ESP Web UI bypassing Top Secret (TSS) security restrictions

Products

• ESP Workload Automation

Issue/Introduction

Logging in with highly restricted user via the ESP Web UI can perform various actions, and fails to enforce Top Secret (TSS) security restrictions for related ESP system.

Environment

Component: ESP Web UI
Release: 12
Security Manager: Top Secret (TSS)

Cause

The Accessor ID (ACID) used for the ESP Web UI STC is not connected to the ESP facility, or the ACID has bypass attributes enabled, such as NORESCHK, NOSUBCHK, or NOLCFCHK.

Resolution

Connect the TSS Facility (FAC) to the ESP user to ensure security controls are enforced.

#1 Identify the ACID associated with the ESP Web UI started task.
#2 Execute the following command to add the facility connection:
TSS ADD(webuser) MASTFAC(ESP)
#3 Verify the ACID attributes to ensure no unintended bypass attributes are set: TSS LIST(webuser) DATA(ALL)

For further configuration details, refer to the documentation: 
Configure ESP Workload Automation Web UI Security.

Additional Information

ESP Web UI user can perform local actions in Workspace even it doesn't have access to related ESP system.