Security Settings

General information

When talking about the Workflow Server security system, we indicate the following two components:

• access to the Workflow API. It is considered separately.
• access to the admin panel.

The settings related to security are edited in the following locations:

• in Settings section - in the Security tab.
• in the Users section.

Restricting Access to Admin Panel

1. The types of access to the admin panel:

   • None - the access is not checked.
   • Basic - by login and password.
   • OpenId Connect - by login and password, together with the built-in OpenIddict Server.

2. Administrator login - only one person has access to the admin panel - a special user.

3. Administrator password.

Working with Users

The User interface is quite simple.

1. The list of Users, double click opens the User card.

The user editing interface is also very simple.

1. Roles can be assigned to a User, and then, checked in your workflow.
2. If you want the user to log in by login and password, which are stored (password as a hash) in the database, then you can specify them in the user card.

There are four main ways to create Users in the Workflow Server:

1. Creating and editing Users through the admin panel interface.
2. Creating and editing Users through the Workflow API.
3. Importing Users via LDAP.
4. Automatic User creation when logging in through external sources that support OpenId (Facebook, Google, Okta).

User might import settings via LDAP which are in the Setting page - in the Security tab.

If the connection to LDAP is configured, the Import from AD button will appear in the User interface; then clicking on it, you can import Users. In this case, User groups are registered as the roles of these Users.

info

Set the properties in the config.json file to encrypt the LDAP password in the database.

{
  //...
  "LdapEncryptPassword": true,
  "Salt": "someSecureSaltForEncryption",
  //...
}

Then restart the Workflow Server and save the LDAP settings through the admin panel. This will update the LDAP settings in your database.

Authentication Settings

OpenIddict, running inside the Workflow Server is used to authenticate Users. Authentication can be performed both by login and password and through external sources that support OpenId.

It is very important to fill in Redirect Hosts URLs for redirects to ensure correct authentication settings. The options can be accessed by: 'Settings' -> in the 'Security' tab.

1. Certificate file - the path to the certificate for signing authorization tokens. If there is no certificate, it will be generated automatically, but that is not recommended.

2. Certificate password - the certificate password for signing authorization tokens.

   info

   If you are going to use OpenID Connect, you must connect a trusted certificate and ensure all communication occurs over HTTPS protocol.

3. Redirect hosts - a list of the hosts allowed for redirects.

4. Redirect urls - a list of the URLs allowed for redirects. By default, the admin url are used.

5. Admin headers - a list with headers that will be added to each request.

caution

If any of these settings are changed, the server instance must be physically restarted. That is, the Workflow Server application should be stopped and then restarted.

Enabling OpenIddict Server

The OpenIddict Server is disabled by default, it is only used when working with an external authorization server, so you can enable it if necessary. To do this, add the following to the config file:

{
  "DisableOpenIddictServer": false
}

CORS (Cross-Origin Resource Sharing)

It is used to provide a web page with access to resources from another domain.

Adjusted parameters:

• Allow from origin - addresses to send requests, with allowed access to the Workflow Server, for example, to the Workflow API.

Custom OpenId Connect Providers

Custom OpenId Connect providers are connected using the WorkflowServerRuntime.RegisterOpenIdConnectProviders method. That is, you can only add them by customizing the Workflow Server code.

public void RegisterOpenIdConnectProviders(params Action<OpenIddictClientBuilder>[] registerActions)

Through WorkflowServerInitializer:

(bool success, IWebHost host) = initializer.BuildWebHost(workflowServer =>
{
    ...
    //Register your own Identity Providers:
    workflowServer.RegisterOpenIdConnectProviders(authBuilder =>
    {
        authBuilder.AddRegistration(new OpenIddictClientRegistration
        {
            Issuer = new Uri("https://localhost:44323"),
            ClientId = "wfs-client",
            ClientSecret = "DF77F57E-3BD4-4E06-B464-FC4B497D0B20",
            ProviderDisplayName = "OpenIddict server",
            ProviderName = "OpenIddict",
            RedirectUri = new Uri("https://localhost:8077/account/callback"),
            ResponseTypes = { "code" },
            Scopes =
            {
                OpenIddictConstants.Scopes.OpenId,
                OpenIddictConstants.Scopes.Profile,
                OpenIddictConstants.Scopes.Email
            }
        });
    });
});

You can use your own implementations of IExternalLogonService and IExternalCredentialsProcessor after registering them via the WorkflowServerRuntime methods:

public WorkflowServerRuntime SetExternalLogonService(IExternalLogonService externalLogonService)

public WorkflowServerRuntime SetExternalCredentialsProcessor(IExternalCredentialsProcessor externalCredentialsProcessor)