Mobile CRM and Epicor Web Access - Security/Best Practice

[josecgomez]

@utaylor

it would be nice to hear more about 2nd factor authentication with Epicor and if anyone is having success using that with mobile CRM yet. He also mentioned the access scope for API.

We use second factor via Azure AD. We authenticate Epicor with Azure Active Directory and forced second factor on there. So to login to Epicor if you are in our internal network it uses SSO, but if you are coming from anywhere external you need to authenticate against AD and provide your second factor, works great and right out of the box.

AppProxy is great approach that has already been recommended.

We wrote a portal that allows customers to access their data we did it via a Proxy on the DMZ which sits between them us and our network.
That server can only communicate with Epicor via port 443 (our Epicor server is not exposed directly) I covered this in more detail in a prior post… (let me look for it)

here you you

API management for 3rd party data consumers

We want to expose certain BAQ data to a third party but I do not want them to be calling the Epicor API directly. I know that recently BAQ security on API was exposed to limit what a user can call, but I am not at that upgade yet. My initial thought was to create a Web API that then calls the specific BAQ and returns the data to the caller. The issue I see is maintainability. Is there a preferred or better method to do what I’m attempting, which is essentially a simple API to call another API? …

Which is basically similar to what AzureAppProxy does