DataPower

DataPower

Join this online group to communicate across IBM product users and experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Access Profile Declaration

    Posted 01/06/23 01:20 PM

    What is the access  profile to allow only the reading of   a specific file in a directory in the local filesystem in the default domain?

     

    Let say that the subdirectory in local is ILMT and the filename in the subdirectory is ilmt.doc.

     

    We tried the following access profiles, but none worked:

     

    */default/file/local?Name=^ilmt.doc$&Directory=^///ILMT$&Access=r

    */default/file/local?Name=^ilmt.doc$&Directory=^\/\/\/ILMT$&Access=r

     

    */default/file/local?Name=^ilmt.doc$&Directory=^///ILMT/$&Access=r

    */default/file/local?Name=^ilmt.doc$&Directory=^\/\/\/ILMT\/$&Access=r

     

    */default/file/local?Name=^ilmt.doc$&Directory=^//ILMT/$&Access=r

    */default/file/local?Name=^ilmt.doc$&Directory=^\/\/ILMT\/$&Access=r

     

    */default/file/local?Name=^ilmt.doc$&Directory=^///ILMT$&Access=r

    */default/file/local?Name=^ilmt.doc$&Directory=^\/\/\/ILMT$&Access=r

     

    */default/file/local?Name=^ilmt.doc$&Directory=^ILMT$&Access=r

    */default/file/local?Name=ilmt.doc&Directory=ILMT&Access=r

     

     

     

    */default/file/local?Access=r  works but allows read access to the entire local directory.

     

    Thanks.

     

    Paul

     

    Sent from Mail for Windows

     



  • 2.  RE: Access Profile Declaration

    Posted 01/09/23 10:48 AM

    For you question, the PCRE is as follows. Unfortunately, this is not the file or directory that you want to access.

        */default/file/local?Name=ilmt.doc&Directory=ILMT&Access=r

    The PCRE I think that you want, for the directory path you want is "ilmt/output/" and to change directory to get to a file in the "output" subdirectory, you need "x" permission. What is best for this scenario is to set access to the local:///ilmt directory, for this is the directory that contains the archive of interest.

        */default/file/local?Name=.*&Directory=ilmt&Access=rx



    ------------------------------
    F Hackerman
    ------------------------------



  • 3.  RE: Access Profile Declaration

    Posted 01/10/23 10:52 AM
    Thank you for suggestion.

    We tried:
    */default/file/local?Name=.*&Directory=ilmt&Access=r+x

    Unfortunately, it did not work.

    ------------------------------
    Paul Dango
    ------------------------------

    Original Message


  • 4.  RE: Access Profile Declaration

    Posted 01/09/23 11:04 AM
    A suggestion: it might be easier to write a little utility / program that uses XMI to get the particular file you are interested in.
    Here is a sample:
    Using the DataPower XML Management interface to get and set files and configuration
    https://www.ibm.com/support/pages/using-datapower-xml-management-interface-get-and-set-files-and-configuration
    - section "Get File Example"
    Your utility might be Java / Python / Bash to run on the user desktop.
    The user would then not need to login to SSH nor WebGui.
    Hope that helps.
    Steve

    ------------------------------
    Steve Edwards
    Director
    Escala Ltd
    Southampton
    02380783802
    ------------------------------



  • 5.  RE: Access Profile Declaration

    Posted 01/10/23 10:54 AM
    Thank you for your reply.

    Unfortunately the XMI option is not authorized to some users.

    ------------------------------
    Paul Dango
    ------------------------------

    Original Message


  • 6.  RE: Access Profile Declaration

    Posted 01/10/23 12:09 PM
    Hi,

    WRT to my suggested XMI solution ...

    You seem to miss the point:
    - a program could be written that hides the XMI username / password from the user
    - the program could have its own user name password to allow it to make that call
    That overcomes the problem you seem to indicate :-)
    Steve

    ------------------------------
    Steve Edwards
    Director
    Escala Ltd
    Southampton
    02380783802
    ------------------------------

    Original Message


  • 7.  RE: Access Profile Declaration

    Posted 01/10/23 01:28 PM
    However, the objective is to allow only access to a  specific file to some users. 
    So, I do not see that can be supported without declaring the appropriate access profile.

    ------------------------------
    Paul Dango
    ------------------------------

    Original Message


  • 8.  RE: Access Profile Declaration

    Posted 01/10/23 02:39 PM

    Paul, I just create a user group with the following access profile and I can only "read" the scan results in the "ilmt/output" directory.
         */*/file/local?Directory=ilmt&Access=r
         */*/login/ssh?Access=r+w+a+d+x
         */*/login/web-mgmt?Access=r+w+a+d+x
         */*/system/ilmt-force-scan?Access=r+w+a+d+x
         */*/system/ilmt-scanner?Access=r+w+a+d+x

    This profile allow the users in this group to log in to the GUI or CLI and work with the ILMT artifacts. I didn't state to "default" domain, but this is where all these resources reside and will not change permission/access. What I did note and why I added CLI access was that the GUI always shows no files (a bug that you need to open a service ticket against).

    When you use the CLI, this is what I get for for this user in this group.

    # co
    Global mode
    (config)# dir local:
    % Access Denied - use 'cancel' to exit any submode.
    (config)# dir local:///ilmt
    % Access Denied - use 'cancel' to exit any submode.
    (config)# dir local:///ilmt/output/
       File Name                    Last Modified                    Size
       ---------                    -------------                    ----
       202301101619-<systemname>-1673345956.tar.gz Jan 10, 2023 11:19:03 AM         3489
     
       8661.6 MB available to local:///ilmt/output/
     
    Note that I find that not showing the subdirectories is also a bug, but it might be working as designed/implemented.
    With all stated, I believe what Paul is attempting to state is that you can probably create a script that anyone can run. I've seen done similar with simple PHP, but this was for a custom web service that does all activities and any type of script can be used. Any user with access to this script run it (as PHP, it's a button on a web page). The script contains the credentials for the DataPower user (who can have full access but isn't the person who clicked the button). The script can do the following if created correct.
    1. Copy the scan files from DP (local:///ilmt/output/*) to a remote server with same file name.
    2. Upload these files from the remote server (because you still need to keep copies for 2 years) to the configured location on the ILMT server.
    3. Delete these files from DP. 
    Basically Paul is stated that the person who runs the scripts doesn't know credentials for the DP user and the DP user can have access to more that what the person running the script ever needs to know.

    ------------------------------
    F Hackerman
    ------------------------------



Related Content