Name

OpenXPKI::Server::Workflow::Activity::Tools::EvaluateEligibility

Description

This activity can be used to check the eligibility of a request based on information available in the workflow against a data source. It first assembles a config path from the request context and fetches the value from this location. Afterwards it can check the reveived value against a whitelist of accepted values.

The result is always a boolean value (0 or 1) written into target_key.

The activity is designed to run within "shared workflows" and reads the data source configuration details from a config path. The default path is $interface.$server.eligible which can be changed by setting the config_path parameter.

Activity Configuration

config_path

The path where to look up the data source config (see next section).

The default is equivalent to

  map_config_path: "[% context.interface %].[% context.server %].eligible"

target_key

The context key to store the evaluation result. The default is eligibility_result.

raw_result

The context key to store the raw result of the query, this is optional.

pause_on_error

Set this if you have connectors that might cause exceptions. You also need to set a useful value for retry_count. Effective only in attribute mode! (see also OpenXPKI::Server::Workflow::Activity). If not set, connector errors will bubble up as exceptions to the workflow handler.

Data Source Configuration

Dynamic using a Connector

Put this configutation into your server configuration:

    eligible:
      value@: connector:your.connector
      args:
        - "[% context.cert_subject %]"
        - "[% context.url_mac %]"
      expect:
        - Active
        - Build

The check will succeed, if the value returned be the connector has a literal match in the given list.

If you do not specify an expect list, the return value is mapped to a boolean result by perl magic. Note: Perl magic might not work as expected if your data was transported in text format and has trailing newlines or any other "hidden" characters. Sanitize your input or use the match option.

Compare result using a RegEx

Instead of a static expect list, you can also define a regex to evaluate:

    eligible:
      value@: connector:your.connector
      args:
        - "[% context.cert_subject %]"
        - "[% context.url_mac %]"
      match:
        regex: (Active|Build)
        modifier: ''

Static

In cases where you just need a static value, independant from the actual request content, leave out the arguments section and use a literal value:

    eligible:
      value: 1

Sidenote: You can use a connector here as well, but in static mode we always test for a literal "1" as return value!