Thanks for your help. Actually I tried to run the sample demo program - the evaluation one.
There are 2 screens that are displayed :
When you type http://localhost:8080/jbpm-console you get a login screen
When you login as "krisv" then go to tasks and select the task that you want to view then there is another login.
This is the actual BPM Console snapshot. This login is requested only once. When the second user say "john" or
"mary" logs in and they want to view the tasks it does ask for the second login.
The reason is cookies store the login information and they are valid for the entire session. So when user "john" logs in
the system does not ask him to authenticate because of the cookies. So even though it is john who is approving
it remembers from the cookies that it is krisv. So even though it is john who has logged into the JBPM console
it remembers "krisv" from the BPM console login. This is what I think is the issue.
When I tried deleting the cookies after the logout of "krisv" and then logged in as "john" it asked for the second login
(BPM Console Login) and it worked fine.
Thanks for your help.