Legacy: Multi-admin Control Panel Access and Audit Trail

Mail Assure provides a multi-level access structure for Admin/Sub-Admin, Technician, Domain and Email level users. An unlimited hierarchy can be created where each parent account has full access to underlying domains, and associated Sub-admin, Domain and Email users.

  • For each Admin, Technician, Domain or Email user account, only one username/password is supported. Technicians can be used for multi-account access to an Admin account
  • All activity for each username and IP address is logged on the platform
  • OAuth is available for Single Sign-On (SSO) control over these accounts
  • A different method for multi-account access for larger organizations with more than one admin user requiring access to an account, a solution is required that does not involve sharing the account password. In this situation, a simple Single Sign-On (SSO) module is available via the API (see the Authentication section), allowing integration with your external control panel(s), billing system or support system. Using this method, each user's activities are tracked by the system and revealed in the audit trail

There are many opensource modules available for integration with your control panel.

The following shows a simple API method to generate authtickets:

/api/authticket/create/username/<string>/][identifier/<string>/]
Method for authentication tickets generation. 
Such tickets can be used for webinterface access without the need to enter a 
username and the password. A new authticket can be used for several login 
attempts, however it expires after 15 minutes.
Arguments:
username (string): Username of a user to create authticket for identifier 
(string): Custom identifier for client username in the API logging. -OPTIONAL

The following example uses Curl:

curl " https://adminusername:password@api.antispamcloud.com/api/authticket/create/username/
subadminexample/identifier/staffmembername/"
adminusername: Replace with your Mail Assure admin access 
credentials, it will allow the generation of an authticket for any related 
sub-admin, domain, or email user
password: Replace with your Mail Assure admin password
Subadminexample: Replace this with the username you wish to grant access to
staffmembername: Replace this with an optional identifier for the audit trail. 
For example matching the username of the specific staff member that is granted access.

The command will return a string (e.g. “736586bf5983138a6408bb145a3fbc9985091bf7”), which you can use for the SSO URL and display in your control panel to the authorized user:

Make sure the admin credentials in the script are secured, and not accessible externally. Additionally, ensure the authticket is only exposed to authorized users.

The following shows a PHP example:

<?php
// ========== Parameters section ==========
// This is a sample sso.php script, please ensure to only use this in a secured environment
// This script can be called via url:
// https://antispam.webserver.hostname/some/secured/folder/sso.php?u=admin_domain_or_email_here
// The GET variable 'u' in the URL should contain the (sub-)admin, domain, or email for which you want
// to create an one-click-login link.
// API documentation is available at https://antispam.webserver.hostname

$cfg = array(
'panel_host' => 'antispam.hostname',           // Please set the webinterface hostname.
'admin_user' => 'admin_username',              // Please set your admin username.
'admin_pass' => 'admin_password',              // Please set your admin password.
'identifier' => 'custom_identifier',           // This is a custom field allowing to set an identifier for auditing, 
as all activity will be logged using this variable
'new_window' => 0,                             // In case of 'output' parameter = 'link' this parameter tells where 
to open login link - in the same window (0) or in the new window (1)
);

$createAuthTicketURL =
'https://' . $cfg['admin_user'] . ':' . $cfg['admin_pass'] . '@' . rtrim($cfg['panel_host'], '/')
. '/api/authticket/create/username/' . (!empty($_REQUEST['u']) ? rawurlencode($_REQUEST['u']) : '');

$authTicket = trim(file_get_contents($createAuthTicketURL))
$url = 'https://' . rtrim($cfg['panel_host'], '/') . '/?authticket=' . $authTicket . '&identifier= ' . $identifier;
echo $url;
?>