Process Initiation Authorization

[dumitru_ciubenc]

Activiti version 5.15.1
According to the current documentation we can use:  extensionElements for defining candidate group/user for process start.
So my understanding is that if I would use :

   <extensionElements>
       <activiti:potentialStarter>
         <resourceAssignmentExpression>
           <formalExpression>group2, group(group3), user(user3)</formalExpression>
         </resourceAssignmentExpression>
       </activiti:potentialStarter>
     </extensionElements>
‍‍‍‍‍‍‍‍‍

I'm expecting that after process deployment there will be some new record in the ACT_RU_IDENTITYLINK with GROUP_ID_ reference.
But this is not working.

I have my customSessionFactories for GroupIdentityManager and UserIdentityManager, and if I'm using activiti:candidateStarterGroups :

 <process id="myProcess" name="Import workflow" isExecutable="true" activiti:candidateStarterGroups="MYGROUP">
‍‍‍

It's working.

So the question is why it is not working in case of using extensionElements?


Thank you,
Dima

[martin_grofcik]

Hi Dima,

Following test could put more light on identity links:
org.activiti.examples.bpmn.authorization.StartAuthorizationTest#testIdentityLinks

Regards
Martin

[dumitru_ciubenc]

Hi Martin,

<b>testIdentityLinks</b> Is testing the case when the process definition uses the tag candidateStarterUsers and candidateStarterGroups that's working fine also for me.
My question refers more to the test "testPotentialStarter" but it is NOT testing what I would expect, because it is testing same tag:
<b>activiti:candidateStarterUsers="user1, user2"</b>
<code>
    identityService.setAuthenticatedUserId("user1");
    ProcessInstance processInstance = runtimeService.startProcessInstanceByKey("potentialStarter");
</code>

and this part is not covered or at least I don't see any test for this:
<code>
           <extensionElements>
   <activitiotentialStarter>
    <resourceAssignmentExpression>
     <formalExpression>group2, group(group3), user(user3)</formalExpression>
    </resourceAssignmentExpression>
   </activitiotentialStarter>
  </extensionElements>
</code>
from <b>StartAuthorizationTest.testPotentialStarter.bpmn20.xml</b>

So when I'm using <b>extensionElements</b> there are no records in IDENTITYLINK table and my particular code:
<code>
     repositoryService.createProcessDefinitionQuery().startableByUser(ctx.getCallerPrincipal().getName()).active().latestVersion().list()
</code>
is not working.


Thank you for your response,
Dima

[martin_grofcik]

Hi,

I think you are right. Could you create jira ticket for it (or pull request?)

Regards
Martin

[dumitru_ciubenc]

Added new https://github.com/Activiti/Activiti/pull/288

Best regards,
Dima