Inbound Web service Security ConfigurationDescription<!-- div.margin{ padding: 10px 40px 5px 30px; } table.tocTable{ border: 1px solid; border-color:#E0E0E0; background-color: rgb(245, 245, 245); padding-top: .6em; padding-bottom: .6em; padding-left: .9em; padding-right: .6em; } table.noteTable{ border:1px solid; border-color:#E0E0E0; background-color: rgb(245, 245, 245); width: 100%; border-spacing: 8px; border-collapse: separate; } table.internalTable{ border:1px solid; border-color:#E0E0E0; background-color: rgb(245, 245, 245); width: 100%; border-spacing:0; } .sp td{ border-bottom: 1px solid; border-right: 1px solid; border-color:#E0E0E0; background-color: #ffffff; height: 20px; padding-top: .5em; padding-bottom: .5em; padding-left: .5em; padding-right: .5em; } .sphr td{ border-right: 1px solid; border-bottom: 1px solid; border-color:#E0E0E0; background-color: rgb(245, 245, 245); padding-top: .5em; padding-bottom: .5em; padding-left: .5em; padding-right: .5em; height: 20px; } .title { color: #D1232B; font-weight:; font-size:25px; } .hd1{ color: #D1232B; font-weight:; font-size:18px; } .hd2{ color: #646464; font-weight:bold; font-size:16px; } .hd3{ color: #7a7a7a; font-weight:; font-size:16 px; text-decoration:; } .hd4{ color: #000000; font-weight:bold; font-size:14 px; text-decoration:; } --> Inbound Web Service Security Configuration Requirement Configure Web Service Security for inbound SOAP web servicesConfigure WSS for inbound requests with different certificates for different clients Solution Use WS-Security. This functionality is available starting with the Dublin release. Set up Certificates as required in sys_certificate tableSet up WS ProfileSet up SOAP Web ServiceConfigure glide.soap.default_security_policy property with newly created security policy name Details WS Security is message level security for SOAP web services. Here a signature element is added to header element of soap request. This signature is validated at Servicenow instance based on certificate configured. If man-in-middle tamper request body, it won’t match with signature added during generation of SOAP request. There is no support for encryption. WS Profiles provide a way to configure different profiles while Security Policy determines what profiles to validate and how to authenticate (either all of the profiles or one of them) the request. If no policy is created or defined, all configured WS Profiles are evaluated on all incoming requests. Another important to note is that once you configure WS Profiles or Security Policy, validation is performed on all incoming SOAP requests including MID and ODBC. You must exclude MID and ODBC requests from validation by following steps in following article.