Examples with RoleSelectionSpecification com.evolveum.midpoint.model.api.RoleSelectionSpecification used on opensource projects

Example 6 with RoleSelectionSpecification

use of com.evolveum.midpoint.model.api.RoleSelectionSpecification in project midpoint by Evolveum.

the class TestSecurityBasic method test272AutzJackAssignAnyRoles.

@Test
public void test272AutzJackAssignAnyRoles() throws Exception {
    final String TEST_NAME = "test272AutzJackAssignAnyRoles";
    TestUtil.displayTestTile(this, TEST_NAME);
    // GIVEN
    cleanupAutzTest(USER_JACK_OID);
    assignRole(USER_JACK_OID, ROLE_ASSIGN_ANY_ROLES_OID);
    assumeAssignmentPolicy(AssignmentPolicyEnforcementType.RELATIVE);
    login(USER_JACK_USERNAME);
    // WHEN
    TestUtil.displayWhen(TEST_NAME);
    assertReadAllow(NUMBER_OF_ALL_USERS + 1);
    assertAddDeny();
    assertModifyDeny();
    assertDeleteDeny();
    PrismObject<UserType> user = getUser(USER_JACK_OID);
    assertAssignments(user, 2);
    assertAssignedRole(user, ROLE_ASSIGN_ANY_ROLES_OID);
    assertAllow("assign application role to jack", (task, result) -> assignRole(USER_JACK_OID, ROLE_APPLICATION_1_OID, task, result));
    user = getUser(USER_JACK_OID);
    assertAssignments(user, 3);
    assertAssignedRole(user, ROLE_APPLICATION_1_OID);
    assertAllow("assign business role to jack", (task, result) -> assignRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, task, result));
    assertAllow("unassign application role from jack", (task, result) -> unassignRole(USER_JACK_OID, ROLE_APPLICATION_1_OID, task, result));
    user = getUser(USER_JACK_OID);
    assertAssignments(user, 3);
    RoleSelectionSpecification spec = getAssignableRoleSpecification(getUser(USER_JACK_OID));
    assertRoleTypes(spec);
    assertFilter(spec.getFilter(), TypeFilter.class);
    assertAllowRequestItems(USER_JACK_OID, ROLE_APPLICATION_1_OID, AuthorizationDecisionType.ALLOW);
    assertGlobalStateUntouched();
}

Example 7 with RoleSelectionSpecification

use of com.evolveum.midpoint.model.api.RoleSelectionSpecification in project midpoint by Evolveum.

the class TestSecurityBasic method test274AutzJackAssignNonApplicationRoles.

@Test
public void test274AutzJackAssignNonApplicationRoles() throws Exception {
    final String TEST_NAME = "test274AutzJackAssignNonApplicationRoles";
    TestUtil.displayTestTile(this, TEST_NAME);
    // GIVEN
    cleanupAutzTest(USER_JACK_OID);
    assignRole(USER_JACK_OID, ROLE_ASSIGN_NON_APPLICATION_ROLES_OID);
    assumeAssignmentPolicy(AssignmentPolicyEnforcementType.RELATIVE);
    login(USER_JACK_USERNAME);
    // WHEN
    TestUtil.displayWhen(TEST_NAME);
    assertReadAllow(NUMBER_OF_ALL_USERS + 1);
    assertAddDeny();
    assertModifyDeny();
    assertDeleteDeny();
    PrismObject<UserType> user = getUser(USER_JACK_OID);
    assertAssignments(user, 2);
    assertAssignedRole(user, ROLE_ASSIGN_NON_APPLICATION_ROLES_OID);
    assertAllow("assign business role to jack", (task, result) -> assignRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, task, result));
    user = getUser(USER_JACK_OID);
    assertAssignments(user, 3);
    assertAssignedRole(user, ROLE_BUSINESS_1_OID);
    assertDeny("assign application role to jack", (task, result) -> assignRole(USER_JACK_OID, ROLE_APPLICATION_1_OID, task, result));
    assertAllow("unassign business role from jack", (task, result) -> unassignRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, task, result));
    user = getUser(USER_JACK_OID);
    assertAssignments(user, 2);
    RoleSelectionSpecification spec = getAssignableRoleSpecification(getUser(USER_JACK_OID));
    assertRoleTypes(spec);
    assertFilter(spec.getFilter(), TypeFilter.class);
    assertGlobalStateUntouched();
}

Example 8 with RoleSelectionSpecification

use of com.evolveum.midpoint.model.api.RoleSelectionSpecification in project midpoint by Evolveum.

the class TestSecurityBasic method test278AutzJackAssignRequestableRolesWithOrgRefTweakedDelta.

/**
	 * MID-3136
	 */
@Test
public void test278AutzJackAssignRequestableRolesWithOrgRefTweakedDelta() throws Exception {
    final String TEST_NAME = "test278AutzJackAssignRequestableRolesWithOrgRefTweakedDelta";
    TestUtil.displayTestTile(this, TEST_NAME);
    // GIVEN
    cleanupAutzTest(USER_JACK_OID);
    assignRole(USER_JACK_OID, ROLE_ASSIGN_REQUESTABLE_ROLES_OID);
    assumeAssignmentPolicy(AssignmentPolicyEnforcementType.RELATIVE);
    login(USER_JACK_USERNAME);
    // WHEN
    TestUtil.displayWhen(TEST_NAME);
    assertReadAllow(NUMBER_OF_ALL_USERS + 1);
    assertAddDeny();
    assertModifyDeny();
    assertDeleteDeny();
    PrismObject<UserType> user = getUser(USER_JACK_OID);
    assertAssignments(user, 2);
    assertAssignedRole(user, ROLE_ASSIGN_REQUESTABLE_ROLES_OID);
    assertAllow("assign business role to jack", (task, result) -> assignPrametricRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, ORG_MINISTRY_OF_RUM_OID, null, task, result));
    user = getUser(USER_JACK_OID);
    assertAssignments(user, 3);
    assertAssignedRole(user, ROLE_BUSINESS_1_OID);
    assertDeny("assign application role to jack", (task, result) -> {
        Collection<ItemDelta<?, ?>> modifications = new ArrayList<>();
        ContainerDelta<AssignmentType> assignmentDelta1 = ContainerDelta.createDelta(UserType.F_ASSIGNMENT, getUserDefinition());
        PrismContainerValue<AssignmentType> cval = new PrismContainerValue<AssignmentType>(prismContext);
        assignmentDelta1.addValueToAdd(cval);
        PrismReference targetRef = cval.findOrCreateReference(AssignmentType.F_TARGET_REF);
        targetRef.getValue().setOid(ROLE_BUSINESS_2_OID);
        targetRef.getValue().setTargetType(RoleType.COMPLEX_TYPE);
        targetRef.getValue().setRelation(null);
        cval.setId(123L);
        ContainerDelta<AssignmentType> assignmentDelta = assignmentDelta1;
        modifications.add(assignmentDelta);
        ObjectDelta<UserType> userDelta1 = ObjectDelta.createModifyDelta(USER_JACK_OID, modifications, UserType.class, prismContext);
        ObjectDelta<UserType> userDelta = userDelta1;
        Collection<ObjectDelta<? extends ObjectType>> deltas = MiscSchemaUtil.createCollection(userDelta);
        modelService.executeChanges(deltas, null, task, result);
    });
    assertAllow("unassign business role from jack", (task, result) -> unassignPrametricRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, ORG_MINISTRY_OF_RUM_OID, null, task, result));
    user = getUser(USER_JACK_OID);
    display("user after (expected 2 assignments)", user);
    assertAssignments(user, 2);
    RoleSelectionSpecification spec = getAssignableRoleSpecification(getUser(USER_JACK_OID));
    assertRoleTypes(spec);
    assertFilter(spec.getFilter(), TypeFilter.class);
    assertGlobalStateUntouched();
}

Example 9 with RoleSelectionSpecification

use of com.evolveum.midpoint.model.api.RoleSelectionSpecification in project midpoint by Evolveum.

the class TestSecurityBasic method test290AutzJackRoleOwnerAssign.

@Test
public void test290AutzJackRoleOwnerAssign() throws Exception {
    final String TEST_NAME = "test290AutzJackRoleOwnerAssign";
    TestUtil.displayTestTile(this, TEST_NAME);
    // GIVEN
    cleanupAutzTest(USER_JACK_OID);
    assignRole(USER_JACK_OID, ROLE_ROLE_OWNER_ASSIGN_OID);
    assumeAssignmentPolicy(AssignmentPolicyEnforcementType.RELATIVE);
    login(USER_JACK_USERNAME);
    // WHEN
    TestUtil.displayWhen(TEST_NAME);
    assertReadAllow(NUMBER_OF_ALL_USERS + 1);
    assertAddDeny();
    assertModifyDeny();
    assertDeleteDeny();
    PrismObject<UserType> user = getUser(USER_JACK_OID);
    assertAssignments(user, 2);
    assertAssignedRole(user, ROLE_ROLE_OWNER_ASSIGN_OID);
    assertAllow("assign application role 1 to jack", (task, result) -> assignRole(USER_JACK_OID, ROLE_APPLICATION_1_OID, task, result));
    user = getUser(USER_JACK_OID);
    assertAssignments(user, 3);
    assertAssignedRole(user, ROLE_APPLICATION_1_OID);
    assertDeny("assign application role 2 to jack", new Attempt() {

        @Override
        public void run(Task task, OperationResult result) throws Exception {
            assignRole(USER_JACK_OID, ROLE_APPLICATION_2_OID, task, result);
        }
    });
    assertAllow("unassign application role 1 from jack", (task, result) -> unassignRole(USER_JACK_OID, ROLE_APPLICATION_1_OID, task, result));
    user = getUser(USER_JACK_OID);
    assertAssignments(user, 2);
    RoleSelectionSpecification spec = getAssignableRoleSpecification(getUser(USER_JACK_OID));
    assertRoleTypes(spec);
    assertFilter(spec.getFilter(), TypeFilter.class);
    assertEquals("Wrong type filter type", RoleType.COMPLEX_TYPE, ((TypeFilter) spec.getFilter()).getType());
    ObjectFilter subfilter = ((TypeFilter) spec.getFilter()).getFilter();
    assertFilter(subfilter, RefFilter.class);
    assertEquals(1, ((RefFilter) subfilter).getValues().size());
    assertEquals("Wrong OID in ref filter", USER_JACK_OID, ((RefFilter) subfilter).getValues().get(0).getOid());
    assertGlobalStateUntouched();
}

Example 10 with RoleSelectionSpecification

use of com.evolveum.midpoint.model.api.RoleSelectionSpecification in project midpoint by Evolveum.

the class TestSecurityBasic method test277AutzJackAssignRequestableRolesWithOrgRefSecondTime.

/**
	 * Assign a role with parameter while the user already has the same role without a parameter.
	 * It seems that in this case the deltas are processed in a slightly different way.
	 * MID-3136
	 */
@Test
public void test277AutzJackAssignRequestableRolesWithOrgRefSecondTime() throws Exception {
    final String TEST_NAME = "test277AutzJackAssignRequestableRolesWithOrgRefSecondTime";
    TestUtil.displayTestTile(this, TEST_NAME);
    // GIVEN
    cleanupAutzTest(USER_JACK_OID);
    assignRole(USER_JACK_OID, ROLE_ASSIGN_REQUESTABLE_ROLES_OID);
    assumeAssignmentPolicy(AssignmentPolicyEnforcementType.RELATIVE);
    login(USER_JACK_USERNAME);
    // WHEN
    TestUtil.displayWhen(TEST_NAME);
    assertReadAllow(NUMBER_OF_ALL_USERS + 1);
    assertAddDeny();
    assertModifyDeny();
    assertDeleteDeny();
    PrismObject<UserType> user = getUser(USER_JACK_OID);
    assertAssignments(user, 2);
    assertAssignedRole(user, ROLE_ASSIGN_REQUESTABLE_ROLES_OID);
    assertAllow("assign business role to jack (no param)", (task, result) -> assignPrametricRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, null, null, task, result));
    user = getUser(USER_JACK_OID);
    assertAssignments(user, 3);
    assertAssignedRole(user, ROLE_BUSINESS_1_OID);
    assertAllow("assign business role to jack (org MoR)", (task, result) -> assignPrametricRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, ORG_MINISTRY_OF_RUM_OID, null, task, result));
    user = getUser(USER_JACK_OID);
    assertAssignments(user, 4);
    display("user after (expected 4 assignments)", user);
    assertAssignedRole(user, ROLE_BUSINESS_1_OID);
    assertAllow("assign business role to jack (org Scumm)", (task, result) -> assignPrametricRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, ORG_SCUMM_BAR_OID, null, task, result));
    user = getUser(USER_JACK_OID);
    assertAssignments(user, 5);
    display("user after (expected 5 assignments)", user);
    assertAssignedRole(user, ROLE_BUSINESS_1_OID);
    assertAllow("unassign business role from jack (org Scumm)", (task, result) -> unassignPrametricRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, ORG_SCUMM_BAR_OID, null, task, result));
    user = getUser(USER_JACK_OID);
    assertAssignments(user, 4);
    display("user after (expected 4 assignments)", user);
    assertAssignedRole(user, ROLE_BUSINESS_1_OID);
    assertDeny("assign application role to jack", (task, result) -> assignRole(USER_JACK_OID, ROLE_BUSINESS_2_OID, task, result));
    assertAllow("unassign business role from jack (no param)", (task, result) -> unassignPrametricRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, null, null, task, result));
    user = getUser(USER_JACK_OID);
    display("user after (expected 3 assignments)", user);
    assertAssignments(user, 3);
    assertAllow("unassign business role from jack (org MoR)", (task, result) -> unassignPrametricRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, ORG_MINISTRY_OF_RUM_OID, null, task, result));
    user = getUser(USER_JACK_OID);
    display("user after (expected 2 assignments)", user);
    assertAssignments(user, 2);
    RoleSelectionSpecification spec = getAssignableRoleSpecification(getUser(USER_JACK_OID));
    assertRoleTypes(spec);
    assertFilter(spec.getFilter(), TypeFilter.class);
    assertGlobalStateUntouched();
}