X.509 Web Service Authentication for ABAP AS Web Service Interaction

[Former Member]

We are trying to use X.509 web service authentication with SAP Web AS ABAP between 2 different SAP installations. Company 1 is trying to consume a web service set up by Company 2.

Company 1 has installed Company 2's public key, generated the client proxy using Company 2's WSDL and created a corresponding lpconfig entry.

Then company 2 has set up the profile parameter ICM/HTTPS/verify_client to accept certificates and imported Company 1's SLL client certificate and mapped the user in USREXTID. Note that Company 1 uses self-signed certificates, so it does not have a root certificate, which is what the documentation says should be imported into the PSE instead of the SSL client certificate.

When Company 1 tries the web service call, it receives a request to authenticate the web service from Company 2. (basic authentication logon screen, even though the web service configuration is set to X.509 Client Certificate.

Should this work or is there a problem because Company 1 uses self-signed certificates or is there something else we are missing?

[former_member678355]

The error:

SRT: Unexpected failure in SOAP processing occurred: ("No Web service configuration for this access path: """)

turned out to be a bad URL parameter pass on our side. Once we got the parameters working, it ran.

[Former Member]

Company 2 does use a load balancer, but the SSL is passed through to the SAP application servers.

We gave up on the X.509 authentication since we have a self-signed certificate and are already using it for connections to other companies.

So now company 2 has provided a user ID and password and switch back to basic user authentication. When I try the web service call now, I get the error

SRT: Unexpected failure in SOAP processing occurred: ("No Web service configuration for this access path: """)

We do not see any errors on our side. They are able to access the service internally. We have lpconfig set up to use SM59 and if we test the connection in SM59, and enter the user ID/password, we get the same error. I have not found any help on SDN for this message.

We are calling other external web services with no problems.

Thanks for any help.

[Former Member]

Hi,

Do you have a Reverse Proxy (like SAP Web Dispatcher or Apache) in front of Company 2 system ?

If yes, where does the SSL connection end ?

Regards,

Olivier

[Former Member]

--

Edited by: Gourav Khare on Feb 2, 2011 12:40 PM

[Former Member]

>

> We are trying to use X.509 web service authentication with SAP Web AS ABAP between 2 different SAP installations. Company 1 is trying to consume a web service set up by Company 2.
> 
> Company 1 has installed Company 2's public key, generated the client proxy using Company 2's WSDL and created a corresponding lpconfig entry.
> 
> Then company 2 has set up the profile parameter ICM/HTTPS/verify_client to accept certificates and imported Company 1's SLL client certificate and mapped the user in USREXTID.  Note that Company 1 uses self-signed certificates, so it does not have a root certificate, which is what the documentation says should be imported into the PSE instead of the SSL client certificate.
> 
> When Company 1 tries the web service call, it receives a request to authenticate the web service from Company 2. (basic authentication logon screen, even though the web service configuration is set to X.509 Client Certificate.
> 
> Should this work or is there a problem because Company 1 uses self-signed certificates or is there something else we are missing?

I think that the problem is in Service Authentication (in transaction sicf). You have to consume web-service, transmitting user-password for access.