Integration processes with the SolarWinds platform currently require service accounts that possess both API permissions and interactive user interface access, creating potential security and compliance challenges when automated systems or third-party tools need data without exposing the web console UI.
Problem Statement
Automating integrations via the SolarWinds REST API currently requires service accounts that have full access to log into the Orion web console via URL. Security guidelines, least-privilege principles, and compliance frameworks often mandate that integration accounts be strictly restricted to programmatic access only, completely disabling their ability to access the web application user interface.
When teams request API-only credentials, the current architecture forces them to provision standard user accounts, introducing unnecessary security risks and complicating identity governance.
Proposed Solution
Implement a dedicated authentication and authorization mechanism for the SolarWinds REST API that decouples programmatic access from web console access.
Key capabilities of this enhancement include:
- API-Only User Roles: Ability to create or flag user accounts specifically for API/scripting use that are explicitly blocked from accessing the Orion web console URL.
- Granular Permission Mapping: Role-based access control (RBAC) designed specifically for API endpoints, limiting API service accounts only to the specific verbs, modules, and data entities required for the integration.
- Enhanced Audit Logging: Clear separation in audit logs distinguishing API-driven actions from interactive web console sessions.
Business Value and Benefits
- Improved Security Posture: Adheres to the principle of least privilege by ensuring integration accounts cannot be used to manually browse the SolarWinds web UI.
- Compliance Alignment: Meets strict corporate and regulatory security requirements that prohibit service accounts from having interactive login capabilities.
- Reduced Risk of Misuse: Minimizes the blast radius if an integration's API credentials are inadvertently exposed, as the credentials cannot be used to log into the web interface.
Please do vote from your side if you feel it is worth to consider.
