Segmenting Users and Groups

[tameyer]

I've searched across the forums for an answer to this question and never saw a reply as to whether this was possible or on the TODO list.  I apologize if it has been answered.

Based on the database design it does not appear a single instance of Activiti could be used to segment users\groups in companies.  For instance, If I work for Company A and I setup my users and groups I would not want anyone from Company B to be able to see my users, groups, processes, etc.  This scenario would be common in SaaS where you might have multiple companies paying a subscription for some service built around Activiti where load may not warrant multiple servers\instances.  It seems to me you would need a unique key added to many of the tables (and methods) that could represent the company\subscription ID.

Any thoughts of how this could be accomplished or on the radar? (BTW, Great work!)

[pault]

My application is somewhat different, but does involve multiple process engines, each with their own dbs, being controlled within a single application.

My databases are mostly in memory it seems to work well, so maybe a centrally co-ordinated multiple-process engine architecture might work ?

Each new process engine required on a customer by customer basis could be created automatically, adding the new users and groups and deploying the processes, forms etc. required for the service.

It does mean duplication of any common processes etc. into each database, but from a scalability and distribution angle has significant advantages, e.g. moving customers from server to server.

Anyways just a thought.

[tameyer]

Thanks for the response.
This is one of the approaches I considered.  The downside is additional resource requirements.  The upside is you continue to use Activiti as it is currently engineered.
I had been investigating a scheme where I would use my own tables to manage companies and users and just insert reference id values in the Activiti tables but I think this would create a fragile system with regards to future Activiti enhancements.

[tombaeyens]

multi tenancy is certainly on our radar.  adding the information to the user tables is not that hard, but the authorization constraints is less trivial to solve.  so we can't give predictions on when we'll be able to get this in.

[jasonw]

Our SaaS solution plans to have a single application supporting multiple customers.  Customers each have their own schema.  We use Hibernate 4.x multi-tenant framework to switch the connection at runtime based on "context" calling "alter schema" to point the generic connection to a specific customer's data.  Is it possible in Activiti to change the engine to look at a different schema based on the customer context?

[martin_grofcik]

Hi,
AFAIK, it is not possible. On the other hand you can start one process engine per customer which can point to different datasource. (or use activiti multi-tenant implementation)

Regards
Martin