Pass User ID/ Password to Java mapping

[Former Member]

Hi All,

I have a java mapping where I am doing SOAP Lookup to a webservice using a USER ID/ PASSWORD to fetch a session ID. I further use this Session ID in my java mapping while I try to construct the SOAP envelop in target SOAP mapping.

My question is I have hardcoded USER ID / PASSWORD in string variable and use it while constructing my SOAP Lookup xml.

So when I am moving from one environment to another the client USER ID / PASSWORD will change. In that case I have to manually change the java mapping explicitly and transport it.

What is the best way to handle it ? So  that I don't have to change the USER ID/ PASSWORD when I am transporting my java mapping from environment to environment.

I see three options:

1. Use Value mapping and control the User ID/ Password in ID.

2. Use Parametrized Java mapping and control the User ID/ Password in ID.

3. From System Property get the SID i.e PID or PIQ or PIP and then put a if else condition to select the respective user id and password

I would like to go with option 1 and 2 and In both the cases I expose my password to other developers. Can I hide my password field like we have in password fields where it shows up as asterisk charaters ?Which of the two above option is suggested ?

Also the SESSION ID I get can be reused throughout the day. So in subsequent calls I need not do further soap lookup? Is there any way I can store this session id in a global container variable and reuse it till it gets exhausted. Like when I get the the session id from the webservice it says 14000 secs the session is valid, so that means we can reuse this sesssion id rather than each time getting the session id. So what is the best way to handle this ? The only option I think is storing it in some z table and doing a soap rfc lookup.

Thx in advance

Hemantika

[asdasd_asdasd]

I had the same problem a few months ago and the solution was this

[sugata_bagchi2]

Hi All,

My question to SAP in this context is -

we can simply hide the password if we are using a parameter name starts with pwd. e.g - pwd.Value, pwd_set etc. But this is possible only with adapter module. I have created few custom adapter modules where passwords needed to be passed as parameter and this worked.

Then why the same can not work in case of interface or receiver determination parameter passing for mapping.

Thanks

Sugata Bagchi Majumder

picture added

[former_member609165]

Hello Sugata,

Could you please share code about reading parameter. I am able to read normal parameters but when use pwd. parameter, code is reading as NULL.

I am using String apiKey = mContext.getContextData("APIKey");

Please help.

[gagandeep_batra]

HI Patnaik,

i am not expert but you can see my thought.

why not you make one z-table in sap PI and store both userID/Password and Session id correspond to both.

and use rfc lookup to get at one go.

and give access to that table only few users that u want to.

you can also encrypt the password filed at abap table level  and use by java mapping.

this approach can help you to maintain for transportation also

Regards

Gagan

[anupam_ghosh2]

Hi Hemanthika,

Here are my thoughts on this

1. Use Value mapping and control the User ID/ Password in ID:- Good option but you can't hide user id and password. Makes future changes in userid/password easier for developers.

2. Use Parametrized Java mapping and control the User ID/ Password in ID.:- Developers have to know java mapping an how to set parameters. Many developers who do not come from java background might face problems in doing so.

3. From System Property get the SID i.e PID or PIQ or PIP and then put a if else condition to select the respective user id and password:-  Better leave this option. Over the time Business changes and they might decide to replace the servers or clone them. While cloning the server the internal system property including SID will change (90% probability). Then the developers will have to change the hard coding associated with it.

"I would like to go with option 1 and 2 and In both the cases I expose my password to other developers. Can I hide my password field like we have in password fields where it shows up as asterisk charaters ?Which of the two above option is suggested ?"

ans) You need to ensure that in future the project maintenance should go on, even if you decide to move on.

The developers who take over should be easily able to understand the whereabouts of the username and password. Thus I would suggest a fourth option that is message mapping. Supply the username and password as constant fields in message mapping(MM). The message mapping should precede the java mapping code in the same operation/interface mapping. The userid and password will be hard coded in MM. The MM serves as input to java mapping. If you want to hide the actual password then in constant field specify it in a reverse way and use and UDF to make it correct before feeding it to java mapping. That is if password is xyz@123  it becomes say 321@zyxbefore reaching java mapping. Thus even if password is exposed its not the actual one. Developers have to study the UDF to find the actual password.

"Like when I get the the session id from the web  service it says 14000 secs the session is valid, so that means we can reuse this session id rather than each time getting the session id. So what is the best way to handle this"

ans) You cannot take chances here as you do not know when this session id gets invalid. to use same session id valid through out the day , it should remain the same for 86400 secs. Thus you have to generate a new session id each time you are accessing the web service. If you are calling web service multiple times within same scenario then the best option is what you have suggested " The only option I think is storing it in some z table and doing a soap rfc lookup." . You can also store it in temporary files in PI server using UDF (but safer option is to use Z tables).

Finally "Can I hide my password field like we have in password fields where it shows up as asterisk charaters ?"

ans) I don't think you have this option in SAP PI. you can wait for experts to respond on this.

Regards

Anupam

[Former Member]

Hi Anupam,

Thanks for your reply. Regarding option 4 I would say this won't work when suddenly they reset the password and then I would need to make the changes in message mapping and need to request for a transport urgently from Dev to QA to Prod. Which I think most clients won't agree.

So would like to go with the value mapping option, where I have the flexibility to change the password at runtime in SAP PI Production, when the target system resets the Password.

But my only problem with value mapping is exposing the password, which under SAS audits may be a compromise of security.

Regards

Ravijeet

[baskar_gopalakrishnan2]

Why don't you write the user/password in a property file and provide access control to only system administrators. In mapping you can read the file and provide the values. You basically need to maintain seperate property file for each environment which is pretty standard in the development environment.

[Former Member]

I suggest you use both 1 and 2.

You can write a UDF to pass the user ID and password which can be retrieved from the value mappings. In this way, you can easily maintain it when you migrate to your QA or production systems.

The password however is exposed to other developers when they acces the ID in any case. You can store the hashed password (SHA1 algorithm) in the value mapping table. Then you will need to write more java code to de-hash the value before you pass it to your UDF. What you can do is to obscure the password.

[Former Member]

Hi Li,

So which one is better to use Value mapping or Parametrized values ? Are Parametrized values created in Interface determination transportable ?

Also regarding my second question how can I best handle Session ID across the day ? Once I do a soap lookup I get the session ID, how can I reuse this for the period it is valid ? I want to do this just to avoid opening multiple sessions ?

Thx in advance

Hemantika

[Former Member]

i would suggest you to use value mapping.

Never handle the session id before so can't offer you too much advice.