contextual administrative objects. However, through granting them the ability to author workflow templates they are also effectively being granted the ability to write Java expressions which will be run on the server when the workflow is executed.

With the introduction and adoption of the distributed administration model, the number of users with broad access permissions in the application contexts expanded significantly. PTC is no longer assuming that a user who is responsible for administering an individual context is trusted to author Java code which may provide access to information outside of the context they manage.

Considering this capability, a user with permissions to create workflow templates (for example, Project Managers) could potentially add malicious code in one of the expressions, causing a possible security threat. For this reason, workflow templates that contain Java expressions must be created and thoroughly tested by individuals that are trusted by the organization.

Restricting Workflow-Embedded Java Code

An additional level of control has been provided for the site administrator to restrict which users can create and modify Java expressions within workflow templates. This is done by specifying membership in at least one of three of the following site context groups:

•Administrators

•Workflow Administrators

•Workflow Author

A user must be part of one of the above listed groups to have permission to embed Java code in workflows templates.

When a user attempts to add or modify expression code, the system will perform an additional check to verify that the user is a member of at least one of these

three groups defined in the Site context. If the user is not a member of at least one of these three groups, all expression code input fields in the Workflow Template Editor will be disabled. Furthermore, the workflow service will prevent saving a template with modified expression code, in cases where the workflow template may be created through other means.

Administrative Groups

The Administrators and Workflow Administrators groups are part of the base data loaded with every Windchill installation. However, members of these groups are also granted the permissions necessary to create and modify workflow templates

within the Site context. Even though these permissions are not inherited by the domains used for organizations or other contexts, a member of one of these groups could potentially obtain the URL for and access the Site-level Workflow Template Administration utility by typing it directly into a browser address bar.

For this reason, a new group is available in the Site context called Workflow Author. This group will not be granted any access permissions by default, but members of this group will be considered trusted to author Java expressions in locations where they are otherwise granted the permission necessary to author workflow templates.

For example, if a library context manager launches the Workflow Template Administration utility and creates a workflow template in the context of that library, they will be permitted to do so because they have been granted the necessary access control permissions through their membership in the library manager role (Full Control (All) permission on WTObject). However, when the library context manager attempts to access any of the input fields for expression code (for example, the Transitions tab for a workflow activity) in the workflow template, the system will perform an additional check to verify that the user is trusted to author expression code by confirming that the user is a member of either the Workflow Author, Workflow Administrators, or Administrators groups. If so, the expression code input fields will be enabled and the user will be able to edit the embedded expression code. If not, the expression code input fields will be disabled and the user will be able to view but not edit the expression code.

Thus, membership in one or more of these three groups serves as a second layer of permission controlling who is able to create and edit workflow-embedded Java expressions.

Disabled Areas of the User Interface

The following areas within the Workflow Template Administration utility will be disabled for users that do not have permission to create or edit Java expressions:

•Import button

•Export button

•Save As button

The text area used to enter Java expressions in the Workflow Template Editor will be disabled for the following components:

•Routing tab in the Assigned Activity / Ad hoc Activity process node

•Transition tab in the Assigned Activity / Ad-hoc Activity process node

•Routing tab from the Properties link

•Transition tab from the Properties link

•Expression Robot

•Block

•All connectors (And connector, Or connector, Threshold connector, and the Conditional router)