Currently, all turbo applications use the username and password authentication flow along with connected app secret for data sync. However, this flow is not recommended for server-to-server communication due to the following challenges:

• Security Risks: Sharing sensitive data as username and password may have a chance of uninvited access.
• Authentication Issues: Turbo applications will fail at authentication Whenever the user changes the password.
• Maintenance: The Conga Support teams (TS) team has to change passwords in the tenant config file whenever the user changes them.

To overcome these issues, the TurboData team recommends using a JSON Web Token (JWT) based authentication for server-to-server communication where the certificate is used instead of the password to enhance security and user experience. JWT is a JSON encoded representation of a request(s) transferred between two parties and it allows the users to share the information securely. However, the validity of this certificate is one year, and the admin has to update the certificate once a year. Thus, changing the password will not affect the authentication.

Advantages of JWT based authentication:

• Reduces Security Risks: Reduce security risk as no password or client secret is stored.
• Low Maintenance: Users can change their passwords as required. If the user changes the password, redeployment is not required for configuration changes.

Sample Tenant Config (click to expand)

{
  "TenantId": "00XXXXXXeau",
  "TenantName": "Customer1Prod",
  "OpenIdConfiguration": {
    "Authority": "https://login.salesforce.com",
    "SalesforceUsername": "pricXXXXXdev",
    "ClientId": "3MVG9vXXXXXXXmn609",
    "RSAPrivateKey": ""
  },
  "ProcessorConfiguration": {
    "Parallel": 8,
    "BufferSize": 500
  },
  "DataSource": {
    "Type": "ElasticSearch",
    "Configuration": {
      "ServiceUrl": "https://ls-ibm-engg-elasticdata.apttuscloud.io:9200",
      "SuperAdmin": {
        "UserName": "elastic",
        "Password": "ElasXXXXXX90"
      },
      "ReadonlyUser": {
        "UserName": "elastic",
        "Password": "ElastXXXX90"
      }
    }
  },
  "CacheConfiguration": {
    "ConnectionString": "XXXXX"
  },
  "LightsaberDatabase": {
    "ConnectionName": "lightsaberdb",
    "MongoDbName": "iclsdev1-lsdb",
    "MongoDbConnectionString": "mongodb://localhost:27017"
  },
  "DatasyncConfiguration": {
    "InstanceUrl": "https://XXXXX.my.salesforce.com",
    "OAuthTokenUrl": "https://login.salesforce.com/services/oauth2/token",
    "SalesforceUsername": "pXXXev",
    "SalesforcePassword": "XXX0",
    "ClientId": "3MXXXXX609",
    "ClientSecret": "87XXXX9",
    "MongoDbConnections": [
      {
        "ConnectionName": "syncconfiguration",
        "MongoDbName": "iclsdev1-ds",
        "MongoDbConnectionString": "mongodb://localhost:27017"
      }
    ],
    "KafkaConfiguration": {
      "EventsTopicName": "XXX-datasyncEvents",
      "TriggerTopicName": "XXX-datasyncTrigger",
      "SchedulerTopicName": "XXX-datasyncScheduler",
      "PushTopicCreatedTopicName": "XXX-datasyncPushTopic",
      "ConsumerOrchestratorTopicName": "XXX-consumerorchestrator"
    }
  },
  "ElasticAdminApiEndPoint": "http://data-admin-api",
  "ActorApiEndPoint": "http://XXXXX.local",
  "x-forwarded-host": "XXXX.apttuscloud.io",
  "CMSApiEndpoint": "<CMS-PublicURL>"
}

Prerequisites:

• Public Key (Certificate): You must collect the key (certificate) from conga TS or Conga Ops.

• Existing users can invoke the following APIs (using datasync swagger) before enabling JWT authorization for verification purposes after enabling JWT.

  • /ds/api/dataintegration/v1/Validate - Trigger this API and copy the validation Id (guId) from the response.
  • /ds/api/dataintegration/v1/Validate/GetValidationResults - Trigger this API by passing validation id copied from the response of the above API. Then, save the response.

Enabling JWT authorization covers five major processes:

1. Identifying the Connected App
2. Setting up the Permitted Users
3. Uploading Public Certificate
4. Associating correct access for the connected app
5. Enabling JWT OAuth using a feature flag