Hector Martin

Integrating with service Made in Spain. 1) Dev SOAP service has expired cert, 2) it throws 500s, 3) web UI uses SHA1 intermediate cert. Joy.

This is getting better. Turns out the 500s were an authentication error. Because I'm not supposed to use my user/pw, but a *shared one*.

Then you call the "log-in" API, which doesn't take credentials. Then the actual *operation* API takes the real user/pw. WTF?

Two-phase login sounds like some sort of anti-CSRF mechanism. I seem to remember MediaWiki API doing the same.

This isn't two-phase login. It's just stupid enterprisy consultancy bullshit. Someone told them they needed "security"...

... so they decided to use WS-security (it has security in the name!) with a hardcoded username and password, because SECURITY!!1!

All WS-Security with user/password auth does is stick the username/password in the message header.