# SOAP Basic HTTP authentication with a policy in CTP

**URL:** <https://techcommunity.softwareag.com/t/soap-basic-http-authentication-with-a-policy-in-ctp/243467>\
**Category:** Knowledge base\
**Tags:** soap, CTP, Software-AG-Runtime, basic-auth, WSS, Web-Services-Stack\
**Created:** [August 9, 2021, 9:51am UTC](https://techcommunity.softwareag.com/t/soap-basic-http-authentication-with-a-policy-in-ctp/243467 "2021-08-09T09:51:58Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Esin\_Yakub](https://avatars.discourse-cdn.com/v4/letter/e/e47c2d/32.png) [@Esin\_Yakub](https://techcommunity.softwareag.com/u/Esin_Yakub)\
**Post date:** [August 9, 2021, 9:51am UTC](https://techcommunity.softwareag.com/t/soap-basic-http-authentication-with-a-policy-in-ctp/243467/1 "2021-08-09T09:51:58Z")

</div>

Add the following in the `services.xml` of your AAR service archive:

```auto
        <module ref="rampart"/>
        <parameter name="sin.jaas.transport.login.context">Default</parameter>
        <wsp:Policy wsu:Id="BasicAuthPolicy" xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"
          xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
          <wsp:ExactlyOne>
                <wsp:All>
                    <sp:TransportBinding xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
                        <wsp:Policy>
                            <sp:TransportToken>
                                <wsp:Policy>
                                    <sp:HttpsToken>
                                        <wsp:Policy>
                                            <sp:HttpBasicAuthentication/>
                                        </wsp:Policy>
                                    </sp:HttpsToken>
                                </wsp:Policy>
                            </sp:TransportToken>
                            <sp:AlgorithmSuite>
                                <wsp:Policy>
                                    <sp:Basic256/>
                                </wsp:Policy>
                            </sp:AlgorithmSuite>
                            <sp:Layout>
                                <wsp:Policy>
                                    <sp:Lax/>
                                </wsp:Policy>
                            </sp:Layout>
                            <sp:IncludeTimestamp/>
                        </wsp:Policy>
                    </sp:TransportBinding>
                    <ramp:RampartConfig xmlns:ramp="http://ws.apache.org/rampart/policy">
                      <ramp:policyValidatorCbClass>com.softwareag.wsstack.jaas.callback.MultiLoginPolicyValidatorCallback</ramp:policyValidatorCbClass>
                    </ramp:RampartConfig>
                </wsp:All>
            </wsp:ExactlyOne>
        </wsp:Policy>

```

- The communication must happen over HTTPS per the SOAP WS-Security specification
- As this is by the WS-Security specification the request to this service should contain a SOAP security header with a timestamp. In SOAP UI - [WS-Security (WSS) for API Testing | SoapUI](https://www.soapui.org/docs/soapui-projects/ws-security/) (Timestamp)
- The MultiLoginPolicyValidatorCallback class makes the connection between the Web Services Stack and the Software AG Security Infrastructure
- The “sin.jaas.transport.login.context” points to a JAAS login context defined in /profiles/CTP/configuration/jaas.config. In this example we have default one which works with the Software AG internal user store (common/conf/users.xml, common/conf/groups.xml, common/conf/roles.xml). New users can be added by using [Reverb](https://documentation.softwareag.com/webmethods/wmsuites/wmsuite10-7/Cross_Product/10-7_Infra_Admin_webhelp/index.html#page/softwareag-infrastructure-admin-guide%2Fcreate.internal.user.repo.file.html%23) , role and group assignment happens by manual edit of the corresponding files.