Problem solve Get help with specific problems with your technologies, process and projects.

Addressing SAP Web Services security issues

So far we have talked about a lot of the technical issues of Web Services. Now it's time to discuss security.

Table of Contents

SAP Web Services tutorial for beginners

Sharing data through SAP Java code web service programs

Communicating in SAP Web Services through XML markup tags and SAP SOAP

Getting started with Apache SAP web services

Addressing SAP Web Services security issues 

 

So far we have talked about a lot of the technical issues surrounding how to create a Web Service based on SAP functionality but we have side-stepped the issue of security.

The current SOAP specification does not address this issue but Microsoft, IBM, and Verisign have recently authored a new Web Service security specification called WS-Security. This specification dictates how SOAP messages will secure themselves and not rely on the protocol over which they are being sent (ie. HTTP and HTTPS).

In part 3 of this series we discussed the structure of SOAP messages. They have an envelope, a body, and a payload in the body that consists of the actual information being sent. This information is sent unencrypted and is therefore susceptible to being viewed by authorized parties and being modified in transit. Because they contain no authentication information, anyone can create a SOAP message and attempt to impersonate another party. WS-Security addresses the same issues that affect all other types of transactions authentication, data integrity, and message confidentiality.

WS-Security adds XML tags to the SOAP header for the purpose of passing authentication information. This information is based on existing security mechanisms such as X.509 digital certificates, Kerberos, and the basic username/password combination. For instance, when passing a digital certification in the header, the author is now free to use standard PKI-based encryption and hash code binding on the payload. This then ensures the recipient that the information is coming from a known source, it has not been altered, and it has remained confidential.

In order for Web Services to truly become part of companies' IT strategy, these security issues needed to be addressed. Hopefully, thanks to WS-Security, everyone can agree on the same standard for securing Web Services and their promise of integration at reduced costs can be realized. Additional information about WS-Security can be found at http://www-106.ibm.com/developerworks/library/ws-secure/.

Author Jeff Marin is director of training and education for Gamma Enterprise Technologies Inc.


This was last published in August 2002

Dig Deeper on SAP Web applications

PRO+

Content

Find more PRO+ content and other member only offers, here.

Join the conversation

1 comment

Send me notifications when other members comment.

By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Please create a username to comment.

Hi,
I was expecting this article to talk about creating web services that invoke SAP BAPI.
This is what was mentioned in the Part-4 of the series. Any pointers??
Cancel

-ADS BY GOOGLE

SearchManufacturingERP

SearchOracle

SearchDataManagement

SearchAWS

SearchBusinessAnalytics

SearchCRM

SearchContentManagement

SearchFinancialApplications

Close