Curl Workday请求在SoapUI中有效，但在Postman中无效

我正在尝试调用Workday招聘web服务的操作。我已经在SoapUI中打开了WSDL文件，并成功地发送了以下XML

<?xml version="1.0" encoding="UTF-8"?>
<env:Envelope
    xmlns:env="http://schemas.xmlsoap.org/soap/envelope/"
    xmlns:xsd="http://www.w3.org/2001/XMLSchema"
    xmlns:wd="urn:com.workday/bsvc">
    <env:Body>
        <wd:Put_Background_Check_Request
            xmlns:wd="urn:com.workday/bsvc"
            wd:version="v26.2">
            <wd:Business_Process_Parameters>
                <wd:Run_Now>true</wd:Run_Now>
            </wd:Business_Process_Parameters>
            <wd:Background_Check_Data>
                <wd:Event_Reference>
                    <wd:ID wd:type="Background_Check_ID">BACKGROUND_CHECK_EVENT-6-96</wd:ID>
                </wd:Event_Reference>
                <wd:Background_Check_Status_Data>
                    <wd:Status_Date>2016-12-16</wd:Status_Date>
                    <wd:Status_Reference>
                        <wd:ID wd:type="Background_Check_Status_ID">Background_Check_Status_Pending</wd:ID>
                    </wd:Status_Reference>
                </wd:Background_Check_Status_Data>
                <wd:Package_Reference_Data>
                    <wd:Package_Reference>
                        <wd:ID wd:type="Background_Check_Package_ID">BACKGROUND_CHECK_PACKAGE_QR1SQ</wd:ID>
                    </wd:Package_Reference>
                    <wd:Status_Reference>
                        <wd:ID wd:type="Background_Check_Status_ID">Background_Check_Status_Pending</wd:ID>
                    </wd:Status_Reference>
                </wd:Package_Reference_Data>
            </wd:Background_Check_Data>
        </wd:Put_Background_Check_Request>
    </env:Body>
</env:Envelope>

真的
背景检查事件-6-96
2016-12-16
背景检查状态待定
背景检查包QR1SQ
背景检查状态待定

我得到以下回应

<env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/">
   <env:Body>
      <wd:Put_Background_Check_Response wd:version="v26.2" xmlns:wd="urn:com.workday/bsvc">
         <wd:Event_Reference wd:Descriptor="Background Check for Job Application: Elizabeth Taylor - R0000039 Diversity Report Test (Open)">
            <wd:ID wd:type="WID">ee6477431cb2100ca61ac0100d041523</wd:ID>
            <wd:ID wd:type="Background_Check_ID">BACKGROUND_CHECK_EVENT-6-96</wd:ID>
         </wd:Event_Reference>
      </wd:Put_Background_Check_Response>
   </env:Body>
</env:Envelope>

ee6477431cb2100ca61ac0100d041523
背景检查事件-6-96

网址是。身份验证方法是基本的身份验证username@tenant和密码。HTTP日志如下所示。。。

问题是，当我尝试在Postman（或cURL或Python请求）中使用相同的头重新创建相同的POST请求时，会出现无效的用户名或密码错误。SoapUI在这里做什么特别的事情吗？本案的答复如下

<?xml version="1.0" encoding="utf-8"?>
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
    <SOAP-ENV:Body>
        <SOAP-ENV:Fault xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wd="urn:com.workday/bsvc">
            <faultcode>SOAP-ENV:Client.authenticationError</faultcode>
            <faultstring>invalid username or password</faultstring>
        </SOAP-ENV:Fault>
    </SOAP-ENV:Body>
</SOAP-ENV:Envelope>

SOAP-ENV:Client.authenticationError
无效的用户名或密码

SoapUI在这种情况下会修改传出XML。在作为POST请求发送之前，它在

元素之前添加以下块

<env:Header>
    <wsse:Security
        env:mustUnderstand="1"
        xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
        xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
        <wsse:UsernameToken wsu:Id="UsernameToken-86F2FCCEFFBB80C4CD14820998755791">
            <wsse:Username>username@tenant</wsse:Username>
            <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">password</wsse:Password>
            <wsse:Nonce
                EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">asdfwrqwarqwr1+oA==
            </wsse:Nonce>
            <wsu:Created>2016-12-18T22:24:30.575Z</wsu:Created>
        </wsse:UsernameToken>
    </wsse:Security>
</env:Header>

username@tenant
密码
asdfwrqwarqwr1+oA==
2016-12-18T22:24:30.575Z

---

因此，我已将其添加到原始XML中，并从请求中删除了基本的Auth头，它可以正常工作。

从响应中可以清楚地看到凭据不正确。请更正并重试。WS-Security。它将密码放在文档中，由https连接保护，而不是头中的密码（https不保护）。