Disabling API / Web Services access for Password Manager (4266092)

WORKAROUND 1

Disabling API / Web Service access for ALL INSTANCES at once of PMadmin can be done via the PMAdmin site, following the guidance below:

1. Log into the PMAdmin site
2. Browse to General Settings | Extensibility
3. Toggle Extensibility Features to ON
4. Click on the Web Services option now visible on the left pane
5. Click on the Web Services Endpoints tab
6. Click on the Edit button
7. Uncheck all check boxes

• The above changes will replicate to all Password Manager servers in the realm

WORKAROUND 2

Disabling API / Web Service access for A SINGLE INSTANCE of Password Manager can be done via the IIS Request Filtering, following the guidance below:

1. Select Default Web Site
2. Open IIS Manager
3. Double click Request Filtering in the center pane
4. Click on the URL tab
5. Click on Deny Sequence in the right hand pane
6. In the Deny Sequence input window type /PMUser/api/ and then click OK

• After performing the above configuration, API requests should result in a 404 - Not Found error

NOTE: The PMSelfService site REQUIRES access to files in the /PMSelfService/api/ container for normal functionality and this workaround is not compatible with the PMSelfService site.

If this workaround is implemented for the PMSelfService site, the PMSelfService site will not load correctly. Instead, it will only display a logo and a spinning icon.