security | Community Creatio

Question

10:10 May 12, 2022

Hi All,

How can malicious code be detected in Creatio On Cloud Instance? Is there any plugin in marketplace in support of this feature.

File system development mode is not enabled so what everchanges are done are directly contributed by multiple developers to the instance.

1 comments

Mira Dmitruk

16:23 May 13, 2022

Hello,

Could you please elaborate on your question and give us more details on what functionality you need and what business logic exactly you want to implement?

Kind regards,

Mira

Show all comments

Question

custom web service security

Eran Malik

17:50 Mar 15, 2022

Hi,

Q: IS Creatio custom web service DDOS safe ?

In other words: If I create a custom web service (Anonymous) for integration with external systems (of course with basic security logic to identify the source which is accessing my endpoint), Is creatio DDoS Safe? Or in this case i should use application firewall (like cloudflare) infront of creatio ?

0 comments

Show all comments

Question

IP & user filtering for custom configuration service

M Shrikanth

09:38 Feb 03, 2021

Hello community,

We have a Creatio installation on Creatio SaaS cloud with a few custom configuration services we have built. The security requirements are very stringent and we need to be able to permit access to these custom configuration services only to a few users & only to a few IPs. Pls find below questions in this regard -

From what we understand, access to the GUI application and to the back end services are shared across the same Creatio credentials (via user setup). Can we disable GUI access to a few users and only enable access to these specific custom configuration services? Also, can we disable access to these configuration services for all other GUI users? In short - A few users only for these configuration services. A few users only for the GUI.
We would like to permit only certain IPs access these configuration services. This can be handled in 4 layers - Network infrastructure layer (Load balancer etc), IIS Configuration on the WebServer, Explicitly verify and restrict access to certain IPs inside the configuration service logic. Which of these 3 is recommended from a feasibility & security perspective on Creatio SaaS cloud?

Thanks in advance

1 comments

Best reply

Oleg Drobina

20:02 Feb 03, 2021

Hello,

Here are the answers to your questions:

1) You can restrict login to the application UI in the root Web.config file. You need to find this location in the file:

&lt;location path="0/Nui"&gt;
    &lt;system.web&gt;
      &lt;authorization&gt;
        &lt;deny users="SysPortalConnection" /&gt;
      &lt;/authorization&gt;
    &lt;/system.web&gt;
  &lt;/location&gt;

and add your system user to this list after the comma seprator:

&lt;location path="0/Nui"&gt;
    &lt;system.web&gt;
      &lt;authorization&gt;
        &lt;deny users="SysPortalConnection,1" /&gt;
      &lt;/authorization&gt;
    &lt;/system.web&gt;
  &lt;/location&gt;

In the example above the system user with "1" login won't be able to login to the application.

As for disabling access to custom configuration service you need to find a location record for this service in the /Terrasoft.WebApp/Web.config file (just an example below):

&lt;location path="ServiceModel/GeneratedWebFormService.svc"&gt;
    &lt;system.web&gt;
      &lt;authorization&gt;
        &lt;allow users="*" /&gt;
      &lt;/authorization&gt;
    &lt;/system.web&gt;
  &lt;/location&gt;

And add this denying rule to the location (it's important to add it above permitting rules):

&lt;location path="ServiceModel/GeneratedWebFormService.svc"&gt;
    &lt;system.web&gt;
      &lt;authorization&gt;
		&lt;deny users="Supervisor" /&gt;
        &lt;allow users="*" /&gt;
      &lt;/authorization&gt;
    &lt;/system.web&gt;
  &lt;/location&gt;

As a result the Supervisor won't be able to get access to the GeneratedWebFormService service.

2) As for restricting access from IP-addresses - such a possibility is present to restrict login to the UI, but there is no in-built possibility to restrict access to the endpoint via IP. We don't have any recommendations on this matter and you can test all the possible approaches and choose the most suitable one.

Best regards,

Oscar

Oleg Drobina

20:02 Feb 03, 2021

Hello,

Here are the answers to your questions:

1) You can restrict login to the application UI in the root Web.config file. You need to find this location in the file:

&lt;location path="0/Nui"&gt;
    &lt;system.web&gt;
      &lt;authorization&gt;
        &lt;deny users="SysPortalConnection" /&gt;
      &lt;/authorization&gt;
    &lt;/system.web&gt;
  &lt;/location&gt;

and add your system user to this list after the comma seprator:

&lt;location path="0/Nui"&gt;
    &lt;system.web&gt;
      &lt;authorization&gt;
        &lt;deny users="SysPortalConnection,1" /&gt;
      &lt;/authorization&gt;
    &lt;/system.web&gt;
  &lt;/location&gt;

In the example above the system user with "1" login won't be able to login to the application.

As for disabling access to custom configuration service you need to find a location record for this service in the /Terrasoft.WebApp/Web.config file (just an example below):

&lt;location path="ServiceModel/GeneratedWebFormService.svc"&gt;
    &lt;system.web&gt;
      &lt;authorization&gt;
        &lt;allow users="*" /&gt;
      &lt;/authorization&gt;
    &lt;/system.web&gt;
  &lt;/location&gt;

And add this denying rule to the location (it's important to add it above permitting rules):

&lt;location path="ServiceModel/GeneratedWebFormService.svc"&gt;
    &lt;system.web&gt;
      &lt;authorization&gt;
		&lt;deny users="Supervisor" /&gt;
        &lt;allow users="*" /&gt;
      &lt;/authorization&gt;
    &lt;/system.web&gt;
  &lt;/location&gt;

As a result the Supervisor won't be able to get access to the GeneratedWebFormService service.

Best regards,

Oscar

Show all comments

Question

security

7.12_()

Dynamic Security

mortada

17:04 May 28, 2019

In the out of the box functionality i can prevent the user from deleting contacts by configuring the object permissions.

Can we prevent deleting a specific type of contacts? Let us say those who are males?

1 comments

Anastasia Botezat

12:05 May 30, 2019

Dear Mortada,

You can add such logic on the client side of your application or add a trigger to the database.

In case you decide to choose client side realization, than you need to create a replacing client module for ContactSectionV2 and override basic deleteRecords method. Add an if clause to check whether record meets requirements to be deleted.

In case you want to choose database trigger, than draw your attention to the before delete triggers.

Regards,

Anastasia

Show all comments

Question

security

7.12_()

UI Trimming when Using Object Permissions

mortada

16:42 May 28, 2019

When I prevent a specific user from deleting records of a specific section. Let us say, User A cannot delete contacts. After configuring this in object permission:

Login using User A, go to contact page, select a record, you will still be able to see the Delete button but you will not be able to delete.

Is there any settings to let the delete button be automatically hidden when there is insufficient permissions?

1 comments

Oleg Drobina

12:57 May 29, 2019

Hello,

After denying access to delete records from a section - delete button won't disappear and user will be able to click it, but there will be a popup stating that this user has no rights to perform this action.

Unfortunately there is no system setting that declares button disappearing when denying access rights are configured for a record to be deleted and this logic can be achieved only via additional development. Here are community articles that describe how to hide a button on a page here, here, here, here and here. I will also create a suggestion to our R&D team so they could implement this login in out-of-the-box version in future.

Thank you for helping us to make our application better!

Best regards,

Oscar

Show all comments

Question

Security Configuration

Uriel Nusenbaum

19:47 Sep 18, 2018

Hi there, how are you? Hope you are doing well.

I need some help with this scenario:

Org Roles (City roles):

•   Boston

•   San Diego

•   Miami

Each user in Boston role can Access to the Boston accounts with columns limitations : no view Web, Phone and Numbers of employee [this configuration by columns permissions]

Each account can have multiple owners that manages the account and should be able to view all the information of the account including web, phone and number of employee.

how can permits be combined?

Example:

•   Account 1

o   City: Boston

o   Owner: user 1 and user 2

•   Account 2

o   City: Boston

o   Owner: user 3

user 1, user 2 and user 3 has the role Boston , because they need to access all the account for Boston (Account 1 and Account 2) excepts the columns Web, Phone and Numbers of employee.

How can I make user 1 and user 2, in the case of account 1, see it completely as the owners? I tried to assign explicit permission to Account 1 for user 1 and user 2, but same results the user can access the account but the columns web, phone and numbers of employee not appear.

We cannot do by code because this is an example but in a real scenario we need to apply this to multiple entitys with a lot of columns configuration.

We need to resolve this permission settings by security configuration.

Thank you

Kind regards

2 comments

Dennis Hudson

23:00 Sep 19, 2018

Dear Uriel,

You would need to create separate Business rules that would make field visible if the user that want's to see it is the owner of the record. Here is the example of such rule: https://prnt.sc/kwdeex. Access rights would not be applicable in this case.

Best regards,

Dennis