Hi Christoph,
Again always continue with the naming standard :D thanks for the answer. Some people did not understand my question, let me give some details with your answer.
for example let's say there is a folder X with only "dont read" authorization:
In v12 : You could search for a job in folder X in the search section via java userinterface, find it and execute it. this always seemed strange to me :)
In v21 : You cannot find a job in X folder by searching in the search section via AWI . but as you said, even if you cant search via AWI and cannot find it ; you can still take action to job with automic script methods. it's better than nothing, there's some progress :D
Thanks.
------------------------------
Olgun Onur Ozmen
https://www.linkedin.com/in/olgunonurozmen/------------------------------
Original Message:
Sent: Jan 20, 2025 10:06 AM
From: Christoph Rekers at Tricise
Subject: AE Rest API Security
Hi Olgun,
The behavior is still the same in V24.x: if a user has no read right to a folder he can still execute objects located in that folder e.g. with activate_uc_object or delete objects with remove_object
------------------------------
--------------------------------------------------------
Automic Consultant and Trainer since 2000
--------------------------------------------------------
now Tricise
Original Message:
Sent: Jan 17, 2025 03:08 AM
From: Olgun Onur Ozmen
Subject: AE Rest API Security
Hi Marcus,
this will be a bit irrelevant question, but I wanted to ask because the subject came up.
In v12, in the past, when we restricted only the folder, you could see and execute the objects in that folder from the java userinterface search section, this was a situation we did not want. But I think this was fixed after AWI v21. in v21, when you restrict only the folder, you cannot access the objects in it in any way, including search. is that right?
Thanks.
------------------------------
Olgun Onur Ozmen
https://www.linkedin.com/in/olgunonurozmen/
Original Message:
Sent: Jan 17, 2025 02:20 AM
From: Markus Embacher
Subject: AE Rest API Security
Hi Ben,
there is no difference between a user login in via AWI and via REST API. The same defined security restrictions apply.
Please make sure that you did not only protect folders, so users in AWI can't look into the folders, but also protect the objects in those folders.
https://docs.automic.com/documentation/webhelp/english/ALL/components/DOCU/21.0.9/Automic%20Automation%20Guides/Content/AWA/AdministrationPerspective/obj_user_defining_AEAuth.htm#Folders
Regards, Markus
Original Message:
Sent: Jan 16, 2025 05:41 PM
From: BEN BAEZ
Subject: AE Rest API Security
Hello,
We are a fairly small operation with less than 1500 workflows and jobs scheduled. Currently running 21.0.11. We have three developer teams who generate jobs for different parts of the business. in AWI we only have one client and security prevents the developers from seeing and executing each others jobs. One team recently has requested access to the REST API which we haven't used before. In my initial testing with a developer user account I can execute my users jobs and the other teams jobs no problem. I have been unable to find documentation on locking down what an api user can execute. I have found information on locking down the rest api with reverse proxy and firewall rules but once a user is in it seems they can execute whatever JOBS they want. Has this been everyone else's experience? should we restructure the teams into different clients? Thanks for any info you can give.
Ben