Question
Cognizant Technology Solutions
CA
Last activity: 10 Oct 2016 10:30 EDT
PEGA API - Authentication - Queries
OOTB Pega API offers various rest services and all of them have the "Requires Authentication" checkbox enabled in their respective service package.PFA the attachment.
Queries
1.But as per Pega help in Service Package(http://www.Pegaserver.com/prhelp/data-/data-admin-/data-admin-servicepackage/context.htm) , Pega does not recommend to use "Requires Authentication" option for high volume production system.Is this satement still holds good for Pega API?.
2.Does using Pega API in production system have any negative impacts since we have the "Requires Authentication" enabled?
3.What are steps to secure the REST Services as per Pega Recommended way
***Updated by Moderator: Vidyaranjan. Removed user added #helpme and Ask the Expert tags. Apologies for confusion, shouldn't have been an end-user option*** included srexists***
Accepted Solution
Pegasystems Inc.
US
Please refer the online help where all your questions are answered, here a quote from 7.2.1 online help - also check this pdn article https://community.pega.com/:
Securing the Pega API
The Pega API requires the use of strong transport layer security, such as TLS 1.2, to help ensure the safety of the Pega API credentials transferred using HTTP basic authentication. The Pega API will function without such basic security measures, however, it us strongly recommended that you use them.
To configure security:
Please refer the online help where all your questions are answered, here a quote from 7.2.1 online help - also check this pdn article https://community.pega.com/:
Securing the Pega API
The Pega API requires the use of strong transport layer security, such as TLS 1.2, to help ensure the safety of the Pega API credentials transferred using HTTP basic authentication. The Pega API will function without such basic security measures, however, it us strongly recommended that you use them.
To configure security:
- Deploy the Pega application using TLS/SSL. You can do this by creating and installing TLS/SSL digital certificates on your web application server for the Pega application. Refer to the documentation for your server for instructions on how to do this.
- Confirm that the Pega API is configured to use TLS/SSL. This is enabled by default. On the Edit Service Package dialog box for the API service package, ensure that Requires authentication, Use TLS/SSL (REST only), and Suppress Show-HTML are selected.
- Test the Pega API in Designer Studio and ensure that:
- the URL starts with "https://"
- the connection is using TLS 1.2
- the user is prompted for their Pega credentials the first time the Pega API is used in a browser session
PegaRULES:PegaAPI role
The role PegaRULES:PegaAPI must explicitly added to a user's access group in order for them to be able to use the Pega API. This is done when creating a new application.