Web service: security

[Former Member]

Hi,

I have a general question regarding security in webservices.

We have a webservice for which a SAP user and password is required.

The external system that consumes the webservice, works automatically so I guess they have the SAP user and password hardcoded in their system. ( The SAP system and external system are on the same ‘secure’ network, there is no firewall in between ).

Concerning authorization roles, we will restrict the role for this SAP user to the transaction that is being called in the webservice, but still I feel uneasy with the idea that someone who knows the SAP user and password can build code and start calling the webservice.

Question is: can you give me some advice on how security for a webservice is usually set up in this situation ?

Thank you,

Rolf

[Former Member]

Rolf,

Hi. If you are concerned then there are a couple of things that can be done to ensure that no-one can 'pick-up' the user-name/password just by monitoring the network.

1) Ask the calling site to ensure they use a POST call not a GET. This is standard internet security and is generally adhered to by web developers.

2) You could request the web service be via HTTPS (A setting in SICF will 'require' this protocol when calling your web service). This will mean no 'sniffers' on the network will be able to identify data passed between the two applications i.e. user-name/password.

If your concern is that the people storing the user-name/password are doing this in a manner that someone might have access to this, then I would suggest you get then to store this in a more secure manner.

One other option is to hard-code the user-name/password into the web service (SICF) and when they call your webservice it wont ask for user signon. Seems like an option if the web service doesn't allow them to do anything except a simple tcode call.

SDN has many interesting topics/documents on web security, so you could always scan the blogs for a more detailed analysis.

Cheers

Rob

[Former Member]

Thanks, i'll check it out.