Managing Workflow Security

Workflow creators are permitted to write workflow-embedded Java code to facilitate the execution of the workflow process. This embedded Java code is executed on the server, and there are no restrictions on the APIs available for use.

Considering this capability, an additional level of control has been provided for the site administrator to prevent a user who is not a member of at least one of three specific site context groups (Administrators, Workflow Administrators, or Workflow Author) from embedding Java code in workflows.

A user with permissions to create workflow templates (for example, a project manager) could potentially add malicious code in one of the workflow expressions, causing a possible security threat. For this reason, workflow templates that contain Java expressions must be written, reviewed, and thoroughly tested by individuals that are trusted by the organization.

The Workflow Template Administration link is available on the Utilities page of Site

, Organizations , Libraries , and Products . Although it is not available

on the Project Utilities page, a Project Manager could potentially obtain the URL for the utility and access it by typing the URL directly into a browser address bar.

The following sections provide more detail about the roles that can author workflow processes, the site context groups that allow Java code to be embedded, and the areas that are disabled when a user is prevented from embedding Java code.

Workflow Creators

Windchill PDMLink and Windchill ProjectLink permit all users with the role of Library, Product, and Project Managers, as well as Organization and Site Administrators to author (create and modify) workflows within the contexts (Organizations, Products, Libraries, or Projects) they manage. This is as-designed, and is a necessary component of the distributed administration model enabled by these solutions.

The embedded Java code that workflow creators are permitted to write to a workflow process includes embedding Java code in Execute Expression robots, Synchronize robots, Conditional gates and activities to perform conditional branching or execute custom application logic within the context of the workflow. This embedded Java code is executed on the server, and there are no restrictions on the APIs.

Application context managers for Libraries, Products, Projects, Programs, and Organizations are granted Full Control (All) permission on WTObject. This permits Organization Administrators and application context managers to effectively administer their contexts, through granting them the ability to modify access control policy rules, workflow and life cycle templates, and other