IDM. BPMN Groups vs Spring Security Groups

[joram]

@moraleda

The way the flowable IDM currently works, it couples BPMN groups with roles as defined above. My suggestion is that the two concepts should not be coupled. Instead, it is my opinion that belonging to a BPMN group is logically equivalent to having a privilege as defined above. In this way of thinking, users could be assigned membership to bpmn groups specifically, but roles could also be given membership into bpmn groups and users would inherit membership from the roles they have. This way there we could have roles that would have membership to multiple bpmn groups as well as roles that have nothing to do with bpmn and have no membership to any bpmn group. Let me know if this makes sense.

Thans for the thorough explanation. Am I understanding you correctly that you want to add the concept of a ‘role’ that could also be a member of a group? Is a role something that gets persisted (with foreign keys and all that to user/groups) or is it more something orthogonal to it, that gets applied when needed?

FYI: in the past, we’ve had the concept of a ‘security group’ (see https://github.com/flowable/flowable-engine/blob/master/modules/flowable-ui-idm/flowable-ui-idm-logic/src/main/java/org/flowable/ui/idm/constant/GroupTypes.java#L21), which is a group for the IDM engine, but treated differently. The current implementation however, doesn’t use that type anymore. With a security group, privileges can be attached to that group.