Prevent users from running REST API queries
Hello,
I'm looking for a way to prevent users from running REST API queries against CCM, QM and RM. What is the best way to go about it? The idea is to have a few users authorized to run REST API queries at predefined times instead of having hundreds of users doing this throughout the day. I don't think it can be done through settings in the applications, so I'm thinking about implementing a rule in the firewall server. I would block URLs such as "https://<server:port>/ccm/rpt" and make it available only to certain IP addresses. Any thoughts? |
2 answers
For RQM, you can disable the Quality Management/XML Export permissions (see https://jazz.net/wiki/bin/view/Main/RqmApi#Permissions) for the user role.
|
We desperately need this, too - we've got folks now running bots now which update work items. The potential for users to update 300+ work items in one call is now possible. Is it possible to block the REST port on WebSphere for everyone except the userIds which are auth'd to use it (i.e. jts_user, etc.)? I am guessing not due to RTC using REST programmatically?
Comments The way I solved this was by blocking access from all IPs to URL https://yourserver.com:9443/ccm/rpt, except for a few IPs from users who really need access to the REST API. But I guess this approach only works if your network uses fixed IPs for the workstations.
1
It also depends on what API those "bots" are using - OSLC, REST or internal web service. The first two have distinctive URL patterns so you can easily tell, but the last one will look just like a normal request call from a browser.
Thanks Andre! Possibly this could work, although I think the few users that should use it may be dynamically assigned IPs; but either way I appreciate your response and insight!
Thanks Donald, I was afraid of that as well...
|
Your answer
Dashboards and work items are no longer publicly available, so some links may be invalid. We now provide similar information through other means. Learn more here.
Comments
Are there complaints about performance ? If not, my opinion is not to worry. If performance is an issue, efforts to improve the hosting might go further than blocking accesses arbitrarily.
Kevin, yes we are having issues with performance. This REST API queries are not the root cause, but they do influence the overall load in the server. We have an ongoing initiative to increase resources for the server, but we also need to think about the damage several hundred users could cause if they run long queries.