Examples with RoleSelectionSpecification com.evolveum.midpoint.model.api.RoleSelectionSpecification used on opensource projects

Example 11 with RoleSelectionSpecification

use of com.evolveum.midpoint.model.api.RoleSelectionSpecification in project midpoint by Evolveum.

the class AbstractSecurityTest method assertNoAccess.

protected void assertNoAccess(PrismObject<UserType> userJack) throws Exception {
    assertReadDeny();
    assertAddDeny();
    assertModifyDeny();
    assertDeleteDeny();
    assertReadCertCasesDeny();
    RoleSelectionSpecification roleSpec = getAssignableRoleSpecification(userJack);
    assertNotNull("Null role spec " + roleSpec, roleSpec);
    assertRoleTypes(roleSpec);
    assertFilter(roleSpec.getFilter(), NoneFilter.class);
    assertAuditReadDeny();
}

Example 12 with RoleSelectionSpecification

use of com.evolveum.midpoint.model.api.RoleSelectionSpecification in project midpoint by Evolveum.

the class AbstractSecurityTest method assertSuperuserAccess.

protected void assertSuperuserAccess(int readUserNum) throws Exception {
    assertReadAllow(readUserNum);
    assertAddAllow();
    assertModifyAllow();
    assertDeleteAllow();
    // 2 campaigns there
    assertSearch(AccessCertificationCampaignType.class, null, 2);
    assertReadCertCasesAllow();
    assertSearch(TaskType.class, null, 2);
    RoleSelectionSpecification roleSpec = getAssignableRoleSpecification(getUser(USER_JACK_OID));
    assertNotNull("Null role spec " + roleSpec, roleSpec);
    assertNull("Non-null role types in spec " + roleSpec, roleSpec.getRoleTypes());
    assertFilter(roleSpec.getFilter(), null);
    assertAuditReadAllow();
}

Example 13 with RoleSelectionSpecification

use of com.evolveum.midpoint.model.api.RoleSelectionSpecification in project midpoint by Evolveum.

the class TestSecurityBasic method test270AutzJackAssignApplicationRoles.

@Test
public void test270AutzJackAssignApplicationRoles() throws Exception {
    final String TEST_NAME = "test270AutzJackAssignApplicationRoles";
    TestUtil.displayTestTile(this, TEST_NAME);
    // GIVEN
    cleanupAutzTest(USER_JACK_OID);
    assignRole(USER_JACK_OID, ROLE_ASSIGN_APPLICATION_ROLES_OID);
    assumeAssignmentPolicy(AssignmentPolicyEnforcementType.RELATIVE);
    login(USER_JACK_USERNAME);
    // WHEN
    TestUtil.displayWhen(TEST_NAME);
    assertReadAllow(NUMBER_OF_ALL_USERS + 1);
    assertAddDeny();
    assertModifyDeny();
    assertDeleteDeny();
    PrismObject<UserType> user = getUser(USER_JACK_OID);
    assertAssignments(user, 2);
    assertAssignedRole(user, ROLE_ASSIGN_APPLICATION_ROLES_OID);
    assertAllow("assign application role to jack", (task, result) -> assignRole(USER_JACK_OID, ROLE_APPLICATION_1_OID, task, result));
    user = getUser(USER_JACK_OID);
    assertAssignments(user, 3);
    assertAssignedRole(user, ROLE_APPLICATION_1_OID);
    assertDeny("assign business role to jack", (task, result) -> assignRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, task, result));
    assertAllow("unassign application role from jack", (task, result) -> unassignRole(USER_JACK_OID, ROLE_APPLICATION_1_OID, task, result));
    user = getUser(USER_JACK_OID);
    assertAssignments(user, 2);
    RoleSelectionSpecification spec = getAssignableRoleSpecification(getUser(USER_JACK_OID));
    assertRoleTypes(spec, "application", "nonexistent");
    assertFilter(spec.getFilter(), TypeFilter.class);
    assertAllowRequestItems(USER_JACK_OID, ROLE_APPLICATION_1_OID, null, AssignmentType.F_TARGET_REF, ActivationType.F_VALID_FROM, ActivationType.F_VALID_TO);
    assertGlobalStateUntouched();
}

Example 14 with RoleSelectionSpecification

use of com.evolveum.midpoint.model.api.RoleSelectionSpecification in project midpoint by Evolveum.

the class TestSecurityBasic method test295AutzJackAssignOrgRelation.

@Test
public void test295AutzJackAssignOrgRelation() throws Exception {
    final String TEST_NAME = "test295AutzJackAssignOrgRelation";
    TestUtil.displayTestTile(this, TEST_NAME);
    // GIVEN
    cleanupAutzTest(USER_JACK_OID);
    assignRole(USER_JACK_OID, ROLE_ASSIGN_ORGRELATION_OID);
    assignOrg(USER_JACK_OID, ORG_MINISTRY_OF_RUM_OID, null);
    login(USER_JACK_USERNAME);
    // WHEN
    TestUtil.displayWhen(TEST_NAME);
    RoleSelectionSpecification specJack = getAssignableRoleSpecification(getUser(USER_JACK_OID));
    display("Spec (jack)", specJack);
    assertRoleTypes(specJack);
    Task task = taskManager.createTaskInstance();
    SearchResultList<PrismObject<AbstractRoleType>> assignableRolesJack = modelService.searchObjects(AbstractRoleType.class, ObjectQuery.createObjectQuery(specJack.getFilter()), null, task, task.getResult());
    display("Assignable roles", assignableRolesJack);
    assertObjectOids("Wrong assignable roles (jack)", assignableRolesJack, ROLE_BUSINESS_3_OID);
    RoleSelectionSpecification specRum = getAssignableRoleSpecification(getUser(userRumRogersOid));
    display("Spec (rum)", specRum);
    assertRoleTypes(specRum);
    SearchResultList<PrismObject<AbstractRoleType>> assignableRolesRum = modelService.searchObjects(AbstractRoleType.class, ObjectQuery.createObjectQuery(specRum.getFilter()), null, task, task.getResult());
    display("Assignable roles", assignableRolesRum);
    assertObjectOids("Wrong assignable roles (rum)", assignableRolesRum, ROLE_BUSINESS_3_OID);
    assertGlobalStateUntouched();
}

Example 15 with RoleSelectionSpecification

use of com.evolveum.midpoint.model.api.RoleSelectionSpecification in project midpoint by Evolveum.

the class TestSecurityBasic method test275bAutzJackAssignRequestableOrgs.

/**
	 * MID-3636 partially
	 */
@Test(enabled = false)
public void test275bAutzJackAssignRequestableOrgs() throws Exception {
    final String TEST_NAME = "test275bAutzJackAssignRequestableOrgs";
    TestUtil.displayTestTile(this, TEST_NAME);
    // GIVEN
    cleanupAutzTest(USER_JACK_OID);
    assignRole(USER_JACK_OID, ROLE_END_USER_REQUESTABLE_ABSTACTROLES_OID);
    assumeAssignmentPolicy(AssignmentPolicyEnforcementType.RELATIVE);
    login(USER_JACK_USERNAME);
    // WHEN
    TestUtil.displayWhen(TEST_NAME);
    PrismObject<UserType> user = getUser(USER_JACK_OID);
    assertAssignments(user, 2);
    assertAssignedRole(user, ROLE_END_USER_REQUESTABLE_ABSTACTROLES_OID);
    assertAllow("assign requestable org to jack", (task, result) -> assignOrg(USER_JACK_OID, ORG_REQUESTABLE_OID, task, result));
    user = getUser(USER_JACK_OID);
    assertAssignments(user, OrgType.class, 1);
    RoleSelectionSpecification spec = getAssignableRoleSpecification(getUser(USER_JACK_OID));
    assertRoleTypes(spec);
    ObjectQuery query = new ObjectQuery();
    query.addFilter(spec.getFilter());
    // set to 6 with requestable org
    assertSearch(AbstractRoleType.class, query, 6);
    assertAllow("unassign business role from jack", (task, result) -> unassignOrg(USER_JACK_OID, ORG_REQUESTABLE_OID, task, result));
    user = getUser(USER_JACK_OID);
    assertAssignments(user, OrgType.class, 0);
    assertGlobalStateUntouched();
}