Workflow : When actions need password

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

jeltix

Hello,

First, i would like to say thank you for this great Forum

i have done a search but my question is not answered yet

Question:
I'm setting up a new workflow (hiring process) and some actions are really touchy (RH agreement,top manager agreement..) so i would like the users workflow to reintroduce there password when approving the hiring request.

our alfresco is configured with the active directory and i'm using the activiti Kickstart to design both workflow and forms

is-it possible to configure alfresco to ask the login/password when the user approve something?

Thanks you very much for your help

M JELTI

afaust

Hello,

unfortunately, this is something that is not simple to do. Alfresco does not yet have standard workflow actions that require a user to enter their credentials. Mostly this is due to the fact that Alfresco can be operating in a context where it can't validate the users credentials, e.g. when users are authenticated externally.

In case your Alfresco is set up in a way that it can actually validate credentials, e.g. it has local/passthru/kerberos/LDAP authentication set up, you can add such a functionality to Alfresco manually. This requires some Java development though, so nothing you can do with just Kickstart. You'd need to add fields for login/password into your workflow model and forms, and should implement a form filter that intercepts the login & password, validates them via the authentication service (simply do an authentication in a separate transaction), veto if authentication fails or proceed (but remove login/password from the fields to save, so as not to accidentally save the password in the workflow where administrators / others may retrieve it from).

What I would prefer is using some kind of OTP setup in Alfresco that is independant of the actual credentials. Then you can require the user to enter time sensitive pin before submitting the form and validate that in Alfresco without having to go to any authentication service.

Regards
Axel