Table of Contents
SAP Web Services tutorial for beginners
Requires Free Membership to View
When you register, you will start receiving targeted emails from my award-winning team of editorial writers. Our goal is to keep you informed on the hottest topics and biggest challenges faced by SAP professionals today.
Hannah Smalltree, Editorial Director
Sharing data
through SAP Java code web service programs
Communicating in SAP Web Services through XML markup tags and SAP SOAP
Getting started with Apache SAP web services
Addressing SAP Web Services security issues
So far we have talked about a lot of the technical issues surrounding how to create a Web
Service based on SAP functionality but we have side-stepped the issue of security.
The current SOAP specification does not address this issue but Microsoft, IBM, and Verisign have
recently authored a new Web Service security specification called WS-Security. This specification
dictates how SOAP messages will secure themselves and not rely on the protocol over which they are
being sent (ie. HTTP and HTTPS).
In part 3 of this series we discussed the structure of SOAP messages. They have an envelope, a
body, and a payload in the body that consists of the actual information being sent. This
information is sent unencrypted and is therefore susceptible to being viewed by authorized parties
and being modified in transit. Because they contain no authentication information, anyone can
create a SOAP message and attempt to impersonate another party. WS-Security addresses the same
issues that affect all other types of transactions authentication, data integrity, and message
confidentiality.
WS-Security adds XML tags to the SOAP header for the purpose of passing authentication information.
This information is based on existing security mechanisms such as X.509 digital certificates,
Kerberos, and the basic username/password combination. For instance, when passing a digital
certification in the header, the author is now free to use standard PKI-based encryption and hash
code binding on the payload. This then ensures the recipient that the information is coming from a
known source, it has not been altered, and it has remained confidential.
In order for Web Services to truly become part of companies' IT strategy, these security issues
needed to be addressed. Hopefully, thanks to WS-Security, everyone can agree on the same standard
for securing Web Services and their promise of integration at reduced costs can be realized.
Additional information about WS-Security can be found at
http://www-106.ibm.com/developerworks/library/ws-secure/.
Author Jeff Marin is
director of training and education for Gamma Enterprise Technologies Inc.
This was first published in August 2002