Adding a Service Permission Credential to Control the API Access Permission

Why Do I Need to Add a Service Permission Credential?

The service permission credential can control the access permission of Huawei Cloud Astro Zero users on customized public APIs. If a user permission contains a service permission credential, the user can call the customized public API configured with the corresponding service permission credential.

What Is a Service Permission Credential?

Service permission credentials are used to control API access permissions. Huawei Cloud Astro Zero provides two methods to control API access permissions: configuring permission scripts and configuring APIs. Profile scripts should be preferentially used for verification. You can decide on the next operation based on the return value of the script.

• If an API has a service permission credential, a user's profile must be accessible to the service permission credential to call the API.
  • If a user has no service permission credential, the system verifies the data permission in the profile (for example, running flows and scripts, adding, deleting, modifying, and querying objects, and API read and write permissions).
  • If a portal user has no service permission credential, an error is reported when the API is called without verifying the data permissions in the profile.
• If no service permission credential is configured for an API, check the value of the API's built-in parameter bingo.permission.customapi.check. This parameter controls the logic when no service permission credential is bound to a public API.
  • If this parameter is set to true and no service permission credential is bound to a public API, portal users cannot access the API. For users, the system verifies the data permissions in the profile.
  • If this parameter is set to false and no service permission credential is bound to a public API, portal users can access the API without verification. For users, the system verifies the data permissions in the profile.

  For example, if the built-in parameter bingo.permission.customapi.check is set to true, and the service permission credential is not bound to an API, portal users cannot perform operations on object data even if they have API read and write permissions. To allow portal users to perform operations on object data, set this parameter to false.

  To view and configure this parameter, go to the Huawei Cloud Astro Zero environment configuration page, choose Configuration > System Settings > System Parameters. On the System Parameters page, click the Built-in System Parameters tab.

  Figure 1 Built-in system parameters
  

Configuring Service Permissions Credentials

1. Log in to the application designer by referring to Logging In to the Application Designer.
2. In the navigation pane, click Settings.
3. In the Application Settings page, choose Permissions. The Service Permissions Credentials page is displayed.
4. Click Create, complete the configuration, and click Save.
   Figure 2 Creating a service permission credential
   

5. Add a service permission credential to an API
   1. On the Huawei Cloud Astro Zero console, click Access Homepage to go to the application development page.
   2. In the upper left corner of the page, click and choose Environments > Environment Configuration.
   3. Choose Maintenance from the main menu.
   4. In the navigation pane, choose Global Elements > Custom APIs.
   5. In the custom API list, click the operation name of the target API. The API details page is displayed.
   6. Click Edit in the Service Permissions Credentials area, add the permission credential to the selection box on the right, and click Save.
      Figure 3 Adding a service permission credential
      

6. Choose Configuration from the main menu. In the navigation pane, choose User Security > Profiles.
7. In the profile list, click the name of the profile for which you want to configure a service permission credential. The profile details page is displayed.
8. On the Service Permissions Credentials tab page, click , select Accessible next to the corresponding service permission credential, and click .
   Figure 4 Binding a service permissions credential to a profile
   

9. In the navigation pane, choose User Security > Users.

   Alternatively, choose Maintenance from the main menu and choose Global Elements > Portal Users.

10. After permissions are configured for a user/portal user, the user/portal user can obtain the permission to call the corresponding API. Otherwise, the user/portal user cannot pass the service permission credential verification of the API.
    Figure 5 Granting the profile to a user/portal user
    

    Huawei Cloud Astro Zero verifies service permission credentials differently for users and portal users. For users, if the service permission credential fails to be verified, the user need to perform another verification. If successful, the API can still be called. For portal users, if the service permission credential fails to be verified, an error is reported and the operation is terminated.