I want to another important piece of information that I had missed out earlier. When the user krisv logs in to the console he is able
to see the task in the panel. When he clicks on view there is further authentication before the form is displayed. He has already logged
in and he is the potential owner of the task. I don't know whey he is required to authenticate again to view the form.
Interestingly the actor for the second human task john when he logs in he is able to view the form without further authentication.
Also the users and groups are defined in the task-service directory which the task server reads. But I was not able to trace the
assignment between users and groups namely to which groups each user belongs. Also in the auth folder under the jbpm-installer
there is a file which defines roles. Where is this information used ?
I am thinking that the second authentication information by krisv is remembered and even though it is john who is approving the
second human task it is remembering the previous authentication.