Security Note Introducing WSDL security in Java AS 7.20, SAP security note 1428117

SAP security note 1428117, "Security Note: Introducing WSDL security in Java AS 7.20", is. Below are the symptom and SAP recommended solution.

Description

Symptom

WSDL security was introduced in SAP Java AS 7.20 SP0, providing authentication control to access a WSDL via HTTP. As of 7.20 SP3, this was extended with authorization control as well, requiring UME roles "Administrator", "WSDL_Viewer", or any other role with the assigned action "WSDL_Visualization" to access WSDLs via HTTP. By default, WSDL security is disabled. This guarantees backward compatibility and avoids side effects on already running scenarios.

Solution

• Upgrade SAP Java AS to version 7.20 SP03 or a subsequent version.
• Enable or disable WSDL security by setting the wsdl.security property of the Web Service Container to true or false. Follow these steps:
  • Log on to the SAP NetWeaver Administrator and navigate to Configuration Management > Infrastructure > Java System Properties. The Java System Properties screen will open.
  • In the Details area, select the Services tab.
  • Choose the Web Services Container service. You can also filter the list of services by entering "Web Services Container" in the search field.
  • In the Properties area, select the wsdl.security property and modify its value: click Modify, enter true to enable WSDL security or false to disable it in the custom value field, click Set, and to confirm, click Save.

References

• 1416467 – WSDL security concept in Java AS 7.20