Server-Side Scripts

Overview

In some cases, you'll want to perform a specific task that can be automated but needs access to the WorkflowGen GraphQL API; this use case is often in the form as a server-side script. For this, OAuth2 provides a type of grant called Client Credentials that simply exchanges a client ID and secret for an access token. There is no ID token since it's not part of the OpenID Connect standard and there's no user involved.

This section provides instructions on how to configure AD FS with a server-side script that has access to the GraphQL API.

Prerequisites

• Make sure to have a licensed copy of WorkflowGen installed and running on a server.

• Make sure to have administrative access to WorkflowGen.

• Make sure to have administrative access to AD FS to be able to configure it properly.

• Make sure to have successfully configured delegated authentication to AD FS on your WorkflowGen instance following the instructions in the AD FS authentication section.

AD FS configuration

Step 1: Register a new server application

1. In the AD FS Management window, navigate to the Application Groups folder, and double-click on the WorkflowGen group.

2. In the WorkflowGen Properties window, click Add application.

3. Select the Server application type, then click Next.

4. Configure the server application:

   1. Name: My Server Application

   2. Copy the client identifier, which you'll need for the client credentials grant flow. You won't be able to retrieve it afterwards.

   3. Add a redirect URI. Here, it doesn't matter what you enter because the client credentials grant doesn't use this value.

   4. Click Add, then click Next.

5. In the Configure Application Credentials window, generate a client secret for the server application:

   1. Check the Generate a shared secret checkbox.

   2. Copy the value; you'll need it for the client credentials grant flow.

   3. Click Next.

6. Review the configuration; once you've finished, click Next.

7. Click Close.

You should now see your new server application listed in the WorkflowGen application group.

Step 2: Grant access to the GraphQL API

Now that you've created your server application, you need to grant it access to the GraphQL API. To do this:

1. In the AD FS Management window, navigate to the Application Groups folder, and double-click on the WorkflowGen group.

2. In the WorkflowGen Properties window, double-click WorkflowGen GraphQL API.

3. On the Client Permissions tab in the WorkflowGen GraphQL API Properties window, click Add.

4. Click the server application that you created in the previous section, then click Add.

5. You should now see your server application in the list of client applications; make sure it's selected.

6. Make sure that the openid, profile, and email scopes are checked.

   
7. Click OK.

You've now registered your server application in AD FS and granted it access to the WorkflowGen GraphQL API.

WorkflowGen configuration

As with user provisioning, WorkflowGen needs to know which application is accessing the GraphQL API. Therefore, you have to register the application, which consists of your script.

Register a new application

1. On the Applications page in the WorkflowGen Administration Module, click New application.

2. Fill in the form:

   • Name: My Server Application

   • Description: A description that clearly identifies the script.

   • Type: Non Interactive Client

   • Impersonate username: Any username that has the required access to the GraphQL API.

   • Client ID: The client ID you copied earlier.

   • Active: Check this checkbox.

3. Click Save.

Your application should now appear in the list of applications.

You should now have the necessary components in place to make GraphQL API requests with your script by passing the access token received from AD FS from a Client Credentials Grant flow.