Data Connection Permissions via API

[maxksoll]

Hi all, 

today I was struggling a lot with data connections. My starting point was to have a workflow in a subscription and wanted to execute it through the Private Gallery API. It worked for me before so I was sure it should work, but unfortunately I received: "Unable to translate alias" what can mean basically anything.

So I started to investigate and tried all possibilities to make it happen (I thought the subscription of the workflow itself would be sufficient as a permission for the connection). First I checked if the service account (who triggers the API) has all required permissions, but turns out he had all of them. Afterwards I wasn't sure how this works in general.

Hours passed and finally I found the way it works. When the API is triggered the only user who needs permissions on the data connection is the owner of the executed workflow.

Am I wrong with this or can I handle this differently?

In my opinion it should check the permission of the subscription itself and not the owner of the workflow.

I hope you understand my problem.

(The server version is currently 2019.4)

Best regards

Max

[raychase · Accepted solution]

From my understanding, you are correct.  Shared data connections from the Gallery are linked to the published_revision_author_id.  If the user that published the latest revision of a workflow still has those connections shared with him/her, then the alias should resolve properly.

Having said that, it's worth noting that the actual integrated authentication to the data source the connection string references is tied to the run-as user (which may or may not be the published_revision_author) for that specific job.