Jazz Forum Welcome to the Jazz Community Forum Connect and collaborate with IBM Engineering experts and users

RQM v4.0.2 How To Restrict The Use Of API To Prevent Misuse?

Questions
Tags
Users
Badges
Li Chen
(119●2●37●42) Feb 04 '14, 3:56 p.m.

Our users are allowed to run reports or load artifacts using the utilities written by our team (RQM Admin Team). But some end users with programming background wrote their own scripts by calling API, they pulled and uploaded, and this becomes a big risk for us as they can delete, they can consume a lot of resources and etc.

What should we do to prevent users running their own scripts? or what should we do to prevent users directly (not using RQM user interface) access database?

0 votes

1 answer
7,185 views
0 votes

One answer

Permanent link
Vidya Malkarnekar
JAZZ DEVELOPER (1.0k●1●5) Feb 05 '14, 9:52 a.m.
Hi Li,

You can  restrict API POST/PUT calls using  XML Import permission at project level.
For more information, check out https://jazz.net/wiki/bin/view/Main/RqmApi#Permissions 
XML Export is supposed to control GET calls, but looks like there is an existing defect with that permission not being honored currently.

-Vidya

0 votes

Comments
Li Chen
Feb 05 '14, 10:08 a.m.
Thanks Vidya, If I do not allow a user to API upload test case, that means he can't upload even if he uses the scripts written by me, right? If this is the case, this is not what I want. Some users have been writting/testing/debugging their own scripts on production without letting us know. This is a big risk for us. I once wrote a script to delete a user but when I tested it I deleted all users. Luckily I knew how to get them back, but not every user knew how to recover from their mistake. Currently we only knew they were doing things like that when they approached us and told us they encountered a problem and  they need us to help out, and every time when this happened, we got shocked because of the risk.

Vidya Malkarnekar
JAZZ DEVELOPER Feb 05 '14, 12:03 p.m.
Right,  the users won't be able to update artifacts using API calls in any script with their user id  if not having  XML Import permission. I misunderstood your original question. I can't think of a way to prevent users  from running only selective scripts as per your requirement.

Your answer

Register or log in to post your answer.

Dashboards and work items are no longer publicly available, so some links may be invalid. We now provide similar information through other means. Learn more here.

Ask a question
Guidelines
FAQ
Search context
Follow this question

By Email: 

Once you sign in you will be able to subscribe for any updates here.

By RSS:

Answers
Answers and Comments
Question details
× 12,144
× 241

Question asked: Feb 04 '14, 3:56 p.m.

Question was seen: 7,185 times

Last updated: Feb 05 '14, 12:03 p.m.

Confirmation Cancel Confirm