Skip to main content

         This documentation site is for previous versions. Visit our new documentation site for current releases.      

This content has been archived and is no longer being updated.

Links may not function; however, this content may be relevant to outdated versions of the product.

Authentication and Web Services

Updated on September 10, 2021

This presentation is part of the Authentication Overview Self-Study Course.


Web services can be used to establish application-to-application connections and to exchange messages. Authentication of Web Services can be configured to be handled in one of two ways:  1) by the container or 2) by PegaRULES.

When using container-managed security, the container (i.e., the application server) handles the authentication.  There is an example WebSOAPContainerAuth Servlet definition in the web.xml file you can find in the PegaRULES distribution media that shows the requisite configuration.

Alternatively, PRPC can authenticate incoming web services requestors.  The PRSOSAPServlet that manages all incoming web services requests will challenge the requestor for username and password and authenticate incoming requests with the PegaRULES security database.  The user credentials can be passed to the PRSOAPServlet in one of 3 ways:  1) in the HTTP header, 2) in the SOAP envelope header, or 3) in the SOAP envelope body.

The Web Services must be configured as "stateful" in order for the PRSOAPServlet to authenticate requestors.

Have a question? Get answers now.

Visit the Support Center to ask questions, engage in discussions, share ideas, and help others.

Did you find this content helpful?

Want to help us improve this content?

We'd prefer it if you saw us at our best. is not optimized for Internet Explorer. For the optimal experience, please use:

Close Deprecation Notice
Contact us