Examples with ItemDeltaItem com.evolveum.midpoint.repo.common.expression.ItemDeltaItem used on opensource projects

Example 1 with ItemDeltaItem

use of com.evolveum.midpoint.repo.common.expression.ItemDeltaItem in project midpoint by Evolveum.

the class AssignmentEvaluator method evaluateAssignment.

private void evaluateAssignment(AssignmentPathSegmentImpl segment, PlusMinusZero mode, boolean isValid, EvaluationContext ctx, FocusType targetType, QName relation, AssignmentType roleAssignment) throws SchemaException, ObjectNotFoundException, ExpressionEvaluationException, PolicyViolationException {
    ObjectType orderOneObject = getOrderOneObject(segment);
    if (ObjectTypeUtil.isDelegationRelation(relation)) {
        // We have to handle assignments as though they were inducements here.
        if (!isInducementAllowedByLimitations(segment, roleAssignment)) {
            if (LOGGER.isTraceEnabled()) {
                LOGGER.trace("Skipping application of delegated assignment {} because it is limited in the delegation", FocusTypeUtil.dumpAssignment(roleAssignment));
            }
            return;
        }
    }
    QName nextRelation = getRelation(roleAssignment);
    EvaluationOrder nextEvaluationOrder = segment.getEvaluationOrder().advance(nextRelation);
    EvaluationOrder nextEvaluationOrderForTarget = segment.getEvaluationOrderForTarget().advance(nextRelation);
    if (LOGGER.isTraceEnabled()) {
        LOGGER.trace("orig EO({}): follow assignment {} {}; new EO({})", segment.getEvaluationOrder().shortDump(), targetType, FocusTypeUtil.dumpAssignment(roleAssignment), nextEvaluationOrder);
    }
    ItemDeltaItem<PrismContainerValue<AssignmentType>, PrismContainerDefinition<AssignmentType>> roleAssignmentIdi = new ItemDeltaItem<>();
    roleAssignmentIdi.setItemOld(LensUtil.createAssignmentSingleValueContainerClone(roleAssignment));
    roleAssignmentIdi.recompute();
    String nextSourceDescription = targetType + " in " + segment.sourceDescription;
    AssignmentPathSegmentImpl nextSegment = new AssignmentPathSegmentImpl(targetType, nextSourceDescription, roleAssignmentIdi, true);
    nextSegment.setRelation(nextRelation);
    nextSegment.setEvaluationOrder(nextEvaluationOrder);
    nextSegment.setEvaluationOrderForTarget(nextEvaluationOrderForTarget);
    nextSegment.setOrderOneObject(orderOneObject);
    // TODO why??? this should depend on evaluation order
    if (targetType instanceof AbstractRoleType) {
        // evaluation order of an assignment is probably too high (TODO but not in case of inducements going back into zero or negative orders!)
        nextSegment.setProcessMembership(false);
    } else {
        // We want to process membership in case of deputy and similar user->user assignments
        nextSegment.setProcessMembership(true);
    }
    nextSegment.setPathToSourceValid(isValid);
    assert !ctx.assignmentPath.isEmpty();
    evaluateFromSegment(nextSegment, mode, ctx);
}

Example 2 with ItemDeltaItem

use of com.evolveum.midpoint.repo.common.expression.ItemDeltaItem in project midpoint by Evolveum.

the class LensUtil method formatIterationToken.

public static <F extends ObjectType> String formatIterationToken(LensContext<F> context, LensElementContext<?> accountContext, IterationSpecificationType iterationType, int iteration, ExpressionFactory expressionFactory, ExpressionVariables variables, Task task, OperationResult result) throws SchemaException, ObjectNotFoundException, ExpressionEvaluationException {
    if (iterationType == null) {
        return formatIterationTokenDefault(iteration);
    }
    ExpressionType tokenExpressionType = iterationType.getTokenExpression();
    if (tokenExpressionType == null) {
        return formatIterationTokenDefault(iteration);
    }
    PrismPropertyDefinition<String> outputDefinition = new PrismPropertyDefinitionImpl<>(ExpressionConstants.VAR_ITERATION_TOKEN, DOMUtil.XSD_STRING, context.getPrismContext());
    Expression<PrismPropertyValue<String>, PrismPropertyDefinition<String>> expression = expressionFactory.makeExpression(tokenExpressionType, outputDefinition, "iteration token expression in " + accountContext.getHumanReadableName(), task, result);
    Collection<Source<?, ?>> sources = new ArrayList<>();
    PrismPropertyDefinitionImpl<Integer> inputDefinition = new PrismPropertyDefinitionImpl<>(ExpressionConstants.VAR_ITERATION, DOMUtil.XSD_INT, context.getPrismContext());
    inputDefinition.setMaxOccurs(1);
    PrismProperty<Integer> input = inputDefinition.instantiate();
    input.add(new PrismPropertyValue<Integer>(iteration));
    ItemDeltaItem<PrismPropertyValue<Integer>, PrismPropertyDefinition<Integer>> idi = new ItemDeltaItem<>(input);
    Source<PrismPropertyValue<Integer>, PrismPropertyDefinition<Integer>> iterationSource = new Source<>(idi, ExpressionConstants.VAR_ITERATION);
    sources.add(iterationSource);
    ExpressionEvaluationContext expressionContext = new ExpressionEvaluationContext(sources, variables, "iteration token expression in " + accountContext.getHumanReadableName(), task, result);
    PrismValueDeltaSetTriple<PrismPropertyValue<String>> outputTriple = ModelExpressionThreadLocalHolder.evaluateExpressionInContext(expression, expressionContext, task, result);
    Collection<PrismPropertyValue<String>> outputValues = outputTriple.getNonNegativeValues();
    if (outputValues.isEmpty()) {
        return "";
    }
    if (outputValues.size() > 1) {
        throw new ExpressionEvaluationException("Iteration token expression in " + accountContext.getHumanReadableName() + " returned more than one value (" + outputValues.size() + " values)");
    }
    String realValue = outputValues.iterator().next().getValue();
    if (realValue == null) {
        return "";
    }
    return realValue;
}

Example 3 with ItemDeltaItem

use of com.evolveum.midpoint.repo.common.expression.ItemDeltaItem in project midpoint by Evolveum.

the class ProjectionCredentialsProcessor method processProjectionPasswordMapping.

private <F extends FocusType> void processProjectionPasswordMapping(LensContext<F> context, final LensProjectionContext projCtx, final ValuePolicyType passwordPolicy, XMLGregorianCalendar now, Task task, OperationResult result) throws ExpressionEvaluationException, ObjectNotFoundException, SchemaException, CommunicationException, ConfigurationException, SecurityViolationException {
    LensFocusContext<F> focusContext = context.getFocusContext();
    PrismObject<F> userNew = focusContext.getObjectNew();
    if (userNew == null) {
        // This must be a user delete or something similar. No point in proceeding
        LOGGER.trace("userNew is null, skipping credentials processing");
        return;
    }
    PrismObjectDefinition<ShadowType> accountDefinition = prismContext.getSchemaRegistry().findObjectDefinitionByCompileTimeClass(ShadowType.class);
    PrismPropertyDefinition<ProtectedStringType> projPasswordPropertyDefinition = accountDefinition.findPropertyDefinition(SchemaConstants.PATH_PASSWORD_VALUE);
    ResourceShadowDiscriminator rsd = projCtx.getResourceShadowDiscriminator();
    RefinedObjectClassDefinition refinedProjDef = projCtx.getStructuralObjectClassDefinition();
    if (refinedProjDef == null) {
        LOGGER.trace("No RefinedObjectClassDefinition, therefore also no password outbound definition, skipping credentials processing for projection {}", rsd);
        return;
    }
    List<MappingType> outboundMappingTypes = refinedProjDef.getPasswordOutbound();
    if (outboundMappingTypes == null || outboundMappingTypes.isEmpty()) {
        LOGGER.trace("No outbound password mapping for {}, skipping credentials processing", rsd);
        return;
    }
    // HACK
    if (!projCtx.isDoReconciliation() && !projCtx.isAdd() && !isActivated(outboundMappingTypes, focusContext.getDelta())) {
        LOGGER.trace("Outbound password mappings not activated for type {}, skipping credentials processing", rsd);
        return;
    }
    final ObjectDelta<ShadowType> projDelta = projCtx.getDelta();
    final PropertyDelta<ProtectedStringType> projPasswordDelta;
    if (projDelta != null && projDelta.getChangeType() == MODIFY) {
        projPasswordDelta = projDelta.findPropertyDelta(SchemaConstants.PATH_PASSWORD_VALUE);
    } else {
        projPasswordDelta = null;
    }
    checkExistingDeltaSanity(projCtx, projPasswordDelta);
    boolean evaluateWeak = getEvaluateWeak(projCtx);
    final ItemDeltaItem<PrismPropertyValue<PasswordType>, PrismPropertyDefinition<ProtectedStringType>> userPasswordIdi = focusContext.getObjectDeltaObject().findIdi(SchemaConstants.PATH_PASSWORD_VALUE);
    StringPolicyResolver stringPolicyResolver = new StringPolicyResolver() {

        @Override
        public void setOutputPath(ItemPath outputPath) {
        }

        @Override
        public void setOutputDefinition(ItemDefinition outputDefinition) {
        }

        @Override
        public StringPolicyType resolve() {
            if (passwordPolicy == null) {
                return null;
            }
            return passwordPolicy.getStringPolicy();
        }
    };
    MappingInitializer<PrismPropertyValue<ProtectedStringType>, PrismPropertyDefinition<ProtectedStringType>> initializer = (builder) -> {
        builder.defaultTargetDefinition(projPasswordPropertyDefinition);
        builder.defaultSource(new Source<>(userPasswordIdi, ExpressionConstants.VAR_INPUT));
        builder.stringPolicyResolver(stringPolicyResolver);
        return builder;
    };
    MappingOutputProcessor<PrismPropertyValue<ProtectedStringType>> processor = (mappingOutputPath, outputStruct) -> {
        PrismValueDeltaSetTriple<PrismPropertyValue<ProtectedStringType>> outputTriple = outputStruct.getOutputTriple();
        if (outputTriple == null) {
            LOGGER.trace("Credentials 'password' expression resulted in null output triple, skipping credentials processing for {}", rsd);
            return false;
        }
        boolean projectionIsNew = projDelta != null && (projDelta.getChangeType() == ChangeType.ADD || projCtx.getSynchronizationPolicyDecision() == SynchronizationPolicyDecision.ADD);
        Collection<PrismPropertyValue<ProtectedStringType>> newValues = outputTriple.getPlusSet();
        if (projectionIsNew) {
            newValues = outputTriple.getNonNegativeValues();
        } else {
            newValues = outputTriple.getPlusSet();
        }
        if (!canGetCleartext(newValues)) {
            ObjectDelta<ShadowType> projectionPrimaryDelta = projCtx.getPrimaryDelta();
            if (projectionPrimaryDelta != null) {
                PropertyDelta<ProtectedStringType> passwordPrimaryDelta = projectionPrimaryDelta.findPropertyDelta(SchemaConstants.PATH_PASSWORD_VALUE);
                if (passwordPrimaryDelta != null) {
                    // We have only hashed value coming from the mapping. There are not very useful
                    // for provisioning. But we have primary projection delta - and that is very likely
                    // to be better.
                    // Skip all password mappings in this case. Primary delta trumps everything. 
                    // No weak, normal or even strong mapping can change that.
                    // We need to disregard even strong mapping in this case. If we would heed the strong
                    // mapping then account initialization won't be possible.
                    LOGGER.trace("We have primary password delta in projection, skipping credentials processing");
                    return false;
                }
            }
        }
        return true;
    };
    mappingEvaluator.evaluateOutboundMapping(context, projCtx, outboundMappingTypes, SchemaConstants.PATH_PASSWORD_VALUE, SchemaConstants.PATH_PASSWORD_VALUE, initializer, processor, now, true, evaluateWeak, "password mapping", task, result);
}

Example 4 with ItemDeltaItem

use of com.evolveum.midpoint.repo.common.expression.ItemDeltaItem in project midpoint by Evolveum.

the class TestAbstractAssignmentEvaluator method test130DirectExpressionReplaceDescriptionFromNull.

@Test
public void test130DirectExpressionReplaceDescriptionFromNull() throws Exception {
    final String TEST_NAME = "test130DirectExpressionReplaceDescriptionFromNull";
    TestUtil.displayTestTile(this, TEST_NAME);
    // GIVEN
    Task task = taskManager.createTaskInstance(TestAssignmentEvaluator.class.getName() + "." + TEST_NAME);
    OperationResult result = task.getResult();
    PrismObject<UserType> user = userTypeJack.asPrismObject().clone();
    AssignmentType assignmentType = unmarshallValueFromFile(ASSIGNMENT_DIRECT_EXPRESSION_FILE, AssignmentType.class);
    assignmentType.setDescription(null);
    user.asObjectable().getAssignment().add(assignmentType.clone());
    //		// We need to make sure that the assignment has a parent
    //		PrismContainerDefinition<AssignmentType> assignmentContainerDefinition = user.getDefinition().findContainerDefinition(UserType.F_ASSIGNMENT);
    //		PrismContainer<AssignmentType> assignmentContainer = assignmentContainerDefinition.instantiate();
    //		assignmentContainer.add(assignmentType.asPrismContainerValue().clone());
    ItemPath path = new ItemPath(new NameItemPathSegment(UserType.F_ASSIGNMENT), new IdItemPathSegment(123L), new NameItemPathSegment(AssignmentType.F_DESCRIPTION));
    ObjectDelta<UserType> userDelta = ObjectDelta.createModificationReplaceProperty(UserType.class, USER_JACK_OID, path, prismContext, "sailor");
    ObjectDeltaObject<UserType> userOdo = new ObjectDeltaObject<>(user, userDelta, null);
    userOdo.recompute();
    AssignmentEvaluator<UserType> assignmentEvaluator = createAssignmentEvaluator(userOdo);
    ItemDeltaItem<PrismContainerValue<AssignmentType>, PrismContainerDefinition<AssignmentType>> assignmentIdi = new ItemDeltaItem<>();
    assignmentIdi.setItemOld(LensUtil.createAssignmentSingleValueContainerClone(assignmentType));
    assignmentIdi.setSubItemDeltas(userDelta.getModifications());
    assignmentIdi.recompute();
    // WHEN
    TestUtil.displayWhen(TEST_NAME);
    EvaluatedAssignmentImpl<UserType> evaluatedAssignment = assignmentEvaluator.evaluate(assignmentIdi, PlusMinusZero.ZERO, false, userTypeJack, "testDirect", task, result);
    evaluatedAssignment.evaluateConstructions(userOdo, task, result);
    // THEN
    TestUtil.displayThen(TEST_NAME);
    result.computeStatus();
    TestUtil.assertSuccess(result);
    assertNotNull(evaluatedAssignment);
    display("Evaluated assignment", evaluatedAssignment);
    assertEquals(1, evaluatedAssignment.getConstructionTriple().size());
    PrismAsserts.assertParentConsistency(user);
    Construction<UserType> construction = evaluatedAssignment.getConstructionTriple().getZeroSet().iterator().next();
    assertNotNull("No object class definition in construction", construction.getRefinedObjectClassDefinition());
    assertEquals(1, construction.getAttributeMappings().size());
    PrismValueDeltaSetTripleProducer<PrismPropertyValue<String>, PrismPropertyDefinition<String>> attributeMapping = (PrismValueDeltaSetTripleProducer<PrismPropertyValue<String>, PrismPropertyDefinition<String>>) construction.getAttributeMappings().iterator().next();
    PrismValueDeltaSetTriple<PrismPropertyValue<String>> outputTriple = attributeMapping.getOutputTriple();
    PrismAsserts.assertTripleNoZero(outputTriple);
    PrismAsserts.assertTriplePlus(outputTriple, "The best sailor the world has ever seen");
    PrismAsserts.assertTripleMinus(outputTriple, "The best man the world has ever seen");
    // the same using other words
    assertConstruction(evaluatedAssignment, ZERO, "title", ZERO);
    assertConstruction(evaluatedAssignment, ZERO, "title", PLUS, "The best sailor the world has ever seen");
    assertConstruction(evaluatedAssignment, ZERO, "title", MINUS, "The best man the world has ever seen");
    assertNoConstruction(evaluatedAssignment, PLUS, "title");
    assertNoConstruction(evaluatedAssignment, MINUS, "title");
    assertEquals("Wrong number of admin GUI configs", 0, evaluatedAssignment.getAdminGuiConfigurations().size());
}

Example 5 with ItemDeltaItem

use of com.evolveum.midpoint.repo.common.expression.ItemDeltaItem in project midpoint by Evolveum.

the class TestAbstractAssignmentEvaluator method test310DisableRoleEngineer.

@Test
public void test310DisableRoleEngineer() throws Exception {
    final String TEST_NAME = "test310DisableRoleEngineer";
    TestUtil.displayTestTile(this, TEST_NAME);
    // GIVEN
    Task task = taskManager.createTaskInstance(TestAssignmentEvaluator.class.getName() + "." + TEST_NAME);
    OperationResult result = task.getResult();
    // disable role Engineer
    ObjectDelta disableEngineerDelta = DeltaBuilder.deltaFor(RoleType.class, prismContext).item(ACTIVATION_ADMINISTRATIVE_STATUS_PATH).replace(ActivationStatusType.DISABLED).asObjectDelta(ROLE_CORP_ENGINEER_OID);
    modelService.executeChanges(Collections.<ObjectDelta<? extends ObjectType>>singletonList(disableEngineerDelta), null, task, result);
    AssignmentEvaluator<UserType> assignmentEvaluator = createAssignmentEvaluator();
    PrismAsserts.assertParentConsistency(userTypeJack.asPrismObject());
    AssignmentType assignmentType = getAssignmentType(ASSIGNMENT_ROLE_ENGINEER_FILE);
    ObjectDeltaObject<UserType> userOdo = new ObjectDeltaObject<>(userTypeJack.asPrismObject(), null, null);
    userOdo.recompute();
    ItemDeltaItem<PrismContainerValue<AssignmentType>, PrismContainerDefinition<AssignmentType>> assignmentIdi = new ItemDeltaItem<>();
    assignmentIdi.setItemOld(LensUtil.createAssignmentSingleValueContainerClone(assignmentType));
    assignmentIdi.recompute();
    // WHEN
    TestUtil.displayWhen(TEST_NAME);
    EvaluatedAssignmentImpl<UserType> evaluatedAssignment = assignmentEvaluator.evaluate(assignmentIdi, PlusMinusZero.ZERO, false, userTypeJack, "testRoleEngineer", task, result);
    evaluatedAssignment.evaluateConstructions(userOdo, task, result);
    // THEN
    TestUtil.displayThen(TEST_NAME);
    result.computeStatus();
    TestUtil.assertSuccess(result);
    assertNotNull(evaluatedAssignment);
    display("Evaluated assignment", evaluatedAssignment.debugDump());
    assertEquals(0, evaluatedAssignment.getConstructionTriple().size());
    PrismAsserts.assertParentConsistency(userTypeJack.asPrismObject());
    assertNoConstruction(evaluatedAssignment, ZERO, "title");
    assertNoConstruction(evaluatedAssignment, PLUS, "title");
    assertNoConstruction(evaluatedAssignment, MINUS, "title");
    assertNoConstruction(evaluatedAssignment, ZERO, "location");
    assertNoConstruction(evaluatedAssignment, PLUS, "location");
    assertNoConstruction(evaluatedAssignment, MINUS, "location");
    assertEquals("Wrong number of admin GUI configs", 0, evaluatedAssignment.getAdminGuiConfigurations().size());
}