BPM UserTask -->complex assignment

Scenario:

I have a simple order approval BPM app.
An order needs to be approved by an Approver.
An Approver is someone, who according to our LDAP directory, belongs to the NCGroup1 and NCGroup2.

In this post I discuss how to access LDAP for the relevant info.

I create such a user - nc - leveraging weblogic's embedded LDAP.

nc is a member of NCGroup1 and NCGroup2
rc is a member of NCGroup1

I now need to write some Java to retrieve this information -

Extracting the user nc's information as follows -
------------------------------------------------------------

public static void main(String a[])
{
String ENTRYDN = "uid=nc,ou=people,ou=myrealm,dc=nc_domain";// This is rootDN

// ou=people,ou=myrealm,dc=nc_domain
Hashtable env = new Hashtable();
env.put(Context.INITIAL_CONTEXT_FACTORY,"com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.PROVIDER_URL,"ldap://127.0.0.1:7001");// This is your ldap URL

try{

env.put(Context.SECURITY_PRINCIPAL,"cn=Admin");//DN
env.put(Context.SECURITY_CREDENTIALS,"welcome1");//This is password

DirContext ctx = new InitialDirContext(env);
   
//
   
  String[] attrs = new String[4];
        attrs[ 0 ] = "cn";              /* Get canonical name(s) (full name) */
        attrs[ 1 ] = "sn";              /* Get surname(s) (last name) */
        attrs[ 2 ] = "wlsMemberOf";            /* Get email address(es) */
        Attributes result = ctx.getAttributes(ENTRYDN, attrs);
    
System.out.println("Result " + result.size());   
System.out.println("Result " + result.get("cn"));   
System.out.println("Result " + result.get("wlsMemberOf"));

---------------------------------------------------------

Output -

However, I really need to look up the group -

  I take the memberURL and use as follows -


    System.out.println(" ****************************************************************");
       
// Look for members of NCGroup1
 Attributes userAttrs = new BasicAttributes(true);
 userAttrs.put("cn", null);
  NamingEnumeration answer = ctx.search(
     "ldap://localhost:7001/ou=people,ou=myrealm,dc=nc_domain??sub?(&(objectclass=person)(wlsMemberOf=cn=NCGroup1,ou=groups,ou=myrealm,dc=nc_domain))", userAttrs); 
    while (answer.hasMoreElements()){
        System.out.println("Group Members of NCGroup1 =" + answer.nextElement().toString()); 
       
    }
    System.out.println(" ****************************************************************");
    // Look for members of NCGroup2
      answer = ctx.search(
         "ldap://localhost:7001/ou=people,ou=myrealm,dc=nc_domain??sub?(&(objectclass=person)(wlsMemberOf=cn=NCGroup2,ou=groups,ou=myrealm,dc=nc_domain))", userAttrs); 
        while (answer.hasMoreElements()){
            System.out.println("Group Members of NCGroup2 =" + answer.nextElement().toString()); 
           
        }
---------------------------------------------------------


Output -

Now another approach could be taken, if there is a hierarchy at work -

Let's use groups with more relevant names -

In this case -
NCGroup1 = IE_EMPS
NCGroup2 = IE_EMPS_ACCOUNTS

so amend IE_EMPS_ACCOUNTS as follows -

I create a new group IE_EMPS_SALES and assign IE_EMPS as its parent group.

I assign the users as follows -

rc is a member of IE_EMPS_SALES
pc is a member of IE_EMPS_ACCOUNTS
nc is a member of IE_EMPS

I deploy and test the above -

Log in to the BPM workspace as user nc

He sees no tasks

Log in to the BPM workspace as user rc

She sees the BasicApproval task

Log in to the BPM workspace as user pc

He sees no tasks

Variation of the theme...

I have 3 groups
IE_EMPS = IE_EMPS_SALES AND IE_EMPS_ACCOUNTS
IE_EMPS_SALES
IE_EMPS_ACCOUNTS
  

I have 3 users -
nc  belongs to IE_EMPS
rc belongs to IE_EMPS_SALES
pc belongs to IE_EMPS_ACCOUNTS

Now the process is as follows -

Deploy and Test

Only nc sees the task

Ergo rc doesn't

I add another swimlane to the process

Re-deploy and test

I login as nc and see the order - I approve it.

User nc now sees the Financial Approval task as nc has the role IE_EMPS that includes IE_EMPS_SALES and IE_EMPS_ACCOUNTS.

User pc naturally also sees the task as he has the role IE_EMPS_ACCOUNTS

User rc doesn't see the task as she has the role IE_EMPS_SALES

End of Part 1...