Replies posted by Vincent Doppenberg

421 Replies

SanderAdam
Sidekick
SanderAdamSidekick
asked in Questions & Conversations

Indicium call is not functional anymore

Hello @SanderAdam,I don't think it's possible for the URL /indicium/open/iam/iam/usr to have ever worked, so the URL must have changed compared to when it did work previously.If you want to add a user by directly calling IAM's own API, the URL would be like this:/indicium/iam/iam/usrIf you want to add a user by calling a custom API of your own application, then URL would be like this:/indicium/open/iam/my_appl/my_process_flowThe /open/ segment is used exclusively to call process flows with the Custom API checkbox checked. There is no custom API process flow called ‘usr’ in IAM and there hasn’t been one in the past either.I hope this helps.

1
V
Moderator
17 hours ago
S
Apprentice
Sanne BuitelaarApprentice
asked in Questions & Conversations

File upload doesn't work in universal GUI

Hello @Sanne Buitelaar,The request in your first screenshot, with the 403 response, never arrived at Indicium. You can tell that this is the case by looking at the Server response header and the lack of response headers that are always added by Indicium (Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, X-Xss-Protection, Server-Timing).The 403 Forbidden response is caused by the AWS ELB load balancer that sits in front of Indicium. I'm not sure why the load balancer would give a 403 response, but many load balancers double as a Web Application Firewall (WAF) and this is also the case for the AWS ELB.It seems very likely to me that the request was rejected due to a false positive of one of the WAF rules. You should be able to find the cause of the rejection in the WAF logs. The solution will most likely involve changing or turning off one or more of the WAF rules. You can find more - hopefully useful - information here.I hope this helps.

4
S
Apprentice
3 days ago
Valentin
Rookie
ValentinRookie
asked in Questions & Conversations

Page not found when executing an API POST call

Hello @Valentin,The 403 response indicates that your request violates your permissions in some kind of way. To list a few options for a POST call on a table:You are not allowed to insert records on this table (no add permissions) You are providing a property in your JSON body that corresponds to an unauthorized, hidden or readonly column. Note that this includes when a layout procedure sets a column to hidden or readonly. You can only provide values for ‘regular’ columns. You are providing a value for a lookup column that falls outside of the locked lookup prefilters for that user.As to why the IAM metasource is not working, I suspect that this is an issue with permissions as well, or an incorrect application alias or ID. But it's hard to say for sure without more information regarding the error.I hope this helps.

4
Jeroen van den Belt
Administrator
5 days ago
Valentin
Rookie
ValentinRookie
asked in Questions & Conversations

Page not found when executing an API POST call

Hello @Valentin,The URL pattern is {serverURL}/{metaSourceIDorAlias}/{appIDorAlias}/{table name}.So for example, if we assume the following:The server URL is https://localhost/indicium We want to use IAM as the metasource The application alias is my_appl The table ID is my_tableThis would give you the following URL:https://localhost/indicium/iam/my_appl/my_tableAlternatively, it would be /sf/ to use the SF as the metasource. Other than that, the user that you are authenticating with must have sufficient permissions to access the application and the table in question. To validate whether you can access the application, you can perform a GET request on the following URL:https://localhost/indicium/iam/my_appl I hope this helps

4
Jeroen van den Belt
Administrator
5 days ago
Y
Rookie
YaraRookie
asked in Questions & Conversations

Importing data - Invalid OData URL error

Hello @Yara,The most likely explanation for this is that your Universal GUI is newer than your Indicium. The /start_commit endpoint is a rather new feature of Indicium to initiate an asynchronous import operation which cannot result in a timeout. If you have updated your Universal GUI, it will start using /start_commit, but if you have not updated your Indicium, it won't support it.I hope this helps.

2
Y
Rookie
20 days ago
Sulea Ema
Vanguard
Sulea EmaVanguard
asked in Questions & Conversations

HTTP POST error

Hello @Sulea Ema,What you are doing in Postman here:Is simply a querystring parameter, which is part of the request URL, not of the request body. To achieve that, you can simply add ?json={json} here: To be clear, the {json} part is a reference to your process variable called ‘json’. Its value will be inserted into the URL at that location. So it's really ?json={process_variable_id} and you enter the ID of the process variable that you want to be inserted at that location.As for the Content-Type and Content input parameters, I can't tell from your picture what you are sending in Postman:But perhaps you can simply leave both of them empty, as it looks like you're posting the data through the querystring parameter in the URL.I hope this helps.

4
Sulea Ema
Vanguard
26 days ago
Sulea Ema
Vanguard
Sulea EmaVanguard
asked in Questions & Conversations

HTTP POST error

Hello @Sulea Ema,It looks like the API that you are calling is expecting a property called “json” in the request body. I don't know which API you are calling, so it's hard for me to be more specific, but perhaps it's expecting the body to be like this?{ "json": [ { "first_name": "...", ... } ]}I hope this helps.

4
Sulea Ema
Vanguard
26 days ago
Harm Horstman
Superhero
Harm HorstmanSuperhero
asked in Questions & Conversations

Authentication method Indicium (Universal) for external applications

Hello Jeroen,The answer is actually both.When using the Authorization Code flow, the access tokens are user-specific authentication tokens that allow API access as that user (given that the API access checkbox is checked in IAM). When API calls are made using these access tokens, the dbo.tsf_user() function on the database will also return the expected username.The reason it seems like the authentication is client-based is because it is also client-based. Only valid (i.e. registered Client Applications in IAM) clients can request access tokens for users, using the Authorization Code flow. For this, the client_id and client_secret are used. After providing a valid client_id and client_secret, the login screen will be shown to the user, followed by a consent screen in which the user consents to giving certain access on behalf of the user to the client. When using the Client Credentials flow, a pure client-based authentication mode is used without an intervening login and consent screen f

10
V
Moderator
1 month ago
Jeroen de Klerk
Vanguard
Jeroen de KlerkVanguard

Indicium service health checkCompleted

Hello @Jeroen de Klerk We have implemented a health check endpoint some time ago, you can read more about it here. It already includes some of the capabilities mentioned in this idea, such as Service availability, Database connectivity and App version check.In the upcoming sprint we will also add support for the Database responsiveness capability. This will be based on how long it took to open a connection to the database. Note that this will give an indication of network and connection availability, but not of database I/O availability. Keep an eye on our release notes for this feature.It does not include Available memory, Available disk storage and Backup database connectivity and we currently have no plans to add these capabilities. These capabilities are much more limited in usefulness and involve much more complexity to implement. For monitoring to this extent, we'd recommend using Application Insights and/or tools at the Operating System level such as performance counters.

3
Jeroen van den Belt
Administrator
1 month ago
W
Apprentice
Wilfred BossenbroekApprentice
asked in Questions & Conversations

Indicium as service: license check log every 11 to 13 seconds?

Hello Wilfred,That's great to hear, thank you for posting the solution to the problem for future reference as well.

3
V
Moderator
1 month ago
W
Apprentice
Wilfred BossenbroekApprentice
asked in Questions & Conversations

Indicium as service: license check log every 11 to 13 seconds?

Hello @Wilfred Bossenbroek,It looks like your Indicium is not configured correctly and is restarting every 11-13 settings. The particular logging shown in your screenshot can only happen once, when Indicium is started, and after that it will not occur again until Indicium is restarted.From your description, my two best guesses areThe scheduled task that restarts Indicium every morning is not configured correctly and actually restarts Indicium constantly. NSSM is somehow restarting the Indicium service constantly.You can confirm or eliminate the first option by turning that scheduled task off.Another thing you could do is look at the Windows Event Viewer to see if you can find a reason for the shutdown/restart of the process.Aside from these points, NSSM does have the following known bug listed on their website, which indicates that an issue with privileges could be causing this:nssm may enter a crash and restart loop if run without administrator rights when privilege elevation is neede

3
V
Moderator
1 month ago
Jeroen de Klerk
Vanguard
Jeroen de KlerkVanguard
asked in Questions & Conversations

Configure expire-time of cookie in Indicium

Hello Jeroen,There is currently no way to configure the cookie expiration time. However, if a user checks the ‘Remember me’ checkbox when logging in, the user will be logged in for up to 14 days of being idle, or until the user logs out. Please note that when this checkbox is checked, the authentication cookie will survive browser restarts as well, so it is less suitable for shared devices because the user would have to explicitly sign out at the end of the session. Some more information can be found in this topic.If this is not a solution, then please submit an idea to make the expiration time configurable.

1
V
Moderator
1 month ago
P
Sidekick
Peter de WitSidekick
asked in Questions & Conversations

Session is expired in Universal GUI

Hello @Allard Lakerveld,No, this setting is not configurable. Do you have a specific use case?

6
A
Superhero
24 days ago
A
Apprentice
AlfonsMApprentice
asked in Questions & Conversations

Forgot Password not working despite Exchange setup.

Hello @AlfonsM,but returns an error on valid accounts (email address)Are you still getting this error? If so, can you have a look at Indicium’s error log and see if it contains more details regarding this error? If the details seem sensitive in nature, then I would recommend creating a ticket instead.Well. This messed things up a bit. I have made the changes to the appsettings and IAM as described, but it didn't work and the signon screen is now messed up.It seems like you have either configured an OpenID provider or Two-factor authentication in IAM, in both of these cases the Universal GUI can no longer handle the authentication itself and it will delegate this to Indicium. It is possible that email 2FA had already been configured on your user and that configuring an email provider in IAM caused it to enable.

5
Jeroen van den Belt
Administrator
19 days ago
P
Apprentice
Pierius Lycklama A NijeholtApprentice
asked in Questions & Conversations

OpenID with required PKCE still expects a client_secret

​Hello @Pierius Lycklama A Nijeholt,We enabled PKCE, because the application is publicly available. We did this because, according to the OAuth2.0 this is supposed to be secure:https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkceYes, this is an accepted OAuth flow for public clients, but not one that we support at this moment. We only support flows for confidential clients, i.e. clients that can safely store a client secret.We support PKCE on top of that because PKCE should not be seen as a replacement for a client secret for public clients, but rather a general security addition that is also recommended for confidential clients.We can make the client secret optional (and enforce PKCE when empty) in order to support public clients as well, I would recommend creating an Idea for this.We are building an application where the user need to authenticate via the Thinkwise Platform. So they can see data associated with their account.In my

3
V
Moderator
2 months ago
P
Apprentice
Pierius Lycklama A NijeholtApprentice
asked in Questions & Conversations

OpenID with required PKCE still expects a client_secret

Hello @Pierius Lycklama A Nijeholt,Is it possible to configure the Indicium authorization server to not require a client_secret for public clients using PKCE?No, this is currently not possible. Indicium offers no OpenID flow that is suitable for public clients and since PKCE is not a replacement for a client secret (i.e. it provides no means of client authentication), it is not sufficient to make a client confidential.Can you elaborate on why you would want or need to use OpenID for your use case?

3
V
Moderator
2 months ago
A
Captain
Alban_TCaptain
asked in Questions & Conversations

can we programatically manipulate the HTTP status code that is returned by a HTTP connector?

Hello @Alban_T,Yes, this is possible by using a custom protocol process flow. Please check this two part blog post on how you can achieve this. Note that when calling this process flow, the URL should contain an /open/ segment, like this:<indicium>/open/iam/my_appl/my_process_flowI hope this helps.

1
V
Moderator
2 months ago
P
Sidekick
Peter de WitSidekick
asked in Questions & Conversations

Session is expired in Universal GUI

Hello @Peter de Wit,If a user would like to remain signed in, then they can check the ‘Remember me’ checkbox in the Universal GUI Or, if they are redirected to the Indicium login screen, the ‘Stay signed in’ checkbox: The intended behavior has always been that the session expires after 30 minutes of being idle, unless this checkbox is checked. However this did not appear to work as intended in all cases, until a change that was made recently. The change itself was not directly related to session timeouts, but the behavior of the session timeout was affected as a side-effect. We did notice this change ourselves as well, but after investigation we realized that the previously intended session timeout did not always work and that the new behavior was in fact the intended behavior. And since the GUI now keeps the user signed in when the user ticks the box and does not keep the user signed in when the user does not tick the box, we did not make note of this in our release notes.My recommend

6
A
Superhero
24 days ago
E
Sidekick
ericbosmanSidekick
asked in Questions & Conversations

Indicium - Aborting schedule '...' of process flow - please give information

Hello @Arie V,I see that the error handling is not optimal in this scenario, I will make sure that this is addressed in the next release.This error is related to the second point, aborting system flows that were already scheduled, but had not yet started. Functionally this does work as intended, however, the message in the error log should have been more friendly.

6
V
Moderator
3 months ago
E
Sidekick
ericbosmanSidekick
asked in Questions & Conversations

Indicium - Aborting schedule '...' of process flow - please give information

Hello @ericbosman,I would expect the system flow to be terminated after 5 minutes in this case because, as stated earlier, I believe that the upper limit for the shutdownTimeLimit is 5 minutes. In addition to that, once a shutdown signal is sent, it will go through even if you remove the app_offline.htm file before the shutdown is finished.It is also important to realize that when the app_offline.htm file is present, the web application will no longer accept incoming requests, nor will it start a new instance of the web application until the file is removed. In other words, Indicium would be inaccessible for a long time. So there is a good reason why long shutdownTimeLimits should not be supported.When you have a very long running system flow that cannot be interrupted, I would not look for a solution where the shutdown signal is sent, but is ignored for long periods of time or even canceled after half an hour. Because if it is acceptable to cancel the shutdown, then apparently the shu

6
V
Moderator
3 months ago
E
Sidekick
ericbosmanSidekick
asked in Questions & Conversations

Indicium - Aborting schedule '...' of process flow - please give information

Hello @ericbosman,When Indicium receives a shutdown signal, it will do the following:Prevent new scheduled system flows from being picked up. Abort system flows that were already queued, but had not yet started. Await the completion of system flows that are in progress.We make an effort to do graceful shutdowns and allow all system flows that are in progress to finish, but in the end it is up to the web server to decide how long the process can be in the ‘shutting down’ state before it will simply end the process.In IIS, the default shutdown time limit is 90 seconds, so this means that system flows will have 90 seconds to finish up before IIS will end the process anyway. If necessary, the shutdownTimeLimit setting on the Application Pool can be used to increase (or decrease) the window of time in which system flows are allowed finish. More information on that setting can be found here. Despite there being no mention of this in Microsoft's documentation, I do believe there is an upper l

6
V
Moderator
3 months ago
Sulea Ema
Vanguard
Sulea EmaVanguard
asked in Questions & Conversations

Http connector error

Hello Sulea,The most obvious reason for this would be that the authentication settings on your HTTP connector are incorrect and don't in fact match with your authentication settings in Postman.However, what I wrote here may apply to this problem as well. Usually whenever people do the exact same request in an HTTP connector and in Postman/Insomnia, and one of them works while the other gives a 401 Unauthorized response, the reason is that Postman/Insomnia is not using the authentication settings that they think it is. This is because clients like Postman/Insomnia remember authentication cookies and these cookies supersede authentication settings on the request.So in your case, I would delete all cookies in Postman and then try the request again with the same authentication settings. You might find that you're now getting a 401 Unauthorized in Postman as well. Which simply means that your username and/or password are incorrect.I hope this helps.

2
V
Moderator
4 months ago
V
Moderator
Vincent DoppenbergModerator

Hotfix release - Indicium 2023.3.13.1

We have decided to roll back the change regarding the query generation for prefilters, as described in the release notes, pending the investigation of additional edge case issues. We will most likely re-release this change in the next release.

821
V
Moderator
4 months ago
P
Apprentice
Pierius Lycklama A NijeholtApprentice
asked in Questions & Conversations

How to restrict OpenID connect authentication on a client application

Hello @Pierius Lycklama A Nijeholt This issue has been resolved in version 2023.3.13.0 of Indicium, which is available now. The claims of custom resources for a user can be retrieved by calling the userinfo endpoint and providing the access token of that user as a bearer authentication token.GET/connect/userinfo 

6
V
Moderator
4 months ago
P
Apprentice
Pierius Lycklama A NijeholtApprentice
asked in Questions & Conversations

How to restrict OpenID connect authentication on a client application

Hello @Pierius Lycklama A Nijeholt,This issue will be resolved in the upcoming version of Indicium, which will be released later this week. After that, my previous suggestion should work for you.

6
V
Moderator
4 months ago

Badges

Show all badges
Terms & ConditionsCookie settings