backoffice login restriction by ip

[former_member628981]

How to restrict access right by IP address in backoffice?

Is it possible to prevent admin login by IP in backoffice?

SAP Hybris version is 6.6.

I will be grateful for any help you can provide.

[former_member628981]

How to customize the code that restrict an IP to login using some role?

I can't find customizing infomation about LoginInfomationHandler.

Could you give me a development guide?

Thank you for your help.

[matthewsmith]

Hi Hyungon,

In a production or pre-production environment, a more sensible approach to take would be to put the backoffice behind an apache server (or potentially other web server) such that it can't be accessed directly. Rules could then be applied on the web server, or at the network layer, so that only certain IP addresses or ranges can access it.

This would mean no custom code is needed, only configuration on other components of the system. Ideally we don't change anything about backoffice for this scenario, so that the other environments such as dev and test, where the IP restrictions might not exist, are consistent with the production environment.

Hope that helps!

[Former Member]

Hi hgkim143 ,

We can add adding a filter or a servlet with in the custom Backoffice extension. I think you can put your custom logic there for checking the admin role or IP address.

You can add this filter or servlet to Backoffice web.xml and Backoffice supports modularity of the web.xml through the web-fragment.xml to fulfill this need.

Summarizing steps below -

• Create a new Backoffice-based extension, e.g. training.
• Add a filter class to the training/src directory not in the training/backoffice/src folder.
• OR, Add a servlet class to the training/src directory.
• Now, add the web-fragment.xml file to the training/resources directory.
• Build and run your platform.

Hope it will solve your problem.

Regards,

Prashant