Credentials Widget doesn't extract credentials of logged in user on Bus Hub

KNIME Business Hub
1

Hi,
I’m transitioning a workflow to the KNIME Business Hub from KNIME Server. The workflow includes a KNIME Widget node configured to extract the credentials of the currently logged in user on the KNIME Server (the consumer never sees a login prompt). The credentials are used in the workflow to access a custom application API hosted internally. Unfortunately, the Credentials Widget node doesn’t seem to be able to extract the credentials of the currently logged in user when the data app workflow is deployed on the Business Hub. Is this the expected behavior? I was hoping to spare our consumers from having to log into KNIME and then log in again using the same credentials every time they run the workflow. Bus Hub Standard (version 1.14). Thanks.

2

Hi @dnaki,

that comfortable setup is unfortunately not possible on KNIME Hub anymore, as the login mechanism completely changed when compared to KNIME Server. It’s now done via a piece of software called keycloak, which does not return the raw credentials anymore (but works with access tokens instead).

Unfortunately, I don’t see a straight forward way around people providing the credentials (again), e.g. via the Credentials Widget.

KNIME Hub instead introduces Secrets to manage team- or user-bound credentials. Is your internal API authentication user-bound or would a service account work as well?

  • If a service account is possible, you could provide the credentials as a team-secret, that is made availble to whomever executes the data app.
  • Alternatively, we offer the KNIME Hub Secret Selector component to let the users select a secret in the data app. But that would require your users to set up a secret each, which is probably not what you want (unless you want to go as far and e.g. create a workflow that automatically creates these user-specific secrets).

Another route, depending on how much resources you want to put in an how your infrastructure looks like, setting up Kerberos might be an option.

Hope that gives some insights!

Kind regards,
Lukas

3

Hi Lukas,

Thanks for the detailed explanation. Unfortunately, the credentials are user-bound, so it appears the simplest solution would be to ask users to log in (again) when they run the workflow.

Best regards,
Don