Whatever identifier you choose to identify a client, it must be unique to the application. Identifiers that represent user names are often not suitable because the identified users might submit requests for multiple APIs.

Identifying applications by IP address or host name is often a suitable choice, however, it does create a dependency on the network infrastructure. If a client moves to a new machine, or its IP address changes, you must update the identifiers in the application asset.

Using X.509 certificates or a custom token that is extracted from the SOAP message itself (using an XPATH expression), is often the most trouble-free way to identify a client.

The simplest way to identify clients is to use the Evaluate IP Address action.

Evaluate HTTP Basic Authentication to identify clients using the token derived from the HTTP Header.

HTTP Basic Authentication.

Evaluate WSS Username Token action to identify clients using the token derived from the WSS Header.

Evaluate WSS X.509 Certificate action to identify clients using the WSS X.509 certificate.

Require SSL action.