Application Development and Automation Discussions
Join the discussions or start your own on all things application development, including tools and APIs, programming models, and keeping your skills sharp.
cancel
Showing results for 
Search instead for 
Did you mean: 
Read only

a question about web service

Former Member
0 Likes
656

hi experts,

I develop a web service based on abap FM. When the 3party programs call it, user need to input the username/password.

can I config sth for the web service, and user don't need the input user/pass?

Thanks

1 ACCEPTED SOLUTION
Read only

JackGraus
Active Contributor
0 Likes
630

The webservice created for the RFC should be visible in the webservice tree, tranaction SICF under "sap/bc/srt/sap". The webservice is default created without user/password but you could enter a user/password on the "Logon Data" tab of the webservice.

Regards Jack

hi experts,

I develop a web service based on abap FM. When the 3party programs call it, user need to input the username/password.

can I config sth for the web service, and user don't need the input user/pass?

Thanks

4 REPLIES 4
Read only

JackGraus
Active Contributor
0 Likes
631

The webservice created for the RFC should be visible in the webservice tree, tranaction SICF under "sap/bc/srt/sap". The webservice is default created without user/password but you could enter a user/password on the "Logon Data" tab of the webservice.

Regards Jack

Read only

Former Member
0 Likes
630

thanks,Jack

I have one more question. If no password for this web service, any log for having called this web service?

I'm afraid this will has a security issue if access the web service without user/pass

Thanks.

Read only

JackGraus
Active Contributor
0 Likes
630

You could enable the ICF recorder for this webservice. This can be done in transaction SICF. Then calls to the webservce are logged: URL's and also the content of POST.

Regards Jack

Read only

Former Member
0 Likes
630

Hi Michael,

I understand you are worried about security (i.e.people accessing the Service anonymously is something you want to avoid). Also, you don't want the people to have to manually authenticate themselves (i.e. enter a User ID and Password) to execute the Service. In this case, you need to use a more sophisticated authentication technique like X.509 SSL Client Certificate or SAP Single Sign On Ticket. This is a complex subject and not suitable for discussion here. Here are links to topics that could get you started.

1. SAP Help Portal link to the topic Security Aspects for Web Services:

http://help.sap.com/saphelp_nwpi71/helpdata/en/46/a088198f835edfe10000000a11466f/frameset.htm

2. SAP Help Portal link to the topic Making a Web Service Secure:

https://help.sap.com/saphelp_nwpi711/helpdata/EN/47/ab7ba049f84848e10000000a421138/frameset.htm

I hope this helps.

Best Regards,

Andy