WebDev - Security Zones

Ignition
,
1

I'm on 8.1.41

Is there a way to use Security Zones in WebDev module ?

I want to secured some WebDev scripts to give access to specific IP addresses without authentification required.

I don't want to hardcode allowed ip addresses in my scripts, I want to be able to configure it in the gateway...

2

Not in convenient built in way, but if you have a GatewayContext there's nothing stopping you from grabbing the SecurityZoneManager and doing something with it, like call getZonesFor() with some IdentityTraits you built using the IP address from the request header.

3

Something like this?

gateway = request["context"]
listOfZones = gateway.SecurityZoneManager.getZonesFor(request["remoteAddr"])

4

Almost, but getZonesFor requires you build an IdentityTraits object.

5

Not familiar with that, have you some examples for me ?

6

You should be able to figure this out from looking at the Javadoc, it's a necessary skill if you will be using classes from the SDK.

It would look something like this:

from com.inductiveautomation.ignition.gateway.authentication.securityzones import IdentityTraits

id = IdentityTraits.newBuilder.ipAddress(request["remoteAddr"]).build()
7

Another thing to keep in mind here is that the usefulness/accuracy of the remote address as seen by the WebDev module will depend entirely on your network architecture.

8

Seems that something going wrong with the IdentityTraits

The first part of my code working well and retun list of securityzones

gateway = request["context"]
szm = gateway.getSecurityZoneManager() 
listOfZones = szm.getZones()
return {'json': {"Zones for {}:".format(request["remoteAddr"]): listOfZones}}

But when I try to build the IdentityTraits I got server error
com.inductiveautomation.ignition.common.script.JythonExecException: Traceback (most recent call last): File "", line 8, in doGet AttributeError: 'reflectedfunction' object has no attribute 'ipAddress'

from com.inductiveautomation.ignition.gateway.authentication.securityzones import IdentityTraits 
identity = IdentityTraits.newBuilder.ipAddress(request["remoteAddr"]).build()
return {'html': "Here !!!"}
9

Was missing () for newBuilder

identity = IdentityTraits.newBuilder().ipAddress(request["remoteAddr"]).build()
2 Likes
10

szm.getZonesFor(identity) always return empty list

	gateway = request["context"]
	szm = gateway.getSecurityZoneManager() 
	listOfZones = szm.getZones()

	from com.inductiveautomation.ignition.gateway.authentication.securityzones import IdentityTraits 
	identity = IdentityTraits.newBuilder().ipAddress(request["remoteAddr"]).build()
	identityZones = szm.getZonesFor(identity)
	return {'json': 
				{
					"Zones for {}: ".format(identity.getIpAddress()): identityZones,
					"Zones for context: " : listOfZones
				}
			}

image

image

11

In the Gateway, set the logger for "Security.SecurityZones.Zone" to DEBUG level and then send the request again and see what gets logged.

12

Zone 'WebDev_API' does not match due to incorrect value for qualifier 'direct-connection'. Remote machine sent: '{ip-address=10.7.15.64}'

13

Ok, I think you need to set some additional attributes on the IdentityTraits you build.

Probably call isDirect(true) and gatewayScope(): IdentityTraits.Builder

14

missing isDirect, isSecure and gatewayScopre()

identity = IdentityTraits.newBuilder().ipAddress(request["remoteAddr"]).isDirect(True).isSecure(False).gatewayScope().build()