Security for Groove Server Data Bridge
Updated: April 1, 2008
Applies To: Groove Server 2007
Topic Last Modified: 2009-01-05
Groove's inherent cryptographic security is intended to keep workspace data and activities within the exclusive purview of the workspace’s member users. However, Groove Data Bridge identities, like Groove users, may hold membership in multiple spaces and retain access to external applications. Therefore, exercise caution when defining the presence and role of an identity in a given workspace.
A basic tenet of Groove Data Bridge security is to logically locate the Data Bridge server on your network to allow a minimum number of Internet protocols through. On the Data Bridge server, this typically means leaving outbound port 80 open for HTTP (inbound blocked) and leaving port 2492 open for SSTP, using firewalls to block all other Internet traffic.
In the context of Service Oriented Architecture (SOA)-based integration solutions through Groove Web Services, consider the following information:
Groove Data Bridge uses SOAP, a standard, XML-based protocol, to communicate with remote applications which integrate with Groove workspaces through remote Groove Web Services on Groove Data Bridge. Native Groove security does not protect the connections between Data Bridge servers and the remote applications where the integration logic (code) lives; these are the remote applications. Therefore, pay careful attention to the security of these network connections when planning deployment. As an extra precaution, you may want to consider changing the default network listening ports used on remote Groove Data Bridge (for XML-RPC and SOAP over HTTP communications).
All connections to devices running external applications (those integrating with Groove workspaces through Groove Web Services on Groove Data Bridge) should be secured with standard techniques such as IPSec. Also, as standard practice, both remote and physical accesses to the devices should be limited to only authorized administrators. Note that Groove Web Services access must be enabled on the Groove Data Bridge server in order to allow Groove Data Bridge to receive messages from external applications that rely on XML-based calls to Web services.
Groove Data Bridge expects Web services calls via HTTP and does not support HTTP authentication. Groove Data Bridge does not support HTTPS and its associated encryption of transmitted data. Therefore, external security measures cited above are highly recommended to help secure Web services communications with the Data Bridge server.
To help prevent DNS-based security attacks, identifying the Groove Data Bridge server by a static IP address (rather than its DNS address) is recommended.
How you implement security measures at your site depends largely on your company’s specific security requirements, the software you use, and on your existing network topology. The Best Practices listed below provides some guidelines.
For more information about securing Groove Data Bridge communications, see Groove Web Services Security.