REST API - Anything I have missed? (Securing/pitfalls)

We are currently running CSI 9.01.12 on premise. We are about to launch a REST server to the Internet (with authorized access of course) to have CSI queried by external sources.

First, the REST API I am referring to is not the one that is part of Infor OS. I am referring to the REST API that looks like this: http(s)://UTILITY_SERVER/IDORequestService/MGRestService.svc/BLAH_BLAH_BLAH_BLAH_LBAH

We currently have two Utility Servers: LAN and DMZ. The LAN Utility Server has all features installed. The DMZ server only has the IDO Runtime Service configured to forward requests to the LAN Utility Server. Both servers are configured only to accept HTTPS connections to avoid data leakage during transmission. Testing has gone extremely well and we are getting close to a launch. Before we do launch, I want to be sure I've secured the system as much as humanly possible.

To connect to the REST server, the user needs:

An active CSI Service (my definition) account
An Automation license
Definitions in their Middleware form for permissions used to access the IDOs

Is there a way to block users that do not fit that description from connecting? End-user accounts do not get Middleware permissions, so I am not too concerned about them. I am more concerned about the "sa" account attempting to sign in as that account can do anything regardless of modules.

Are there any other account security options I need to be aware of aside from the Middleware/Automation requirements?

I am trying to stick with this REST service as it requires no Infor DLLs at all to interface with CSI. I will add any additional information as needed.

Thank you in advance!

Find more posts tagged with

Syteline Development

Accepted answers

All comments

Stephen Cena

Has anyone implemented OAuth with their REST server? Infor doesn't seem to have any documentation I can find but any security layer I can put in place I want to.

unknown

That field is for enabling single sign-on while using the ION API in Infor OS.

The main use case is for internal Syteline users to automatically sign in using windows/ad authentication (now called Microsoft Entra) and allow user credentials, groups, and permissions to be singly managed via Active Directory.

As an API provider, I would consider implementing OAuth2 if the administrative load to maintain user accounts warrants it.

Oauth2 supports the idea to centralize all user accounts in one place rather than manage multiple user accounts for a single person in multiple applications (i.e. Syteline, Active Directory, Salesforce, etc.)

A proper OAuth2 implementation solves issues like:

If you're creating Syteline accounts for external users, how do they securely get the credentials?
Credentials should expire to prevent access from stale accounts, who is going to administer new credentials, how do external users securely get the new credentials, and how disruptive will the turnaround time for new credentials be for the external user?

Stephen Cena

Is it possible to use OAuth 2.0 with CSI 9? I haven't seen any ways to do this just yet but if it's possible I'm interested.

unknown

I'm not sure as the company I work for is on CSI 10 (on-prem), but the IIS wizard displays the option, so I can only suspect that it works for CSI 9.

I would definitely contact your Infor/Syteline rep, specifically about setting up SSO on-prem and then working up from there.

Copyright © 2025 Infor. All rights reserved.