How can I use my own SSO instead of using basic auth

[lambav]

Hi

I want to use our own SSO and user, group mapping instead of using the default basic Auth. I am using the activiti rest.

Do I need to extend some class. And if yes,

Can you please help me where I can take the code base of activiti rest and do the necessary change.

Thanks

[ekolesnikov]

This will probably not answer your question directly, but there's usually no need to do that. The only benefit of having authorised user in Activiti is that you have variables like "initiator" populated automatically - apart from that there is no direct link between Activiti users/groups and task (potential) assignees. We are using generic login to secure REST services and then simply assign tasks to the SSO (Google App Engine) user IDs even though there are no associated records in ACT_ID_USER, ACT_ID_GROUP or ACT_ID_MEMBERSHIP tables.

[jbarrez]

@ekolesnikov: perfectly explained.

[imsrk]

@ekolesnikov: Does that means there is no point of Roles/Groups in Activiti BPM? The moment I landed into Activiti BPM I was really shocked that it doesn't fully implement the concept of Swim lanes and does create confusion. I do understand and appreciate the Activiti REST API and documentation around it but in some way it does violates few principles of BPMN. I was stuck at the same scenario and I would rather term it as product limitation for not having good support or documentation around SSO or custom Authentication provider integration. There is no single resource implementing end to end SSO for Activiti which ofcourse is the biggest limitation for any serious production implementation for Activiti. You might start looking into other solution sooner or later due to this limitation. Merely stating it's an open source product and you could customize it to fit your need does not solve the purpose.

I'm not being biased here as I have used Activiti to map my existing and highly complex business processes into Activiti (Migrated from commercial BPM product for POC) and it proved to be worthy in terms of quick implementation, extremely high performance, hassle-free middleware implementation (no huge app servers and maintenances) and highly appreciate the very well documented REST API's which further gives unlimited control over the choice of frameworks/technologies for implementing user interfaces and such.

Only if there could be a well thought approach around Authentication/Authorization adhering to the concept of Roles/Swimlanes in BPMN and at least documented similar to LDAP.