From ec343a2081b019c08dcac90a97f472b74579b63c Mon Sep 17 00:00:00 2001
From: Radovan Semancik <radovan.semancik@evolveum.com>
Date: Mon, 13 Mar 2017 19:37:40 +0100
Subject: [PATCH] Permission to read workflow status of tasks

---
 .../resources/initial-objects/040-role-enduser.xml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/gui/admin-gui/src/main/resources/initial-objects/040-role-enduser.xml b/gui/admin-gui/src/main/resources/initial-objects/040-role-enduser.xml
index 74751a64b26..7eebc299b9a 100644
--- a/gui/admin-gui/src/main/resources/initial-objects/040-role-enduser.xml
+++ b/gui/admin-gui/src/main/resources/initial-objects/040-role-enduser.xml
@@ -160,5 +160,19 @@
             <type>ServiceType</type>
         </object>
     </authorization>
+    <authorization>
+    	<name>assignment-target-read-task</name>
+    	<description>
+    		Authorization that allows to read workflow status of tasks. This is used to display requests
+    		to the end users, especially in the "My Requests" box in user dashboard.
+    		This authorization is a temporary solution. It will be replaced by a finer-grained
+    		permissions in the future.
+    	</description>
+        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
+        <object>
+            <type>TaskType</type>
+        </object>
+        <item>workflowContext</item>
+    </authorization>
     <roleType>system</roleType>
 </role>
\ No newline at end of file