15/7/2016

HowtoconfigureaServiceProviderABAPConnectivitySCNWiki

GettingStarted Newsletters

Welcome,Guest

Login

Register

Store

SearchtheCommunity

Products

Services&Support

AboutSCN

Downloads

Industries

Training&Education

Partnership

DeveloperCenter

LinesofBusiness

UniversityAlliances

Events&Webinars

Innovation

ABAPConnectivity / ABAPConnectivityHome / ABAPConnectivityWebServicesABAP

HowtoconfigureaServiceProvider
CreadoporFlorianChrosziel,modificadoporltimavezporFelipeZanettinieljun29,2016
Contents
HowtoconfigureaServiceProvider
Prerequisites
Procedure
Result
MoreInformation

HowtoconfigureaServiceProvider
ThisarticledescribeshowtoconfigureaWebServiceproviderusingtheSAPABAPSOAManager(transactionSOAMANAGER).Inordertoprovideacompactoverviewofthesteps,thisarticledoesnot
coveralltheavailableconfigurationoptionsindetail.ThesedetailstobeexplainedarelefttomorespecificarticlesintheSDN.Inthisarticle,wegiveanoverviewanddescribetheconfigurationoptionsthat
areessentialtoconfigureanABAPWSserviceprovider.
TheresultofaWebserviceconfigurationprocessistodefineasocalledbinding.TheW3Cconsortiumdefinesabindingasfollows(shortened):Abindingdefinesmessageformatandprotocoldetailsfor
operationsandmessagesdefinedbyaparticularportTypeaportTypeisdefinedasasetofabstractoperations,whereeachoperationreferstoaninputandoutputmessage.
TheportTypeisoftenreferredintheABAPenvironmentasthedesigntime(DT)dataofaWebService.OnABAPWSproviderside,theservicedefinitionistherepresentativeoftheDTdata.
SeveralbindingscanbegroupedintooneserviceimplementingalternativewaysforaccessingaWebService.Aservicemusthaveatleastonebinding.
ThebindinginformationisusedtosupporttheconfigurationofWSconsumersintheformofaWSDLdocument.EachconfiguredABAPWSproviderconfiguration(abinding)candescribeitssettingsviaa
WSDLdocument.AWSDLdocumentdescibesaWSinanXMLdocumentformat.Itgetsmostlyusedtopassthebinding'sinformationtoaWSconsumertosupportthesetupoftheconsumer'sbinding,
whichisreferencedviaaLogicalPort.

Withoutabinding,itisnotpossibletocallaWebService.FromtheconfigurationperspectiveeachbindingrepresentsacallableWebService.

Backtotop

Prerequisites
TodefineaWebService,aservicedefinitiongetsusedonABAPsystems.EachWebServiceproviderbindinginABAPisreferingtoaservicedefinitionasitsbasis.AnABAPservicedefinitionispractically
awrapperobjectkeepingalinktotheWebServiceimplementingclassorfunctionmoduleandtheDTconfiguration.TheDTconfigurationisacollectionofrequirementsforaWebServicewhicharealready
knownatDT.Itspecifybasicattributes(e.g.ifoperationsaresynchronouslyorasynchronouslyprocessed)andminimumrequirementsforabindingithastokeepforaccessingtheWebService(e.g.the
minimumauthenticationlevelrequired).

Backtotop

Procedure
ToconfigureaWebServiceprovider,performthefollowingsteps.
1.StartSOAManager
UsethetransactioncodeSOAMANAGERtostarttheABAPSOAManager.

TheSOAManagerisanABAPWebDynproapplication.ItislikeeachregularWDapplicationusinganICFnodeforaccessingit.YoumayusetransactionSICFtocheckthattheICFnode
forSOAManagertransaction(/sap/bc/webdynpro/sap/appl_soap_management)isactive.
Moreinformationaboutthissubject:SAPNote1124553and1088717.

2.FromthemainscreenoftheSOAManager,gototheServiceAdministrationtab

https://wiki.scn.sap.com/wiki/display/ABAPConn/How+to+configure+a+Service+Provider

1/9

15/7/2016

HowtoconfigureaServiceProviderABAPConnectivitySCNWiki

3.ChooseWebServiceConfiguration
4.SelectServiceDefinitionfromtheSearchbymenu,andspecifyaservicedefinition
Hereinthisconfigurationexample,wewillusetheservicedefinitionSRT_TEST_PROVIDER.
5.SelecttheGobutton
TheservicedefinitionisdisplayedintheSearchResults

https://wiki.scn.sap.com/wiki/display/ABAPConn/How+to+configure+a+Service+Provider

2/9

15/7/2016

HowtoconfigureaServiceProviderABAPConnectivitySCNWiki

EachservicedefinitioncanbeuniquelyidentifiedbyaninternalABAPname(char30incapitalletters)andanexternalqualifiedname(i.e.anamewithnamespaceandnamepart).The
userinputforthesearchisusedtosearchcaseinsensitivefortheinternalandtheexternalname(onlythenamecomponentoftheexternalname)ofaservicedefinition.

6.SelecttherowandchooseApplySelection
7.Existingservicesandbindingsaredisplayed.

https://wiki.scn.sap.com/wiki/display/ABAPConn/How+to+configure+a+Service+Provider

3/9

15/7/2016

HowtoconfigureaServiceProviderABAPConnectivitySCNWiki

Youmayseemultipleserviceseachwithatleastonebinding.Ifyouhaveaservicewithmultiplebindings,thenthesameserviceprovidesviadifferentruntimeconfigurationsalternativewaysfor
accessingtheservice.
8.ChooseCreate
Adialogboxisdisplayed,wheretheidentifyinginformationaboutanewproviderbindingmustgetspecified.Youhavetospecifyaservicename,abindingname,andaservicedescription.

Iftheservicenamespecifiedinthedialogboxalreadyexists,anewbindingisassignedtotheexistingservice.Ifyouspecifyanewservicename,acompletelynewserviceandbinding
arecreatedbasedontheserviceandbindingnamespecifiedinthedialogbox.

9.ChooseApplySettings
Theconfigurationviewisdisplayedwherethedetailsforthenewbindinggetspecified.Youmayneedtoscrolldowninthebrowserwindowtoseethisviewcompletely.

Atthisstage,thenewbindingisnotconfiguredandhasnotyetbeensaved.Onlydefaultsettingsareselectedwhereapplicable.note,thatthesecuritysettingsdonothavedefaultsettings
forthenewbindingandthusmustbespecifedexplicitly.

10.GototheProviderSecuritytab
Inthisviewthesecuritysettingsonthenewbindinggetspecified.
Theprovidersecuritysettingsdisplayedfallintotwomaincategories:
thecommunicationsecurity,i.e.settingsdealingwiththesecuritywhilethemessageisonthenetwork,and
theauthenticationmethodtobeusedforidentifyingtheuserenvironmentontheWebServiceprovidersystem.

https://wiki.scn.sap.com/wiki/display/ABAPConn/How+to+configure+a+Service+Provider

4/9

15/7/2016

HowtoconfigureaServiceProviderABAPConnectivitySCNWiki

Forthecommunicationsecuritysettingsinthisexample,weusetheABAPNGAP(SAP_BASIS8.x)codelineoptionsonthisUIview.Youcanseethefollowingalternativesfortheprovider
binding:
None:TheHTTPprotocolgetsused,i.e.thereisnoencryptiontakingplaceontheWSmessagesonthenetwork
SSL:TheHTTPSprotocolgetsused(SSL=SecureSocketLayer),i.e.theHTTPmessagecontainingtheWSmessagegetsencrypted.Thisprovidesforintegrityandprivacyprotection.SSL
alsoprovidesserversideauthentication(theserveridentifiesitselftotheprovider).Theclientsideauthentication(onconnectionestablishmenttheconsumeridnetifiesitselftotheprovider)can
beenforcedbyselectiongtheX.509ClientCertificateoptionintheAuthenticationsectionbelow.Thecombinationofbothprovidesamutualauthentication.
ThefollowingoptionsaremainlyimplementationsofOASISsecuritystandardslikeWSSecurityandWSSecureConversation.
SymmetricMessageSignature/Encryption:SecuresthedataexchangeontheWS(SOAP)messagelevel.TheSOAPmessagewillbesignedandencryptedwhereboththesignatureandthe
encryptioniscalculatedusingasymmetricsessionkey.Thiskeyiscreatedbytheconsumertobeusedforthecompleterequest/responsecycle.Thesymmetrickeyitselfwillbetransferredin
encryptedformatusingtheproviderspublickeyofitsPublicPrivateKeypair.
Moreinformation
AsymmetricMessageSignature/Encryption:SecuresthedataexchangeontheWS(SOAP)messagelevel.TheSOAPmessagewillbesignedandencrypted.Thesignatureiscomputedusing
theconsumersprivateasymmetrickey.Theencryptioniscalculatedusingasymmetricsessionkeywhichiscreatedbytheconsumerfortherequesttotheprovider.Theproviderwillgenerate
anewsymmetrickeyfortheresponseencryption.Thesymmetrickeyitselfwillbetransferredinencryptedformatusingtheprovidersasymmetricpublickey.
Moreinformation
Inaddition,youcanspecifyviacheckboxes,ifyouwanttoswitchonsecureconversationandextendedheaderandsignatureprotection.
SecureConversation:IfSecureConversationisselectedinadditiontoanothercommunicationsecurityoption,theSOAPmessagewillbesignedandencryptedusingasymmetricsessionkey.
Thiskeywillbeusedformultiplerequest/responsecyclestilltheSecureConversationsessiongetsterminated,e.g.onaterminationofaWSReliableMessagesequence.Thechosen
communicationsecurityintogetherwiththechosenauthenticationmethodwillbeusedtoestablishtheSecureConversationsession.
Moreinformation
Extendedheaderandsignatureprotection:ThiswillprovideadditionalmeansofprotectingSOAPmessagelikeSignatureEncryption,SignatureconfirmationandSOAPHeaderencryption
Moreinformation
Fortheauthenticationsettings,yourhavethefollowingoptionsavailabletospecifytheauthenticationmethodormethodstobeused.
NoAuthentication:ThisspecifiesthatyourserviceisconsideredtobeapublicWS.Theauthenticationisdonewithafixeduseraccountspecifiedasadditionalinputonchoosingthisoption.The
useraccountwillbestoredinthebinding'sICFnodeasserviceuser.
TransportChannelAuthentication:Theauthenticationisdonebymeansofthetransportchannel.YouspecifyaUserID/Password,aX.509clientcertificateoraSAPassertionticket
authentication.TheauthenticationinformationforUserID/PasswordandSAPassertionticketauthenticationwillbetransferredashttpheader.
LogonandAssertionTicket
UsingUserIDandPasswordAuthentication
X.509SSLClientCertificateonlyworksincombinationwithCommunicationSecuritySSLwhereauthenticationisperformedinsidetheSSLLayer.
Moreinformation
MessageAuthentication:TheauthenticationisdoneintheWSmessageitselfasdefinedintheWSSecuritystandard.TheauthenticationinformationistransferredwithintheSOAPsecurity
header.Youcanspecifythesekindsofmessagauthentication:
UserID/password(UsernameToken),
X.509certificate(X509Token)or
SingleSignOnusingSAML(SAMLToken).
Moreinformation
IncaseyouselectedoptionSingleSignOnusingSAMLasmessagebasedauthenticationmethod,thistableshowswhatsubjectconfirmationmethodtheproviderwillexpect.Thisis
particularlyimportantwhencallingaSAPWebServicewithanonSAPconsumer.TheSAMLsubjectconfirmationmethodmainlydependsonthechosenCommunicationSecuritysetting.
CommunicationSecuritySetting

SenderVouches

HolderofKey

None(HTTP)

SSL(HTTPS,TransportChannelSecurity)

AsymmetricMessageSignature/Encryption

SSL+SecureTokenServiceIssuerselected

SymmetricMessageSignature/Encryption

ThecommunicationsecuritysettingSymmetricMessageSignature/EncryptionalwaysmeanHolderofKeysubjectconfirmation.AllothersettingsdefaulttoSenderVouches.
IfyouhoweverselectedSSLinconjunctionwithaTokenIssuerinsectionSecureTokenServiceSettings,theHolderofKeysubjectconfirmationmethodwillbeexpectedbytheprovider.
FormoreinformationaboutSingleSignOnmechanismsandthedistinctionbetweenTransportChannelauthenticationandMessageauthenticationconsultthefollowingSAPdocumentationlink:
SingleSignOnforWebServices
Youcanfindconfigurationexamplesviathislink:
ConfigurationExamplesforASABAP

Thesecurityfeaturesdonotrun"outofthebox",i.e.youhavetopreparetheABAPsystemtousethesecuritymechanismsofferedinthisview.Especillythemessagebased
authenticationneedpreparationviathereportWSS_SETUPtorunproperly.
RefertotheSAPsecurityonlinedocumentationformoredetailsonthesetup.

Youneedtoselectatleastoneoptionfromtheauthenticationmethodsectionbeforetheservicecanbesaved.Youmayevenselectmultiplemethods,sothebindingsservesdifferent
authenticationssimultanously.

Youcannotmixtransportlevelandmessagebasedauthenticationmethodswithinonebinding.Ifyouwanttomaketheserviceavailableforbothtransportlevelandmessagelevel

https://wiki.scn.sap.com/wiki/display/ABAPConn/How+to+configure+a+Service+Provider

5/9

15/7/2016

HowtoconfigureaServiceProviderABAPConnectivitySCNWiki
authentication,youhavetospecifydifferentbindingsfortheservice.

ThesesettingsconstitutetheminimumsecuritysettingsrequiredtocallthisWebservice.

ThesettingspermittedintheprovidersecuritysettingsarebasedonthesecuritysettingsoftheservicedefinitionspecifiedinABAPDevelopmentWorkbench.

11.Savethebinding
Whenthebindinggetssaved,itisdisplayedinthelistofconfigurationsbelongingtotheselectedservicedefinition.ThenewbindingisnowaccessibleunderitsaccessURLbyWSconsumers.Also
itisnowpossiblethatthisbindingisprovidingaWSDLdocumenttodescribeitself.

https://wiki.scn.sap.com/wiki/display/ABAPConn/How+to+configure+a+Service+Provider

6/9

15/7/2016

HowtoconfigureaServiceProviderABAPConnectivitySCNWiki

12.TodisplaytheAccessURLforthebinding,gototheTransportSettingstab

https://wiki.scn.sap.com/wiki/display/ABAPConn/How+to+configure+a+Service+Provider

7/9

15/7/2016

HowtoconfigureaServiceProviderABAPConnectivitySCNWiki

TheaccessURLpathisdisplayedintheCalculatedAccessURLfieldintheTransportSettingstab.YoucanalsodefineanalternativeURLpathforthecallsincaseyourprovidercanonlyusea
fixedaccesspath.TheaccesspaththatyousetinthefieldAlternativeAccessPathaddsoneadditional,alternativeaccesspathtotheWebService.DuetotherestrictionsoftheICFframework,
thatalternativeaccesspathcanonlybeusedonceinthesystem(inNGAPperSAPclient).

TheaccessURListheURLtowhichtheconsumersendsitsWebServiceSOAPrequest.TheaccessURLispartoftheserviceWSDLdocument.

Backtotop

Result
YouhavenowconfiguredaWebServiceprovider(aka."WebService"),andthisprovidercannowbecalledbyaconsumer.
FortheWebServiceaWSDLdocumentisalsonowavailabletheWSDLURLcanbeseenviatheOverviewtaband,ifmaintained,youcantesttheWebServiceviaatestpageoftheSAPJ2EEengine.
Moreinformation:
HowtofindWebServiceWSDLinSOAManager
WebServiceTestingUsingtheJ2EEServerWebServiceNavigator

Backtotop

MoreInformation
SAPNote2175422WebserviceproviderconfigurationintransactionSOAMANAGER[Video]
SAPNote1124553InactiveICFservicesofWebServiceruntime
SAPNote1319507Overview:AnalysisofABAPWebServiceConfiguration

Backtotop

binding

provider

service_definition

provider_configuration_video

provider_video

6Comentarios

https://wiki.scn.sap.com/wiki/display/ABAPConn/How+to+configure+a+Service+Provider

8/9

15/7/2016

HowtoconfigureaServiceProviderABAPConnectivitySCNWiki

PaulRead
ThisisoneofthemostinformativearticlesIhaveseen.
Thanks!
p

Guest
Excellentarticle.Youexplainwhateachpiecedoes.Thisiswaymorehelpfulthanjustgoingthroughtthestepstobuildawebservice,andnotexplainingwhateachthingdoesorwhywedoit.
Thanks!

NikolausHertzEichenrode
Todaythesceenshotsareallinaresolutionthatyoucan'tseethedetailsanymore.ThisisratherapittyandIwonderititlookedlikethisfromthestart.

DezsoPap
DearNikolaus,

Idonotknowwhatwentwrong
Ihaveenlargedtheimagestemporary,untilwefindthecause.Theimagesshouldbeclickableandshouldenlargeuponclick.

Bestregards,
Dezso

RegysM
Hi,
IhavebeenlookingforastepbystepapproachtoextractdatafromwebserviceandIthinkyouhavesavedmedaysofwork.Thankyouverymuchforthisdetailedexplaination.Iamtryingto
extractdatafromthewebserviceintoSAPBW.ThoughIhaveaquestion.So,IfollowedthisdocumentandIdidthebindingfortheserviceprovider.Afterdoingthebinding,isthereanylistof
stepstocompletethisextractionprocessfromtheWebServicetoSAPBW?Meanwhile,doIhavetodoanythingatSE80orisenoughonlycreatingthisservicebindingasyouhavedescribed
above?
Thanksagain,forthedetailedworkandhopefullyyouwillreplytomyquestions!
Withbestregards,
Regys

AbzalKalygulov
Hi,
thanks!Butihavesomeproblemswithwsdlurl.
Canyoupleaseexplain:
wsdlurlvs.calculatedurl?

Thanks

ContactUs
Privacy

SAPHelpPortal
TermsofUse

LegalDisclosure

Copyright

https://wiki.scn.sap.com/wiki/display/ABAPConn/How+to+configure+a+Service+Provider

FollowSCN

9/9