Mechanism of management rights on the start of process?

[christoph_retti]

Hi, I am on the way to upgrade from activiti 5.6 to 5.10 and found that there has been a change in https://jira.codehaus.org/browse/ACT-740
adding the possibility to query users/groups that have the right to start a given process.

As I implemented my own identity service like

  public class CspIdentityService implements IdentityService, org.activiti.engine.impl.interceptor.Session, InitializingBean

to be able to access my proprietary security entities from actititi (and not having to define users/groups in every application domain) I now have a problem
because this functionality forces me to include the activiti process definition model into my own security model as well.

I don't think that this is a good idea as this couples security concerns with process concerns and also forces me to be aware of the actitivi database tables

Is there any suggestion how I can proceed here? I know there is also now a sample implementation of LDAP security service (at least it comes with the book)
and I don't think that in LDAP you will want to manage this type of security as well)?

  regards, Chris

[frederikherema1]

The introduced methods, related to who can start a process, aren't enforced by the engine itself. If you don't want to use this functionality, you don't need to. You can just ignore those methods on the identity-service and start processes anyway.

If you want to use the feature, you'll have to check IF a person can start a process yourself, through the API, before calling startProcessInstance(…).

[christoph_retti]

Good to hear that the engine does not need this methods (at least right now)!

Anyway, I think this feature should not be in the identity service but rather be moved to the RepositoryService
where - at least in my optinion - it would better fit.

What do you think?

  regards, Chris

[jbarrez]

I think it's pretty hard to change this, as we would need to deprecate it, move it to the repo service and remove it again in two releases (that's our policy).
I think there are things to say for both approaches … and I don't have any particular preference, actually.