imported>Jason.nicholls: /* Configuration of Access Control */

2014-07-10T11:43:16Z

Configuration of Access Control

← Older revision		Revision as of 11:43, 10 July 2014
Line 47:		Line 47:
	<br>		<br>

	{\|class="wikitable~~" border="1" style="background-color:#eeeeee;~~"		{\|class="wikitable"
	!Access Control Option		!Access Control Option
	!Description		!Description
Line 67:		Line 67:
	\|baseur1		\|baseur1
	\|URLs accessed in the proxied channel are restricted to those requests that match the host, port, and protocol of the channel’s Base URL.		\|URLs accessed in the proxied channel are restricted to those requests that match the host, port, and protocol of the channel’s Base URL.
	~~{{Note\|~~For channels with targets, the Base URL implicitly includes the host, port, and protocol of the target in addition to any path that is entered in the Base URL field.
	For example, if the channel's Base URL is <tt><nowiki>http://www.yahoo.com/</nowiki></tt>images, the channel will allow access to <tt><nowiki>http://www.yahoo.com/images/image1.gif</nowiki></tt> or <tt><nowiki>http://www.yahoo.com/images/USA/index.html</nowiki></tt>. However, resources such as <tt><nowiki>http://www.yahoo.com/html/index.html</nowiki></tt>, <tt><nowiki>https://maps.yahoo.com</nowiki></tt>, and <tt><nowiki>http://maps.google.com</nowiki></tt> cannot be accessed through the channel.}}		For channels with targets, the Base URL implicitly includes the host, port, and protocol of the target in addition to any path that is entered in the Base URL field.
			For example, if the channel's Base URL is <tt><nowiki>http://www.yahoo.com/</nowiki></tt>images, the channel will allow access to <tt><nowiki>http://www.yahoo.com/images/image1.gif</nowiki></tt> or <tt><nowiki>http://www.yahoo.com/images/USA/index.html</nowiki></tt>. However, resources such as <tt><nowiki>http://www.yahoo.com/html/index.html</nowiki></tt>, <tt><nowiki>https://maps.yahoo.com</nowiki></tt>, and <tt><nowiki>http://maps.google.com</nowiki></tt> cannot be accessed through the channel.
	\|-		\|-
	\|private		\|private
Line 90:		Line 91:
	\|The channel is disabled from accessing any URL. This option is typically used in conjunction with custom allow rules defined in runtime CRS files.		\|The channel is disabled from accessing any URL. This option is typically used in conjunction with custom allow rules defined in runtime CRS files.
	\|}		\|}
	~~<br>~~

	{{Tip\|The options listed in the table above will handle the access control needs of most channels. If specific controls are needed that cannot be handled by one of the standard options, you can accomplish this by configuring the necessary controls in an XML file to be applied as a runtime CRS file to the appropriate channel(s).}}		{{Tip\|The options listed in the table above will handle the access control needs of most channels. If specific controls are needed that cannot be handled by one of the standard options, you can accomplish this by configuring the necessary controls in an XML file to be applied as a runtime CRS file to the appropriate channel(s).}}

imported>Jason.nicholls: 1 revision

2014-07-10T05:09:00Z

1 revision

← Older revision	Revision as of 05:09, 10 July 2014
(No difference)

imported>Jason.nicholls: moved enportal/5.5/web integrations/access control proxied channels to enportal/5.5/admin/user administration/content creation/generic proxy access control

2014-06-27T12:22:02Z

moved enportal/5.5/web integrations/access control proxied channels to enportal/5.5/admin/user administration/content creation/generic proxy access control

New page

[[Category:enPortal 5.5]]
{{DISPLAYTITLE:Configuring Access Control for Proxied Channels}}

__TOC__

The Access Control setting in the enPortal Channel Builder gives the administrator control over what resources can be accessed through a given channel. This appendix details the options and usage for this setting.

 
== Purpose of Access Control ==
 
To properly establish access controls for channels, it is important to first understand the purpose of the channel and the requirements for any restrictions you will need to apply. You can then apply the appropriate restriction by use of the '''Access Control''' option in the '''Channel Editor'''.
 
The URL that is defined for a channel allows the portal administrator to specify precisely what resource should be loaded in the channel when the channel is presented to a portal user. However, the nature of Web content is that within a channel there may be links and other actions through which the user can access other Web resources.
 
There are times when the administrator would like to give the user full flexibility to navigate to a variety of URLs within a channel. However, there are also times where the administrator would like to guarantee that the channel will only permit certain resources to be accessed in the channel.
An example would be a channel that is designed to display certain sensitive information only from a particular server. Within a proxied application in that channel, there may be a link to other sensitive content on another server which you do not want to be displayed to the user. One way to ensure that the user in the channel is restricted to viewing only content on the permitted server is with the '''Access Control''' option in the '''Channel Editor'''.

{{Warning|enPortal users who have permission to edit a channel or create a channel can make changes to the Access Control settings. Before granting these privileges to a user, it is important to consider the potential repercussions of any changes they could make to the channel’s Access Control.}}

 
==Default Settings==
 
Out of the box, enPortal limits each channel’s access of Web resources to the protocol, host, and port that the channel is configured to use. Initially, each channel’s '''Access Control''' property uses the recommended setting for most channels, which is the default setting.

The definition of the default access control setting is configurable. This option looks to a setting in the <tt>PORTAL_HOME/config/crs.properties</tt> file called <tt>crs.accesscontrol.default</tt>. This setting selects one of the access control options to apply to any channels set as default. When the portal is first installed, the initial setting in the file is: <tt>crs.accesscontrol.default=application</tt>.
 
You can customize this configuration by copying and updating the above line from <tt>PORTAL_HOME/config/crs.properties</tt> to <tt>PORTAL_HOME/config/custom.properties</tt>.
If most or all of your channels will use the same '''Access Control''' option, one approach is to set them all to
default and then define that option in the <tt>custom.properties</tt> file. The advantage of this approach is
that if the '''Access Control''' setting for all of these channels later needs to be changed, you would only need to
update the single setting in the properties file.
The ''Configuration of Access Control'' section below describes the access control settings in detail.

 
==Configuration of Access Control==
 

Perform the following steps to assign '''Access Control''' to a channel:
#Create a channel 
#On the ''Channel Editor'' screen, click on the ''Access Control'' drop-down and select the appropriate option.


 
The table below describes the available Access Control options.
 

{|class="wikitable" border="1" style="background-color:#eeeeee;"
!Access Control Option
!Description
|-
|default
|Restriction of URLs accessed in this proxied channel is defined by a global setting in a system properties file.
For more information on this option, see ''Default Settings'' above.
|-
|application
|URLs accessed in the proxied channel are restricted to those requests that match the host, port, and protocol of the channel’s Full URL Path.
For example, if the channel's target is <tt><nowiki>http://www.yahoo.com</nowiki></tt>, the channel will allow access only to <tt><nowiki>www.yahoo.com</nowiki></tt> using http through port 80. Resources such as <tt><nowiki>https://maps.yahoo.com</nowiki></tt> and <tt><nowiki>http://www.yahoo.com:1234</nowiki></tt> cannot be accessed through the channel.
|-
|public
|URLs accessed in the proxied channel are restricted to those requests that meet one of the following two conditions:
#The host, port, and protocol of the requested resource matches those in the Full URL Path of the channel.
#The requested resource is not part of a private network from the standpoint of the requestor (as defined under private description below).
For example, if the channel's Full URL Path is <tt><nowiki>http://www.yahoo.com</nowiki></tt>, the channel will allow navigation to <tt><nowiki>http://www.yahoo.com</nowiki></tt> or <tt><nowiki>http://www.google.com</nowiki></tt>, but not <tt><nowiki>http://127.0.0.1</nowiki></tt>.
|-
|baseur1
|URLs accessed in the proxied channel are restricted to those requests that match the host, port, and protocol of the channel’s Base URL.
{{Note|For channels with targets, the Base URL implicitly includes the host, port, and protocol of the target in addition to any path that is entered in the Base URL field.
For example, if the channel's Base URL is <tt><nowiki>http://www.yahoo.com/</nowiki></tt>images, the channel will allow access to <tt><nowiki>http://www.yahoo.com/images/image1.gif</nowiki></tt> or <tt><nowiki>http://www.yahoo.com/images/USA/index.html</nowiki></tt>. However, resources such as <tt><nowiki>http://www.yahoo.com/html/index.html</nowiki></tt>, <tt><nowiki>https://maps.yahoo.com</nowiki></tt>, and <tt><nowiki>http://maps.google.com</nowiki></tt> cannot be accessed through the channel.}}
|-
|private
|URLs accessed in the proxied channel are restricted to those requests that meet one of the following two conditions:
#The host, port, and protocol of the requested resource matches those in the Full URL Path of the channel.
#The requested resource is part of a private network from the standpoint of the requestor. The private netmasks are configurable, but by default are defined as any of the following: <tt><nowiki>10.0.0.0/255.0.0.0</nowiki></tt>, <tt><nowiki>192.168.0.0/255.255.0.0</nowiki></tt>, <tt><nowiki>172.16.0.0/255.240.0.0</nowiki></tt>, or <tt><nowiki>127.0.0.0/255.255.255.0</nowiki></tt>. You can customize these configurations by copying one or more of the <tt>crs.accesscontrol.network.private</tt> settings from <tt>PORTAL_HOME/config/crs.properties</tt> to <tt>PORTAL_HOME/config/custom.properties</tt>.
For example, if the channel's Full URL Path is <tt><nowiki>http://www.yahoo.com</nowiki></tt>, the channel will allow navigation to <tt><nowiki>http://www.yahoo.com</nowiki></tt> or <tt><nowiki>http://127.0.0.1</nowiki></tt>, but not <tt><nowiki>http://www.google.com</nowiki></tt>.
|-
|domain
|URLs accessed in the proxied channel are restricted to those requests that match the domain listed in the Full URL Path of the channel.
For example, if the channel's Full URL Path is <tt><nowiki>http://www.yahoo.com</nowiki></tt>, the channel will allow navigation to <tt><nowiki>http://images.yahoo.com</nowiki></tt> or <tt><nowiki>https://maps.yahoo.com</nowiki></tt>, but not <tt><nowiki>http://maps.google.com</nowiki></tt>.
|-
|host
|URLs accessed in the proxied channel are restricted to those requests that match the server listed in the Full URL Path of the channel.
For example, if the channel's Full URL Path is <tt><nowiki>http://www.yahoo.com, the channel will allow navigation to <tt><nowiki>http://www.yahoo.com</nowiki></tt>, <tt><nowiki>https://www.yahoo.com</nowiki></tt>, or <tt><nowiki>http://www.yahoo.com:1234</nowiki></tt>, but not <tt><nowiki>http://maps.yahoo.com</nowiki></tt> or <tt><nowiki>http://maps.google.com</nowiki></tt>.
|-
|allowall
|There is no restriction of what URLs can be accessed through this proxied channel. However, restrictions can be applied through enPortal security controls to manage which users have permission to view the channel.
|-
|denyall
|The channel is disabled from accessing any URL. This option is typically used in conjunction with custom allow rules defined in runtime CRS files.
|}
 

{{Tip|The options listed in the table above will handle the access control needs of most channels. If specific controls are needed that cannot be handled by one of the standard options, you can accomplish this by configuring the necessary controls in an XML file to be applied as a runtime CRS file to the appropriate channel(s).}}

Enportal/5.5/admin/user administration/content creation/generic proxy access control - Revision history

imported>Jason.nicholls: /* Configuration of Access Control */

imported>Jason.nicholls: 1 revision

imported>Jason.nicholls: moved enportal/5.5/web integrations/access control proxied channels to enportal/5.5/admin/user administration/content creation/generic proxy access control