AnsweredAssumed Answered

Web services authorizations

Question asked by Steve Alexandre on Aug 16, 2018
Latest reply on Aug 16, 2018 by Mostafa Helmy

Like • Show 0 Likes0
Comment • 3

Hello everyone,

We are using web services available on RSA IGL to do some interractions with it like getting some informations of review but I missunderstood something ...

we should normally use in first step the loginUser to get the token needed to interract with the API but when i'm checking some of interfaces available on the web services, a lot of them does not need the token to be necessary for using them. If I try for example to use findUsers without the token, I get the result with users.

1) Why I can query the API without the token ?

2) It is possible to set as "needed", the token for calling them ?

Thanks for your help.

Mostafa Helmy

Aug 16, 2018 8:18 AM

Correct Answer

Hi Steve,

There are two authorization types for our webservices:

Token authorization: which uses a token generated from loginUser web service.
Whitelist IP: This is where you can specify a certain list of IP addresses that can issue web service calls without a token.

In your case, either you are calling the web service from a whitelisted IP address or you are allowing all connections (which is not recommended as per Security best practices). You can verify your settings from Admin > Web Services > List of IPs allowed to invoke web services.

Here is an example from my lab where I did not restrict any IP address in the White list, which means anyone can call any webservice without a token. By default you should keep this as 127.0.0.1 (localhost).

See the reply in context

No one else had this question

Outcomes

Mostafa Helmy

Aug 16, 2018 8:18 AM

Hi Steve,

There are two authorization types for our webservices:

Token authorization: which uses a token generated from loginUser web service.
Whitelist IP: This is where you can specify a certain list of IP addresses that can issue web service calls without a token.

1 person found this helpful

Actions

Steve Alexandre @ Mostafa Helmy on Aug 16, 2018 8:27 AM

Hi Mostafa,

That's the point, okay understood.

actually, there was my ip in the field, I thought it was to allow people to contact the API, not to bypass the authentication.

Thank you, by removing my ip, the API ask now for a token to be query .

PS : the name of this parameter is not clear. Maybe a little description on it should be better to understand what is it exactly.

Actions

Mostafa Helmy

@ Steve Alexandre on Aug 16, 2018 8:31 AM

Completly agree with you on that. The naming of the field gives you the impression that without it, you wouldn't be allowed to call the webservice at all (even with a token). I will report this interally and see if we can get the working changed in any upcoming patch

Actions

3 Replies

Mostafa Helmy Aug 16, 2018 8:18 AM
Unmark Correct
Correct Answer
Hi Steve,

There are two authorization types for our webservices:
1. Token authorization: which uses a token generated from loginUser web service.
2. Whitelist IP: This is where you can specify a certain list of IP addresses that can issue web service calls without a token.
In your case, either you are calling the web service from a whitelisted IP address or you are allowing all connections (which is not recommended as per Security best practices). You can verify your settings from Admin > Web Services > List of IPs allowed to invoke web services.

Here is an example from my lab where I did not restrict any IP address in the White list, which means anyone can call any webservice without a token. By default you should keep this as 127.0.0.1 (localhost).
1 person found this helpful
Like • Show 1 Like1
Actions
- Steve Alexandre @ Mostafa Helmy on Aug 16, 2018 8:27 AM
  Mark Correct
  Correct Answer
  Hi Mostafa,
  
  That's the point, okay understood.
  actually, there was my ip in the field, I thought it was to allow people to contact the API, not to bypass the authentication.
  
  Thank you, by removing my ip, the API ask now for a token to be query .
  
  PS : the name of this parameter is not clear. Maybe a little description on it should be better to understand what is it exactly.
  Like • Show 0 Likes0
  Actions
  - Mostafa Helmy @ Steve Alexandre on Aug 16, 2018 8:31 AM
    Mark Correct
    Correct Answer
    Completly agree with you on that. The naming of the field gives you the impression that without it, you wouldn't be allowed to call the webservice at all (even with a token). I will report this interally and see if we can get the working changed in any upcoming patch
    Like • Show 1 Like1
    Actions

Web services authorizations

Outcomes

Related Content

Recommended Content