Problem solve Get help with specific problems with your technologies, process and projects.

Addressing SAP Web Services security issues

So far we have talked about a lot of the technical issues of Web Services. Now it's time to discuss security.

Table of Contents

SAP Web Services tutorial for beginners

Sharing data through SAP Java code web service programs

Communicating in SAP Web Services through XML markup tags and SAP SOAP

Getting started with Apache SAP web services

Addressing SAP Web Services security issues 


So far we have talked about a lot of the technical issues surrounding how to create a Web Service based on SAP functionality but we have side-stepped the issue of security.

The current SOAP specification does not address this issue but Microsoft, IBM, and Verisign have recently authored a new Web Service security specification called WS-Security. This specification dictates how SOAP messages will secure themselves and not rely on the protocol over which they are being sent (ie. HTTP and HTTPS).

In part 3 of this series we discussed the structure of SOAP messages. They have an envelope, a body, and a payload in the body that consists of the actual information being sent. This information is sent unencrypted and is therefore susceptible to being viewed by authorized parties and being modified in transit. Because they contain no authentication information, anyone can create a SOAP message and attempt to impersonate another party. WS-Security addresses the same issues that affect all other types of transactions authentication, data integrity, and message confidentiality.

WS-Security adds XML tags to the SOAP header for the purpose of passing authentication information. This information is based on existing security mechanisms such as X.509 digital certificates, Kerberos, and the basic username/password combination. For instance, when passing a digital certification in the header, the author is now free to use standard PKI-based encryption and hash code binding on the payload. This then ensures the recipient that the information is coming from a known source, it has not been altered, and it has remained confidential.

In order for Web Services to truly become part of companies' IT strategy, these security issues needed to be addressed. Hopefully, thanks to WS-Security, everyone can agree on the same standard for securing Web Services and their promise of integration at reduced costs can be realized. Additional information about WS-Security can be found at

Author Jeff Marin is director of training and education for Gamma Enterprise Technologies Inc.

Dig Deeper on SAP integration

Where SOA standards matter: The SAP view Jeff Anders, director of solution marketing SAP AG's NetWeaver Developer Platform, was at JavaOne this month making a pitch for the new NetWeaver Composition Environment tool for standards-based service-oriented architecture (SOA) development. He brought along Michael Bechauf, vice president of industry standards at SAP, and currently chairman of the Web Services Interoperability Organization (WS-I) to help make the point that the standards-based approach broadens the reach of SAP tools beyond SAP. Anders and Bechauf answered questions on why standards, including Java EE 5, Service Component Architecture (SCA) now with OASIS, and WS-I guidelines matter in SOA tooling. Bechauf also talked about the need for Web services interoperability that transcends some of the debate over what is the latest and greatest technology. He argues that business people are looking for the Web to provide a "ubiquitous dial tone" so they can transact business over the Internet as easily as they do over the telephone.

Join the conversation

1 comment

Send me notifications when other members comment.

Please create a username to comment.

I was expecting this article to talk about creating web services that invoke SAP BAPI.
This is what was mentioned in the Part-4 of the series. Any pointers??