# Required privileges

**URL:** <https://forum.flowable.org/t/required-privileges/4614>\
**Category:** Flowable Engine\
**Created:** [October 1, 2019, 8:29am UTC](https://forum.flowable.org/t/required-privileges/4614 "2019-10-01T08:29:33Z")\
**Posts on this page:** 16\
**Page:** 1

<div class="post-metadata">

**Author:** ![DarkStar1](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/darkstar1/32/394_2.png) [@DarkStar1](https://forum.flowable.org/u/DarkStar1)\
**Post date:** [October 1, 2019, 8:29am UTC](https://forum.flowable.org/t/required-privileges/4614/1 "2019-10-01T08:29:33Z")

</div>

Hi  
I am testing out a custom idm for my springboot project (using Alfresco as an idm source).  
I’m wondering what kind of privilege a user needs to be able to make queries for process definitions and task list over REST api?  
I have added a **user mapping** for the **access-rest-api** privilege but I still get 401 (I even tried access-admin).  
I located [the config](https://github.com/flowable/flowable-engine/blob/master/modules/flowable-app-rest/src/main/java/org/flowable/rest/conf/BootstrapConfiguration.java#L107) that boots the REST admin user and used that as the inspiration to bootstrap the mappings after the spring context loads but alas to no avail.  
Would really appreciate any pointers that can help me solve this.

---

<div class="post-metadata">

**Author:** ![filiphr](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/filiphr/32/315_2.png) [@filiphr](https://forum.flowable.org/u/filiphr)\
**Post date:** [October 2, 2019, 12:35pm UTC](https://forum.flowable.org/t/required-privileges/4614/2 "2019-10-02T12:35:45Z")

</div>

Hey,

How are you providing the custom IDM to the Flowable engines? This [`SecurityConfiguration`](https://github.com/flowable/flowable-engine/blob/master/modules/flowable-app-rest/src/main/java/org/flowable/rest/conf/SecurityConfiguration.java) is the places where the **access-rest-api** is configured.

How does your security configuration look like?

Cheers,  
Filip

---

<div class="post-metadata">

**Author:** ![DarkStar1](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/darkstar1/32/394_2.png) [@DarkStar1](https://forum.flowable.org/u/DarkStar1)\
**Post date:** [October 2, 2019, 12:44pm UTC](https://forum.flowable.org/t/required-privileges/4614/3 "2019-10-02T12:44:17Z")

</div>

I literally used the LDAP module for inspiration and essentially using an auto configuration class to inject my identityService. Something like so:

```auto
@Configuration
@ConditionalOnIdmEngine
@ConditionalOnProperty(prefix = "flowable.idm.alfresco", name = "enabled", havingValue = "true", matchIfMissing = false)
@AutoConfigureOrder(Ordered.LOWEST_PRECEDENCE)
@AutoConfigureAfter({
        AppEngineAutoConfiguration.class,
        ProcessEngineAutoConfiguration.class,
})
@AutoConfigureBefore({
        IdmEngineAutoConfiguration.class,
        AppEngineServicesAutoConfiguration.class,
        ProcessEngineServicesAutoConfiguration.class
})
public class FlowableConfiguration extends IdmEngineAutoConfiguration {
...
@Bean
    public EngineConfigurationConfigurer<SpringIdmEngineConfiguration> alfrescoIdmEngineConfigurer(AlfrescoConnectionUtil connectionUtil) {
        return idmEngineConfiguration -> idmEngineConfiguration
                .setIdmIdentityService(new AlfrescoIdentityServiceImpl(connectionUtil));
    }
}

```

I didn’t see a security configuration for the LDAP module so I didn’t create one.  
I also noticed that only 2 privileges are being created when my process engine boots up,  
namely the **access-rest-api** and the **access-admin**.

---

<div class="post-metadata">

**Author:** ![filiphr](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/filiphr/32/315_2.png) [@filiphr](https://forum.flowable.org/u/filiphr)\
**Post date:** [October 2, 2019, 12:53pm UTC](https://forum.flowable.org/t/required-privileges/4614/4 "2019-10-02T12:53:46Z")

</div>

And is there a mapping created between the admin user and the privileges? Are you created some user during the boot of the application?

Btw you should not extend from a Spring Boot Auto Configuration. You can create your own and that one would be properly picked up.

---

<div class="post-metadata">

**Author:** ![DarkStar1](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/darkstar1/32/394_2.png) [@DarkStar1](https://forum.flowable.org/u/DarkStar1)\
**Post date:** [October 2, 2019, 12:58pm UTC](https://forum.flowable.org/t/required-privileges/4614/5 "2019-10-02T12:58:45Z")

</div>

Yes. I have created groups in my alfresco repo that match, in name, the flowable default privileges such that on boot, my identity service creates the privilege mapping (though the admin user and mapping are always created by the time my bootstrap code runs).  
When I inspect the database I see that my users are present and the mapping privileges are also present.

---

<div class="post-metadata">

**Author:** ![filiphr](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/filiphr/32/315_2.png) [@filiphr](https://forum.flowable.org/u/filiphr)\
**Post date:** [October 2, 2019, 1:02pm UTC](https://forum.flowable.org/t/required-privileges/4614/6 "2019-10-02T13:02:05Z")

</div>

Then everything should work properly. If you are creating your own Spring Boot project and you don’t have a security configuration defined then perhaps the problems is that the default from Spring Boot is picked up. You would need to define your own with your own logic for it to work properly.

---

<div class="post-metadata">

**Author:** ![DarkStar1](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/darkstar1/32/394_2.png) [@DarkStar1](https://forum.flowable.org/u/DarkStar1)\
**Post date:** [October 2, 2019, 1:02pm UTC](https://forum.flowable.org/t/required-privileges/4614/7 "2019-10-02T13:02:59Z")

</div>

So I should create my own security config to match the one you suggested earlier?  
Will give that a go. Thanks for the pointer.

---

<div class="post-metadata">

**Author:** ![filiphr](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/filiphr/32/315_2.png) [@filiphr](https://forum.flowable.org/u/filiphr)\
**Post date:** [October 2, 2019, 1:03pm UTC](https://forum.flowable.org/t/required-privileges/4614/8 "2019-10-02T13:03:56Z")

</div>

Yes you should create your own that would match your needs

---

<div class="post-metadata">

**Author:** ![DarkStar1](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/darkstar1/32/394_2.png) [@DarkStar1](https://forum.flowable.org/u/DarkStar1)\
**Post date:** [October 3, 2019, 10:00am UTC](https://forum.flowable.org/t/required-privileges/4614/9 "2019-10-03T10:00:52Z")

</div>

I tried all sorts of configuration for the SecurityConfig and currently have the following Auto config deployed

```auto
.... Some code to initialise privileges defined as alfresco groups which actually work and create the privileges.
@Profile("production")
@Configuration
@ConditionalOnIdmEngine
@ConditionalOnProperty(prefix = "flowable.idm.alfresco", name = "enabled", havingValue = "true", matchIfMissing = false)
@AutoConfigureAfter({AlfrescoConnectionUtil.class, AlfrescoIdentityServiceImpl.class})
@Order(710)
@EnableWebSecurity
public class ProdAppWebSecurityConfigurer extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        UtilMethods.logInfoMsg(logger,"Initialising production web security config.........");

// http.csrf().disable()
// .requestMatchers()
// .antMatchers("/process-api/**").and()
// .authorizeRequests()
// .antMatchers("/runtime/**").hasAuthority(SecurityConstants.PRIVILEGE_ACCESS_REST_API)
// .antMatchers("/repository/process-definitions/**").hasAuthority(SecurityConstants.PRIVILEGE_ACCESS_REST_API)
// .and()
// .httpBasic();

        http.csrf().disable()
            .authorizeRequests()
            .anyRequest()
            .hasAuthority(SecurityConstants.PRIVILEGE_ACCESS_REST_API).and().httpBasic();
    }
}

```

but I am still getting the same 401 results.  
I should add that I took my inspiration from the [flowable-spring-boot-sample-ldap](https://github.com/flowable/flowable-engine/blob/master/modules/flowable-spring-boot/flowable-spring-boot-samples/flowable-spring-boot-sample-ldap/src/main/java/flowable/SampleLdapApplication.java) example.  
I should also mention that, a symptom of implementing the security configuration is that **the admin account is now locked out** of making the same request(s), whereas before it wasn’t.

---

<div class="post-metadata">

**Author:** ![jckermagoret](https://avatars.discourse-cdn.com/v4/letter/j/34f0e0/32.png) [@jckermagoret](https://forum.flowable.org/u/jckermagoret)\
**Post date:** [October 9, 2019, 4:34am UTC](https://forum.flowable.org/t/required-privileges/4614/10 "2019-10-09T04:34:26Z")

</div>

Hello DarkStar1,  
Have you finally succeeded in developing your Alfresco idm?

Jc

---

<div class="post-metadata">

**Author:** ![DarkStar1](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/darkstar1/32/394_2.png) [@DarkStar1](https://forum.flowable.org/u/DarkStar1)\
**Post date:** [October 9, 2019, 7:59am UTC](https://forum.flowable.org/t/required-privileges/4614/11 "2019-10-09T07:59:15Z")

</div>

Not yet.  
I’m returning to it tomorrow to try and resolve this issue with the privileges.  
Once it’s then battle tested, I’ll mirror the code onto Github (or the OOTB repo).  
So perhaps next week sometime.

---

<div class="post-metadata">

**Author:** ![jckermagoret](https://avatars.discourse-cdn.com/v4/letter/j/34f0e0/32.png) [@jckermagoret](https://forum.flowable.org/u/jckermagoret)\
**Post date:** [October 9, 2019, 2:47pm UTC](https://forum.flowable.org/t/required-privileges/4614/12 "2019-10-09T14:47:01Z")

</div>

Hello,  
I can help, test…

Don’t hesitate, I’m willing to help, I have the same concerns. I’m using LDAP connector for the moment but it’s a little limited iwthout subgroups support. If implemented in Alfresco, it can be done easily.

Thanks,

JC

---

<div class="post-metadata">

**Author:** ![DarkStar1](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/darkstar1/32/394_2.png) [@DarkStar1](https://forum.flowable.org/u/DarkStar1)\
**Post date:** [October 14, 2019, 12:25pm UTC](https://forum.flowable.org/t/required-privileges/4614/13 "2019-10-14T12:25:49Z")

</div>

Currently testing. Will get back to you as soon as I’ve verified it is working.

---

<div class="post-metadata">

**Author:** ![jckermagoret](https://avatars.discourse-cdn.com/v4/letter/j/34f0e0/32.png) [@jckermagoret](https://forum.flowable.org/u/jckermagoret)\
**Post date:** [October 14, 2019, 7:54pm UTC](https://forum.flowable.org/t/required-privileges/4614/14 "2019-10-14T19:54:38Z")

</div>

Cool. I’m eager to test it 🙂

JC

---

<div class="post-metadata">

**Author:** ![jckermagoret](https://avatars.discourse-cdn.com/v4/letter/j/34f0e0/32.png) [@jckermagoret](https://forum.flowable.org/u/jckermagoret)\
**Post date:** [October 16, 2019, 9:41am UTC](https://forum.flowable.org/t/required-privileges/4614/15 "2019-10-16T09:41:05Z")

</div>

Hi Daskstar1,  
Need some help to test?

JC

---

<div class="post-metadata">

**Author:** ![DarkStar1](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/darkstar1/32/394_2.png) [@DarkStar1](https://forum.flowable.org/u/DarkStar1)\
**Post date:** [October 16, 2019, 11:47am UTC](https://forum.flowable.org/t/required-privileges/4614/16 "2019-10-16T11:47:29Z")

</div>

Yes. I sent you a pm with a link.