How Apps use identity
An App acts with the publisher’s identity and permissions by default. Basic and enhanced identity propagation let the App identify the current viewer without changing the permissions that the App uses to reach Domino resources. Extended identity propagation lets a trusted App request a full-scope token and act with the viewer’s permissions after the viewer consents. The App must opt in, and only a SysAdmin or CloudAdmin can publish an App that uses it. App security and identity has complete details about identity propagation, authentication headers, and JWT tokens.NetApp Volume and Dataset access in Apps
By default, Apps mount NetApp Volumes and Datasets that the App publisher can access, which means viewers can inherit access to data they cannot reach directly. To enforce viewer-specific permissions, configure identity propagation and use thedominodatalab-data SDK instead of the mounted file path. Pass the raw bearer token from the request’s Authorization header to the SDK client so Domino’s API can apply the viewer’s permissions. The domino-username header and decoded token claims can identify the viewer, but they do not authenticate an SDK call.
- NetApp Volumes
- Datasets
- Read the
Authorizationrequest header and remove itsBearerprefix. - Pass the remaining raw token to the
dominodatalab-dataclient. - Use the client to read, write, or download volume files under the viewer’s permissions.
Next steps
- Apps security and identity has complete details about identity propagation, authentication headers, and JWT tokens.
- Persist data using Datasets or external storage to make your Apps more dynamic and interactive.
- Share an App explains how to control discovery and viewing access, manage requests, and choose whose identity the App uses.