SOAP authentication (Overview)

  • Updated on Nov 18, 2025
  • Published on Jul 7, 2025
  • 4 minute(s) read
Prev Next

The SOAP authentication interface exposes various authentication commands (see Table: SOAP authentication commands (Overview)).

  Table:  SOAP authentication commands (Overview)
CommandDescription
authUserPerforms a user authentication operation on OneSpan Authentication Server (see  authUser (Command)).
cancelAuthUserCancels a pending user authentication based on Push Notification (see cancelAuthUser (Command)).
changeBackendPasswordThe user can change the static Active Directory password with a configured back end for OneSpan Authentication Server via a user self-management website (see changeBackendPassword (Command)).
changeEncStatPwdDeprecated. Changes the PIN and static password for a Digipass 110 authenticator (see changeEncStatPwd (Command)).
getChallengeRequests the OneSpan Authentication Server to generate an authentication challenge, i.e. 1-step challenge (see getChallenge (Command)).
getPreparedSecureChallengeUsed during the Push Notification authentication workflow by the mobile application to fetch the secure challenge for the authentication process (see getPreparedSecureChallenge (Command)).
getSecureChallenge

Requests OneSpan Authentication Server to generate a request message that can be used to initiate an authentication process (see getSecureChallenge (Command)).

Applies if Secure Channel is supported.

updatePasswordPerforms a static password update operation on OneSpan Authentication Server (see  updatePassword (Command)).

The SOAP authentication commands support different credential field attributes (see Table: SOAP authentication credential field attributes).

  Table:  SOAP authentication credential field attributes
Attribute nameData typeDescription
CREDFLD_ADMIN_PRIVILEGESString

The administration privileges of the user.

Up to 255 characters.

CREDFLD_AUTH_TYPEString

Determines the authentication type. This is used to force a specific authentication workflow. If omitted, the authentication command uses its default behavior to determine the workflow type.

Possible values:

  • PUSH_NOTIFICATION. Triggers an authentication via push notifications (push and login). A keyword is not required in this case.
  • SCAN. Triggers a scan and login workflow. A keyword is not required in this case.
CREDFLD_AUXILIARY_MESSAGEString

The serialized error stack.

Only specified if authuser request is not successful.

CREDFLD_CESPRStringDeprecated. This is the change encrypted static password request generated by the Digipass 110 applet required for the changeEncStatPwd command.
CREDFLD_CHALLENGEStringThe challenge used to generate a response for challenge/response authentication.
CREDFLD_CHALLENGE_KEYStringThe challenge key used to refer to a challenge generated by OneSpan Authentication Server.
CREDFLD_CHALLENGE_MESSAGEStringThe message to be displayed to the end users asking them to use the returned challenge.
CREDFLD_COMPONENT_TYPEStringSOAP client application identifier.
CREDFLD_CONFIRM_NEW_PINStringThe confirmation of the new server PIN to be set.
CREDFLD_CONFIRM_STATIC_PASSWORDString

The confirmation of the new static password to be set.

Up to 255 characters.

CREDFLD_CONTROLLER_TYPEStringSSM/HSM-Safenet
CREDFLD_CRYPTO_APP_INDEXUnsigned Integer

The index of the authenticator application to use when you initiate an authentication process using Secure Channel (see  getSecureChallenge (Command)). The specified authenticator application must be allowed by the effective policy.

If not specified, the first applicable authenticator application is used by default.

You can determine the application index with the DIGIPASSAPPLCMD_GETINFO command.

Possible values: 1–n

CREDFLD_CRYPTO_APP_NAMEString

The name of the authenticator application to use when you initiate an authentication process using Secure Channel (see getSecureChallenge (Command)). The specified authenticator application must be allowed by the effective policy.

If not specified, the first applicable authenticator application is used by default.

You can retrieve the application names of an authenticator with the digipassapplQuery (Command) command.

Up to 12 characters.

CREDFLD_CURRENT_PINStringThe current server PIN to be changed.
CREDFLD_DIGIPASS Input of authenticator credentials.
CREDFLD_DOMAINString

As output, the user's resolved domain will be specified.

Up to 255 characters.

CREDFLD_DP_RESPONSEStringThe one-time password (OTP) generated by the authenticator (only used if CREDFLD_PASSWORD_FORMAT is set to 4).
CREDFLD_HOST_CODEStringThe host code, only returned if the corresponding attribute field was specified in the authentication request and the authentication has been successful.
CREDFLD_LOGICAL_ADMIN_PRIVILEGESString

A comma-separated list of the assigned administrative privileges.

Each administrative privilege is specified as follows:

privilege_name [true|false]

For a list of possible values, see Table: Logical administrative privileges.

CREDFLD_NEW_PINStringThe new server PIN to be set.
CREDFLD_NEW_STATIC_PASSWORDString

The new static password to be set.

Up to 255 characters.

CREDFLD_NONCEString

Random character string. The nonce value is used to associate client sessions with ID tokens when using OpenID Connect (OIDC) for authentication.

Availability: 3.27 and later

CREDFLD_NOTIFY_GRACE_EXPIRE_DATEDate 
CREDFLD_NOTIFY_GRACE_PERIOD_EXPIREDBoolean 
CREDFLD_NOTIFY_PASSWORD_EXPIRE_DATEDateTime

The date and time when the static password expires.

Format: YYYY-MM-DDThh:mm:ssZ

CREDFLD_NOTIFY_PASSWORD_RANDOMIZEBoolean 
CREDFLD_NOTIFY_REQUIRE_PIN_CHANGEBoolean 
CREDFLD_NOTIFY_TOKEN_IS_ASSIGNEDBoolean 
CREDFLD_ORGANIZATIONAL_UNITString

Indicates the user's resolved organizational unit.

Up to 255 characters.

CREDFLD_PASSWORDStringThe combined password string (only if CREDFLD_PASSWORD_FORMAT is set to 0).
CREDFLD_PASSWORD_FORMATUnsigned Integer

Possible values:

  • 0. Cleartext combined password format.
  • 4. Different authentication elements are provided into separate parameters in cleartext.
  • 5. Password is an authorization code for OpenID Connect (OIDC).
CREDFLD_PLATFORMStringLinux/Windows
CREDFLD_PRODUCT_NAMEStringThe product name of the OneSpan Authentication Server instance.
CREDFLD_PRODUCT_VERSIONString

The product version of the OneSpan Authentication Server instance including the build number.

Format: major.minor.patch.build

CREDFLD_REQUEST_BODYString

The clear request body used to generate the challenge request message for an authentication process using Secure Channel.

Applies if Secure Channel is supported.

Up to 512 characters.

CREDFLD_REQUEST_HOST_CODEString

Possible values:

  • 0. No.
  • 1. Optional.
  • 2. Required.

Only the number should be used.

CREDFLD_REQUEST_MESSAGEString

The secure challenge request message.

Applies if Secure Channel is supported.

Up to 1070 hexadecimal characters.

CREDFLD_RESTRICT_ADMIN_PRIVILEGE_ASSIGNMENTString 
CREDFLD_SERIAL_NOString

As input, the serial number of the authenticator to be used for the respective command.

As output, the serial number of the authenticator (instance) that was used to perform the respective operation.

Up to 255 characters.

CREDFLD_SERVER_LOCAL_TZStringServer local timezone.
CREDFLD_SESSION_IDString

The session ID for a wireless RADIUS session. May be used for fast reconnect.

Up to 255 characters.

CREDFLD_STATIC_PASSWORDString

Only used if CREDFLD_PASSWORD_FORMAT is 4.

Up to 255 characters.

CREDFLD_STATUS_MESSAGEString

The reason of failure.

Only specified if an authuser request is not successful.

CREDFLD_STORAGE_TYPEStringODBC/LDAP
CREDFLD_USER_ATTRIBUTE_GROUPString

The user attribute group name for the attributes you want to be returned after a successful authentication.

Up to 255 characters.

CREDFLD_USERIDString

The user ID as provided by the calling application (no specific format is required).

As output, the resolved user ID will be specified.

Up to 255 characters.

CREDLFD_SVR_PUBLIC_KEYStringServer public key
CREDLFD_TRANSACTION_TITLEString

The title of a secure challenge transaction.

Applies if Secure Channel is supported.

Up to 255 characters.

Table: Logical administrative privileges lists the available logical admin privileges.

  Table: Logical administrative privileges
access_all_domainsaccess_domainaccess_private_report
admin_logonapprove_reject_pending_operationassign_digipass
axsguard_system_administrationbind_digipassbulk_cleanup_digipass_data
cancel_taskchange_ownership_reportfilechange_report_owner
create_backendcreate_componentcreate_domain
create_keycreate_orgunitcreate_policy
create_reportcreate_userdeactivate_digipass
decrypt_digipass_information_messagedelete_admin_sessiondelete_audit_information
delete_backenddelete_componentdelete_digipass
delete_domaindelete_keydelete_orgunit
delete_pending_operationdelete_policydelete_report
delete_reportfiledelete_taskdelete_user
disable_server_pindisable_userdownload_reportfile
enable_disable_maker_checkerenable_server_pinenable_user
encrypt_digipass_request_messageforce_pin_changegenerate_dpappl_activation_data
generate_virtual_otpimport_digipassimport_user
link_userlive_auditmove_digipass
move_userreplication_reconnectreplication_status
reset_activationreset_dpapplreset_dpappl_lock
reset_last_authentication_timereset_offline_datareset_password
reset_pinresume_taskrotate_key
run_reportsend_digipass_activation_datasend_notification
set_admin_domainsset_auth_policy_overridesset_digipass_expiration
set_dpappl_eventset_passwordset_pin
set_privilegesset_user_expirationsuspend_task
take_ownership_reportfiletake_task_ownershiptest_otp
test_signatureunassign_digipassunbind_digipass
unlink_userunlock_digipassunlock_user
update_backendupdate_componentupdate_configuration
update_digipassupdate_domainupdate_key
update_orgunitupdate_policyupdate_report
update_server_configurationupdate_taskupdate_user
view_admin_sessionview_audit_informationview_backend
view_componentview_configurationview_digipass
view_domainview_keyview_orgunit
view_policyview_privilegesview_recent_digipass_activity
view_recent_user_activityview_reportview_reportfile
view_server_configurationview_taskview_usage_information
view_user