topic How to implement ACL in activiti? in Alfresco Archive

How to implement ACL in activiti?

rahulbabarit — Tue, 14 Jun 2011 06:00:48 GMT

Hi All,We are looking for implementing ACL (Access Control List) for our web application which uses activiti workflows. Is there any support for ACL in activiti itself? I appreciate your suggestions on how to implement ACL in activiti.Thanks,Rahul Babar

Re: How to implement ACL in activiti?

frederikherema1 — Tue, 14 Jun 2011 07:13:50 GMT

The only thing activiti offers out of the box are users and groups (used for task assignement and authentication). More fine-grained access control (eg. limiting visibility of process-definitions or not allowing to start process-instance for certain definition) don't exist I'm affraid.

It all depends on how you want to use it. You can write a layer on top of activiti, which filters the result of certain calls to activiti, based on the user and checks all attempts to eg. start a process. Depends on how fine-grained you want your ACL's and how much you want to expose of the engine.

Re: How to implement ACL in activiti?

heymjo — Tue, 14 Jun 2011 12:29:11 GMT

somewhat related: Would it be reasonable / feasible to have an extension point that allows you to delegate the candidate selection to a custom interface ?

pseudocode:


<userTask id="theTask" name="my task" activiti:customCandidates="group(management), permission={UK,CZ,BE}" />

with something like this to be implemted by the app


// returns candidate users
public List<String> resolveCustomCandidates(String candidateExpression) {

  //candidateExpression = group(management), permission={UK,CZ,BE}
  //this impl is responsible for parsing the expression and returning the list of candidates
}

Thanks
Jorg

Re: How to implement ACL in activiti?

frederikherema1 — Tue, 14 Jun 2011 12:37:31 GMT

If you're using activiti with spring, this is possible (workaround), by defining a bean in your clontext and using it in the candidateGroups expressions:


activiti:candidateGroups="${candidateHandler.getGroupDandicates("group(management), permission={UK,CZ,BE}}")

Also, If you're not using spring, you can pass the objects you want to be available in expressions, to the ProcessEngineConfiguration "beans" property.

Re: How to implement ACL in activiti?

heymjo — Tue, 14 Jun 2011 13:44:56 GMT

that's a good enough 'workaround' , thanks !

Jorg