Additional build steps required:
Client-Side Usage
HTTP Basic Authentication is the default authentication supported by gSOAP. The credentials for client-side use age set with:
soap.userid = "<userid>";
soap.passed = "<passwd>";
if (soap_call_ns__method(&soap, ...))
...
HTTP Basic Authentication should never be used over plain HTTP, because the user ID and password are sent in the clear. It is safe(r) to use over HTTPS, because the HTTP headers and body are encrypted.
The better alternative is to use HTTP Digest Authentication, which uses the digest (hash value) of the credentials and avoids a plain-text password exchange.
To use HTTP Digest Authentication with gSOAP, register the http_da plugin:
soap_register_plugin(&soap,
http_da);
To make a client-side service call:
if (soap_call_ns__method(&soap, ...))
{
if (soap.error == 401)
{
http_da_save(&soap, &info,
"<authrealm>",
"<userid>",
"<passwd>");
if (soap_call_ns__method(&soap, ...))
...
}
else
...
}
The "<authrealm>" is a string that is associated with the server's realm. It can be obtained after an unsuccessful non-authenticated call:
if (soap_call_ns__method(&soap, ...))
{
if (soap.error == 401)
{
const char *realm = soap.authrealm;
...
}
else
...
}
Before a second call is made to the same endpoint that requires authentication, you must restore the authentication state and then finally release it:
bool auth = false;
if (soap_call_ns__method(&soap, ...))
{
if (soap.error == 401)
{
http_da_save(&soap, &info,
"<authrealm>",
"<userid>",
"<passwd>");
auth = true;
}
else
...
}
if (soap_call_ns__method(&soap, ...))
...
if (auth)
if (soap_call_ns__method(&soap, ...))
...
soap_destroy(&soap);
soap_end(&soap);
if (auth)
if (soap_call_ns__method(&soap, ...))
...
if (auth)
soap_destroy(&soap);
soap_end(&soap);
soap_done(&soap);
For HTTP proxies requiring HTTP Digest Authenticaiton, use the 'proxy' functions:
...
if (soap_call_ns__method(&soap, ...))
{
if (soap.error == 407)
{
auth = true;
}
else
...
}
if (auth)
if (soap_call_ns__method(&soap, ...))
...
soap_destroy(&soap);
soap_end(&soap);
soap_done(&soap);
Client Example
A client authenticating against a server:
soap_register_plugin(&soap,
http_da);
if (soap_call_ns__method(&soap, ...))
{
if (soap.error == 401)
{
{
if (soap_call_ns__method(&soap, ...) == SOAP_OK)
{
...
soap_end(&soap);
...
if (!soap_call_ns__method(&soap, ...) == SOAP_OK)
...
A client authenticating against a proxy:
soap_register_plugin(&soap,
http_da);
if (soap_call_ns__method(&soap, ...))
{
if (soap.error == 407)
{
{
if (soap_call_ns__method(&soap, ...) == SOAP_OK)
{
...
soap_end(&soap);
...
if (!soap_call_ns__method(&soap, ...) == SOAP_OK)
...
Server-Side Usage
Server-side HTTP Basic Authentication can be enforced by simply checking the soap.userid and soap.passwd values in a service method that requires client authentication:
soap_register_plugin(&soap,
http_da);
...
soap_serve(&soap);
...
int ns__method(struct soap *soap, ...)
{
if (!soap->userid || !soap->passwd || strcmp(soap->userid, "<userid>") || strcmp(soap->passwd, "<passwd>"))
return 401;
...
}
HTTP Digest Authentication is verified differently:
soap_register_plugin(&soap,
http_da);
...
soap_serve(&soap);
...
int ns__method(struct soap *soap, ...)
{
if (soap->authrealm && soap->userid)
{
{
{
...
return SOAP_OK;
}
}
}
return 401;
The http_da_verify_post() function checks the HTTP POST credentials. To verify an HTTP GET operation, use http_da_verify_get().
Server Example
soap_register_plugin(&soap,
http_da);
...
soap_serve(&soap);
...
int ns__method(struct soap *soap, ...)
{
if (soap->userid && soap->passwd)
{
if (!strcmp(soap->userid,
userid) && !strcmp(soap->passwd,
passwd))
{
...
...
return SOAP_OK;
}
}
else if (soap->authrealm && soap->userid)
{
{
{
...
return SOAP_OK;
}
}
}
return 401;
}
HTTP Digest Authentication Limitations
HTTP Digest Authentication cannot be used with streaming MTOM/MIME/DIME attachments. Streaming is turned off by the plugin and attachment data is buffered rather than streamed. Non-streaming MTOM/MIME/DIME attachments are handled just fine.