Hook_URL for Punchout Catalogue

[Former Member]

Hi,

my understanding of the configuration required in SRM for punch out catalogue settings is that the Hook_URL parameter shoudl eb left blank and the value is automatically determiend at runtime.

The requirement from our security team is that we should need set the server details externally to the supplier, is there a way we can mask the server name in the URL?

Regards

Chris

[Former Member · Accepted solution]

hi,

For internal catalog and Punch out catalog you have to define the HOOK_URL leave as blank

and type as Return URL

No need to Mask . It will work

Regards

G.Ganesh Kumar

[Former Member · Accepted solution]

Hi,

I think you've missed the point of my question. I understand that you don't need to populate the the HOOK_URL paramter however the requirement from our security team is to not expose the server name to external parties when punching out, is this possible?

Thanks

Chris

[Matt_Fraser · Accepted solution]

I'm not sure that's possible. In any case, it isn't your server that is calling the supplier's server, it is your end user's browser when they select the punchout catalog. The hook_url parameter (and the other parameters you define in the punchout catalog configuration in your SRM system) will be passed by the user's browser in the HTTP GET request sent to the supplier's website. It's not so much that the supplier needs that information, but your user's browser needs it in the session state so as to be able to return the catalog items back into the open shopping cart (via HTTP POST). However, as it's part of the URL string submitted by the browser to the supplier website, even if they don't use it it should show up in their web access logs.

Note that your SRM server does not need to be exposed outside your firewall to your supplier for this activity to occur. It is your user's browser that is doing the work, and presumably your user is inside your firewall. So, even though the supplier could see the hostname of your SRM server, that doesn't mean they have any access to it (unless you're also exposing it for supplier self-services or some similar scenario, in which case they have to know the hostname or they can't do business with you).

--Matt

[Former Member]

Hi Chris,

I think it's the IP address of the server which is required by the supplier becasue they need to open ports for this particular IP to allow it to access supplier's portal and I dont think it takes along the other details with it while accessing the supplier's catalog.

- Ajay