# Temporal web UI extension for restart , reply tctl commands **URL:** \ **Category:** Community Support\ **Tags:** web-ui, tctl\ **Created:** [October 1, 2021, 4:29pm UTC](https://community.temporal.io/t/temporal-web-ui-extension-for-restart-reply-tctl-commands/3064 "2021-10-01T16:29:34Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![phani](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/phani/32/1309_2.png) [@phani](https://community.temporal.io/u/phani)\ **Post date:** [October 1, 2021, 4:29pm UTC](https://community.temporal.io/t/temporal-web-ui-extension-for-restart-reply-tctl-commands/3064/1 "2021-10-01T16:29:34Z")
Hi , Can we give some direction how to we extend temporal web for addition re-start , reply and tctl commands . When can we expect next gen web UI will be available for public release . Is it possible for tctl commands to be wrapped against UI . any directions to be appreciated . Thanks phani ---
**Author:** ![Ruslan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/ruslan/32/66_2.png) [@Ruslan](https://community.temporal.io/u/Ruslan)\ **Post date:** [October 1, 2021, 7:21pm UTC](https://community.temporal.io/t/temporal-web-ui-extension-for-restart-reply-tctl-commands/3064/2 "2021-10-01T19:21:31Z")
As i understand you would like functionality to - restart workflows - is second one is to replay history? - some of the tctl commands (and/or tctl integration?) By extending Web UI, do you mean how to implement these in Web v1 source code? If so, contributions are welcome:) In such case please still let us know in advance though so we are in-line with the approach As for next gen UI (v2) - no public timeline. Please feel free to try it out and provide your feedback. Currently it’s not very stable though, we are focusing on improving the stability and the looks ---
**Author:** ![phani](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/phani/32/1309_2.png) [@phani](https://community.temporal.io/u/phani)\ **Post date:** [October 1, 2021, 7:45pm UTC](https://community.temporal.io/t/temporal-web-ui-extension-for-restart-reply-tctl-commands/3064/3 "2021-10-01T19:45:11Z")
Hi Ruslan, Can you please give us URL for next gen UI( V2 ) and Will the next gen UI will have role based access to terminate and reply etc … Thanks phani ---
**Author:** ![Ruslan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/ruslan/32/66_2.png) [@Ruslan](https://community.temporal.io/u/Ruslan)\ **Post date:** [October 1, 2021, 10:17pm UTC](https://community.temporal.io/t/temporal-web-ui-extension-for-restart-reply-tctl-commands/3064/4 "2021-10-01T22:17:26Z")
**UI v2:** > **[GitHub - temporalio/ui-server: Golang Server for...](https://github.com/temporalio/ui-server)** > > Golang Server for https://github.com/temporalio/ui - GitHub - temporalio/ui-server: Golang Server for https://github.com/temporalio/ui > **[GitHub - temporalio/ui: The next-generation UI for Temporal.](https://github.com/temporalio/ui)** > > The next-generation UI for Temporal. Contribute to temporalio/ui development by creating an account on GitHub. Running the UI atm requires to start up both ^. I’m currently working on having a single docker image that will serve both the ui-server and ui The design of the new UI also allows to start it from the temporal process. So in future you might be able to just start temporal server and it will serve the UI too **Role based functionality** : Is the question specifically targeted at the UI functionality, or generally role based security? If we speak about the UI functionality, for example to disable the Terminate button if the person is not supposed to have access to it based on roles - this is something i’m happy to look into and understand better, though at this moment we don’t have such feature in plans. cc @ryland @steve @swyx to correct me about this ^ If we speak about general security: the UI is just a temporal client. For the actual security Temporal server endpoints have to be secured foremost. This is already available: [Temporal Server security | Temporal documentation](https://docs.temporal.io/docs/server/security/#authorization) Lmk if this answers your question ---
**Author:** ![phani](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/phani/32/1309_2.png) [@phani](https://community.temporal.io/u/phani)\ **Post date:** [October 4, 2021, 12:49pm UTC](https://community.temporal.io/t/temporal-web-ui-extension-for-restart-reply-tctl-commands/3064/5 "2021-10-04T12:49:47Z")
Hi Ruslan, Thank you for quick response . Once a user logged in temporal web ui by authenticating our active directory how do we restrict the user from functions like terminate ( currently this is the only option available ) . I have seen the security of temporal working on workflow to pass a valid jwt token but how do we configure temporal web to pass the jwt token to temporal server . New UI server i am getting below exception i am still looking into it . > temporal-ui@0.0.1 preview:local > TEMPORAL\_UI\_BUILD\_TARGET=local svelte-kit preview **sh: svelte-kit: command not found** ---
**Author:** ![Ruslan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/ruslan/32/66_2.png) [@Ruslan](https://community.temporal.io/u/Ruslan)\ **Post date:** [October 5, 2021, 12:15am UTC](https://community.temporal.io/t/temporal-web-ui-extension-for-restart-reply-tctl-commands/3064/6 "2021-10-05T00:15:09Z")
To allow or deny a user to perform a certain operation, such as [terminating a workflow](https://github.com/temporalio/api/blob/master/temporal/api/workflowservice/v1/service.proto#L223), you will need to: - configure users permissions in your auth provider. Typically you would give permissions to users for example `read:my-namespace` if you want them to have read access but not perform Terminate and other “write” operations (you can have your own pattern for the permission naming). - secure Temporal server endpoints - once the Web UI’s oidc is configured (oidc is enabled, client\_id and other oidc params are passed) and a user is authenticated, Web UI will start passing the JWT token with each request to your Temporal server. Here is when the claim mapper and authorizer plugins will process the JWT token and make a decision As for Active Directory and OIDC, i haven’t personally tried using it with Temporal Web UI, though have seen few docs [Issue in Enabling SSO for Web - #10 by Ruslan](https://community.temporal.io/t/issue-in-enabling-sso-for-web/3053/10) Let me know if this answers some of your questions and helps to understand how the OIDC integration works ---
**Author:** ![Ruslan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/ruslan/32/66_2.png) [@Ruslan](https://community.temporal.io/u/Ruslan)\ **Post date:** [October 5, 2021, 12:25am UTC](https://community.temporal.io/t/temporal-web-ui-extension-for-restart-reply-tctl-commands/3064/7 "2021-10-05T00:25:13Z")
Oh and lastly, there is an environment variable that will remove the Terminate button from the Web UI `TEMPORAL_PERMIT_WRITE_API` , see for more details [GitHub - temporalio/web: Temporal Web UI](https://github.com/temporalio/web#getting-started). Set it to `false` when starting the Web UI and the button itself should not render on the UI This was an initial quick feature to remove the Terminate button from the UI prior to implementing Auth. For proper security it is still advised to follow [Temporal Server security | Temporal documentation](https://docs.temporal.io/docs/server/security) ---
**Author:** ![phani](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/phani/32/1309_2.png) [@phani](https://community.temporal.io/u/phani)\ **Post date:** [October 7, 2021, 6:21pm UTC](https://community.temporal.io/t/temporal-web-ui-extension-for-restart-reply-tctl-commands/3064/8 "2021-10-07T18:21:24Z")
Hi Ruslan, I am able to make workers communicate with temporal server using jwt token . Where do i provide private key for temporal web to signin the token and send it to temporal server . I have used the below parameters in temporal server . - TEMPORAL\_AUTH\_AUTHORIZER=default - TEMPORAL\_AUTH\_CLAIM\_MAPPER=default - TEMPORAL\_JWT\_KEY\_SOURCE1=http://10.0.0.216:8095/eaiapi/jwks - TEMPORAL\_JWT\_KEY\_SOURCE2=http://10.0.0.216:8095/eaiapi/jwks - TEMPORAL\_JWT\_KEY\_REFRESH=1m ---
**Author:** ![Ruslan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/ruslan/32/66_2.png) [@Ruslan](https://community.temporal.io/u/Ruslan)\ **Post date:** [October 7, 2021, 8:22pm UTC](https://community.temporal.io/t/temporal-web-ui-extension-for-restart-reply-tctl-commands/3064/9 "2021-10-07T20:22:07Z")
Do you mean you intend to use jwts from [http://10.0.0.216:8095/eaiapi/jwks](http://10.0.0.216:8095/eaiapi/jwks) in Temporal Web? Temporal Web expects that users will authenticate through an OIDC provider. That way users don’t have to spin up the web manually and provide jwt tokens, but rather click the Sign In button and follow login process. OIDC provider will provide the jwt token that the Web will use and send to temporal server with each request ---
**Author:** ![phani](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/phani/32/1309_2.png) [@phani](https://community.temporal.io/u/phani)\ **Post date:** [October 7, 2021, 11:06pm UTC](https://community.temporal.io/t/temporal-web-ui-extension-for-restart-reply-tctl-commands/3064/10 "2021-10-07T23:06:31Z")
Hi Ruslan, We have jwt service which will generate a token and give us the jwks url with public keys to verify the signed jwt token . Temporal workflows sending these token to temporal server and provided the jwks url to validate the token and it is working as expected . Now we want the temporal web also use the same service to send the token to temporal service and temporal service use the jwks url to validate the token . Thanks phani ---
**Author:** ![Ruslan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/ruslan/32/66_2.png) [@Ruslan](https://community.temporal.io/u/Ruslan)\ **Post date:** [October 19, 2021, 7:31pm UTC](https://community.temporal.io/t/temporal-web-ui-extension-for-restart-reply-tctl-commands/3064/12 "2021-10-19T19:31:50Z")
hey @phani Web UI currently only supports OIDC for retrieving the JWT tokens. By any change does your jwt service support oidc as an option?