Web Dispatcher 7.3 support adding authentication before sending request to backend

[sunil_pandey6]

Hi All,

I do not know this is the right forum for seeking helps related web dispatcher 7.3, we have web service scenario where we are hosting web service in SAP PI 7.11 and our external client is calling this web service for some business function. We already have external facing web service running in our environment using web dispatcher as proxy between external client and SAP PI.

Now new client is asking us to provide web service without authentication what this means is that they are not going to pass user/password (basic authentication) when they call web service, I am thinking is it possible in web dispatcher to add authentication in request before sending it to SAP PI.

This is what I already tried… terminating the SSL in web dispatcher but I do not find any document which let me know how to add header variable for
authentication. I know there are some other product like datapower from IBM where they receive request and play around the authentication like basic to client certificate to SAML token base authentication between datapower and SAP system.

Is it possible in web dispatcher 7.3 to add authentication before sending request over to SAP PI?

With Regards

Sunil

[Former Member]

Try using the axis adapter. Here you have the possibility to accept web service calls without any need for authentication. The FAQ Note describes this in detail.

[Former Member]

Hi Sunil,

Maybe try the SAP Security forum?

They should have a better idea there...Especially with use cases for the SAP Web Dispatcher in the DMZ or being used as a reverse proxy. The "without authentication" requirement confuses me. Even if the web dispatcher is in the DMZ, there should still be some sort of authentication (like SSL with certs, never Basic) to prevent denial of service attacks at the very least.

While PI can support SAML authentication and SSL termination and re-encrytion, I'm not sure what web dispatcher is capable of (after SSL termination from external client) because it's not a full blown reverse proxy solution.

Regards, Trevor