# Flowable-rest doesn't use ldap users **URL:** \ **Category:** Flowable Engine\ **Created:** [June 9, 2017, 12:50pm UTC](https://forum.flowable.org/t/flowable-rest-doesnt-use-ldap-users/634 "2017-06-09T12:50:54Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![Sebastiaan](https://avatars.discourse-cdn.com/v4/letter/s/48db29/32.png) [@Sebastiaan](https://forum.flowable.org/u/Sebastiaan)\ **Post date:** [June 9, 2017, 12:50pm UTC](https://forum.flowable.org/t/flowable-rest-doesnt-use-ldap-users/634/1 "2017-06-09T12:50:54Z")
I configured flowable-rest with the following parameters: > db=mysql > datasource.driver=com.mysql.jdbc.Driver > datasource.url=jdbc:mysql://127.0.0.1:3306/flowable?characterEncoding=UTF-8 > datasource.username=flowable > datasource.password=gfvEsygoAZh3XagGKu5tkexAFs > # demo data properties > > create.demo.users=true > create.demo.definitions=false > create.demo.models=false > # engine properties > > engine.process.schema.update=true > engine.process.asyncexecutor.activate=true > engine.process.history.level=full > engine.dmn.schema.update=true > engine.form.schema.update=true > # rest properties > > # Enable/disable Java serializable objects to be passed as variables in the REST API. > > rest.variables.allow.serializable=true > > # Enable/disable whether the docs are available on /docs > > rest.docs.swagger.enabled=true The user I need to use to query the rest interface is kermit. When i query all users “flowable-rest/service/identity/users” only the demo users are returned. (kermit, fozzie, gonzo.) Is LDAP implemented in flowable-rest? ---
**Author:** ![carbon\_60](https://avatars.discourse-cdn.com/v4/letter/c/ecae2f/32.png) [@carbon\_60](https://forum.flowable.org/u/carbon_60)\ **Post date:** [January 17, 2020, 6:44pm UTC](https://forum.flowable.org/t/flowable-rest-doesnt-use-ldap-users/634/2 "2020-01-17T18:44:33Z")
Hi, I saw this old post, but no one answered this post. I am interested in knowing the answer to the same question. I’ve followed other posts to enable LDAP in my flowable-default.properties file under flowable-rest\WEB-INF\classes: flowable.idm.ldap.enabled=true … But the authentication still goes against dbo.ACT\_ID\_USER table of the configured database, not to LDAP. Reading through the document, to enable LDAP integration, one needs to include dependency in pom.xml: ```auto org.flowable flowable-ldap-configurator latest.version ``` I looked at pom.xml in the flowable-rest package, I do not see this dependency. So I am afraid that I cannot use LDAP authentication for flowable-rest.war, is that true? If that is true, what are my options if I want to integrate flowable-rest.war with LDAP as user store? I cannot use the database configured for flowable engine because it looks like the user passwords in the dbo.ACT\_ID\_USERS are in clear text. Thanks, Joey ---
**Author:** ![Sebastiaan](https://avatars.discourse-cdn.com/v4/letter/s/48db29/32.png) [@Sebastiaan](https://forum.flowable.org/u/Sebastiaan)\ **Post date:** [January 20, 2020, 8:25am UTC](https://forum.flowable.org/t/flowable-rest-doesnt-use-ldap-users/634/3 "2020-01-20T08:25:24Z")
Hi Joey I actually never got it working. I ended putting an API-Manager in front of it. The one I used was wso2 ([https://wso2.com/api-management/](https://wso2.com/api-management/)) This had the advantage that it is a generic solution that also supports other applications and adds features like keys. The disadvantage is that since wso2 uses a “configured” user to connect to Flowable, all actions, no matter who did it are done by that configured user. ---
**Author:** ![Sebastiaan](https://avatars.discourse-cdn.com/v4/letter/s/48db29/32.png) [@Sebastiaan](https://forum.flowable.org/u/Sebastiaan)\ **Post date:** [January 20, 2020, 8:27am UTC](https://forum.flowable.org/t/flowable-rest-doesnt-use-ldap-users/634/4 "2020-01-20T08:27:30Z")
You could also try this how to: [https://robferguson.org/blog/2019/01/28/how-to-flowable-and-ldap/](https://robferguson.org/blog/2019/01/28/how-to-flowable-and-ldap/) Haven’t tried it yet, but maybe that resolves your issue ---
**Author:** ![carbon\_60](https://avatars.discourse-cdn.com/v4/letter/c/ecae2f/32.png) [@carbon\_60](https://forum.flowable.org/u/carbon_60)\ **Post date:** [January 21, 2020, 5:08am UTC](https://forum.flowable.org/t/flowable-rest-doesnt-use-ldap-users/634/5 "2020-01-21T05:08:57Z")
Thanks, Sebastiaan. I followed your link, unfortunately, I am not able to make much progress yet. I even tried to configure flowable-idm to work with Active directory following the link [Integration with Microsoft Active Directory](https://forum.flowable.org/t/integration-with-microsoft-active-directory/492). It appears I was directed to AD for authentication, but I could not get it working. At least, I know the LDAP configuration does make some difference to flowable-idm app, but it does nothing to flowable-rest. b Thanks, Joey ---
**Author:** ![filiphr](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/filiphr/32/315_2.png) [@filiphr](https://forum.flowable.org/u/filiphr)\ **Post date:** [January 21, 2020, 3:17pm UTC](https://forum.flowable.org/t/flowable-rest-doesnt-use-ldap-users/634/6 "2020-01-21T15:17:20Z")
Hey Joey, The Flowable REST Application only supports Basic authentication. This is done in its [SecurityConfiguration](https://github.com/flowable/flowable-engine/blob/master/modules/flowable-app-rest/src/main/java/org/flowable/rest/conf/SecurityConfiguration.java). In case you need some other custom security you would need to create your own. You can get some pointers from the [Building your own Flowable Spring Boot Application](https://blog.flowable.org/2018/12/19/building-your-own-flowable-spring-boot-application/) blog post ---
**Author:** ![carbon\_60](https://avatars.discourse-cdn.com/v4/letter/c/ecae2f/32.png) [@carbon\_60](https://forum.flowable.org/u/carbon_60)\ **Post date:** [January 22, 2020, 2:11pm UTC](https://forum.flowable.org/t/flowable-rest-doesnt-use-ldap-users/634/7 "2020-01-22T14:11:04Z")
Thank you Filiphr for your reply. I do not have issue with the basic authentication to flowable-rest APIs. I was hoping I can use flowable-rest.war as it is with just additional configuration to support AD users and groups. The goals are 1. Use a valid AD user with required privileges to authenticate into flowable-rest application. 2. Use AD users and groups as the CandidateUsers and CandidateGroups in the user task definition in the BPMN process definition. The second goal is more important to me than the first one. If the above goal cannot be accomplished by configuration only, then it seems that I will have to build my own REST application by using flowable-spring-boot-starter-rest dependency. It looks like I can use LDAP configurator ([https://flowable.com/open-source/docs/bpmn/ch17-Ldap/](https://flowable.com/open-source/docs/bpmn/ch17-Ldap/)) to accomplish the above goal, is that correct? Thanks, Joey ---
**Author:** ![Sebastiaan](https://avatars.discourse-cdn.com/v4/letter/s/48db29/32.png) [@Sebastiaan](https://forum.flowable.org/u/Sebastiaan)\ **Post date:** [January 22, 2020, 3:33pm UTC](https://forum.flowable.org/t/flowable-rest-doesnt-use-ldap-users/634/8 "2020-01-22T15:33:26Z")
Hi Joey, The first goal can be accomplished with an API manager. The 2nd goal can be accomplished by doing an LFAP call in a service class, or a rest call to something like keycloak. ---
**Author:** ![carbon\_60](https://avatars.discourse-cdn.com/v4/letter/c/ecae2f/32.png) [@carbon\_60](https://forum.flowable.org/u/carbon_60)\ **Post date:** [January 22, 2020, 8:34pm UTC](https://forum.flowable.org/t/flowable-rest-doesnt-use-ldap-users/634/9 "2020-01-22T20:34:31Z")
Thanks Sebastiaan for your pointer. I did think of the approach of doing the LDAP lookup in my own code. Maybe there is a better way, but the simplest way is to get all the tasks from flowable-rest API without any filter. Then get all the AD groups this user belongs to. Then loop through all the tasks to see if any of them is assigned to a group matching this user’s AD groups. This approach would work, although it will add a lot more network traffic between flowable-rest service and my client app if there are a lot of tasks for a lot of people. So I hope I can find a better solution. I will take a look at keycloak suggestion next. Thanks, Joey ---
**Author:** ![filiphr](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/filiphr/32/315_2.png) [@filiphr](https://forum.flowable.org/u/filiphr)\ **Post date:** [January 23, 2020, 7:24am UTC](https://forum.flowable.org/t/flowable-rest-doesnt-use-ldap-users/634/10 "2020-01-23T07:24:25Z")
Hey Joey, Your approach is also interesting. Keep in mind that you can also pass the groups and user id to flowable-rest. This way the filtering is done in the DB and you’ll have proper paging and less network traffic Cheers, Filip ---
**Author:** ![carbon\_60](https://avatars.discourse-cdn.com/v4/letter/c/ecae2f/32.png) [@carbon\_60](https://forum.flowable.org/u/carbon_60)\ **Post date:** [January 24, 2020, 12:46am UTC](https://forum.flowable.org/t/flowable-rest-doesnt-use-ldap-users/634/11 "2020-01-24T00:46:37Z")
Hi, Philip, Many thanks for your reply. I have a followup question regarding this group filter in Flowable-rest API. Say there is a task with candidategroup = “sales”. Say John is a member of the “sales” group. I read from other threads in the forum, you’ve said that one cannot query the task by user John. That is, one cannot call query/tasks?CandidateUser=john Instead, one has to call query/tasks?CandidateGroup=sales So if john belongs to 10 groups, does the client have to first find out all 10 groups john belongs to and call query/tasks 10 times to see all of John’s tasks? Or is there a single API call to send all 10 groups with OR logic, something like this: query/tasks?CandidateGroup=sales&CandidateGroup=marketing&…? I remember someone in another thread asked similar question and you answered that flowable-rest API does not support OR logic. Thanks, Joey ---
**Author:** ![carbon\_60](https://avatars.discourse-cdn.com/v4/letter/c/ecae2f/32.png) [@carbon\_60](https://forum.flowable.org/u/carbon_60)\ **Post date:** [January 24, 2020, 12:49am UTC](https://forum.flowable.org/t/flowable-rest-doesnt-use-ldap-users/634/12 "2020-01-24T00:49:43Z")
Sorry, Filip, I mistyped your name to Philip. Sincere apology! Joey ---
**Author:** ![carbon\_60](https://avatars.discourse-cdn.com/v4/letter/c/ecae2f/32.png) [@carbon\_60](https://forum.flowable.org/u/carbon_60)\ **Post date:** [January 24, 2020, 1:11am UTC](https://forum.flowable.org/t/flowable-rest-doesnt-use-ldap-users/634/13 "2020-01-24T01:11:50Z")
Hi, Filip, upon further reading of the document, it appears one can use candidategroups=sales,marketing,… That may work, of course it would be much better if candidateuser=john would work as well. Thanks, Joey ---
**Author:** ![filiphr](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/filiphr/32/315_2.png) [@filiphr](https://forum.flowable.org/u/filiphr)\ **Post date:** [January 24, 2020, 7:41am UTC](https://forum.flowable.org/t/flowable-rest-doesnt-use-ldap-users/634/14 "2020-01-24T07:41:51Z")
Hey Joey, > [@carbon\_60](#): > > I mistyped your name to Philip. Sincere apology! It’s completely fine 🙂. Yes you are right OR is currently not supported as a query option. So you would either search for groups or for the user (I know it is not ideal). So using `candidateGroups=sales,marketing,...&candidateUser=john` will not work. Additionally there is also `involvedUser` (over REST) and also `involvedGroups` (over Java, not exposed over REST). If you can create your own Flowable REST App you can in theory add your own endpoint that would be able to use the Java API and use OR (you can do that with Java). Cheers, Filip ---
**Author:** ![carbon\_60](https://avatars.discourse-cdn.com/v4/letter/c/ecae2f/32.png) [@carbon\_60](https://forum.flowable.org/u/carbon_60)\ **Post date:** [January 24, 2020, 4:05pm UTC](https://forum.flowable.org/t/flowable-rest-doesnt-use-ldap-users/634/15 "2020-01-24T16:05:54Z")
Thanks, Filip, for clarification! Joey