---
title: "Security"
slug: "safran-project-integration-api-security"
updated: 2024-09-04T13:27:29Z
published: 2024-09-04T13:27:29Z
canonical: "docs.safran.com/safran-project-integration-api-security"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safran.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

## Security

### Authorization/Authentication

An authentication system is in place. All methods called must be authenticated. The authentication key today comprises a username and password. The API controllers verify that the key is correct. Initial access checks used Basic Authentication (BA) implementation. This has now been expanded, supporting:

1. [Kerberos Authentication](/v1/docs/kerberos-authentication)
2. [Basic Authentication](/v1/docs/basic-authentication)
3. [No Authentication](/v1/docs/no-authentication)
4. [JSON Web Token (OAuth)](/v1/docs/json-web-token)

This is configured in the [Application Setttings - SafranWebApiAuthenticationType](/v1/docs/application-settings#application_settings_SafranWebApiAuthenticationType).

### Encryption

The Web Services API require SSL. This ensures that all communication is encrypted with all standard HTTP requests being rejected.

### The Safran database user

In addition to what is listed in [Safran User](/v1/docs/safran-user), additional security could be achieved when the API is to have read-only access to the database.

If you wish to lock down any update of the Safran data, one option would be to create a new database role, similar to the standard Safran *powerplan*, this is for Microsoft DBMS, where the role is only granted select access to the Safran database tables. Alternatively use a role already present in your database. Place the API database user into that new database role. A standard [db_datareader](https://learn.microsoft.com/en-us/sql/relational-databases/security/authentication-access/database-level-roles?view=sql-server-ver16) in Microsoft DBMS could be used for this. With this, the API will no longer be able to alter any Safran data.

```
ALTER ROLE db_datareader ADD MEMBER SAFRANWEBAPI_READONLY;
```

### The database connection string, version 7.3 and earlier

**The database connection string, version 7.3 and earlier**

  

The web.config file holds the database connection details. Typically the details contains user and password in clear text. That is not always desirable in a production environment. This is why the connection strings should be encrypted. You can use [ASP.NET IIS Registration Tool](https://docs.microsoft.com/en-us/previous-versions/k6h9cz8h(v=vs.100)) (aspnet_regiis.exe) to encrypt and decrypt your connections strings.

For a single server encryption/decryption the following steps could be used:

Please notice that the location used below might be different on your installation.

1. Run Command Prompt as Administrator.
2. Go to C:\Windows\Microsoft.NET\Framework\v4.0.30319
3. Perform the command below to encrypt the connection string in your web.config:
  1. ASPNET_REGIIS -pef "connectionStrings" "c:\inetpub\wwwroot\SafranIntegrationAPI"
4. Open web.config and check if the connection string is encrypted.
5. Test the API site.
6. If you want to decrypt it back, run this command:
  1. ASPNET_REGIIS -pdf "connectionStrings" "c:\inetpub\wwwroot\SafranIntegrationAPI"
7. Open the web.config and check if the connection string is decrypted.