BPM Dynamic Roles

Hi All,
I am trying to figure out how I can dynamically assign roles within BPM. So I want to be able to route the BPM process to the manager of the user that the process was assigned. I am just not sure how to dynamically do this within BPM.
Any thoughts? Any documentation on dynamic roles would be greatly appreciated.
We are using BPM 11g.
--S

So is it the call CreateResourceList that lets you actually set the user / approle for a flow?
It looks like that might be on the right track.
--S

Similar Messages

Participant Assignment to BPM Process Role

Hi everyone ;
I need to custom application for participant assignment to BPM process role. You know, this operation has been made under Business Process Workspace > Administration Areas > Organization > Roles But this page is not useful for Administrator user. I want to develop an application that it makes set Participant to BPM App Role. But, i haven't any API.
Firstly, is this possible? And than, how can i implement it?
Thanks.

Is restart of the engine server on which ProcessP deployed is the only solution since the error messages shows up as 'Process Execution Engine has not re-synchronized with the Directory Service. '

Dynamic Role -- Group Mapping not working in WebLogic 10

I have an installation I am migrating from 9.2 to 10. It uses Dynamic Role Mapping:
From my Weblogic.xml within the deployment:
    <security-role-assignment>
        <role-name>EELSSystemAdministrator</role-name>
        <externally-defined/>
    </security-role-assignment>I am using SPNEGO SSO, and it is working fine, it retrieves the principles from LDAP and adds them to the subject, so everything is fine there. I have defined the deployment constraint "EELSSystemAdministrator" as a Global Role, and then Added a condition "group" and set it to the LDAP Group (SMS EELSSystemAdministrator) which is one of the three principles being returned from LDAP.
When the Role mapper runs, it returns the following in the logs:
<SecurityRoleMap> <Accessed Subject: Id=urn:oasis:names:tc:xacml:2.0:subject:group, Value=[everyone,users, SMS EELSSystemAdministrator,SMS EELSReportAnalyst]>
<SecurityRoleMap> <Evaluate urn:oasis:names:tc:xacml:1.0:function:string-is-in(SMS EELSSystemAdministrator ,[everyone,users,SMS EELSSystemAdministrator,SMS EELSReportAnalyst]) -> false>
<SecurityRoleMap> <primary-rule evaluates to NotApplicable because of Condition>
<SecurityRoleMap> <urn:bea:xacml:2.0:entitlement:role:EELSSystemAdministrator:top, 1.0 evaluates to Deny>
<SecurityRoleMap> <XACML RoleMapper: accessing role EELSSystemAdministrator: DENIEDIn my 9.2 Installation that is working I get the following in the logs:
<SecurityRoleMap> <Accessed Subject: Id=urn:oasis:names:tc:xacml:2.0:subject:group, Value=[everyone,users,SMS EELSSystemAdministrator,SMS EELSReportAnalyst]>
<SecurityRoleMap> <Evaluate urn:oasis:names:tc:xacml:1.0:function:string-is-in(SMS EELSSystemAdministrator,[everyone,users,SMS EELSSystemAdministrator,SMS EELSReportAnalyst]) -> true>
<SecurityRoleMap> <Evaluate urn:oasis:names:tc:xacml:1.0:function:or(true) -> true>
<SecurityRoleMap> <primary-rule evaluates to Permit>
<SecurityRoleMap> <urn:bea:xacml:2.0:entitlement:role:EELSSystemAdministrator:type@E@Furl@G@M@Oapplication@EEELSWeb@[email protected]@O$@S@VDSTAMP@S@W@M@OcontextPath@E@UEELS@M@Ouri@E@U, 1.0 evaluates to Permit>
<SecurityRoleMap> <XACML RoleMapper: accessing role EELSSystemAdministrator: GRANTED> I am not sure why my 9.2 deployment lists the role type as a "url" (which points to the right deployment, and 10 lists it as the word "top". Either way, it is not authenticating to my global role based on the Group returned from LDAP.
I'm pretty much out of troubleshooting idea's, having compared every config file/log file etc to find descrepancies in my setup. Anyone have any suggestions, perhaps something that has to be setup differently in 10 then in 9.2?
Thanks in Advance,
John

Update:
I checked a bunch of settings, and it seems to be working now, very odd.

Authorizations: Dynamic roles

Hello everybody,
We are going to migrate our authorizations from 3.x concept to BI-7.
With the new concept we are compelled to respect certain requirements like to include into the single user profile every InfoObject AuthorizationRelevant (that are also built-in into the InfoProvider, indented for the future analysis).
-     Certain users had only one dynamic role. In such a case we are able to restrict for instance:
o     0CO_AREA = a value;
o     every other InfoObject AuthorizationRelevant = * (every single values)
-     Certain users had two or more dynamic roles; in such a case we are supposed to:
o     ROLE 1: 0CO_AREA = a value; every other InfoObject AuthorizationRelevant, for instance 0COMANY_CODE = * (every single values)
o     ROLE 2: 0COMANY_CODE = a value; every other InfoObject AuthorizationRelevant, for instance 0CO_AREA = * (every single values)
In this particular case though we expect that the system will ignore our restrictions because it is adding the two roles in fact:
ROLE 1 is set: 0CO_AREA = a value;
ROLE 2 is set: 0CO_AREA = *.
Base on what we just described above, here they are our questions:
1.     Does exist a symbol (for instance :   >) that we can assigned to every InfoObject AuthorizationRelevant in order to cheat the system making it understand that it is there but not relevant for the authorizations (instead using *)?
2.     If not can you please suggest us another way to cope with the problem of having for a user more dynamic roles assigned.
Thank you very much
Matteo Mariniello

Hello,
I don't have a solution but I think I understood Matteo's goal which is not at all to authorized users to do anything they want to.
He wants to restrict certain tasks but when it comes for a user to have two or more dynamic roles the addition of them make the restriction useless.
As he said
Dynamic Role 1)
0CO_AREA = a value
0COMP_CODE= *
Dynamic Role 2)
0CO_AREA = *
0COMP_CODE= A VALUE
Therefore; the addition of them for ONE user is going to make the restrictions
0CO_AREA = a value
0COMP_CODE= a value
USELESS!!
Take Care
Domenico

BPM user role access

Hi Experts,
Who all can access the BPM process? Is it possible to set the userrole access to the BPM process?
Scenario :
Through webservice, I have to call BPM process..But the BPM process should be accessed by particular user.
For example, Manager related BPM process should not be accessable to the Developers.
How to set/give the BPM user role access?
Regards
Sara

It is not possible, if sender application has an athorization to send the message to XI the process will be instantiated using Receive step.
Thanks
Farooq.

Init function to habilite dynamic roles

Hi
We want user dynamic roles at database level, we are using JAAS for security at application level, we want to habilite the roles in a database procedure in base of jaas username, but we need execute this database procedure before any other action, like an init() function, where can we execute this method ? I tried in the ApplicationModule constructor but it don't function well because I need to use the function getApplicationModule to obtain de JAAS user.
Where can I execute this method ? maybe a function at Application Module level
Thanks in advance
Liceth

Liceth,
With functionality like this you have to always remember that many things (such as Application Module instances en DB connections) are pooled and re-used, so the constructor of an ApplicationModuleImpl is definately NOT the place!
If I understood your problem correctly, it sounds very similar to the problem you would be facing when using Business Components together with the VPD (Virtual Private Database) feature of the Oracle Database. It boils down to you having to execute a PL/SQL procedure every time a database connection is obtained from the database connection pool when an ApplicationModule instance is checked out from the ApplicationModulePool for a particular user/session.
If you search OTN on the combination VPD and BC4J, you will certainly find some very useful documents that will probably help you implement your solution.
Kind regards,
Peter Ebell
JHeadstart Team

Dynamic roles in Agent Assignment

Dear All
I have a requirement of assigning dynamic roles which is stored in container element. When i select the role in the agent assignment of the task all the system roles come in the drop down. How to assign the role stored in the container element in agent assignment.
Thanx in advance

You can use a simple rule that returns the agents having that role FM PRGN_READ_USERS_FOR_ONE_AGR will do the trick.
Or else I think you can just use a role as an expression (haven't done this myself). Just as you would pass in USUSERNAME, prefix it with AG. You may have an issue with data types though if the role name is longer than the standard HR object name, I haven't tried it for this very reason.

Dynamic role Assignment in Portal using Web dynpro Java?

Hi All,
We have following requirement for dynamic role assignment.
1) User Login to Portal.
2) User Clicks on Home Tab in Portal, through RFC/BAPI, get Role from Backend(ECC) and compare the role ID with Portal Object ID through UME.
Role gets assigned in Portal after comparison, if it exists in Portal.
Can you please let me know what all steps I need to do to complete the above assignment.
Thank you
Ravi

Thanks Tobias.
To be precise I will explian my requirement.
1) User Login ( User ID will be input to RFC)
2) RFC will get Role for that user ID from Backend(ECC) and return that role ID to Portal.
3) Now With the help of UME API, need to search role ID in Portal, If it exists, no action.
If Role ID does not exists, then it shuld assign that role in Portal.
Sorry for tedious comment.
I am a bit new to webdyn pro.
Can you please tell me each step i need to follow to complete the above requirement.
Many Thanks,
Ravi

[BPM Dynamic Parametric Role] How to Implement DPR?

Hi Guys,
Here again, can someone provide me a link for sample codes on implementing Dynamic Parametric Roles?
Thanks!

Hi Dan,
Yup I'm talking about Parametric roles in oracle BPM. I need to find a way where in the system can generate parameters without any human intervention. This needs to be done by an external application. So basically what I need is a sample implementation of how it is done in BPM.
Regards,
Mr. Clutch

OBPM 10gR3 Dynamic Role Assignment at user login

Hi,
For all the great integration with LDAP in 10gR3, unfortunately, the system is unable to deal with dynamically-defined LDAP groups.
Our goal is to apply a BPM Role to ALL humans defined in our LDAP.
All humans happen to already be defined by a dynamically-defined LDAP group called 'AllPeople'.
It would have been perfect if we could simply assign our BPM Role, 'Employee', to the LDAP group, 'AllPeople'. Sadly you can't (one for the next release pls).
So as a workaround, what we want to do instead is assign the BPM Role 'Employee' to each individual user dynamically when they first login.
Since the FDI library is useless outside of a BPM context (you'll find that some of the familiar methods of RoleAssignment are missing), We opted to create an actual BPM process to conduct role assignments, and we would then trigger it via PAPI.
The question then was, where/when do we invoke the process such that it does the role assignment quickly and soon enough for the appropriate views and applications to appear in their workspace straight after login?
We opted for a customised implementation of the SSOWorkspaceLoginInterface class.
However, we tried making the invocation in the setupAuthenticatedSession() and the processRequest() methods but, although the role assignment was successfully done in either case, sadly the user's session was loaded without the new changes - perhaps loaded quicker than the role assignment could be fed back through the directory.
Therefore, we dumped the invocation in the actual constuctor - and this seems to work for the most part. Yet on the odd ocassion, the role assignment is not quick enough to be realised in the user's workspace session - the user has to logout and back in before the changes are realised.
We've even tried to get the execution to sleep for a second or two, while the PAPI thread goes about doing the role assignment - again not much success.
So I really have 2 questions:
1. Where during login can we make a PAPI call to do a role assignment so that it should be picked up by the time the session is created? perhaps we already are doing it in the right place.
2. How could we refresh/request a new session cookie without explicitly logging out and back in again? Note, page refresh is not enough.
Thanks for reading.

Sorry for the belated response - I don't get notified of replies.
The code for my custom SSOLoginModule class is:-
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.FileInputStream;
import java.io.IOException;
import java.util.Properties;
import fuego.workspace.security.SSOWorkspaceLoginInterface;
import fuego.papi.Arguments;
import fuego.papi.CommunicationException;
import fuego.papi.InstanceInfo;
import fuego.papi.OperationException;
import fuego.papi.ProcessService;
import fuego.papi.ProcessServiceSession;
import fuego.sso.SSOLoginException;
import fuego.sso.SSOUserLogin;
import fuego.jsfcomponents.Util;
import fuego.workspace.model.common.WorkspaceApplicationBean;
public class CustomSSOWorkspaceLogin extends SSOUserLogin implements SSOWorkspaceLoginInterface {
private ProcessService pService;
private ProcessServiceSession pServiceSession;
private Properties properties;
public SSOWorkspaceDBLogin() {
//Do the role assignment here because it works, and does not work in the ideal location of setupAuthenticatedSession method
pService = createProcessService();
pServiceSession = createProcessServiceSession();
assignDefaultRole(Util.getHttpServletRequest().getRemoteUser());
private ProcessService createProcessService() {
return WorkspaceApplicationBean.getCurrent().getProcessService();
private ProcessServiceSession createProcessServiceSession() {
return pService.createSession("yourdirectoryusername","yourdirectorypassword",null);
//This method is used to remotely invoke a BPM process to do the role assignment - no external API to do this directly!
private void assignDefaultRole(String email) {
try {
String processId = "myRoleAssignmentProcessId";
String argumentName = "argumentName"; //the name of the input argument to feed in the participant
String argumentValue = email;
Arguments arguments = Arguments.create();
arguments.putArgument(argumentName, argumentValue);
InstanceInfo instance = pServiceSession.processCreateInstance(processId, arguments);
Long waitTime = new Long(1000);
Long timeLimit = new Long(5000);
boolean roleAssigned = false;
boolean timeLimitExceeded = false;
Long startTime = System.currentTimeMillis();
//Allow role assignment thread to complete
while (!roleAssigned && !timeLimitExceeded) {
try {
Thread.sleep(waitTime);
if (pServiceSession.processGetInstance(instance.getId()).isCompleted()) {
roleAssigned = true;
if (System.currentTimeMillis() - startTime > timeLimit) {
timeLimitExceeded = true;
} catch (InterruptedException e) {
e.printStackTrace();
//close process service session
pServiceSession.close();
//Do not close the service itself as it is shared with the Workspace itself!
//pService.close();
} catch (Exception e) {
e.printStackTrace();
public void setupAuthenticatedSession(HttpServletRequest httpservletrequest, HttpServletResponse httpservletresponse) throws SSOLoginException {
//Unfortunately, the below does not work here because the role assignment is not fast enough
//The result is that the user logs in but cannot see any applications because the role assignment has not been made in time.
//Therefore, we run the below statements from the constructor - ugly but functions.
//pService = createProcessService();
//pServiceSession = createProcessServiceSession();
//assignDefaultRole(httpservletrequest.getRemoteUser());
public void processRequest(HttpServletRequest httpservletrequest, HttpServletResponse httpservletresponse) throws SSOLoginException {
}

BPM 11g Role Assignment not Reflected on BPM Workspace

Hi,
I'm having trouble with role maping in JDeveloper for my BPM 11g project, where the server groups mapped against a particular applcation role is not reflected in BPM workspace.
I'm mapping application roles with server groups in the Organization section of my BPM project in JDeveloper, but when I open the Administration section of the BPM workspace, I see that the appropriate section is blank where there should be the server group assigned.
I have confirmed that the server groups are in place, and have users associated with them. I even tried ti with the Administrators groups of WebLogic, with the same results.
However, when I deployed this same project on an Oracle On Demand server, the JDeveloper role maapping was successfully deployed along with my process. Could anyone please provide some insight in this matter?
I'm working on JDeveloper and SOA 11.1.1.5
Thanks,
Debojit

HI,
In 11g you have the concept of Global Links. You can refer to http://docs.oracle.com/cd/E23943_01/user.1111/e15175/bpmug_ext_apps.htm#BACCACGI fro example of how this can be acheived
I think there are also some samples on java.net for Oracle BPM Suite however this appears to be down at the time of posting so I can not validate this.
Hope this helps
Regards Dave

BPM swimlanes role

Actually i want all the roles created in oracle bpm swim lanes in a dropdown on a adf form.
so,can anybody help me out as where these roles are actually stored like in any table.
plz provide some help.
Thanks

Hi.
What is the BPM product version (10g or 11g)?

Dynamic role setting in human task

Hi,
I would like to use the human task activity in a BPEL process setting the role that has to complete the activity dynamically.
I mean, inside the human task editor, there is a section named "Assignment and Routing policy" where I add a participant to the task. There, I have two options: By name (which I have already used) or by expression.
I would like to assign the role from a variable of my process. This is, I invoke the business rules engine, and the result is a role. Then, I want to assign the human task to that role. It this possible? How do I do this?
Thanks in advance,
Zaloa

We do the same. We invoke a service from BPEL before the human workflow activity. This service returns a department (that is also present in our OID) based on some instance data. We assign this role to the human task in the task definition like this:
<routingSlip xmlns="http://xmlns.oracle.com/bpel/workflow/routingSlip">
<globalConfiguration>
<expirationDuration duration="/task:task/task:payload/ns0:humanTaskInformation/ns0:expirationDate"
type="XPATH"/>
</globalConfiguration>
<participants isAdhocRoutingSupported="false">
<participant name="Department">
<resource isGroup="true" type="XPATH">/task:task/task:payload/ns0:humanTaskInformation/ns0:department</resource>
</participant>
</participants>
<notification includeTaskAttachments="false" actionable="false"
secureNotifications="false"/>
</routingSlip>
This works.
As Eric already indicated, you should see some error detail in the audit trail when the human workflow activity "falls through".
Regards, Ronald

Application roles and dynamic roles

Hello all,
In my custom workflow, i need to send approvals to some employees. The list of their positions are created in Lookup table. The procedure i am following now is, i am creating appliation roles and adding the names of the people who are in those positions to that role.
In the workflow, i am sending the notification to that role and all the people in that role get the notification.
My question is, how is this different from creating role dynamically?
Which one is preferable?
Thanks
Kumar

Hi,
How often do the users change? If there is a regular turnover of users, then it would be easier to maintain as an adhoc role which is created for each process and the users dynamically added to the role. If there is very little turnover of users in the table, then this is less of a maintenance overhead.
Do the users have an extra responsibility purely to receive the notification? If so, they might not want to see that as an option when they log in, in which case you should consider an adhoc role.
How many instances of the process are likely to be running at the same time? Who should be notified if the list of users changes during the process execution - the old list, or the new list? Depending on the answers, there are pros and cons of building the solution using responsibilities or adhoc roles - only you and your client know the answers, though.
Matt
WorkflowFAQ.com - the ONLY independent resource for Oracle Workflow development
Alpha review chapters from my book "Developing With Oracle Workflow" are available via my website http://www.workflowfaq.com
Have you read the blog at http://www.workflowfaq.com/blog ?
WorkflowFAQ support forum: http://forum.workflowfaq.com

BPM Parametric Role

Dear all,
I try to lookup parametric role from JDev and I get this exception.
effectively the ejb.bpm.services/BPMOrganizationServiceBean context doesn't exists in Foreign JNDI provider list ....
Error during ejb lookup from bpm services client.
Error during lookup of remote ejb BPMOrganizationService .
Contact Oracle support if exception can not be fixed.
Caused by: javax.naming.NameNotFoundException: While trying to lookup 'ejb.bpm.services/BPMOrganizationServiceBean' didn't find subcontext 'bpm'. Resolved 'ejb' [Root exception is javax.naming.NameNotFoundException: While trying to lookup 'ejb.bpm.services/BPMOrganizationServiceBean' didn't find subcontext 'bpm'. Resolved 'ejb']; remaining name 'bpm/services/BPMOrganizationServiceBean'
     at weblogic.rjvm.ResponseImpl.unmarshalReturn(ResponseImpl.java:234)
     at weblogic.rmi.cluster.ClusterableRemoteRef.invoke(ClusterableRemoteRef.java:348)
     at weblogic.rmi.cluster.ClusterableRemoteRef.invoke(ClusterableRemoteRef.java:259)
     at weblogic.jndi.internal.ServerNamingNode_1035_WLStub.lookup(Unknown Source)
     at weblogic.jndi.internal.WLContextImpl.lookup(WLContextImpl.java:423)
     at weblogic.jndi.internal.WLContextImpl.lookup(WLContextImpl.java:411)
     at javax.naming.InitialContext.lookup(InitialContext.java:392)
     at oracle.bpm.client.impl.BPMServiceRemoteClient.getBPMOrganizationService(BPMServiceRemoteClient.java:190)
     at oracle.tip.tools.ide.workflow.editor.controls.lpg.LPGLookup.fetchLPG(LPGLookup.java:200)
     at oracle.tip.tools.ide.workflow.editor.controls.lpg.LPGDetailPanel.searchLPG(LPGDetailPanel.java:160)
     at oracle.tip.tools.ide.workflow.editor.controls.lpg.LPGDetailPanel._populateApprovalGroups(LPGDetailPanel.java:234)
     at oracle.tip.tools.ide.workflow.editor.controls.lpg.LPGDetailPanel.access$100(LPGDetailPanel.java:36)
     at oracle.tip.tools.ide.workflow.editor.controls.lpg.LPGDetailPanel$2.run(LPGDetailPanel.java:214)
     at java.lang.Thread.run(Thread.java:662)
Caused by: javax.naming.NameNotFoundException: While trying to lookup 'ejb.bpm.services/BPMOrganizationServiceBean' didn't find subcontext 'bpm'. Resolved 'ejb'
     at weblogic.jndi.internal.BasicNamingNode.newNameNotFoundException(BasicNamingNode.java:1139)
     at weblogic.jndi.internal.BasicNamingNode.lookupHere(BasicNamingNode.java:247)
     at weblogic.jndi.internal.ServerNamingNode.lookupHere(ServerNamingNode.java:182)
     at weblogic.jndi.internal.BasicNamingNode.lookup(BasicNamingNode.java:206)
     at weblogic.jndi.internal.BasicNamingNode.lookup(BasicNamingNode.java:214)
     at weblogic.jndi.internal.RootNamingNode_WLSkel.invoke(Unknown Source)
     at weblogic.rmi.internal.BasicServerRef.invoke(BasicServerRef.java:667)
     at weblogic.rmi.cluster.ClusterableServerRef.invoke(ClusterableServerRef.java:230)
     at weblogic.rmi.internal.BasicServerRef$1.run(BasicServerRef.java:522)
     at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:363)
     at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:146)
     at weblogic.rmi.internal.BasicServerRef.handleRequest(BasicServerRef.java:518)
     at weblogic.rmi.internal.wls.WLSExecuteRequest.run(WLSExecuteRequest.java:118)
     at weblogic.work.ExecuteThread.execute(ExecuteThread.java:256)
     at weblogic.work.ExecuteThread.run(ExecuteThread.java:221)
Dec 12, 2012 10:10:53 AM oracle.bpm.services.instanceManagement
SEVERE: Exception
BPM-70203

oups ....
Fixed server was shut down

BPM Dynamic Roles

Similar Messages

Maybe you are looking for