vRA: The importance of input validation when creating advanced services

The Advanced Service Designer (ASD) of vRealize Automation (vRA), f.k.a. vCloud Automation Center, allows you to provide Anything-as-a-Service to the portal users. The ASD publishes vRealize Orchestrator (vRO) workflows in the portal of vRealize Automation. The vRO workflows can be used to create service blueprints or custom actions. A service blueprint can be a service on its own, while a custom action is linked to an object or item in the catalog of vRA.

When creating a service blueprint, you have to select a workflow and publish it in the portal of vRealize Automation. The request form consists of the input parameters of the vCO workflow, as is showed in this example:

This form is based on the standard vRO workflow Create a user in a organization unit. This particular workflow is using the default Microsoft Active Directory plugin of vRealize Orchestrator. Because the standard AD plugin offers rather limited features, powershell scripts or command-line tools are quite often used in vRO workflows that deal with AD user management.

Why is input validation important?

By default the inputs of an ASD form are not validated by default, this is something you have to do as a developer of workflows and ASD forms. Without input validation the user can enter any data he wants, leading to data in fields you don’t want to have or even worse: leading to unexpected behavior of your workflow. For example: if scripting/programming code is not explicitly blocked in an input field this might lead to your vCO workflow doing something different then it was designed for (code injection).

Input validation of ASD form inputs

There are two places to validate the form input: in vRealize Automation or in vRealize Orchestrator.

The validation options in vRealize Automation itself are quite limited. You can set a minimum and maximum input length and configure if a particular field is required. There are some additional options available, but these don’t really have to do with input validation.

In vRealize Orchestrator on the other hand, you have an additional and very powerful option to validate the inputs for a workflow: regular expressions.

In theoretical computer science and formal language theory, a regular expression and sometimes called a rational expression is a sequence of characters that forms a search pattern, mainly for use in pattern matching with strings, or string matching, i.e. “find and replace”-like operations. [source: wikipedia]

In this case you’re using a regex to test if the user input satisfies a pre-defined pattern. You can set the regex in vRO on the workflow level under the presentation option of a workflow. Just choose matching regular expression in vRO and enter the regex that will validate the user input.

Of course you have to learn some regex, for example the regex

^[\w_-]+$

accepts letters lower and uppercase, as well as the underscore “_” and dash “-“. This regex might be applicable for the validation of a username. If you also want to allow a period in a username, the regex might be

^[\w_-.]+$.

Another regex example which can be used for e-mail address validation is

^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,4})$

Regex is an “art” on its own and I really encourage you to gain some knowledge on regex. The website www.regexr.com lets you test your regex. There are numerous websites discussing regexs, they also include a lot of examples.

After implementing the regex, orchestrator will actively monitor the inputs of a workflow. vRealize Automation will also use the regex in the request forms in the portal. In case a user enters data that doesn’t satisfy the regex, the form cannot be submitted.

I hope this is helpful, please leave a comment if you have any questions.