Web Services Authentication Methods

This is an option for REST services that allow anonymous access. It does not perform any authentication with the REST service.

This is a non-standard authentication mechanism that passes a username and a password in clear text in a query string. This authentication method is not secure and should be avoided.

This is the standard basic access authentication, where the Web Services Connector provides a username and a password in the Authorization header with each call. The credentials are passed as a Base64 encoded string, built by joining the username and password with a single colon (:). This authentication method should only be used with HTTPS connections, as the credentials are passed in clear text. Learn more

This is an older authentication protocol that is now superseded by OAuth 2.0.

OAuth 1.0 is considered insecure and should be avoided. Learn more

OAuth 1.0a is more secure but it has been obsoleted in favor of OAuth 2.0. Learn more

This is an industry-standard protocol for authorization. The OAuth framework specifies several grant types for different use cases. Learn more

GENESIS supports the following grant types:

• Authorization Code. The authorization code grant type is used by confidential and public clients to exchange an authorization code for an access token. After the user returns to the client via the redirect URL, the application gets the authorization code from the URL and uses it to request the access token.
• Client Credentials. The client credentials grant type is used by clients to obtain an access token outside of the context of a user.
• Resource Owner Password. The password grant type is a legacy way to exchange a user's credentials for an access token. Since the client application has to collect the user's password and send it to the authorization server, using this grant is no longer recommended.

This is a Microsoft Windows specific authentication protocol that you can use to authenticate users and computers based on a challenge/response mechanism that proves to a server or domain controller that the user knows the password associated with an account.