使用JBoss jBPM实现流程访问和执行的授权

<process package="com.navteq.jbpm" 
	    key="NO_AUTHORIZATION" 
	    name="Test Authorization not required"   version="1" 
	    xmlns="http://jbpm.org/4.0/jpdl">	
<start g="68,14,48,48" name="start"  >
	<transition to="end"/>
</start>
  
<end g="78,383,48,48" name="end"/>
</process>

<process package="com.navteq.jbpm" 	    key="AUTHORIZATION" 	    name="Test Authorization Required" version="1" 	    xmlns="http://jbpm.org/4.0/jpdl" 	    user-users="mark" 	    user-groups="tomcat">
<start g="68,14,48,48" name="start" >
	<transition to="end"/>
</start>
<end g="78,383,48,48" name="end"/>
</process>

@Retention(value=RetentionPolicy.RUNTIME)
@Target(value=ElementType.METHOD)
public @interface AuthorizedCommand {
	/** Access type */
	public String role();
	String key();
}

…………..
@SuppressWarnings("unchecked")
public void checkPermission(Command<?> command, EnvironmentImpl environment) {
	
environment.setAuthenticatedUserId(environment.get(AuthorizationIdentitySession.class).getAuthenticatedUserId());
	for( Method method : command.getClass().getMethods()) {
		AuthorizedCommand sc = method.getAnnotation(AuthorizedCommand.class);
		if(sc != null){
			log.debug("Checking Class based Secured Function");
			String ID = environment.get(AuthorizationIdentitySession.class).getAuthenticatedUserId();
			Object value = null;
			try {
				log.debug("Checking authorization: " + command.getClass().getName());
				Session session = environment.get(SessionImpl.class);
				value = method.invoke(command, (Object[])null);
				Query uQ = session.createQuery(userQuery.get(sc.key())).
					setString("role", sc.role()).setString("value",(String) value);
				Query gQ = session.createQuery(groupQuery.get(sc.key())).
					setString("role", sc.role()).setString("value", (String) value);
				List<String> userIds = (List<String>)uQ.list();
				List<String> groups = (List<String>)gQ.list();
				if(!isAuthorized(environment, userIds, groups)) 
					throw new AccessControlException(ID+" attempted access to ProcessDefinition #"+value);
			} catch (IllegalArgumentException e) {
				log.error("Caught " + IllegalArgumentException.class, e);
				throw new AccessControlException(ID+" attempted access to ProcessDefinition #"+value);
			} catch (IllegalAccessException e) {
				log.error("Caught " + IllegalAccessException.class, e);
				throw new AccessControlException(ID+" attempted access to ProcessDefinition #"+value);
			} catch (InvocationTargetException e) {
				log.error("Caught " + InvocationTargetException.class, e);
				throw new AccessControlException(ID+" attempted access to ProcessDefinition #"+value);
			}
		}  
	}
	return;
}
……………………..
public boolean isAuthorized(EnvironmentImpl env, List<String> authorizedUserIds, List<String> authorizedGroupIds) {
	AuthorizationIdentitySession identitySession = env.get(AuthorizationIdentitySession.class);
	if (authorizedUserIds.contains(AuthorizationIdentitySession.ANONYMOUS_USER_ID)) 
		return true;
	if (authorizedUserIds.contains(identitySession.getAuthenticatedUserId()) ) 
		return true;
	//check if any of userGroups is an authorized group.  if so then return true
	List<Group> groups = identitySession.findGroupsByUser(identitySession.getAuthenticatedUserId());
	for(Group group : groups){
		String g = group.getId();
		// admin is allowed to execute any command
						if(g.equals(AuthorizationIdentitySession.ADMINISTRATORS_GROUP))
			return true;
		if(authorizedGroupIds.contains(g))
			return true;
}
return false;
}

@AuthorizedCommand(role = ACL.STARTER, key = NavteqAuthorizationSession.PROCESSID)
public String getProcessDefinitionKey() {
   return processDefinitionId;
}

//check authorization
String userId = EnvironmentImpl.getCurrent().getAuthenticatedUserId();
List<Group> userGroups = EnvironmentImpl.getCurrent().get(IdentitySession.class).findGroupsByUser(userId);

hql.append(", " + ACL.class.getName() + " as acl ");
appendWhereClause("acl.deployment=deployment and acl.type='"
	+ ACL.STARTER + "' ", hql);
appendWhereClause("((acl.userId in "
	+ Utils.createHqlUserString(userId) + ") or " + "(acl.groupId in "
					+ Utils.createHqlGroupString(userGroups) + ")) ", hql);

public static class SetPrincipalCommand extends AbstractCommand<Void> {
	private static final long serialVersionUID = 1L;
	private String userId;
	private String[] groups;
	public SetPrincipalCommand(String u, String...groups) { this.userId=u; this.groups=groups; }
	public Void execute(Environment environment) throws Exception {
		environment.get(AuthorizationIdentitySession.class).setPrincipal(userId,groups);
		return null;
	}
}

public static class ResetPrincipalCommand extends AbstractCommand<Void> {
	private static final long serialVersionUID = 1L;
	public Void execute(Environment environment) throws Exception {
		environment.get(AuthorizationIdentitySession.class).reset();
		return null;
	}
}

public class NavteqHistoryServiceImpl extends HistoryServiceImpl {

	@Override
	public HistoryActivityInstanceQuery createHistoryActivityInstanceQuery() {
		return new AuthorizedHistoryActivityInstanceQueryImpl(commandService);
	}

	@Override
	public HistoryDetailQuery createHistoryDetailQuery() {
		return new AuthorizedHistoryDetailQueryImpl(commandService);
	}

	@Override
	public HistoryProcessInstanceQuery createHistoryProcessInstanceQuery() {
		return newAuthorizedHistoryProcessInstanceQuery(commandService);
	}
}