To configure authorization for REST, GraphQL, gRPC, SOAP, or XML-RPC requests, you need to assign authorization profiles to them. ReadyAPI applies the same authorization settings to different requests across the project. Also, you use authorization profiles to change authorization in different environments.
With authorization inheritance, you can assign the same profile to multiple requests.
You can also use Basic, NTLM, and SPNEGO/Kerberos built-in profiles. ReadyAPI applies such profiles only to one request.
In ReadyAPI, you can manage request authorization in several ways:
-
From the Authorization panel of the request editor
-
From Auth Manager
Auth Manager
With Auth Manager, you can work with all authorizations in your project. It holds information about all the authorization profiles configured in the project and helps you assign them as needed.
To open the manager, select any node in the APIs section of the Navigator and select Auth Manager from the Auth & Security drop-down on the toolbar.
Click the image to enlarge it.
Auth Manager has two tabs:
-
Auth Repository – Provides access to all the configured profiles. Here, you can create, configure, rename, and delete the authorization profiles used in your projects. See the Manage Authorization Profiles section for details.
-
Auth Manager – Provides access to all the requests in your projects. Here, you can assign an authorization profile or method to REST, SOAP, or XML-RPC requests. The requests can be both API definitions and request test steps in your SoapUI tests.
Manage authorization profiles
Add a profile
You can create an authorization profile and use it in a single or multiple requests. To add an authorization profile:
-
Open a request in the editor, switch to the Auth panel and click Add Authorization Profile.
– or –
In Auth Manager, click
on the Auth Repository tab. -
In the subsequent dialog, select a profile type, enter a profile name, and click OK.
Click the image to enlarge it.
-
Configure the profile according to its type.
View image
Assign a profile
To assign an authorization profile to a specific request:
-
Open a request in the editor, switch to the Auth panel, and select an authorization profile or method from the Authorization dropdown.
– or –
-
In Auth Manager, switch to the Auth Manager tab and select an authorization profile or method from the drop-down list in the Authorization Method column of the needed request.
Rename a profile
To rename a profile:
-
Open a request in the editor, switch to the Auth panel, and select Rename Current Profile from the Authorization dropdown.
– or –
In Auth Manager, select a profile on the Auth Repository tab and click
. -
In the subsequent dialog, enter a profile name and click OK.
| Note: | There is no need to rename the profile in individual requests. |
Delete a profile
To delete an authorization profile:
-
Open a request in the editor, switch to the Auth panel, and select Delete Current Profile from the Authorization dropdown.
– or –
In Auth Manager, select a profile on the Auth Repository tab and click
. -
In the subsequent dialog, confirm the deletion.
Authorization inheritance
With authorization inheritance, you can apply the same profile to a large number of tests. For example, you can apply authorization rules specified on the project level to all underlying levels, such as test suites, test cases, test steps and requests. To do this, you need to select the Inherit From Parent authorization method for the needed requests.
Click the image to enlarge it.
How it works
Authorization rules specified at lower levels have a priority over the rules specified at higher levels. For example, a configuration at the test case level will override the configuration at the test suite level. This allows you to have the same standard authorization for all test cases, except for the ones that test for faulty authorization or use different authorization types.
Click the image to enlarge it.
Authorization methods
To inherit authorization settings from a request, use the following methods:
-
No authorization – Select it if no authorization is needed for the request.
-
Inherit From Parent – Select it to apply authorization settings as in the parent test case.
-
Inherit From Service – Select it to apply authorization settings as in the underlying API.