Exchange Web Service Connector 24.1

# Configure Client Authorization

You can configure Exchange Web Service Connector to authorize different operations for different connections.

Authorization roles define a set of operations for a set of users. You define the operations by using the `StandardRoles` configuration parameter, or by explicitly defining a list of allowed actions in the `Actions` and `ServiceActions` parameters. You define the authorized users by using a client IP address, SSL identities, and GSS principals, depending on your security and system configuration.

For more information about the available parameters, see the Exchange Web Service Connector Reference.

IMPORTANT: To ensure that Exchange Web Service Connector allows only the options that you configure in `[AuthorizationRoles]`, make sure that you delete any deprecated `RoleClients` parameters from your configuration (where `Role` corresponds to a standard role name, for example `AdminClients`).

To configure authorization roles

1. Open your configuration file in a text editor.

2. Find the `[AuthorizationRoles]` section, or create one if it does not exist.

3. In the `[AuthorizationRoles]` section, list the user authorization roles that you want to create. For example:

       [AuthorizationRoles]
       0=AdminRole
       1=UserRole

4. Create a section for each authorization role that you listed. The section name must match the name that you set in the `[AuthorizationRoles]` list. For example:

       [AdminRole]

5. In the section for each role, define the operations that you want the role to be able to perform. You can set `StandardRoles` to a list of appropriate values, or specify an explicit list of allowed actions by using `Actions`, and `ServiceActions`. For example:

       [AdminRole]
       StandardRoles=Admin,ServiceControl,ServiceStatus

       [UserRole]
       Actions=GetVersion
       ServiceActions=GetStatus

   NOTE: The standard roles do not overlap. If you want a particular role to be able to perform all actions, you must include all the standard roles, or ensure that the clients, SSL identities, and so on, are assigned to all relevant roles.

6. In the section for each role, define the access permissions for the role, by setting `Clients`, `SSLIdentities`, and `GSSPrincipals`, as appropriate. If an incoming connection matches one of the allowed clients, principals, or SSL identities, the user has permission to perform the operations allowed by the role. For example:

       [AdminRole]
       StandardRoles=Admin,ServiceControl,ServiceStatus
       Clients=localhost
       SSLIdentities=admin.example.com

7. Save and close the configuration file.

8. Restart Exchange Web Service Connector for your changes to take effect.

IMPORTANT: If you do not provide any authorization roles for a standard role, Exchange Web Service Connector uses the default client authorization for the role (localhost for `Admin` and `ServiceControl`, all clients for `Query` and `ServiceStatus`). If you define authorization only by actions, OpenText recommends that you configure an authorization role that disallows all users for all roles by default. For example:

    [ForbidAllRoles]
    StandardRoles=*
    Clients=""

This configuration ensures that Exchange Web Service Connector uses only your action-based authorizations.

Copyright 2023 Open Text
Version 24.1 | Last updated December 2023

Send documentation feedback

Close

Send documentation feedback

To send feedback using your default email client, open an email window.

Otherwise, send your feedback and the information below to MFI-swpdl.idoldocsfeedback@opentext.com.

We appreciate your feedback!

Product: IDOL Exchange Web Service Connector 24.1

Topic Title: Configure Client Authorization