"gwittwer" wrote:
I have to use jBPM for my diploma thesis. I'm developing a tool, which transforms the ARIS notation (EPC) to jPDL 3.0.

"gwittwer" wrote:

Now I'm thinking about the security of the AS / Workflow-Engine. I read, that the identity package of jBPM 3.0 is in alpha stage.

"gwittwer" wrote:


I would like to use JAAS for the security and "bind" the JAAS to jBPM.
As I read, it is possible with the properties jbpm.authentication and jbpm. authorization. I have to implement my own Authenticator and Authorizer and map them with the properties.

"gwittwer" wrote:


Questions:
1. Is it "best practices" of J2EE and jBPM philosophy to do this like that?
2. Should I use the identity tables / classes of jBPM for JAAS (JBPM_ID...)?

"gwittwer" wrote:


3. Do I need the JBossAuthenticator in that case? What's about JBossAuthorizer?

"gwittwer" wrote:


4. If I would like to do some Webservices on the JBoss AS which use the same JAAS stuff is it better to create own tables and how could jBPM then get the actorID / User / Group / Membership?In this case, do I have to implement an AssignmentExpression class?

"gwittwer" wrote:



5. Does anyone have an example or an open source Webapp which is using the identity package of jBPM 3.0 combined with JAAS?

"gwittwer" wrote:


The thesis thanks for your help!! :-)

"kukeltje" wrote:

Good luck, and we are interested in the result.

"gwittwer" wrote:

The results are published on http://aibp.dyndns.org. Language is German, because I'm living in Switzerland :)

"gwittwer" wrote:

I think, I will "refactor" the jbpm.identity module and change it to the requirements for the thesis (I don't need memberships, just users and groups, and no parent groups).

"gwittwer" wrote:

I will change the Default AssignmentHandler of jBPM to my own (or do this in the proessdefinition).

"gwittwer" wrote:

Is there a relation between Swimlanes and User/Group of jbpm.identity?

"gwittwer" wrote:

My question is, how can I map this relation for the following scenario:

I have several users in my AIBP_USER table and several groups in my AIBP_GROUP table. There is a mapping table AIBP_USERGROUP (like membership of jbpm.identity).

On my webapp the user logs in with username/password (saved in AIBP_USER). Then I would like to give him/her the possibility to view all processes, which are assigned to the User ( -> "user(XYZ)") or to view all processes of the group, where he / she belongs to ( -> "group(XYZ)").

Do you have any inputs how to handle this mapping from authentication (LoginForm.jsp) to authorisation (set the logged-in swimlane/actorID)?

"gwittwer" wrote:

Thank you for helping me!

 String actorId = (request.getUserPrincipal() != null ? request.getUserPrincipal().getName() : request.getParameter("confirm"));
 if (actorId == null) {
 actorId = request.getHeader("HTTP_PROXY_USER");
 }
 UserBean userBean = (UserBean) request.getSession().getAttribute("userBean");
 if (userBean == null) {
 userBean = new UserBean();
 userBean.setUserName(actorId);
 request.getSession().setAttribute("userBean", userBean);
 } else if (userBean.getUserName() == null) {
 userBean.setUserName(actorId);
 request.getSession().setAttribute("userBean", userBean);
 } else {
 actorId = userBean.getUserName();
 }

 if (logger.isDebugEnabled()) {
 logger.debug("doFilter() - userPrincipal = " + actorId);
 }

I've also implemented security around JBPM, but mainly based on the excellent work of Matunda Nyanchama and Sylvia Osborn in their article "The role graph model and conflict of Interest" from the university of western ontario.

I introduced groups, users and roles. Where roles are collections of Permissions (in JAAS terminology) and Users extend Groups and Groups have both direct and indirect Groups and Roles. The roles are maintained in a rolegraph (that can be checked for cyclicy and so on) and the groups/roles are maintained in a groupgraph.


btw, Hoi Kukeltje, werk jij voor de UU?

Oh btw, I added an issue to JIRA requesting the usage of Interfaces for the Sessions (GraphSession, ContextSession) and so on, because this allows much easier usage of the Proxy pattern to protect access to individual methods.

The T,

[sorry for the others, something in Dutch]
Nee, ik werk voor een bedrijf is Zeist. Noem hier in dit forum liever niet de naam vanwege de staffware/jbpm zaken. Stuur ff een mailtje aan ronald (@) jbpm (dot) org en je krijgt wat meer details.

Gerhard,

I've partly read the docs, and volunteer to participate, as a consumer, in task 35 in the projectplan.

What do you think? :-)

Support -> Yes, unless you ask stupid questions.... then I by accident miss that post :-)

About the project. It's nice to see people implement 'converters' for commercial designers on the business level. People tend to think of opensource stuff as technical tools, but commercial bpm engines often also lack a business level designer like ARIS and the likes.

I don't know if you've seen something of the GPD, but it would be nice if the resulting process-definition.xml would be accompanied by a gpd.xml. Then the process would be visible in the jBPM GPD and it would be easier to continue on it from a more techical level.

That's currently all I can say about the project, since I've not read the details yet.

"gwittwer" wrote:
Another question is about your implementation. Do you share your code of the security around jbpm?

Thanks anyway for your help!!

Regards
The unknowing student :)

The_T,

will the report be published online?

"kukeltje" wrote:
The_T,

will the report be published online?