Skip to page contentSkip to chat
ServiceNow support
    • Community
      Ask questions, give advice, and connect with fellow ServiceNow professionals.
      Developer
      Build, test, and deploy applications
      Documentation
      Find detailed information about ServiceNow products, apps, features, and releases.
      Impact
      Accelerate ROI and amplify your expertise.
      Learning
      Build skills with instructor-led and online training.
      Partner
      Grow your business with promotions, news, and marketing tools
      ServiceNow
      Learn about ServiceNow products & solutions.
      Store
      Download certified apps and integrations that complement ServiceNow.
      Support
      Manage your instances, access self-help, and get technical support.
Inbound Web service Security Configuration - Support and Troubleshooting
  • >
  • Knowledge Base
  • >
  • Support and Troubleshooting (Knowledge Base)
  • >
  • Inbound Web service Security Configuration
KB0546239

Inbound Web service Security Configuration


1551 Views Last updated : Aug 22, 2022 public Copy Permalink
KB Summary by Now Assist

Issue

Inbound Web Service Security Configuration

Requirement

  • Configure Web Service Security for inbound SOAP web services
  • Configure WSS for inbound requests with different certificates for different clients

Resolution

Use WS-Security. This functionality is available starting with the Dublin release.

  • Set up Certificates as required in sys_certificate table
  • Set up WS Profile
  • Set up SOAP Web Service
  • Configure glide.soap.default_security_policy property with newly created security policy name

Details

WS Security is message-level security for SOAP web services. Here a signature element is added to the header element of the soap request. This signature is validated at the Servicenow instance based on the certificate configured. If a man-in-middle tamper request body, it won’t match with the signature added during the generation of the SOAP request.

There is no support for encryption.

WS Profiles provide a way to configure different profiles while Security Policy determines what profiles to validate and how to authenticate (either all of the profiles or one of them) the request. If no policy is created or defined, all configured WS Profiles are evaluated on all incoming requests.

Another important to note is that once you configure WS Profiles or Security Policy, validation is performed on all incoming SOAP requests, including MID and ODBC. You must exclude MID and ODBC requests from validation by following the steps in the following article.


The world works with ServiceNow.

Sign in for more! There's more content available only to authenticated users Sign in for more!
Did this KB article help you?
Did this KB article help you?

How would you rate your Now Support digital experience?

*

Very unsatisfied

Unsatisfied

Neutral

Satisfied

Very satisfied

Very unsatisfied

Unsatisfied

Neutral

Satisfied

Very satisfied

What can we improve? Please select all that apply.

What are we doing well? Please select all that apply.

Tell us more

*

Do you expect a response from this feedback?

  • Terms and conditions
  • Privacy statement
  • GDPR
  • Cookie policy
  • © 2025 ServiceNow. All rights reserved.