Activiti: activiti 7 + jhipster user authorization

[mkawczynski07]

Hi.

I created microservice with jhipster. I added to it activiti 7.0.0.Beta1. My microservices are configured to use jhipster UAA. I added a small endpoint to create process instance:

    @Timed
    @GetMapping("/start")
    public ResponseEntity<ProcessInstance> start() throws URISyntaxException {
        Offer offer = new Offer();
        StartProcessPayload payload = ProcessPayloadBuilder
                .start()
                .withProcessDefinitionKey(PROCESS_NAME)
                .withProcessInstanceName("New offer")
                .withVariable("offer", offer)
                .build();
        ProcessInstance instance = processRuntime.start(payload);
        return ResponseEntity.created(new URI("/api/process/start/" + instance.getId()))
                .headers(HeaderUtil.createEntityCreationAlert(PROCESS_NAME, instance.getId()))
                .body(instance);
    }

And it works perfectly. :)
But when I try to expose list of current users task in this way:

    @GetMapping("/get-my-tasks")
    @Timed
    public ResponseEntity<List<Task>> getAllMyTasks(Pageable pageable) {
        log.debug("REST request to get a page of my tasks");

        org.activiti.runtime.api.query.Pageable.of(new Long(pageable.getOffset()).intValue(), pageable.getPageNumber());
        Page<Task> page = taskRuntime.tasks(
                org.activiti.runtime.api.query.Pageable.of(new Long(pageable.getOffset()).intValue(), pageable.getPageNumber())
        );

        HttpHeaders headers = ActivitiPaginationUtil.generatePaginationHttpHeaders(page, "/api/tasks/get-my-tasks");
        return new ResponseEntity<>(page.getContent(), headers, HttpStatus.OK);
    }

I get exception:

org.springframework.security.core.userdetails.UsernameNotFoundException: admin
        at org.springframework.security.provisioning.InMemoryUserDetailsManager.loadUserByUsername(InMemoryUserDetailsManager.java:146)
        at org.activiti.spring.identity.ActivitiUserGroupManagerImpl.getUserGroups(ActivitiUserGroupManagerImpl.java:23)
        at org.activiti.runtime.api.impl.TaskRuntimeImpl.tasks(TaskRuntimeImpl.java:103)
        at org.activiti.runtime.api.impl.TaskRuntimeImpl$$FastClassBySpringCGLIB$$cb179e94.invoke(<generated>)
        at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:204)
        at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.invokeJoinpoint(CglibAopProxy.java:746)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:163)
        at org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:69)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:185)
        at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:688)
        at org.activiti.runtime.api.impl.TaskRuntimeImpl$$EnhancerBySpringCGLIB$$eed2ae67.tasks(<generated>)
        at com.bpm.micro.web.rest.TasksResource.getAllMyTasks(TasksResource.java:45)
        at com.bpm.micro.web.rest.TasksResource$$FastClassBySpringCGLIB$$3b2950c2.invoke(<generated>)
        at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:204)
        at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.invokeJoinpoint(CglibAopProxy.java:746)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:163)
        at org.springframework.aop.aspectj.MethodInvocationProceedingJoinPoint.proceed(MethodInvocationProceedingJoinPoint.java:88)
        at com.bpm.micro.aop.logging.LoggingAspect.logAround(LoggingAspect.java:85)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:564)
        at org.springframework.aop.aspectj.AbstractAspectJAdvice.invokeAdviceMethodWithGivenArgs(AbstractAspectJAdvice.java:644)
        at org.springframework.aop.aspectj.AbstractAspectJAdvice.invokeAdviceMethod(AbstractAspectJAdvice.java:633)
        at org.springframework.aop.aspectj.AspectJAroundAdvice.invoke(AspectJAroundAdvice.java:70)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:185)
        at org.springframework.aop.aspectj.AspectJAfterThrowingAdvice.invoke(AspectJAfterThrowingAdvice.java:62)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:185)
        at org.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:92)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:185)
        at com.ryantenney.metrics.spring.TimedMethodInterceptor.invoke(TimedMethodInterceptor.java:48)
        at com.ryantenney.metrics.spring.TimedMethodInterceptor.invoke(TimedMethodInterceptor.java:34)
        at com.ryantenney.metrics.spring.AbstractMetricMethodInterceptor.invoke(AbstractMetricMethodInterceptor.java:59)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:185)
        at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:688)
        at com.bpm.micro.web.rest.TasksResource$$EnhancerBySpringCGLIB$$4b05f146.getAllMyTasks(<generated>)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:564)
        at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:209)
        at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:136)
        at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:102)
        at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:877)
        at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:783)
        at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87)
        at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:991)
        at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:925)
        at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:974)
        at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:866)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:687)
        at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:851)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
        at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
        at com.codahale.metrics.servlet.AbstractInstrumentedFilter.doFilter(AbstractInstrumentedFilter.java:111)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at org.springframework.web.filter.CorsFilter.doFilterInternal(CorsFilter.java:96)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at org.springframework.boot.actuate.web.trace.servlet.HttpTraceFilter.doFilterInternal(HttpTraceFilter.java:90)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:320)
        at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:127)
        at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:91)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
        at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:119)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
        at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
        at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:111)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
        at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:170)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
        at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
        at org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationProcessingFilter.doFilter(OAuth2AuthenticationProcessingFilter.java:176)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
        at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
        at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:66)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
        at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
        at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
        at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:215)
        at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178)
        at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:357)
        at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:270)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at org.springframework.web.filter.HttpPutFormContentFilter.doFilterInternal(HttpPutFormContentFilter.java:109)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:93)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.filterAndRecordMetrics(WebMvcMetricsFilter.java:155)
        at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.filterAndRecordMetrics(WebMvcMetricsFilter.java:123)
        at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.doFilterInternal(WebMvcMetricsFilter.java:108)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:200)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
        at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
        at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:64)
        at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
        at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:132)
        at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
        at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
        at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
        at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
        at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.SessionRestoringHandler.handleRequest(SessionRestoringHandler.java:119)
        at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
        at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
        at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
        at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
        at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
        at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
        at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
        at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
        at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
        at io.undertow.server.Connectors.executeRootHandler(Connectors.java:336)
        at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1135)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
        at java.base/java.lang.Thread.run(Thread.java:844)

For me seams that spring-boot inject InMemoryUserDetailsManager but i dont know why. Should I send this issue to jhipster team or it is activiti problem ?

Also when I change my code a little bit:

    @Timed
    @GetMapping("/start")
    public ResponseEntity<ProcessInstance> start() throws URISyntaxException {
        Offer offer = new Offer();
        StartProcessPayload payload = ProcessPayloadBuilder
                .start()
                .withProcessDefinitionKey(PROCESS_NAME)
                .withProcessInstanceName("New offer")
                .withVariable("offer", offer)
                .withVariable("owner", SecurityUtils.getCurrentUserLogin().get())
                .build();
        ProcessInstance instance = processRuntime.start(payload);
        return ResponseEntity.created(new URI("/api/process/start/" + instance.getId()))
                .headers(HeaderUtil.createEntityCreationAlert(PROCESS_NAME, instance.getId()))
                .body(instance);
    }

In the database I will have owner variable set to correct user login.

EDIT: Ok, I figured it up. But this is only for my POC so it is not a solution:

@Configuration
public class ActivitiUserDetailsConfiguration {

    private final Logger log = LoggerFactory.getLogger(ActivitiUserDetailsConfiguration.class);

    @Bean
    public UserDetailsService myUserDetailsService() {

        InMemoryUserDetailsManager inMemoryUserDetailsManager = new InMemoryUserDetailsManager();

        List<SimpleGrantedAuthority> authorities = new ArrayList();
        authorities.add(new SimpleGrantedAuthority("ROLE_ADMIN"));
        authorities.add(new SimpleGrantedAuthority("ROLE_USER"));
        authorities.add(new SimpleGrantedAuthority("ROLE_ACTIVITI_USER"));

        inMemoryUserDetailsManager.createUser(new User("admin", passwordEncoder().encode("admin"), authorities));

        return inMemoryUserDetailsManager;
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

[salaboy]

@mkawczynski07 great that you are trying our stuff with JHipster, we will provide further integrations before the final release. Would you consider jumping into our Gitter channel so we can help you to get this working.
The main problem is the UAA integration, which shouldn't be difficult but we need to implement it, and it sounds like a great community contribution. I am confident that if we collaborate we can get this working for beta2.

If instead of UAA you use Keycloak in JHipster, you should be able to get it working in no time, just adding some deps.

https://gitter.im/Activiti/Activiti7?utm_source=share-link&utm_medium=link&utm_campaign=share-link

[mkawczynski07]

@Salaboy we decide today that we will use activiti 7 in our project. We also would like to use jhipster. In case of that, we have been even thinking about getting involved in the integration project.

[salaboy]

@mkawczynski07 great!!! those are great news! We can definitely collaborate in that .. get in touch via gitter so we can have a more detailed conversation.

[salaboy]

@mkawczynski07 did you manage to make progress on this front?

[mkawczynski07]

Unfortunately nope. But integration with jhipster uaa is part of our next sprint. So I will be working on it by the end of the month.

[salaboy]

@mkawczynski07 great.. please make sure that you get back to us before starting so we can update you on our side. I bet that we can get that working in less than a week.

[mkawczynski07]

@salaboy we integrated jhipster uaa with activiti.

First, we have to implement UserGroupManager

@Component
@Primary
public class UaaUserGroupManager implements UserGroupManager {

    private final UserService userService;

    public UaaUserGroupManager(UserService userService) {
        this.userService = userService;
    }

    @Override
    public List<String> getUserGroups(String login) {
        return userService.getUserGroups(login);
    }

    @Override
    public List<String> getUserRoles(String login) {
        return userService.getUserRoles(login);
    }
}

UserService is a simple service that accesses uaa through faign client.
Right now we don't have time to create user groups so we basically based on authorities prefix. Our quick win. :)

@Component
public class UserService {

    private final UaaClient uaa;

    public UserService(UaaClient uaa) {
        this.uaa = uaa;
    }

    private List<String> getUserAuthorities(String login, String authorityType) {
        return uaa.getUser(login).getAuthorities()
            .stream()
            .filter(authority -> authority.startsWith(authorityType))
            .collect(Collectors.toList());
    }


    public List<String> getUserGroups(String login) {
        return getUserAuthorities(login, AuthoritiesConstants.GROUP_PREFIX);
    }

    public List<String> getUserRoles(String login) {
        return getUserAuthorities(login, AuthoritiesConstants.ROLE_PREFIX);
    }
}

Second, we have to implement SecurityManager:

@Configuration
@Primary
public class UaaSecurityManager implements SecurityManager {
    @Override
    public String getAuthenticatedUserId() {
        return SecurityUtils.getCurrentUserLogin().get();
    }
}

At last, we would like to provide authenticated user id to process definitions scripts so we call Authentication.setAuthenticatedUserId.

@Component
public class ActivitiAuthenticationSuccessEventListener implements ApplicationListener<AuthenticationSuccessEvent> {

    @Override
    public void onApplicationEvent(AuthenticationSuccessEvent authenticationSuccessEvent) {
        Authentication.setAuthenticatedUserId(authenticationSuccessEvent.getAuthentication().getName());
    }
}

That's all that we have done so far. Right now for us, everything works perfectly. :)

[salaboy]

@mkawczynski07 you rock guys! Are you willing to contribute that back to the project? Today, that means to create a couple maven module with your classes here:
https://github.com/activiti/activiti-cloud-service-common

You will see that we have a module for security and another for identity.

I'm not so sure that this is the best approach:

 @Override
    public void onApplicationEvent(AuthenticationSuccessEvent authenticationSuccessEvent) {
        Authentication.setAuthenticatedUserId(authenticationSuccessEvent.getAuthentication().getName());
    }

But it will do the work for sure. I am happy to review that if you send a PR to https://github.com/activiti/activiti-cloud-service-common

By contributing you will get more features as we add them and bug fixes, avoiding you to maintain that code 👍

[salaboy]

@mkawczynski07 also.. if you contribute that back before the end of Nov .. there are a lot of chances to get it in for Beta4

[ryandawsonuk]

@mkawczynski07 thanks for sharing your solution so clearly. As @salaboy suggests, it would be great to capture that as a module for uaa in cloud service common so that we can provide it out of the box and the activiti community can support and build on it. If you can contribute do feel free to chat with us as we're happy to help. We understand contributor time is limited so it's ok if things start out a bit rough and ready.

Once we have that then we could look at what dependencies and config we need to add to a jhipster project to get it working and whether we can do that in a jhipster generator. We did a POC on that before but it would need reworking now to use the new versions and dependencies. The generator would be a later step though.

[stoicko]

@salaboy @ryandawsonuk The UserGroupManager interface has been extended in beta2 for getUsers / getGroups, but I can not find a use case for them.
This is tricky in the context of jhipster uaa integration as this data (all users / groups) should be available only to admin users only

[salaboy]

@stoicko we will add this in Beta5, but how do you get users in UUA? If users and groups are only available only for admins, we can just return an empty list for both.. unless the one executing the request is the admin.. is that a valid option?

[ryandawsonuk]

@stoicko we use a service account user named 'client'/'client-user' to access the users and groups as ordinary users in our example keycloak realm also don't have permission to query for users and groups. The implementation code needs to use the details of that client user and login with that user when doing the query.

[mkawczynski07]

@ryandawsonuk thanks for the code. @stoicko I think that we could do something similar for jhipster uaa.

[salaboy]

@mkawczynski07 @stoicko guys.. can you share the dependency that you are using for including the UaaClient class? I want to provide you guys a module that you can just include in your JHipster app to avoid you maintaining that integration.. I can share a branch with these modules so you can test it before we release. The sooner I get the right dependency for UAA Client the sooner that I can share those two new modules.

[mkawczynski07]

import client.AuthorizedUserFeignClient;
import service.dto.UaaUserDTO;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;

import java.util.List;

@AuthorizedUserFeignClient(name = "uaa")
public interface UaaClient {

  @GetMapping("/api/users/{login}")
  UaaUserDTO getUser(@PathVariable(value = "login") String login);

  @GetMapping("/api/users/logins")
  List<String> getAllUsersLogins();

  @GetMapping("/api/users/authorities")
  List<String> getAuthorities();
}

package service.dto;

import java.util.Set;

public class UaaUserDTO {

    private String login;
    private Set<String> authorities;

    public UaaUserDTO(){
    }

    public UaaUserDTO(String login, Set<String> authorities) {
        this.login = login;
        this.authorities = authorities;
    }

    public String getLogin() {
        return login;
    }

    public Set<String> getAuthorities() {
        return authorities;
    }
}

AuthorizedUserFeignClient is generated class by jHipster.
uaa is a name of our UAA microservice.

[salaboy]

@mkawczynski07 hmm we need to find a way to integrate with @AuthorizedUserFeignClient(name = "uaa"), where is that generated? in your target dir? Can you share a simple jhipster project/microservice that I can clone with such classes?

[mkawczynski07]

Just generate simple microservice with jhipster then you could check out AuthorizedUserFeignClient class.

[mteodori]

@mkawczynski07 is there anything else we can do for this issue or just close? Is UAA using a standard like SCIM or does it have proprietary API like Keycloak to retrieve users/groups/roles?
Thanks

[mkawczynski07]

You can close this issue. We integrated UAA with activity as I wrote in previous post.

more about UAA: https://www.jhipster.tech/using-uaa/

[mteodori]

great thanks, if we add alternate implementations in activiti it would probably be SCIM as at least it's a standard and not tied to a single identity product once again like keycloak