How to implement ACL in activiti?

[rahulbabarit]

Hi All,

We are looking for implementing ACL (Access Control List) for our web application which uses activiti workflows. Is there any support for ACL in activiti itself? I appreciate your suggestions on how to implement ACL in activiti.

Thanks,
Rahul Babar

[frederikherema1]

The only thing activiti offers out of the box are users and groups (used for task assignement and authentication). More fine-grained access control (eg. limiting visibility of process-definitions or not allowing to start process-instance for certain definition) don't exist I'm affraid.

It all depends on how you want to use it. You can write a layer on top of activiti, which filters the result of certain calls to activiti, based on the user and checks all attempts to eg. start a process. Depends on how fine-grained you want your ACL's and how much you want to expose of the engine.

[heymjo]

somewhat related: Would it be reasonable / feasible to have an extension point that allows you to delegate the candidate selection to a custom interface ?

pseudocode:


<userTask id="theTask" name="my task" activiti:customCandidates="group(management), permission={UK,CZ,BE}" />

with something like this to be implemted by the app


// returns candidate users
public List<String> resolveCustomCandidates(String candidateExpression) {

  //candidateExpression = group(management), permission={UK,CZ,BE}
  //this impl is responsible for parsing the expression and returning the list of candidates
}

Thanks
Jorg

[frederikherema1]

If you're using activiti with spring, this is possible (workaround), by defining a bean in your clontext and using it in the candidateGroups expressions:

activiti:candidateGroups="${candidateHandler.getGroupDandicates("group(management), permission={UK,CZ,BE}}")

Also, If you're not using spring, you can pass the objects you want to be available in expressions, to the ProcessEngineConfiguration "beans" property.

[heymjo]

that's a good enough 'workaround' , thanks !

Jorg