cXML – Authentication

The connector validates the identity data from the cXML header element on login. Three independent check points are available — each can be enabled or disabled individually.

The Three Check Points

FROM — Buyer Identity

The <From> element identifies the purchasing system (the buyer). The connector compares the submitted value with a Shopware field of the logged-in customer.

Field	Description
Check FROM	Enables or disables this check
FROM domain	Expected domain value (e.g. DUNS, NetworkId, AribaNetworkUserId)
FROM field	Shopware customer field to compare against (email, customer number, or custom field)

Example in cXML:

<From>
  <Credential domain="NetworkId">
    <Identity>AN01234567890</Identity>
  </Credential>
</From>

TO — Recipient Identity

The <To> element addresses the shop. This check ensures the cXML is actually intended for this system.

Field	Description
Check TO	Enables or disables this check
TO domain	Expected domain value
TO field	Shopware field for comparison

SENDER / Shared Secret — Password Check

The <Sender> element contains the technical sender and optionally a Shared Secret (password). The SENDER check validates the technical sender identity; the Shared Secret check validates the password.

Field	Description
Check SENDER	Enables or disables the SENDER check
SENDER domain	Expected domain value — applies only to the SENDER identity check, not to the shared secret
Check Shared Secret	Enables the password check
Shared Secret	The expected password — from a Shopware customer profile or custom field

Since 3.7.400 / 3.6.200

When Check Shared Secret is enabled, the login is rejected if the procurement system sends no <SharedSecret> or the element is empty. An empty secret was tolerated before. If the system does not send a shared secret, the check must be disabled.

As of 3.7.500 / 3.6.300

The shared secret is read from the first Sender credential, regardless of its domain. Previously the configured SENDER domain was used for this, which rejected valid logins whenever the procurement system sent the secret under a different domain. The lookup stays scoped to <Sender> on purpose — <From> and <To> are not searched. The secret is still verified.

Example in cXML:

<Sender>
  <Credential domain="DUNS">
    <Identity>123456789</Identity>
    <SharedSecret>secret</SharedSecret>
  </Credential>
  <UserAgent>Ariba 1.0</UserAgent>
</Sender>

Default Configuration

info

In the default configuration, only FROM is active. TO and SENDER are optional and are only required if the procurement system sends the corresponding values and expects mutual identification.

Typical minimal configuration for Ariba:

Check point	Active	Domain	Field
FROM	✅	NetworkId	Email
TO	❌	–	–
SENDER	❌	–	–
Shared Secret	❌	–	–

Common Issues

Login fails — authentication error

• Does the domain (NetworkId, DUNS, etc.) match the exact value the procurement system sends?
• Is the customer assigned to the system in the Customers tab?
• Is the Shopware field (email, customer number, custom field) filled in for the customer?

Shared Secret fails

• Does the password match exactly (case-sensitive)?
• Is the field correctly set on the Shopware customer profile?
• Does the procurement system send a <SharedSecret> at all? Since 3.7.400 / 3.6.200 a missing or empty secret is rejected when the check is enabled — disable the check in that case.