Restricting access to web services for portal users

Introduction

The portal is a bpm’online platform component whose main purpose is to implement self-service processes for your customers and partners. You can also use the portal to organize the work of internal users if you need to restrict access permissions to functionality of the primary application.

Using portal enables many external users (who are not employees of your organization) to access some of the bpm’online data. For this, you need to manage which users (portal or company employees) have access to the application web services.

Route prefixes for web services configuration

Route prefixes in bpm’online enable managing access to the application web services. You can set the needed route prefix using specific ServiceRoute attributes of the service class (table 1).

Table 1. Route prefixes for configuration web services

[ServiceContract]
[SspServiceRoute]
public class SspOnlyService : BaseService
{
}

[ServiceContract]
public class InternalService : BaseService
{
}

[ServiceContract]
[DefaultServiceRoute]
public class InternalService : BaseService
{
}

[ServiceContract]
[DefaultServiceRoute]
[SspServiceRoute]
public class CommonService : BaseService
{
}

[ServiceContract]
[ServiceRoute("custom")]
public class CustomPrefixService : BaseService
{
}

Restricting access to the internal API for portal users

If a portal user (SspUserConnection) addresses a service with a route that does not contain the “/ssp” prefix, the service will return error 403 (Forbidden).

Restricting access to the portal API for internal users

If an internal user (UserConnection) addresses the service with the route that contains the “/ssp” prefix, the service will return a page with code 403 (Forbidden).

Changing access to the base service

The application has a set of base services and only internal users have access to them.

To change access to the base service:

1. In the custom package, create a service with the access settings for portal users.
2. In the service, add the base service methods that must be available for portal users.
3. Change the custom or extend the base client schemas by changing the call of base service to the call of the created service (see step 1).
4. Compile the configuration.

Example of the service source code that extends access to the ActivityUtilService base service:

namespace Terrasoft.Configuration
{ 
    using System;
    using System.IO;
    using System.Runtime.Serialization;
    using System.ServiceModel;
    using System.ServiceModel.Activation;
    using System.ServiceModel.Web;
    using Terrasoft.Configuration.FileUpload;
    using Terrasoft.Core.Factories;
    using Terrasoft.Web.Common;
    using Terrasoft.Web.Common.ServiceRouting;
    
    [ServiceContract]
    // The service is available for both: the internal and portal users
    [DefaultServiceRoute]
    [SspServiceRoute]
    [AspNetCompatibilityRequirements(RequirementsMode = AspNetCompatibilityRequirementsMode.Required)]
    public class PartnerActivityUtilService: BaseService {
        // Base service, access needs to be extended
        private static readonly ActivityUtilService _baseService = new ActivityUtilService();
        
        [OperationContract]
        [WebInvoke(Method = "POST", BodyStyle = WebMessageBodyStyle.Wrapped, RequestFormat = WebMessageFormat.Json, ResponseFormat = WebMessageFormat.Json)] 
        public Guid CreateActivityFileEntity(JsonActivityFile jsonActivityFile) { 
            return _baseService.CreateActivityFileEntity(jsonActivityFile); 
        } 
        [OperationContract] 
        [WebInvoke(Method = "POST", BodyStyle = WebMessageBodyStyle.Wrapped, RequestFormat = WebMessageFormat.Json, ResponseFormat = WebMessageFormat.Json)]
        public Guid CreateFileEntity(JsonEntityFile jsonEntityFile) {
            return _baseService.CreateFileEntity(jsonEntityFile); 
        } 
    } 
} 

The ServiceStack core services

The ServiceStack core services (DataService, ManagerService, etc.) are available by default to the internal users only.

To make any of these methods available on the portal, tag such method with the SspServiceAccess attribute – in this case, the method will have an additional route with the ~/DataService/ssp/… prefix.

If you need to have a different logic for the portal, create a new service by specifying the SspServiceAccess attribute for it and pass the name of the original method to its constructor. Example:

[SspServiceAccess(nameof(SelectQuery))]
public class SspSelectQuery : SelectQuery
{
}

This service creates a contract whose method will be registered at the following path:

~/DataService/ssp/SelectQuery

Access to the ServiceStack methods with the “ssp” prefix is denied to the internal users. Access to the ServiceStack methods without the “ssp” prefix is denied to the portal users.