Access Token for Anonymous Forms

Configure an access token to connect to an anonymous form. This type of access token provides credentials that let non-authenticated users complete an eForm in AgilePoint NX.

Figure: Anonymous Forms Access Token Configuration screen

Background and Setup

Examples

(Example) Use Anonymous Authentication in a Form-Based App
(Example) Use Anonymous Authentication in a Process-Based App
Examples - Step-by-step use case examples, information about what types of examples are provided in the AgilePoint NX Product Documentation, and other resources where you can find more examples.

Prerequisites

Account credentials for anonymous authentication. This is the account the eForm uses to connect to AgilePoint NX, and get and submit data in the application. You can use an AgilePoint NX account or an account in Active Directory.
If you do not use any of these authentication methods in your organization, you can create an AgilePoint NX account to use for anonymous authentication.

Active Directory authentication is not available for AgilePoint NX OnDemand.
As a security best practice, in your access token for anonymous forms, AgilePoint recommends using a user with minimum access rights. This is a user with the Users role with the default access rights.
An application designer who configures an eForm to use anonymous authentication (used with anonymous forms) must have a role with the Allow Enabling Anonymous Access access right.
The Allow Enabling Anonymous Access role lets the application designer create an anonymous form in App Builder at design time. It does not control the security for the anonymous form or the anonymous form user at runtime. The user credentials used for the anonymous authentication access token do not require this access right.

Good to Know

To enforce strict security, AgilePoint highly recommends you use anonymous forms for data entry only, and avoid using lookups that connect to your backend systems.
However, the decision whether to use lookups in anonymous forms is based on your business requirements. If your requires you to use a lookup to backend system, make that design choice as necessary.
Optionally, in AgilePoint NX OnPremises and AgilePoint NX PrivateCloud, anonymous forms can use the AgilePoint Service Account for authentication if you select User System Account when you configure an access token for anonymous forms. However, this practice carries security risks. It is not recommended unless you have a specific business requirement for Service Account access, and the security risks are mitigated.
If you use the AgilePoint Service Account, the credentials are not stored in the database.
If you have questions about the security impacts or best practices for anonymous forms, contact AgilePoint Professional Services.
In most cases, you can use a global access token or an application level access token:
- Global access tokens are shared across all users and applications. If you want all process designers and runtime app users in your AgilePoint NX tenant to be able to connect to an external data source, use a global access token. An example is a SharePoint site on an intranet that all employees in a company can access.
- Application level access tokens are shared with all processes in a process-based app, or restricted to use within a form-based app. Use application level access tokens if only process designers or runtime app users for a particular application should access an external system — for example, a Google Drive account that is only used to share files within a small team.
Access tokens are collections of credentials that are used to authenticate communication directly between AgilePoint NX and an external system. Because it is the AgilePoint NX system that uses these credentials, rather than an app, there is no difference between design time and runtime access tokens. Access tokens are never checked in or published, and they do not use version control. If you change an access token in the App Builder or Manage Center, the access token changes immediately everywhere the access token is used. Changes to application level access tokens apply to all versions of an application, including running application instances. Changes to global access tokens apply everywhere they are used in AgilePoint NX. You can not roll back an access token to a previous version.
For more information, refer to What Data Is Deleted When I Delete an App or Application Resource?

How to Start

There are several ways to create an access token for anonymous form. How to create the access token depends on where you want to use it.

Global (Manage Center)

You can use a global access token in any application in your AgilePoint NX tenant. Use a global access token if you want any user in your environment to be able to connect to the same external system.

Click Manage .
Click App Builder > Global Access Tokens.
On the Global Access Tokens screen, click Add Token .
On the Add Global Access Tokens screen, select Anonymous Forms .
Click Next.

Application Level (App Builder)

Create an access token to use in any process activity or form control in an application.

Click Build Apps .
In the Application Explorer, on the My Applications pane, click [Application Name] > Shared Resources > Access Tokens.
Click New .
On the New App Token screen, select Anonymous Forms .
Click Next.

Process Activities and Form Controls

Different access token types can be created in context and used in different process activities, form controls, or applications. The App Builder shows shortcut buttons in any place you can create an access token.

You can create an application level access token for Anonymous Forms here:

Process Builder
- Anonymous Start Task (eForms) activity
- Anonymous Standard Task (eForms) activity
- Start Task (eForms) activity
- Standard Task (eForms) activity

Fields

Field Name	Definition
Token Name	Function: Specifies the unique name for your connection to AgilePoint. Accepted Values: A text string that can have letters, numbers, and spaces. Default Value: None Example: Refer to: (Example) Use Anonymous Authentication in a Form-Based App (Example) Use Anonymous Authentication in a Process-Based App
Description	Function: A description for your access token. Accepted Values: More than one line of text. Default Value: None Example: Refer to: (Example) Use Anonymous Authentication in a Form-Based App (Example) Use Anonymous Authentication in a Process-Based App
Domain	Function: The authentication domain. Accepted Values: A valid domain. Default Value: None Example: Refer to: (Example) Use Anonymous Authentication in a Form-Based App (Example) Use Anonymous Authentication in a Process-Based App
User Name	Function: Specifies the user name of the user in Active Directory or AgilePoint NX. Accepted Values: A valid user name. Default Value: None Accepts Process Data Variables: No Example: Refer to: (Example) Use Anonymous Authentication in a Form-Based App (Example) Use Anonymous Authentication in a Process-Based App
Password	Function: Specifies a password for the user. Accepted Values: A valid password. Default Value: None Accepts Process Data Variables: No Example: Refer to: (Example) Use Anonymous Authentication in a Form-Based App (Example) Use Anonymous Authentication in a Process-Based App
User System Account	Function: Specifies to use the AgilePoint Service Account for anonymous authentication. (This is sometimes also called the AgilePoint System Account.) Accepted Values: Selected - Uses the AgilePoint Service Account as the credentials for anonymous authentication. Deselected - Does not use the AgilePoint Service Account for anonymous authentication. Default Value: Deselected Limitations: This field is available only in AgilePoint NX OnPremises or AgilePoint NX PrivateCloud. To select this field, use of the AgilePoint Service Account must be enabled on your tenant. For more information, refer to, How Do I Let a Role Use the AgilePoint Service Account?. As a security best practice, in your access token for anonymous forms, AgilePoint recommends using a user with minimum access rights. This is a user with the Users role with the default access rights. Optionally, in AgilePoint NX OnPremises and AgilePoint NX PrivateCloud, anonymous forms can use the AgilePoint Service Account for authentication if you select User System Account when you configure an access token for anonymous forms. However, this practice carries security risks. It is not recommended unless you have a specific business requirement for Service Account access, and the security risks are mitigated. If you use the AgilePoint Service Account, the credentials are not stored in the database.
Validate	Function: Makes sure the specified Active Directory or AgilePoint NX account is correct. Example: Refer to: (Example) Use Anonymous Authentication in a Form-Based App (Example) Use Anonymous Authentication in a Process-Based App
Encrypt	Function: Stores the access token in the AgilePoint database as encrypted data. Note: AgilePoint recommends you to store this access token in the database in encrypted format. Accepted Values: Deselected - The access token is in plain text in the database. Selected - The access token is encrypted in the database. Default Value: Selected Limitations: This field was removed from the UI in AgilePoint NX OnPremises and PrivateCloud v7.0 Software Update 2. Access token credentials are encrypted by default. If you want to store credentials in unencrypted format, contact AgilePoint Customer Support.