Magento 2.1: WEBAPI / Soap services are not deployed anymore [Critical!]

[ericahoekerd]

We receive message like procedure is not present when sending data by API, these are the default now, a lot of them are missing, which were available in previous versions, all functions regadring to catalog are missing, this is a serious bug. This is very critical! A lot of our customers are starting on Magento 2.1

These should be part of the servcies;

[2016-06-29 07:58:03] main.CRITICAL: exception 'RuntimeException' with message 'Requested service is not available: "customerV1"' in C:\wamp64\www\magento2_1\vendor\magento\module-webapi\Model\ServiceMetadata.php:167
Stack trace:
#0 C:\wamp64\www\magento2_1\vendor\magento\module-webapi\Model\Soap\Wsdl\Generator.php(366): Magento\Webapi\Model\ServiceMetadata->getServiceMetadata('customerV1')
#1 C:\wamp64\www\magento2_1\vendor\magento\module-webapi\Model\AbstractSchemaGenerator.php(169): Magento\Webapi\Model\Soap\Wsdl\Generator->getServiceMetadata('customerV1')
#2 C:\wamp64\www\magento2_1\vendor\magento\module-webapi\Model\Soap\Wsdl\Generator.php(374): Magento\Webapi\Model\AbstractSchemaGenerator->getAllowedServicesMetadata(Array)
#3 C:\wamp64\www\magento2_1\vendor\magento\module-webapi\Model\AbstractSchemaGenerator.php(104): Magento\Webapi\Model\Soap\Wsdl\Generator->getAllowedServicesMetadata(Array)
#4 C:\wamp64\www\magento2_1\vendor\magento\module-webapi\Controller\Soap.php(132): Magento\Webapi\Model\AbstractSchemaGenerator->generate(Array, 'http', 'localhost', 'http://localhos...')
#5 C:\wamp64\www\magento2_1\var\generation\Magento\Webapi\Controller\Soap\Interceptor.php(24): Magento\Webapi\Controller\Soap->dispatch(Object(Magento\Framework\App\Request\Http))
#6 C:\wamp64\www\magento2_1\vendor\magento\framework\App\Http.php(135): Magento\Webapi\Controller\Soap\Interceptor->dispatch(Object(Magento\Framework\App\Request\Http))
#7 C:\wamp64\www\magento2_1\vendor\magento\framework\App\Bootstrap.php(258): Magento\Framework\App\Http->launch()
#8 C:\wamp64\www\magento2_1\index.php(39): Magento\Framework\App\Bootstrap->run(Object(Magento\Framework\App\Http))
#9 {main}

We tracked this down to the file vendor/magento/module-webapi/Model/AbstractSchemaGenerator.php and then the getListOfServices() method: This method lists all the available SOAP methods when requesting this from a SOAP client. Within this method, there are two foreach loops. In the second loop, the check $this->authorization->isAllowed is used to check whether access to this Web API method is allowed, before allowing the method to be listed in the WSDL listing.

This seems incorrect. The WSDL listing should list all available methods at all times, while the ACL rules should be used to prevent usage of the actual methods. So it seems the WSDL listing is broken intentionally because of a false (sorry for the harsh word) security assumption. To me, and @tinxit it makes no sense to hide WSDL methods from the WSDL listing. Obviously their usage should be limited. But hiding their actual name breaks numerous SOAP applications.

Commenting out the if check fixes things.

Pull request is now also added: #5501

[mbrinton01]

Many of the services have been protected for security reasons. Please review the updated documentation here: http://devdocs.magento.com/guides/v2.1/get-started/soap/soap-web-api-calls.html

See the Authentication section

[ericahoekerd]

The WSDL should always be available only the real SOAP call should be secured. Check the link you gave, WSDL is public information.

[paliarush]

As @mbrinton01 mentioned, this was done for security reasons. Here is the correct link to the documentation describing what has become restricted and how you can enable anonymous access again if necessary.

[MarkB42]

@paliarush tnixit is right. The WSDL NEEDS to be available anonymously as it's used by software to generate the classes to write software against. By hiding it against authentication we cannot generate the objects in the first instance and it wont comply with the standard. The SOAP API calls need to be secured by authentication.

Can we please reopen this and get it fixed?

[manhao-chen]

i was building an integration on 2.0.2 using soap c#, now i just updated to 2.1.2 all the soap modules are gone, i've enabled the allow anonymous web api thing,

i got

• integrationAdminTokenServiceV1
• storeStoreRepositoryV1
• catalogInventoryStockRegistryV1
• catalogProductRepositoryV1

still missing

• customerCustomerRepositoryV1
  

• salesOrderRepositoryV1
  

• salesOrderManagementV1
  

• salesInvoiceRepositoryV1
  

• salesInvoiceCommentRepositoryV1
  

• salesCreditmemoRepositoryV1
  

• salesCreditmemoCommentRepositoryV1
  

this needs to be addressed!

how would you expect anyone to do a full soap integration without the full wsdl structure???

[MarkB42]

@manhao-chen Until, or if, the fix this you can modify the source code to comment out the security in the Mage 2.1x source code so you can build the intermediate objects and create integration software via WSDL.

[manhao-chen]

@MarkB42 Where do we comment out the security?

[MarkB42]

@manhao-chen I documented it on the Magento community forums for reference. Once you have built the objects you want to use you can put the code back to standard and it will continue accessing the obscured WSDL SOAP methods.

https://community.magento.com/t5/Programming-Questions/Magento-2-C-APIs-SOAP-problem/m-p/49677#M1206

[nagrgk]

if we dont comment permission and leave magento code as it is,

How do we access magento wsdl restricted services like below (using browser url or curl )?

soap/default?wsdl&services=salesOrderRepositoryV1

Do we have to use integrations or user level authentications?

Thanks

[MarkB42]

@nagrgk Simply put you have access to a VERY limited set of APIs if you enable the 'Allow Anonymous Access' in the store setup. Alternatively the best fix so far is use Magento 1.9.