Questions about punchout catalogs in SRM 7.0

[Former Member]

1) Does SRM use any encryption when sending the catalog URL and the user ID and password to the punchout catalog.

2) When the Punch out catalog sends back the data to SRM, are we exposing the SRM server to internet? (opening up a port etc)

This could be a possible security risk

3) How is session management handled? suppose 3 users are using the catalog simultaneously, how does the punchout catalog know , which items to transfer , where?

4) How can we ensure that the punchout vendor is charging the correct prices as agreed in the contract and not changing them?

5) If it is decided that all the items in the catalog be stored as product masters in SRM and a contract is maintained for them, is it possible to do a price check against that contract , at run time when the shopping cart is created ?

6) Can the UNSPSC code sent by the vendor in the OCI data be stored in a std field in the shopping cart?

Regards

Kedar

[Former Member]

Thanks a lot Jason!

I have some further questions.

1) For enabling the xml variant of the oci, we need to pass two parameters in the call structure.

~xmltype = ESAPO3.5

~xmlDocument -????

What should be the value of the xmlDocument parameter?

As per the Document :"In this parameter the XML file that must correspond to one of the schemas above is transferred as a Base64-coded character set."

So should it be a file name or file path??

Also where do we get the file ? Could you provide an example of this parameter maintained in SRM?

2) Does the OCi support any version of xml, provided a suitable reference file is provided? can it support pidx or cxml?

3) When the supplier is sending the UNSPSC code, which field in the shopping cart is it copied?

I didn't see any field by the name External category ID in the std. shopping cart. Is this copied to the Product category field?

Regards

Kedar

[jason_boggans]

Hi Kedar,

1) For enabling the xml variant of the oci, we need to pass two parameters in the call structure.

~xmltype = ESAPO3.5

~xmlDocument -????

What should be the value of the xmlDocument parameter?

As per the Document :"In this parameter the XML file that must correspond to one of the schemas above is transferred as a Base64-coded character set."

So should it be a file name or file path??

Also where do we get the file ? Could you provide an example of this parameter maintained in SRM?

The value is as defined, it looks for the schema used, in the case of ESAP0-3.5 it should be the OpenCatalogInterface.xsd as defined in the documentation. I will attach the xsd for you to see, it should refer to the xml file contained within the HTML form submitted

2) Does the OCi support any version of xml, provided a suitable reference file is provided? can it support pidx or cxml?

I am not sure here, basically, we take the xml document passed and move it into the integration engine where it is parsed using the transformation BBP_OCI_XML_TO_RFC, i.e. inside function MAP_XML_TO_ITABS we call this if the xmltype = ESAP0-3.5

IF xml_type = 'ESAPO-3.5'.

• Transfrom OCI XML data via XSLT to RFC structures

TRY.

CALL TRANSFORMATION bbp_oci_xml_to_rfc

SOURCE XML IV_XML_DOCUMENT

RESULT sc_items = lt_sc_items.

CATCH CX_ROOT INTO lr_exception.

• CATCH cx_xslt_runtime_error.

RAISE xslt_failure.

ENDTRY.

ENDIF.

I guess if the XML type is not interpreted then you'll get an xslt failure

3) When the supplier is sending the UNSPSC code, which field in the shopping cart is it copied?

I didn't see any field by the name External category ID in the std. shopping cart. Is this copied to the Product category field?

It is (I think, I haven't fully checked this in the coding) reffered to the Product Category field, the mapping for external product category is decided in Form map_product_category

IF NOT iv_ext_schema_type IS INITIAL OR

NOT iv_ext_category_id IS INITIAL.

PERFORM get_external_category_guid USING iv_ext_schema_type

iv_ext_category_id

CHANGING cv_category_guid

cv_error.

Regards,

Jason

[jason_boggans]

Sorry, forgot the xsd

[jason_boggans]

Hi Kedar,

I will try to answer what questions I can.

1) Does SRM use any encryption when sending the catalog URL and the user ID and password to the punchout catalog

Yes, submitted HTML data sent in the HTTP request is subjected to encoding, however, to my knowledge the encoding used in the XML version of the OCI is greater

2) When the Punch out catalog sends back the data to SRM, are we exposing the SRM server to internet? (opening up a port etc)

Yes, but the data is returned based on the predefined settings on catalog call, i.e. you define the return parameters so you can define exactly how the data is returned.

3) How is session management handled? suppose 3 users are using the catalog simultaneously, how does the punchout catalog know , which items to transfer , where?

Each user accesses a seperate instance of the catalog, depending on release and configuratuion the session management is handled either by the application directly or by the Portal

4) How can we ensure that the punchout vendor is charging the correct prices as agreed in the contract and not changing them?

I guess for this you should be able to trust the catalog vendor? In any case, it is likely that any variances will be picked up by Purchasers at a later stage and this can be resolved with the catalog vendor. You could also I guess do some coding in the BBP_CATALOG_TRANSFER Badi to ensure that contract fields are filled when receiving data from a particular catalog?

5) If it is decided that all the items in the catalog be stored as product masters in SRM and a contract is maintained for them, is it possible to do a price check against that contract , at run time when the shopping cart is created ?

If contract and contract line are passed via OCI, the contract item will be validated in all cases.

6) Can the UNSPSC code sent by the vendor in the OCI data be stored in a std field in the shopping cart?

Yes, it should be passed via OCI as NEW_ITEM-EXT_SCHEMA_TYPE and NEW_ITEM-EXT_CATEGORY_ID as defined in the OCI 4.0 documentation attached. (Section 4.2.4)

Regards,

Jason

[Former Member]

Hello All

I need answers to these questions as our client wants to evaluate the punch-out catalog before deciding.

I would appreciate any info you provide

regards

Kedar