Following an instance scan unsure how to resolve some of the issues

[marke1]

Following an instance security scan got these two recommendations.

1. Record producers should be assigned appropriate role, record producer script should secure GlideRecord and/or GlideSystem API calls.


2. All inbound actions should have roles mentioned in "Required roles" field to secure actions triggered from inbound actions, only users with the required roles should be allowed to trigger inbound action

Given the record producers and inbound actions are accessing table data, seems like the idea they have a role to grant that access is required also same for calling client callable scripts.

NOTE: the record producers and inbound mail processors are handling inputs from users who do not have roles in the system e.g portal users / customers.

I can see that we have roles for Record producers and inbound actions - however my understanding is these are roles to access the record producers or inbound actions rather than a role assigned to an inbound action or record producer. Given they handle input from non role users - what role should I assign or How do I assign a role to an Inbound action, Record producer or Client script that does not block users without a role?

Many thanks

[Maik Skoddow]

Hi

you can try it with the "public" role. But don't wonder that maybe something does not work anymore, as you have to propagate that role to all functionalities / ACLs handling the inbound emails and requests.

And you should also think about whether you really want to open your instance that way. If all users are able to create records via inbound email or record producers without logging in, there is a high risk of DDOS attacks.

Kind regards
Maik

[marke1]

Thanks Maik, users are all authenticated but will not have any assigned role i.e. they users of catalog services / portal etc.