Highlighted
Contributor

Anaplan REST API with Cert Access: Connect to different Models

Hello All -

 

I am building a process to connect to Anaplan via REST APIs. I have an integration account and utilizing CA Cert for authentication for API authentication.

 

I have two workspaces, say WorkspaceA (with Model Model-A) and WorkspaceB (with Model-B). I have build a list in WorkspaceA/Model-A. My integration account has "Full Access" in both WorkspaceA  and WorkspaceB.

 

I am trying to Import the list from WorkspaceA/Model-A into WorkspaceB/Model-B but getting the following error:

 

"You do not have access to the source workspace"

 

 

 

  "task" : {
    "taskId" : "7511C105589444B9A675E54ED16F",
    "currentStep" : "Failed.",
    "progress" : 0.0,
    "result" : {
      "details" : [ {
        "localMessageText" : "You do not have access to the source workspace",
        "occurrences" : 0,
        "type" : "importFailedGeneralError",
        "values" : [ "errorMessage", "You do not have access to the source workspace" ]
      } ],
      "failureDumpAvailable" : false,
      "objectId" : "112000000717",
      "successful" : false
    },
    "taskState" : "COMPLETE",
    "creationTime" : 1578331886369
  }

 

 

 

Question: Does Anaplan support connectivity between different workspaces when using CA Cert? 

 

I have referenced the following doc https://help.anaplan.com/anapedia/Content/Import_and_Export/Import_Data_into_Models/Connect_to_a_Mod... which does not mention anything specific about CA Certs

 

Thanks in advance

@Fwolf 

 

 

21 REPLIES 21
Highlighted
Community Boss

Re: Anaplan REST API with Cert Access: Connect to different Models

1: yes we can do cross workspace imports with a user that connects via certificate

2: it shouldn't be necessary but is the user a model builder in workspace A ?

Nathan Rudman
Anaplan Model Builder
Highlighted
New Contributor

Re: Anaplan REST API with Cert Access: Connect to different Models

The user running the query is a workspace admin in both the target and source workspaces and their respective models - but he is still getting this access error. The action is testing the update of changing a user's access from 'x' to 'no access' - the process runs successfully when run manually in the respective models, however, when using the rest API, it is saying he doesn't have access - could it be something in his query?
Highlighted
Contributor

Re: Anaplan REST API with Cert Access: Connect to different Models

Hi Nathan. Thanks for replying.

 

Yes, the batch account is a Workspace Admin in both Workspaces. I can connect to the Source and Target Workspace but still cannot trigger cross workspace imports.

 

below is my setup...heavily redacted version

 

The both account has  "Full Access" and "Workspace Admin" in Source and Target workspaces. 

 

Source: 

 

damianshameer2_0-1578349589665.png

 

Source User:

 

image.png

 

Target

 

image.png

 

Target User:

 

 

ERROR:

 

 

URL to execute: https://api.anaplan.com/2/0/workspaces/xxxx/models/xxx/imports/112000000025/tasks/0EF8B476761D4FD0B09291832375ECB5 

 

 

 

 

[executeGetApi] responseCode: 200
{
  "meta" : {
    "schema" : "https://api.anaplan.com/2/0/models/xx/objects/task"
  },
  "status" : {
    "code" : 200,
    "message" : "Success"
  },
  "task" : {
    "taskId" : "0EF8B476761D4FD0B09291832375ECB5",
    "currentStep" : "Failed.",
    "progress" : 0.0,
    "result" : {
      "details" : [ {
        "localMessageText" : "You do not have access to the source workspace",
        "occurrences" : 0,
        "type" : "importFailedGeneralError",
        "values" : [ "errorMessage", "You do not have access to the source workspace" ]
      } ],
      "failureDumpAvailable" : false,
      "objectId" : "112000000025",
      "successful" : false
    },
    "taskState" : "COMPLETE",
    "creationTime" : 1578349287119
  }
}

 

 

 

Highlighted
Community Boss

Re: Anaplan REST API with Cert Access: Connect to different Models

the URL you are calling ends with ?xxxxx
I've not seen this at the end of an API call before. Was it just added when you copied it ? are you calls actually executing with this ?

https://api.anaplan.com/2/0/workspaces/xxxx/models/xxxx/imports/112000000025/tasks/xxxxxx?_ga=2.1533...
Nathan Rudman
Anaplan Model Builder
Highlighted
Contributor

Re: Anaplan REST API with Cert Access: Connect to different Models

I removed my workspace id and model id. 

 

I have no issue connecting to Anaplan and executing imports/exports/uploads/downloads/processes/action...We have already built a few PROD processes that utilizes these APIs.

 

The main issue now is cross workspace imports....This is failing as per the json i posted earlier.

Highlighted
Community Boss

Re: Anaplan REST API with Cert Access: Connect to different Models

Are the source and/or target workspaces normally secured with single sign-on? If they use different identity endpoints then this can happen, or if the user is not also marked as an exception user in the source workspace.

Contributor

Re: Anaplan REST API with Cert Access: Connect to different Models

Ben,

 

"Are the source and/or target workspaces normally secured with single sign-on?"

 

As per Firm policy, SSO must be enabled. Exception Users not allowed.

 

"If they use different identity endpoints then this can happen, or if the user is not also marked as an exception user in the source workspace."

 

"identity endpoints" What do this mean? Different SSO logins? It was my understanding that Anaplan does not support multiple SAML configuration for the same tenancy.

 

To recap:

1. Source and Target workspaces are in the same tenancy. 

2. The batch account [ batch@mycompany.com  ] is added to both source and target workspaces.

3. The batch account is a Workspace Admin in source and target workspaces. SSO is enabled for both Source and Target

  • SSO should not be a factor here since this is not a human account and access to Anaplan does not flow thru our IdP

4. I establish a connection to Anaplan via REST API, utilizing CA Certs for Authentication as per https://anaplanauthentication.docs.apiary.io/#

 

 

 

Highlighted
Certified Master Anaplanner

Re: Anaplan REST API with Cert Access: Connect to different Models

Hi Damian,

 

My understanding is that when scripting integrations, the integration user must NOT be SSO.  SSO does not use passwords or certificates, but instead a SAML server that is connected up on the back end between your firm and the Anaplan authentication servers which knows the user by their network credentials.  Even if you have a network account that can be logged into that you can then use SSO into Anaplan with (when logged in as that user), that's not going to work for scripted integrations.  

I understand your statement that it's firm policy to not have exceptions, however, that may need to be revisited with your management if you'd like to have scheduled integrations.    

 

Good luck,

Stacey Gibbens

 

 

Highlighted
Master Anaplanner/Community Boss

Re: Anaplan REST API with Cert Access: Connect to different Models

@Stacey_Gibbens I always learn something new when it comes to Anaplan. 

@damianshameer2 I needed to learn more about SAML and I found this really good article and makes sense why SSO would use it.

Jared Dolich - Retail, Wholesale, eCommerce Analyst