Consuming an External Web Service using HTTPS and WS Security

Question

Hello everyone,
I'm having a problem setting the security information in a SOAP header using a generated ABAP Client Proxy to consume an external web service that requires a User ID and Password in the Header section of the SOAP message.  I need to use HTTPS. I'm on a WAS 7.01 SP08 system so from my readings, SAP is supposed to be able to add the username and password into the header section of the message.  I can't seem to get SAP to add this information added to the header.
Here are the steps that I have taken to set the security values.
1) Created the client proxy from the WSDL in SE80.  Basic Authentication on the Configuration tab was turned on automatically.
       Note, Transport Security is set to None.  I cannot change it.
2) Created an outbound set user name profile in transaction WSPROFILE with the appropriate username and password.
3) Added the profile to the default port in transaction LPCONFIG as an outbound under the WS Security section of the screen.
When I called the external Web Service, I got back the following error message:
com.ibm.wsspi.wssecurity.SoapSecurityException: WSEC5509E: A security token whose type is [http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#UsernameToken] is required.
So, after reading through this Forum, I saw that I needed to use the SOAMANAGER.  I set up a Proxy in the SOAMANAGER and manually created the Logical Port.  This was the only way I could figure out how to set the Authentication Settings in the Logical Port to "User ID / Password".  I then entered the User ID and Password.
However, I am still getting the same error message.  I feel I am close but missing some small configuration to tell SAP to use WS Security with a Username token.
I'm not sure what I'm doing wrong, so any help would be appreciated.
Thanks,
Stephen

Answer 1

I had this error again so I thought I would post my solution:
The issue is SAP needs to know the certificates being used by the web site being called.  These certificates are automatically installed in your browser but need to be manually installed in SAP.  This is what I did:
How to find/install new certificates
Make sure you run Internet Explorer as an Administrator so you can export the certificates
Go to the web site that SAP is trying to call in Internet Explorer
Double click on the lock in the address bar
View certificates
Find the certificates that are being used
Tools --> Internet Options --> Content --> Certificates
Click on the “Trusted Root Certification Authorities” tab
Find the certificate identified in step iii
Export as a CER certificate
Click on the “Intermediate Certification Authorities” tab
Find the certificate identified in step iii
Export as a CER certificate
Go to STRUST in SAP
Import the Certificates in the “Anonymous” or “Standard” SSL client
Save
RESTART the ICM via t-code SMICM  <-- Critical!!!
Test