Examples with LensContext com.evolveum.midpoint.model.impl.lens.LensContext used on opensource projects

Example 1 with LensContext

use of com.evolveum.midpoint.model.impl.lens.LensContext in project midpoint by Evolveum.

the class ProjectionCredentialsProcessor method processProjectionPasswordMapping.

private <F extends FocusType> void processProjectionPasswordMapping(LensContext<F> context, final LensProjectionContext projCtx, final ValuePolicyType passwordPolicy, XMLGregorianCalendar now, Task task, OperationResult result) throws ExpressionEvaluationException, ObjectNotFoundException, SchemaException, CommunicationException, ConfigurationException, SecurityViolationException {
    LensFocusContext<F> focusContext = context.getFocusContext();
    PrismObject<F> userNew = focusContext.getObjectNew();
    if (userNew == null) {
        // This must be a user delete or something similar. No point in proceeding
        LOGGER.trace("userNew is null, skipping credentials processing");
        return;
    }
    PrismObjectDefinition<ShadowType> accountDefinition = prismContext.getSchemaRegistry().findObjectDefinitionByCompileTimeClass(ShadowType.class);
    PrismPropertyDefinition<ProtectedStringType> projPasswordPropertyDefinition = accountDefinition.findPropertyDefinition(SchemaConstants.PATH_PASSWORD_VALUE);
    ResourceShadowDiscriminator rsd = projCtx.getResourceShadowDiscriminator();
    RefinedObjectClassDefinition refinedProjDef = projCtx.getStructuralObjectClassDefinition();
    if (refinedProjDef == null) {
        LOGGER.trace("No RefinedObjectClassDefinition, therefore also no password outbound definition, skipping credentials processing for projection {}", rsd);
        return;
    }
    List<MappingType> outboundMappingTypes = refinedProjDef.getPasswordOutbound();
    if (outboundMappingTypes == null || outboundMappingTypes.isEmpty()) {
        LOGGER.trace("No outbound password mapping for {}, skipping credentials processing", rsd);
        return;
    }
    // HACK
    if (!projCtx.isDoReconciliation() && !projCtx.isAdd() && !isActivated(outboundMappingTypes, focusContext.getDelta())) {
        LOGGER.trace("Outbound password mappings not activated for type {}, skipping credentials processing", rsd);
        return;
    }
    final ObjectDelta<ShadowType> projDelta = projCtx.getDelta();
    final PropertyDelta<ProtectedStringType> projPasswordDelta;
    if (projDelta != null && projDelta.getChangeType() == MODIFY) {
        projPasswordDelta = projDelta.findPropertyDelta(SchemaConstants.PATH_PASSWORD_VALUE);
    } else {
        projPasswordDelta = null;
    }
    checkExistingDeltaSanity(projCtx, projPasswordDelta);
    boolean evaluateWeak = getEvaluateWeak(projCtx);
    final ItemDeltaItem<PrismPropertyValue<PasswordType>, PrismPropertyDefinition<ProtectedStringType>> userPasswordIdi = focusContext.getObjectDeltaObject().findIdi(SchemaConstants.PATH_PASSWORD_VALUE);
    StringPolicyResolver stringPolicyResolver = new StringPolicyResolver() {

        @Override
        public void setOutputPath(ItemPath outputPath) {
        }

        @Override
        public void setOutputDefinition(ItemDefinition outputDefinition) {
        }

        @Override
        public StringPolicyType resolve() {
            if (passwordPolicy == null) {
                return null;
            }
            return passwordPolicy.getStringPolicy();
        }
    };
    MappingInitializer<PrismPropertyValue<ProtectedStringType>, PrismPropertyDefinition<ProtectedStringType>> initializer = (builder) -> {
        builder.defaultTargetDefinition(projPasswordPropertyDefinition);
        builder.defaultSource(new Source<>(userPasswordIdi, ExpressionConstants.VAR_INPUT));
        builder.stringPolicyResolver(stringPolicyResolver);
        return builder;
    };
    MappingOutputProcessor<PrismPropertyValue<ProtectedStringType>> processor = (mappingOutputPath, outputStruct) -> {
        PrismValueDeltaSetTriple<PrismPropertyValue<ProtectedStringType>> outputTriple = outputStruct.getOutputTriple();
        if (outputTriple == null) {
            LOGGER.trace("Credentials 'password' expression resulted in null output triple, skipping credentials processing for {}", rsd);
            return false;
        }
        boolean projectionIsNew = projDelta != null && (projDelta.getChangeType() == ChangeType.ADD || projCtx.getSynchronizationPolicyDecision() == SynchronizationPolicyDecision.ADD);
        Collection<PrismPropertyValue<ProtectedStringType>> newValues = outputTriple.getPlusSet();
        if (projectionIsNew) {
            newValues = outputTriple.getNonNegativeValues();
        } else {
            newValues = outputTriple.getPlusSet();
        }
        if (!canGetCleartext(newValues)) {
            ObjectDelta<ShadowType> projectionPrimaryDelta = projCtx.getPrimaryDelta();
            if (projectionPrimaryDelta != null) {
                PropertyDelta<ProtectedStringType> passwordPrimaryDelta = projectionPrimaryDelta.findPropertyDelta(SchemaConstants.PATH_PASSWORD_VALUE);
                if (passwordPrimaryDelta != null) {
                    // We have only hashed value coming from the mapping. There are not very useful
                    // for provisioning. But we have primary projection delta - and that is very likely
                    // to be better.
                    // Skip all password mappings in this case. Primary delta trumps everything. 
                    // No weak, normal or even strong mapping can change that.
                    // We need to disregard even strong mapping in this case. If we would heed the strong
                    // mapping then account initialization won't be possible.
                    LOGGER.trace("We have primary password delta in projection, skipping credentials processing");
                    return false;
                }
            }
        }
        return true;
    };
    mappingEvaluator.evaluateOutboundMapping(context, projCtx, outboundMappingTypes, SchemaConstants.PATH_PASSWORD_VALUE, SchemaConstants.PATH_PASSWORD_VALUE, initializer, processor, now, true, evaluateWeak, "password mapping", task, result);
}

Example 2 with LensContext

use of com.evolveum.midpoint.model.impl.lens.LensContext in project midpoint by Evolveum.

the class TestUserChangeApprovalLegacy method test090UserModifyModifyResourceAssignmentValidity.

/**
     * User modification: modifying validity of single security-sensitive resource assignment.
     */
@Test(enabled = true)
public void test090UserModifyModifyResourceAssignmentValidity() throws Exception {
    TestUtil.displayTestTile(this, "test090UserModifyModifyResourceAssignmentValidity");
    login(userAdministrator);
    final XMLGregorianCalendar validFrom = XmlTypeConverter.createXMLGregorianCalendar(2015, 2, 25, 10, 0, 0);
    final XMLGregorianCalendar validTo = XmlTypeConverter.createXMLGregorianCalendar(2015, 3, 25, 10, 0, 0);
    executeTest("test090UserModifyModifyResourceAssignmentValidity", USER_JACK_OID, new TestDetails() {

        @Override
        int subtaskCount() {
            return 1;
        }

        @Override
        boolean immediate() {
            return false;
        }

        @Override
        boolean checkObjectOnSubtasks() {
            return true;
        }

        @Override
        boolean removeAssignmentsBeforeTest() {
            return false;
        }

        @Override
        public LensContext createModelContext(Task task, OperationResult result) throws Exception {
            LensContext<UserType> context = createUserLensContext();
            fillContextWithUser(context, USER_JACK_OID, result);
            UserType jack = context.getFocusContext().getObjectOld().asObjectable();
            modifyAssignmentValidity(context, jack, validFrom, validTo);
            return context;
        }

        @Override
        public void assertsAfterClockworkRun(Task rootTask, List<Task> wfSubtasks, OperationResult result) throws Exception {
            ModelContext taskModelContext = wfTaskUtil.getModelContext(rootTask, result);
            assertEquals("There are modifications left in primary focus delta", 0, taskModelContext.getFocusContext().getPrimaryDelta().getModifications().size());
            UserType jack = getUser(USER_JACK_OID).asObjectable();
            checkNoAssignmentValidity(jack);
        }

        @Override
        void assertsRootTaskFinishes(Task task, List<Task> subtasks, OperationResult result) throws Exception {
            assertAssignedResource(USER_JACK_OID, RESOURCE_DUMMY_OID, task, result);
            UserType jack = getUser(USER_JACK_OID).asObjectable();
            checkAssignmentValidity(jack, validFrom, validTo);
            checkDummyTransportMessages("simpleUserNotifier", 1);
            //checkWorkItemAuditRecords(createResultMap(ROLE_R1_OID, WorkflowResult.APPROVED));
            checkUserApprovers(USER_JACK_OID, Arrays.asList(DUMMYBOSS_OID), result);
        }

        @Override
        boolean decideOnApproval(String executionId) throws Exception {
            login(getUser(DUMMYBOSS_OID));
            return true;
        }
    });
}

Example 3 with LensContext

use of com.evolveum.midpoint.model.impl.lens.LensContext in project midpoint by Evolveum.

the class TestUserChangeApprovalLegacy method test041UserModifyPasswordChange.

@Test(enabled = true)
public void test041UserModifyPasswordChange() throws Exception {
    TestUtil.displayTestTile(this, "test041UserModifyPasswordChange");
    login(userAdministrator);
    PrismObject<UserType> jack = getUser(USER_JACK_OID);
    final ProtectedStringType originalPasswordValue = jack.asObjectable().getCredentials().getPassword().getValue();
    LOGGER.trace("password before test = " + originalPasswordValue);
    executeTest("test041UserModifyPasswordChange", USER_JACK_OID, new TestDetails() {

        @Override
        int subtaskCount() {
            return 1;
        }

        @Override
        boolean immediate() {
            return false;
        }

        @Override
        boolean checkObjectOnSubtasks() {
            return true;
        }

        @Override
        public LensContext createModelContext(Task task, OperationResult result) throws Exception {
            LensContext<UserType> context = createUserLensContext();
            fillContextWithUser(context, USER_JACK_OID, result);
            encryptAndAddFocusModificationToContext(context, REQ_USER_JACK_MODIFY_CHANGE_PASSWORD);
            //context.setOptions(ModelExecuteOptions.createNoCrypt());
            return context;
        }

        @Override
        public void assertsAfterClockworkRun(Task rootTask, List<Task> wfSubtasks, OperationResult result) throws Exception {
            ModelContext taskModelContext = wfTaskUtil.getModelContext(rootTask, result);
            assertEquals("There are modifications left in primary focus delta", 0, taskModelContext.getFocusContext().getPrimaryDelta().getModifications().size());
        }

        @Override
        void assertsRootTaskFinishes(Task task, List<Task> subtasks, OperationResult result) throws Exception {
            PrismObject<UserType> jack = getUser(USER_JACK_OID);
            ProtectedStringType afterTestPasswordValue = jack.asObjectable().getCredentials().getPassword().getValue();
            LOGGER.trace("password after test = " + afterTestPasswordValue);
            //assertNotNull("password was not set", afterTestPasswordValue.getEncryptedData());
            assertFalse("password was not changed", originalPasswordValue.getEncryptedDataType().equals(afterTestPasswordValue.getEncryptedDataType()));
            checkDummyTransportMessages("simpleUserNotifier", 1);
        }

        @Override
        boolean decideOnApproval(String executionId) throws Exception {
            login(getUser(USER_ADMINISTRATOR_OID));
            return true;
        }
    });
}

Example 4 with LensContext

use of com.evolveum.midpoint.model.impl.lens.LensContext in project midpoint by Evolveum.

the class TestUserChangeApprovalLegacy method test050UserModifyAddRoleAndPasswordChange.

@Test(enabled = true)
public void test050UserModifyAddRoleAndPasswordChange() throws Exception {
    TestUtil.displayTestTile(this, "test050UserModifyAddRoleAndPasswordChange");
    login(userAdministrator);
    PrismObject<UserType> jack = getUser(USER_JACK_OID);
    final ProtectedStringType originalPasswordValue = jack.asObjectable().getCredentials().getPassword().getValue();
    LOGGER.trace("password before test = " + originalPasswordValue);
    executeTest("test050UserModifyAddRoleAndPasswordChange", USER_JACK_OID, new TestDetails() {

        @Override
        int subtaskCount() {
            return 2;
        }

        @Override
        boolean immediate() {
            return false;
        }

        @Override
        boolean checkObjectOnSubtasks() {
            return true;
        }

        @Override
        public LensContext createModelContext(Task task, OperationResult result) throws Exception {
            LensContext<UserType> context = createUserLensContext();
            fillContextWithUser(context, USER_JACK_OID, result);
            encryptAndAddFocusModificationToContext(context, REQ_USER_JACK_MODIFY_CHANGE_PASSWORD_2);
            addFocusModificationToContext(context, REQ_USER_JACK_MODIFY_ADD_ASSIGNMENT_ROLE1);
            //context.setOptions(ModelExecuteOptions.createNoCrypt());
            return context;
        }

        @Override
        public void assertsAfterClockworkRun(Task rootTask, List<Task> wfSubtasks, OperationResult result) throws Exception {
            ModelContext taskModelContext = wfTaskUtil.getModelContext(rootTask, result);
            assertEquals("There are modifications left in primary focus delta", 0, taskModelContext.getFocusContext().getPrimaryDelta().getModifications().size());
        }

        @Override
        void assertsRootTaskFinishes(Task task, List<Task> subtasks, OperationResult result) throws Exception {
            PrismObject<UserType> jack = getUser(USER_JACK_OID);
            ProtectedStringType afterTestPasswordValue = jack.asObjectable().getCredentials().getPassword().getValue();
            LOGGER.trace("password after test = " + afterTestPasswordValue);
            // todo why is password value not set?
            //assertNotNull("password was not set", afterTestPasswordValue.getEncryptedData());
            //assertFalse("password was not changed", originalPasswordValue.getEncryptedData().equals(afterTestPasswordValue.getEncryptedData()));
            assertAssignedRole(jack, ROLE_R1_OID);
            checkDummyTransportMessages("simpleUserNotifier", 1);
        }

        @Override
        boolean decideOnApproval(String executionId) throws Exception {
            LightweightObjectRef targetRef = (LightweightObjectRef) activitiEngine.getRuntimeService().getVariable(executionId, CommonProcessVariableNames.VARIABLE_TARGET_REF);
            if (targetRef != null && RoleType.COMPLEX_TYPE.equals(targetRef.toObjectReferenceType().getType())) {
                return decideOnRoleApproval(executionId);
            } else {
                login(getUser(USER_ADMINISTRATOR_OID));
                return true;
            }
        }
    });
}

Example 5 with LensContext

use of com.evolveum.midpoint.model.impl.lens.LensContext in project midpoint by Evolveum.

the class TestUserChangeApprovalLegacy method test070UserModifyAssignment.

@Test(enabled = true)
public void test070UserModifyAssignment() throws Exception {
    TestUtil.displayTestTile(this, "test070UserModifyAssignment");
    login(userAdministrator);
    removeAllAssignments(USER_JACK_OID, new OperationResult("dummy"));
    assignRoleRaw(USER_JACK_OID, ROLE_R1_OID);
    final XMLGregorianCalendar validFrom = XmlTypeConverter.createXMLGregorianCalendar(2015, 2, 25, 10, 0, 0);
    final XMLGregorianCalendar validTo = XmlTypeConverter.createXMLGregorianCalendar(2015, 3, 25, 10, 0, 0);
    executeTest("test070UserModifyAssignment", USER_JACK_OID, new TestDetails() {

        @Override
        int subtaskCount() {
            return 1;
        }

        @Override
        boolean immediate() {
            return false;
        }

        @Override
        boolean checkObjectOnSubtasks() {
            return true;
        }

        @Override
        boolean removeAssignmentsBeforeTest() {
            return false;
        }

        @Override
        public LensContext createModelContext(Task task, OperationResult result) throws Exception {
            LensContext<UserType> context = createUserLensContext();
            fillContextWithUser(context, USER_JACK_OID, result);
            UserType jack = context.getFocusContext().getObjectOld().asObjectable();
            modifyAssignmentValidity(context, jack, validFrom, validTo);
            return context;
        }

        @Override
        public void assertsAfterClockworkRun(Task rootTask, List<Task> wfSubtasks, OperationResult result) throws Exception {
            ModelContext taskModelContext = wfTaskUtil.getModelContext(rootTask, result);
            assertEquals("There are modifications left in primary focus delta", 0, taskModelContext.getFocusContext().getPrimaryDelta().getModifications().size());
            UserType jack = getUser(USER_JACK_OID).asObjectable();
            checkNoAssignmentValidity(jack);
        }

        @Override
        void assertsRootTaskFinishes(Task task, List<Task> subtasks, OperationResult result) throws Exception {
            UserType jack = getUser(USER_JACK_OID).asObjectable();
            checkAssignmentValidity(jack, validFrom, validTo);
        // TODO
        //checkDummyTransportMessages("simpleUserNotifier", 1);
        }

        @Override
        boolean decideOnApproval(String executionId) throws Exception {
            login(getUser(R1BOSS_OID));
            return true;
        }
    });
}