SAP and Web services, part 5

So far we have talked about a lot of the technical issues surrounding how to create a Web Service based on SAP functionality but we have side-stepped the issue of security.

The current SOAP specification does not address this issue but Microsoft, IBM, and Verisign have recently authored a new Web Service security specification called WS-Security. This specification dictates how SOAP messages will secure themselves and not rely on the protocol over which they are being sent (ie. HTTP and HTTPS).

In part 3 of this series we discussed the structure of SOAP messages. They have an envelope, a body, and a payload in the body that consists of the actual information being sent. This information is sent unencrypted and is therefore susceptible to being viewed by authorized parties and being modified in transit. Because they contain no authentication information, anyone can create a SOAP message and attempt to impersonate another party. WS-Security addresses the same issues that affect all other types of transactions authentication, data integrity, and message confidentiality.

WS-Security adds XML tags to the SOAP header for the purpose of passing authentication information. This information is based on existing security mechanisms such as X.509 digital certificates, Kerberos, and the basic username/password combination. For instance, when passing a digital certification in the header, the author is now free to use standard PKI-based encryption and hash code binding on the payload. This then ensures the recipient that the information is coming from a known source, it has not been altered, and it has remained confidential.

In order for Web Services to truly become part of companies' IT strategy, these security issues needed to be addressed. Hopefully, thanks to WS-Security, everyone can agree on the same standard for securing Web Services and their promise of integration at reduced costs can be realized. Additional information about WS-Security can be found at http://www-106.ibm.com/developerworks/library/ws-secure/.

Author Jeff Marin is director of training and education for Gamma Enterprise Technologies Inc.