Limit API Access to an account | Community
Skip to main content
szymons55769873
szymons55769873
Level 2
January 13, 2020
Solved

Limit API Access to an account

  • January 13, 2020
  • 4 replies
  • 16091 views

Hello

 

I was wondering if there is a possibility to limit account's access rights in a way that would allow only reading ONE particular schema and nothing else. Either SOAP API or jssp is fine.

Additionally, is it possible to track exactly how often and how much data the user is obtaining with the API calls?

 

Kind regards

 

 

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by Jonathon_wodnicki

Hi,

 

Assuming 'nothing else' refers to user-defined schemas, add sysFilters per this guide:

NB all users of Campaign share the same underlying db user, so this is mostly cosmetic.

API traffic can be monitored in web server logs with custom scripts or off-the-shelf software such as ELK, Splunk.

 

Thanks,

-Jon

4 replies

Jonathon_wodnicki
Community Advisor
Jonathon_wodnickiCommunity AdvisorAccepted solution
Community Advisor
January 14, 2020

Hi,

 

Assuming 'nothing else' refers to user-defined schemas, add sysFilters per this guide:

NB all users of Campaign share the same underlying db user, so this is mostly cosmetic.

API traffic can be monitored in web server logs with custom scripts or off-the-shelf software such as ELK, Splunk.

 

Thanks,

-Jon

szymons55769873
szymons55769873Author
Level 2
January 15, 2020

@jonathon_wodnicki 

Thanks, I'll check that out.

 

As for the "nothing else", I would also like to limit one's ability to use factory schemas like xtk:session's methods, because if the user has access to those, he'd be able to do Write, so essentially insert/delete as well.

 

Also, what do you mean by cosmetic and what does the documentation mean by "This restriction applies only to non technical users: a technical user, with related permissions, or using a workflow, will be able to retrieve and update data."? That this can be easily bypassed if a user really wants to?

 

Kind regards, Szymon

Amit_Kumar
Amit_Kumar
Level 10
January 17, 2020

Hi Szymon,

In your use case, you should not allow any user to login to Adobe campaign as Jon mentioned there are couple of security concerns when you allow a user to login to your marketing database even via API.  

The recommended way will create a middleware API(for this particular microservice) endpoint which should act as a bridge to your system from the outside world. Cheapest way will be to use Amazon lamda based function where you can easily measure the data usage and at the same time restrict them to a certain function from, Adobe campaign.

 

The data flow would be :

 

Third-party system: Read data API(AWS): authenticate the request: Get the data from Adobe campaign.

Third-party system: Update data API(AWS): authenticate the request: update the data in Adobe campaign.

https://docs.aws.amazon.com/lambda/latest/dg/with-on-demand-https-example.html

https://docs.aws.amazon.com/lambda/latest/dg//monitoring-functions-access-metrics.html

https://docs.aws.amazon.com/lambda/latest/dg//monitoring-functions-metrics.html

 

Regards,

Amit

szymons55769873
szymons55769873Author
Level 2
January 17, 2020

Thanks Amit for your thoughts. 

My idea was to create JSSP pages and instead of SOAP Calls allowing POST requests through HTTP, then I believe it would be possible to build some kind of basic tracking on that JSSP, wouldnt it?

szymons55769873
szymons55769873Author
Level 2
January 17, 2020
Thanks, Amit, would you know how exactly does the "Restriction by folder" option in the account settings in client work? It doesn't seem to work for API which is unfortunate
Terms & ConditionsAccessibility statement

Loading footer...