identity in a webapp

[tbee]

So I figured out how to set which user is logged in for the workflow:

processEngine.getIdentityService().setAuthenticatedUserId("kermit");
‍‍‍

But this code is running as part of a webapplication, and according to the user guide, "the ProcessEngine and the services objects are thread safe. So you can keep a reference to 1 of those for a whole server." This would mean that all threads / request share the same identity service, and thus that the setAuthenticatedUserId is valid for all threads. But individual requests may be "in the spirit" of different workflow users.

How do I make sure that setAuthenticatedUserId is not influenced by other threads / request and subsequent calls are executed in context of the user set before?

[ronald_van_kuij]

This would mean that all threads / request share the same identity service,

Yes

and thus that the setAuthenticatedUserId is valid for all threads.

No, look at what the service does… it sets the authenticated userid on the current thread (from the top of my head)

How do I make sure that setAuthenticatedUserId is not influenced by other threads / request and subsequent calls are executed in context of the user set before?

Nothing, see previous answer

[tbee]

Ok, then, is there a way to get the active workflow user? Because, as far as I can tell, it is good practice to first claim a task before completing it. But claim requires the user name.


processEngine.getTaskService().claim(taskId, username);

I do not see a getAuthenticatedUserId() on the IndentityService.

[p4w3l]

First your runtime enviromnment "knows" the authenticated user i.e. request.getPrincipal(). Then you "tell" it to Activiti Engine with identityService.setAuthenticatedUserId( userId ). Then when you do some operations like start a new process instance or add a comment then the engine "knows" the authenticated user for a while you do the operation. Normally I immediately identityService.setAuthenticatedUserId(null); after the operation. The claim for me is the method where you set the user explicity. Why then need to get the user from identityService? Grab it from request if in servlet environment. Hope that helps.

[tbee]

I fully agree, hence I would expect a method "claim()" which claims a task in name of the authenticated user. But that call does not exist, you need to specify a username.