Policy Xpress SOAP query Authorization header missing with Basic Auth

Products

• CA Identity Manager
• CA Identity Suite

Issue/Introduction

When Identity Manager (IM) uses Policy Xpress (PX) to perform a SOAP query against a web service managed by API Gateway, the Authorization: Basic header may be omitted from the outbound request even if Basic Authentication is configured in the PX action.

Symptoms

• The Policy Xpress action fails during execution.
• The test or execution returns the following error: Policy Falsified
• Network traces show the SOAP request from IM is missing the Authorization header, while the same request sent via external tools (like SoapUI) succeeds.

Environment

Identity Manager

Cause

Identity Manager may suppress the Authorization header if the target endpoint does not explicitly signal a requirement for it during the initial handshake. Specifically, if the API Gateway policy is not configured to mandate credentials, IM may not include the header in its SOAP envelope.

Resolution

To ensure the Authorization header is sent, the API Gateway policy for the target service must be updated to explicitly require credentials:

1. Open the API Gateway Policy Manager.
2. Navigate to the policy associated with the SOAP service being called by Identity Manager.
3. Add the following assertion to the policy: Require HTTP Basic Credentials
4. Save and Publish the policy.

Once this assertion is active, the Gateway will properly signal the requirement, and Identity Manager will include the Authorization: Basic header in the PX SOAP query.