JR55960: AUTHORIZATION ON COMPLETE AND FINISH TASK REST APIS DOES NOT MATCH DOCUMENTED BEHAVIOR

bpm.8570.cf2016.09.delta.repository.1of2
bpm.8570.cf2016.09.delta.repository.2of2
Downloading IBM Business Process Manager V8.5.7 Cumulative Fix 2016.09

APAR status

• Closed as program error.

Error description

• The documentation states that the potential task owner, task
  collaborator, task team manager authorization roles cannot
  complete or finish a task.
  However, the implementation deviates from this specification.
  

Local fix

Problem summary

• No additional information is available.
  
  PRODUCTS AFFECTED
  IBM Business Process Manager (BPM) Advanced
  IBM BPM Standard
  IBM BPM Express
  

Problem conclusion

• A fix will be included in IBM BPM V8.5.7 cumulative fix 2016.09
  that excludes task collaborators, potential task owners, and
  task team managers from being authorized to complete and finish
  tasks.
  
  The following roles remain authorized to complete and finish
  tasks:
  
  - IBM BPM administrators
  - Process application administrators (IBM Process
    Portal administrator team)
  - Instance owners team
  - Task owner
  
  These roles are described in "REST API authorization for task
  actions"
  (https://www.ibm.com/support/knowledgecenter/SSFPJS_8.5.7/com.ib
  m.wbpm.bpc.doc/topics/rrestapi_authtasks.html).
  
  To re-create the earlier authorization behavior, add the
  following setting to your 100Custom.xml file:
  
  <server merge="mergeChildren">
   <portal merge="mergeChildren">
    <authorization-level-for-task-complete-and-finish
  merge="replace">8560</authorization-level-for-task-complete-and-
  finish>
   </portal>
  </server>
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  BPM STANDARD

• Fixed component ID

  5725C9500

Applicable component levels