M312: Filtering on Source IP Address

 

In the initial settings the Workflow platform (Server) does not restrict the connection source (Client). "User login" and "API Request" are possible from anywhere in the world. If you wish to restrict access other than from the business office, etc. register a whitelist of source IPs.

1. Overview of Source IP Filtering on the Workflow Platform

a. IP Filtering

Restrict the source IP for all access

b. API IP Filtering

Restrict the source IP accessing Message Catch Event API

• You can not set IP Filtering by Client devices or users
• Message Catch Event API is used for automatically starting Issues, etc. (M221, M220, M226)
• It can be set for each Request Path to the Message Catch Event API
• The Request Path to the Message Catch Event API begins with "/System/"
• Access from within the platform to the Message Catch Event API is not subject to IP Filtering
• Requests starting with "/API/" are not subject to IP Filtering at the present time
• Please use it in secure communication with OAuth 2 authorization or Basic authentication

 

2. Setting IP Filter

a. Enumerate static IPs

Specify by dotted decimal notation (e.g. 192.168.0.1)

b. Enumerate IP addresses in a range

Specify in CIDR notation (e.g. 69.208.0.0/24)

System Settings – IP Address Filtering

• When you allow more than one separate them with line breaks
• Static IP and range IP can coexist

---

Z. More Info: Restrict access destination hosts (version 14.1 nad later)

a. Filtering connection destinations of HTTP communication

Enable [HTTP Destination Filtering] and register hosts to permit

HTTP communication from workflow apps is restricted to the allowed hosts only

System Settings – HTTP Destination Filtering

X. Tutorial

• Starting a Process from Outside of Questetra BPM Suite

X. Workflow-Sample

• 2017-09-11 (Business Improvement Idea Reception Process): Episode 552: "Idea Soliciting" is Important for Work Style Reformation