Activiti Explorer LDAP configuration

[matutano6]

Hi,
I was using Activiti Explorer for a while and now I want to integrate it with LDAP.

I followed the chapter 17 of the User's Guide and everything seems to be very straight forward. The authentication and the operation works fine, but when I try the Users or Groups menu item from the Management tab I get an error from wich it cannot recover until I clean the browser's cookies.

At the applications server's log the following exception is shown:

Feb 10, 2014 6:07:13 PM com.vaadin.Application terminalError
SEVERE: Terminal error:
org.activiti.engine.ActivitiIllegalArgumentException: Query is currently not supported by LDAPUserManager.
   at org.activiti.ldap.LDAPUserManager.findUserByQueryCriteria(LDAPUserManager.java:152)
   at org.activiti.ldap.LDAPUserManager.findUserCountByQueryCriteria(LDAPUserManager.java:175)
   at org.activiti.engine.impl.UserQueryImpl.executeCount(UserQueryImpl.java:156)
   at org.activiti.engine.impl.AbstractQuery.execute(AbstractQuery.java:145)
   at org.activiti.engine.impl.interceptor.CommandInvoker.execute(CommandInvoker.java:24)
   at org.activiti.engine.impl.interceptor.CommandContextInterceptor.execute(CommandContextInterceptor.java:57)
   at org.activiti.spring.SpringTransactionInterceptor$1.doInTransaction(SpringTransactionInterceptor.java:47)
   at org.springframework.transaction.support.TransactionTemplate.execute(TransactionTemplate.java:130)
   at org.activiti.spring.SpringTransactionInterceptor.execute(SpringTransactionInterceptor.java:45)
   at org.activiti.engine.impl.interceptor.LogInterceptor.execute(LogInterceptor.java:31)
   at org.activiti.engine.impl.cfg.CommandExecutorImpl.execute(CommandExecutorImpl.java:40)
   at org.activiti.engine.impl.cfg.CommandExecutorImpl.execute(CommandExecutorImpl.java:35)
   at org.activiti.engine.impl.AbstractQuery.count(AbstractQuery.java:132)
   at org.activiti.explorer.ui.management.identity.UserListQuery.size(UserListQuery.java:41)
   at org.activiti.explorer.data.LazyLoadingContainer.size(LazyLoadingContainer.java:115)
   at com.vaadin.ui.AbstractSelect.size(AbstractSelect.java:731)
   at com.vaadin.ui.Table.refreshRenderedCells(Table.java:1511)
   at com.vaadin.ui.Table.getVisibleCells(Table.java:3779)
   at com.vaadin.ui.Table.paintContent(Table.java:2979)
   at com.vaadin.ui.AbstractComponent.paint(AbstractComponent.java:781)
   at com.vaadin.ui.GridLayout.paintContent(GridLayout.java:558)
   at com.vaadin.ui.AbstractComponent.paint(AbstractComponent.java:781)
   at com.vaadin.ui.CustomComponent.paintContent(CustomComponent.java:133)
   at com.vaadin.ui.AbstractComponent.paint(AbstractComponent.java:781)
   at com.vaadin.ui.CssLayout.paintContent(CssLayout.java:203)
   at com.vaadin.ui.AbstractComponent.paint(AbstractComponent.java:781)
   at com.vaadin.terminal.gwt.server.AbstractCommunicationManager.writeUidlResponce(AbstractCommunicationManager.java:1044)
   at com.vaadin.terminal.gwt.server.AbstractCommunicationManager.paintAfterVariableChanges(AbstractCommunicationManager.java:925)
   at com.vaadin.terminal.gwt.server.AbstractCommunicationManager.doHandleUidlRequest(AbstractCommunicationManager.java:792)
   at com.vaadin.terminal.gwt.server.CommunicationManager.handleUidlRequest(CommunicationManager.java:325)
   at com.vaadin.terminal.gwt.server.AbstractApplicationServlet.service(AbstractApplicationServlet.java:501)
   at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
   at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
   at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
   at org.activiti.explorer.filter.ExplorerFilter.doFilter(ExplorerFilter.java:44)
   at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
   at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
   at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
   at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
   at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
   at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
   at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
   at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293)
   at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859)
   at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:602)
   at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
   at java.lang.Thread.run(Thread.java:679)
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

I think it may be related to the fact that Explorer is not intended to administer the LDAP directory, but the Management tab may show the list of users and groups whithout making modifications to them.

Thanks in advance!
Regards,
m.

[jbarrez]

You are correct, the ldap integration does not do any searching/querying, there are better toolings for it.

If it is really important (altough managing ldap through explorer might not be the best idea), you can always extends the default LDAP classes and implement the classes that now throw an error.

[matutano6]

Hi! Thanks for your answer!

Is there any way to disable users and group menus? It's a little annoying to deal with the error when someone clicks them accidentally: the application presents an error message which reappears even by reloading the whole application. The only way to recover from that situation is clearing cookies.

Thanks again!
Regards,
M.

[jbarrez]

Hmmm you would need a rebuild of the war then (which isnt so hard).

Clone the repo from https://github.com/Activiti/Activiti, do your changes in the activiti-explorer module, and do a full rebuild

(eg mvn -Pdistro clean install -DskipTests)

[b_schnarr]

Just for my understanding: when I use the explorer or the Rest webapp with LDAP, all users and groups are determined by the ldap? Lets say I need an admin user in the explorer which is not in the official admin ldap group. Does than mean that I have to add Code to the project? Would a LDAP sync Tool be a better solution, meaning that existing users and groups were Imported into the lokal User db? Then, you would be able to add process-dependant groups without extending the activiti Source Code?

[jbarrez]

Both are possible, and depends on how you prefer it. The sync has its benefits, as that you don't need to change a lot. However, it will always be a bit behind the 'master' data.

If you can't create an admin group in ldap, you indeed need extra code (not a code change, but implementing an interface) to map your admin group to a query in Explorer.