Flow Access with Poller Service Account

In Utilihive, every flow must be associated with a service account. For flows that expose HTTP endpoints, an external entity authenticates itself using credentials like username/password, API key, or certificate.

Some flows have no active external entity. They generate or acquire messages entirely on their own, triggered by a timer or by polling a system. For these flows, Utilihive requires a special credential type: the Poller User. The service account that uses a poller user credential type is a Poller Service Account.

What is a Poller Service Account

A Poller Service Account has no credentials because authentication is handled by the server. It is used for flows that don’t have an external entity or a public API endpoint, for example schedule-driven flows.

Even with no external caller, Utilihive requires all flows to have a registered identity. The Poller Service Account is the internal identity that Utilihive uses to authorize the flow at the source boundary.

The credential types (BasicAuthentication, ApiKey, mTLS, OIDC) are designed for scenarios where an external party presents credentials.

The Poller User credential type is used when:

No external system calls the flow.
No HTTP request arrives with a username and password.
The flow server itself decides when to fire, based on a cron expression.

It allows the flow server to run the flow without an external caller, registering the flow’s identity at the source boundary without generating unused credentials.

Flows that require a Poller Service Account are:

Flow Source Processor Reason

Flow Source Processor	Reason
`consumeGooglePubSub`	Consumes messages from a Google Cloud Pub/Sub subscription.
`readFiles` (SFTP)	Polls an SFTP server.
`receiveFromAwsS3`	Polls an AWS S3 bucket.
`receiveFromAzureBlobStorage`	Polls Azure Blob Storage.
`receiveFromEventHubs`	Consumes messages from Azure Event Hubs.
`receiveFromHabitat`	Receives data from Habitat.
`receiveFromJms`	Consumes messages from a JMS broker.
`receiveFromKafka`	Consumes messages from a Kafka topic.
`receiveFromMqtt`	Receives messages from an MQTT broker.
`receiveFromOpcUa`	Reads tags from an OPC UA server.
`receiveFromRabbitMq`	Reads messages from a RabbitMQ queue.
`schedule`	Triggered internally by the Flow Server on a cron schedule.

consumeGooglePubSub

Consumes messages from a Google Cloud Pub/Sub subscription.

readFiles (SFTP)

Polls an SFTP server.

receiveFromAwsS3

Polls an AWS S3 bucket.

receiveFromAzureBlobStorage

Polls Azure Blob Storage.

receiveFromEventHubs

Consumes messages from Azure Event Hubs.

receiveFromHabitat

Receives data from Habitat.

receiveFromJms

Consumes messages from a JMS broker.

receiveFromKafka

Consumes messages from a Kafka topic.

receiveFromMqtt

Receives messages from an MQTT broker.

receiveFromOpcUa

Reads tags from an OPC UA server.

receiveFromRabbitMq

Reads messages from a RabbitMQ queue.

schedule

Triggered internally by the Flow Server on a cron schedule.

For more information on flow processors, see Processors in Utilihive.

Integrate Poller Service Account with Flow Processor

Step 1: Create the Poller Service Account

In the Utilihive Console, go to Security and select Create Service Account.
Enter a Name (for example, my-scheduled-flow-poller).
Set the Credential type to Poller User, and click Create.

You have created a Poller Service Account.

Step 2: Write the Source Flow

A schedule-driven flow uses schedule as its source processor — the first and only entry point. Because no external entity triggers it, the flow must be assigned a Poller Service Account.

The following flow is an example that polls a public joke API every two seconds and logs the response. Replace this with your own flow definition.

// The flow is assigned to a Poller Service Account, which is used for authorization at the source boundary.
val flowSpec = flowConfig {
        id = "fun-flow"
        ownerId = OWNER_ID
        exchangePattern = FlowExchangePattern.RequestResponse

        schedule {
            id = "scheduler"
            scheduleExpression = "0/2 * * ? * * *"
        }
        restRequest {
            id = "get-joke"
            defaultMethod = HttpMethod.GET
            address = URL("https://official-joke-api.appspot.com/random_joke")
        }

    }

For guidance on writing a flow, see the Single-Flow Design and Multi-Flow Design.

Step 3: Grant Flow Access to the Poller Service Account

In the Utilihive Console:
1. Go to Flows and select your-flow.
2. Open the Flow Access tab and select Add Flow Access.
3. Select the Poller Service Account, confirm with Add, then save with Add Flow Access.
Using flow-access.properties (SDK Deployer): set my-scheduled-flow-poller = your-flow

Step 4: Deploy the Flows

To deploy the flow, use the SDK deployer or the Utilihive Console. The scheduled flow will now run on the defined schedule, and the Poller Service Account will be used for authorization at the source boundary.

mvn -P deploy-flows -D owner-id=your-owner-id -D environment=test

Go to the Flows tab in the Utilihive Console to verify that the flow is up and running.

The flow run page in the Utilihive Console shows the status of the scheduled flow.

To view the logs of the scheduled runs, go to the Flows traces tab.

The flow traces log page in the Utilihive Console shows the scheduled flow run details.

You have successfully deployed a flow and granted it access to a Poller Service Account.

Poller Service Account vs. SFTP Secret

SFTP authentication secret: Used by the source processor to authenticate outbound connections to an external system.
Poller Service Account: Inbound authorization identity used by Flow Server to verify the message at the source endpoint-to-flow boundary.

Poller-based sources authenticate once during setup while push-based connections authenticate on every inbound request.

Was this page helpful?