Authentication for Webservice

[Former Member]

Hi All,

I have exposed my outbound interface as a webservice sucessfully

But the problem is I need to provide a User Id to contact XI SOAP adapter. I dont require any authentication for this webservice client. How can I disable the authentication check for this particular webservice.

I have seen some forum posts, which suggested me to make some modification in web.xml which will disable auth for all webservices. Is it possible for me to disable the authentication check only for this particular webservice?

Regards,

Jai Shankar

[MichalKrawczyk · Accepted solution]

Hi Jai,

>>>>How can I disable the authentication check for this particular webservice.

you can only do it for the whole SOAP adapter - so not advisable

>>>>Is it possible for me to disable the authentication check only for this particular webservice?

not possible

Regards,

michal

[Former Member · Accepted solution]

Michal,

Thanks for the input. In that case, I do not wat the end user to provide a user id, pwd to send the msg to SOAP adapter. Is it a recommended approach to hard code the user id in the application?

Any other alternative approach?

Your insights are highly appreciated.

Regards,

Jai Shankar

[bhavesh_kantilal · Accepted solution]

Jai,

I guess one option is to create a Service User Id with a non expiring password and hardcoding it in the application.

Even here, like you do in a J2EE application you can have a properties file to key in the user id and password.

and when the dats is being sent from the application to XI, it can use this to red the user name and password and make the call to XI.

Just like you do for any J2EE application etc.

Regards

Bhavesh

[MichalKrawczyk · Accepted solution]

Hi,

>>>>>Is it a recommended approach to hard code the user id in the application?

no

as if you change the pass (even by accident) you will need to recompile

your app

try to put it in some configuration (property) file

together with your app

anyway it has to be changeble somehow

Regards,

michal

[Former Member · Accepted solution]

Bhavesh/Michal,

Thanks a lot. Your inputs helped me a lot.

Saw this forum thread, where Bernard said such an option would be available from SP14. But it seems, the functionality is still not included.

Regards,

Jai Shankar

[henrique_pinto · Accepted solution]

Best option to avoid client system to have to provide user/pwd is to use client certificates for authentication. You'll have to register your server certificate with a particular https port and also you'll have to maintain the client certificate in SSL Provider Service.

It is the same principle behind Single Sign-On.

Check this link for further information: http://help.sap.com/saphelp_nw2004s/helpdata/en/b0/881e3e3986f701e10000000a114084/frameset.htm.

Regards,

Henrique.

[Former Member · Accepted solution]

Henrique,

Thanks a lot. Have never used certificates so far. Will try to read more and get back if I face any problems.

Regards,

Jai Shankar

[Former Member · Accepted solution]

Hi,

If you are using a username/password based authentication, then don't maintain the user as Communication user, as the password will expire.

Better to keep it as type Service.

Regards

Puloma.

[Former Member · Accepted solution]

Hi Jai,

Can you provide me the code as to how to pass the userid and password from the J2EE application on apache when calling the XI webservice.

[bhavesh_kantilal]

Jai,

><i>How can I disable the authentication check for this particular webservice.</i>

Check this thread. But this will turn of Authentication for all SOAP Sender Adapters.

><i>I have seen some forum posts, which suggested me to make some modification in web.xml which will disable auth for all webservices. Is it possible for me to disable the authentication check only for this particular webservice?</i>

Its either for all SOAP adapters or for none . there is no middle ground.

Better way is to use Access Control List.

Regards

Bhavesh