Activiti Rest Security - Where is it being used?

[stbill79]

I've seen other posts and also dug through the activiti-rest, common, and activiti-spring-boot modules.

I believe I understand how to customize the security.

What I don't understand is WHERE the security is being used.

* I don't see any sort of identityService.setAuthenticatedUser… around any of the Spring MVC rest controllers.

* There is a dependency on Spring Security. But I don't see any refererences to SecurityContextHolder…

* Can't find any use of ServletRequest.getUserPrincipal or similar.

Unless I'm missing something, it seems you've forced authentication on the rest urls, but never actually do anything with the current user.

If that's the case, how does the process engine know which user is currently making calls?

Thanks,
Will

[jbarrez]

Activiti does not have any security / permissioning built in. So for the engine setting setAuthenticatedUSer is enough to fill the audit daa properly.

When integrating with Activiti, you would have to add that yourself. For example, you can add LDAP authentication to your app with Spring Security, and set the authenticated user after a successful login.