That url is the WSDL for the publishing engine, I'm not sure what other services you think it's for. I've used that WSDL to create requests to the PE using a tool like Soap UI. The last time I tried it, I couldn't get a correct response from the PE so PTC might have unknowingly broken the service. It worked in 5.4 for us, but not in 6.0.
Alternatively, you can use URLs to get request/response for PE composition. Here's an example URL:
Thanks for responding, Brett. This is an area in which I have very little experience. As such, I do not have any expectations at all other than those generated from my last exchange with a previous pen tester.
The current pen tester is now saying (or I am now understanding) that he doesn't actually want the WSDL file. (Which is all I provided the last time we were pen tested other than an Editor install). The pen tester wants the "SOAP UI project file" which he says should end with ".xml". Or, failing that, he wants sample request/response pairs and he's sent me examples (generic or from other applications unrelated to Arbortext technology). I keep telling him that I do not do SOAP programming and that it is all happening between Editor and PE but it's a little like we're speaking American and British English ... it sounds like it is a meaningful exchange ...
The web.xml (from the web-inf or e3 folder, I can't remember) and e3config.xml are not what he wants (even though I am fairly confident they do describe at least to some extent the conversations possible through the main PE server URL). All of the SOAP stuff I can find in the documentation is related to developing your own SOAP client although I know that Dynamic Link Manager relied on one of the SOAP URLs described by the WSDL file.
On Tue, Sep 16, 2014 at 6:48 AM, Brett McCorkle <-> wrote:
> Hi Paul, > > That url is the WSDL for the publishing engine, I'm not sure what other > services you think it's for. I've used that WSDL to create requests to the > PE using a tool like Soap UI. The last time I tried it, I couldn't get a > correct response from the PE so PTC might have unknowingly broken the > service. It worked in 5.4 for us, but not in 6.0. > > Alternatively, you can use URLs to get request/response for PE > composition. Here's an example URL: > > > > You can add multiple parameters to the end of the request, they are > documented in the help. Here's some examples: > > &file-type=xml|text|pdf|docx|word|frame|zip|wordml|html|sgml|rtf > &type=pdf|htmlhelp|html > &f=convert > &profile=attributename=value > &profile=setprofilegroup=groupname > &zip-output=yes|no > > Hope this helps. >
So if the white-hat hacker can't penetrate the system, even with help from an insider (you), then I think the system can be classified secure now? Problem solved, long live SOAP 🙂
Sounds like a fairly difficult person to work with, I don't understand why they can't create their own SOAP UI project for this.
Are you familiar with SOAP UI? It's a free program you can download. Once installed, you can create a new project, pointing it to the WSDL for your PE:
It will automatically create XML to send a request to your PE. From there you can fill in the XML with the parameters needed. The project you create will be an XML file you can send to the tester you're working with.
I hope that helps, if you're still having trouble, I should have an example SOAP UI project around here that I could dig up.
Thanks, Brett. It's less the person than the process, or that's how I'm choosing to interpret it anyhow. While we all want the same thing (safe systems), I do treat the process a bit like an adversarial exchange providing as little as possible while helping the process along. Extraneous information can only lead to additional questions.
It is probably not coincidence that my boss' weekly direct reports meeting included a discussion of Office Space.
Um. Yeah. We're going to need the SOAP UI for this test. Can you work that for me?
On Wed, Sep 17, 2014 at 7:55 AM, Brett McCorkle <-> wrote:
> Hi Paul, > > Sounds like a fairly difficult person to work with, I don't understand why > they can't create their own SOAP UI project for this. > > Are you familiar with SOAP UI? It's a free program you can download. Once > installed, you can create a new project, pointing it to the WSDL for your > PE: > > > > It will automatically create XML to send a request to your PE. From there > you can fill in the XML with the parameters needed. The project you create > will be an XML file you can send to the tester you're working with. > > I hope that helps, if you're still having trouble, I should have an > example SOAP UI project around here that I could dig up. > > -Brett >
PTC support confirms there is no WSDL or SOAP UI file/project available (or probably possible) for the main PE URL. It is not a SOAP service at all.
On Wed, Sep 17, 2014 at 9:41 AM, Paul Nagai <-> wrote:
> Thanks, Brett. It's less the person than the process, or that's how I'm > choosing to interpret it anyhow. While we all want the same thing (safe > systems), I do treat the process a bit like an adversarial exchange > providing as little as possible while helping the process along. Extraneous > information can only lead to additional questions. > > It is probably not coincidence that my boss' weekly direct reports meeting > included a discussion of Office Space. > > Um. Yeah. We're going to need the SOAP UI for this test. Can you work that > for me? > > On Wed, Sep 17, 2014 at 7:55 AM, Brett McCorkle <-<br/>> > wrote: > >> Hi Paul, >> >> Sounds like a fairly difficult person to work with, I don't understand >> why they can't create their own SOAP UI project for this. >> >> Are you familiar with SOAP UI? It's a free program you can download. >> Once installed, you can create a new project, pointing it to the WSDL for >> your PE: >> >> >> >> It will automatically create XML to send a request to your PE. From >> there you can fill in the XML with the parameters needed. The project you >> create will be an XML file you can send to the tester you're working with. >> >> I hope that helps, if you're still having trouble, I should have an >> example SOAP UI project around here that I could dig up. >> >> -Brett >> >
