Securing webMethods Integration Cloud and API Cloud

Author: Vivek Kumar (vivk@softwareag.com), Srikanth Prathipati (srpr@softwareag.com)

1.Introduction

webMethods Integration Cloud and API Cloud (Gateway and Portal) are part of iPaaS (integration Platform-as-a-Service) offering from Software AG. This document covers the User Management, Access Profiles, Project Permissions, ACLs (Access Control List) to secure the platform (both Integration Cloud and API Cloud).

• Audience

This article is intended for Cloud Integration Architects, Platform Administrators who would like to secure the platform with the proper Access Permissions.

• Overview

1228×565 11.4 KB

Integration Cloud supports three dimensional permissions matrix.

• Access Profile: Access Profile specifies  a collection of permissions that can be applied to multiple users.
• Project Permission: Project Permissions are used to define custom project specific administrative permissions.
• Access Control Lists: Access Control Lists are used to control the execution permission of an Integration. ACL, through the assigned Access Profiles, specifies the users who are granted the Execute Integration permission.

Users, Access Profile and Access Control Lists are linked with each other whereas Project permissions are linked with Projects and Users. Section 3 provides more details on this.

2. User Management

User Management for all the iPaaS offerings (Integration Cloud, API Gateway, Portal) are managed from Integration Cloud. In future the same would be offered from Software AG Cloud. Integration Cloud also supports Single Sign-On (SSO) to allow users to access the platform from Corportate Identity Provider (IDP). Users identities can be imported into the platform with the SSO configurations. 

• IDP Users:
  • Users Identities are imported from IDP when the above configuration is enabled
  • When users logs in SSO they are authenticated with SAML tokens against IDP
  • It is recommended to use IDP users for Platform User Interface (UI) login only but not for API/Integration execution access
• Native Users:
  • Native user (Tenant Administrator) is provisioned during tenant creation.
  • Native user can be used for both UI and API/Integration access.
  • Follow the recommended password policies for the Native users.

For creating the New User follow the below steps from Settings. If you want to create user for a Developer, make sure the user is assigned to right Project Permissions. Access Profile can be assigned with minimum functional permissions. This would explained in Section.5 – Sample Use cases.

1647×746 30.7 KB

• Audit Log : A security Audit Log entry will be audited when a user (IDP/Native) logs into the platform/ access the API/Integration from an invocation channel. In addition to that all platform operation would also be audited. For example, logs related to additions, deletions, updations, export, schedule, skip, login, logout, password changes, record access attempts, access violations, deployments, restart Integration executions, resume Integration executions, etc.

3. Securing Integration Cloud

• Access Profiles: Access Profile specifies a collection of functional permissions that can be applied to multiple users.
  • Associated with Permission Matrix
    • Administrative permissions to be associated with Access Profile is classified into three categories;
      • Global Permissions
      • Functional Controls
      • Project Permissions

For example; Please refer to appropriate configurations from the below screenshot

1376×759 45.4 KB

• The created Access Profile should be associated with at-least one stage. Please refer to appropriate configuration for the below screenshot

1843×667 58.7 KB

• Many to many mappings with ACL. Access Profiles can be mapped to multiple ACLs. 

It is recommended to have different Access Profiles for Platform Administrator, Developer and DevOps Engineers. DevOps engineer can have different Access Profile for Monitoring purpose (read only).

• Project Permission:

Project permissions are used to associate permissions with projects. Any new project created is automatically associated with the "Developer" project permission profile. If a project permission profile is associated with a user on the user profile page, the user can perform only the permitted tasks in the mapped project.

• Associated with Project Permission Matrix. For example; Please refer to appropriate configurations from the below screenshot.

1787×705 54.5 KB

• Project permission can be mapped to multiple users.
• It is recommended to use Project Permissions only for development activities and hence it is not required to associate this for stages.

• Access Control Lists:

Use Access Control Lists (ACLs) to control the execution permission of an Integration. ACL can be mapped with multiple Access Profiles. It is recommended use custom ACLs (not Default) for API/Integration access.

1652×490 24.5 KB

• Sample Permission Matrix

4. Securing API Cloud

• Access Profiles: API Management requires the below permissions for the Access Profile.

1580×698 55.4 KB

• The created Access Profile should be associated with at-least one stage as mentioned in the earlier sections. It is recommended to have different Access Profiles for API Gateway Administrator, API Gateway Providers, API Portal Administrators and API Portal Providers. These are offered by the platform out of the box. Administrative permissions that can be associated with different Access Profiles are below.

Based on the public/private communities managed on API Portal, more fine-grained roles can be provisioned.

• Access Control Lists: Use Access Control Lists (ACLs) to control the execution permission of an Integration. ACL, through the assigned Access Profiles, specifies the users who are granted the Execute Integration permission.

1661×587 31.8 KB

• Sample Permission Matrix

5. Sample Use case - Creating Access Profile for Developer:

• Access Profile for Developer requires – project permissions for developing integrations, APIs, Applications (if the restriction needs to be applied on certain projects). Default Project is in general is intended for shared access between multiple development teams. Hence this is offered as part of Access Profile. An Access Profile can be created with such permission as shown below and can be associated with the developers.
• Go to Settings > Access Profiles > Add New Access Profile > Administrative Permissions and select the default permissions to be assigned for developer in webMethods Integration Cloud.

Please find below sample for the same.

1392×782 56.1 KB

From API Management prespective, Developer would also need permision to Manage the APIs (create, update, delete). This is required especially on Developement API Gateway Tenant. This requires the below permissions.

1558×660 47.3 KB

• In addition to this, new Project permissions can be created for each Project. To create the Project Permission,

Go to Settings > Project Permissions > Add New Project Permissions. Select the Project to give permissions and Click on ‘+‘ icon. Select all the permissions.

1802×617 40.7 KB

• Associate Access Profile and Project Permission to Users: The Access Profile created above has to be mapped with the User. To create the user with associated Access Profile; Go to Settings > Users > Add New User, select the Access Profile and required Project Permission

1658×759 32.9 KB