Product updates
Ideas
Groups
E-learning
Documentation
Events

Community
Search

Replies posted by Vincent Doppenberg

420 Replies

Newest first

Oldest first

Arie VSuperhero

Custom login screens with different default Login settingsCompleted

Hello Arie,It's not necessary, but Indicium is the one that tells the Universal GUI via a response header to redirect whenever there are authentication options configured that only Indicium can handle. This response header can occur on any request and it's not feasible to have the Universal GUI attach the new authentication provider hint parameter on every request. So Indicium doesn't know which authentication providers should be available at the moment that it instructs the Universal GUI to redirect. And the Universal GUI will apply this new parameter when it is already redirecting to Indicium, to limit the options.So it's not feasible to implement this in Indicium, however, the Universal GUI could simply ignore Indicium's redirect instructions if only LocalLogin is available - which it can handle by itself. I haven't checked ticket 6355, but it would have to be a change request for the Universal GUI. I agree that it would make a lot of sense for it to work this way.I hope this clarif

Arie VSuperhero

asked in Questions & Conversations

OAuth login connector - oauthredirecturi Extended property not working?

Oh that's good to know, I thought this might have been urgent for that release that was mentioned. In that case I will only send the version with extra logging so we can sort out the reverse proxy settings. I'm pretty confident that we can get this to work, but it's difficult to determine the issue from the outside. It's probably a good idea for us to make this logging permanent for that very reason.

Arie VSuperhero

asked in Questions & Conversations

OAuth login connector - oauthredirecturi Extended property not working?

Hello Arie,We can offer the extended property as a temporary solution, however, I would like to send you a version of Indicium with some additional logging as well, to get the reverse proxy configuration to work. Once this works as intended, the extended properly will no longer be necessary.I'll send both versions to you tomorrow.

asked in Questions & Conversations

Save credentials for M2M communication on Azure

Hello Boudewijn,Without knowing the entire context, a typical way to do authentication in machine to machine scenarios is OAuth 2.0 Client Credentials. This will be supported by the platform as of version 2023.2. A solution that could already work is using the OAuth 2.0 Authorization Code flow and bootstrapping it manually one time, to obtain a refresh token and then using that refresh token to continuously obtain new access tokens and refresh tokens.Both of these options still require a client_id and client_secret to be stored somewhere though, but storing this information in some kind of configuration file on the server is usually reasonable.

asked in Questions & Conversations

Self registration and SSO via Azure Active Directory B2C?

Hello Boudewijn,Despite having no experience with Azure AD B2C specifically, I can't think of a reason why this wouldn't work. It should work exactly the same as any other OpenID provider. And yes, you can set up user provisioning in IAM to create IAM users automatically.

asked in Questions & Conversations

Opening CORS for API-calls after go-live

According to our partner, “security auditors will frown upon a proxy-solution”.I honestly don't see why, perhaps they could elaborate on this. To be clear, I'm talking about a self-hosted, reverse proxy. It can simply be companydomain.com/indicium which performs HTTP passthrough to azuredomain.com/indicium.As for what to use as a reverse proxy, you can configure IIS to be a reverse proxy for instance. We have documentation on that here. You could also use nginx or another webserver.I'm not sure about storing the credentials in Azure and having the reverse proxy supply them, this doesn't seem like the most obvious solution to me, if it's even possible. A reverse proxy doesn't really integrate, it just forwards requests and responses. If it doesn't feel secure enough to have the client application handle the credentials for the requests to Indicium, then it is an option to have the reverse proxy inject the credentials into requests, but it would probably be some kind of configuration of

asked in Questions & Conversations

Opening CORS for API-calls after go-live

To add to my answer, if your situation is indeed the third case, then I don't think there's anything wrong with using a proxy, I would say that this is the correct solution. The proxy can be limited to only send requests to Indicium on Azure.

asked in Questions & Conversations

Opening CORS for API-calls after go-live

Hello Boudewijn,It's not CORS that prevents these interactions, it's the Same Origin Policy (SOP) that all modern browsers use. CORS is actually the mechanism through which you can poke holes in this SOP to allow for some exceptions.CORS is by itself will not be enough, because CORS only governs whether a request is allowed to be sent or not, but browsers also apply this policy to determine if cookies can be sent. So, cookies will also need to be configured to be allowed to be sent on cross origin requests. In doing so, the browser will mandate HTTPS, which is fine, but it still won't work in incognito windows, until the user flips the the radio button to allow third party cookies. So due to all of these issues and the fact that it is simply a bad practice for security to begin with, we don't advocate for a solution like this. We've also found that it's usually not necessary to use a solution like this either. Can you elaborate on your use case regarding integration? Is there a web app

Richard EldermanSidekick

asked in Questions & Conversations

Devexpress not working in two-Universal-sites custom IIS deployment setup

Hello @Richard Elderman,The hotfix is now available in TCP.

Richard EldermanSidekick

asked in Questions & Conversations

Devexpress not working in two-Universal-sites custom IIS deployment setup

Hello @Richard Elderman,Having read the link you sent, am I right that the solution, if any, must be implemented in Indicium's source code??It’s a matter of updating a Microsoft library that Indicium uses to connect to the database. The issue was in Microsoft’s code and they appear to have solved it. I can update the package and release a hotfix for you.However, since the issue appears to be related to “Failover” I have some doubts that this will be the full solution. Because it sounds like the connections fails, it tries to perform some kind of failover and then it crashes there. But I could be wrong, perhaps this is the full solution to your problem. At the very least I would expect a better error message after updating.I will leave a reply here where the hotfix is ready, so you can try it. It will have version number 2023.1.13.3.

Richard EldermanSidekick

asked in Questions & Conversations

Devexpress not working in two-Universal-sites custom IIS deployment setup

Hello @Richard Elderman,This looks like an issue in Microsoft’s SqlClient library. This appears to be the same issue as the one you are having. One of the replies in that thread says that this issue occurs on Amazon RDS instances with Multi-AZ mode. Is this something that you have configured recently?

Diana KuipersModerator

Release notes Indicium 2023.1.13release notes

Hello everyone,We have released a hotfix for this version of Indicium with version number 2023.1.13.1. This hotfix resolves an issue that would cause Indicium’s error log to be flooded with messages indicating that system flows are already running. This issue could occur when multiple Indiciums were targeting the same IAM database and this IAM database contained system flow schedules.Our apologies for any inconvenience caused by this issue.

Arie VSuperhero

asked in Questions & Conversations

OAuth login connector - oauthredirecturi Extended property not working?

Hello Arie,Your configuration looks correct, but I can't vouch for the IP spaces that you configured. Since it’s not working, my main guess would be that they're not correct or that you didn't restart Indicium.Where you did you find these IP spaces?

Richard EldermanSidekick

asked in Questions & Conversations

DNS resolving for two universals on the same server

Hello @Richard Elderman and @Arie V,My suggestion was actually to have three websites, two that deliver the static content of the Universal GUI and don’t require an Application Pool and a third one that hosts Indicium and has an Application Pool. But I failed to consider that the third website would need to have a different subdomain, which leads to the issue of cross origin requests and cookies that will be blocked by the browser.My suggested setup would work if the two Universal GUIs did not use a different subdomain, in which case you could even put all three of them in a single website. For instance:myserver/universal1 myserver/universal2 myserver/indiciumHowever, this is not quite as nice as using subdomains. This could be fixed by adding a reverse proxy in front of it, which would do the following routing:subdomain1.myserver → myserver/universal1 subdomain1.myserver/indicium → myserver/indicium subdomain2.myserver → myserver/universal2 subdomain2.myserver/indicium → myserver/indi

Peter KruisCaptain

asked in Questions & Conversations

Win vs Universal Task parameter

Hello @Alban_T and @Peter Kruis,This issue has been fixed and is scheduled for release on March 17th.

tiagoVanguard

asked in Questions & Conversations

Using API to update on the database with a custom screen

Hello Freddy,This is definitely something to consider. The Universal GUI is of course one of the primary consumers of Indicium's API and it will only need the detail reference if show detail is checked. However I understand your situation as well. I think it could be a nice idea to have separate checkboxes for the UI and API or ignore ‘Show detail’ and ‘Show lookup’ in Indicium and allow the API to be limited through permissions.Could you create an idea for this?

tiagoVanguard

asked in Questions & Conversations

Using API to update on the database with a custom screen

Hello Freddy,It could be several things, I would start by trying:GEThttps://prova.lef.tec.br/indicium/sf/esm/service_task(tenant_id=1, service_id=1106, service_task_id=745)If this one does not work, then tenant_id (int), service_id (int) and service_task_id (int) is not the primary key of service task.GEThttps://prova.lef.tec.br/indicium/sf/esm/service_task(tenant_id=1, service_id=1106, service_task_id=745)/detail_ref_service_task_service_task_dependency_properIf this one does not work, then ref_service_task_service_task_dependency_proper is not a detail reference of the source table service_task. The reason could also be the permissions of the user making the request, i.e. service_task or the detail reference is unavailable to that user.I hope this helps.

tiagoVanguard

asked in Questions & Conversations

Using API to update on the database with a custom screen

Hello tiago,You are most likely supplying a hidden or readonly property in your JSON request body. It looks like you are trying to insert a record into a detail subject and you're supplying the key values from the parent subject as well, which are most likely hidden or readonly.The way to insert a value into a detail subject is like this.URL:https://prova.lef.tec.br/indicium/sf/esm/service_task(tenant_id=1, service_id=1106, service_task_id=743)/detail_ref_service_task_service_task_dependencyJSON body:{ "previous_service_task_id": 740, "connection_type": 0, "tsf_user": "PROVA\tiago", "transaction_date": "2023-01-19T11:29:27.067Z"}Please note that I have made a few assumptions here which might be incorrect:The parent subject is service_task The primary key of service_task is tenant_id, service_id, service_task_id The ID of the detail reference between service_task and service_task_dependency is ref_service_task_service_task_dependency.If any of these assumptions are incorrect

Richard EldermanSidekick

asked in Questions & Conversations

DNS resolving for two universals on the same server

That's great to hear Richard, I'm glad it all worked out. We will look into adding additional information on this topic to our documentation.Were there any additional pitfalls regarding the New-Website command or the parameters.xml, aside from the x64 version of PowerShell that you would like to share for our documentation? Or perhaps some other steps that were not mentioned explicitly in this topic?

Arie VSuperhero

asked in Questions & Conversations

OAuth login connector - oauthredirecturi Extended property not working?

Hello Arie,Regarding this:Configuring KnownNetworks / fixed IP-addresses is explicitly something we don't want for services in a Cloud environment. As also warned for by AWS in the link you provided:Important: The IP addresses for Classic Load Balancers and Application Load Balancers change over time. Avoid using this information to statically configure your applications to point to these IP addresses.The KnownNetworks configuration allows you to specify a so called CIDR block which covers an entire subnet. Usually when an IP address is dynamic, it remains within the same subnet, this is the case for proxies on Azure for instance. So for example, the CIDR block 10.10.0.0/16 covers the entire 10.10.x.y set of IP addresses. However I'm not certain that AWS's dynamic IP addresses also stay within the same subnet, it's difficult to find good documentation on this.Could you try to set up the KnownNetworks with the current IP space of your ALB just to confirm that this would work as a soluti

Cees HameeteRookie

asked in Questions & Conversations

indicium as rest api, how to assing user/role rights while using bearer tokens

Hello Cees,Our documentation on how to configure roles with different permissions can be found here. And our documentation on how to create user groups and assign roles to them can be found here.And finally, our documentation on how to set up Indicium as an OpenID Identity Provider and use Bearer tokens for authentication can be found here.I hope this helps

FreddyThinkwise Local Partner Brasil

asked in Questions & Conversations

Bug indicium? - Recursion on delete action view?

Hello Freddy,Given the error message, I can only conclude that there must be some kind of recursion occuring through one of the following causes:The view contains a CTE in its definition that uses recursion. This includes selecting from or joining with another view which might contain a CTE, and so on. The view has an instead of delete trigger and this trigger contains insert, update and/or delete statements which keep triggering additional insert, update and/or delete triggers. Or select, insert, update or delete statements on other views which contain a recursive CTE. The view does not have an instead of delete trigger, but SQL Server is able to resolve the delete statement itself on the base table(s) of the view. These base table(s) have delete triggers which in turn do insert, update and/or delete statements which trigger additional triggers, etc. Or select, insert, update or delete statements on other views which contain a recursive CTE.Either way it should boil down to a recursiv

Arie VSuperhero

asked in Questions & Conversations

OAuth login connector - oauthredirecturi Extended property not working?

Hello Arie,To follow up on my previous answer, I think the problem could be caused by not having specified KnownNetworks in Indicium’s reverse proxy settings. I’ve seen this happen before with Azure Front Door for instance.You will have to find the IP range of the ALB which is sending the traffic to Indicium. This link might help. And then configure it similar to how it is described here.If this solves your problem, please let us know so we can update our AWS documentation accordingly.

Arie VSuperhero

asked in Questions & Conversations

OAuth login connector - oauthredirecturi Extended property not working?

Hello Arie,While this would fix your problem, it should not be necessary for the ALB to communicate over https with the EC2 server. This is exactly what the purpose of the X-Forwarded-Proto header is. The ALB should send an X-Forwarded-Proto header to Indicium on the EC2 server to tell Indicium: “Even though this request was done via http, my external address is actually https”. This knowledge allows Indicium to use https for all of the URLs it generates and communicates back to the Universal GUI.With that said, I’m not sure why your configuration isn’t working, because the ALB should be sending the X-Forwarded-Proto header. I think you can remove the CustomHeaders section from the appsettings, but I’m not certain that this will fix the problem.As for the extended property, there is no need for the Universal GUI to implement this. Indicium determines the return URL that is used and it does so based on the requests it received. This issue should be completely solved if we can get the AL

Arie VSuperhero

asked in Questions & Conversations

OAuth login connector - oauthredirecturi Extended property not working?

Hello Arie,On second thought, you shouldn’t need this extended property for the Universal GUI with Indicium. The return URL will be based on the request URL that arrives at Indicium. The fact that it turns into http:// indicates that there is a reverse proxy which handles https:// and communicates to Indicium over http://.The issue here is mostly likely caused by the lack of a proper Reverse Proxy configuration for Indicium, as documented here.I hope this helps.

1
2
3
4
5
6
7
8
...
17

Page 5 / 17

Badges

Dennis Kallanseehas earned the badge Geek
Alban_Thas earned the badge Generator
martijngaasbeekhas earned the badge Preparator
SanderAdamhas earned the badge Preparator
Robert Wijn 2has earned the badge Adapter

Show all badges

Powered by Gainsight

Terms & Conditions Cookie settings

Sign up

Already have an account? Login

Login

Login to the Thinkwise Software Community

Login

Enter your username or e-mail address. We'll send you an e-mail with instructions to reset your password.

Username or e-mail

Back to overview

Scanning file for viruses.

Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.

OK

This file cannot be downloaded

Sorry, our virus scanner detected that this file isn't safe to download.

OK