Changes for page Endpoint Check

Summary

• Page properties (2 modified, 0 added, 0 removed)

Details

Page properties

Title

...	...	@@ -1,1 +1,1 @@
1		-novice-soap-webservice-connectivity-calling-a-soap-webservice
	1	+Securing your SOAP Webservice

Content

...	...	@@ -1,5 +1,5 @@
1	1	{{container}}{{container layoutStyle="columns"}}(((
2		-When setting up a point at which your customers can talk to you eMagiz offers various methods of creating such a point. One of those options is by hosting a SOAP Webservice in eMagiz that handles XML messages asynchronously or synchronously. In this microlearning, we will learn the basics of this configuration in the various phases of the platform so you can easily set up your SOAP web service.
	2	+When setting up a point at which your customers can talk to you eMagiz offers various methods of creating such a point. One of those options is by hosting a SOAP Webservice in eMagiz that handles XML messages asynchronously or synchronously. In this microlearning, we will zoom in on the part that security plays on a client level when hosting a SOAP web service.
3	3
4	4	Should you have any questions, please contact academy@emagiz.com.
5	5
...	...	@@ -20,11 +20,11 @@
20	20	* Validation
21	21	* Authentication
22	22
23		-Of these four points, the last two will be discussed in separate microlearnings.
	23	+Of these four points, we will zoom in on the authentication part of our SOAP Webservice in this microlearning.
24	24
25		-== 3. Configure your SOAP Webservice ==
	25	+== 3. Securing your SOAP Webservice ==
26	26
27		-When setting up a point at which your customers can talk to you eMagiz offers various methods of creating such a point. One of those options is by hosting a SOAP Webservice in eMagiz that handles XML messages asynchronously or synchronously. In this microlearning, we will learn the basics of this configuration in the various phases of the platform so you can easily set up your SOAP web service.
	27	+When setting up a point at which your customers can talk to you eMagiz offers various methods of creating such a point. One of those options is by hosting a SOAP Webservice in eMagiz that handles XML messages asynchronously or synchronously. In this microlearning, we will zoom in on the part that security plays on a client level when hosting a SOAP web service.
28	28
29	29	Crucial parts in the configuration are:
30	30	* Operation Name
...	...	@@ -32,51 +32,62 @@
32	32	* Validation
33	33	* Authentication
34	34
35		-Of these four points, the last two will be discussed in separate microlearnings. In this microlearning, we will focus on the first two aspects of the configuration. As you might have noticed I did not mention the fact whether the integration is synchronous or asynchronous as a crucial part of the configuration. The reason being that when configuring a (SOAP) web service you always need to send an acknowledgment back to the client calling the web service to let them know what the status of the message is. In case you want to set up the rest of your integration asynchronously you can send an empty message back as acknowledgment. In case you want to set up the rest of your integration synchronously you need to send the response you have received from the backend operation back to the client. More on the choice between asynchronous and synchronous in a later stage.
	35	+Of these four points, we will zoom in on the authentication part of our SOAP Webservice in this microlearning. When hosting your SOAP web service in the eMagiz Cloud the endpoint will be HTTPS secured on default. If you want to mimic the same result for an on-premise environment you should define the valid SSL settings (https://my.emagiz.com/p/question/172825635700357186).
36	36
37		-=== 3.1 Operation Name ===
	37	+Apart from that aspect of security, we should also consider how clients that call the SOAP Web service will authenticate themselves upon entry. Within eMagiz, we advise a two-step approach. Each client that wants to call your SOAP Webservice should:
38	38
39		-Let us first zoom in on the parts of the configuration before we learn how you can implement it in eMagiz. Starting with the operation name. When you have dealt with the API Gateway offering of eMagiz in the past or have some knowledge of how APIs work the notion of an operation name should not be unfamiliar. In essence, it is a unique name that defines a certain operation. In eMagiz the best practice for naming the operation is as follows:
	39	+* Send along a client certificate
	40	+* Send along an API key in a SOAP Header that references to the word apiKey (i.e. apiKey)
40	40
41		-* Send{technicalnameoftheoperation}
	42	+To verify both parts some configuration is needed. The first aspect, checking for a valid client certificate is done on cloud level. For more information on how to exactly configure this please take a look at the microlearning [Securing a hosted web service with certificates in the eMagiz Cloud](intermediate-securing-your-data-traffic-securing-a-hosted-webservice-with-certificates-in-the-emagiz-cloud.md).
42	42
43		-When you are in Create you will notice that eMagiz uses the default suffix of Request and Response is added to the operation name. Therefore the full operation name a client needs to call to get the desired result if you adhere to the best practice is:
	44	+In this microlearning, we will focus on the second part of the configuration.
44	44
45		-* Send{technicalnameoftheoperation}Request
	46	+=== 3.1 API Key verification ===
46	46
47		-=== 3.2 SOAP Webservice Namespace ===
	48	+To verify whether the client has sent a valid API Key we need to change the configuration within the entry flow in the Create phase of eMagiz. The configuration consists of three steps:
48	48
49		-The second part of the configuration is the SOAP Webservice Namespace. When hosting a SOAP Webservice via the standard eMagiz tooling you need to define a namespace. To smoothen this process eMagiz automatically generates a namespace based on the configuration settings you choose in the Design phase of eMagiz.
	50	+* Get value from SOAP Header
	51	+* Check value against a list
	52	+* Respond based on results
50	50
51		-=== 3.3 Configuration in eMagiz ===
	54	+==== 3.1.1 Get value from SOAP Header ====
52	52
53		-Now that we know what configurations are required, we can see how we can implement this in eMagiz. In the Capture phase, nothing changes. You simply draw a system on the canvas including at least one line that goes from the system towards eMagiz. When you are done you move to the Design phase in eMagiz. In this phase, you need to correctly set up the operation name(s) and the SOAP Webservice Namespace.
	56	+Let us move to the entry flow by going to the Create phase of eMagiz, opening the correct flow, and entering "Start Editing" mode. After you have done so we need to add a support object to the flow. The support we need is called 'Complex SOAP header mapper'. In this component, we need the bottom section.
54	54
55		-The configuration in Design starts at the system level. At the system level, you need to define the technical name (or let eMagiz automatically fill it in for you) and select the checkbox called Combined Entry Connector. By selecting this checkbox you tell eMagiz that you want to host an endpoint for others to call.
	58	+[[image:Main.Images.Microlearning.WebHome@novice-soap-webservice-connectivity-securing-your-soap-webservice--complex-soap-header-mapper.png]]
56	56
57		-[[image:Main.Images.Microlearning.WebHome@novice-soap-webservice-connectivity-configure-your-soap-webservice--combined-entry-check.png]]
	60	+Here we define a new header by entering a name and a valid XPath expression.
58	58
59		-As you can see, selecting this option opens up a new choice to make. In this case between SOAP Webservice and Custom.
	62	+[[image:Main.Images.Microlearning.WebHome@novice-soap-webservice-connectivity-securing-your-soap-webservice--complex-soap-header-mapper-config.png]]
60	60
61		-[[image:Main.Images.Microlearning.WebHome@novice-soap-webservice-connectivity-configure-your-soap-webservice--combined-entry-choice.png]]
	64	+When you are satisfied you can press Save twice to store the support object. After we have configured the support object we need to link it to our web service inbound gateway. To do so open the component, navigate to the advanced tab and select the Header mapper you have just created.
62	62
63		-In this case, we opt for the SOAP web service. After you have done so eMagiz will automatically define the SOAP Webservice Name and SOAP Webservice Namespace.
	66	+[[image:Main.Images.Microlearning.WebHome@novice-soap-webservice-connectivity-securing-your-soap-webservice--link-complex-soap-header-mapper.png]]
64	64
65		-[[image:Main.Images.Microlearning.WebHome@novice-soap-webservice-connectivity-configure-your-soap-webservice--combined-entry-soap-ws-namespace.png]]
	68	+==== 3.1.2 Check value against list ====
66	66
67		-With this, you are done with your configuration on the system level. Don't forget to update the status of your task. Now that we have configured the system it is time to configure the integration that is drawn from the system to eMagiz. We can do so by double-clicking on it (or by accessing the context menu and selecting the edit option). When you open the Edit page on the integration level you will notice that a new segment is added (compared to other integrations). This segment defines the settings on the system level we have just specified and defines the operation name.
	70	+Now that we placed the value the client has entered in the apiKey SOAP header on our message we can check whether the value exists in a list of predefined valid values. To do add two headers to the standard header enricher component in your flow. The first one ensures that the apiKey is removed from the header (to prevent the API key from being publicly seen by others). The second one searches for the client name that corresponds with the apiKey and returns the name of the client in the header. This search action is done with the help of a SpEL expression, more on that later on. In this case the SpEL expression we use is set up as follows: headers['spwbsrv_apiKey'] != null and {${authentication.api-keys}}.contains(headers.spwbsrv_apiKey) ? {${authentication.tenant-ids}}[{${authentication.api-keys}}.indexOf(headers.spwbsrv_apiKey)] : null
68	68
69		-[[image:Main.Images.Microlearning.WebHome@novice-soap-webservice-connectivity-configure-your-soap-webservice--edit-integration.png]]
	72	+With this SpEL expression, we check whether there is an API key and whether that apiKey can be found in a predefined list. If so we search for the corresponding name based on the index of where a certain apiKey is within the list. If not the header is not created. Combining this logic in one component should look similar to the following.
70	70
71		-As you can see eMagiz has already prefilled the operation name for you based on the best practice at eMagiz. If you want to change you have the option to do so. Do note that for the sake of consistency it would be smart to use the same naming convention within a single project to avoid confusion.
	74	+[[image:Main.Images.Microlearning.WebHome@novice-soap-webservice-connectivity-securing-your-soap-webservice--check-headers.png]]
72	72
73		-=== 3.4 Add integration to Create ===
	76	+==== 3.1.3 Respond based on results ====
74	74
75		-Now that we have finished the configuration in Design the last step of this microlearning is to add the integration to Create. You can simply do so by navigating to Create -> Add integrations and selecting the integration to move it to Create. After you have selected it press Save to add the integration to Create.
	78	+After we have searched for the API key in the list and we have defined the client that is sending the information (or not) we can respond to the client whether or not the client is authorized to call our SOAP web service. To execute this check we first need a standard filter component. In this component, we will check whether the spwbsrv_client header we have just created is not null.
76	76
	80	+[[image:Main.Images.Microlearning.WebHome@novice-soap-webservice-connectivity-securing-your-soap-webservice--standard-filter.png]]
	81	+
	82	+If it is indeed not null we can pass the empty message back to the client telling the client that the message was delivered successfully. If the header is null we need to tell the client that he/she is unauthorized to call the operation. To do so we need to add a component called 'custom error message activator'. In this component, we define the message we want to give back to the client in case of an error. In this case, we simply give back 'Unauthorized'.
	83	+
	84	+[[image:Main.Images.Microlearning.WebHome@novice-soap-webservice-connectivity-securing-your-soap-webservice--custom-error-message.png]]
	85	+
	86	+With all this done we have successfully secured our SOAP web service according to the best practices.
	87	+
77	77	== 4. Assignment ==
78	78
79		-Configure a SOAP web service that consists of at least one operation and add it to Create.
	90	+Secure a SOAP web service to confirm the outlined approach above. Focus on the apiKey part.
80	80	This assignment can be completed with the help of the (Academy) project that you have created/used in the previous assignment.
81	81
82	82	== 5. Key takeaways ==
...	...	@@ -86,7 +86,8 @@
86	86	** SOAP Webservice Namespace
87	87	** Validation
88	88	** Authentication
89		-* For ease, you can use the default naming convention of eMagiz
	100	+* Hosting your SOAP web service in the eMagiz cloud results in standard HTTPS
	101	+* Use a combination of client certificate + API key for authentication
90	90
91	91	== 6. Suggested Additional Readings ==
92	92
...	...	@@ -94,6 +94,6 @@
94	94
95	95	== 7. Silent demonstration video ==
96	96
97		-{{video attachment="novice-soap-webservice-connectivity-configure-your-soap-webservice.mp4" reference="Main.Videos.Microlearning.WebHome"/}}
	109	+{{video attachment="novice-soap-webservice-connectivity-securing-your-soap-webservice.mp4" reference="Main.Videos.Microlearning.WebHome"/}}
98	98
99	99	)))((({{toc/}}))){{/container}}{{/container}}