Claim and complete tasks from other user?

Camunda 7 Topics Discussion & Questions
1

Hi,

I am a little bit confused and hope you can help me. In my workflow I have set CandidateUser and CandidateGroups for the user tasks.

In one user task the candidateUser is set to max@mycompany.com. When I query the tasks using REST, I will see the task. So far so good.

Now, when I want to complete the task, I do the following steps:

  • claim the task
  • complete the task
    public void completeTask(String user, String taskId, Map<String, Object> variables) {
        identityService.setAuthenticatedUserId(user);
        if (MapUtils.isEmpty(variables)) {
            taskService.complete(taskId);
        } else {
            taskService.complete(taskId, variables);
        }
        identityService.clearAuthentication();
    }

    public void claimTask(String username, String taskId) {
        identityService.setAuthenticatedUserId(username);
        taskService.claim(taskId, username);
        identityService.clearAuthentication();
    }

Now, when I try to claim and complete the task using another user (peter@mycompany.com), it works.

I am using the LdapIdentityProviderPlugin and set the AuthorizationCheckEnabled flag to true.

Shouldn’t the camunda engine throw an error, that peter@mycompany.com isn’t authorized to claim and complete a task where max@mycompany.com is set as the candidateUser?

If not, how can I “protect” my workflow?

Best regards,

Rainer

2

Greetings.
I don’t know much about the Authorization service but I think your issue is addressed here.
https://docs.camunda.org/manual/7.16/user-guide/process-engine/authorization-service/#default-task-permissions

Personally, we’re planning to do those restrictions at the application level instead of making the Camunda engine worry about it.
-Doug

3

Thank you for your answer.

I think before claiming the task I will query the tasklist for the current user. If the task that should be claimed is in the tasklist, the claim is allowed otherwise I will response with unauthorized.