Restricting users from CSSDK api calls

Not sure if anyone came across this type of request. We have bunch of content developer users who has fair knowledge on writing custom cssdk java programs to make calls from their local machine and playaround with content store on Teamsite workarea. As long as they are teamsite users they can access teamsite, am just checking to see if theres any way we can prevent users from running custom programs from their desktop machines.

Pls let me know. TS version - 7.4.1 - RHEL 6.4

Find more posts tagged with

Comments

Rick Poulin

Kinda.. you can change the SSL certs and turn off cssdk web services, and then give the cert to only those apps you want to grant access.

Aside from that, note that users connecting through the cssdk will only have the permissions for their user anyway, so it's not like they can't do anything that they can't already do through the TS UI.

ts_tech

Thanks rpoulin!

SSL certs is one way for csddk soap and we thought of setting one common tool server - that can get this CSSDK feature in more controlled way - by allowing queued operation + blocking based on IP address. But that would be more work. But we understand that cssdk access is based on the users, roles.

Rick Poulin

Not sure if you understood my meaning. I wasn't saying you should build a web service to control access. What I'm saying is that the CSSDK comes in two flavours, right?

CSJavaFactory -- don't give external apps the right certs and won't be able to connect.

CSSOAPFactory -- just disable the web service entirely if you don't use it for legitimate reasons.

But honestly.. Why are so many people trying to hack your system in the first place?

ts_tech

Understood rpoluin, may be I didnt word it right. Thanks again.