Security

6 Topics

Avoid exfiltering OAuth Credentials in Git Repository
Hi, I am using ReadyAPI to test an OAuth2.0 secured API. I am using a Composite project with Git integration and I do not see how could I make use of Auth Manager without exfiltering my OAuth credentials into Git in plaintext, as part of the settings.xml file, within con:oAuth2ProfileContainer and con:oAuth20AuthEntry I tried using client-id and client-secret as encrypted properties, but as soon as the groovy script sets them in the profile, they appear in clear text in the settings.xml file.
Solved
morehendrix 4 years ago Place ReadyAPI Questions
1.1KViews
1like
3Comments
No Community Help with SAML 2 Config Posts. Can some provide an example of SAML(XML) 2 in SoapUI?
I'm having difficulty configuring SAML authentication using SoapUI Pro and I've read many similar posts in Open Source community; however, they go unanswered. For example, "Could some give a sample example of SAML(XML) in SoapUI WS configuration" and "Enveloped Signature for SAML (XML) WSS Entry". SmartBear's page doesn't provide an example SAML(XML) Assertion. Collaborator has a page that goes into some depth to help the customer, but not SoapUI OS or Pro. We use ForgeRock's OpenAM to setup SAML and I think I’ve gleaned as much as I can from it. For instance, XML Canonicalization algorithm, XML digest algorithm, XML signature algorithm, ID Token Signing Algorithms supported, ID Token Encryption Algorithms supported, Circle of Trust, etc.; however, there’s no 1-for-1 match between what OpenAM provides that SoapUI Pro asks for. I've asked our DevOps/Integration teams for a SAML(XML) Assertion, but they haven't been able to accommodate, yet. Could someone give a sample example of SAML(XML) in SoapUI WS configuration? Regards,
Solved
socaltester 5 years ago Place ReadyAPI Questions
3.9KViews
0likes
6Comments
NTLM Authentication - Password is visible (Security Issue)
Hi, I see password is visible if I use NTLM authentication. It seems like security issue Please advise. Thanks
Solved
Rama16 6 years ago Place ReadyAPI Questions
4.2KViews
0likes
15Comments
How to perform security tests on SOAP request that contains XML in a string attribute.
I have a web service that submits a soap request that contains an XML file in the request in a string element. The actual request (i.e. data that would change in different requests) are in the embedded document. And yes, the xml document is enclosed in CDATA. Is there a way to have the security functionality perform the testing on the elements in the embedded XML document? Thanks.
gelkins 7 years ago Place ReadyAPI Questions
555Views
0likes
0Comments
Configure WSS11 Security Policy
Has anyone had any luck in configuring WSS11 security policy on Soap UI? I am using Ready API 1.4.1. I have attempted to find multiple forum articles regarding this, but no-one seems to have had an answer e.g. - https://community.smartbear.com/t5/SoapUI-NG/Support-for-signature-using-secretkey/td-p/33846 - http://community.smartbear.com/t5/SoapUI-NG/SecretKey-not-supported-due-to-JCEKS-keystores-not-supported/m-p/110835#M25770 It looks like a feature request was raised for this. If anyone has managed to configure this, please get in touch. Thanks.
simonjdonnelly 9 years ago Place ReadyAPI Questions
1.5KViews
0likes
1Comment
SecurePRO (ReadyAPI 1.6.0): How to modify the default assertion "Valie HTTP Status Codes"
We run SecurePRO Security-Tests. Therefore we use all the default scans provided. One of them is "HTTP Method Fuzzing" Request: PATCH http://localhost:14080/rest-service/rest/contact/contacts?languageCode=xx Response: HTTP/1.1 500 Internal Server Error Now, SecurePro isalerting (Warning): Valid HTTP Status Codes: Response status code 500 is not in the list of status codes But I can't find any place to modify the list of valid status codes. Please note, I did not add this assertion manually It's a default assertion as it is alsoa default security scan. Any ideas? Thanks Regards, Reto
rka 9 years ago Place ReadyAPI Questions
2.2KViews
0likes
3Comments