Process initiator - not a gr. member proceed bpmn process

[udoderk]

Hi everybody,

if my bpmn process has an initiator, that not a member of some groups, that used by user tasks, such initiator can proceed the user tasks, that are not ordered to him. ( Activiti 5.11. Activiti Explorer  as managing GUI 😉 )

Details:
0. We use the demo data of activiti explorer (kermit aka admin, etc…)
1. We need to create the group with id A named A. And group B named B firstly.
2. We order the "kermit" demo user to group "A".
3. We order the "fozzie" demo user to group "B".

Then, following bpmn process must be deployed into Activiti Explorer:

<?xml version="1.0" encoding="UTF-8"?>
<definitions xmlns="http://www.omg.org/spec/BPMN/20100524/MODEL" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:activiti="http://activiti.org/bpmn" xmlns:bpmndi="http://www.omg.org/spec/BPMN/20100524/DI" xmlns:omgdc="http://www.omg.org/spec/DD/20100524/DC" xmlns:omgdi="http://www.omg.org/spec/DD/20100524/DI" typeLanguage="http://www.w3.org/2001/XMLSchema" expressionLanguage="http://www.w3.org/1999/XPath" targetNamespace="http://www.activiti.org/test">
  <process id="MyProcessWithUserGrTestPrfmAsIntr" name="MyProcessWithUserGrTestPrfmAsIntr">
    <startEvent id="startevent1" name="Start" activiti:initiator="initiator"></startEvent>
    <userTask id="usertask1" name="TaskOnlyForBGr" activiti:assignee="${initiator}" activiti:candidateGroups="B">
      <extensionElements>
        <activiti:formProperty id="form1" name="form1" type="string"></activiti:formProperty>
      </extensionElements>
    </userTask>
    <userTask id="usertask2" name="TaskOnlyForAGrp" activiti:assignee="${initiator}" activiti:candidateGroups="A">
      <extensionElements>
        <activiti:formProperty id="form12" name="form12" type="string"></activiti:formProperty>
      </extensionElements>
    </userTask>
    <endEvent id="endevent1" name="End"></endEvent>
    <sequenceFlow id="flow1" name="" sourceRef="startevent1" targetRef="usertask1"></sequenceFlow>
    <sequenceFlow id="flow2" name="" sourceRef="usertask1" targetRef="usertask2"></sequenceFlow>
    <sequenceFlow id="flow3" name="" sourceRef="usertask2" targetRef="endevent1"></sequenceFlow>
  </process>
  <bpmndi:BPMNDiagram id="BPMNDiagram_MyProcessWithUserGrTestPrfmAsIntr">
    <bpmndi:BPMNPlane bpmnElement="MyProcessWithUserGrTestPrfmAsIntr" id="BPMNPlane_MyProcessWithUserGrTestPrfmAsIntr">
      <bpmndi:BPMNShape bpmnElement="startevent1" id="BPMNShape_startevent1">
        <omgdc:Bounds height="35" width="35" x="60" y="170"></omgdc:Bounds>
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape bpmnElement="usertask1" id="BPMNShape_usertask1">
        <omgdc:Bounds height="55" width="105" x="260" y="360"></omgdc:Bounds>
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape bpmnElement="usertask2" id="BPMNShape_usertask2">
        <omgdc:Bounds height="55" width="105" x="480" y="170"></omgdc:Bounds>
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape bpmnElement="endevent1" id="BPMNShape_endevent1">
        <omgdc:Bounds height="35" width="35" x="730" y="170"></omgdc:Bounds>
      </bpmndi:BPMNShape>
      <bpmndi:BPMNEdge bpmnElement="flow1" id="BPMNEdge_flow1">
        <omgdi:waypoint x="95" y="187"></omgdi:waypoint>
        <omgdi:waypoint x="193" y="187"></omgdi:waypoint>
        <omgdi:waypoint x="193" y="385"></omgdi:waypoint>
        <omgdi:waypoint x="260" y="387"></omgdi:waypoint>
      </bpmndi:BPMNEdge>
      <bpmndi:BPMNEdge bpmnElement="flow2" id="BPMNEdge_flow2">
        <omgdi:waypoint x="365" y="387"></omgdi:waypoint>
        <omgdi:waypoint x="433" y="387"></omgdi:waypoint>
        <omgdi:waypoint x="433" y="197"></omgdi:waypoint>
        <omgdi:waypoint x="480" y="197"></omgdi:waypoint>
      </bpmndi:BPMNEdge>
      <bpmndi:BPMNEdge bpmnElement="flow3" id="BPMNEdge_flow3">
        <omgdi:waypoint x="585" y="197"></omgdi:waypoint>
        <omgdi:waypoint x="597" y="187"></omgdi:waypoint>
        <omgdi:waypoint x="730" y="187"></omgdi:waypoint>
      </bpmndi:BPMNEdge>
    </bpmndi:BPMNPlane>
  </bpmndi:BPMNDiagram>
</definitions>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

In this bpmn process i bind explicit the (activiti:assignee) with process variable "${initiator}" . This variable was defined before by start event (activiti:initiator="initiator").
Then we logion as kermit in browser 1 and with fozzie in browser 2.
Then we start this process in browser 1 (kermit is initiator)
The kermit has ALL user tasks. The not-memnership by group B wil be still ignored.

IMHO this is a bug:-/

[frederikherema1]

This is not a bug. If you have an explicit assignee set, the candidateGroups are ignored. Once you don't have an assignee, the task is claimable by someone in group B… This is the way activiti works, for example when a member of group B is reassigning a task that was originally "for group B" only to a person NOT part of group B, this should be possible -> assignee field takes precedence on candidates.

[udoderk]

Thank you for your response