KeyMark Labs is excited to release version 23.4.0 of Forms inMotion. Our fourth release of the year covers many areas of the application with the intention of further securing and validation form package submissions with the introduction of Form Package Processors and support for Google ReCaptcha Enterprise. Additionally, the workflow engine has been significantly enhanced with the introduction of Interactive Workflows.
Interactive Workflows
Workflows in Forms inMotion typically follow a “fire and forget” pattern. That is, once the user has gathered all necessary data to execute a Forms inMotion workflow the workflow is invoked, and the results of the execution are only known if an administrator browses to the administration dashboard to check them.
Interactive Workflows introduces a new paradigm into the workflow engine by adding “Interactive Activities”. The first set of interactive activities are focused on the form package submission life cycle, however they can be brought in to any process through the use of the Forms inMotion plugin API.
Pictured below is a sample workflow illustrating an interactive workflow:
Form Package Processors
In previous versions of Forms inMotion, the validation of form package fields was handled exclusively by the Forms inMotion Workflows engine. After the package was submitted, logic could be run against the form package attachments and their fields to ensure that data matched requirements set by the host organization. If any data was present that did not meet those requirements, the web form would be informed of these issues and request the user fix them.
With this new version of Forms inMotion, new functionality has been added that we like to call Form Package Processors. This functionality can be used with any Forms inMotion Form package, pre-existing or new.
Form Package Processors run whenever a form package is submitted and before a workflow is invoked. This allows the administrator to “challenge” submitted form package data before the package data is completely committed and finalized. For example, in the below screenshot the VirusTotal attachment scanning plugin is used to ensure that no form package attachments contain malware:
Using a processor like this prevents any potentially malicious file from ever being placed on to the server’s long-term storage. Similarly processors can be created to enforce server-side rules like ensuring data validity without having to do lookups that could potentially expose sensitive data to the frontend.
Anonymous Authentication Providers
Frequently, prior to filling out a webform a user will have to fill out some form of challenge that ensures they are a human, and not a robot. Commonly these are called CAPTCHAs. Forms inMotion integrates challenges such as captchas now with a concept called Anonymous Authentication Providers.
Anonymous Authentication Providers provide a mechanism for a user to fulfil an authentication challenge. After the authentication challenge has been fulfilled, the user is assigned a system-managed identity with the permissions needed to fill out and submit the form package that the authentication provider is guarding.
The initial Anonymous Authentication Provider leverages Google’s Recaptcha Enterprise to seamlessly and silently validate the user’s authenticity without them having to click any checkboxes or select any pictures. Leveraging this feature ensures that, so long as the application is properly configured, Forms inMotion’s public forms are not susceptible to attacks by bots.
Anonymous Links
An additional feature added with Anonymous Authentication Providers is Form Package Links. Previously, when a Form Package was accessed it was through a single “anonymous link” that allowed the user access without a challenge. This new version includes the ability to dynamically create certain links, each one using a specific Authentication Provider to access the form package.
Additional Changes
Post Submit Links can now be created using Interactive Workflows to forward users to a webpage after a Form Package has been submitted.
System Managed Users are now created for every authentication provider. These users serve as the identities that users are given whenever signing in through an anonymous authentication provider. The managed users can be assigned to groups to grant them access to individual form packages.
The Request File Activity, and Finish Form Package Submission Activity have been added to ease two common workflows in an Interactive Form Package Workflow.
Portals now publish an embeddable link which will always show the most up-to-date version of the portal.
Thanks For Reading!
If you are an existing Forms inMotion customer and you’re interested in this feature, please reach out to us at support@keymarkinc.com to discuss an upgrade.
If you’re want to learn more about Forms inMotion please reach out to sales@keymarkinc.com
Thanks for reading!