CURRENT BEHAVIOR
In IBM App Connect Enterprise (ACE) 13.0.x, the administration security model assigns permissions at the integration-node, integration-server, and data-resource levels. When a role is granted read+ access to an integration server, that role can view all readable server resources through both the ACE Web UI and the administration REST API. This includes the Credentials tab and the /credentials API subtree, which expose:
- Credential identity names (e.g. adminAuthentication, BTU_MAIL)
- Credential types and providers (e.g. setdbparms)
- Configured service-account identities (e.g. LDAP bind DNs)
- Authentication types and read-only flags
Password values are masked with asterisks, and credentials stored in the vault are encrypted using AES-256 encryption. The masking and encryption controls work as designed. However, the credential metadata itself (names, types, providers, and service-account identities) is visible to any role with read+ access to the integration server.
PROBLEM STATEMENT
There is no documented configuration option that hides only the Credentials tab in the Web UI, or denies only the /credentials API subtree, while preserving general integration-server read+ access for operational users.The only available workaround is to remove read+ from the role entirely, which is broader than the required control and removes other server-level visibility that read-only operational users legitimately need. This makes the workaround unsuitable for roles which require general server visibility for day-to-day operations.
REQUESTED ENHANCEMENT
Provide a granular permission control that allows administrators to:
1. Hide the Credentials tab in the ACE Web UI from non-administrative roles, independently of other integration-server read permissions.
2. Deny access to the /credentials API subtree (e.g. GET /apiv2/servers/{name}/credentials/...) for specified roles, while preserving read+ access to all other integration-server resources.
3. Optionally, introduce a dedicated credentials permission token (e.g. read+:credentials) that can be granted or denied independently at the
role level, separate from the general integration-server read+ permission.
BUSINESS JUSTIFICATION
Credential identity names and service-account identities are useful targeting data for attackers conducting password-spraying or credential-guessing attacks. Although passwords are masked, exposing credential names, providers, and service-account identities (such as LDAP bind DNs) to low-privilege operational roles increases the attack surface unnecessarily. A security audit of our ACE QA environment identified this as a finding, and the recommended remediation is to restrict the credentials subtree to administrative roles only. The current permission model does not support this without removing legitimate operational visibility.
The principle of least privilege requires that roles see only the resources they need to perform their function. Operational users need integration-server read access for flow and application monitoring but have no operational need to view credential identities or service-account information.
REFERENCES
- IBM Docs: Managing web user accounts (ACE 13.0.x)
https://www.ibm.com/docs/en/app-connect/13.0.x?topic=administration-managing-web-user-accounts
- IBM Docs: Configuring encrypted security credentials in the vault (ACE 13.0.x)
https://www.ibm.com/docs/en/app-connect/13.0.x?topic=vault-configuring-encrypted-security-credentials
ENVIRONMENT
Product: IBM App Connect Enterprise
Version: 13.0.x (also applicable to 12.0.x and 11.0.x)
Component: Administration Security / Web UI / REST Admin API
Platform: Linux (unixODBC), Windows
IBM CASE Raised # TS023281703
