I am in the process of creating a custom SOAP apex web service using webservice keyword so that external system can call this apex web service. I am not using Apex REST.
From the class I can create WSDL and share it with the external system. Apex REST clearly documents that it supports OAuth and Session ID authentication but no documentation for Apex SOAP Web service.
How can I secure this apex SOAP web service ? What authentication mechanism is supported ? How can external system connect to it securely ? Do they have to pass salesforce username/password/token?