Problem solve Get help with specific problems with your technologies, process and projects.

Addressing SAP Web Services security issues

So far we have talked about a lot of the technical issues of Web Services. Now it's time to discuss security.

Table of Contents

SAP Web Services tutorial for beginners

Sharing data through SAP Java code web service programs

Communicating in SAP Web Services through XML markup tags and SAP SOAP

Getting started with Apache SAP web services

Addressing SAP Web Services security issues 


So far we have talked about a lot of the technical issues surrounding how to create a Web Service based on SAP functionality but we have side-stepped the issue of security.

The current SOAP specification does not address this issue but Microsoft, IBM, and Verisign have recently authored a new Web Service security specification called WS-Security. This specification dictates how SOAP messages will secure themselves and not rely on the protocol over which they are being sent (ie. HTTP and HTTPS).

In part 3 of this series we discussed the structure of SOAP messages. They have an envelope, a body, and a payload in the body that consists of the actual information being sent. This information is sent unencrypted and is therefore susceptible to being viewed by authorized parties and being modified in transit. Because they contain no authentication information, anyone can create a SOAP message and attempt to impersonate another party. WS-Security addresses the same issues that affect all other types of transactions authentication, data integrity, and message confidentiality.

WS-Security adds XML tags to the SOAP header for the purpose of passing authentication information. This information is based on existing security mechanisms such as X.509 digital certificates, Kerberos, and the basic username/password combination. For instance, when passing a digital certification in the header, the author is now free to use standard PKI-based encryption and hash code binding on the payload. This then ensures the recipient that the information is coming from a known source, it has not been altered, and it has remained confidential.

In order for Web Services to truly become part of companies' IT strategy, these security issues needed to be addressed. Hopefully, thanks to WS-Security, everyone can agree on the same standard for securing Web Services and their promise of integration at reduced costs can be realized. Additional information about WS-Security can be found at

Author Jeff Marin is director of training and education for Gamma Enterprise Technologies Inc.

Dig Deeper on SAP integration

Join the conversation

1 comment

Send me notifications when other members comment.

Please create a username to comment.

I was expecting this article to talk about creating web services that invoke SAP BAPI.
This is what was mentioned in the Part-4 of the series. Any pointers??