Custom SDK authentication fails when triggered by PX in configuration management workflows

I’m developing custom SDK-based authentication for automated configuration management workflows in Agile 9.3.6. The authentication works perfectly when invoked directly from Java code, but fails consistently when the same code is triggered by a Process Extension (PX) during workflow transitions.

The PX error log shows:


AuthenticationException: Missing credentials
at CustomAuthHandler.authenticate()
at ConfigWorkflowPX.doAction()
Caused by: No security context available

The issue appears to be that the PX authentication context doesn’t include the necessary credentials for SDK session handling. When the workflow automation triggers the PX, there’s no user context available for the SDK to authenticate against.

How do I properly configure PX authentication context and SDK session handling for automated workflow integration scenarios?

Consider implementing a PX base class that handles all the authentication boilerplate. This way, your specific workflow PX extensions can inherit the authentication logic without duplicating code. The base class should manage session creation, credential retrieval, error handling, and session cleanup.

I’ll walk you through a complete solution addressing PX authentication context, SDK session handling, and automated workflow integration.

PX Authentication Context:

The fundamental issue is that Process Extensions execute in a server-side context without an implicit user session. You must explicitly create an authenticated session within your PX code. First, configure a dedicated service account for PX operations:

  1. Create a service account in Agile with appropriate permissions for configuration management operations
  2. Store credentials securely in Agile’s property configuration
  3. Grant the service account necessary roles for your workflow operations

In your PX implementation, retrieve and use these credentials:

String username = PropertyReader.getProperty("px.service.account.user");
String password = PropertyReader.getProperty("px.service.account.pwd");
String url = PropertyReader.getProperty("agile.server.url");

SDK Session Handling:

Implement proper session lifecycle management within your PX. Create a session at the start of PX execution and ensure cleanup in all code paths:

public class ConfigWorkflowPX implements IEventSubscriber {
    private IAgileSession session = null;

    public void doAction(IEventInfo event) {
        try {
            session = createPXSession();
            performWorkflowAction(session, event);
        } finally {
            if (session != null) session.close();
        }
    }
}

The createPXSession() method should handle authentication with proper error handling and retry logic. This ensures your PX always has a valid authenticated session regardless of how it’s triggered.

Automated Workflow Integration:

For seamless workflow automation, implement a session factory pattern that centralizes authentication logic:

public class PXSessionFactory {
    public static IAgileSession createSession() {
        // Retrieve service account credentials
        // Create and authenticate session
        // Return authenticated session
    }
}

This factory should be used by all your PX extensions to ensure consistent authentication behavior. It should also implement connection pooling to improve performance when multiple PX instances execute concurrently.

Complete Implementation:

Here’s the recommended structure for your ConfigWorkflowPX:

public class ConfigWorkflowPX implements ICustomEventSubscriber {

    public void doAction(IEventInfo event) {
        IAgileSession pxSession = null;

        try {
            // Create authenticated session for PX context
            pxSession = PXSessionFactory.createSession();

            // Retrieve event data
            IChange change = (IChange) event.getDataObject();

            // Execute custom authentication logic
            CustomAuthHandler authHandler = new CustomAuthHandler(pxSession);
            authHandler.authenticate();

            // Perform configuration management operations
            performConfigUpdate(pxSession, change);

        } catch (APIException e) {
            // Log error and handle gracefully
            logError("PX authentication failed", e);
            throw new EventException("Workflow automation failed", e);
        } finally {
            // Always close session to prevent leaks
            if (pxSession != null) {
                try {
                    pxSession.close();
                } catch (APIException e) {
                    logError("Session cleanup failed", e);
                }
            }
        }
    }
}

Key Implementation Points:

  1. Session Creation: Always create a new session within the PX. Don’t attempt to reuse or inherit sessions from the triggering user.

  2. Credential Security: Store service account credentials in Agile’s encrypted property store, not in code or configuration files.

  3. Error Handling: Implement comprehensive error handling. If authentication fails, the PX should log the error and fail gracefully without breaking the workflow.

  4. Session Cleanup: Use try-finally blocks to ensure sessions are always closed, even when exceptions occur. Unclosed sessions cause memory leaks and license consumption.

  5. Transaction Management: Create the session before starting any database transactions. The authentication must complete before transactional operations begin.

Testing Strategy:

Test your PX in three scenarios:

  1. Manual Trigger: User manually initiates the workflow transition that triggers the PX
  2. Scheduled Trigger: Automated scheduler triggers the workflow
  3. Cascading Trigger: Another PX or API call triggers the workflow

All three scenarios should execute successfully with proper authentication. Monitor session creation/cleanup in the application server logs to verify no session leaks occur.

Performance Optimization:

For high-volume workflows, implement session pooling in your PXSessionFactory. This reduces authentication overhead when multiple workflow instances execute simultaneously. Configure a pool of 5-10 pre-authenticated sessions that PX instances can borrow and return.

Monitoring and Auditing:

Implement logging to track PX authentication events. Log successful authentications, failures, and session lifecycle events. This provides audit trails for troubleshooting and compliance purposes.

With this implementation, your custom SDK authentication will work reliably when triggered by PX in configuration management workflows, with proper security context and session management throughout the automated workflow integration.

I’ve implemented similar automated workflow integration. The tricky part is maintaining the authentication context across the entire workflow chain. If your configuration management workflow has multiple PX triggers, each one needs its own session management. You can’t pass a session from one PX to another - each must authenticate independently. Also, be aware of transaction boundaries. If your PX modifies data, the session must be created before the transaction starts, not during it.

The missing security context error indicates your PX is trying to inherit the user’s session, but workflow automation runs asynchronously without a user context. You have two options: configure a service account specifically for PX operations, or implement session delegation where the PX creates its own authenticated session using stored credentials. I recommend the service account approach for better auditability. Store the service account credentials in Agile’s secure properties and retrieve them at runtime.

PX extensions run in a different security context than direct SDK calls. You need to explicitly set up an admin session within your PX code before calling SDK methods that require authentication. Use the IAgileSession.createSession() method with admin credentials at the beginning of your PX execution.

For SDK session handling in PX context, you need to understand the session lifecycle. When a PX executes, it doesn’t automatically have an authenticated session. You must create a session programmatically within the PX code itself. The key is using the AgileSessionFactory with proper authentication parameters. Make sure you’re also closing the session properly in a finally block to avoid session leaks.