Uploaded image for project: 'Service Packs and Hot Fixes'
  1. Service Packs and Hot Fixes
  2. MNT-20155

Admin user cannot use enterprise REST API endpoint to cancel/delete process instances started by other users

    Details

    • Bug Priority:
      Category 2
    • ACT Numbers:

      00981326

      Description

      Summary
      We have an enterprise REST API endpoint to cancel/delete a process instance, see also http://docs.alfresco.com/process-services1.9/topics/delete_a_process_instance.html. It seems that this endpoint can only be used successfully by the related process initiator, but is not behaving correct while executing as admin user, who should always be able to cancel/delete a process instance.

      Steps to reproduce
      1. Login to activiti-app as any user other than the inbuilt admin user
      2. Start any process instance and determine the process instance ID (e.g. via activit-admin)
      3. Via REST client (e.g. Postman) or api-explorer execute the following API call as admin:

      DELETE http://server:port/activiti-app/api/enterprise/process-instances/<processInstanceId>

      4. Inspect the response

      Expected behaviour
      The API replies with an code in the 200 region and the process instance for the passed process instance ID was cancelled or deleted.

      Current behaviour
      As the admin user is not the initiator of the process, the response is like the following:

      {
      "message": "Process with id: 762541 does not exist or is not started by this user",
      "messageKey": "GENERAL.ERROR.NOT-FOUND"
      } 
      

      This is incorrect behaviour as an admin user should always be able to cancel/delete a process instance.

      Supporting evidence

      • Reproduced with current latest APS 1.9.0.3 version
      • Workaround: Deleting or cancelling a process instance works fine with activiti-admin, which uses an engine API call, e.g.
        DELETE http://server:port/activiti-app/api/runtime/process-instances/762541

        Attachments

          Structure

            Activity

              People

              • Assignee:
                djohnson Doug Johnson
                Reporter:
                dkoch Dennis Koch
              • Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                Dates

                • Created:
                  Updated:

                  Structure Helper Panel