topic Can not setAuthenticatedUserId in rest API if there is customization authentication in Alfresco Archive

Can not setAuthenticatedUserId in rest API if there is customization authentication

youtianhong — Wed, 15 Jul 2015 07:35:55 GMT

Hello everyone,As we know, we can set the initiator like below code :<startEvent id="request" activiti:initiator="initiator" />The authenticated user must be set with the method BEFORE the process instance is started,try { identityService.setAuthenticatedUserId("bono"); runtimeService.startP

Re: Can not setAuthenticatedUserId in rest API if there is customization authentication

balsarori — Sun, 19 Jul 2015 04:00:08 GMT

In your overrided authenticate method you need to return the user id that should be used.

If your application uses custom authentication, you need to extract the current authenticated user id from the request. One way of doing that is as follows:

[java]
public String authenticate(Request request, Response response) {
// use org.restlet.ext.servlet.ServletUtils to get HttpServletRequest
    HttpServletRequest servletRequest = ServletUtils.getRequest(restletRequest);

    String userId = // Add whatever logic to retrieve user id to be used
    return userId;
}
[/java]

If you want to use another user id (other than the current authenticated user id) for the initiator then you need to use a custom implementation of ProcessInstanceCollectionResource class and call identityService.setAuthenticatedUserId before starting the process.

Note that Restlet was replaced by Spring MVC since Activiti 5.16.4

Re: Can not setAuthenticatedUserId in rest API if there is customization authentication

youtianhong — Tue, 21 Jul 2015 03:57:34 GMT

Much Thanks balsarori for your detailed response.
Actuallty, I also thought that override ProcessInstanceCollectionResource class and call identityService.setAuthenticatedUserId to solve this issue.
But this still has a problem, though this customization class can write the userId correctlly when we start a process instance, however we do other actions subsequently like 'claim task', 'complete task' etc, it will be overridden by "System user" which was written in 'authenticate' method again, because we know that every rest method has a validataion process like "if (!authenticate()) return null;" before invoking real API.
So I think we still need to modify 'authenticate' method, and receive the real userId in the client side.

I want to encapsulate rest api client side code, it's like ActivitiClient.jar that can be embed in other web application.
So i don't how to create a dummy HttpServletRequest,Since HttpServletRequest is an interface
that is implemented by other web container
I tested it like you mention as below code
<code>
// use org.restlet.ext.servlet.ServletUtils to get HttpServletRequest
HttpServletRequest servletRequest = ServletUtils.getRequest(restletRequest);

//client side java code
org.restlet.resource.ClientResource clientResource = new ClientResource(uri);
clientResource.setReference(uri);
ClientInfo clientInfo = new ClientInfo();
org.restlet.security.User user = new User();
user.setIdentifier("Frank");
clientInfo.setUser(user);
clientResource.setClientInfo(clientInfo);
//the other way
org.restlet.Request request = clientResource.createRequest();
Map map = new HashMap();
map.put("user", "ygq");
request.setAttributes(map);

</code>
For my debug in service side, I did not find the attribute in restletRequest or HttpServletRequest,
Do you know how to set this parameter in restlet client or how to create a dummy HttpServletRequest ?
Thanks a lot again!

Regards,
Frank