Task History Authorization

[mac-git-79]

Hi all,

Is there a way to configure a read history authorization for a specific human task?

We tested with success the READ_HISTORY permission on resource type Process Definition (6) for specific groups, but we want to control it by task, ideally using the task definition key.

Authorization Service | docs.camunda.org

[tmetzke]

Hey @mac-git-79,

READ_HISTORY can be defined on Tasks as well, yes.
It does not seem to be documented, though.
Maybe you could file an issue for that in the Issue Tracker?

However, as far as I know, this only works with task IDs, not with task definition keys because they would not be unique across models.

Perhaps you could use a create task event listener to add the authorization as soon as the task is created? Haven’t tried it myself though.

Best,
Tobias

[lhofer87]

Hi, this should work and here is a little help about authorization in listeners

Four eyes principle (Revoke authorization)

There are more solutions, but if you want to do it with revoking access in permissions you can do it this way. [4eyes] Working sample process: test4eyesPrincipleRevokeAuth.bpmn (7.1 KB) The result is whichever user completes the “Task A”, will not see the “Task B” in the tasklist, even he has the needed authorization set up by the group, but the “user” authorization is “stronger” than the group authorization.

Hope this helps.
Cheers,
Lukas