SAP PI HTTP POST dynamic basic authentication string

[#1]

Dear guys

I am facing an integration challenge with specific/enhanced security requirements.

There should be an async interface to transfer document from internal system to external webservice via SAP PI java only.

• Sender will be REST
• receiver also REST (either JSON or XML message as https POST)

For security reasons the receiver expects basic authentication, but the authentication string should be dynamic consisting of :

• username (fix)
• public key (dynamic per Call)
• encrypted password (dynamic as encrypted by dynamic key)

the document should be tranfered directly as base64 string and not be included in JSON or XML structure.

Following two main questions arises:

1. Is there an possibility to dynamically set basic authentication string in HTTP header? I know it is not possible in SOAP Receiver via ASMA. Maybe there are other ways to set this value dynamically during runtime
2. Does REST or SOAP in plain mode support direct transmitting of base64 string or is structure mandatory e.g. XML with single field. This should be a minor issue.

Any Idea how to solve part 1 dynamic basic authentication?

Any thoughts or idea appreciated.

Best regards

Jochen

[Former Member]

point 1 is possible.

https://answers.sap.com/questions/84202/how-configure-dynamic-http-header-in-rest-receiver.html

you can construct the key UDF or java mapping and put it in dynamic configuration. dynamic configuration variable can be used in Http header of rest receiver channel

point 2

what is the operation of the service? GET,PUT,POST,etc..

[Jochen_Gugel]

Hi sapbinary key

hi Manoj

thanks for your responses.

I set up an test scenario SOAP -> PI -> (TCP Tracing) -> REST and tried to set HTTP header parameter via ASMA.

It looks promising, the HTTP parameters are visible in the trace. Hopefully the receiver system is able to recognize the parameter correctly. the actual receiver do not expect any authentication.

I try to enhance my test scenario and use an REST receiver expecting basic authentication have an end-to-end test.

I will come back a let you know the result.

regarding point 2: my operation is POST.

once again thanks for your support.

best regards

Jochen

[manoj_khavatkopp]

Hi Jochen,

1.I don't think this is possible as basic authentication is static in REST channel and there are no Dynamic Configuration variable available for these attributes .

2.When you say direct transmitting you mean without any soap envelope or any structure ? just the main output paylaod should have base64 content.

Br,

Manoj