{"id":380,"date":"2016-05-14T13:01:53","date_gmt":"2016-05-14T11:01:53","guid":{"rendered":"http:\/\/h2916922.stratoserver.net:8084\/?p=380"},"modified":"2016-09-30T11:32:42","modified_gmt":"2016-09-30T09:32:42","slug":"caution-advised-storing-passwordstokens-in-icn-plugin-configuration","status":"publish","type":"post","link":"https:\/\/www.ivojonker.nl\/?p=380","title":{"rendered":"Caution advised storing passwords &#038; tokens in ICN plugin configuration"},"content":{"rendered":"<hr \/>\n<p>For those creating IBM Content Navigator plugins, please be advised not to store any tokens, passwords or API keys in the plugin configuration, as it will be\u00a0accessible to all authenticated users.<\/p>\n<p>Although you would expect the ICN admin-api to be limited to admin-users, the following snippet works for everyone \ud83d\ude42<\/p>\n<pre class=\"lang:js decode:true\">require ([\"ecm\/model\/admin\/ApplicationConfig\"],function(ApplicationConfig){ \r\n    ApplicationConfig.getPluginObjects(function (plugins){\r\n        console.log(plugins)\r\n    })\r\n})<\/pre>\n<p>A suggestion would be to create a &#8216;central configuration&#8217; plugin, that stores its configuration (though the configurationpane) in a different location\/datasource &#8211; only accesible for admin users. A nice addition would be to create a java class that performs a server-side lookup of the datasource allowing access to the configuration just anywhere within your server context \ud83d\ude42<\/p>\n<p style=\"text-align: left;\">p.s. Did you know the IBM ICA\/Watson plugin requires configuting an API key?<\/p>\n<p>Update: I translated my own suggestion into a working solution:) See\u00a0<strong><a class=\"row-title\" href=\"http:\/\/h2916922.stratoserver.net:8084\/?p=407\">Central Configuration plugin for multi-server ICN\/ICM environments<\/a><\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>For those creating IBM Content Navigator plugins, please be advised not to store any tokens, passwords or API keys in the plugin configuration, as it will be\u00a0accessible to all authenticated [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-380","post","type-post","status-publish","format-standard","hentry","category-geen-categorie"],"_links":{"self":[{"href":"https:\/\/www.ivojonker.nl\/index.php?rest_route=\/wp\/v2\/posts\/380","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ivojonker.nl\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ivojonker.nl\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ivojonker.nl\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ivojonker.nl\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=380"}],"version-history":[{"count":8,"href":"https:\/\/www.ivojonker.nl\/index.php?rest_route=\/wp\/v2\/posts\/380\/revisions"}],"predecessor-version":[{"id":467,"href":"https:\/\/www.ivojonker.nl\/index.php?rest_route=\/wp\/v2\/posts\/380\/revisions\/467"}],"wp:attachment":[{"href":"https:\/\/www.ivojonker.nl\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=380"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ivojonker.nl\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=380"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ivojonker.nl\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=380"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}