XRAY: How to restrict users only to access Xray through REST API without providing UI access

In this article, we are going to describe the two methods through which we can restrict UI access to users and provide privileges to perform Xray operations through REST API.
 

Method 1: Creating a transient user with an access token 

We can create a transient user with an access token. The advantage of access tokens is the fact that you do not have to create a user in Artifactory to use them. When creating a token, you can specify a user name that does not exist in Artifactory, and Artifactory will create a transient user that will only exist as long as the token is valid(We can specify while creating an access token).

To create a Transient user go to Administration → Identity and Access → Access Tokens → Generate Token. Here you can specify the service to which the user can have access(if only to Xray REST API) and set the expiration time.


Two ways to use access tokens for authentication. For example:

Basic Authentication

  curl -u<USERNAME>:<TOKEN> <Xray url>/xray/api/v2/watches

Authorization Headers

  curl -H"Authorization: Bearer <TOKEN>" <Xray url>/xray/api/v2/watches

Method 2: Restricting UI access from the JFrog platform 

To perform some Xray REST API action we do not have restrictions that the user needs admin access, in such cases we can use this method. Based on the requirement we can provide the manage resources, policies and watches level of access. If you want to restrict any existing user in an Artifactory from accessing UI you can simply disable UI access for that particular user. Go to administration → Identity and Access → Users → Click on the user and can select Disable UI Access. 



Example to use username and password for REST API authentication.
 

  curl -u<USERNAME>:<PASSWORD> <Xray url>/xray/api/v2/watches