Encryption.

The Web Services Hub encrypts the repository login information in the configuration file used to connect to the repository. You can also run the Web Services Hub in secure mode and use the SSL protocol for encryption of web service client requests.

Authentication.

For batch web services, the web service client application must call the Login operation before it calls other operations. The Web Services Hub authenticates the request based on the session ID.

For protected real-time web services, the Web Services Hub authenticates the web service client based on the user name token. The web service client must include the user name token in every SOAP request sent to the Web Services Hub. The user name token can include a plain text, hashed, or digested password.

The Web Services Hub does not authenticate web service requests for a public real-time web service.

Authorization.

A web service client with repository access must have permission on a folder to run a service. For protected real-time web services, a web service client with the appropriate permissions on a folder can run a service in that folder based on service configuration. For example, if the service is not runnable, a web service client cannot start the service, but it can invoke the service if the web service workflow is running.