Working with ldap - what are the admin manage tab privileges

[ilansch]

Hi, so we have succeeded using Activiti 5.18 with ldap (Windows server 2012R2 Active Directory)
My question is regarding to the groups, We have 2 groups, Admins and Users.
The Admin will see the manage tab and users will not.
When admin is trying to view Users/Groups in Manage tab, what he is supposed to see ? We are recieving exception from the findUserByQueryCriteria (LDAPUserManager.java).

What is the expected behavior ? When admin user login, he is expected to see all users from active directory ? all users/admins ?
And what about the groups ? to see 2 groups ? users and admins ? the real active directory users/groups ?


We are getting the exception since the Id property on the query object is null.

[trademak]

It depends on your Activiti LDAP configuration. We've implemented the LDAP module mainly to add LDAP authentication for Activiti. The users and groups views in the Activiti Explorer are there to manage the built-in identity tables and are not specifically implemented for running LDAP queries. What's the exception thrown by the LDAPUserManager?

Best regards,

[ilansch]

The impl of the function is to throw exception when fields are not filled.
it checks if there is query.getId() or query.getFullNameLike() are not null, The query object is empty, so the exception is:
"throw new ActivitiIllegalArgumentException("Query is currently not supported by LDAPUserManager.");"

Since I am not familiar with the project code/logic, I dont know, if on this point, when requesting the users/groups, the query object (UserQueryImpl query) )should have data in it or no.
I do know that during login, same function called and UserQueryImpl query is filled with the user data (good)

https://github.com/Activiti/Activiti/blob/master/modules/activiti-ldap/src/main/java/org/activiti/ld...

[trademak]

The user and groups manage tab in the Activiti Explorer are not written with the LDAP connector in mind, so this exception is expected. With some changes to the LDAP module and to the Activiti Explorer implementation this could be made to work of course. Would you be interested in contributing that to the Activiti project?

Best regards,

[ilansch]

If the team leader will decide to implement this feature (to show users/groups), i will be happy to contribute the code.