SoapUI Gets a 407 Before the SOAP Service Can Authenticate
Keep the proxy login in SoapUI's proxy settings and diagnose it separately from the service's 401 or message-security credentials.
A 407 asks SoapUI to authenticate to the intermediary. An Authorization header intended for the SOAP service cannot answer it, and for HTTPS the proxy may reject CONNECT before the service request is sent.
Put the intermediary host, port, username and password in SoapUI's proxy settings. Keep the service's authentication on its request or applicable authorization profile. SOAP message-security credentials may form another layer.
| Response | Who is asking? | Corresponding credential header |
|---|---|---|
| 407 / Proxy-Authenticate | The proxy | Proxy-Authorization |
| 401 / WWW-Authenticate | The destination | Authorization |
For an HTTPS failure, first establish whether CONNECT was accepted. Then inspect the service exchange. This order keeps a missing tunnel login from being mistaken for the service rejecting its own account.
If the wrong account seems to be sent, compare the selected authentication profile, explicit headers and actual exchange with secrets removed. Keep the SoapUI version with that evidence; reports of the symptom in historical releases do not establish its cause in this installation.
A manually constructed Basic header applies only to Basic authentication. Its Base64 content still contains credentials, and duplicate Authorization headers or a value copied into proxy settings can create a second error.