Contact Us 1-800-596-4880
  1. Homepage
  2. API Community Manager
  3. Troubleshooting

  4. Avoid a Potential Security Vulnerability

Avoid a Potential Security Vulnerability

The guest and member user profile contains the Exchange Viewer permission that gives access to all assets in Exchange with this visibility. An impersonated user can potentially exploit this visibility and access assets that are not intended for them.

To troubleshoot this issue, ensure that guest and community users can only access intended and required assets.

  1. Create a new team in Access Management called Guest Community Users and create a new mapping for External Idp Groups called Community Guest.

  2. In Salesforce, change the Named Credential authentication information.

  3. In Exchange, share the assets for the Everyone visibility with the Guest Community Users team and share assets for the Members only visibility with the Community Users team.

  4. In Access Management, remove the Exchange Viewer permission and the inherited permissions of the guest user and the Community Users team.

To avoid a potential security vulnerability:

  1. Create a new team in Access Management called Guest Community Users and create a new mapping for External Idp Groups called Community Guest:

    1. Go to Access Management.

    2. In the Access Management navigation menu, click Teams.

    3. Click Create Team and enter Guest Community Users.

    4. Select External Idp Groups and enter the following fields:

      • In Group Name, enter Community Guest.

      • In Provider Name, select a provider.

    5. Click Save Changes.

  2. In Salesforce, change the Named Credential authentication information:

    1. Go to Salesforce > *Setup.

    2. In the Quick Find search box, enter Named Credentials and select it.

    3. Click Anypoint.

    4. In the Authentication section, go to the Per User Subject field.

    5. In the Formula Editor field change & "|[\"Community User\"]" to & "|" & IF($User.Alias = "guest", "[\"Community Guest\"]", "[\"Community User\"]").

    6. Click Save.

  3. In Exchange, share the asset with the Guest Community Users or the Community Users team. Repeat these steps for each asset you want to share with guest community users or the community users:

    1. Go to Exchange and select the asset.

    2. Click Share.

    3. In the Collaborators tab, enter Guest Community Users or Community Users.

    4. Click Save.

  4. In Access Management, remove the ability for users to see the inherited permissions from the Exchange Viewer permission:

    1. Go to Access Management > Users.

    2. Select the guest user.

    3. In Permissions, move the slider to disable showing inherited permissions.

    4. Click Permissions > Remove all permissions.