Can only system administrators setup a webservice connection for ConfiForms?
Asked by Ulrik Schoth:

Hi,

I'm new to getting data with ConfiForms via REST API from a webservice. For testing, I have created a page that uses an IFTTT macro and the action *WebService Request* . I know what to configure for the *Service URL* and *Method* parameters but I stumble at *WebService connection*:

* The only entry I can select from the dropdown list is *JIRA*. I guess that this is a connection to the JIRA server of my company which does not help.
* I tried to click on *Manage connections* because I assumed that this allows to add a new Webservice connection. But instead a new page opens that displays the hint shown in the attached screenshot.

Because of the URL "/admin/vertuna/confiforms/config.action" that is displayed if I move the mouse cursor over the *Manage connections* button, I have the impression that only system administrators can setup a WebService connection.

Is that true?

![message.png](/t5/image/serverpage/image-id/245105iAE5CA1737AA34371/image-dimensions/247x139?v=v2 "message.png")


Answers:
author: Alex Medved _ConfiForms_
body: Hi [@Ulrik Schoth](/t5/user/viewprofilepage/user-id/2108520)

This configuration is accessible for Confluence administrators only

Alex

comments: author: Ulrik Schoth
body: Hi [@Alex Medved _ConfiForms_](/t5/user/viewprofilepage/user-id/781630)

By *system* administrator, I actually meant *Confluence* administrator. Thank you for using the more accurate term.

But why can only a Confluence administrator configure a WS connection? This makes the use of REST APIs inflexible, as I have to ask my admin colleagues for support every time. Also, the list is likely to grow as more ConfiForms developers use different WebServices.

I suspect this is for security reasons, to separate and hide the credentials from the ConfiForms code.

Right?


author: Alex Medved _ConfiForms_
body: Hi

This is by design and allows your responsible personnel to be aware o the connections to external systems the Confluence has and may do.

This can be changed in the ConfiForms settings - either lowering the security and allowing non admin users to configure connections (allowUserConnections) or increasing the follow whitelists and so on (whitelistEnforcement)

Alex


author: Ulrik Schoth
body: Hi [@Alex Medved _ConfiForms_](/t5/user/viewprofilepage/user-id/781630)

this is a great suggestion. Since I don't have access to ConfiForms settings, I didn't know about *allowUserConnections* or *whitelistEnforcement*.

I will discuss this with my colleagues.

Thanks for your support! ?

Best regards  
Ulrik


author: Alex Medved _ConfiForms_
body: When enabled, the UI to configure web-service connections will appear in user profile settings.

Alex


author: Ulrik Schoth
body: Hi [@Alex Medved _ConfiForms_](/t5/user/viewprofilepage/user-id/781630) ,

one last question to *whiteListEnforcement* you have suggested [above](https://community.atlassian.com/t5/Confluence-questions/Re-Re-Can-only-system-administrators-setup-a-webservice/qaq-p/2296871/comment-id/266491#M266491). The meaning of this setting in respect to Web Service connections is not clear to me.

To check the function of the *allowUserConnections* or *whitelistEnforcement* settings, I organized a Confluence DC test instance where I have access to the admin settings

**allowUserConnections**

* In the admin section "ConfiForms general settings", I enabled *allowUserConnections* and was able to configure a web service connection in my user profile settings. Exactly as you have described above. And, by doing this, I was able to access external public REST API servers. ?

**whiteListEnforcement**

* I enabled *whiteListEnforcement* and added one of the public servers to the Allowlist. I thought, this would allow to connect to the server *without* a Web Service connection. But this did not work (error message: *Webservice connection is not selected*).
* I left the *whiteListEnforcement* setting enabled and removed the public server from the Allowlist. Expected behaviour: As none of the used servers is on the list, no data should be read via REST. But in fact, I was still able to read the data.

Could you please explain the meaning of *whiteListEnforcement* in respect to Web Service connections a bit more?

Thanks + best regards  
Ulrik


author: Alex Medved _ConfiForms_
body: Hi

This is what *whiteListEnforcement*is all about

<https://confluence.atlassian.com/conf59/configuring-the-whitelist-792499785.html>

And ConfiForms follows these rules and will allow connections only to these servers (you will still need to define a connection in ConfiForms, but only the ones that match the rules in the whitelisting will be work)

Alex


author: Ulrik Schoth
body: Hi [@Alex Medved _ConfiForms_](/t5/user/viewprofilepage/user-id/781630)

thanks for your explanation. However, as I described above in the second bullet point under **whitelistEnforcement** , *it doesn't work as expected*.

At least not in my test environment. (BTW: The term *whitelist* has been changed to *allowlist* in the Confluence user interface. [Reference](https://developer.atlassian.com/server/confluence/secure-your-macro/#respect-the-outbound-whitelist-when-making-http-queries-from-the-server))

My test environment:

* Confluence DC 7.19.1
* ConfiForms 3.3.9 (Evaluation, Unlimited-user commercial license, Data Center)
* Allowlist is turned on and list is empty (see screenshot).
* Settings *whitelistEnforcement* and *allowUserConnections* are enabled.
* ConfiForms user settings - Web services connections: see screenshot.
* ConfiForms IFTTT macro settings as showed in storage format below.

Expected result:

* As the allowlist is empty, Confluence will display an error and prompt the user to add the URL to the allowlist. \[[Reference](https://confluence.atlassian.com/doc/configuring-the-allowlist-381255821.html)\]

Test result:

* No error message.
* Expected json data is fetched from the rest api server.

Am I doing anything wrong or could it be a bug?

Regards  
Ulrik

![allowlist.png](https://community.atlassian.com/t5/image/serverpage/image-id/249241iE4B1AB858F6F8A54/image-dimensions/262x181?v=v2 "allowlist.png") ![wsc-config.png](https://community.atlassian.com/t5/image/serverpage/image-id/249242iA3FC563BD4BF9DD8/image-dimensions/250x179?v=v2 "wsc-config.png")

```
<ac:structured-macro ac:macro-id="c357d447-51a8-4586-99f6-bc0a0ccd1d65" ac:name="confiform-ifttt" ac:schema-version="1">
<ac:parameter ac:name="action">WebService Request</ac:parameter>
<ac:parameter ac:name="extras">88f09f74e9b21e8f20f7e2efeea29306</ac:parameter>
<ac:parameter ac:name="event">onCreated</ac:parameter>
<ac:parameter ac:name="title">/get?parm1=val1&amp;parm2=val2</ac:parameter>
<ac:parameter ac:name="resultName">restResponse</ac:parameter>
<ac:parameter ac:name="who">GET</ac:parameter>
<ac:rich-text-body>
<p>
<br/>
</p>
</ac:rich-text-body>
</ac:structured-macro>
```


author: Alex Medved _ConfiForms_
body: Hi [@Ulrik Schoth](/t5/user/viewprofilepage/user-id/2108520)

You are right, it seems that the service that allows us to check that was not properly working in the plugin anymore (not being properly looked up - seems that something has silently changed on the Confluence side)

We have fixed that in the upcoming 3.4.0 version of ConfiForms

Alex


author: Ulrik Schoth
body: Hi [@Alex Medved _ConfiForms_](/t5/user/viewprofilepage/user-id/781630)

that's great to hear! I'm looking forward to the new version.

Best regards  
Ulrik


author: Ulrik Schoth
body: Hi [@Alex Medved _ConfiForms_](/t5/user/viewprofilepage/user-id/781630) ,

I have updated ConfiForms to version 3.4.0 in my test environment and can confirm that**the behaviour of the *whitelistEnforcement* setting is now as expected**:

* After the update, I could not retrieve data from any of my configured rest api servers. This made sense as the allowlist (or whitelist) was empty. Instead, an error message was displayed (see screenshot as an example).
* After I added all the rest server domains to the allowlist, the data could be retrieved again.

Thanks for providing a fix so quickly. ?

Best regards  
Ulrik

![error-message-not-whitelisted.png](https://community.atlassian.com/t5/image/serverpage/image-id/250204iBB981DCF0CBFE920/image-size/large?v=v2&px=999 "error-message-not-whitelisted.png")


Tags: confiforms

confluence-server

ifttt

server