Security Considerations

You can set global, default web services credentials at build time via the following properties set in your Bootstrap.properties file:

• curam.security.credentials.ws.username - the username used when executing inbound web service calls;
• curam.security.credentials.ws.password - the password used when executing inbound Web Service calls. This password must be encrypted.

  The above credentials must exist on the Curam 'Users' table, must be enabled, and should be assigned the appropriate security role.

  Default credentials can streamline your development and testing processes, but should not be used in a production environment when working with sensitive data and/or processes.

Once a BPO has been assigned to a webservice server it is callable by anybody as a web service without any authentication. All web service calls are automatically logged in and invoked using default credentials. The default user, WEBSVCS, automatically gets permission to invoke all methods of a class which is assigned to a webservice server.

Therefore caution is advised when making a class visible as a web service.