World-class Security Frameworks

What is an Information Security Framework?

Data security depends on managing authentication and authorization.

• Authentication frameworks are the process by which you verify that a person who is attempting to access services and applications is who they claim to be
• Authorization frameworks allow you to give an authenticated person access to a specific resource or function within your system.

These fundamentals are at the heart of government cybersecurity frameworks and small business application security frameworks alike.

Security Frameworks in formsflow.ai

formsflow.ai utilizes the power of Keycloak to provide our users with industry-leading security frameworks to secure their organization’s data in transit and at rest. There are two key elements that set Keycloak apart and make it the perfect open-source security framework partner for us.

OpenID Connect

OpenID Connect allows clients of all types, including Web-based, mobile, and JavaScript clients, to request and receive information about authenticated sessions and end-users.

Many OpenID Connect Implementations have attained OpenID Certification for one or more certification profiles, including an authentication profile. Check here for a complete list: https://openid.net/certification/

Once installed, formsflow.ai users can create user roles, which are standardized across all the products. Inherent in each user role is the ability to be assigned to specific groups, or to be granted access to individual Realms.

Realms

In Keycloak, a Realm is a way of managing user permissions and authorizations based on a user’s assigned credentials, roles, and groups.

Within Keycloak, a user belongs to and logs into a Realm. Realms are isolated from one another and can only manage and authenticate the users they control. Each Realm shares a common security framework for authorization, access, and identity management.

With this in mind, here are a few key things to know about the interaction between users, groups, and roles within formsflow.ai’s constituent parts:

• Groups (and if needed, subgroups) are associated with roles
• Note that there is no client for Form.io – there is no direct login capability on Keycloak for form.io. All form administration is performed from the formsflow.ai UI
• In practice, users are assigned to groups and thereby inherit the roles
• Groups are also synced to Camunda so they are available for task filtering, email notifications, etc.

To learn more about how security frameworks operate within formsflow.ai, try it for free today.