User's Guide: Configuring Third-Party Groups Using Data Connectors and Scripts

1.0 Introduction

Welcome to the Fortanix Confidential Computing Manager (CCM) User Guide. This article describes the steps to create, update, and revoke third-party groups in CCM.

A Fortanix CCM third-party group is an entity that is created when two groups from different Fortanix CCM accounts wish to collaborate. During collaboration, they can share the Dataverse objects of each other’s groups.

2.0 Create Source Group

The following section describes an example to explain the collaboration between three CCM groups from different CCM accounts using a workflow where one group will be the Source group and the other two groups will be the Recipient groups.

Perform the following steps to create a third-party source group for workflow collaboration:

1. Log in to Fortanix CCM and create a new account. For example: DemoA or go to an existing account. For steps to log in and create a new Fortanix CCM account, refer to User’s Guide: Logging In.

2. On the Groups page, click ADD GROUP on the top-right corner of the screen to create the source group.

   

3. In the Create Group form, enter the Name of the source group. For example: DemoA-Group1.

4. Click CREATE GROUP to create the source group.

   

The group is successfully created.

2.1 Create Scripts

Perform the following steps to add multiple scripts to the source group, DemoA-Group1:

1. Click the group to go to the detailed view of the source group.

2. Create new scripts in the source group to participate in the workflow collaboration. Click the add button   on the Scripts tile.

   

3. In the ADD SCRIPT form, enter the following details:

   • Name: Enter the required name for your script in the provided field.

   • Description (optional): Enter a brief description of your script.

   • Select query language: Click the corresponding radio button to select the query language as SQL or Python for your script. Use the provided text area to enter the commands relevant to your script.

4. Click the CREATE SCRIPT button to initiate the script creation process for the source group DemoA-Group1.

5. Repeat Step 2 to 4 to create SQL Aggregate script in the source group.

   

The SQL statement and SQL Aggregate scripts are created successfully.

3.0 Create Recipient Groups

Perform the following steps to create the recipient groups to participate in a workflow collaboration:

1. Create two new Fortanix CCM accounts, For example: DemoB and DemoC or log in to existing accounts if already present. For steps to log in and create a new Fortanix CCM account, refer to User’s Guide: Logging In.

2. Repeat Steps 2 to 4 in Section 2.0: Create Source Group, to create the two new recipient groups. For example: DemoB-Group2 and DemoC-Group3.

3.1 Create Inbound Connectors

Perform the following steps to add an inbound connector to the recipient group, DemoB-Group2:

1. Click the group to go to the detailed view of the recipient group.

2. Create new inbound data connector in the recipient group to participate in the workflow collaboration. Click the add button   on the Inbound connector tile.

   

3. In the INBOUND CONNECTOR form, select either of the following connecter types:

   • BigQuery: Select this option if you want to import data from BigQuery.

   • CSV: Select this option if your data is in CSV format and you want to import it using this connector.

4. Click the NEXT button to proceed further.

5. On the Create INBOUND CONNECTOR page,

   • If you have selected the BigQuery option in Step 3, enter the following details:

     • Connector name: Enter a required name for the inbound connector.

     • Description (Optional): Add a brief description to provide additional context if needed.

     • Labels: Assign one or more key-value labels to categorize or tag the connector.

     • Project ID: Enter the ID of the BigQuery project.

     • Dataset name: Enter the name of the dataset from which you want to import data.

     • Table name: Enter the name of the table within the specified dataset.

     • API key: Enter the API key required for accessing the Big Query service in the text box provided. You can also upload the API key in Raw or Base64 format using the browse option. To know the steps for generating this API key, refer to the Google Cloud: Create an API Key documentation.

       NOTE

       The API key cannot be viewed again after submission.

   • If you have selected the CSV option in Step 3, enter the following details:

     • Connector name: Enter a required name for the inbound connector.

     • Description (Optional): Add a brief description to provide additional context if needed.

     • Labels: Assign one or more key-value labels to categorize or tag the connector.

     • Group: Select the required group name from the drop down menu to associate this connector with that group.

     • URL: Enter the URL where the CSV file is located for importing data.

       NOTE

       Pre-designed URL is supported for Amazon Web Services (AWS), Azure, and Google Cloud Platform (GCP).

6. Click the ADD INBOUND CONNCETOR button to initiate the inbound connector creation process for the source group DemoB-Group2.

   

The inbound data connector is created successfully.

4.2 Create Outbound Connectors

Perform the following steps to add multiple outbound connectors to the recipient group, DemoC-Group3:

1. Click the group to go to the detailed view of the recipient group.

2. Create new outbound data connector in the recipient group to participate in the workflow collaboration. Click the add button   on the Outbound connector tile.

   

3. On the Create OUTBOUND CONNECTOR page, enter the following details:

   • Connector name: Enter a required name for the outbound connector.

   • Description (Optional): Add a brief description to provide additional context if needed.

   • Labels: Assign one or more key-value labels to categorize or tag the connector.

   • URL: Enter the URL where the CSV file is located containing the exported data from the script.

4. Click the ADD OUTBOUND CONNCETOR button to initiate the outbound connector creation process for the source group DemoC-Group3.

   

The outbound connector is created successfully.

4.0 Share Participation Token

For a Fortanix CCM source group to request a Fortanix CCM recipient group for collaboration, the source group must prove itself to be an authenticated group. This can be achieved if the recipient groups create a 'group participation token', that can be used to identify themselves. When the source group requests a recipient group for collaboration, the recipient group provides the group participation token to identify itself. The recipient group verifies the participation token in the request and authenticates the source group.

To share the participation token:

1. Go to the detailed view of DemoB-Group2 in the DemoB account.

2. Navigate to the GENERAL tab → Participation Tokens section → GENERATE TOKEN button to generate a new participation token. 

   

3. Click the COPY icon to copy the participation token. This participation token must be shared with the source group for collaboration. The means by which the token can be shared is out of the scope of this guide.

   

4. Similarly, go to the detailed view of DemoC-Group3 in the DemoC account and repeat Steps 2 to 3 above to copy the participation token of DemoC-Group3 and share it with the source group, DemoA-Group1.

5. You can also view the generated participation token by clicking the VIEW TOKENS button.

   

2.4 Create Third-Party Shared Group

Perform the following steps to create a third-party group for workflow collaboration:

1. Go to the detailed view of the source group, that is, DemoA-Group1, in the account DemoA.

2. Click the SHARE button on the top-right corner of the page.

   

3. In the TOKENS dialog box, paste the group participation token shared by the recipient group in Section 4.0: Share Participation Token.

4. Click the SHARE button to create the third-party group.

   

5. On the Groups page, click the THIRD PARTY GROUPS tab.

6. On the Third Party Groups page, under the SOURCE ROLE tab, you will see that the source group DemoA-Group1 in the GROUP column is now associated with a recipient group DemoB-Group2 in the RECIPIENT GROUP column.

   

7. In the STATUS column, you will see that the status of the third-party group creation is still in a Pending state.

   NOTE

   The recipient groups must accept the third-party group so that collaboration can begin between the respective source and the recipient groups

8. Go to the recipient group DemoB-Group2 and click the THIRD PARTY GROUPS tab.

9. Click the RECIPIENT ROLE tab. Observe that the recipient group DemoB-Group2 now shows an association with the source group DemoA-Group1.

   

10. Click the more option   icon for the recipient group row and expand the UPDATE STATUS menu to approve the third-party group association.

11. Click the APPROVE button to approve the collaboration.

    

12. The status is now updated to Accepted in the recipient and source groups.

    

13. Go to the source group and observe that the status is now updated to Accepted.

    

14. Similarly, repeat Steps 1 to 13 above to create a third-party shared group between the source group DemoA-Group1 and the recipient group DemoC-Group3 using the participation token shared by the DemoC-Group3 group member with DemoA-Group1 group administrator.

    

6.0 Create a Shared Workflow

The source group administrator will now initiate the collaboration between the source and recipient groups by creating a shared workflow. To create a shared workflow for workflow collaboration, the source group administrator will create placeholder nodes and assign these nodes to the group members of the recipient groups to update the node with the data connectors for the collaboration.

Perform the following steps as a source group administrator to create a shared workflow:

1. In the DemoA account, click the Workflows menu item in the CCM user interface (UI) left navigation bar.

2. On the Workflows page, click +WORKFLOW to create a new workflow.

3. In the CREATE NEW WORKFLOW form,

   1. Enter the workflow Name.

   2. In the Group field (optional), select the source group for the shared workflow. If no group is selected, the default group will be considered.

   3. Click CREATE WORKFLOW, to create the shared workflow.

      

4. On the workflow graph, add an inbound connector placeholder node that belongs to the recipient group DemoB-Group2.

   

   For more information on how to create a workflow graph, refer to User’s Guide: Create Workflow.

5. Add an SQL or Python script node that belongs to the source group DemoA-Group1.

   

   NOTE

   The script can belong to any internal group that the user is part of.

6. Add an SQL Aggregate script that belongs to the source group, DemoA-Group1.

   

7. Add an outbound connector placeholder node that will be assigned to the recipient group DemoC-Group3.

   

8. Make a connection between the data connectors and scripts.

9. Click SAVE AS DRAFT to save the workflow as a draft so that the members of the recipient groups will see the draft workflow in their respective accounts and fill the placeholder nodes.

   

7.0 Fill the placeholder Nodes with Actual Data

The following steps must be performed by the recipient group members:

1. As a group member of the recipient group DemoB-Group2 in the account DemoB, go to the Workflows page and click the Draft workflow tab.

2. You will see the placeholder node that has been assigned to you by the group administrator of the source group DemoA-Group1.

   

3. Click the placeholder node to add the inbound connector. In the INBOUND CONNECTOR form, select the inbound connector that you created earlier in Section 3.1: Create Inbound Connectors from the list.

   

4. After adding the inbound connector, click SAVE AS DRAFT to save the updated shared workflow.

   

5. As a group member of the recipient group DemoC-Group3, go to the DemoC account and repeat Steps 1 to 4 above to fill the placeholder node with the outbound connector that you created earlier in Section 3.2: Create Outbound Connectors.

   

Now the workflow is complete with all the placeholder nodes filled by the respective recipient group members.

8.0 Request Approval to Create Approved Workflow

After a workflow with placeholder nodes is filled with the objects from the required recipient groups and is ready to go, each of the recipient groups should approve it.

After the shared workflow is approved by all participant groups, the shared workflow will be an approved workflow. Perform the following steps to create an approved workflow:

1. As a group administrator of the source group DemoA-Group1, go to the Draft workflow tab, and click the REQUEST APPROVAL button to request the recipient group members for workflow approval.

   

   The workflow is now pending approval from other recipient group members. Click the Pending tab to see the workflow in the pending approval state.

   

2. As group members from the recipient groups, you must approve the workflow. Go to the Workflows page in DemoB account, and in the Pending tab, click SHOW APPROVAL REQUEST to approve the workflow.

   

3. In the APPROVAL REQUEST – CREATE WORKFLOW dialog box, click APPROVE to approve the workflow.

   

4. As a group member of the recipient group DemoC-Group3, repeat Steps 2 to 3 above to approve the workflow.

   

5. After the recipient group members have approved the workflow, the group administrator of the source group must finally approve the workflow to complete the workflow approval process.

   

6. The shared workflow will now appear in the Approved tab.

   

9.0 Run the Shared Workflow

A shared workflow can only be run by the owner of the workflow, that is, the source group administrator. The participants, that is, the recipient group members, cannot run the workflow.

To run the workflow, refer to the User's Guide - Configure and Run the Workflow documentation.

After running a workflow, the workflow execution logs will only be available for viewing at the source group. The recipient group members cannot view the execution logs.

10.0 Revoke Token

A “Group Participation Token” can be revoked by the recipient group member. Revoking of a Group Participation Token does not affect the existing third-party group collaboration between the recipient group and the source group. The workflow collaboration will not work after this.

11.0 Revoke Status

To revoke the collaboration with the recipient or source group, click the More options icon in the Third Party Groups page, and click REVOKE against the source or recipient group’s row to revoke or break the collaboration. The workflow collaboration will not work after this. The collaboration can be revoked from the source or recipient groups.