Schedule from Designer with Credentials ?

[sraynal]

Hi, 

As an Administror I can require users to enter their  credentials before scheduling a workflow on the Gallery : 

It works well on the Gallery Schedule, they have to enter their credential :

Then, the workflow is executed on "Run As" mode, with their own user connexions. So users have only access to their data.

However, they can still Schedule without credential using the Designer / Controller Schedule: 

Without credential, the worklow is executed by a default user, which can cause security problem.

Two questions :

- Is it possible to require credential when a user schedule a workflow on a Controller (not on gallery) ?

- How to execute a workflow with "Run as" mode on Controller Schedule ? 

Kind regards

[echuong1]

General users should NOT be accessing the installation of Designer on the Server machine. That is to be used for debugging purposes. Accessing this machine has security risks and you also risk taking away resources from your Server. Given that, users shouldn't be scheduling directly on there either.

You are correct in that it would run as the local service account. However, you can set run-as credentials for the Server as a whole in the system settings if needed.

[sraynal]

Hi, 

Thanks for this fast answer.

"General users should NOT be accessing the installation of Designer on the Server machine."

=> Yes, users don't have access to the server.
They schedule with their client Designer on their own computer (with "Controller" not "Gallery").

" However, you can set run-as credentials for the Server as a whole in the system settings if needed."

=> Yes, we have set "Run as different user" to a technical account.

Let say this account can access to table "Table_01", "Table_02", "Table_03".

When a user schedule, on their designer client, using the Controller, the workflow is run with the technical account.

So the user can get data from "Table_01", "Table_02", "Table_03" even if he has only access to "Table_01".

That's a security problem that could be solved by asking users to enter their credential when they schedule a worklow with the Controller.