Skip to content

BPM bridge

The BPM bridge lets BPM open DMS in an embedded, authenticated session without asking the user to sign in again.

How it works

  1. BPM creates a short-lived token with the user, an expiry, and a read-only flag.
  2. The token is signed with the shared BPM_API_KEY.
  3. The browser opens GET /bpm-bridge/auth?t=<token>.
  4. DMS validates the signature and the time window, checks the user and the explorador:ver permission, and creates an embedded session.
  5. DMS redirects to the Explorer in embedded mode.

A read-only embedded session blocks upload, edit, and delete requests. DMS uses a separate session cookie for the embedded session so it does not overwrite the user's direct DMS session.

Browser embedding

DMS relaxes its frame-ancestors policy only for the BPM origins configured by the administrator. Configure those origins before you enable the embedded view.