SOAP Authentication (Overview)

  • Published on Jul 7, 2025
  • 3 minute(s) read
Prev Next

The SOAP authentication interface exposes various authentication commands (see Table: SOAP authentication commands (Overview)).

  Table:  SOAP authentication commands (Overview)
CommandDescription
authUserError codesPerforms a user authentication operation on OneSpan Authentication Server (see  authUser (Command)).
cancelAuthUserCancels a pending user authentication based on Push Notification (see cancelAuthUser (Command)).
changeBackendPasswordThe user can change the static Active Directory password with a configured back end for OneSpan Authentication Server via a user self-management website (see changeBackendPassword (Command)).
changeEncStatPwdDeprecated. Changes the PIN and static password for a Digipass 110 authenticator (see changeEncStatPwd (Command)).
getChallengeRequests the OneSpan Authentication Server to generate an authentication challenge, i.e. 1-step challenge (see getChallenge (Command)).
getPreparedSecureChallengeUsed during the Push Notification authentication workflow by the mobile application to fetch the secure challenge for the authentication process (see getPreparedSecureChallenge (Command)).
getSecureChallenge

Requests OneSpan Authentication Server to generate a request message that can be used to initiate an authentication process (see getSecureChallenge (Command)).

Applies if Secure Channel is supported.

updatePasswordPerforms a static password update operation on OneSpan Authentication Server (see  updatePassword (Command)).

The SOAP authentication commands support different credential field attributes (see Table: SOAP authentication credential field attributes).

  Table:  SOAP authentication credential field attributes
Attribute nameData typeDescription
CREDFLD_ADMIN_PRIVILEGESString

The administration privileges of the user.

Up to 255 characters.

CREDFLD_AUTH_TYPEString

Determines the authentication type. This is used to force a specific authentication workflow. If omitted, the authentication command uses its default behavior to determine the workflow type.

Possible values:

  • PUSH_NOTIFICATION. Triggers an authentication via push notifications (push and login). A keyword is not required in this case.
  • SCAN. Triggers a scan and login workflow. A keyword is not required in this case.
CREDFLD_AUXILIARY_MESSAGEString

The serialized error stack.

Only specified if authuser request is not successful.

CREDFLD_CESPRStringDeprecated. This is the change encrypted static password request generated by the Digipass 110 applet required for the changeEncStatPwd command.
CREDFLD_CHALLENGEStringThe challenge used to generate a response for challenge/response authentication.
CREDFLD_CHALLENGE_KEYStringThe challenge key used to refer to a challenge generated by OneSpan Authentication Server.
CREDFLD_CHALLENGE_MESSAGEStringThe message to be displayed to the end users asking them to use the returned challenge.
CREDFLD_COMPONENT_TYPEStringSOAP client application identifier.
CREDFLD_CONFIRM_NEW_PINStringThe confirmation of the new server PIN to be set.
CREDFLD_CONFIRM_STATIC_PASSWORDString

The confirmation of the new static password to be set.

Up to 255 characters.

CREDFLD_CONTROLLER_TYPEStringSSM/HSM-Safenet
CREDFLD_CRYPTO_APP_INDEXUnsigned Integer

The index of the authenticator application to use when you initiate an authentication process using Secure Channel (see  getSecureChallenge (Command)). The specified authenticator application must be allowed by the effective policy.

If not specified, the first applicable authenticator application is used by default.

You can determine the application index with the DIGIPASSAPPLCMD_GETINFO command.

Possible values: 1–n

CREDFLD_CRYPTO_APP_NAMEString

The name of the authenticator application to use when you initiate an authentication process using Secure Channel (see getSecureChallenge (Command)). The specified authenticator application must be allowed by the effective policy.

If not specified, the first applicable authenticator application is used by default.

You can retrieve the application names of an authenticator with the digipassapplQuery (Command) command.

Up to 12 characters.

CREDFLD_CURRENT_PINStringThe current server PIN to be changed.
CREDFLD_DIGIPASS Input of authenticator credentials.
CREDFLD_DOMAINString

As output, the user's resolved domain will be specified.

Up to 255 characters.

CREDFLD_DP_RESPONSEStringThe one-time password (OTP) generated by the authenticator (only used if CREDFLD_PASSWORD_FORMAT is set to 4).
CREDFLD_HOST_CODEStringThe host code, only returned if the corresponding attribute field was specified in the authentication request and the authentication has been successful.
CREDFLD_LOGICAL_ADMIN_PRIVILEGESString

A comma-separated list of the assigned administrative privileges.

Each administrative privilege is specified as follows:

privilege_name [true|false]

For a list of possible values, see Table: Logical administrative privileges.

CREDFLD_NEW_PINStringThe new server PIN to be set.
CREDFLD_NEW_STATIC_PASSWORDString

The new static password to be set.

Up to 255 characters.

CREDFLD_NOTIFY_GRACE_EXPIRE_DATEDate 
CREDFLD_NOTIFY_GRACE_PERIOD_EXPIREDBoolean 
CREDFLD_NOTIFY_PASSWORD_EXPIRE_DATEDateTime

The date and time when the static password expires.

Format: YYYY-MM-DDThh:mm:ssZ

CREDFLD_NOTIFY_PASSWORD_RANDOMIZEBoolean 
CREDFLD_NOTIFY_REQUIRE_PIN_CHANGEBoolean 
CREDFLD_NOTIFY_TOKEN_IS_ASSIGNEDBoolean 
CREDFLD_ORGANIZATIONAL_UNITString

Indicates the user's resolved organizational unit.

Up to 255 characters.

CREDFLD_PASSWORDStringThe combined password string (only if CREDFLD_PASSWORD_FORMAT is set to 0).
CREDFLD_PASSWORD_FORMATUnsigned Integer

Possible values:

  • 0. Cleartext combined password format.
  • 4. Different authentication elements are provided into separate parameters in cleartext.
CREDFLD_PLATFORMStringLinux/Windows
CREDFLD_PRODUCT_NAMEStringThe product name of the OneSpan Authentication Server instance.
CREDFLD_PRODUCT_VERSIONString

The product version of the OneSpan Authentication Server instance including the build number.

Format: major.minor.patch.build

CREDFLD_REQUEST_BODYString

The clear request body used to generate the challenge request message for an authentication process using Secure Channel.

Applies if Secure Channel is supported.

Up to 512 characters.

CREDFLD_REQUEST_HOST_CODEString

Possible values:

  • 0. No.
  • 1. Optional.
  • 2. Required.

Only the number should be used.

CREDFLD_REQUEST_MESSAGEString

The secure challenge request message.

Applies if Secure Channel is supported.

Up to 1070 hexadecimal characters.

CREDFLD_RESTRICT_ADMIN_PRIVILEGE_ASSIGNMENTString 
CREDFLD_SERIAL_NOString

As input, the serial number of the authenticator to be used for the respective command.

As output, the serial number of the authenticator (instance) that was used to perform the respective operation.

Up to 255 characters.

CREDFLD_SERVER_LOCAL_TZStringServer local timezone.
CREDFLD_SESSION_IDString

The session ID for a wireless RADIUS session. May be used for fast reconnect.

Up to 255 characters.

CREDFLD_STATIC_PASSWORDString

Only used if CREDFLD_PASSWORD_FORMAT is 4.

Up to 255 characters.

CREDFLD_STATUS_MESSAGEString

The reason of failure.

Only specified if an authuser request is not successful.

CREDFLD_STORAGE_TYPEStringODBC/LDAP
CREDFLD_USER_ATTRIBUTE_GROUPString

The user attribute group name for the attributes you want to be returned after a successful authentication.

Up to 255 characters.

CREDFLD_USERIDString

The user ID as provided by the calling application (no specific format is required).

As output, the resolved user ID will be specified.

Up to 255 characters.

CREDLFD_SVR_PUBLIC_KEYStringServer public key
CREDLFD_TRANSACTION_TITLEString

The title of a secure challenge transaction.

Applies if Secure Channel is supported.

Up to 255 characters.

Table: Logical administrative privileges lists the available logical admin privileges.

  

  Table: Logical administrative privileges
access_all_domainsaccess_domainaccess_private_report
admin_logonapprove_reject_pending_operationassign_digipass
axsguard_system_administrationbind_digipassbulk_cleanup_digipass_data
cancel_taskchange_ownership_reportfilechange_report_owner
create_backendcreate_componentcreate_domain
create_emvcap_applicationcreate_keycreate_orgunit
create_policycreate_reportcreate_user
deactivate_digipassdecrypt_digipass_information_messagedelete_admin_session
delete_audit_informationdelete_backenddelete_component
delete_digipassdelete_domaindelete_key
delete_orgunitdelete_pending_operationdelete_policy
delete_reportdelete_reportfiledelete_task
delete_userdisable_server_pindisable_user
download_reportfileenable_disable_maker_checkerenable_server_pin
enable_userencrypt_digipass_request_messageforce_pin_change
generate_dpappl_activation_datagenerate_virtual_otpimport_digipass
import_userlink_userlive_audit
move_digipassmove_userreplication_reconnect
replication_statusreset_activationreset_dpappl
reset_dpappl_lockreset_last_authentication_timereset_offline_data
reset_passwordreset_pinresume_task
rotate_keyrun_reportsend_digipass_activation_data
send_notificationset_admin_domainsset_auth_policy_overrides
set_digipass_expirationset_dpappl_eventset_password
set_pinset_privilegesset_user_expiration
suspend_tasktake_ownership_reportfiletake_task_ownership
test_otptest_signatureunassign_digipass
unbind_digipassunlink_userunlock_digipass
unlock_userupdate_backendupdate_component
update_configurationupdate_digipassupdate_domain
update_keyupdate_orgunitupdate_policy
update_reportupdate_server_configurationupdate_task
update_userview_admin_sessionview_audit_information
view_backendview_componentview_configuration
view_digipassview_domainview_emv_pan
view_keyview_orgunitview_policy
view_privilegesview_recent_digipass_activityview_recent_user_activity
view_reportview_reportfileview_server_configuration
view_taskview_usage_informationview_user