Require authorization for SOAP requests

  • Release version: Australia
  • Updated March 12, 2026
  • 1 minute to read

    • Use the glide.basicauth.required.soap property to designate if incoming SOAP requests should require basic authorization.

    The glide.basicauth.required.soap system property controls whether basic authentication is required to make a SOAP request to an instance. If glide.basicauth.required.soap is not set to the recommended value of true, then unauthenticated users performing SOAP operations are mapped to the soap.guest user. This may enable an unauthenticated user to perform operations on the instance as if a logged in user to the instance. There may be additional impact if the user define within com.glide.soap.guest_user is assigned additional roles.

    Ensure that the property glide.basicauth.required.soap exists in the System Properties [sys_properties] tableand is set to the value true. Alternatively, configure the instance for WS Security by setting the property glide.soap.require_ws_security to true and following the product documentation to configure WS Security Profiles. If the property does not appear in the System Properties [sys_properties] table, add a new record.

    Warning:
    This is a safe harbor property, meaning the value can't be altered once it's changed. It is non-revertible.

    More information

    Attribute Description
    Configuration name
    • glide.basicauth.required.soap
    • glide.soap.require_ws_security
    Configuration type System Properties (/sys_properties_list.do)
    Data type Boolean
    Recommended value
    • true
    • true
    Default value false
    Fallback value
    • <none>
    • <none>
    Category API and web service
    Security risk
    • Severity score: 8.1
    • CVSS rating: High
    • Security risk details: Unauthenticated access to SOAP export data, when combined with misconfigured guest user role, poses a significant risk of unauthorized data exposure.
    Functional impact This remediation enforces a combination of authentication methods, in the form of basic authentication and system level access control.
    • It performs this authentication while retrieving data from tables/pages in the form of SOAP data on the instance.
    • It restricts any guest users who are currently accessing this data.
    • Create an account for a user who needs access to this content, with the necessary access control permissions.

    To learn more, see SOAP web service and MID Server authentication credentials and SOAP requests.
    Dependencies and prerequisites None