Web Services security considerations

The Service Manager server requires that each Web Service request provide a valid operator name and password combination. These must be supplied in a standard HTTP Basic Authorization header. The Web Service toolkits universally support this authentication mechanism. Use SSL if you are concerned about the possibility of someone using a network monitoring tool to discover passwords. Basic Authorization by itself does not encrypt the password; it simply encodes it using Base 64.

Note Only ASCII operator names are supported in Service Manager Web Service integrations. When Service Manager is handling an incoming Web Service request, the authorization string is decoded by BASE64Decoder. Service Manager uses the decoded string value to construct a UTF-8 string that is used in the RTE. However, the authorization string is in the header and Service Manager does not know the charset or encoding of the underling string value, which is BASE64 encoded. Therefore, if the underlying string value is not UTF-8, Web Service clients will fail to connect to Service Manager. In Service Manager, when fetching an operator from the database, no matter what collation the database uses, the operator finally will get a UTF-8 operator value. However, even if users put the same value in the authorization header, the operator name may differ because of the charset/encoding issue.

In addition to having a valid login, the operator must have the SOAP API or RESTful API capability word to access the Web Services. If the Web Service request does not contain valid authorization information, then the server sends a response message containing “401 (Unauthorized).” If the request is valid, then the server sends a response message containing the results of your Web Services operation. The response message contains only the information the operator is allowed to see. The security settings of the user's profile, Mandanten security settings, and conditions defined in the Document Engine are maintained by all Web Services.