Creating web embed with anonymous authentication

User Experience
1

Hi,

We have a Constellation-based app in Pega 24.2, and we’re looking to enable anonymous access via Web Embed.

Use case:
A user receives an email with a link. On click, it should open a case assignment (embedded) without requiring login.

We reviewed the Pega Web Embed documentation, but it’s not clear how to enable anonymous access end-to-end.

Questions:

  • What are the exact steps to make this work without authentication?

  • For added security, should we create a token table and validate tokens in a custom authentication activity?

  • Can we rely on Pega’s default activity like pyPegaOAuthAccessTokenAuthenticationActivity, or is a custom one better?

Appreciate any guidance here.

2

@Mayurk33 - Anonymous authentication is not supported in Constellation design system.

Please refer to this article for more information.

Thanks,

Rich

3

@Mayurk33

This is doable while using OAuth and I think you are close. Take a look at the Implementing web embed interfaces challenge in the Pega Platform Design > Lead System Architect mission. The mission uses an activity called AuthenticateMashup which has the base steps (operatorPage steppage steps) and maps the client id to a operator record as the pattern but be sure to secure and harden based on your requirements.

  1. Grant Type = Customer Bearer
  2. Check Custom bearer and add your Authentication activity in the OAuth 2.0 record
  3. Update your OAuth Service Package
  4. Add your operator record(s) you defined in the Authentication activity
  5. Test your WebEmbed

I just tried this myself and it worked. Hope this helps with your use case.

4

As mentioned in this thread, true Anonymous authentication as offered for Traditional Pega applications, where a unique operator is provisioned for each new access, is not yet available for Constellation apps. However, you might “simulate” anonymous access by creating an operator record for use for all simulated anonymous accesses. Please see the bottom of this doc page for additional caveats with such an approach: Authentication in Web Embeds

Also, within the custom bearer activity or web ldap custom authentication service activity one might implement a copying of such a designated template anonymous operator record and devise a way to always make the operator ids unique to better simulate what is done within the Pega Authentication Service of type Anonymous. This path would be more complex as you would also need to manage what happens when the access token expires and a new full reauthentication is needed and any type of maintenance done to these created unique temporary operator id records.

5

@d.mcphail AuthenticateMashup worked just right. Thank you for referring that activity for custom bearer.