Configuring Authentication and Connectivity for API Scans

You can configure proxy settings, network authentication, and site authentication on the Authentication and Connectivity page of the API Scan Wizard. Options for configuring authentication include the following:

• Configuring Proxy Settings for API and Web Service Scans

• Configuring Network Authentication for API and Web Service Scans

• Using a Client Certificate

• Using Custom Headers

• Configuring SOAP Authentication

Configuring Proxy Settings for API and Web Service Scans

If you need to access the target site through a proxy server, you can configure proxy settings on the Authentication and Connectivity page of the API Scan Wizard.

To configure proxy settings:

• Select Network Proxy and then choose an option from the Proxy Profile list:

  • Auto Detect: Use the Web Proxy Autodiscovery Protocol (WPAD) to locate a proxy autoconfig file and use this to configure the browser's Web proxy settings.

  • Use System Proxy: Import your proxy server information from the local machine.

  • Use PAC File: Load proxy settings from a Proxy Automatic Configuration (PAC) file. If you select this option, click Edit to enter the location (URL) of the PAC.

  • Use Explicit Proxy Settings: Specify proxy server settings. If you select this option, click Edit to enter proxy information.

  • Use Mozilla Firefox: Import your proxy server information from Firefox.

  Note: Electing to use browser proxy settings does not guarantee that you will access the Internet through a proxy server. If the Firefox browser connection settings are configured for "No proxy," or if the Internet Explorer setting "Use a proxy server for your LAN" is not selected, then a proxy server will not be used.

Configuring Network Authentication for API and Web Service Scans

You can configure network authentication for accessing the Web server on the Authentication and Connectivity page of the API Scan Wizard.

To configure network authentication for the Web server:

1. Select Network Authentication.

2. In the Method drop-down list, select an authentication method. The API Type determines the available authentication methods. The complete list of methods is:

   • ADFS CBT

   • Automatic

   • Basic

   • Bearer

   • Custom

   • Digest

   • Kerberos

   • Negotiate

   • NT LAN Manager (NTLM)

   Note: The ADFS CBT, Automatic, Kerberos, and Negotiate methods are not applicable to scans that use AuthProviders.

3. Continue according to the following table.

   For this authentication type...	Do this...
   ADFS CBT Automatic Basic Digest Kerberos Negotiate NTLM	Type the authentication username in the Username box. Type the authentication password in the Password box.
   Custom	Type the custom header name or token name in the Scheme box. Type the token value in the Parameter box. When using Custom, you can fetch a token that is generated from a response to a workflow macro, and then use the token to apply state. For more information, see Fetching a Token Value.
   Bearer	Type the token value in the Parameter box. When using Bearer, you can fetch a token that is generated from a response to a workflow macro, and then use the token to apply state. For more information, see Fetching a Token Value.

Fetching a Token Value

You can use a custom regular expression to fetch the token value from a login or workflow macro. If a match to the regular expression occurs in the response, then the value is fetched and used as a bearer token. If the regular expression contains parentheses, then the value inside the parentheses will be extracted and used as a bearer token. Only the first value inside parentheses will be used.

To fetch a token value:

1. Select Fetch Token From Macro.

2. Do one of the following:

   • To import an existing macro, click , and then locate and select the file to import.

   • To record a macro, click .

3. Type a regular expression for pattern matching in the Fetch Token Search Pattern box.

4. Do one of the following:

   • To have each scan thread run its own fetch macro playback and apply the bearer token value to the thread, select the Isolate State check box.

   • To have only one fetch macro playback run for all scan threads and the single shared bearer token value apply to all threads, clear the Isolate State check box.

Using a Client Certificate

Client certificate authentication allows users to present client certificates rather than entering a user name and password for site authentication. You can enable the use of a certificate and then import the certificate to the scan settings.

To use a client certificate:

1. Select Client Certificate.

2. Click .

   A standard Windows file selection dialog box opens.

3. Locate and select the certificate file, and then click Open.

   The certificate file is added to the Client Certificate box.

4. Enter the password in the Client Certificate Password box.

Using Custom Headers

If additional or different headers are required for authentication purposes, then you must add the information as a Custom Header.

You can configure multiple custom headers.

To add a custom header:

1. Select Custom Headers.

2. Click Add....

3. In the Name box, type the custom HTTP header name. For example, X-MyCustomAuth.

   Important! The header must be unique and cannot be Authorization.

4. In the Scheme box, type the header value prefix name. For example, CustomToken.

5. In the Parameter box, type the custom header value.

6. Click OK.

   The custom header is added to the list.

To edit a custom header:

1. In the Custom Headers list, select the custom header you want to edit.

2. Click Edit....

3. Follow steps 3 through 6 of the procedure To add a custom header:.

To remove a custom header:

1. In the Custom Headers list, select the custom header you want to remove.

2. Click Remove.

Configuring SOAP Authentication

You can configure message-based authentication for SOAP scans.

To configure SOAP authentication settings:

1. Select SOAP Authentication.

2. Select that authentication method to use from the SOAP Method list. Options are Username Token and Certificate Pair.

3. Continue according to the following table.

   For this SOAP method...	Do this...
   Username Token	In the Username box, type the user name whose credentials are used to access the SOAP service. In the Password box, type the password for the user name. In the Username Token Type list, select the type of token. Options are Text and Hash. In the Timestamp list, select an option for when the Username Token was created and when it expires. Options are Created, Full, and None. If nonce is enabled for the token, select Include nonce. Important! Nonce is required for hash tokens because it helps the server to recalculate the hash and compare it to the data the client sent.
   Certificate Pair	Click to the right of the Client Certificate box. A standard Windows file selection dialog box opens. Locate and select the certificate file, and then click Open. The certificate file is added to the Client Certificate box. In the Client Certificate Password box, type the password. Click to the right of the Server Certificate box. A standard Windows file selection dialog box opens. Locate and select the certificate file, and then click Open. The certificate file is added to the Server Certificate box. In the Server Certificate Password box, type the password.

4. Optionally, to identify the Web Services Addressing (WS-Addressing) schema version used by the SOAP service, select WS Addressing and continue as follows:

   1. In the Schema Version list, select the version. Options are NONE, WSA0408, and WSA0508.

   2. In the WSA: To box, enter the URL override for the Web service host.

      Note: SOAP services may be exposed by way of a load balancer or reverse proxy. This configuration may prevent the sensor from getting the correct information for the internal Web service host name. The "WSA: To" URL override provides the correct address into WS Addressing.

      The URL override uses the following format:

      https://<host_name><service_path>/<port_name>

What's Next?

Do one of the following:

• If you are configuring a legacy Web services scan using a Web Service Definition Language (WSDL) file or an existing Web Service Test Design (WSD) file, click Next and proceed with Configuring Scan Details for API and Web Service Scans.

• For all other API scans, click Next and proceed with Configuring API Content and Filters.