< class="prominent-subhead ">

Task assigned to destination user with wrong security label

This article was created in response to a support issue logged with K2. The content may include typographical errors and may be revised at any time without notice. This article is not considered official documentation for K2 software and is provided "as is" with no warranties.
This article has been archived, and/or refers to legacy products, components or features. The content in this article is offered "as is" and will no longer be updated. Archived content is provided for reference purposes only. This content does not infer that the product, component or feature is supported, or that the product, component or feature will continue to function as described herein.


A workflows' client event is set to assign a task to a user on a custom security label, but when a process instance is started, the task gets assigned to a user with the same username, but on the default K2 security label.

For example, the correct destination user should be CustomLabel:USER1. But when the process instance starts running, the report shows that the client event task gets assigned to K2:DOMAIN\USER1 instead.


  • The K2 environment has other custom security labels configured.
  • The client events' destination user is being assigned dynamically, such as using a SmartObject to retrieve the destination users' username. 
  • This issue will not occur if the destination user is set by dragging the user from the context browser. 
  • This issue will not occur if the destination user is set by typing the users' FQN (eg. CustomLabel:USER1)

Troubleshooting Steps

  1. If you are dynamically assigning the destination user by retrieving the destination user from a SmartObject, please test the SmartObject to make sure it is returning the correct user.

  2. Make sure the destination user above can be resolved. Test this by doing the following: 

    1. Open SmartObjects Service Tester
    2. Expand SmartObject Explorer > All SmartObjects
    3. Select 'UMUser', and execute it
    4. Select the 'Get User Details', enter the destination user's FQN (eg. CustomLabel:USER1, K2:DENALLIX\Bob), and execute the method
    5. If the destination user can be resolved, you should see the details of the user being shown

3. If the correct user is being returned, make sure your worflows' client event is using the correct SmartObject property in the destination user. 

When assigning a destination user, make sure the SmartObject property mapped returns a FQN of the user (eg. CustomLabel:USER1), and not just the username (eg. USER1). If you are only using the username without specifying the security label in the destination user, K2 will try to resolve that username using the default security label, which is 'K2'.

Therefore, if your SmartObject does not return a property that contains the user's FQN, please update your data source accordingly so that the SmartObject will return the FQN.