Limit API Access to an account

Avatar

Avatar
Ignite 1
Level 2
szymons55769873
Level 2

Likes

5 likes

Total Posts

22 posts

Correct reply

0 solutions
Top badges earned
Ignite 1
Validate 1
Give Back
Boost 5
Boost 3
View profile

Avatar
Ignite 1
Level 2
szymons55769873
Level 2

Likes

5 likes

Total Posts

22 posts

Correct reply

0 solutions
Top badges earned
Ignite 1
Validate 1
Give Back
Boost 5
Boost 3
View profile
szymons55769873
Level 2

12-01-2020

Hello

 

I was wondering if there is a possibility to limit account's access rights in a way that would allow only reading ONE particular schema and nothing else. Either SOAP API or jssp is fine.

Additionally, is it possible to track exactly how often and how much data the user is obtaining with the API calls?

 

Kind regards

 

 

Accepted Solutions (1)

Accepted Solutions (1)

Avatar

Avatar
Establish
MVP
wodnicki
MVP

Likes

983 likes

Total Posts

1,097 posts

Correct reply

517 solutions
Top badges earned
Establish
Affirm 500
Contributor
Shape 1
Give Back 100
View profile

Avatar
Establish
MVP
wodnicki
MVP

Likes

983 likes

Total Posts

1,097 posts

Correct reply

517 solutions
Top badges earned
Establish
Affirm 500
Contributor
Shape 1
Give Back 100
View profile
wodnicki
MVP

14-01-2020

Hi,

 

Assuming 'nothing else' refers to user-defined schemas, add sysFilters per this guide:

NB all users of Campaign share the same underlying db user, so this is mostly cosmetic.

API traffic can be monitored in web server logs with custom scripts or off-the-shelf software such as ELK, Splunk.

 

Thanks,

-Jon

Answers (3)

Answers (3)

Avatar

Avatar
Ignite 1
Level 2
szymons55769873
Level 2

Likes

5 likes

Total Posts

22 posts

Correct reply

0 solutions
Top badges earned
Ignite 1
Validate 1
Give Back
Boost 5
Boost 3
View profile

Avatar
Ignite 1
Level 2
szymons55769873
Level 2

Likes

5 likes

Total Posts

22 posts

Correct reply

0 solutions
Top badges earned
Ignite 1
Validate 1
Give Back
Boost 5
Boost 3
View profile
szymons55769873
Level 2

17-01-2020

Thanks Amit for your thoughts. 

My idea was to create JSSP pages and instead of SOAP Calls allowing POST requests through HTTP, then I believe it would be possible to build some kind of basic tracking on that JSSP, wouldnt it?

Amit_Kumar
There is a problem as soon as you give the access to JSSP page, they will automatically get access to SOAP. then the only way you can achieve this is by hard coding the access in JSSP for the user using logonEscalation method or something similar.
Amit_Kumar
if you still wants that method then you have to create another schema for monitoring if you want ACC to handle everything in-house. every time there is an invocation to this JSSP page you can create a row there. and log the bytes requested as response and session info.
szymons55769873
Amit, I tested a scenario when the IP I whitelisted wasn't given API access rights and I was still able to obtain data from JSSP. A problem only would arise if the user was using an IP that has to have the API enabled.
Amit_Kumar
yeah because JSSP sits on web server so anyone can access it as it's in public domain. if you want it like that then sure it will solve your purpose.
szymons55769873
Thanks, Amit, would you know how exactly does the "Restriction by folder" option in the account settings in client work? It doesn't seem to work for API which is unfortunate
Amit_Kumar
yeah, it's a shame. The Restrict to information found in sub-folders of: option lets you limit the rights attributed to the operator of a folder. Only the subfolders of the node specified in this option will be visible to the user in console. so it will not work for JSSP page.
szymons55769873
Amit, do you know if JS server pages have any limitations as such, or is in theory possible to read/write the exact same range of schemas and use all methods that SOAP Call allows?
Amit_Kumar
Except for the public domain access security issues, everything else is there. In terms of functionality, you can achieve everything.
szymons55769873
But to access the page if logon is required you still need to have your IP whitelisted, which would address most of the vulnerabilities, wouldn't it?

Avatar

Avatar
Springboard
MVP
Amit_Kumar
MVP

Likes

329 likes

Total Posts

649 posts

Correct reply

231 solutions
Top badges earned
Springboard
Ignite 5
Ignite 3
Ignite 1
Validate 10
View profile

Avatar
Springboard
MVP
Amit_Kumar
MVP

Likes

329 likes

Total Posts

649 posts

Correct reply

231 solutions
Top badges earned
Springboard
Ignite 5
Ignite 3
Ignite 1
Validate 10
View profile
Amit_Kumar
MVP

17-01-2020

Hi Szymon,

In your use case, you should not allow any user to login to Adobe campaign as Jon mentioned there are couple of security concerns when you allow a user to login to your marketing database even via API.  

The recommended way will create a middleware API(for this particular microservice) endpoint which should act as a bridge to your system from the outside world. Cheapest way will be to use Amazon lamda based function where you can easily measure the data usage and at the same time restrict them to a certain function from, Adobe campaign.

 

The data flow would be :

 

Third-party system: Read data API(AWS): authenticate the request: Get the data from Adobe campaign.

Third-party system: Update data API(AWS): authenticate the request: update the data in Adobe campaign.

https://docs.aws.amazon.com/lambda/latest/dg/with-on-demand-https-example.html

https://docs.aws.amazon.com/lambda/latest/dg//monitoring-functions-access-metrics.html

https://docs.aws.amazon.com/lambda/latest/dg//monitoring-functions-metrics.html

 

Regards,

Amit

Avatar

Avatar
Ignite 1
Level 2
szymons55769873
Level 2

Likes

5 likes

Total Posts

22 posts

Correct reply

0 solutions
Top badges earned
Ignite 1
Validate 1
Give Back
Boost 5
Boost 3
View profile

Avatar
Ignite 1
Level 2
szymons55769873
Level 2

Likes

5 likes

Total Posts

22 posts

Correct reply

0 solutions
Top badges earned
Ignite 1
Validate 1
Give Back
Boost 5
Boost 3
View profile
szymons55769873
Level 2

14-01-2020

@wodnicki 

Thanks, I'll check that out.

 

As for the "nothing else", I would also like to limit one's ability to use factory schemas like xtk:session's methods, because if the user has access to those, he'd be able to do Write, so essentially insert/delete as well.

 

Also, what do you mean by cosmetic and what does the documentation mean by "This restriction applies only to non technical users: a technical user, with related permissions, or using a workflow, will be able to retrieve and update data."? That this can be easily bypassed if a user really wants to?

 

Kind regards, Szymon