Guest users

See also: Users

What are guest users used for?

Lobster Data Platform creates accounts for Guest users automatically in most cases (see Create guest user). This gives users low-threshold access without authentication to selected content or functions, limited in time or scope as needed.

In logistics, (end) recipients primarily use Guest users accounts for shipment tracking. This gives them access without being set up as full Users of the Lobster Data Platform.

You find the Guest users menu item in the Main menu under Administration > Accounts, provided you have the required permissions.

It opens an overview for the Guest user (GuestUser) entity type by default, also called a guest user account.

• View name: de.lobster.scm.base.security.guest::GuestUser|listDetailsWindow

• Menu node name: admin/accounts/guestUserOverview

The permissions for the node Administration > Accounts > Guest users (administration/accounts/guestUser) control access to Guest users.

• The Guest users menu item only appears if the permission for Show (show) is available for Guest users.

• Access to Guest users is generally subject to owner restrictions for the Company of session.

• The permissions of the Role of session therefore apply only to Guest users for which the Company of session is the owner. This also applies when the Company of session is the recipient of a corresponding Company authorizations.

A guest user account enables a Lobster Data Platform session to be set up without explicit authentication. It is then considered a User of session within the session.

NOTE: When Guest users perform write accesses to entities, the system enters the negative value of the account's ID (id) in the Creator (creatorId) or Last modified by (lastModifierId) field. This distinguishes references to Guest users from those to Users.

 CAUTION: 

Guest users are a potential security risk. They allow access to the Lobster Data Platform without explicit authentication. In addition, they are typically provisioned automatically, without an administrator approving them.

Control this unverified access strictly, using the following methods:

1. Guest users should only have access to highly restrictive Roles that only grant the minimum scope of permissions for the specific purpose.

2. If needed, configure additional functional restrictions for Guest users by evaluating a Check type for the User of session, for example in Association criteria or Event handling.

3. Limit the use of guest user accounts to a time window or a maximum number of logins using the account properties (see below).

4. With specific guest user restrictions, you control access to specific entities for individual accounts more precisely than for Users (see Create guest user).

The following table lists the main systematic differences for Guest users and Users:

The interactive administration for Guest users uses a combined view (listDetailsWindow) by default. Open it via the Guest users menu item in the Main menu.

The following screenshot shows the default ribbon (for a role with all relevant permissions), including the default input form with the details of the guest user selected in the list area (at the bottom).

Special features in the ribbon

In addition to the generic ribbon buttons (New, Delete, etc.), the main category (Common) visible in the screenshot also contains specific ribbon buttons for Guest users:

Contents of the default input form

The data input form provided as default for Guest users maps the contents of the data structure relevant for direct interactive maintenance for Guest users using Form elements.

Guest user login

Typically, Guest users receive access to the Lobster Data Platform via E-mails with a link containing the Login token as URL parameters, which could look like this, for example:

• https://platform.doma.in?loginToken=b017f3e8-ec62-4e2b-be24-2bcac7e8d49e

As of version 26.3.0, the Login token also enables direct links to a log in the DataCockpit.

Such a link signs the guest user in and opens the log of the specified job directly:

• https://platform.doma.in/DataCockpit/logs/<JobNumber>?loginToken=<Login-Token>

NOTE: For details on the link format and security notes, see Log search.

Alternatively, a guest user login can also be carried out interactively:

Configuration example

In the following example, guest user accounts are used to grant limited read access to specific shipments. Each guest user account can define individual restrictions using the following parameters:

• Shipments are listed only if modified within a specific time horizon before the current time.

• A filter condition for the text attribute Plant defines which shipments are relevant for the guest user.

• Additional visibility restrictions result from the company assigned to the guest user account, via ownership, involvement, and Effective authorizations.

The guest users are assigned a role that grants only the following permissions:

• Business objects / Shipments / Read

• Business objects / Shipments / Show details

A special shipment overview is also configured (see Custom overviews). Its condition must evaluate the parameters per guest user account. These parameters are stored as Custom data in the guest user account. You define them in a portal that opens from the guest user overview via a ribbon button (command Portals > Open portal), with a single selection identifying the target guest user:

• When the portal opens, data from the selected guest user account is passed automatically if the form design includes a container with the data field loadedItem. In this example, the container holds the elements ID (data field: id), Login token (loginToken), and E-mail (emailAddress).

• Below, a filter for Plant (data field: PLANT_FILTER) is defined using Combobox (with key values A120, A121, A125, A127, and A12_). The selected value is compared by LIKE against the text attribute Plant (t_PLANT.value.text) in the custom overview condition.

• A date value for Modified as of (data field: MINDATE) defines the time horizon. The custom overview condition compares it against the lastModified timestamp using a Greater or equal constraint.

• Both filter criteria are grouped in a container filters (not visible in the screenshot) to simplify handling in further configurations (see below).

• Clicking the Save restrictions button triggers a Custom action event Guest user – set data (SET_GUEST_USER_DATA) behavior, which starts the following event handler:

• Because the Triggering event can only be triggered from the portal, the Validating rule is limited to a sub-criterion that defines the context for executing the actions (Company rule, Role rule).

• All Actions run in the context of the selected guest user account. The account is resolved from the variable formData (of type Client object) within a Execute with action. The container loadedItem, which represents the selection, is passed to a Input object (type safe) resolver, which returns the guest user account object.

• A Set value action then sets the value of the Custom data (customData) field of the account. It reads the settings from the filters container in the formData variable.

• The Save changes later action saves the change to the guest user object, even though the object was only added via Execute with.

To verify an assignment, click the Custom data > Edit button in the guest user overview:

In the Shipment overview (Guest user) custom overview condition, the filter criteria are included as follows:

• The text attribute Plant (t_PLANT.value.Text) is compared by LIKE against the selection for Plant (PLANT_FILTER).

• The User of session is identified first, and the corresponding guest user account is then resolved by Input object (type safe).

• The Custom data (customData) field of the guest user object provides the object (object) generated from portal data, including the fields (property) PLANT_FILTER (string) and MINDATE (DateTime).

• A Object property resolver reads the value of PLANT_FILTER for matching.

• MINDATE is accessed the same way to compare it against the lastModified timestamp (below).