Glossary Item Box

Government Gateway 2.2.0 (MR-01) ISV Developer Help (Doc Version 06/03/08) | Send comments on this topic.

# Interfaces and Security Tokens

To control access to Gateway Web services, SOAP method requests (normally) include the caller’s identity by placing a security token in the SOAP request message header. The caller can then be authenticated before they are allowed to use the method.

The exceptions are primarily methods (on the SOAP Portal Interface) that register a user with the Gateway, reset a user’s password or get their User ID. In these cases the user cannot be identified (by including a security token) since the user either does not exist on the Gateway yet, or they cannot log on to the Gateway because they have forgotten their password or User ID.

The four options for authentication calls to methods are:

- No security token (as described). Accepted by the SOAP Portal Interface for some methods – there is also one on the SOAP Public Interface).
- UsernameToken. Accepted by the SOAP Admin, KnownFactUpload and DelegatedRights Interface methods.
- X.509SecurityToken. Accepted by the SOAP Admin, KnownFactUpload and DelegatedRights Interface methods.
- GatewayToken. Accepted by the SOAP Portal and Public Interface methods. Note that a UsernameToken, X509SecurityToken, SAML Assertion or a TicketBook security token can be used to request a GatewayToken from the Gateway Security Token Service (STS).

© Crown Copyright 2008. All rights reserved