No WSDL Validation at Application Level for Enterprise Web Services

Hello community,
We are building Enterprise Web Services in our application running on Netweaver 7.40 and have built several service definitions through the Enterprise Service Builder tool.   Ultimately the WSDL file that the builder creates is mapped to Java skeleton classes which define the API for the service endpoints thanks to Netweaver Developer Studios' 'Generate Java Bean Skeleton' functionality.    What we noticed was that during the processing of requests, the application was ignoring all validation imposed/defined in the WSDL definition.
We're assuming that this type of validation is part of an operating Web Service implementation on any J2EE Application Container - including Netweaver - and the Container would be responsible for early validation stages of request processing, utilizing the Service definitions.
Is it not part of the JSR-921 specification that compliant applications include a SOAP Processor that parses and validates a SOAP request that is submitted?   Where It is part of the responsibility of the SOAP processor upon receiving a Service request to validate and THEN relay the request to the appropriate Service method?
We could potentially validate our own but we have 100's of objects to manually validate against which becomes a very tedious and hard to maintain exercise.   It seems redundant and common behavior that should be handled at the Service layer by the SOAP processor within the Container should it not?
Validation capabilities seem to be provided by other vendor products such as Oracle AS and WebSphere.    Does anyone know if Netweaver offers this and if so how would we go about implementing it through configuration or otherwise?
Thank you!
Hanif

Hi,
If WSNavigator is not asking for password then endpoint is not configured for user/password so go ahead and use this wsdl in .Net application, it should work fine,
Just make sure that session is not stored in WSNavigator and that's why it is not asking for user/password. I believe if you open wsdl with binding it should ask for user/password.
Regards,
gourav

Similar Messages

Validation on Application Level?

Hi,
is there the possibility to define a validation on application level? Couldn't find anything.
I thought about a validation on page 0, but page 0 doesn't allow to create validations...
Purpose: I want to validate the Apex_Application.g_fxx arrays. The validation will be the same for all pages.
Thanks for your help
Patrick
Check out my APEX-blog: http://inside-apex.blogspot.com

Hi Vikas,
thanks for the help. Just tried it out, didn't work :-(
It does the redirect, but doesn't show the error message. I assume the g_validation_ids_in_error and g_item_ids_in_error has also to be set. But the redirect isn't good in my case anyway, because the tabular form entries are lost.
But I just found out that APEX_Application.show_error does exactly what I was looking for!
Thanks for your help
Patrick
Check out my APEX-blog: http://inside-apex.blogspot.com

Getting complete WSDL for the web services created in J2EE

Hi,
I have created a web service using Netweaver developer studio for a J2EE project (complete EJB, WEB and Appln Project) similar to CAR rental application.
I also have tested the web service in web service perspective and it is working fine. Now i want to call this web service from XI. Therefore i need the WSDL for the same. The testing screen also gives the WSDL for the web service. But it has got number of links inside in the forms of import.
Editing all those documents and forming the complete wSDL is very difficult..
How do i do it??
Abhijeet

Hi,
When I opened the wsdl it has number has a wsdl:import location tag..which refers to binding.
when opened this import location we have one more import location for porttypes.
When combined all thhree e.g. service, binding and porttype we get the complete WSDL which i could comofortably import in XI and further process.
This way i coudl succesfully call a web service from XI.
I used Stylus studio for editing WSDL.
Thanx

Problem using WSDL from SAP in IBM's RAD for generating web service client

When importing a WSDL from the ABAP stack on a SAP 6.40 system into IBM's RAD tool for generating a web service client there are errors with the soap fault classes that get generated. The WSDL declares the types for the faults with WebServiceName.RfcException and these have elements of name, text, and message. When the tools see this in the WSDL they generate classes that extend the Java exeception class and this causes an error because the "message" name conflicts with the standard java exception message. Has anyone else ran into this problem? It seems like a basic problem many java tools for generating web service client proxies would have because the soap faults get turned into java exceptions. This name conflict of the java exception with the WSDL fault definition means that code always needs to be adjusted and cannot simply use the classes that are generated from the WSDL. Anyone run across this or a similar problem in the java environment using the SAP WSDL?
Aaron

Hi,
Hello again .
Have you tried your service using soapui ?
You can use your WSDL as input .
In order to eliminate eclipse problem try this service:(I just did)
http://www.oorsprong.org/websamples.countryinfo/CountryInfoService.wso?WSDL
Regards.
package main;
import java.io.FileInputStream;
import java.rmi.RemoteException;
import java.util.Properties;
import org.oorsprong.www.websamples_countryinfo.CountryInfoServiceSoapType;
import org.oorsprong.www.websamples_countryinfo.CountryInfoServiceSoapTypeProxy;
import org.oorsprong.www.websamples_countryinfo.TCountryCodeAndName;
public class Main {
public static void main(String[] args) {
try {
   final Properties properties = new Properties();
   properties.load(new FileInputStream("properties.ini"));
   System.getProperties().putAll(properties);
} catch (final Exception exception) {
   exception.printStackTrace();
new Main();
public Main() {
try {
   final CountryInfoServiceSoapType infoServiceSoapType = new CountryInfoServiceSoapTypeProxy();
   final TCountryCodeAndName[] tCountryCodeAndNames = infoServiceSoapType.listOfCountryNamesByName();
   for (final TCountryCodeAndName tCountryCodeAndName : tCountryCodeAndNames) {
    System.out.println(tCountryCodeAndName.getSName());
} catch (final RemoteException exception) {
   exception.printStackTrace();

SOAP vs. XML-RPC for synchronous Web Services applications

Hi everyone, I have to finish one project soon and I have to make a decision. Because I don't have much time I want to ask if anyone can answer me, what are the major differences bettween SOAP vs. XML-RPC for synchronous Web Services applications. I'll be very grateful if you help me!
Thanks in advance!

Come on guys i know you can help me, please don't hesitate to write some row

Enterprise web service for CREMAS

Is there an SAP delivered Enterprise web service to create vendor data in ECC ?

Dear Umesh,
Unfortunately my experience is bound only to axis2, but i think there will be not big differences on what you want to do.
As i know there are two ways, by-value and by-ref,(and an other one combining the two previous) to make an attachment. The first one is:
a) by-value solution
<?xml blablabla?>
<root>
<my_elem1 name='xyz'>
<type>car</type>
<image>101010101010101010101001010101010100101</image>
</myelem1>
<root/>
This can be made with 'hand'... Meaning what you should do is this(client side):
                OMFactory fac = OMAbstractFactory.getOMFactory();
          OMNamespace omNs = fac.createOMNamespace("http://you.com","xsd");
          OMElement method = fac.createOMElement("my_elem1", omNs);
                OMElement value1 = fac.createOMElement("image", null);//<image> ....    </image>
          value1.addChild(fac.createOMText(value1, ImageData ));//                   /\ server side:
public void myserviceMethod(OMElement payload){
              OMElement oe1=payload.getFirstChildWithName(new QName("http://you.com","image"));
              DataBase.store(   oe1.getText()    );//this is the binary stream(10101010101010101010)
}b,c) I don't think it make sense(at this point) to describe the other two because i thing they will confuse toy and they wont help you find a solution to your problem(its better start with the first one).

Best Practice for Securing Web Services in the BPEL Workflow

What is the best practice for securing web services which are part of a larger service (a business process) and are defined through BPEL?
They are all deployed on the same oracle application server.
Defining agent for each?
Gateway for all?
BPEL security extension?
The top level service that is defined as business process is secure itself through OWSM and username and passwords, but what is the best practice for security establishment for each low level services?
Regards
Farbod

It doesnt matter whether the service is invoked as part of your larger process or not, if it is performing any business critical operation then it should be secured.
The idea of SOA / designing services is to have the services available so that it can be orchestrated as part of any other business process.
Today you may have secured your parent services and tomorrow you could come up with a new service which may use one of the existing lower level services.
If all the services are in one Application server you can make the configuration/development environment lot easier by securing them using the Gateway.
Typical probelm with any gateway architecture is that the service is available without any security enforcement when accessed directly.
You can enforce rules at your network layer to allow access to the App server only from Gateway.
When you have the liberty to use OWSM or any other WS-Security products, i would stay away from any extensions. Two things to consider
The next BPEL developer in your project may not be aware of Security extensions
Centralizing Security enforcement will make your development and security operations as loosely coupled and addresses scalability.
Thanks
Ram

Connect Enterprise Web Services

Hi all,
I need a copy of the "firstapp.zip" sample application. It is
suppose to be available for developers who want to use Connect
Enterprise Web Services but I cannot find it.
Thanks,
A

Hi Mark,
I have logged a bug for this https://bugs.adobe.com/jira/browse/FB-27335
-Radhakrishna

Using Identity Management for Securing Web Services

My goal is to associate my services with an Oracle Internet Directory. I made some attempts to set up SAML authentication for the web services, but it didn't have the right outcome.
(My identity management server and OID is up and running and I have successfully made authentication modules for other web applications)
Here is what I did:
1. I wrote a simple java file, used jdeveloper tools to create and deploy it as a web service to OC4J. I associated an identity management server with this service through OC4J web tools as security provider.
2. I made a data control for the web service and put it in an ADF application . (client)
3. I deployed the client project(2) to OC4J.
I could use the web service through the page.
Then
I secured the webservice to expect SAML for authentication.
Surprisingly, the client could still communicate with the webservice, Why? Shouldn't it have rejected the request because of the problem in SAML token? (The proxy and the data control were not secured, and didn't provide any SAML tokens)
4.
I added login page to my client project (through ADF security wizard). It used idenity management for authentication successfully. login process completes and web service data control is displayed.
5. I want the authentication information to be propagated through the page so that the web service receives the data and uses Identity Management.
I know I should add <property name="oracle.security.wss.propagate.identity" value ="true"/>
to one of the configuration files, but don't know where exactly.
Best Regards,
Farbod

It doesnt matter whether the service is invoked as part of your larger process or not, if it is performing any business critical operation then it should be secured.
The idea of SOA / designing services is to have the services available so that it can be orchestrated as part of any other business process.
Today you may have secured your parent services and tomorrow you could come up with a new service which may use one of the existing lower level services.
If all the services are in one Application server you can make the configuration/development environment lot easier by securing them using the Gateway.
Typical probelm with any gateway architecture is that the service is available without any security enforcement when accessed directly.
You can enforce rules at your network layer to allow access to the App server only from Gateway.
When you have the liberty to use OWSM or any other WS-Security products, i would stay away from any extensions. Two things to consider
The next BPEL developer in your project may not be aware of Security extensions
Centralizing Security enforcement will make your development and security operations as loosely coupled and addresses scalability.
Thanks
Ram

OWSM and Webservices -Define policies once for multiple web services

I thought that through using OWSM we had the possibility to use the same Policy Lines for multiple web services.
Mostly when web services are used/integrated within an application, the same rules need to be defined and I thought this requirement could be met when using OWSM.
But you need to define the policy requirements on each web service that's passing through a gateway or agent, why isn't it supported to define policy lines one level higher to be able to use the same requirements for multiple web services?

Nathalie,
For this purpose OWSM allows you to use Template Policy Pipelines.
For individual services, you can than replace the pipeline with the Template.
But I have to agree with you here: the templating functions are rough on the edges, e.g. limited editing capabilities.
Hope this helps.
Best regards, Sjoerd

How to disable default logging for workshop web services

Hi there,
We have created a web service using WL Workshop that we want to deploy to a production server. The problem is that the destination server is not using a default log4j library for the server, but each application initiates its own library.
When we try to deploy the web service onto the production server, we are getting an error of a log4j/Appender class not found. We can solve the problem by adding any log4j library to the class path at the beginning, but that will cause compatilibity problems with existing applications.
Is there any way to disable the default web services logging? It looks like the knex library is trying to instantiate this class at deployment. Any way we can disable that option?
Thanks

Thanks David for your reply,
That is indeed what I am trying to do: to add all required libraries within my web-inf folder.
But it seems that the server itself expects the log4j library to be loaded when the server is initiated. It looks to me that some server-level listener for the web services is starting together with the domain and tries to access the log4j library. This library is not found because it is inside the web-inf folder of my application.
I do not see any error while starting the server. The error only appears when trying to deploy the application (ear) with the web service. It seems that I am forgetting something, but unless I include the log4j.jar in the classpath when I start the server, i will not be able to avoid the error.
Suggestions and tests are much welcome.
thanks!

Create an Alias in SICF for SOA Web Services

We have various Enterprise Web Services (SOAP) which are available via URLs which look like this:
https://oursapserver.ourdomain.com/sap/bc/srt/rfc/sap/zServiceX/100/ConfigY/bindingZ
Whenever we change the interface (changing the Function Modules) we have to create a new Enterprise Web Service (and config and binding...) in SOAMANAGER and this is not only tedious but it means a new URL.
We would like to have a fixed URL pointing to the latest version of the service. Something like:
https://oursapserver.ourdomain.com/zws/serviceX
When we create such an alias in SICF and point it to the above path and binding it does not work. We get a 500 error with the following response:
HTTP/1.1 500 SRT: Unexpected failure in SOAP processing occurred: ("No Web service configuration for this access path: "/zws/serviceX"")
content-type: text/html
content-length: 0
server: SAP NetWeaver Application Server / ABAP 731
Can anyone explain this message, or suggest a solution?

You'd get a different message if the address was already taken. The error you are experiencing has been reported numerous times, but I would assume that it was intermittent or we'd be hearing a lot more about it than we do. I'm afraid your only options are to try from time to time, or to attempt to navigate the shoals of the iCloud support system and ask them whether they can fix it.
To contact Support: if you currently happen to have AppleCare, either because you recently bought Apple hardware or have paid to extend the inititial period, you can contact them here:
http://www.apple.com/support/icloud/contact/
You will need the serial number of the covered hardware.
If you are not covered by AppleCare, then - in common with other free email services - there is no free support and you may be asked to pay a fee - if so you should point out that this problem is their fault and you shouldn't be charged.

How to remove user authentication for SAP Web Service?

Hi there,
I am using SAP Web Services in my flex application. Every time wsdl url is called, the username\password window pops up. I want to remove this.
I searched in the forum and based on the discussions, I tried giving the user name password under Web Service Administration using SOAMANAGER, by selecting No Authentication option. But this did not work. I still get that pop up.
I also tried giving the credentials in SICF, under Logon Data tab of the service. This too failed. I kept getting the pop up.
Can someone pls let me know how can I remove this? If username password in mandatory to be passed, I can create a temporary username which will be used to access all of my webservices and use it. But I want to remove this authentication part when I am using the flex application ang calling the web service url from within it.
Appreciate your help.....
-Deepak

Hi,
It is a little bit tricky, because the interface has changed several times in different releases. I know that it is possible without authentification.
I remember that i defined somewhere the default client, the username and password in the ERP system to use by this web service.
Maybe it helps if you try the old transactions WSADMIN, WSCONFIG or WSADMIN2 ?
Sorry that I cannot help you more. I hope it helps.
Best regards,
Joern

Determine BADI from Enterprise Web Service?

Hi all,
We've just started to work with Enterprise Web Services and have a need to enhance one of them. Using ES Workplace we have identified the 'Read Purchase Order' as a candidate and want to see what capabilities exist in making minor changes. The resources that we have found so far that detail this involve implementing a BADI.
My question is, how do we determine what the BADI is for each enterprise web service? I do not see a BADI name listed in the es workplace page for the web service. Is there a tcode on the ECC system that can use one of the values listed from the es workplace page?
http://esworkplace.sap.com/socoview(bD1lbiZjPTAwMSZkPW1pbg==)/render.asp?packageid=DE0426DD9B0249F19515001A64D3F462&id=32D255D472EA11DA36BB000F20DAC9EF

Hello,
BADI's relevant for each Web Service is provided at ES Workplace. For example, PO Query Web service definition ECC_PURCHASEORDER002QR, BADI is PUR_SE_PURCHASEORDER002QR which is mentioned in the link:
http://esworkplace.sap.com/socoview(bD1lbiZjPTAwMSZkPW1pbg==)/render.asp?packageid=DE0426DD9B0249F19515001A64D3F462&id=32D255D472EA11DA36BB000F20DAC9EF
I hope you may also search BADI's in SE18 using wild search 'PURCHASEORDER002QR'.
Thanks,
Venu

What are the different messages that OCOD may return for a web service requ

Hi,
Please give me feedback on the questions below, concerning the limitations of web service, and messages which may return.
1) What are the different messages that OCOD may return for a web service request? I need all the messages of all the scenarios which OCOD can meet, for example:
- If the file is rejected (Error message)
- If the file is accepted (to clarify that the records have been created)
- if the application is unavailable (maintenance or web service is down)
2) How many request can we send simultaneously, and how many records we can make per second?
Best Regard,

Have a look here Jquery slideshow tutorial for beginners | WEBTUTS

No WSDL Validation at Application Level for Enterprise Web Services

Similar Messages

Maybe you are looking for