Authenticating SOAP API via UsernameToken

Question

So I have tested about every way I can think of and I can no longer get the UsernameToken authentication to work in ANY account. I get the same error of An invalid security token was provided. This is not saying the User/Pass is invalid - that is a different error, saying something like 'Login failed'.

Has there been an update to this that is not in the documentation or any other similar changes? Perhaps there is a permission or business rule on SFMC end that is now turned off by default or a new layout/structure for these security requests?

Please note that I tested this with an admin user with full permission sets, so it should not be an issue with my available permission settings.

I know this cannot be a universal thing as I believe there would be a bit more of an outcry on this - so hoping its just me being dumb and missing something small.

I have tried this call using the oauth token and it worked perfectly, so I know it is not the call or anything in the envelope outside the authentication. The second I change it back to UsernameToken authentication, it sends me that error again.

Here is a sample using a simple describe call to help eliminate almost any other possibility of issues in the call's body:

<?xml version="1.0" encoding="UTF-8"?>
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
 <s:Header>
 <o:Security xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" s:mustUnderstand="1">
 <o:UsernameToken>
 <o:Username>myUserName</o:Username>
 <o:Password>myPassWord</o:Password>
 </o:UsernameToken>
 </o:Security>
 </s:Header>
 <s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
      <DefinitionRequestMsg xmlns="http://exacttarget.com/wsdl/partnerAPI">
         <DescribeRequests>
            <ObjectDefinitionRequest>
               <ObjectType>AutomationInstance</ObjectType>
            </ObjectDefinitionRequest>
         </DescribeRequests>
      </DefinitionRequestMsg>
 </s:Body>
</s:Envelope>

Answer 1

Of course within minutes of posting the question, I find the issue. I did not have the 'Enable Username and Password for Web Services' setting turned on.

This IS explicitly stated in the docs, I just missed it. I wanted to share my dumbness just in case anyone else has this issue.

Enable the username and password security setting. Go to Setup | Security | Security Settings and find the setting under Username and Logins.