OAuth Support for SOAP v2

SOAP v2 now supports OAuth 2.0 access tokens when authorizing web service calls into CPQ. In order to use this feature, customers must have Oracle Identity Cloud configured as an OAuth Provider.

OAuth 2.0 is the industry-standard protocol for authorization. Access Tokens are more secure than basic authentication. We now support access tokens when accessing both REST and SOAP endpoints. We recommend transitioning to OAuth access tokens for all SOAP v2 calls as part of your overall plan for secure communication connection.

Steps to Enable

Pre-Requisite: Before adding OAuth Token support for SOAP V2.0, you must have an OAuth Provider Integration with a valid IDCS registration, client ID, and secret already set up. The OpenID Connect section of the OAuth Provider Integration does not need to be completed to enable this feature.

To test SOAP V2.0 Web Services, complete the following steps:

  1. Login to Oracle CPQ.
  2. Click Web Services from the Integration section of the Admin Home page. The Web Services Test page displays.

Web Services Test

  1. Select 2.0 from the Web Services Version drop-down.
  2. Enter your specific OAuth 2.0 Token. Refer to Oracle Identity Cloud Services (IDCS) for your OAuth access token.
  3. Enter the SOAP Server URL.
  4. Select the desired API from the Select API drop-down.
  5. Select the Process Name from the drop-down.
  6. Click Submit  for the SOAP v2 call.

Tips And Considerations

  • SOAP v1 does not support OAuth token.
  • SOAP v2 OAuth 2.0 Token is an optional field. Oracle CPQ 25A continues to support Basic Auth using Username and Password token entries. However, we recommend planning the transition to OAuth token as a secure communication connection.
  • When testing the OAuth connection, note the following: 
    • When present, the OAuth token takes precedence over the Basic Auth Username token. 
    • A Username token is automatically generated. However, when the OAuth token is present, OAuth will take precedence over the Username.
    • Follow IDCS documentation to generate the assertions and verify that it works.
  • SOAP v2 WSDL functionality is not changed by OAuth token support.