Advanced User Access Restriction in IBM Sterling B2B Integrator (SI) Using DENY Permissions
Summary
IBM Sterling B2B Integrator provides coarse-grained access control by default, which can make it difficult to design secure, role-based access such as read-only or restricted users.
This blog shares a practical approach to achieving fine-grained user access control using DENY permissions, based on real-time analysis of authentication logs and extensive UI testing. It also highlights key implementation scenarios, best practices, and important upgrade considerations.
Introduction
In IBM Sterling B2B Integrator (SI), permissions are typically assigned at a high level. When a user is granted access to a resource, they are often able to perform all associated actions such as view, edit, delete, or execute.
While this model works for administrators, it becomes a challenge when designing controlled roles such as:
- Read-only users
- Operations (L1/L2) users
- Audit or compliance-restricted users
This blog demonstrates how to overcome these limitations using DENY permissions combined with authentication log analysis.
Problem Statement
Organizations often require:
- Users who can view but not modify configurations
- Users who can monitor processes without executing them
- Users who can access menus but restrict critical actions
However, SI does not natively provide fine-grained permission control.
Approach & Methodology
1. Log-Based Permission Discovery
Authentication and UI logs were analyzed by enabling debug mode, which provided detailed insights into the internal permission validation and resource access patterns. This helped identify the exact permission names triggered during specific user actions.
2. Systematic UI Testing
Each major module was tested.
3. Mapping UI → Permission → Restriction
Detailed mapping created.
Key Implementation Scenarios
1. Restricting Account Management
_DENY_getaccount
_DENY_getgroup
_DENY_getperm
_DENY_getpwdpolicy_ACCESS
When user tries to create a new user account, the system will show message- you do not have the appropriate permissions to access this area.
2. Business Process Control
_DENY_BPEXEC
_DENY_getbpd_ADD
_DENY_BPMANAGE_EDIT
_DENY_getbpd_ADD
3. BP Monitor Restriction
_DENY_getdoc
4. Deployment Restrictions
_DENY_getservice
_DENY_getschedule
5. Maps/XSLT
_DENY_MAPS_ADD
_DENY_MAPS_EDIT
6. Mailbox
_DENY_GetMBConfig
7. Trading Partner
_DENY_GetPartnerBasic
8. Web Services
_DENY_GetWSConfig
Example Read-only Role
_DENY_BPEXEC
_DENY_getdoc
Key Observations
- DENY overrides ALLOW
- Logs are critical
Important Notes
- DENY not applied to admin users
Upgrade Consideration
Custom permissions and groups may not persist after upgrade.
Always take backup of permissions and groups before upgrade.
Admin Menu | Permission Name | Deny Description |
| | |
Accounts | _DENY_getaccount | Deny user account creation and edit user account |
_DENY_getgroup | Deny Group creation and edit group |
_DENY_getperm | Deny Permission creation and edit permission |
_DENY_getpwdpolicy_ACCESS | Deny Permission to create Password policy and edit policy |
_DENY_getmessage | Deny Permission to create news and edit news |
Business Processes | _DENY_getbpd_ADD | Deny create or edit Process definition |
_DENY_BPEXEC | Deny Execute permission for control Business process execution |
_DENY_bpdactivate | Deny enable /disable the checkbox in Business process execution |
_DENY_BPMANAGE_EDIT | Deny edit of Business Processes under Source Manager |
_DENY_getbpd_CHECKOUT | Deny check out of Business Processes under Source Manager |
_DENY_getbpd | Deny check in -->Go--> BP under Source Manager |
_DENY_getbpd_EDIT | Deny edit of Business Processes under Source Manager |
BP Monitor | _DENY_getdoc | Deny link to download the document from the root document name |
Deployment-->Services | _DENY_getservice | Deny- create a new services, edit services, enable or disable services |
_DENY_globalservice | Deny Global service to update a service |
Deployment-->Schedule | _DENY_getschedule | Deny -creating a scheduler or edit schedule or enabling a schedule |
Deployment-->MAPS | _DENY_MAPS_ADD | |
_DENY_MAPS_CHECKOUT | |
_DENY_MAPS_EDIT | |
_DENY_OPERATIONS_DELETE_MAPS | |
Deployment-->XSLT | _DENY_getxslt | Deny to create XSLT |
_DENY_xsltmanager | Deny to edit, checkout XSLT |
Deployment-->Schema | _DENY_getschema | Deny permission on Go/Edit of Schema |
Deployment-->Mailbox | _DENY_GetMBConfig | Deny permission on Go/Edit of Mailbox Configuration |
_DENY_GetMBVirtualRoot | Deny permission on Go/Edit of Mailbox Virtual roots |
_DENY_GetMBRR | Deny permission on Go/Edit of Mailbox routing rules |
_DENY_GetMBMessage_EDIT | Deny permission on Edit of Mailbox Messages |
_DENY_getdoc | Deny permission to download the file from the Messages-->Filename |
Deployment-->Resource Manager | _DENY_gettag | Deny Permission to create a new resource tags. |
Deployment-->SSH Host Identity Key | _DENY_GetLocalHostKey | Deny permission to create /check in/ edit the SSH host identity key |
Deployment-->Webservices | _DENY_GetWSConfig | Deny Permission to create/edit web service configuration. |
_DENY_GetBPSchemaConfig | Deny Permission to create/edit BP Schema Configuration. |
_DENY_getwsdl | Deny Permission to create/edit WSDL |
_DENY_GetSecurityToken | Deny Permission to create/edit Security tokens |
Trading Partner-->Setup | _DENY_GetPartnerBasic | Deny Permission to create Trading Partner |
_DENY_GetEntity | Deny Permission to create--> Identity/Transports/Doc Exchange/Delivery channels/Packaging/Profiles |
_DENY_UpdateTPEntity | Deny Permission to Edit--> Identity/Transports/Doc Exchange/Delivery channels/Packaging/Profiles |
_DENY_DeleteManager | Deny Permission to Delete--> Identity/Transports/Doc Exchange/Delivery channels/Packaging/Profiles |
Trading Partner-->Digital Certificates | _DENY_getdigicert | Deny Permission to create CA/Trusted /System Certificates |
_DENY_updatedigicert | Deny Permission to edit CA/Trusted /System Certificates |
_DENY_updateSSLDigiCertgrabber | Deny Permission to create Certificate capture utility |
Trading Partner-->Document Envelopes | _DENY_getenvelope | Deny Permission to create envelopes |
_DENY_updateenvelope | Deny Permission to edit envelopes |
_DENY_GetCtrlNumber | Deny Permission to create contrl numbers |
Trading Partner-->Code List | _DENY_CLManager | Deny permission to update CL |
_DENY_GetCL | Deny permission to create CL |
Trading Partner-->AS2 | _DENY_AS2_SETUP | Denies access AS2 UI Page |
_DENY_getas2 | Denies access to create AS2 partner or trading partner relationship |
Trading Partner-->SSH | _DENY_GetSFTPKeys | Denies create access to SSH-->Remote Profiles/Knownhostkeys/ User Identity Keys/ Authorized Keys |
_DENY_InvokeResDelete | Denies delete access to SSH-->Remote Profiles |
_DENY_UpdateSFTPKeys | Denies checkout access to SSH-->Knownhostkeys/ User Identity Keys/ Authorized Keys |
Trading Partner-->AS3 | _DENY_getas3 | Denies access to create AS3 trading partner or contract |
_DENY_updateas3 | Denies Edit access to AS3 |
Operations-->Systems | _DENY_opsclient | Denies access to troubleshooter |
Best Practices
- Use group-based design
- Test in lower env
- Backup before upgrade
Conclusion
Fine-grained control achievable using DENY permissions.