1 of 55

2.0.0 Forms

The service

Overview

Overview of Fortified ID Forms

Forms is an application for digitizing process flows. Examples can be creating users (e.g. employees, consultants, partners), editing users or listing "my users" or "my groups". With Forms you get access to a tool to create web-based flows to delegate the administration to the users responsible for certain information in a simple way.

With Forms, you can also build self-service flows and self-registration of users. In case of self-registration, a user proves himself with e.g. BankID where information is extracted and used to allow the user to create their own account.

We have a number of movies on how to work with forms in different scenarios. (note. All movies are in Swedish.)

Forms and IAM

Forms is a comprehensive Identity and Access Management (IAM) solution designed to streamline and adapt to the specific workflows of your organisation.

The modern landscape of IAM requires a balance between automation and control, and Forms offers both in a way that aligns with your internal processes. IAM solutions today need to be flexible enough to manage the complexity of access control across an organisation, especially as digital environments become more intricate and regulated. Forms IAM addresses this by providing customisable workflows that can be fully automated or augmented with manual checkpoints, ensuring both efficiency and accuracy. This flexibility is crucial in industries with stringent compliance requirements, where every access decision needs to be carefully monitored and validated. Forms IAM is available both on-premises and in the cloud, giving you the flexibility to deploy the solution in the environment that best suits your infrastructure and security requirements. Whether you are looking to maintain full control over your data in an on-prem deployment or leverage the scalability and convenience of the cloud, Forms IAM adapts to your strategy.

Additionally, Forms IAM integrates seamlessly with a wide range of common identity providers and data sources, including Entra ID (formerly Azure Active Directory), Google Cloud Identity, Microsoft Azure, Active Directory, and other leading platforms. This ensures that you can easily manage and centralise access controls across your existing ecosystems, without the need for complex custom integrations. The system allows administrators to configure workflows to match existing processes within the company. Whether it’s handling new employee onboarding, access revocation, or ongoing entitlement reviews, each flow can be automated for speed or include manual approval steps for sensitive actions. This adaptability ensures that the solution integrates seamlessly with your organisation’s existing protocols, rather than forcing a rigid, predefined process onto your teams. With scalable operations, capable of managing identity and access across both small businesses and large enterprises, Forms IAM can evolve alongside your organisation as it grows or its requirements change. In today’s rapidly evolving security environment, having a robust yet flexible IAM system like Forms ensures that your organisation can handle access control efficiently while maintaining the level of precision and oversight necessary for security and compliance.

Products in the Control suite

Other products in the Control family apart of Fortified ID Forms.

Fortified ID Automate

Automation provides the ability to read data from one or more systems, change or influence the data and then write it to one or more source systems. Examples could be reading data from an HR system and looking for newly created users, reading in these users and creating them in, for example, Active Directory, Google or Microsoft Entra ID. All without the influence of an administration or user.

Fortified ID Attest

Attest adds for Forms and Automation the ability to bring in approval flows. Instead of a user being created/changed directly, one or more users must approve this change.

An example could be requesting access to a group that protects a resource where, for example, a group administrator/owner must approve who gets access to the resource.

The solution can be installed locally, in the cloud or as a hybrid solution. The ability to easily move the solution between test and production environments has been made extremely easy. Read more about automation in our technical documentation.

Fortified ID Password Reset

Password Reset from Fortified ID simplifies the management of secure password reset for your organization.

Users can easily and securely create a new password through self-service without having to contact their employer's IT support.

Users with personnel responsibility (manager, teacher, partner/consultant manager) can reset passwords on behalf of another user.

Your organization becomes more efficient as the time that the end user does not have access can be greatly shortened. In addition, IT personnel can also devote themselves to more constructive and proactive work.

About this release

Release notes

Check the release notes to discover the latest updates and improvements in this version.

Breaking changes

If there are any breaking changes included in this release, carefully review them before upgrading to understand how they may impact your installation and to prepare for any necessary adjustments before or after the upgrade.

Release notes

This will highlight the most important items. For in depth detail contact Fortified ID.

First release with documentation.

As this is the first real version with accompanying documentation, there are no points in this section.

Breaking changes

Here we address changes that may cause previously working configurations to stop working after the update, if they are not adjusted to handle the changes below.

First release with documentation.

As this is the first real version with accompanying documentation, there are no points in this section.

Key components

The key components and how they relate to each other.

Overview of Flow, Step, Control and Pipes

Flow

On a high level, Forms delivers well defined "apps" with the soul purpose simplifying a process related to an "IAM-problem". Each app is called a Flow. A Flow have a set of basic properties. For example who may access, is it public, how do it consume authentication.

Step

Flow consists of a number of Steps. Each Step aims to guide the end user through the process. A simple Step could just consists of read only data about a user or a group.

Control

Every Step includes a number of Controls. A Control is some kind graphical entity used to let users read or write data. Just like a Flow or a Step a Control has a number of properties that will define it's behaviour.

By combining Flow, Step & Control small well-defined IAM apps can be built fast with instant added value.

Pipes

When a user wants to do something in the UI, such as retrieve or write data to a data source or process data, a pipe can be used. A pipe consists of a number of valves that can retrieve, write or process data. Pipes and valves are something that is found in all Fortified ID products and are shared between the products, so if you have knowledge of this from one of our other products, it works the same in Forms.

Flow

See a Flow as an app. It defines things like number of steps, path of access and if it is public or protected by authentication. A Flows aims to guide end-users performing a well defined IAM task.

Setting up a flow

The Flow is defined by a JSON file. Name of the file can be anything, but flow.json is a recommended name. Format of the data inside must be either JSON or JSONC. The flow.json file will be picked up, loaded and exposed by the Forms module.

{
    "name": "demo",
    "public": false,
    "require_roles": [
        "role00"
    ],
    "enable_progressbar": false,
    "show_user_menu": true,
    "verbose_logs": [
        "flow",
        "session"
    ],
    "buttons": {
        "next_button": {
            "enabled": true,
            "text": "flow00.next_button"
        },
        "save_button": {
            "enabled": true,
            "text": "flow00.create_button"
        },
        "restart_button": {
            "enabled": true,
            "text": "flow00.restart_button"
        }
    },
    "steps": "@include:steps/*.json",
    "pre_pipe": "forms.flow00.pre_pipe",
    "pipe": "forms.flow00.finalize",
    "incomplete": "@include:incomplete.json",
    "summary": "@include:steps/summary.json"
}

Before step 1

Sometimes it is necessary to perform some kind of logic before first step is rendered. Typically used for validation and or collecting data reqired in step 1.

For case like this use pre_pipe.

In order to consume data in subsequent steps, make sure the pipe returns one item. Data in this item will be accessible using {{flow.xxx}}

Authenication & authorisation

By default accessing a Flow requires authentication. Any authentication is expected to be handled by a trusted SAML IDP. Once authenticated, authorisation is based on the incoming SAML assertion.

How it is connected

In order for authentication to work, a SAML SP authenticator needs to be configured. Also, SAML SP need to share first part of URI in with Forms module.

Example

Forms module has "http_context" configured to "/forms". The SAML must have it's "http_context" set to "/forms/xxx" ("/forms/auth" is a good pattern).

Typically the properties regarding authentication in Forms module will look something like this:

"http_context": "/forms",
"http_auth_redirect_url": "/forms/authn/login",

On the SAML SP side configuration will look like this:

"http_context": "/forms/authn",
"success_location": "/forms/",

Once the user is authenticated data from incoming assertion vill be transfered to the session.

NameID vill be the users login identifier. Other attributes will be put in the session where multivalued attributes is merged into a comma separated list.

Filtering access to a Flow

Once authenticated all users by default can access a Flow. Restricting is based on roles attribute in the incoming assertion. By using the "requires_role" configuration parameter on the Flow restriction control is performed comparing the incoming "roles" in the assertion and data in "requires_role" for the Flow.

One value of "role" must match "requires_role" in order for user getting access.

Step

Steps are comparable to pages in a form, where each step includes sections that focus on a specific area. By linking steps, one can create highly customizable IAM solutions.

Creating a step

A step is represented by a json object. Steps can be loaded from one json file or multiple files. Recommended setup is to keep each step in a single file. This will simplify configuration and overview.

Name

Description

Default

Mandatory

Text shown in browser tab. Overrides overlay.

Forms - Fortified ID

Sort order of step. Omitting will result in undetermined execute order.

N/A

Favicon for this step.

Internal FortifiedID icon

Same as Flow but can override in a step

Empty array[]

List if controls for this step

N/A

Pipe to be executed moving to next step.

N/A

Same as for flow but can override in a step.

See Flow

Example step to create a user.

{
    "controls": [
        {
            "id": "top_text_label",
            "type": "Markdown",
            "data": "# Create an Active Directory user \nEnter information about the user you want to create."
        },
        {
            "id": "givenName",
            "type": "Input",
            "ui": {
                "ui:size": {
                    "md": 6
                }
            },
            "schema": {
                "format": "strict"
            },
            "config": {
                "type": "string",
                "required": true
            }
        },
        {
            "id": "sn",
            "type": "Input",
            "ui": {
                "ui:size": {
                    "md": 6
                }
            },
            "schema": {
                "format": "strict"
            },
            "config": {
                "type": "string",
                "required": true
            }
        },
        {
            "id": "mail",
            "type": "Input",
            "ui": {
                "ui:size": {
                    "md": 6
                }
            },
            "schema": {
                "format": "email"
            },
            "config": {
                "type": "string",
                "required": true
            }
        },
        {
            "id": "mobile",
            "type": "Input",
            "ui": {
                "ui:size": {
                    "md": 6
                }
            },
            "schema": {
                "format": "phone"
            },
            "config": {
                "type": "string"
            }
        },
        {
            "id": "chooseRole",
            "type": "ValuePicker",
            "ui": {
                "ui:size": {
                    "md": 6
                }
            },
            "config": {
                "required": false,
                "options": [
                    {
                        "title": "Human Resources",
                        "value": "hr"
                    },
                    {
                        "title": "Sale",
                        "value": "sale"
                    },
                    {
                        "title": "IT",
                        "value": "it"
                    },
                    {
                        "title": "Engineering",
                        "value": "engineering"
                    }
                ]
            }
        },
        {
            "id": "adUserFindManager",
            "type": "ActiveDirectorySingleSelect",
            "ui": {
                "ui:size": {
                    "md": 6
                }
            },
            "config": {
                "attributes": [
                    "cn"
                ],
                "namespace": "${globals.ldap1_name}",
                "base_dn": "${globals.ldap1_flows_search_user_dn}",
                "scope": "SUB",
                "pre_filter": "(distinguishedName={{flow.manager}})",
                "filter": "(cn={{search_query}})",
                "value_key": "distinguishedName",
                "display_key": "cn"
            }
        }
    ]
}

Example step to edit and find users.

{
    "controls": [
        {
            "id": "top_text_label",
            "type": "Markdown",
            "data": "# Change user\nSelect the user you want to modify"
        },
        {
            "id": "findActiveDirectoryUser",
            "type": "Selector",
            "config": {
                "columns": ["displayName","sAMAccountName","url","manager"],
                "pipe_id": "active_directory_edit_user_step01_widget"
            }
        }
    ],
    "pipe": "active_directory_edit_user_step01"
}

Example with all main properties.

{
    "document_title": "flow00.step01.document_title",
    "favicon": "favicon.ico",
    "order": 1,
    "verbose_logs": [
        "flow",
        "session"
    ],
    "time_lock": "PT3S",
    "controls": [],
    "pipe": "forms.flow00.step01",
    "buttons": {
        "next_button": {
            "enabled": true,
            "text": "flow00.step01.next_button"
        },
        "save_button": {
            "enabled": true,
            "text": "flow00.step01.create_button"
        },
        "restart_button": {
            "enabled": true,
            "text": "flow00.step01.restart_button"
        }
    }
}

Pipe execution

If configured, execution of a pipe is done with all data available to the step. This means data will vary depending on what step is executed.

Data from all previous executed steps will be sent to pipe and accessed in pipes using {{request. pattern.

Returning from pipe execution

In order to be able to access any data returned from a pipe, return a single item in a pipe.

Data will available using {{flow.xxx}} pattern.

Layout

Forms comes with ha default layout. It places controls from left to right.

All steps and summary pages use a layout grid with a base column width of 12. All controls, or children, can be specified to have different sizes and multiple breakpoints for different screen sizes.

All controls (or children of the grid) have a base width of 12, meaning that they fill the entire width of the grid. A child with the width of 6 will occupies half of the grid, a child with the width of 8 will occupy 2/3s of the grid.

The grid will fill its columns from left to right and fit up to 12 columns in each "row".

Sizes for the controls can be set in the ui [SKRIV HÄR, måste kanske ändra en grej i hur man konfar kommer jag på nu.]

All controls will be rendered into the layout according to the order that they are defined.

Each breakpoint (a key) matches with a fixed screen width (a value):

xs, extra-small: 0px
sm, small: 600px
md, medium: 900px
lg, large: 1200px
xl, extra-large: 1536px

Advanced layouts

For more advanced layout options you can also configure a "ui:grid" property on the ui for the step.

Using the "ui:grid" all other rendering will be bypassed, and only items found in the "ui:grid" will be rendered.

With "ui:grid" it is also possible to nest grids.

    "ui": {
      "ui:grid": {
        "spacing": 3,
        "items": [
          {
            "size": 12,
            "spacing": 2,
            "items": [
              {
                "size": { "xs": 12, "sm": 6 },
                "spacing": 3,
                "items": [{ "item": "firstName" }, { "item": "lastName" }]
              },
              {
                "size": { "xs": 12, "sm": 6 },
                "items": [{ "item": "helpText" }]
              }
            ]
          },
          {
            "items": [
              { "size": 8, "item": "address" },
              { "size": 4, "item": "postalCode" }
            ]
          }
        ]
      }
    }

Control

The smallest building block in a flow. Typically a Control is represented by some kind of visual component together with data from some data source.

Control types

Two categories of controls are available:

Basic
Advanced.

Basic controls are comparable to simple HTML inputs, such as checkboxes.

Advanced controls are more like mini-applications with specific goals. For example, they could display a list of Entra-ID users or groups as the first step in a Flow.

Both types are implemented on the front-end using react-jsonschema-form.

Structure of control configuration

All controls follow the same structure:

{
    "type": "<controlType>",
    "id": "<controlId>",
    "config": {
        "required": true,
        "read_only": false
    },
    "data": "<data>",
    "ui": {},
    "schema": {}
}

type: Defines what control to be used.

id: Unique identifier to the current flow. In subsequent pipe calls the id is sent to the pipe along with value(s) from the control and accessed in the piped using {{request.<id>}}

config: Block of control-specific configuration. Se each control for appropriate values.

data: Value to be injected in control.

ui: Any additional ui-related data sent to frontend, unfiltered. See https://rjsf-team.github.io/react-jsonschema-form/ UISchema for more information. Typically this is used for layout management.

schema: Any additional control-related data not available in current control implementation.

Binding data to a control

Data binding is typically done using "data" configuration for a control. Most likely date is set by using some template {{flow.givenName}}.

Not all controls rely on data. Read documentation for appropriate control.

Basic controls

Basic controls are comparable to simple HTML inputs, such as checkboxes.

Input

An input field control, similar to an HTML input.

Below is a screenshot of the control. This is from a create step where an admin has added Clarke and Kent in two input controls. Email and Mobile number has no value yet.

Scenarions when the control can be used:

Like above when an admin creates a new object and needs to add data about the object. You can add data controllers to an inout control to verify correct syntax, an @ for email adress, no characters for an mobile number.
You like to display data about an object. You search an LDAP directory and display a user with data about the user. The input control can be in edit or read-only mode.

Properties

Properties for Input control

Name

Description

Default

Mandatory

This is an example from a create step where values are to be added. Mail and mobile have checks for correct syntax.

This is an example from a create step where values are to be added from a session. In this scenario a user has logged in using Swedish BankID.

This is an example from a step where values are to be added from a previous step or from a pipe in a previous step.

Special notes for config.type and schema.format properties

The 'config.type' determines how the control is displayed in the view.

For the type 'string' the field can be validated before it is sent to the pipe or next step. The 'strict' validation is recommended as it blocks several common special characters not suitable for Pipe/Valve data handling. Postal is post address.

Markdown

Markdown is a lightweight markup language that you can use to add formatting elements to a step.

Add one or several labels and/or descriptions text elements to a step. Example below shows a markdowns example, one label and one description.

The example can be added as one markdown or two separate markdowns.

Configuration when one markdown

Note. When using several markdowns in one step, make sure the id is unique.

Link to basic syntax supported using Markdown

Properties

Markdown is a lightweight markup language that you can use to add formatting elements to a step.

Configuration

Name

Description

Default

Mandatory

This from a step where two lines of text, one heading and one paragraph with a line break between, using one markdown control.

This an example where three different markdowns are used in the same step. Note that each markdown need a unique id.

This an example with one markdown using lang-file to add data from a previous step. It combines string and variable data. For example. "You have selected Donald Duck." where Donald Duck is data from a previous step.

The top example is from a step. The below example is from a language file., en.json.

Link to basic syntax supported using Markdown

Click following link for a number of examples on how to use markdown in a step.

ValuePicker

A value picker component, that lets the user select a given value from a list.

The ValuePicker is often used as a drop-down list for admins to select predefined values from. See example below.

Properties

A value picker component, that lets the user select a given value from a list.

Name

Description

Default

Mandatory

Advanced controls

Advanced controls are more like mini-applications with specific goals. For example, they could display a list of Entra-ID users or groups as the first step in a Flow.

Selector

Use to find objects in data store, e.g. Active Directory. It performs searches using pipes and stores a selected value for next steps to consume.

Properties

Use to find objects in data store, e.g. Active Directory. It performs searches using pipes and stores a selected value for next steps to consume.

Configuration

Control type: Selector

Name

Desciption

Default value

Mandatory

Searching for object to show

To populate list of items in UI a pipe must be executed. List of items returned should at least contain properties defined in columns.

Data sent to pipe is:

search - containing user input if config -> search is set to true
columns - comma separated string of defined columns

Return data must be in a form of a list of items.

Data exposed to flow

When pressing Select, data exposed to flow is found using key if control id. Value is item id returned from pipe

ActiveDirectoryUserEditGroupMember

Update group membership for a selected user.

Use this control to manage groups for a selected user. Note. To select the user, which often is done in a previous step, use the control Selector.

Properties

Update group membership for a selected user.

Requirements

An LdapClient module deployed with matching name as defined in "namespace".

Configuration

Control type: ActiveDirectoryUserEditGroupMember

Name

Desciption

Default value

Mandatory

This control works in conjunction with LdapClient module. It must be installed.

Exposed data to flow

Object array, "ad_pending_remove" - contains data on what groups to remove from user.

Object array, "ad_pending_add" - contains data on what groups to add to user.

Array data will have the syntax:

Valves used in finalize pipe

ActiveDirectoryAddMemberToGroups

Used to add a single group member to groups

ActiveDirectoryRemoveMemberFromGroups

Used to remove a single group member from groups

ActiveDirectoryGroupEditGroupMember

Manage group members for a selected Active Directory group.

Use this control to manage group members for a selected groups. Note. To select the group, which often is done in a previous step, use the control Selector.

Properties

Manage group members for a selected Active Directory group.

Requirements

An LdapClient module deployed with matching name as defined in "namespace".

Configuration

Name

Desciption

Default value

Mandatory

This control works in conjunction with LdapClient module. It must be installed.

Exposed data to flow

Object array, "ad_pending_remove" - contains data on what members to remove from group.

Object array, "ad_pending_add" - contains data on what members to add to group.

Example data in finalize pipe:

Valves used in finalize pipe

ActiveDirectoryAddGroupToMembers

Used to add group members to a specified group

ActiveDirectoryRemoveGroupFromMembers

Used to remove group members from a specified group

ActiveDirectorySingleSelect

Use to select one option from a list that is populated from the result of an LDAP query.

Below is a screenshot of the control. This is from a create step where an admin like to choose a manager for a user to be created.

Properties

Use to select one option from a list that is populated from the result of an LDAP query.

Configuration

Name

Desciption

Default value

Mandatory

Search filter

The search filter is a template that has access to all data that is available in the flow. Additionally, the template can use the parameter search_query, that contains the user input.

The attributes defined by display_key and value_key are always queried.

Attestor

Allows for users to accept or reject work-orders.

User mapping

For an order to be displayed in the list selection is made base on user login subject. Most likely the SAML NameID attribute from SP login.

Properties

Allows for users to accept or reject work-orders.

Configuration

Name

Desciption

Default value

Mandatory

This control works in conjunction with WorkOrder module. It must be installed.

EntraGroupSelect

Find an Entra ID group based on search data

Use this control to find and selected a Microsoft Entra ID group. Note. When group is selected you might like to mange members for the group. Use the control EntraGroupEditGroupMember.

Requirements

An Entra ID module deployed with matching name as defined in "namespace".

EntraGroupEditGroupMember

Edit Entra ID group, update group members

Use this control to manage users for a selected group. Note. To select the user, which often is done in a previous step, use the control EntraGroupSelect.

Requirements

An Entra ID module deployed with matching name as defined in "namespace".

An Entra ID identifier, "selected_entra_id", located in either session or flow. Data is taken from session first and flow second. selected_entra_id must reference a Entra ID group.

EntraUserSelect

Find an Entra ID user based on search data

Use this control to find and selected a Microsoft Entra ID user. Note. When user is selected you might like to manage groups for the user. Use the control EntraUserEditUserMember.

Requirements

An Entra ID module deployed with matching name as defined in "namespace".

Properties

Find an Entra ID user based on search data

The configuration is divided in two blocks, config & ui where config parameters are marked as config.<parameter name> and ui parameters are marked as ui.<parameter name>.

See the Example tab for a full example.

Name

Desciption

Default value

Mandatory

In this scenario the grid will contain two columns. The query will also be executed before grid is displayed. This is what "ui:search": false will do, if you add true the grid will let you add Bob* before search is executed.

In addition to example 1 this grid will also contain the manager of the users returned.

This control works in conjunction with EntraID module. It must be installed.

Only showing used by end user

Set owned_users_only_attribute will cause control match the data from owned_users_only_attribute. Matching is done using data from owned_users_only_attribute and entra_identifier.

entra_identifier is read from session or flow. Session read first then flow.

Settings "owned_users_only_attribute":"manager", will match value from entra_identifier with id in "manager". Only showing users where user is set to owner.

Exposed data to flow

"selected_entra_id" - id of selected group

"selected_entra_displayName" - display name of selected group.

EntraUserEditGroupMember

Edit Entra ID user, update group membership.

Use this control to manage groups for a selected user. Note. To select the user, which often is done in a previous step, use the control EntraUserSelect.

Requirements

An Entra ID module deployed with matching name as defined in "namespace".

An Entra ID identifier, "selected_entra_id", located in either session or flow. Data is taken from session first and flow second. selected_entra_id must reference a Entra ID user.

Properties

Edit Entra ID user, update group membership.

The configuration is divided in two blocks, config & ui where config parameters are marked as config.<parameter name> and ui parameters are marked as ui.<parameter name>.

See the Example tab for a full example.

Name

Desciption

Default value

Mandatory

In this example grid will have two columns.

In this example the grid will have three columns where the owner columns contain the user managing the group.

This control works in conjunction with EntraID module. It must be installed.

Exposed data to flow

Object array, "entra_pending_remove" - contains data on what groups to remove from user.

Object array, "entra_pending_add" - contains data on what groups add to user.

Array data will ha the syntax:

[{"id":"1234567","displayName":"Group 1"}]

TextArea

Use to display text from a text file. Markdown is supported as well as templating: {{flow.xxxx}} etc. Currently translation is not supported

Properties

Use to display text from a text file. Markdown is supported as well as templating: {{flow.xxxx}} etc. Currently translation is not supported

Name

Desciption

Default value

Mandatory

Windows

To install on Windows, click the following link:

When installation is completed, verify the following:

In Windows Services, verify that Fortified ID Forms service exists
In file system, verify that drive:\Program Files\FortifiedID\forms exits

By default Forms use HTTP port 8080.

Access http://<host:8080>/forms/demo1 or http://<host:8080>/forms/demo2

Docker

Using a docker container

Verify using:

By default Forms use HTTP port 8080.

Access http://<host:8080>/forms/demo1 or http://<host:8080>/forms/demo2

Modules

User interface (UI)

Step

Steps are comparable to pages in a form, where each step includes sections that focus on a specific area. By linking steps, one can create highly customizable IAM solutions.

Creating a step

Name

Description

Default

Mandatory

document_title

Text shown in browser tab. Overrides overlay.

Forms - Fortified ID

order

Sort order of step. Omitting will result in undetermined execute order.

N/A

time_lock

Used as a robot mitigator. How long before a step is allowed to be posted back to the server. Format conforms to

favicon

Favicon for this step.

Internal FortifiedID icon

verbose_logs

Same as Flow but can override in a step

Empty array[]

controls

List if controls for this step

N/A

pipe

Pipe to be executed moving to next step.

N/A

buttons.xxx

Same as for flow but can override in a step.

See Flow

Example step to create a user.

{
    "controls": [
        {
            "id": "top_text_label",
            "type": "Markdown",
            "data": "# Create an Active Directory user \nEnter information about the user you want to create."
        },
        {
            "id": "givenName",
            "type": "Input",
            "ui": {
                "ui:size": {
                    "md": 6
                }
            },
            "schema": {
                "format": "strict"
            },
            "config": {
                "type": "string",
                "required": true
            }
        },
        {
            "id": "sn",
            "type": "Input",
            "ui": {
                "ui:size": {
                    "md": 6
                }
            },
            "schema": {
                "format": "strict"
            },
            "config": {
                "type": "string",
                "required": true
            }
        },
        {
            "id": "mail",
            "type": "Input",
            "ui": {
                "ui:size": {
                    "md": 6
                }
            },
            "schema": {
                "format": "email"
            },
            "config": {
                "type": "string",
                "required": true
            }
        },
        {
            "id": "mobile",
            "type": "Input",
            "ui": {
                "ui:size": {
                    "md": 6
                }
            },
            "schema": {
                "format": "phone"
            },
            "config": {
                "type": "string"
            }
        },
        {
            "id": "chooseRole",
            "type": "ValuePicker",
            "ui": {
                "ui:size": {
                    "md": 6
                }
            },
            "config": {
                "required": false,
                "options": [
                    {
                        "title": "Human Resources",
                        "value": "hr"
                    },
                    {
                        "title": "Sale",
                        "value": "sale"
                    },
                    {
                        "title": "IT",
                        "value": "it"
                    },
                    {
                        "title": "Engineering",
                        "value": "engineering"
                    }
                ]
            }
        },
        {
            "id": "adUserFindManager",
            "type": "ActiveDirectorySingleSelect",
            "ui": {
                "ui:size": {
                    "md": 6
                }
            },
            "config": {
                "attributes": [
                    "cn"
                ],
                "namespace": "${globals.ldap1_name}",
                "base_dn": "${globals.ldap1_flows_search_user_dn}",
                "scope": "SUB",
                "pre_filter": "(distinguishedName={{flow.manager}})",
                "filter": "(cn={{search_query}})",
                "value_key": "distinguishedName",
                "display_key": "cn"
            }
        }
    ]
}

Example step to edit and find users.

{
    "controls": [
        {
            "id": "top_text_label",
            "type": "Markdown",
            "data": "# Change user\nSelect the user you want to modify"
        },
        {
            "id": "findActiveDirectoryUser",
            "type": "Selector",
            "config": {
                "columns": ["displayName","sAMAccountName","url","manager"],
                "pipe_id": "active_directory_edit_user_step01_widget"
            }
        }
    ],
    "pipe": "active_directory_edit_user_step01"
}

Example with all main properties.

{
    "document_title": "flow00.step01.document_title",
    "favicon": "favicon.ico",
    "order": 1,
    "verbose_logs": [
        "flow",
        "session"
    ],
    "time_lock": "PT3S",
    "controls": [],
    "pipe": "forms.flow00.step01",
    "buttons": {
        "next_button": {
            "enabled": true,
            "text": "flow00.step01.next_button"
        },
        "save_button": {
            "enabled": true,
            "text": "flow00.step01.create_button"
        },
        "restart_button": {
            "enabled": true,
            "text": "flow00.step01.restart_button"
        }
    }
}

Pipe execution

If configured, execution of a pipe is done with all data available to the step. This means data will vary depending on what step is executed.

Data from all previous executed steps will be sent to pipe and accessed in pipes using {{request. pattern.

Returning from pipe execution

In order to be able to access any data returned from a pipe, return a single item in a pipe.

Data will available using {{flow.xxx}} pattern.

Properties

Find an Entra ID group based on search data

The configuration is divided in two blocks, config & ui where config parameters are marked as config.<parameter name> and ui parameters are marked as ui.<parameter name>.

See the Example tab for a full example.

Name

Desciption

Default value

Mandatory

type

Must be EntraGroupSelect

N/A

config.namespace

Identifier of EntraID module to use

"default"

config.columns

List array with columns to display

["displayName","description"]

config.search_attributes

List array with columns used for searching. Search is done using "starts with".

["displayName","mail"]

config.owned_groups_only_attribute

If set, groups will filtered based on the attribute.

N/A

ui.ui:search

Should search input be visible for end user, true/false

true

ui.ui:submit_on_change

Should selection of an item move to next step. true/false

false

{
    "id": "<enter_unique_id_for_this_control>",
    "type": "EntraGroupSelect",
    "config": {
        "namespace": "tenant1",
        "columns": [
            "displayName",
            "description"
        ]
    },
    "ui": {
        "ui:search": false,
        "ui:submit_on_change": true
    }
}

In addition to example 1 this grid will also contain the owners of the groups returned.

{
    "id": "<enter_unique_id_for_this_control>",
    "type": "EntraGroupSelect",
    "config": {
        "namespace": "tenant1",
        "owned_groups_only_attribute": "owners",
        "columns": [
            "displayName",
            "description",
            "owners"
        ]
    },
    "ui": {
        "ui:size": {
            "md": 12
        },
        "ui:submit_on_change": true,
        "ui:search": false
    }
}

This control works in conjunction with EntraID module. It must be installed.

Only showing groups by end user

Set owned_groups_only_attribute will cause control match the data from owned_groups_only_attribute. Matching is done using data from owned_groups_only_attribute and entra_identifier.

entra_identifier is read from session or flow. Session read first then flow.

Settings "owned_groups_only_attribute":"owner", will match value from entra_identifier with id in "owner". Only showing groups where user is set to owner.