Access Token for Anonymous End User

Examples

• (Example) Use Anonymous Authentication in a Form-Based App
• (Example) Use Anonymous Authentication in a Process-Based App
• (Example) Anonymous Page in Page Builder
• (External) AgilePoint NX Page Builder Pages Now Available To External Users
• Examples - Step-by-step use case examples, information about what types of examples are provided in the AgilePoint NX Product Documentation, and other resources where you can find more examples.

Prerequisites

• For anonymous forms:
  • Account credentials for anonymous authentication. This is the account the eForm uses to connect to AgilePoint NX, and get and submit data in the app. You can use an AgilePoint NX account or an account in Active Directory.

    If you do not use any of these authentication methods in your organization, you can create an AgilePoint NX account to use for anonymous authentication.

    Active Directory authentication is not available for AgilePoint NX OnDemand.

  • As a security best practice, in your access token for anonymous forms, AgilePoint recommends user credentials with minimum access rights. This is a user with the Users role with the default access rights.

    It is not recommended to use an Administrator, Application Designer, or Developer account of any kind for anonymous access.

    In AgilePoint NX OnPremises and AgilePoint NX PrivateCloud, anonymous forms can use the AgilePoint Service Account for authentication if you select User System Account when you configure an access token for anonymous forms. However, this practice carries extreme security risks. This is not recommended unless you have a specific business requirement for Service Account access, and the security risks are mitigated.

    If you use the AgilePoint Service Account, the credentials are not stored in the database.

  • An app designer who configures an eForm to use anonymous authentication (used with anonymous forms) must have a role with the Allow Enabling Anonymous Access access right.

    The Allow Enabling Anonymous Access access right lets the application designer create an anonymous form in App Builder at design time. It does not control the security for the anonymous form or the anonymous form user at runtime. The user credentials used for the anonymous authentication access token do not require this access right.

• For anonymous pages:
  • As a security best practice, in your access token for anonymous pages, AgilePoint recommends user credentials with minimum access rights. This is a user with the Page Viwers permission group with the default access rights.

    It is not recommended to use an Administrator, Application Designer, or Developer account of any kind for anonymous access.

  • A page designer who configures a custom page to use anonymous authentication must have a role with the Allow Enabling Anonymous Access access right.

    The Allow Enabling Anonymous Access access right lets the page designer create an anonymous page in Page Builder at design time. It does not control the security for the anonymous page or the anonymous page user at runtime. The user credentials used for the anonymous authentication access token do not require this access right.

    At minimum, the user account associated with the Anonymous End User access token must be a member of the Page Viewers permission groups for the custom page.

Good to Know

• For anonymous forms:
  • To enforce strict security, AgilePoint highly recommends you use anonymous forms for data entry only, and avoid using lookups that connect to your backend systems.

    However, the decision whether to use lookups in anonymous forms is based on your business requirements. If your requires you to use a lookup to backend system, make that design choice as necessary.

  • To make sure only APIs specific to run through the eForm are allowed to avoid security risks, such as code injection attacks, AgilePoint recommends you select Enable API Whitelisting on the Security tab on the Anonymous eForm Access Configuration screen.
  • If you have questions about the security impacts or best practices for anonymous forms, contact AgilePoint Professional Services.
• For anonymous pages:
  • To make sure only APIs specific to run through custom pages are allowed to avoid security risks, such as code injection attacks, AgilePoint recommends you add only the required APIs.

    To add an API, click Add Whitlisted API on the Anonymous Access Settings tab on the Settings screen.

  • If you have questions about the security impacts or best practices for anonymous pages, contact AgilePoint Professional Services.
• In most cases, you can use a global access token or an app level access token:
  • Global access tokens are shared across all users and apps. If you want all process designers and runtime app users in your AgilePoint NX tenant to be able to connect to an external data source, use a global access token. An example is a SharePoint site on an intranet that all employees in a company can access.
  • Application level access tokens are shared with all processes in a process-based app, or restricted to use within a form-based app. Use application level access tokens if only process designers or runtime app users for a particular application should access an external system — for example, a Box account that is only used to share files within a small team.
• Access tokens are collections of credentials that are used to authenticate communication directly between AgilePoint NX and an external system. Because it is the AgilePoint NX system that uses these credentials, rather than an app, there is no difference between design time and runtime access tokens. Access tokens are never checked in or published, and they do not use version control. If you change an access token in App Builder or Manage Center, the access token changes immediately everywhere the access token is used. Changes to app level access tokens apply to all versions of an app, including running application instances. Changes to global access tokens apply everywhere they are used in AgilePoint NX. You can not roll back an access token to a previous version.

  For more information, refer to What Data Is Deleted When I Delete an App or Application Resource?

• This screen may look different in different places. The UI varies for this screen depending upon how you open it. However, the fields for this screen are the same in all places.

Global (Manage Center)

You can use a global access token in any app in your AgilePoint NX tenant. Use a global access token if you want any user in your environment to be able to connect to the same external system.

1. Click Manage.

   
   
   

2. In Manage Center, click App Builder > Global Access Tokens.

   
   
   

3. On the Global Access Tokens screen, click Add Token.

   
   
   

4. On the Add Global Access Tokens screen, select Anonymous End User.

   
   
   

5. Click Next.

App Level (Modern Add an App Experience)

Create an access token to use in any process activity or form control in an app you create in the Modern Add an App Experience.

1. In App Builder, in the Modern Add an App Experience, create an app.
   For more information, refer to:

   • Modern Add An App Experience (Process-Based App)
   • Modern Add An App Experience (Form-Based App)
2. On the Anything else right now? screen, in the Access Tokens field, click Create.

   
   
   

3. On the What service do you want your app to access? screen, select Anonymous Forms.

   
   
   

4. Click Next.

App Level (App Builder)

Create an access token to use in any process activity or form control in a specified app.

1. Click App Builder.

   
   
   

2. On the App Builder Home screen, click All Apps.

   
   
   

3. On the All Apps screen, on an app, click Edit .

   
   
   

4. On the App Details screen, click Add New > Access Token.

   
   
   

5. On the What service do you want your app to access? screen, select Anonymous Forms.

   
   
   

6. Click Next.

Process Activities and Form Controls

Different access token types can be created in context and used in different process activities, form controls, or apps. The App Builder shows shortcut buttons in any place you can create an access token.

You can create an app level access token for Anonymous End User here:

• Process Builder
  • These activities on the eForms tab:
    • Anonymous Start Task activity
    • Anonymous Standard Task activity
    • Start Task activity
    • Standard Task activity