SOAP Adapter (Client Authentication)

Hi Guys,
I am trying to follow this blog
How to use Client Authentication with SOAP Adapter
Am new to this security settings stuffs , i hear that we have to maintainn keys in visual admin and then later authenticate , am confused all around
My Question
1) Who would provide the Key or certificate ?
2) Should we generate and give it to client r is it given by the client??
3) Where to maintain these key , i know in visual admin , but what r the steps and which place ?
$) How to use this to get authenticated with SOAP Sender Adapter ?
Can any one elobrate this in details and provide any more links on this.
thx in advance for help
with regards
Srini

HI
1.These will be provided by th Client or they can be downloaded from the website n then the Basis Team or the System Adminstrator will do the needful for us.
2.it depends , if the client wishes to give to us he will give or Basis team will be helping us in this Query.
Digital certificates
A digital certificate is an electronic "credit card" that establishes your credentials when doing business or other transactions on the Web. It is issued by a certification authority (CA). It contains your name, a serial number, expiration dates, a copy of the certificate holder's public key (used for encrypting messages and digital signatures), and the digital signature of the certificate-issuing authority so that a recipient can verify that the certificate is real. Some digital certificates conform to a standard, X.509. Digital certificates can be kept in registries so that authenticating users can look up other users' public keys.
Certificates are issued by Certifying Authority(CA) for people or an organization. This is used to identify unique person or unique organization.
Also look at these links
http://www.abanet.org/scitech/ec/isc/dsg-tutorial.html
http://mindprod.com/jgloss/certificate.html
Please go through these links and i am sure they will help you in some ways.
http://help.sap.com/saphelp_nw04/helpdata/en/a8/882a40ce93185de10000000a1550b0/content.htm
https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/docs/library/uuid/db3d8798-0701-0010-9781-8a6e925dd5da
https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/docs/library/uuid/092dddc6-0701-0010-268e-fd61f2035fdd
https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/docs/library/uuid/b2a56861-0601-0010-bba1-e37eb5d8d4a9
cheers
Edited by: vemuganti naga phalguna on Jul 2, 2008 1:00 PM

Similar Messages

Receiver SOAP adapter - User authentication question

XI experts,
Here is the scenario - IDOC > XI > SOAP - Ansynchronous call..
I need your all help to understand the user authentication on the "Receiver SOAP Adapter"... We are using "HTTP" transport protocol.
I believe, the userid which we entered in the communication channel needs to have proper security on the web server. The Web server URL starts with "http://lsme
01.xyz.com/...." .
Question : Is this usrid and password will be encrypted when XI calls this web service?
If an answer is "NO" then is there anyway we can encrypt it?
Thanks in advance!
Points will be given..
MP

XI experts,
I need an answer to the following question....
The Web server URL starts with "http://lsme01.xyz.com/...." .
Question : Is this usrid and password will be encrypted when XI calls this web service?
If an answer is "NO" then is there anyway we can encrypt it?
Thanks in advance!
Points will be given..
MP

Sender SOAP adapter without authentication

Dear All,
I am working on one of our customer requirement where i need to send data to SAP ECC 6.0 using SOAP (Sender) and RFC (Receiver).
My scenario is SOAP (Sender) to RFC (Receiver). While configuring the SOAP sender adapter i am selecting 'HTTP' and my QOS is 'Best Effort' as it is a synchronous call.
The Web service URL looks like as follows :
http://xiserver:50000/XISOAPAdapter/MessageServlet?channel=:BS_WROUTE:SOAP_SEN_ROUTE_DATA&version=3.0&Sender.Service=BS_WROUTE&Interface=http%3A%2F%2Fxxx.com%2Froute%5EMI_WROUTE_ROUTE_OUT
The problem i am facing is while testing this web service {generated by PI 7.0 (in ID)} it is asking for user name and Password.
Can somebody suggest me while testing :
1) how can we avoid user name and Password?
2) Can we attach user name and Password in our SOAP URL? if yes so please suggest me how to attach this.
Thanks
Honey

Dear Stefan,
Thanks for your reply.
If I am using ABAP Port 8000 for my scenario and my URL is as follows :
http://xiserver:8000/XISOAPAdapter/MessageServlet?channel=:BS_WROUTE:SOAP_SEN_ROUTE_DATA
Can i not use this additional string &sap-user=user&sap-password to provide the user name and password in wsdl??
my new URL would be like this:
http://xiserver:8000/XISOAPAdapter/MessageServlet?channel=:BS_WROUTE:SOAP_SEN_ROUTE_DATA&sap-user=user&sap-password
Please suggest how can i avoid the credentials.
Thanks
Honey

SOAP -Client Certificate Authentication in Receiver SOAP Adapter

Dear All,
We are working on the below scenario
SAP R/3 System -> XI/PI -> Proxy -> Customer
In this, SAP R/3 System sends a IDOC and XI should give that XML Payload of IDOC to Customer.
Cusomer gave us the WSDL file and also a Certificate for authentication.
Mapping - we are using XSLT mapping to send that XML payload as we need to capture the whole XML payload of IDOC into 1 field at the target end ( This was given in the WSDL).
Now, how can we achieve this Client Certificate authentication in the SOAP Receiver Adapter when we have Proxy server in between PI/XI and Customer system.
Require your inputs on Client Certificate authentication and Proxy server configuration.
Regards,
Srini

Hi
Look this blog
How to use Client Authentication with SOAP Adapter
http://help.sap.com/saphelp_nw04/helpdata/en/14/ef2940cbf2195de10000000a1550b0/content.htm
Also refer to "SAP Security Guide XI" at service market place.
ABAP Proxy configuration
How do you activate ABAP Proxies?

Enabling HTTPS with Client Authentication for Sender SOAP Adapter on PI7.1

Hello All,
We are currently building up a HTTPS message exchange with an external client.
Our PI 7.1 recieved over HTTPS messages on an already configured Sender SOAP Adapter.
The HTTPS (SSL) connectivity works fine and was completely configured on the ABAP Stack at Trust Manager (TC=STRUSTSSO2)
Login to Message Servlet "com.sap.aii.adapter.soap.web.MessageServlet is required and works fine with user ID and password.
Now we have to configure the addtional Client Authentication.
At SOAP Adapter (Sender Communication Channel) under "HTTP Security Level"you are able to configure "HTTPS with Client Authentication".
But what are the next steps to get this scenario successfully in place?
Many thanks in advance!
Jochen

Hi Colleagues,
following Steps still have to be done:
- Mapping public key to technical user at Java Stack
As preparation you have to activate value "ume.logon.allow.cert" with true under "com.sap.security.core.ume.service" under Config Tool. At NWA under Identity Management at for repecively technical user the public key certificate
- Be sure CA root certivicate at Database under STRUSTSSO2
- Import intermediate Certificate under Certificate List at Trast Manager for the Respecive Server Note
- use Login Module "client_cert" which you have to configure under NWA\Configuration Management\Authentication for Components "sap.com/com.sap.aii.adapter.soap.app*XISOAPAdapter".
Many thanks to all for support!
Regards,
Jochen

SOAP sender adapter with client authentication

Hi,
Can you please tell me the steps to be followed to configure SOAP sender adpater for HTTPS with client authentication.
Thanks

Hello,
Check out this SAP NOTE
[Note 891877 - Message-specific configuration of HTTP-Security|https://websmp130.sap-ag.de/sap(bD1lbiZjPTAwMQ==)/bc/bsp/spn/sapnotes/index2.htm?numm=891877]
Check out below blog for step by step process.
/people/rahul.nawale2/blog/2006/05/31/how-to-use-client-authentication-with-soap-adapter
Hope this will help.
Nilesh
Edited by: Nilesh Kshirsagar on May 28, 2009 11:31 AM

SOAP Adapter - HTTPS w/ client authentication -SSL termination @ dispatcher

Hi,
We have a SOAP client sending SOAP message over SSL to PI. We are using client cert for authentication, but terminating SSL at web dispatcher. In this scenario, i) do we need to configure security for XISOAPADAPTER in Visual admin on PI and ii) do we need to set HTTPS with client authentication security option in SOAp Sender communication channel?
My understanding is that since we are terminatinating SSL at web dispatcher (Server authentication happens between third-party gateway and our gateway and when web dispatcher terminates SSL, client cert for auth is passed via httpheader to PI where it is mapped to UME user with sufficient authorizations) we don't need to set the XISOAPADAPTER security (if it is end-to-end ssl we would i guess set up in V. Admin>Security provider service>clientcertloginmodule for XISOAPADAPTER) and we don't need to set the sender channel as https with client authentication ( it should just be http in SOAP sender channel).
Is my understanding correct? I will really appreciate any clues?
Thanks,
Saurabh

Hi saurabh
follow these links to SAP note
these will be helpful for you
Note 856597 - FAQ: XI 3.0 / PI 7.0 / PI 7.1 SOAP Adapter
https://websmp102.sap-ag.de/~form/handler?_APP=01100107900000000342&_EVENT=REDIR&_NNUM=856597&_NLANG=E
Note 856599 - FAQ: XI 3.0 / PI 7.0 / PI 7.1 Mail Adapter
https://websmp102.sap-ag.de/~form/handler?_APP=01100107900000000342&_EVENT=REDIR&_NNUM=856599&_NLANG=E
Note 870845 - XI 3.0 SOAP adapter SSL client certificate problem
https://websmp130.sap-ag.de/sap(bD1lbiZjPTAwMQ==)/bc/bsp/spn/sapnotes/index2.htm?numm=916664&nlang=EN&smpsrv=https%3a%2f%2fwebsmp102%2esap-ag%2ede
https://websmp130.sap-ag.de/sap(bD1lbiZjPTAwMQ==)/bc/bsp/spn/sapnotes/index2.htm?numm=870845&nlang=EN&smpsrv=https%3a%2f%2fwebsmp102%2esap-ag%2ede
regards
Sandeep
If helpful kindly reward points

HTTPS with Client Authentication in SOAP sender Adapter

Hi All,
In SOAP Sender communication channel. When I generate WSDL with HTTP Security Level = HTTP: it works when third party tries to send data to XIwebservice.
But when I tried with HTTPS with Client Authentication option its giving error
InfoPath either cannot connect to the data source, the service has timed out, or the server has an invalid certificate.
Please guide how to use HTTPS with Client Authentication option, and what all configuration need to apply in XI & in third party to use this.
Regards

Rohan,
With spy you can trace the entire route, since you are using client authentication using certificate, it would be a better option to verify with the certificate.
You also have the option of using a username/pwd combo though that is not advocated as it lowers security levels and is permeable to passive sniffing.
So the answer to your question is yes, after importing the certificate with sender and third party reciever a test would reveal the complete scenario along with any issues that you could encounter..
Regards
Ravi Raman

Configure Client Authentication for Receiver SOAP Adapter

Hi,
Can you please tell me what i should give in receiver soap channel for KeyStoreEntry and KeyStoreView after checking Configure Client Authentication checkbox,as I have got certificate from third party.
Thanks in advance
Best Regards,
Harleen Kaur Chadha

Hi,
Keystore Entry:
Login to Visual Admin --> Server --> Services --> KeyStorage --> TrustedCAs --> Load --> Select the location where you have stored the certificate on your local system
Load function is used as you have already got the certificate....
Once this is done you will find an entry for your certificate in the Entries tab of your TrustedCAs section.
This is your Keystore Entry...in other words it the name of your certificate.
Keystore View:
http://help.sap.com/saphelp_webas630/helpdata/en/16/c0503e1dac5b46e10000000a114084/content.htm
Are you going to consume Logon tickets of the Third party system (which is other than SAP J2ee engine of your XI)? If yes, then you may also need to do some more settings in the J2ee Engine.
Regards,
Abhishek.

How to use Basis Authentication in Sender SOAP Adapter

We implemented one Sender SOAP Adapter and we had to implement the modified WEB.XML method to remove the security specification. We have now asked the developer to correct this situation so we can remove this modification. The Interface developer would like to use Basic Authentication. If you have an automated interface sending in a SOAP Message, how do you do Basic Authentication?
I've tried using:
http://host:port/XISOAPAdapter/MessageServlet?channel=:<Service>:<Channel>&sap-user=xiappluser&sap-password=<Password>&sap-language=EN&sap-client=<Client>
When I do this, I still get the Authentication Pop-Up Window.
How does the Sending Interface either supply the ID and Password on the incoming SOAP Message or respond to the Authentication Pop-Up?
Thanks,
Anne

By Defualt the web service exposed by you will use Basic Authentication mode only.
But the way you do Basic Authentication in the web client is platfrom dependent.
This is not the way to do Basic authentication
http://host:port/XISOAPAdapter/MessageServlet?channel=:<Service>:<Channel>&sap-user=xiappluser&sap-password=<Password>&sap-language=EN&sap-client=<Client>
I am providing you a code snippet on how to Basic Authentication in Java when making the Web Service Call.
If the client is on some other platform just look for the corresponding api.
Please award points if you find this answer useful.
Code Snippet
URL url = new URL(URL);
URLConnection connection = url.openConnection();
if( connection instanceof HttpURLConnection )
((HttpURLConnection)connection).setRequestMethod("POST");
 //connection.setRequestProperty("Content-Length",Integer.toString(content.length()) );
 connection.setRequestProperty("Content-Type","text/xml");
 connection.setDoOutput(true);
 String password = User + ":" + Password ;
 //Where con is a URLConnection
 connection.setRequestProperty ("Authorization", "Basic " + encode(User + ":"+ Password));
 connection.connect();
Encode Method
public static String encode (String source) {
BASE64Encoder enc = new sun.misc.BASE64Encoder();
return(enc.encode(source.getBytes()));

Certificate based authentication with sender SOAP adapter. Please help!

Hi Experts,
I have a scenario where first a .Net application makes a webservice call to XI via SOAP Adapter. Then the input from the .Net application is sent to the R/3 system via RFC adapter.
.Net --->SOAP -
>XI -
>RFC -
R/3 System
Now as per client requirement I have to implement certificate based authentication in the sender side for the webservice call. In this case the .Net application is the "client" and XI is the "server". In other words the client has to be authenticated by XI server. In order to accomplish this I have setup the security level in the SOAP sender channel as "HTTPS with client authentication". Additionally I have assigned a .Net userid in the sender agreement under "Assigned users" tab.
I have also installed the SSL certificate in the client side. Then generated the public key and loaded it into the XI server's keystore.
When I test the webservice via SOAPUI tool I am always getting the "401 Unauthorized" error. However if I give the userid/password for XI login in the properties option in the SOAPUI tool then it works fine. But my understanding is that in certificate based authentication, the authentication should happen based on the certificate and hence there is no need for the user to enter userid/password. Is my understanding correct? How to exactly test certificate based authentication?
Am I missing any steps for certificate based authentication?
Please help
Thanks
Gopal
Edited by: gopalkrishna baliga on Feb 5, 2008 10:51 AM

Hi!
Although soapUI is a very goot SOAP testing tool, you can't test certificate based authentication with it. There is no way (since I know) how to import certificat into soapUI.
So, try to find other tool, which can use certificates or tey it directly with the sender system.
Peter

Receiver SOAP adapter SSL error - client certificate required?

Hi all,
Problem configuring SSL in XI 3.0 NW04 SP17....
I have followed the config steps from Rahul's excellent weblog at <a href="/people/rahul.nawale2/blog/2006/05/31/how-to-use-client-authentication-with-soap-adapter">How to use Client Authentication with SOAP Adapter</a> (my Basis team have done the Visual Admin steps) and am going through his example as it closely matches my requirement. So, I have a test receiver SOAP adapter sending messages to a web service URL defined for a sender SOAP adapter. My test scenario is:
Sender File -> Receiver SOAP -> Sender SOAP -> IDoc Receiver -> IDocs in R/3
The problem components are in italic and underlined above. My Receiver SOAP Adapter has the web service URL, Certificate Keystore Entry and View entered. If, in the Sender SOAP Adapter, I have an HTTP Security Level of HTTPS Without Client Authentication, the interface works fine (note that Rahul suggests you untick the User Authentication in the Receiver but with this Security Level, it seems to work with or without it).
The problem is when I set HTTPS With Client Authentication in the Sender. I then get the following error in the message monitor:
SOAP: response message contains an error XIServer/UNKNOWN/ModuleUnknownException - com.sap.aii.af.mp.module.ModuleException: java.security.AccessControlException: client certificate required caused by: java.security.AccessControlException: client certificate required at com.sap.aii.af.mp.soap.ejb.XISOAPAdapterBean.process(XISOAPAdapterBean.java:1111) at com.sap.aii.af.mp.module.ModuleLocalLocalObjectImpl3.process(ModuleLocalLocalObjectImpl3.java:103) at com.sap.aii.af.mp.ejb.ModuleProcessorBean.process(ModuleProcessorBean.java:250) at com.sap.aii.af.mp.processor.ModuleProcessorLocalLocalObjectImpl0.process(ModuleProcessorLocalLocalObjectImpl0.java:103) at com.sap.aii.af.mp.soap.web.MessageServlet.callModuleProcessor(MessageServlet.java:166) at com.sap.aii.af.mp.soap.web.MessageServlet.doPost(MessageServlet.java:421) at javax.servlet.http.HttpServlet.service(HttpServlet.java(Compiled Code)) at javax.servlet.http.HttpServlet.service(HttpServlet.java(Compiled Code)) at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java(Compiled Code)) at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java(Compiled Code)) at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java(Inlined Compiled Code)) at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java(Compiled Code)) at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java(Compiled Code)) at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java(Compiled Code)) at com.sap.engine.services.httpserver.server.Client.handle(Client.java(Inlined Compiled Code)) at com.sap.engine.services.httpserver.server.Processor.request(Processor.java(Compiled Code)) at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java(Compiled Code)) at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java(Compiled Code)) at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java(Compiled Code)) at java.security.AccessController.doPrivileged1(Native Method) at java.security.AccessController.doPrivileged(AccessController.java(Compiled Code)) at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java(Compiled Code)) at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java(Compiled Code)) Caused by: java.security.AccessControlException: client certificate required at com.sap.aii.af.mp.soap.ejb.XISOAPAdapterBean.process(XISOAPAdapterBean.java:843) ... 22 more
Has anyone got any idea what this could be caused by?
Many thanks,
Stuart Richards

Have you configured the https port with that keystore entry?
Check out these links:
http://help.sap.com/saphelp_nw2004s/helpdata/en/b0/881e3e3986f701e10000000a114084/frameset.htm
http://help.sap.com/saphelp_nw2004s/helpdata/en/5c/15f73dd0408e5be10000000a114084/frameset.htm
Regards,
Henrique.

SOAP Sender with HTTP(with SSL)=HTTPS with Client Authentication config

Hi All,
I have a Web-service-XI-Proxy scenario where we use SOAP Sender Adapter with HTTPs. Double authentication (client- server) sertificate shall be used.
Testing simple HTTP and XI user name/password works fine.
Now I installed requred sertificates in TrustedCA and ssl-provider in VIsualadmin.
But i can't see how i can configure certificates in SOAP sender Adapter. I've just did SOAP receiver for another scenario and there I could give keystore entry.
I also doesn't know how to disable asking for name/password. I am using XI 7.0.
Please advise.
Thanks,
Nataliya

Hi Nataliya,
Go to SOAP Adapter> Inbound Security Checks-> HTTP Security Level--> Here you can specify option "HTTP with Client Authentication.
One more thing HTTP Security level option is always available in Sender Adapter.
For more clarity about HTTPS find below link.
http://help.sap.com/saphelp_nw04/helpdata/en/14/ef2940cbf2195de10000000a1550b0/content.htm
To enable the TrustedCA in SOAP Sender adapter. Go SOAP Sender> Security Parameter> Security Profile--> Web Service
security. Then go to sender agreement there you need to give key store entry.

Setting interface name dynamically from client for SOAP Adapter...

Hi,
does anyone have experience in setting the sender interface name in the HTTP-SOAP request dynamically? I have followed the instructions in "How To Use the XI 3.0 SOAP Adapter" on page 17 (see also SAP Note 856597) which say:
"If you select Use Encoded Headers and Use Query String,
[...]The sender SOAP adapter creates the XI message header according to the
information provided in the query string. [...] In the sender SOAP adapter, you can use only some of the parameters, but the first
parameter must always be the version. For example, you send from the Web service client to the following URL: http://<host>:<j2ee-port>/XISOAPAdapter/MessageServlet?channel=<party>:<service>:<channel>&version=3.0&Interface=http%3A
%2F%2Fsap.com%2Ftest%5ETest
This will overwrite the default interface and namespace of the sender channel."
This is exactly what I need! However, what I actually get as a response following this description is a SOAP:Fault with a java.lang.StringIndexOutOfBoundsException: String index out of range: -1.
Has anyone got this to work properly?
Thanks in advance.

Thank you for your input. I am using the following format for the call (with "x" standing for one letter each):
http://xix.xxx.xx.xxx:5xx00/XISOAPAdapter/MessageServlet?channel=:xx_xxx_xxx_xxxx:xx_xxx_x_SOAP_S&version=3.0&Interface=http%3A%2F%2Fxxxxxxxx.xx%2Fxxxxxx%2Fxxxxxxxxxxxxxxxxxxxxxxxx%5Exxxxxxxxxxxxxxxxxxxxxx
Anything wrong with that? With unchecked "Use Encoded Headers" and "Use Query String" it works fine (default interface) but as soon as I set these flags I get the SOAP-Fault response.
We are on XI 3.0 SPS18.

Remove authentication in sender soap adapter pi 7.1

Hello
Did anyone manged to remove authentication in PI 7.1 sender soap adapter?
I have updated file web.xml in the file com.sap.aii.adapter.soap.war
and now I want to deploy it,but I dont have any sda in the folder
thx
Shai

hi Shai,
just something to try in case:
you don't need any java parameters of SOAP sender
you can try approach from Stefan:
/people/stefan.grube/blog/2006/09/21/using-the-soap-inbound-channel-of-the-integration-engine
and then:
1. in SICF copy the engine service to a new one
2. put the credentials for this new service inside SICF
then you will have sender SOAP adapter without a password right?
I didn't try it but I guess it would work without
crashing the whole original SOAP sender adapter by
making changes into web.xml
Regards,
Michal Krawczyk

SOAP Adapter (Client Authentication)

Similar Messages

Maybe you are looking for