Workflow Approval Via Encrypted Email Links

A common workflow process is often the access request scenario - a user requires access to something, and that something requires an approval before the provisioning can be completed. Typically this is done via notifications, a dashboard and perhaps an email notifying the approver that they have a task that requires their attention.



My use case will look like something like this:
  1. Helpdesk operator requests access to impersonate an end user for a set period of time - say 5 minutes
  2. The end user will receive an email notification with two links - Approve or Reject
  3. Each link will go to two specific OpenIDM custom endpoints - ../endpoint/approveImpersonation or ../endpoint/rejectImpersonation
  5. That encrypted value will be contain the end user's Id and a unique reference to their workflow task instance
  6. As every request into OpenIDM needs to be authenticated, we'll route the request via OpenIG to add in an authentication header
  8. If approved...the workflow will provision the end users Id into the helpdesk operators account under an attribute called impersonationId

The architecture at a high level looks something like this:






The workflow then contains an intermediate timer event that is used to act as a stop watch - to basically reverse any changes that are made, acting like a temporal condition.

        <intermediateCatchEvent id="timer">


        <scriptTask name="Cleanup User" id="cleanupRequestingUser" >
                queryParams = ["_queryFilter": '/userName eq "'+startUserId+'"']
                userToPatch = openidm.query("managed/user", queryParams)

                patchParams = [[operation:'replace', field: 'idToImpersonate', value : ""]]
                openidm.patch('managed/user/'+userToPatch.result[0]._id, null, patchParams)

The code for the above sample is available here.