nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

How to implement ACL in activiti?

rahulbabarit

Hi All,

We are looking for implementing ACL (Access Control List) for our web application which uses activiti workflows. Is there any support for ACL in activiti itself? I appreciate your suggestions on how to implement ACL in activiti.

Thanks,
Rahul Babar

Find more posts tagged with

Comments

frederikherema1

The only thing activiti offers out of the box are users and groups (used for task assignement and authentication). More fine-grained access control (eg. limiting visibility of process-definitions or not allowing to start process-instance for certain definition) don't exist I'm affraid.

It all depends on how you want to use it. You can write a layer on top of activiti, which filters the result of certain calls to activiti, based on the user and checks all attempts to eg. start a process. Depends on how fine-grained you want your ACL's and how much you want to expose of the engine.

heymjo

somewhat related: Would it be reasonable / feasible to have an extension point that allows you to delegate the candidate selection to a custom interface ?

pseudocode:

<br><userTask id="theTask" name="my task" activiti:customCandidates="group(management), permission={UK,CZ,BE}" /><br>
with something like this to be implemted by the app

<br>// returns candidate users<br>public List<String> resolveCustomCandidates(String candidateExpression) {<br><br>&nbsp; //candidateExpression = group(management), permission={UK,CZ,BE}<br>&nbsp; //this impl is responsible for parsing the expression and returning the list of candidates<br>}<br>

Thanks
Jorg

frederikherema1

If you're using activiti with spring, this is possible (workaround), by defining a bean in your clontext and using it in the candidateGroups expressions:
<br>activiti:candidateGroups="${candidateHandler.getGroupDandicates("group(management), permission={UK,CZ,BE}}")<br>
Also, If you're not using spring, you can pass the objects you want to be available in expressions, to the ProcessEngineConfiguration "beans" property.

heymjo

that's a good enough 'workaround' , thanks !

Jorg