In Cockpit, adminGroups users cannot see process instances that belong to a tenant

[yanavasileva]

Environment (Required on creation)

Any setup, 7.10+

Description (Required on creation; please attach any relevant screenshots, stacktraces, log files, etc. to the ticket)

adminGroups users do not have permission to see process instances that belong to a tenant. Only camunda-admin users can access all tenants.

Steps to reproduce (Required on creation)

1. Add MyAdminGroup to adminGroups via process engine configuration
2. Create CamundaAdmin, member of camunda-admin group, MyAdmin member of MyAdminGroup group.
3. Start process instance 1 that belongs to tenant1, Process-instance-2 is belongs to tenant2.
4. Login in Cockpit with MyAdmin and navigate to the process definition where the above process instances belong.

Observed Behavior (Required on creation)

MyAdmin cannot see process instance 1 and process instance 2. CamundaAdmin can see them.

Expected behavior (Required on creation)

MyAdmin can access the process instances that belong to a tenant.

Root Cause (Required on prioritization)

In webapps, tenant check is excluded only for camunda-admin users and does not consider adminGroups - code

Solution Ideas

• Make consistent the #isCamundaAdmin checks in process engine and webapps to include the adminGroups

Hints

• adjust the docs according to the changes - https://docs.camunda.org/manual/latest/user-guide/process-engine/multi-tenancy/#access-all-tenants-as-administrator

Links

• is related to https://jira.camunda.com/browse/SUPPORT-15321

Breakdown

• [x] #3077
• [x] camunda/camunda-bpm-platform-maintenance#922
• [x] camunda/camunda-bpm-platform-maintenance#923
• [x] camunda/camunda-bpm-platform-maintenance#924
• [x] #3079

Dev2QA handover

• [ ] Does this ticket need a QA test and the testing goals are not clear from the description? Add a Dev2QA handover comment

[ThorbenLindhauer]

The same problem exists with the adminUsers property of the engine configuration and should be fixed with this ticket, too.

[tasso94]

@mboskamp, can you please review this? We want to include the patches on Monday, so we should probably get it through / have it merged in the next two days.

[mboskamp]

I will start with the review today. If I can not finish it today it's first on my list for tomorrow. 👍

[tasso94]

Thank you!