ADDI AD Connect automation security model and user enhancements

Based on our evaluation/testing of IBM ADDI AD Connect automation, we have found that while technically feasible, i.e. we were able to connect ADDI server Build Configuration tool to the MF endeavor through the AD Connect listener and retrieve test code, there are security shortcomings that need to be address by IBM.

The main issue is that the AD Connect listener runs under one service ID, and for the automation test to run it was required to grant the service ID highest blanket access to endevor, which is deemed a security violation. IBM does not provide for entering a userid/password, human or machine, at the system/subsystem (or any other level in the process) other than as the service ID the listener runs under.

Since AD Connect automation is a powerful feature of ADDI project analysis setup, one that the bank has made a significant investment in providing, we've been asked to put together an RFE outlining the issues and proposed solution to remedy the security issues. Without these security enhancements we would not be able to implement AD automation within the bank.

Since the developers do not have access to the ADDI server to run AD Build Client or Build Configuration tool (which are already eclipse-based), the ideal situation would be if they could access this functionality directly through IDZ plugin and enter their Endevor credentials, for systems that they are granted permissions, to set up the ADDI project automation and perform builds. (see attached diagram)

There is also two existing related RFEs:
PMR ID:90742,004,000
RTC ID:321205
and
ID: 133466
RTC ID:319436

Would be happy to set up a call to discuss.