diff --git a/modules/ROOT/assets/graffle files/ip-allowlist-confirm-dialog.graffle b/modules/ROOT/assets/graffle files/ip-allowlist-confirm-dialog.graffle new file mode 100644 index 00000000..7059a620 Binary files /dev/null and b/modules/ROOT/assets/graffle files/ip-allowlist-confirm-dialog.graffle differ diff --git a/modules/ROOT/assets/graffle files/ip-allowlist-connected-apps.graffle b/modules/ROOT/assets/graffle files/ip-allowlist-connected-apps.graffle new file mode 100644 index 00000000..f1832942 Binary files /dev/null and b/modules/ROOT/assets/graffle files/ip-allowlist-connected-apps.graffle differ diff --git a/modules/ROOT/assets/graffle files/ip-allowlist-enabled.graffle b/modules/ROOT/assets/graffle files/ip-allowlist-enabled.graffle new file mode 100644 index 00000000..31b5f922 Binary files /dev/null and b/modules/ROOT/assets/graffle files/ip-allowlist-enabled.graffle differ diff --git a/modules/ROOT/assets/graffle files/ip-allowlist-update-app-exempt.graffle b/modules/ROOT/assets/graffle files/ip-allowlist-update-app-exempt.graffle new file mode 100644 index 00000000..69525716 Binary files /dev/null and b/modules/ROOT/assets/graffle files/ip-allowlist-update-app-exempt.graffle differ diff --git a/modules/ROOT/assets/graffle files/ip-allowlist-update-app.graffle b/modules/ROOT/assets/graffle files/ip-allowlist-update-app.graffle new file mode 100644 index 00000000..e56b0722 Binary files /dev/null and b/modules/ROOT/assets/graffle files/ip-allowlist-update-app.graffle differ diff --git a/modules/ROOT/assets/images/ip-allowlist-confirm-dialog.png b/modules/ROOT/assets/images/ip-allowlist-confirm-dialog.png new file mode 100644 index 00000000..bc5900a6 Binary files /dev/null and b/modules/ROOT/assets/images/ip-allowlist-confirm-dialog.png differ diff --git a/modules/ROOT/assets/images/ip-allowlist-connected-apps.png b/modules/ROOT/assets/images/ip-allowlist-connected-apps.png new file mode 100644 index 00000000..a6e4da23 Binary files /dev/null and b/modules/ROOT/assets/images/ip-allowlist-connected-apps.png differ diff --git a/modules/ROOT/assets/images/ip-allowlist-enabled.png b/modules/ROOT/assets/images/ip-allowlist-enabled.png new file mode 100644 index 00000000..61a81363 Binary files /dev/null and b/modules/ROOT/assets/images/ip-allowlist-enabled.png differ diff --git a/modules/ROOT/assets/images/ip-allowlist-update-app-exempt.png b/modules/ROOT/assets/images/ip-allowlist-update-app-exempt.png new file mode 100644 index 00000000..06c73064 Binary files /dev/null and b/modules/ROOT/assets/images/ip-allowlist-update-app-exempt.png differ diff --git a/modules/ROOT/assets/images/ip-allowlist-update-app.png b/modules/ROOT/assets/images/ip-allowlist-update-app.png new file mode 100644 index 00000000..7b714ee9 Binary files /dev/null and b/modules/ROOT/assets/images/ip-allowlist-update-app.png differ diff --git a/modules/ROOT/pages/connected-apps-org-admin.adoc b/modules/ROOT/pages/connected-apps-org-admin.adoc index d9013e42..783a9378 100644 --- a/modules/ROOT/pages/connected-apps-org-admin.adoc +++ b/modules/ROOT/pages/connected-apps-org-admin.adoc @@ -15,6 +15,7 @@ To maintain security, manually rotate the client secrets of all connected apps i You can also reset client secrets programmatically using the https://anypoint.mulesoft.com/exchange/portals/anypoint-platform/f1e97bc6-315a-4490-82a7-23abe036327a.anypoint-platform/access-management-api/minor/1.0/console/method/%236918/[Access Management API]. +[[manage-owned-apps]] == Manage Owned Apps To maintain security, you can view and manage connected apps only if you have the Organization Administrator permission in the root organization or in the business group where the connected app resides. @@ -62,6 +63,7 @@ When you revoke an app’s access, the app’s OAuth 2.0 access tokens and refre . Click the more actions menu (*...*) for the selected application and select *Remove*. . Click *Remove*. +[[configure-authorization-policies]] == Configure Authorization Policies You can configure one of these types of authorization policies for your users: @@ -71,39 +73,63 @@ You can configure one of these types of authorization policies for your users: Organization members can authorize any connected app to act on their behalf. * Restricted + -Only connected apps that are added to an allowlist by an administrator are authorized by organization members to act on their behalf. +Organization members can authorize only connected apps that an administrator has added to the allowlist to act on their behalf. -By default, the *Unrestricted* policy is enabled. If you change the policy to *Restricted*, the application allowlist is enabled, and all existing application authorizations are added automatically. +By default, the *Unrestricted* policy is enabled. If you change the policy to *Restricted*, the application allowlist is enabled, and Anypoint Platform automatically adds all existing application authorizations. When using the *Restricted* policy, you can disable auto-approval of all internal apps, in which case you must add each internal app to the <> like any other connected app. [[application-allowlist-admin]] === Application Allowlist -When the allowlist is enabled, organization users can use only applications that are on the allowlist. If a user attempts to authorize an app that's not on the allowlist, they are prompted to contact their organization administrator. +When the allowlist is enabled, organization users can use only applications that are on the allowlist. If a user attempts to authorize an app that's not on the allowlist, Anypoint Platform prompts them to contact their organization administrator. image::connected-apps-allowlist-blocked.png["The interface the user sees when an app is not on the allowlist", 50%,50%] -Organization administrators can add the app to the allowlist by following the link given to them by the end user. +Organization administrators can add the app to the allowlist by following the link from the end user. image::connected-apps-add-to-allowlist.png["The interface the administrator sees when they add an app to the allowlist", 40%,40%] -Apps may request additional scopes when developers add new features that require access to more data in your organization. -Previously allowed apps _must_ be added to the allowlist again with the new set of scopes before your users can grant those additional scopes to the app. +When developers add features that require access to more of your organization's data, apps request additional scopes. +Add previously allowed apps to the allowlist again with the new set of scopes so your users can grant them. image::connected-apps-add-to-allowlist-again.png["The interface the administrator sees when they re-add an app to the allowlist", 40%,40%] -Existing authorizations continue to work if the app is not added to the allowlist again. New authorizations using the already-allowlisted set of scopes are also allowed. -Apps that remove scopes do not need to be added to an allowlist again. +Existing authorizations continue to work even if you don't add the app to the allowlist again. New authorizations using the already-allowlisted set of scopes are also allowed. +You don't need to add apps that remove scopes to the allowlist again. [NOTE] -- Applications created by users in the same organization are marked as *internal apps* and don't need to be allowlisted manually. -- +[[ip-allowlisting-connected-apps]] +== IP Allowlisting for Connected Apps + +As a root organization administrator, you can restrict which IP addresses are allowed to request OAuth 2.0 tokens for connected apps in your organization. This control shares the same CIDR blocks as the user sign-in IP allowlist but is configured separately. + +When IP allowlisting for connected apps is enabled, Anypoint Platform blocks token requests from IP addresses outside the allowlist and logs them in the audit log. You can also exempt individual connected apps from enforcement. + +[IMPORTANT] +==== +Before enabling this feature, identify the outbound IP address behavior for every connected app in your organization. Connected apps running on CloudHub without static IPs or on CloudHub 2.0 Shared Space use dynamic or shared IPs and must be exempted. Enabling enforcement without exempting these apps blocks token requests for those integrations. +==== + +To enable IP allowlisting for connected apps or to understand which deployment models require exemption, see xref:managing-ip-allowlists.adoc#configure-ip-allowlisting-connected-apps[Configure IP Allowlisting for Connected Apps]. + +=== Exempt a Connected App from IP Enforcement + +Exempt a connected app when it runs on infrastructure where the outbound IP is dynamic, unknown, or shared with other tenants. You must exempt connected apps running on CloudHub without static IPs or CloudHub 2.0 Shared Space from IP enforcement. + +. Sign in to Anypoint Platform using an account that has the root Organization Administrator permission. +. Select *Access Management* from the image:gear.svg["gear icon",20] menu. +. In the Access Management navigation menu, select *Connected Apps*. +. In the *Owned Apps* section, click the connected app to exempt. +. Select *Exempt from IP restrictions*, and then click *Save*. + == Root Organization and Business Groups -By default, connected apps are configured at the root organization level, not at the business group (sub-organization) levels. +By default, Anypoint Platform configures connected apps at the root organization level, not at the business group (sub-organization) levels. When you create a connected app to act on its own behalf using client credentials, you can choose which root organization or business groups to enable it in after you choose scopes. @@ -113,3 +139,4 @@ A connected app that acts on behalf of a user receives its own access and permis * xref:connected-apps-developers.adoc[] * xref:creating-connected-apps-dev.adoc[] +* xref:managing-ip-allowlists.adoc[] diff --git a/modules/ROOT/pages/connected-apps-overview.adoc b/modules/ROOT/pages/connected-apps-overview.adoc index 22a66c77..942a7f8c 100644 --- a/modules/ROOT/pages/connected-apps-overview.adoc +++ b/modules/ROOT/pages/connected-apps-overview.adoc @@ -52,8 +52,13 @@ a| When you register an external application with Anypoint Platform, it receives a unique client identity. You then specify exactly which APIs and data the app has permission to access. When the external app requests access, Anypoint Platform verifies its identity and issues a temporary OAuth 2.0 token. This token grants access only to the permitted resources for a limited time, without exposing user credentials. +== IP Allowlisting for Connected Apps + +Organization administrators can restrict which IP addresses are allowed to request OAuth 2.0 tokens for connected apps. For configuration steps, deployment model guidance, and per-app exemption instructions, see xref:managing-ip-allowlists.adoc#configure-ip-allowlisting-connected-apps[Configure IP Allowlisting for Connected Apps]. + == See Also * xref:connected-apps-org-admin.adoc[] * xref:connected-apps-developers.adoc[] * xref:connected-apps-end-users.adoc[] +* xref:managing-ip-allowlists.adoc[] diff --git a/modules/ROOT/pages/managing-ip-allowlists.adoc b/modules/ROOT/pages/managing-ip-allowlists.adoc index e414377b..18e26c5b 100644 --- a/modules/ROOT/pages/managing-ip-allowlists.adoc +++ b/modules/ROOT/pages/managing-ip-allowlists.adoc @@ -1,59 +1,154 @@ = Managing IP Allowlists in Access Management -Create IP allowlists in Access Management to restrict access to your Anypoint Platform organization to trusted networks. Enforce IP restrictions for Anypoint Platform logins by adding CIDR blocks to reduce credential abuse and meet compliance needs. +Restrict access to your Anypoint Platform organization to trusted networks by configuring IP allowlists in Access Management. You can enforce IP restrictions for both user sign-ins and connected app token minting to reduce credential abuse, prevent unauthorized automation, and meet compliance requirements. [NOTE] -- -* This feature is available only for US and EU commercial clouds. -* IP allowlisting applies only to users who sign in with Anypoint Platform credentials. It doesn't apply to users who authenticate through an external identity provider (IdP) using SSO. +* IP allowlisting for user sign-ins applies only to users who sign in with Anypoint Platform credentials. It doesn't apply to users who authenticate through an external identity provider (IdP) using SSO. +* IP allowlisting is configured at the root organization level and applies to all connected apps created under the root organization and its business groups. +* Only IPv4 addresses are supported. +* Your root organization can define up to 25 CIDR blocks total, shared across both the user sign-in and connected app token minting policies. -- == Before You Begin -* Have the root Organization Administrator permission for your organization. +* Make sure you have the root Organization Administrator permission for your organization. -[enable-disable-ip-allowlisting] -== Enable or Disable IP Allowlisting +[configure-cidr-blocks] +== Add CIDR Blocks to the IP Allowlist -Enable or disable IP allowlisting for your organization’s logins in Access Management. When this feature is enabled, only logins from IP addresses in allowed CIDR blocks succeed. Login attempts outside the IP allowlist are blocked and logged. +Add the IP address CIDR blocks that your organization trusts, and assign each block to one or both restriction policies: *User Login*, *Connected Apps*, or both. A CIDR block restricts only the workflows it is assigned to. If no CIDR blocks are assigned to a policy, enabling IP restrictions has no effect on that workflow. -. Log in to Anypoint Platform using an account that has the root Organization Administrator permission. +. Sign in to Anypoint Platform using an account that has the root Organization Administrator permission. . Select *Access Management* from the image:gear.svg["gear icon",20] menu. . In the Access Management navigation menu, select *Security Settings*. -. In *IP Allowlist*, enter the IP address CIDR blocks to allow to log in. For example: -* IP Address CIDR: `192.0.2.0/24` -* Description: `NE office network` -+ +. In *IP Allowlist*, click *+* to add a new row. +. Enter the IP address CIDR block and an optional description. For example: +* *IP Address CIDR*: `192.0.2.0/24` +* *Description*: `NE office network` +. Under *Restriction Policy*, select the policies to assign to this CIDR block: +* *User Login* — restricts user sign-ins to this CIDR block +* *Connected Apps* — restricts connected app token minting requests to this CIDR block +. Repeat for each CIDR block you want to add. +. Click *Save*. + [NOTE] -Only IPv4 addresses are supported. All defined CIDR blocks apply to all users in your organization unless they're exempted. -. (Optional) Click *Add* or *Remove* to add and remove CIDR blocks. -. Switch the *Enforce IP restrictions for login* switch on or off to activate or deactivate defined IP restrictions for all users within your organization. +All defined CIDR blocks apply to all users and connected apps in your organization unless they are individually exempted. + +[enable-disable-ip-allowlisting] +== Enable or Disable IP Restrictions + +After configuring your CIDR blocks and assigning restriction policies, enable the *Enforce IP restrictions* toggle to activate enforcement across all assigned policies. + +. Sign in to Anypoint Platform using an account that has the root Organization Administrator permission. +. Select *Access Management* from the image:gear.svg["gear icon",20] menu. +. In the Access Management navigation menu, select *Security Settings*. +. Switch the *Enforce IP restrictions* toggle on or off to activate or deactivate IP restrictions for your organization. + -If there aren't any CIDR blocks configured, this option is disabled. +If no CIDR blocks are configured, this option is disabled. . Click *Save*. ++ +After you enable enforcement, users attempting to sign in from an IP address not covered by a User Login-assigned CIDR block receive a `403 Forbidden` error with the message `IP address not allowed for this organization`. [ip-allowlist-exemptions] -== Manage IP Allowlist Exemptions +== Exempt Users from IP Restrictions You can exempt specific users from the organization-wide IP allowlist restrictions. [NOTE] Root organization administrators are subject to IP enforcement unless explicitly exempted, and they're allowed to self-exempt. -. Log in to Anypoint Platform using an account that has the root Organization Administrator permission. +. Sign in to Anypoint Platform using an account that has the root Organization Administrator permission. +. Select *Access Management* from the image:gear.svg["gear icon",20] menu. +. Select *Users*. +. Select the user to exempt and then select *Settings*. +. Select *Exempt user from IP restrictions*, and then click *Save*. + +[configure-ip-allowlisting-connected-apps] +== Configure IP Allowlisting for Connected Apps + +Restrict which IP addresses can mint OAuth 2.0 tokens for connected apps by assigning CIDR blocks to the *Connected Apps* restriction policy. When enforcement is enabled, any `POST /api/v2/oauth2/token` request that originates from an IP address not covered by a Connected Apps-assigned CIDR block is blocked and audit logged. + +Connected apps used by CI/CD pipelines, Anypoint MQ Connector, Object Store v2, and other programmatic integrations send token requests from the IP address of the infrastructure they run on. Before assigning CIDR blocks to the Connected Apps policy, identify the outbound IP address behavior for every connected app in your organization. + +[IMPORTANT] +==== +Before enabling this feature, identify the outbound IP address behavior for every connected app in your organization, including those used for Object Store and Anypoint MQ flows. Connected apps running on CloudHub without static IPs or on CloudHub 2.0 Shared Space use dynamic or shared IPs and must be exempted. Enabling enforcement without exempting these apps blocks token minting requests for those integrations. +==== + +[connected-app-deployment-models] +=== Identify Your Deployment Model + +Use the following table to determine the recommended action for each deployment model before assigning CIDR blocks to the Connected Apps restriction policy. + +[%header,cols="25,35,40a"] +|=== +| Deployment Model | Outbound IP Behavior | Recommended Action + +| CloudHub without static IP (default) +| Dynamic; drawn from an AWS EC2 pool and can change without notice +| Exempt the connected app from IP enforcement. These IPs can't be reliably allowlisted. + +| CloudHub 2.0 Shared Space +| Egress IPs are shared across all customers in that space and aren't static. Allowlisting them provides no meaningful security isolation. +| Exempt the connected app from IP enforcement. These IPs aren't unique to your organization. + +| CloudHub with static IP enabled +| Fixed IP address; you opt in through Runtime Manager app settings on the *Static IPs* tab +| Add those static IPs to the allowlist and assign them to the Connected Apps policy. + +| CloudHub 2.0 Private Space +| Static egress IPs assigned to the Private Space; unique to your organization +| Get the IPs from the Private Space settings in Runtime Manager and add them to the allowlist. + +| Runtime Fabric +| Your own NAT gateway (AWS Elastic IP, Azure NAT Gateway, or GCP Cloud NAT) +| Retrieve the outbound IPs from your cloud provider account and add them to the allowlist. + +| Hybrid (Mule runtime on a customer VM or bare metal) +| Your own network +| Your network team controls and knows these IPs. Add them to the allowlist. + +| CI/CD or build servers +| Your own infrastructure +| Your network team knows these IPs. Add them to the allowlist. +|=== + +=== Enable or Disable IP Allowlisting for Connected Apps + +IP allowlisting for connected apps uses the same *Enforce IP restrictions* toggle as user sign-in enforcement. What determines whether connected apps are restricted is whether any CIDR blocks are assigned to the *Connected Apps* restriction policy. + +. Sign in to Anypoint Platform using an account that has the root Organization Administrator permission. +. Select *Access Management* from the image:gear.svg["gear icon",20] menu. +. In the Access Management navigation menu, select *Security Settings*. +. In *IP Allowlist*, confirm that at least one CIDR block is assigned to the *Connected Apps* restriction policy. If none are assigned, enabling the toggle has no effect on connected app token minting. +. Switch the *Enforce IP restrictions* toggle on to activate IP restrictions for your organization. ++ +If no CIDR blocks are configured, this option is disabled. +. Click *Save*. + +[connected-app-exemptions] +=== Exempt a Connected App from IP Enforcement + +Exempt a connected app when it runs on infrastructure where the outbound IP is dynamic, unknown, or shared with other tenants, such as CloudHub without static IPs or CloudHub 2.0 Shared Space. + +. Sign in to Anypoint Platform using an account that has the root Organization Administrator permission. . Select *Access Management* from the image:gear.svg["gear icon",20] menu. -. In the Access Management navigation menu, select *Users*. -. Select the user to exempt and then select *Settings*. -. Select *Exempt user from IP restrictions*, and then click *Save* to apply the exemption. +. In the Access Management navigation menu, select *Connected Apps*. +. In the *Owned Apps* section, click the connected app to exempt. +. Select *Exempt from IP restrictions*, and then click *Save*. [audit-logging] == Audit Logging These actions are logged in the audit log: -* Create, update, and delete actions performed by an Organization Administrator on the allowlist -* Signin failures due to IP restrictions +* Create, update, and delete actions performed by an organization administrator on the allowlist +* Sign-in failures due to IP restrictions +* Blocked connected app token minting requests due to IP restrictions == See Also -* xref:managing-security-settings.adoc[] \ No newline at end of file +* xref:managing-security-settings.adoc[] +* xref:connected-apps-overview.adoc[] +* xref:connected-apps-org-admin.adoc[]