Custom Authentication - Access is denied

Flowable Engine
1

Hi Flowable Team,

I am using my custom authentication, but not able to start a process using the below Rest API:

http://localhost:8091/runtime/process-instances

Below is the token generated:

Token:::::: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@ffffffc4: Principal: admin; Credentials: [PROTECTED]; Authenticated: true; Details: null; Not granted any authorities

Getting Access Denied: Below is the response from REST API

{
“timestamp”: 1515388648670,
“status”: 403,
“error”: “Forbidden”,
“message”: “Access is denied”,
“path”: “/runtime/process-instances”
}

Below is the steps i have followed:

  1. Excluded below configurations

    @EnableAutoConfiguration(exclude = {
    org.flowable.spring.boot.RestApiAutoConfiguration.class,
    org.flowable.spring.boot.SecurityAutoConfiguration.class})

  2. Created my custom authentication provider

    @Component
    public class CustomAuthenticationProvider implements AuthenticationProvider {

    @Override
    public Authentication authenticate(Authentication auth) throws AuthenticationException {
    String username = auth.getName();
    String password = auth.getCredentials().toString();
    …
    …
    }
    }

  3. Started the application.

  4. After the application started tried to start the process with the REST API mentioned above.

Could someone please help me with this issue.

Thanks,
Manjunath

2

Hi Manjunath,

By default the BPMN REST API should run on /service or /process, so the url would be http://localhost:8091/service/runtime/process-instances in your case. Could you check if that is the issue?
Could you share the whole code of the CustomAuthenticationProvider?

Best regards,

Tijs

3

Hi tijs,

Thanks for quick response. All API’s giving the same response saying Access denied.

Below is the complete code of CustomAuthenticationProvider.java

import java.util.Collections;

import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.stereotype.Component;

@Component
public class CustomAuthenticationProvider implements AuthenticationProvider {
@Override
public Authentication authenticate(Authentication auth) throws AuthenticationException {
String username = auth.getName();
String password = auth.getCredentials().toString();

  System.out.println("UserName:::::: " + username);
  System.out.println("Password:::::: " + password);
  UsernamePasswordAuthenticationToken token = null;
  if ("admin".equals(username) && "admin".equals(password)) {
  	token = new UsernamePasswordAuthenticationToken(username, password, Collections.emptyList());
  } else {
  	throw new BadCredentialsException("External system authentication failed");
  }
  System.out.println("Token:::::: " + token);
  return token;

}

@Override
public boolean supports(Class<?> auth) {
return auth.equals(UsernamePasswordAuthenticationToken.class);
}
}