Workflow 2013 use app model for higher security levels

In a workflow 2013, I am currently calling a workflow 2010 so that I can use the impersonate step to run steps at a higher security level than the user that submitted the workflow. In the impersonate step, everything that needs to be run at a higher security
level are placed in the impersonate step.
I have found that the app model in workflow 2013 looks like it replaces the impersonate step in workflow 2010, correct?
Due to that fact if I want to use the app model in workflow 2013 instead of using the impersonate step in workflow 2010, will I need to place all actions and conditionals within in the app model step for everything that needs to be executed at a higher security
level? If so, can you show me how to accomplish this goal?
If this is not true, what actions and steps do I need to place within the app model so that those actions and conditionals occur at a higher security level?

Hi wendy,
What is app model in SharePoint 2013 workflow? Based on your description, it seems like “App Step”. Is it right?
“App Step” provides all the workflow actions added to it, with Read from and Write to Permissions to all the Items in the Site.
App Step is not available by default you need to activate Workflows can use app permissions feature in your Site to get this displayed for that site in SharePoint Designer.
You need to place all actions and conditionals within the App Step for everything that needs to be executed at a higher security level.
More information about App Step in SharePoint 2013 Designer, please refer to the links below:
Create a workflow with elevated permissions by using the SharePoint 2013 Workflow platform
A word about App Step in SharePoint 2013 Workflow Platform
SharePoint Designer 2013 – The new “App Step”
Best Regards,
Wendy
Forum Support
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
[email protected]
Wendy Li
TechNet Community Support

Similar Messages

Project server workflow 2013 using client object model

hi sir ,
suggest me how to create workflow project server 2013 using csom model
vijay

Hi Vijay,
The CSOM supports submitting status updates, but currently does not support status approvals.

Activating "Workflow can use app permission"

HI,
I am trying to activate the "Workflow can use app Permissions".
I am getting the error "System.ServiceModel.Security.SecurityAccessDeniedException: Access is denied. "
The user is part of the SiteCollectionAdministrators.
What other permissions are required to activate the feature?
Thanks

No I don't think you have to configure the App Domain to use workflows.
Do you also have a User Profile Service (preferably with User Profile Sync) up and running? 2013 workflows (like Apps) use properties in the User Profile to pass identity back and forth. If you are going to run using App Permissions the workflow
service is still going to want to be able to identify the initiator of the workflow. For that you need User Profiles.
Also, is your user just a Site Collection Admin or are they an actual member of the Site Owner's group? Its not clear from the documentation whether activating that feature is a permission dependency or an actual group membership dependency.
Paul Stork SharePoint Server MVP
Principal Architect: Blue Chip Consulting Group
Blog: http://dontpapanic.com/blog
Twitter: Follow @pstork
Please remember to mark your question as "answered" if this solves your problem.

Cannot activate "Workflows can use app permissions"

Dear all,
I have a SharePoint 2013 on Windows Server 2008 R2.
And I create a develop site to share my apps.
First, I try to activate the app permission, but it fail.
Is anybody knows how to fix it?
Thank you!

Workflows can use app permissions feature is only going to be activated if
1) You have configured your workflow manager properly. Make sure there are not issues with your workflow manager and you can create workflow using SP 2013 Workflow Manager.
2) You have configured apps for SharePoint 2013. Again you will need to make sure that you have hit all the check when configuring SharePoint 2013 apps.
Follow these two articles to make sure that you have configured apps for SharePoint 2013.
http://technet.microsoft.com/en-us/library/fp161236.aspx
http://sharepointchick.com/archive/2012/07/29/setting-up-your-app-domain-for-sharepoint-2013.aspx
If you have confirmed that both of the above features are configured properly then check your ULS logs and find the detailed issue using the Correlation ID.
Amit

Unable to activate Workflows can use app permissions feature

Hi all,
Iam unable to activate Workflows can use app permissions feature in sharepoint 2013. it throws sorry something went wrong error. Kindly somebody help me in resolving this issue

Workflows can use app permissions feature is only going to be activated if
1) You have configured your workflow manager properly. Make sure there are not issues with your workflow manager and you can create workflow using SP 2013 Workflow Manager.
2) You have configured apps for SharePoint 2013. Again you will need to make sure that you have hit all the check when configuring SharePoint 2013 apps.
Follow these two articles to make sure that you have configured apps for SharePoint 2013.
http://technet.microsoft.com/en-us/library/fp161236.aspx
http://sharepointchick.com/archive/2012/07/29/setting-up-your-app-domain-for-sharepoint-2013.aspx
If you have confirmed that both of the above features are configured properly then check your ULS logs and find the detailed issue using the Correlation ID.
If this helped you resolve your issue, please mark it Answered

What are my options if I do not want to use App Store for distribution of my Enterprise App?

We are developing an App that is tailormade for a limited number of our customers only. The app is for free.
Currently we ship it through the App Store but the main issue is that the reaction times are too high. If we need to provide a fix it has to be pushed to our clients ASAP without having to wait for review.
If we sign up for an Enterprise Dev licence, we get 5000 installations "for free". The questions that arise:
Is it allowed to use those licences to distribute the app to customers or can they be used for our own employees only?
How are the 5000 devices managed? Do we have to keep track of all of them, create new provisioning profiled and need to rebuild the app and sign it with a new certificate everytime a device gets added/removed?
I found that there is way for third party software disttribution: http://www.apple.com/business/vpp/
It has a dead link that would probably show a way to deploy apps the way we want it: https://developer.apple.com/appstore/resources/volume/
What I' really looking for in short:
I can fix the app, make a new build and upload that to one of our servers.
Our servers ensure that only selected users can access the app installation bundle.
Who ever gains access to the bundle should be able to install it, no matter if his device has been "registered" in some way or not.
It is okay if the users will have to install a provisioning profile to their devices, as long as that profile is "dynamic", meaning that nobody has to add or remove devices manually.
Can somebody comment if there is a solution for that?
Thanks
René

If you are in the Enterprise program, apps can be distributed only to that company's employees. If you want to distribute to customers in general, you would have to be a member of the normal iOS developer program and either use ad-hoc distribution for up to 100 users, or go through the App Store. There are no other options I'm aware of, though you can contact Apple Developer Support through your membership resources and ask.
Regards.

Using dynamic groups for j2ee security

Hi all,
I have my realm setup in server.xml and my standard and sun-specific deployment descriptors setup for j2ee security.
Everything seems to work fine for groups defined via uniquemember attributes (all users are specified), but I'm having trouble with dynamic groups (defined with the memberurl attribute)
How do I configure my realm in my server.xml to get this working?

Hi,
I got an official answer from SUN.
"Dynamic Groups" are not (longer) supported with SJS AS 7!
It will probably be supported with SJS AS 8 SE.
If you have a iPlanet 6.5 application that is running with dynamic groups, just wait a little bit before you migrate.

Use of BADI for SNP capacity levelling

I am using APO V5.1.
I'm interested in using the Business Add in (BADI) for SNP capacity levelling.
Can anyone tell me which BADI this is, and the possible functionality it can provide?
Thanks for any information on this...

To give you a couple of examples of what we use the BADi for:
1) Based on a product characteristic, the levelling will only level certain products. E.g. you could set a characteristic to mark products for internal use versus export use and then level the internal requirements first.
2) The levelling will only level planned production for highlighted orders in the data view.
Hope that helps for ideas
Regards
Ian

My mac crashes everytime i try and use app store for software updates.

i have a 2008 macPro, 10.8.2 2x2.8Ghz with 6gb RAM and since doing 10.8.2 update everytime i try and do a software update using the App Store my machine crashes and generates the following error code.
Interval Since Last Panic Report: 104582 sec
Panics Since Last Report:          7
Anonymous UUID:                    DDDE7BD7-6F47-FE17-9864-60DE12F490FB
Wed Dec 12 13:40:44 2012
panic(cpu 0 caller 0xffffff800d4b7bd5): Kernel trap at 0xffffff800d51debc, type 14=page fault, registers:
CR0: 0x0000000080010033, CR2: 0x00000000deadbeef, CR3: 0x000000001e393000, CR4: 0x0000000000000660
RAX: 0x00000000deadbeef, RBX: 0xffffff80c5533e80, RCX: 0xffffff80c5533ba4, RDX: 0x0000000000000004
RSP: 0xffffff80c5533b90, RBP: 0xffffff80c5533de0, RSI: 0xffffff80c5197230, RDI: 0xffffff80c5533cb3
R8: 0xffffff80c5533ba4, R9: 0xffffff80c5533e80, R10: 0x00000000ffffffff, R11: 0x00000000ffffff80
R12: 0xffffff80c5533ba4, R13: 0xffffff80c5197330, R14: 0xffffff80c5197330, R15: 0xffffff80c5533bb0
RFL: 0x0000000000010202, RIP: 0xffffff800d51debc, CS: 0x0000000000000008, SS: 0x0000000000000010
Fault CR2: 0x00000000deadbeef, Error code: 0x0000000000000000, Fault CPU: 0x0
Backtrace (CPU 0), Frame : Return Address
0xffffff80c5533830 : 0xffffff800d41d626
0xffffff80c55338a0 : 0xffffff800d4b7bd5
0xffffff80c5533a70 : 0xffffff800d4ce4ed
0xffffff80c5533a90 : 0xffffff800d51debc
0xffffff80c5533de0 : 0xffffff800d51d493
0xffffff80c5533e60 : 0xffffff800d776abe
0xffffff80c5533f00 : 0xffffff800d7768e2
0xffffff80c5533f60 : 0xffffff800d7e1533
0xffffff80c5533fb0 : 0xffffff800d4cea1d
BSD process name corresponding to current thread: WDMemeod
Mac OS version:
12C60
Kernel version:
Darwin Kernel Version 12.2.0: Sat Aug 25 00:48:52 PDT 2012; root:xnu-2050.18.24~1/RELEASE_X86_64
Kernel UUID: 69A5853F-375A-3EF4-9247-478FD0247333
Kernel slide:     0x000000000d200000
Kernel text base: 0xffffff800d400000
System model name: MacPro3,1 (Mac-F42C88C8)
System uptime in nanoseconds: 221271550268
last loaded kext at 58616662188: com.apple.driver.AppleBluetoothMultitouch          75.15 (addr 0xffffff7f8f30f000, size 77824)
loaded kexts:
com.apple.driver.AppleBluetoothMultitouch          75.15
com.apple.driver.AudioAUUC          1.60
com.apple.driver.AppleTyMCEDriver          1.0.2d2
com.apple.iokit.IOBluetoothSerialManager          4.0.9f33
com.apple.filesystems.autofs          3.0
com.apple.driver.AppleHWSensor          1.9.5d0
com.apple.driver.AppleHDAHardwareConfigDriver          2.3.1f2
com.apple.driver.AppleUSBDisplays          353
com.apple.driver.AppleUpstreamUserClient          3.5.10
com.apple.driver.AppleMCCSControl          1.0.33
com.apple.driver.AppleHDA          2.3.1f2
com.apple.kext.AMDFramebuffer          8.0.0
com.apple.iokit.IOUserEthernet          1.0.0d1
com.apple.ATIRadeonX2000          8.0.0
com.apple.Dont_Steal_Mac_OS_X          7.0.0
com.apple.driver.AppleMCEDriver          1.1.9
com.apple.driver.ApplePolicyControl          3.2.11
com.apple.iokit.CSRBluetoothHCIControllerUSBTransport          4.0.9f33
com.apple.driver.AppleLPC          1.6.0
com.apple.driver.ACPI_SMC_PlatformPlugin          1.0.0
com.apple.driver.CSRHIDTransitionDriver          4.0.9f33
com.apple.driver.PioneerSuperDrive          3.1.0
com.apple.iokit.SCSITaskUserClient          3.5.1
com.apple.driver.XsanFilter          404
com.apple.driver.AppleFileSystemDriver          3.0.1
com.apple.AppleFSCompression.AppleFSCompressionTypeDataless          1.0.0d1
com.apple.AppleFSCompression.AppleFSCompressionTypeZlib          1.0.0d1
com.apple.BootCache          34
com.apple.iokit.IOAHCIBlockStorage          2.2.2
com.apple.driver.AppleUSBHub          5.2.5
com.apple.driver.AppleAHCIPort          2.4.1
com.apple.driver.AppleIntelPIIXATA          2.5.1
com.apple.driver.AirPortBrcm43224          600.36.17
com.apple.driver.AppleIntel8254XEthernet          3.1.1b1
com.apple.driver.AppleFWOHCI          4.9.6
com.apple.driver.AppleUSBEHCI          5.4.0
com.apple.driver.AppleUSBUHCI          5.2.5
com.apple.driver.AppleEFINVRAM          1.6.1
com.apple.driver.AppleACPIButtons          1.6
com.apple.driver.AppleHPET          1.7
com.apple.driver.AppleRTC          1.5
com.apple.driver.AppleSMBIOS          1.9
com.apple.driver.AppleACPIEC          1.6
com.apple.driver.AppleAPIC          1.6
com.apple.driver.AppleIntelCPUPowerManagementClient          196.0.0
com.apple.nke.applicationfirewall          4.0.39
com.apple.security.quarantine          2
com.apple.driver.AppleIntelCPUPowerManagement          196.0.0
com.apple.driver.IOBluetoothHIDDriver          4.0.9f33
com.apple.driver.AppleMultitouchDriver          235.28
com.apple.iokit.IOSerialFamily          10.0.6
com.apple.kext.triggers          1.0
com.apple.driver.AppleSMBusController          1.0.10d0
com.apple.driver.DspFuncLib          2.3.1f2
com.apple.iokit.IOAudioFamily          1.8.9fc10
com.apple.kext.OSvKernDSPLib          1.6
com.apple.iokit.IOSurface          86.0.3
com.apple.iokit.IOBluetoothFamily          4.0.9f33
com.apple.driver.AppleGraphicsControl          3.2.11
com.apple.iokit.IONDRVSupport          2.3.5
com.apple.driver.AppleSMBusPCI          1.0.10d0
com.apple.iokit.AppleBluetoothHCIControllerUSBTransport          4.0.9f33
com.apple.iokit.IOFireWireIP          2.2.5
com.apple.kext.AMD2600Controller          8.0.0
com.apple.kext.AMDSupport          8.0.0
com.apple.driver.AppleHDAController          2.3.1f2
com.apple.iokit.IOGraphicsFamily          2.3.5
com.apple.iokit.IOHDAFamily          2.3.1f2
com.apple.driver.AppleSMC          3.1.4d2
com.apple.driver.IOPlatformPluginLegacy          1.0.0
com.apple.driver.IOPlatformPluginFamily          5.2.0d16
com.apple.driver.AppleUSBHIDKeyboard          165.5
com.apple.driver.AppleHIDKeyboard          165.5
com.apple.iokit.IOUSBHIDDriver          5.2.5
com.apple.iokit.IOSCSIBlockCommandsDevice          3.5.1
com.apple.iokit.IOUSBMassStorageClass          3.5.0
com.apple.driver.AppleUSBMergeNub          5.2.5
com.apple.driver.AppleUSBComposite          5.2.5
com.apple.iokit.IOSCSIMultimediaCommandsDevice          3.5.1
com.apple.iokit.IOBDStorageFamily          1.7
com.apple.iokit.IODVDStorageFamily          1.7.1
com.apple.iokit.IOCDStorageFamily          1.7.1
com.apple.iokit.IOATAPIProtocolTransport          3.5.0
com.apple.iokit.IOSCSIArchitectureModelFamily          3.5.1
com.apple.iokit.IOAHCIFamily          2.2.1
com.apple.iokit.IOATAFamily          2.5.1
com.apple.iokit.IO80211Family          500.15
com.apple.iokit.IOUSBUserClient          5.2.5
com.apple.iokit.IONetworkingFamily          3.0
com.apple.iokit.IOFireWireFamily          4.5.5
com.apple.iokit.IOUSBFamily          5.4.0
com.apple.driver.AppleEFIRuntime          1.6.1
com.apple.iokit.IOHIDFamily          1.8.0
com.apple.iokit.IOSMBusFamily          1.1
com.apple.security.sandbox          220
com.apple.kext.AppleMatch          1.0.0d1
com.apple.security.TMSafetyNet          7
com.apple.driver.DiskImages          344
com.apple.iokit.IOStorageFamily          1.8
com.apple.driver.AppleKeyStore          28.21
com.apple.driver.AppleACPIPlatform          1.6
com.apple.iokit.IOPCIFamily          2.7.2
com.apple.iokit.IOACPIFamily          1.4
com.apple.kec.corecrypto          1.0
wondering if anyone else is suffering from this?

Try when connected wired. As for the KPs, see
What is a kernel panic,
Technical Note TN2063: Understanding and Debugging Kernel Panics,
Mac OS X Kernel Panic FAQ,
Resolving Kernel Panics, and
Tutorial: Avoiding and eliminating Kernel panics for more details.

Problem in using AWS model for PI interface

Hi
We want to consume XI inbound interface for a 3rd party web service in web dynpro via AWS model; we can create the model class from the wsdl file imported from PI interface; but facing some issue in configuring the logical destination as we don't have any wsdl url from PI which we can use in the dynamic proxy configuration.
Thanks in advance.
Sudip

Hi Sudip
Can you please tell me how did you resolve this issue? We are running into the exact same problem.
Thanks
Preet

Using ImportSecurity.exe for removing security

I am now using EPM ver. 11.1.2.1 in Window 2008 (64bit)
The command, ImportSecurity, works perferly for insert and update security. However, I cannot remove the security. The following is the command that I have tried.
importsecurity "MyApp1,admin,SL_COMMA,0,SL_CLEARALL"
Please kindly help.

Resolved.
ImportSecurity "MyApp1,admin,,,,SL_CLEARALL"
Edited by: Alfred Ku on 2012/4/27 上午 2:00

Use of Aris models for Guided Procedures or VC possible

Hi,
I know that Aris can export BPEL for importing to XI.
What are the capabilities of using Aris for NetWeaver to model for more UI-oriented processes. Is it possible to use ARIS models for GP or Visual Composer?
Thanks.
Dick

Hi David,
The answer to your 1st question is NO. Till NW 7.1, there is no clue on this.
To your 2nd question, there is no noticable enhancement on the GP side in NW 7.1. You can refer to the Developers Guide -> Developing and Composing Applications -> Designing Composite Processes with Guided Procedures section in <a href="http://help.sap.com/saphelp_nwce10/helpdata/en/44/D958673EF05F4DE10000000A11466F/frameset.htm">SAP NetWeaver Composition Environment Library</a> for further reference.
Hope this helps.
Finally I fully agree with you regarding XI and GP.
Regards
Nilay

APP Programing for partial payment

Can we use app programing for partial payment.
Regards
Sachin Patil
Moderator: Search SDN

Hi Sachin,
Partial payment is not possible in APP.
At the most you can issue Payment requests for Partial Payments and they can be cleared. Suppose you have an Invoice of 10000 but you receive a payment request of 5000, then you can pay 5000 using payment request.
Regards,
SAPFICO

Security Level Medium is not working for PO initial version

Hi ,
    We have maintained security level as Medium in Purchaser user personalization. In order to restart the PO SAVED event workflow only there is a value changed while the PO is awaiting for approval.. Here is the scenario and how the start condition maintained for PO - WS 14000145 - SAVED event.
Start condition maintained for event SAVED for WF template WS14000145 as below
&_EVT_OBJECT.POTotalValue& GE 0.00
Security level(BBP_WFL_SECURITY) maintained as Medium in personalization of SU01.
my requirement is when the PO create first time ( Initial Version ) and route for approval. Three level approval is determined for the PO and first approval approved. while the PO is awainiting for second level of approval the purchaser changed the quantity. based on above start condition my expectation is , the PO has to restart and route from beginning. but that is not happening. when i see the approval preview the approval path shows the workitem is waiting in second level of approval.
I tried the below start conditions also
&_EVT_OBJECT.SimpleListOfChanges&CE TOTAL_VAL, but no result..
What is the Medium functionality?
here is the help i found from help.sap.com, but i am not clear about this..
MEDIUM It is possible to change the document The system evaluates the workflow start conditions and starts the approval workflow again if the change necessitates a new approval If this is not the case, the approval workflow continues.
Regards,
John

Hi John,
The security level works differently for PO's.
In the function 'BBP_PDH_WFL_CHECK_RESTART is a desription how the
system should work:
The workflow will be RESTARTED in the following cases:
a) One has a standard workflow with the usual type of approval (not a
   'back&forth' one). It will always be restarted independent on the
   authorization levels of the user and whether the user is a PO
   creator or not;
b) One has the 'back&forth' type of approval but the user reordering
   the PO is not the PO creator (this could be another purchaser from
   the same purchasing group);
c) It is the 'back&forth' type of approval and the user reordering the
   PO is the PO creator but he has the authorization levels that are
   less then 2, i.e '0'(not defined') or '1' (no changes allowed);
That means the security level must be below '2' to force a restart.
I hope that this clarifies how the system is working.
Kind regards,
Siobhan

MFA App Password for Outlook 365 Keep Failing

We are currently using Azure MFA for our Office 365 implementation. Our users have to use App Passwords for devices that don't support MFA. Primarily the desktop outlook client and phones/tablets.
Over the past week I've had multiple users complaining that the App Passwords they've set for their phones and tablets are suddenly being reported as bad. I've personally had my iPhone app password be rejected 3 times in the past 48 hours. I've resolved
it by creating a new app password each time. But it's starting to feel like there is some sort of intermittent outage/problems with MFA App Passwords and Outlook 365.

Four weeks on using MFA for me. On my eighth 8th app password for my desktop Outlook 2010 client. They stop working. The 'remember' feature does not work, even with Run As Admin; or maybe it does but since the last used App Password is
bad, get prompted for a new one. I just spend a few minutes each morning copy-paste from my text file of app passwords, either until one works, or until I go back to the portal (and wait for the verification call) and make a new one. Sometimes
I get thru the list trying all of them, cycle back thru again, and one of them works now. Worse I cannot easily use microsoft stuff that is associated with my MSDN live login once I have used my organizational email to login to the portal; if I sign
out of it and login with the live account . . . maybe 40% of the time I lose email until prompted again for my app password. I copy and paste the app password multiple times a day, and if there was One 1 that worked 100% of the time, I might end up memorizing
it. Sigh.
WilliamL 10 PRINT $Signature 20 END

Workflow 2013 use app model for higher security levels

Similar Messages

Maybe you are looking for