Role Based access to deployed process.

[kingbee888]

Hi

Is there a way to restrict who can see a specific deployed process?  For example only the Sales group can see the process "Create new Sales lead" and only a member of the desktop group can see the process "Deploy new laptop".  But if you're apart of both groups, you see both processes.


Thanks in advance.

[martin_grofcik]

Hi.
You can try to use RepositoryService method

  /**
   * Only selects process definitions which given userId is authoriezed to start
   */
  ProcessDefinitionQuery startableByUser(String userId);

Regards
Martin

[raghuveer]

  /**
   * Only selects process definitions which given userId is authoriezed to start
   */
  ProcessDefinitionQuery startableByUser(String userId);

can you pls elaborate your answer….
If you can share sample implementation for this method it would be helpful 

[martin_grofcik]

Hi,

The good example is org.activiti.examples.bpmn.authorization.StartAuthorizationTest#testPotentialStarter in activiti sources.
example of usage:

     ProcessDefinition potentialStarter = repositoryService.createProcessDefinitionQuery().processDefinitionKey("potentialStarter").startableByUser("user1").latestVersion().singleResult();

Regards
Martin

[raghuveer]

Hi Martin,

tnks for your reply…actually i am making a rest call…and
i am using activiti:candidateStarterUsers…but it is not working…pls help


tnks and regards,
Raghuveer

[raghuveer]

i am hardcoding kermit for CandidateStarerUsers…like this


<process id="potentialStarter"  name="StartUp" isExecutable="true" activiti:candidateStarterUsers="kermit">
 
  <startEvent id="theStart" />
  <sequenceFlow id="flow1" sourceRef="theStart" targetRef="theEnd" />
  <endEvent id="theEnd" />
</process>


but still the process can be started by anyone…pls help me to understand

tnks in advance
Raghuveer

[raghuveer]

<process id="potentialStarter"  name="StartUp" isExecutable="true" activiti:candidateStarterUsers="kermit">
 
  <startEvent id="theStart" />
  <sequenceFlow id="flow1" sourceRef="theStart" targetRef="theEnd" />
  <endEvent id="theEnd" />
</process>

[raghuveer]

<process id="potentialStarter"  name="StartUp" isExecutable="true" activiti:candidateStarterUsers="kermit">
 
  <startEvent id="theStart" />
  <sequenceFlow id="flow1" sourceRef="theStart" targetRef="theEnd" />
  <endEvent id="theEnd" />
</process>

[martin_grofcik]

Hi,

From user guide:

NOTE that the authorization definition is NOT validated by the Activiti Engine in any way. This functionality is only meant for developers to ease the implementation of authorization rules in a web client.

Rest endpoint implementation needs to be changed.

Regards
Martin

[chittaranjan168]

Chittaranjan: Is it possible to provide a sample example for this?