a question about web service

[Former Member]

hi experts,

I develop a web service based on abap FM. When the 3party programs call it, user need to input the username/password.

can I config sth for the web service, and user don't need the input user/pass?

Thanks

[JackGraus]

The webservice created for the RFC should be visible in the webservice tree, tranaction SICF under "sap/bc/srt/sap". The webservice is default created without user/password but you could enter a user/password on the "Logon Data" tab of the webservice.

Regards Jack

[Former Member]

thanks,Jack

I have one more question. If no password for this web service, any log for having called this web service?

I'm afraid this will has a security issue if access the web service without user/pass

Thanks.

[JackGraus]

You could enable the ICF recorder for this webservice. This can be done in transaction SICF. Then calls to the webservce are logged: URL's and also the content of POST.

Regards Jack

[Former Member]

Hi Michael,

I understand you are worried about security (i.e.people accessing the Service anonymously is something you want to avoid). Also, you don't want the people to have to manually authenticate themselves (i.e. enter a User ID and Password) to execute the Service. In this case, you need to use a more sophisticated authentication technique like X.509 SSL Client Certificate or SAP Single Sign On Ticket. This is a complex subject and not suitable for discussion here. Here are links to topics that could get you started.

1. SAP Help Portal link to the topic Security Aspects for Web Services:

http://help.sap.com/saphelp_nwpi71/helpdata/en/46/a088198f835edfe10000000a11466f/frameset.htm

2. SAP Help Portal link to the topic Making a Web Service Secure:

https://help.sap.com/saphelp_nwpi711/helpdata/EN/47/ab7ba049f84848e10000000a421138/frameset.htm

I hope this helps.

Best Regards,

Andy