---
title: "Configuring Collaboration Groups Using Data Connectors and Scripts"
slug: "fortanix-ccm-collaborating-groups-using-data-connectors-and-scripts"
updated: 2026-07-22T13:56:05Z
published: 2026-07-22T13:56:05Z
canonical: "support.fortanix.com/fortanix-ccm-collaborating-groups-using-data-connectors-and-scripts"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuring Collaboration Groups Using Data Connectors and Scripts

## 1.0 Introduction

This article describes the steps to create, update, and revoke collaborating groups in Fortanix Armor Identity and Access Management (IAM).

A **Collaborating Group** in Fortanix CCM represents a collaboration established between two Fortanix Armor IAM groups that belong to different Fortanix Armor accounts. Through this collaboration, the participating groups can securely share selected resources and work together on common workflows.

This document explains the end-to-end collaboration process, including creating collaborating groups, sharing collaboration tokens, building shared workflows, approving workflows, and managing collaboration lifecycle events.

## 2.0 Collaborating Groups Using Scripts and Data Connectors

A Fortanix Armor IAM collaborating group is created when groups from different Fortanix Armor accounts establish a collaboration. Through this collaboration, the groups can share resources and participate together in workflows.

In a collaborating setup:

- One group acts as the [**consumer group**](/v1/docs/fortanix-armor-identity-and-access-management-iam#51-consumer-group) and initiates the collaboration.
- One group acts as the [**publisher group**](/v1/docs/fortanix-armor-identity-and-access-management-iam#52-publisher-group) and participates by contributing permitted resources.

The collaboration is represented and managed through shared workflows, which enforce controlled interaction, approval sequencing, and access restrictions between participating groups.

This article describes collaboration between two Fortanix Armor IAM groups from different Fortanix Armor accounts using a workflow that includes a Script and two Data Connectors. In this example, one group acts as the consumer group and another group acts as the publisher group.

## 3.0 Create Consumer Group

This section describes how to create consumer groups that participate in a workflow collaboration with publisher groups.

In this example, a consumer group is created in a Fortanix Armor account and initiates collaboration with publisher groups using a shared Fortanix CCM workflow. The consumer group adds Scripts and Data Connector placeholder node to the workflow, enabling publisher groups to contribute Data Connectors to the shared workflow.

Perform the following steps to create a consumer group for workflow-based collaboration:

1. Log in to Fortanix Armor and create a new account, for example, **DemoA,** or log in to an existing account. *For more information on how to log in and create a new Fortanix Armor account, refer to* [*Getting Started with Fortanix Armor*](/v1/docs/fortanix-armor-getting-started).
2. On the **Available Solutions** page, select **Identity and Access Management**.
3. In the IAM user interface (UI) left navigation panel, click **Groups**, and then on the **GROUPS** tab, click **ADD GROUP** to create the consumer group.
4. In the **Create group** dialog box:
  1. **Name**: Enter a group name. For example, **DemoA-Group1**.
  2. **Add description**: Click this to add a description, if needed.
  3. **Labels**: Add one or more Key-Value labels to the group
5. Click **CREATE GROUP** to add a new consumer group.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/fortanix-confidential-computing-manager-configuring-third-party-groups-using-data-connectors-and-scripts-v1.0-image-tomddxsh.png)

**Figure 1: Consumer group created**

### 3.1 Create Scripts

Perform the following steps to create scripts:

1. From the Armor **Solutions** drop down menu on the top navigation bar, click **Confidential Computing Manager** to open the CCM UI.
2. In the CCM UI left navigation panel, click **Scripts**, and then click **ADD SCRIPT** to add an SQL script.
3. In the **Add Script** form:
  1. **Script name**: Enter the required name for your script.
  2. **Group**: Select the required group from the drop down menu to associate the configuration with that group. For example, **DemoA-Group1**.
  3. **Description** (optional): Enter a brief description of your script.
  4. **Select query language**: Click the appropriate radio button to select the query language as **SQL**, **SQL Aggregate** or **Python** for your script. Use the provided text area to enter the relevant SQL commands or Python code.
4. Click **ADD SCRIPT** to initiate the script creation.
5. Repeat *Steps 3 to 5* to create an SQL Aggregate script in the consumer group.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/fortanix-confidential-computing-manager-configuring-third-party-groups-using-data-connectors-and-scripts-v1.0-image-6f9zow1u.png)

**Figure 2: Create Scripts for the consumer Group**

## 4.0 Create Publisher Groups

This section describes how to create a publisher group that participates in workflow collaboration with a consumer group.

In this example, two publisher groups are created in a different Fortanix Armor account and contributes the application to a shared workflow initiated by the consumer group.

> [!NOTE]
> NOTE
> 
> To collaborate with resources in the consumer group, you must create an additional group in a different Fortanix Armor account, as collaboration between groups within the same account is not supported.

Perform the following steps:

1. Create two new Fortanix Armor accounts, for example, **DemoB** and **DemoC**, or log in to an existing account. *For more information on how to log in and create a new Fortanix Armor account, refer to* [*Getting Started with Fortanix Armor*](/v1/docs/fortanix-armor-getting-started#40-create-an-account).
2. Repeat *Steps 2 to 5 in* [*Section 3.0: Create Consumer Group*](/v1/docs/fortanix-ccm-collaborating-groups-using-data-connectors-and-scripts#30-create-consumer-group) *in Fortanix Armor*, to create the two new publisher groups, for example, **DemoB-Group2** and **DemoC-Group3**.

### 4.1 Create Inbound Connectors

Perform the following steps to create an inbound connector:

1. From the Armor **Solutions** drop down menu on the top navigation bar, click **Confidential Computing Manager** to open the CCM UI.
2. In the CCM UI left navigation panel, click **Dataverse**, and then on the **INBOUND CONNERTORS** tab, click **ADD INBOUND CONNECTOR** to add a new inbound connector.
3. In the **INBOUND CONNECTOR** form:
  1. **Select Connector Type**: Select **BigQuery**.
  2. **Connector name**: Enter a name for the inbound connector.
  3. **Description** (Optional): Enter a short description of the connector.
  4. **Group**: Select the required group from the drop down menu to associate the configuration with that group. For example, **DemoB-Group2**.
  5. **Project ID**: Enter the ID of the BigQuery project.
  6. **Dataset name**: Enter the name of the dataset from which you want to import data.
  7. **Table name**: Enter the name of the table within the specified dataset.
  8. **Label Details**: Add one or more key–value labels to the connector.
  9. **Table Schema**: Define the schema by adding field details or importing the schema using **IMPORT FROM BIGQUERY JSON**.
  10. **API key**: Enter the API key (Service Account JSON) required for accessing the BigQuery service in the text box provided. You can also upload the API key in **Raw** or **Base64** format using **browse**. *For more information on how to generate this API key, refer to* [*Google Cloud: Create an API Key*](https://cloud.google.com/docs/authentication/api-keys#create)*.*

> [!NOTE]
> NOTE
> 
> The API key cannot be viewed again after submission.
4. Click **ADD INBOUND CONNECTOR** to create the inbound connector.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/fortanix-confidential-computing-manager-configuring-third-party-groups-using-data-connectors-and-scripts-v1.0-image-wegze06x.png)

**Figure 3: Create inbound connector for publisher group**

### 4.2 Create Outbound Connectors

Perform the following steps to create an outbound connector:

1. In the CCM UI left navigation panel, click **Dataverse**, and then on the **INBOUND CONNERTORS** tab, click **ADD INBOUND CONNECTOR** to add a new inbound connector.
2. In the **OUTBOUND CONNECTOR** form:
  1. **Connector name**: Enter a required name for the outbound connector.
  2. **Description** (Optional): Add a brief description to provide additional context if needed.
  3. **Group**: Select the required group from the drop down menu to associate the configuration with that group. For example, **DemoC-Group3**.
  4. **URL**: Enter the pre-signed URL where the CSV file is located containing, the exported data from the script.
  5. **Label Details** (Optional): Add one or more key–value labels to the connector.
3. Click **ADD OUTBOUND CONNECTOR** to create the outbound connector.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/fortanix-confidential-computing-manager-configuring-third-party-groups-using-data-connectors-and-scripts-v1.0-image-v195ois8.png)

**Figure 4: : Create outbound connector for publisher group**

## 5.0 Generate Collaboration Token

To initiate collaboration, a consumer group must authenticate itself to a publisher group. Without authentication, a publisher group could receive unsolicited or spam collaboration requests from another consumer group. To prevent this, the publisher group administrator generates a collaboration token, which serves as proof of identity for collaboration requests.

When a consumer group requests collaboration, it includes the collaboration token provided by the publisher group in the request. The publisher group then verifies the token and authenticates the consumer group before allowing the collaboration to proceed.

Perform the following steps to generate the collaboration token in Fortanix Armor IAM:

1. Go to the detailed view of **DemoB-Group2** in the **DemoB** account.
2. Click **COLLABORATE** to generate a new collaboration token.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot(4063)(1).png)

**Figure 5: Collaborate**
3. In the **Collaborate** dialog box, click **GENERATE TOKEN** to generate the token.
4. Once the token is generated, click **COPY** to copy the collaboration token.
5. You must share this collaboration token with the consumer group administrator to enable collaboration. The method used to share the collaboration token is outside the scope of this guide.
6. Similarly, go to the detailed view of **DemoC-Group3** in the **DemoC** account and repeat *Steps 2 to 5* to generate and copy the collaboration token for **DemoC-Group3**. Then, share this token with the consumer group.
7. Click **Show previous tokens** to view the previously generated tokens.

## 6.0 Create Collaboration Group

This section explains the collaboration process between the consumer group and the publisher group using the collaboration token shared by the publisher group.

Perform the following steps to create a collaborating group for workflow collaboration:

1. Open the detailed view of the consumer group, for example, **DemoA-Group1**, in the **DemoA** account.
2. Click **ACCEPT TOKEN**.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot(4064)(1).png)

**Figure 6: Accept collaboration token**
3. In the **Accept token** dialog box, paste the collaboration token shared by the publisher group in *Section 5.0: Generate Collaboration Token*.
4. Click **PROCEED** to initiate the collaboration request.
5. Navigate to **Groups** and select the **COLLABORATION GROUPS** tab.
6. On the **CONSUMER** tab, verify that the consumer group **DemoA-Group1** appears associated with the publisher group **DemoB-Group2**.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot(3983)(1).png)

**Figure 7: Consumer group collaboration request**
7. In the **Status** column, observe that the collaboration request is in **Pending** state.

> [!NOTE]
> NOTE
> 
> The publisher group must accept the collaboration request before collaboration can begin.
8. Go to the publisher group (**DemoB-Group2**) and navigate to the **COLLABORATION GROUPS** tab.
9. On the **PUBLISHER** tab, verify that **DemoB-Group2** shows an association request from **DemoA-Group1**.
10. Click the overflow menu for the publisher group row and click **Accept** to approve the collaboration request.
11. Verify that the collaboration status updates to **Accepted** in the publisher group view.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot(4066)(1).png)

**Figure 8: Status accepted**
12. Return to the consumer group account (**DemoA**) and confirm that the collaboration status for the consumer group (**DemoA-Group1**) also shows **Accepted**.
13. Repeat *Steps 1 to 12* to create a collaborating group between **DemoA-Group1** and **DemoC-Group3** using the collaboration token generated by **DemoC-Group3**.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/fortanix-confidential-computing-manager-configuring-third-party-groups-using-data-connectors-and-scripts-v1.0-image-od0cn5a3.png)

**Figure 9: Status accepted**

## 7.0 Create a Shared Workflow

After creating the collaborating groups, the consumer group administrator initiates collaboration by creating a shared workflow.

In the shared workflow, the consumer group administrator creates /glo. Each placeholder node is assigned to a specific publisher group, and only administrators of that publisher group can populate the placeholder nodes assigned to them.

Perform the following steps as a consumer group administrator to create a shared workflow:

1. In the CCM UI left navigation panel, click the **Workflows** menu item in the **DemoA** account.
2. On the **Workflows** page, click **ADD WORKFLOW** to create a new workflow.
3. In the **Add workflow** form:
  1. **Name**: Enter a name for the workflow.
  2. **Group**: Select the consumer group (**DemoA-Group1**) for the shared workflow.
  3. Click **ADD WORKFLOW** to create the shared workflow.
4. On the workflow canvas, add the SQL script that belongs to the consumer group, **DemoA-Group1** created in [*Section 3.1: Create Scripts*](/v1/docs/fortanix-ccm-collaborating-groups-using-data-connectors-and-scripts#31-create-scripts).
5. On the workflow canvas, add the SQL aggregate script that belongs to the consumer group, **DemoA-Group1** created in [*Section 3.1: Create Script*](/v1/docs/fortanix-ccm-collaborating-groups-using-data-connectors-and-scripts#31-create-scripts).
6. Add an inbound connector placeholder node to the workflow and assign it to the publisher group, **DemoB-Group2**.
7. When prompted, select **DemoB-Group2** as the publisher group that will populate this inbound connector placeholder.
8. Repeat *Steps 6 and 7* to add an outbound connector placeholder node and assign it to the publisher group, **DemoC-Group3**.
9. Connect the scripts nodes to both data connectors placeholder nodes to define the workflow data flow.
10. Click **SAVE DRAFT** to save the workflow.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (4217).png)

**Figure 10: Create workflow in DemoA**

Saving the workflow as a draft makes it available to the publisher groups, allowing administrators of the assigned publisher groups to access the draft workflow in their respective accounts and populate the placeholder nodes assigned to them.

### 7.1 Fill the Placeholder Nodes with Actual Data

After the consumer group creates the shared workflow and assigns placeholder nodes, members of the publisher groups populate the placeholder nodes with their own resources.

Each publisher group can update only the placeholder node assigned to its group. Publisher group administrators cannot add, remove, or modify other nodes in the workflow.

Perform the following steps as a publisher group administrator:

1. Log in to the **DemoB** account and in the CCM UI left navigation panel, click the **Workflows** menu item.
2. On the **Workflows** page, click the **Draft** menu item. The draft shared workflow created by the consumer group appears in the list.
3. Select the workflow and locate the **inbound connector** **placeholder node** assigned to the publisher group **DemoB-Group2**.
4. In the **Add Inbound Connector** form, select the inbound connector created earlier in [*Section 4.1: Create Inbound Connector*](/v1/docs/fortanix-ccm-collaborating-groups-using-data-connectors-and-scripts#41-create-inbound-connectors) from the list.
5. Click **ADD INBOUND CONNECTOR** to save the updated shared workflow.
6. Log in to the **DemoC** account and repeat *Steps 1 to 5* as an administrator of the publisher group **DemoC-Group3**, and select the outbound connector created earlier in [*Section 4.2: Create Outbound Connector*](/v1/docs/fortanix-ccm-collaborating-groups-using-data-connectors-and-scripts#42-create-outbound-connectors).

After all publisher groups populate their assigned placeholder nodes, the shared workflow is complete and ready for approval.

### 7.2 Request Approval to Create an Approved Workflow

After all publisher groups fill their assigned placeholder nodes, the shared workflow is ready for approval.

Each publisher group must review and approve the workflow before the consumer group can complete the approval process.

> [!NOTE]
> NOTE
> 
> The consumer group cannot approve the workflow until all publisher groups approve it. This ensures that each publisher group explicitly consents to the data being shared.

Perform the following steps to request and approve the shared workflow:

1. Log in to the **DemoA** account as a consumer group administrator.
2. In the CCM UI left navigation panel, navigate to **Workflows** → **Drafts**.
3. Locate the workflow for which you want to request approval and click the dropdown arrow to expand it.
4. Click **REQUEST APPROVAL** to send the approval request to all the publisher groups.

> [!NOTE]
> NOTE
> 
> Alternatively, you can click **VIEW DETAILS** for the required workflow and then click **SAVE AND REQUEST APPROVAL**.
5. On the **Request approval for draft workflow** confirmation dialog box, click **REQUEST APPROVAL** to submit the approval request to the publisher groups. The workflow moves to the **Pending** state.
6. Go to the **Pending Approval** tab to view workflows awaiting approval.
7. Log in to the **DemoB** account as a publisher group administrator. Navigate to **Workflows** → **Pending Approval**.
8. Click the shared workflow from the list or click the dropdown arrow to expand it.
9. Click **VIEW APPROVAL** for the shared workflow.
10. In the **Approval request** confirmation dialog box, click **APPROVE**.
11. After the publisher group approves the workflow, log in to the **DemoA** account as the consumer group administrator, navigate to **Workflows** → **Pending Approval** tab, and click **VIEW APPROVAL** to complete the approval process.

The workflow now appears in the **Approved** tab.

> [!NOTE]
> NOTE
> 
> After a shared workflow reaches the **Approved** state, it cannot be modified. To make changes, edit the workflow to create a new version using **EDIT WORKFLOW**. After approval, the new version replaces the previous one.

### 7.3 Run the Shared Workflow

Only the consumer group administrator, who owns the workflow, can run a shared workflow.

The members of the publisher groups cannot run the workflow.

*For more information on how to run the workflow, refer to* [*Run the Workflow - Web Interface - Connectors and Scripts*](https://support.fortanix.com/docs/fortanix-ccm-run-the-workflow-web-interface-connectors-scripts)*.*

After the workflow runs, execution logs are available only to the consumer group. The members of the publisher groups cannot view the workflow execution logs.

## 8.0 Manage Tokens

### 8.1 Revoke Token

A collaboration token can be revoked by a publisher group administrator.

Revoking a collaborating token does not affect existing active collaborations between the publisher group and consumer group that were established using that token. Any existing shared workflows continue to function as expected.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/fortanix-confidential-computing-manager-collaborating-groups-and-shared-workflow-using-amd-sev-snp-applications-v2.0-image-ql8rtvbr.png)

**Figure 11: Revoke token**

### 8.2 Revoke Status

Perform the following steps to revoke a collaboration between a consumer group and a publisher group:

1. Navigate to the **COLLABORATION GROUPS** page.
2. Locate the collaboration entry you want to revoke.
3. Click the overflow menu for the corresponding row and select **Revoke** from the drop down menu to revoke the collaboration.

You can revoke the collaboration from either the consumer group or the publisher group.

After you revoke the collaboration, the shared workflow cannot progress, and collaboration between the groups stops.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/fortanix-confidential-computing-manager-collaborating-groups-and-shared-workflow-using-amd-sev-snp-applications-v2.0-image-gl2wg1bj.png)

**Figure 12: Revoke collaboration status**

It is a node in the Fortanix CCM workflow graph. This node can be filled with various Fortanix CCM resources, such as applications, datasets, and so on.

## Related

- [Inbound Connector](/fortanix-ccm-inbound-connector.md)
- [Fortanix DSM with Sumo Logic (SIEM) for Windows Server](/using-fortanix-dsm-with-sumo-logic-siem-integration-guide-for-windows-server.md)
- [Key Operations](/fortanix-dsm-key-operations.md)
- [Create, Update, Clone, and Delete Workflows](/fortanix-ccm-create-update-clone-and-delete-workflows.md)