Project

General

Profile

Feature #9989

« Previous | Next »

security plugin for appserver/REST/SOAP/web API access

Added by Greg Shah about 1 year ago. Updated about 1 year ago.

Status:
New
Priority:
Normal
Assignee:
-
Target version:
-
Start date:
Due date:
% Done:

0%

billable:
No
vendor_id:
GCD
case_num:
version_reported:
version_resolved:
reviewer:
production:
No
env_name:
topics:

History

#1 Updated by Greg Shah about 1 year ago

In Replacing the Open Client for Java there is this:

The created account doesn't need any special permissions, other than connect to the FWD server.

We need to add a SecurityManager plugin to secure the legacy appserver/REST/SOAP access. It should be easy to disable so that there is very little to configure to implement the current "OE compatible" mode where there is no granular security model for access. But it should also be possible to apply our full security model to these legacy APIs.

#2 Updated by Constantin Asofiei about 1 year ago

In 4GL, there is SESSION:EXPORT(...) method, which gets a comma-separated list of names/patters, of 4GL programs which can be used as entry-points by the appserver (i.e. what the client - openclient, 4gl, rest, etc - can call via the appserver).

But this is an application-level security, and FWD honors this export list.

#3 Updated by Greg Shah about 1 year ago

I understand, but that is not enough to properly implement the FWD security model.

Also available in: Atom PDF