In WSP, our experience is that the username and password must be passed in headers in order to run the web service. Unless I am missing something in documentation, I do not see a way around this. Can someone help clarify what information MUST be passed in the headers and what information, including authentication, may be able to be passed a different way?
Not sure if accurate, but I saw a Community post that said that if you want the user account to be authenticated with Active Directory then you MUST use IdP. If that is not accurate, what are best practices to have a WSP API create a session for the calling user and then execute the code? I am sure I am missing something obvious here, so help is appreciated.
