Questions about punchout catalogs in SRM 7.0

Question

1) Does SRM use any encryption when sending the catalog URL and the user ID and password to the punchout catalog.
2) When the Punch out catalog sends back the data to SRM, are we exposing the SRM server to internet? (opening up a port etc)
This could be a possible security risk
3) How is session management handled? suppose 3 users are using the catalog simultaneously, how does the punchout catalog know , which items to transfer , where?
4) How can we ensure that the punchout vendor is charging the correct prices as agreed in the contract and not changing them?
5) If it is decided that all the items in the catalog be stored as product masters in SRM and a contract is maintained for them, is it possible to do a price check against that contract , at run time when the shopping cart is created ?
6) Can the UNSPSC code sent by the vendor in the OCI data be stored in a std field in the shopping cart?
Regards
Kedar

Answer 1

Hi Kedar,
1) For enabling the xml variant of the oci, we need to pass two parameters in the call structure.
~xmltype = ESAPO3.5
~xmlDocument -????
What should be the value of the xmlDocument parameter?
As per the Document :"In this parameter the XML file that must correspond to one of the schemas above is transferred as a Base64-coded character set."
So should it be a file name or file path??
Also where do we get the file ? Could you provide an example of this parameter maintained in SRM?
The value is as defined, it looks for the schema used, in the case of ESAP0-3.5 it should be the OpenCatalogInterface.xsd as defined in the documentation. I will attach the xsd for you to see, it should refer to the xml file contained within the HTML form submitted
2) Does the OCi support any version of xml, provided a suitable reference file is provided? can it support pidx or cxml?
I am not sure here, basically, we take the xml document passed and move it into the integration engine where it is parsed using the transformation BBP_OCI_XML_TO_RFC, i.e. inside function MAP_XML_TO_ITABS we call this if the xmltype = ESAP0-3.5
IF xml_type = 'ESAPO-3.5'.
  Transfrom OCI XML data via XSLT to RFC structures
    TRY.
        CALL TRANSFORMATION bbp_oci_xml_to_rfc
          SOURCE XML IV_XML_DOCUMENT
          RESULT sc_items = lt_sc_items.
      CATCH CX_ROOT INTO lr_exception.
     CATCH cx_xslt_runtime_error.
        RAISE xslt_failure.
    ENDTRY.
  ENDIF.
I guess if the XML type is not interpreted then you'll get an xslt failure
3) When the supplier is sending the UNSPSC code, which field in the shopping cart is it copied?
I didn't see any field by the name External category ID in the std. shopping cart. Is this copied to the Product category field?
It is (I think, I haven't fully checked this in the coding) reffered to the Product Category field, the mapping for external product category is decided in Form  map_product_category
IF NOT iv_ext_schema_type IS INITIAL OR
     NOT iv_ext_category_id IS INITIAL.
    PERFORM get_external_category_guid USING iv_ext_schema_type
                                             iv_ext_category_id
                                    CHANGING cv_category_guid
                                             cv_error.
Regards,
Jason