Filtering Exposed Operations

Almost all registered operations and automation chains are exposed through a REST interface to be invoked by remote clients. The UI-specific operations are not exposed through REST since they require a web user interface to work.

For security reasons, you may want to prevent some operations from being accessed remotely, or only allow certain users to be able to invoke them.

The REST operation filters provide an extension point where you can register such security rules on what operations are exposed and for which users.

Here is an example of such an extension point:

<extension target="org.nuxeo.ecm.automation.server.AutomationServer" point="bindings">
  <binding name="Document.Delete" disabled="true"/>
  <binding name="audit" chain="true">
    <administrator>true</administrator>
    <secure>true</secure>
    <groups>members</groups>
  </binding>
</extension>

The above code is contributing two REST bindings - one for the atomic operation Document.Delete which is completely disabled (by using the disabled parameter) and the second one is defining a security rule for the automation chain named audit.

The chain attribute must be set to true every time a binding refers to an automation chain and not to an atomic operation.

The second binding installs a guard that allows only requests made by an administrator user or by users from the member group AND the request should be made over a secured channel like HTTPS.

Here is the complete list of attributes and elements you can use in the extension: