(Example) Use Anonymous Authentication in a Process-Based App

Good to Know

• This example uses the Customer Enquiry app from the AgilePoint NX App Store.

  For more information, refer to How to Get the App

• Customer Enquiry is an app that lets customers submit questions about a company, or its products or services.

  For the use case in this example, you configure the Customer Enquiry Request form to use anonymous authentication so the customer can access the form without signing in.

• To enforce strict security, AgilePoint highly recommends you use anonymous forms for data entry only, and avoid using lookups that connect to your backend systems.

  However, the decision whether to use lookups in anonymous forms is based on your business requirements. If your requires you to use a lookup to backend system, make that design choice as necessary.

• An app designer who configures an eForm to use anonymous authentication (used with anonymous forms) must have a role with the Allow Enabling Anonymous Access access right.

  The Allow Enabling Anonymous Access role lets the application designer create an anonymous form in App Builder at design time. It does not control the security for the anonymous form or the anonymous form user at runtime. The user credentials used for the anonymous authentication access token do not require this access right.

• As a security best practice, in your access token for anonymous forms, AgilePoint recommends using a user with minimum access rights. This is a user with the Users role with the default access rights.
• Optionally, in AgilePoint NX OnPremises and AgilePoint NX Private Cloud, anonymous forms can use the AgilePoint Service Account for authentication if you select User System Account when you configure an access token for anonymous forms. However, this practice carries security risks. It is not recommended unless you have a specific business requirement for Service Account access, and the security risks are mitigated.

  If you use the AgilePoint Service Account, the credentials are not stored in the database.

• If you have questions about the security impacts or best practices for anonymous forms, contact AgilePoint Professional Services.

Good to Know

• An app designer who configures an eForm to use anonymous authentication (used with anonymous forms) must have a role with the Allow Enabling Anonymous Access access right.

  The Allow Enabling Anonymous Access role lets the application designer create an anonymous form in App Builder at design time. It does not control the security for the anonymous form or the anonymous form user at runtime. The user credentials used for the anonymous authentication access token do not require this access right.

How to Start

1. In the Manage Center, click Access Control > Roles.

   
   
   

2. On the Roles screen, click Expand on the Application Designer role.

   
   
   

Procedure

1. On the Application Designer role, in the ACCESS RIGHTS section, click Edit Role .

   
   
   

2. On the Edit Role screen, in the Access Rights tab, click the App Builder tab.

   
   
   

3. On the App Builder tab, select Enable Anonymous Forms.

   
   
   

4. Click Update.

Good to Know

• As a security best practice, in your access token for anonymous forms, AgilePoint recommends using a user with minimum access rights. This is a user with the Users role with the default access rights.

How to Start

1. In the Manage Center, click Access Control > Users.

   
   
   

2. On the Users screen, click Add User.

   
   
   

Procedure

1. On the User Information screen, in the User Name field, enter ExternalUser.

   
   
   

2. In the Full Name field, enter Anonymous External User.

   
   
   

3. In the E-mail Address field, enter the e-mail address for the user.

   
   
   

4. Click Add User.

   By default, the new user is added with the User role.

Prerequisites

• Account credentials for anonymous authentication. This is the account the eForm uses to connect to AgilePoint NX, and get and submit data in the app. You can use an AgilePoint NX account or an account in Active Directory.

  If you do not use any of these authentication methods in your organization, you can create an AgilePoint NX account to use for anonymous authentication.

  Active Directory authentication is not available for AgilePoint NX OnDemand.

• As a security best practice, in your access token for anonymous forms, AgilePoint recommends using a user with minimum access rights. This is a user with the Users role with the default access rights.
• An app designer who configures an eForm to use anonymous authentication (used with anonymous forms) must have a role with the Allow Enabling Anonymous Access access right.

  The Allow Enabling Anonymous Access role lets the application designer create an anonymous form in App Builder at design time. It does not control the security for the anonymous form or the anonymous form user at runtime. The user credentials used for the anonymous authentication access token do not require this access right.

Good to Know

• Optionally, in AgilePoint NX OnPremises and AgilePoint NX Private Cloud, anonymous forms can use the AgilePoint Service Account for authentication if you select User System Account when you configure an access token for anonymous forms. However, this practice carries security risks. It is not recommended unless you have a specific business requirement for Service Account access, and the security risks are mitigated.

  If you use the AgilePoint Service Account, the credentials are not stored in the database.

• If you have questions about the security impacts or best practices for anonymous forms, contact AgilePoint Professional Services.
• This example shows how to create a global access token for anonymous forms. You can also create an app level access token for anonymous forms.

How to Start

1. Click Manage.

   
   
   

2. Click App Builder > Global Access Tokens.

   
   
   

3. On the Global Access Tokens screen, click Add Token.

   
   
   

4. On the Add Global Access Tokens screen, select Anonymous Forms.

   
   
   

5. Click Next.

Procedure

1. On the Add Global Access Tokens screen, in the Token Name field, enter Anonymous Customer Request.

   
   
   

2. In the Domain field, enter nxone.

   You can find the domain name in the Portal Instance URL field on Tenant Settings.

   For more information, refer to Find your Portal Instance URL.

   
   
   

3. In the User Name field, enter ExternalUser.

   
   
   

4. In the Password field, enter the password of the user.

   
   
   

5. To make sure the specified credentials are correct, click Validate .

   
   
   

6. Click Done.

Prerequisites

• An app designer who configures an eForm to use anonymous authentication (used with anonymous forms) must have a role with the Allow Enabling Anonymous Access access right.

  The Allow Enabling Anonymous Access role lets the application designer create an anonymous form in App Builder at design time. It does not control the security for the anonymous form or the anonymous form user at runtime. The user credentials used for the anonymous authentication access token do not require this access right.

How to Start

1. Click App Builder.

   
   
   

2. On the App Explorer screen, in the My Apps pane, click Customer Enquiry > Processes > Customer Enquiry > Process Model > Customer Enquiry.

   
   
   

Procedure

1. On the Process Builder screen, in the Customer Enquiry process model, double-click on the Customer Enquiry form.

   
   
   

2. On the Start Task Configuration screen, select the Customer Enquiry form.

   
   
   

3. Click Advanced > Anonymous Access

   
   
   

4. On the Anonymous eForm Access screen, click the Anonymous Access tab.

   
   
   

5. On the Anonymous Access tab, in the Anonymous Access Name field, enter Anonymous Customer Inquiry.

   
   
   

6. In the Access Token list, select Anonymous Customer Request (Global).

   
   
   

7. Click the URL tab.

   
   
   

8. In the Base URL field, enter https://mysite.nxone.com.

   This URL is an example. You can find the actual value in the Portal Instance URL field on Tenant Settings.

   For more information, refer to Find your Portal Instance URL.

   
   
   

9. The Parameter and Value fields show the default value Process and Customer Enquiry.

   You can not change these values.

   You can specify your own query string parameters and values. Any custom values you specify are used in the URL for the anonymous form.

   
   
   

10. Click Generate.

    
    
    

11. On the Access Token screen, click Save.

    You can use this URL to open and complete an eForm with no authentication.

    
    
    

    The Anonymous eForm Access screen shows.

    
    
    

Procedure

1. On the Anonymous eForm Access screen, click View.

   
   
   

2. On the Access Token screen, click Copy.

   
   
   

3. Click Cancel.
4. On the Anonymous eForm Access screen, click Finish.

   
   
   

5. Sign out of AgilePoint NX Portal.

   
   
   

6. In your web browser, paste the URL for your eForm.

   The Customer Enquiry Request Form opens with no authentication.

   
   
   

7. Complete the fields on the eForm.

   
   
   

8. Click Submit

Procedure

1. Click Work Center.

   
   
   

2. On the Work Center screen, click Inbox > Processes.

   
   
   

3. On the Processes screen, click Processes > I Started.

   
   
   

4. On the Processes I Started tab, click Customer Enquiry > eForm Report View .

   
   
   

5. The View form shows the records you submitted in an eForm.

   
   
   

Prerequisites

• AgilePoint NX OnDemand (public cloud), or AgilePoint NX Private Cloud or AgilePoint NX OnPremises v7.0 or higher.

Good to Know

• This procedure is optional. It is provided so you can test the example with an out-of-the-box app.
• This is part of the Background and Setup procedures, but many users preferred this step to appear after the example, not before it.

Get the App

1. Click App Store .

   
   
   

2. In the CATEGORY section, click Marketing.

   
   
   

3. Click the Customer Enquiry app.

   
   
   

4. On the Customer Enquiry screen, click Add.

   
   
   

5. On the Trust App screen, click Trust it.
6. Click Return to site.