.. _web-services:

Web Services
------------

.. index:: web;web service

**On a web proxy node only**, Self-service and admin Web services can be
disabled, re-enabled and listed if required. The task should be carried out
after provisioning and if the Admin Portal or Self-service GUI for example needs
to be disabled for security purposes.


.. note::

   It is strongly recommended *not* to allow customer end-users the same level
   of administrator access as the restricted groups of provider- and customer
   administrators. This is why Self-service web proxies as well
   as Administrator web proxies should be used.

   Systems with Self-service only web proxies are *only* recommended where the system
   is customer facing, but where the customer does not administer the system
   themselves.

The commands should be run on the relevant web proxy node.
It is not recommended that the commands be run on a standalone single-node cluster system, but
only on a multi-node cluster.

In particular, the commands to disable or enable web services will automatically
reconfigure and restart the nginx process, so some downtime will result.
Request URLs to a disabled service will redirect the user to the
active service. 

.. note:: 

   SSO for end-user Self-service is supported when using a shared VOSS 
   web proxy for Admin and Self-service, when using the Admin URL in the 
   SSO setup. Once authenticated in the IdP via that URL, the user 
   is dropped into the end-user Self-service interface (if they are an end user) 
   and access via their role. SSO is not supported when using a dedicated Self-service proxy.

* To disable admin or Self-service web services on a web proxy node,
  run the command on the relevant node: 

  **web service disable <selfservice|admin>**

  When running ``web service disable admin``, all admin portals are disabled.

* To enable admin or Self-service web services on a web proxy node,
  run the command on the relevant node: 

  **web service enable <selfservice|admin>**


* To list disabled web services on an Admin or Self-service
  web services web proxy node:

  **web service list**
  
  For example:
  
  ::
  
     platform@cscluster1:~$ web service list
     disable: admin



.. |VOSS Automate| replace:: VOSS Automate
.. |Unified CM| replace:: Unified CM