Run as whoever designed the model

jesusa310

Certified Lead Developer

over 6 years ago

Hi all,

What do you think of Setting the security of the lane that starts a process as "Run as whoever designed the model"? Is it a good practice? What happens if the designer leaves the Company and the user gets deactivated? Is it recommened to use instead Run as whoever started the process? I am interested in knowing if this could cause a security error.

Kind regards,

Jesus

Discussion posts and replies are publicly visible

Top Replies

Colton Beck over 6 years ago

I always recommend against running processes as the Designer, unless it's specifically required. I've found it can be used as a crutch for bad security designs.

Additionally, if the publishing user is deactivated, the processes will break if using this design. You can mitigate this issue by always deploying as a service account user that will never be deactivated. But nonetheless, I believe you should only use this configuration when there is some specific reason to do so.
Cancel
Vote Up -1 Vote Down

Sign in to reply

Cancel
jesusa310
Certified Lead Developer
over 6 years ago in reply to Colton Beck

Thanks Colton. Your answer is in line with my thoughts but another question came to me reading you. What if the Setting is "Run as whoever designed the model" but the user that deploys the package in production is a generic Administrator. We would still have a Problem if the designer user is deactivated, wouldnt we?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Cancel
Colton Beck over 6 years ago in reply to jesusa310

Yes, you would still have the issue.

The idea with user a service account is that it's tied to no specific person, so you wouldn't need to deactivate when somebody rolls off the project.

However, if your environment uses defined auto-deactivation rules, you'd need to be careful the service account isn't auto-deactivated, at which point a bunch of your processes could break.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Cancel
Colton Beck over 6 years ago in reply to Colton Beck

Also, there is a good conversation about this here worth reading.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Cancel
jesusa310
Certified Lead Developer
over 6 years ago in reply to Colton Beck

So the best practice would be to set the System lane as " Assign all nodes in this lane to a person or group of People" and then select a generic Service account, right?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Cancel
Colton Beck over 6 years ago in reply to jesusa310

I wouldn't use the swim lane assignment defaults, unless you have a bunch of input tasks that you want to assign to specific user groups. Assignment is different from setting the context of a node running as the initiator or designer.

It's also a best practice to never assign anything to a specific user. Assignments should always be to groups.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Cancel
Robert Shankin
Appian Employee
over 6 years ago

Hi Jesus -
Side note:

Remember, in the environment where the process model is imported, the user who performs the import assumes the identity of the process designer.

That's why it's a good practice to ~never import as a named user, and instead use an Appian service account such as "deployment.administrator" who never leaves the company.
Cancel
Vote Up +1 Vote Down

Sign in to reply

Cancel
jesusa310
Certified Lead Developer
over 6 years ago in reply to Robert Shankin

Hi Robert, that is good news. Currently the deployments in producion are done through a generic account. Is that the behavior in old versions too? We are running on Appian 7.9
Cancel
Vote Up 0 Vote Down

Sign in to reply

Cancel
Robert Shankin
Appian Employee
over 6 years ago in reply to jesusa310

This is true for 7.9, yes.
Cancel
Vote Up +1 Vote Down

Sign in to reply

Cancel
Mike Schmitt over 6 years ago

As an additional note - "run as initiator" does not account for processes changing hands; the initiator is inherited from the top level action only. Furthermore, if that user ever gets deactivated, it has immediate and severe implications upon the running process instance tree they've left behind.

It's for these reasons that on my main project, we are required to do 100% "run as designer" subprocess calls, and make sure that all models in the production environment are published by a shell "admin user" account as Robert mentions above. (We actually do imports under our personal accounts by necesity, and then use a custom app I built to republish all imported process models as the Admin user.)
Cancel
Vote Up +3 Vote Down

Sign in to reply

Cancel