use of com.evolveum.midpoint.repo.common.expression.Source in project midpoint by Evolveum.
the class TestExpression method test120Value.
@Test
public void test120Value() throws Exception {
// GIVEN
OperationResult result = createOperationResult();
rememberScriptExecutionCount();
ExpressionType expressionType = parseExpression(EXPRESSION_VALUE_FILE);
Collection<Source<?, ?>> sources = prepareStringSources();
VariablesMap variables = prepareBasicVariables();
ExpressionEvaluationContext expressionContext = new ExpressionEvaluationContext(sources, variables, getTestNameShort(), null);
// WHEN
PrismValueDeltaSetTriple<PrismPropertyValue<String>> outputTriple = evaluatePropertyExpression(expressionType, PrimitiveType.STRING, expressionContext, result);
// THEN
assertOutputTriple(outputTriple).assertEmptyMinus().assertEmptyPlus().zeroSet().assertSinglePropertyValue(EXPRESSION_VALUE_OUTPUT);
assertScriptExecutionIncrement(0);
}
use of com.evolveum.midpoint.repo.common.expression.Source in project midpoint by Evolveum.
the class ValueMetadataComputation method createSources.
// TODO unify with parsing data mapping sources (MappingParser class)
private void createSources(MetadataMappingBuilder<?, ?> builder, MetadataMappingType mappingBean) throws SchemaException {
for (VariableBindingDefinitionType sourceDef : mappingBean.getSource()) {
ItemPath sourcePath = getSourcePath(sourceDef);
QName sourceName = getSourceName(sourceDef, sourcePath);
ItemDefinition sourceDefinition = getAdaptedSourceDefinition(sourcePath);
Item sourceItem = sourceDefinition.instantiate();
// noinspection unchecked
sourceItem.addAll(getSourceValues(sourcePath));
// noinspection unchecked
Source<?, ?> source = new Source<>(sourceItem, null, null, sourceName, sourceDefinition);
source.recompute();
builder.additionalSource(source);
}
}
use of com.evolveum.midpoint.repo.common.expression.Source in project midpoint by Evolveum.
the class LensUtil method formatIterationToken.
public static <F extends ObjectType> String formatIterationToken(LensContext<F> context, LensElementContext<?> accountContext, IterationSpecificationType iterationType, int iteration, ExpressionFactory expressionFactory, VariablesMap variables, Task task, OperationResult result) throws SchemaException, ObjectNotFoundException, ExpressionEvaluationException, CommunicationException, ConfigurationException, SecurityViolationException {
if (iterationType == null) {
return formatIterationTokenDefault(iteration);
}
ExpressionType tokenExpressionType = iterationType.getTokenExpression();
if (tokenExpressionType == null) {
return formatIterationTokenDefault(iteration);
}
PrismContext prismContext = PrismContext.get();
PrismPropertyDefinition<String> outputDefinition = prismContext.definitionFactory().createPropertyDefinition(ExpressionConstants.VAR_ITERATION_TOKEN_QNAME, DOMUtil.XSD_STRING);
Expression<PrismPropertyValue<String>, PrismPropertyDefinition<String>> expression = expressionFactory.makeExpression(tokenExpressionType, outputDefinition, MiscSchemaUtil.getExpressionProfile(), "iteration token expression in " + accountContext.getHumanReadableName(), task, result);
Collection<Source<?, ?>> sources = new ArrayList<>();
MutablePrismPropertyDefinition<Integer> inputDefinition = prismContext.definitionFactory().createPropertyDefinition(ExpressionConstants.VAR_ITERATION_QNAME, DOMUtil.XSD_INT);
inputDefinition.setMaxOccurs(1);
PrismProperty<Integer> input = inputDefinition.instantiate();
input.addRealValue(iteration);
ItemDeltaItem<PrismPropertyValue<Integer>, PrismPropertyDefinition<Integer>> idi = new ItemDeltaItem<>(input);
Source<PrismPropertyValue<Integer>, PrismPropertyDefinition<Integer>> iterationSource = new Source<>(idi, ExpressionConstants.VAR_ITERATION_QNAME);
sources.add(iterationSource);
ExpressionEvaluationContext expressionContext = new ExpressionEvaluationContext(sources, variables, "iteration token expression in " + accountContext.getHumanReadableName(), task);
PrismValueDeltaSetTriple<PrismPropertyValue<String>> outputTriple = ModelExpressionThreadLocalHolder.evaluateExpressionInContext(expression, expressionContext, task, result);
Collection<PrismPropertyValue<String>> outputValues = outputTriple.getNonNegativeValues();
if (outputValues.isEmpty()) {
return "";
}
if (outputValues.size() > 1) {
throw new ExpressionEvaluationException("Iteration token expression in " + accountContext.getHumanReadableName() + " returned more than one value (" + outputValues.size() + " values)");
}
String realValue = outputValues.iterator().next().getValue();
if (realValue == null) {
return "";
}
return realValue;
}
use of com.evolveum.midpoint.repo.common.expression.Source in project midpoint by Evolveum.
the class ProjectionCredentialsProcessor method processProjectionPasswordMapping.
private <F extends FocusType> void processProjectionPasswordMapping(LensContext<F> context, final LensProjectionContext projCtx, final SecurityPolicyType securityPolicy, XMLGregorianCalendar now, Task task, OperationResult result) throws ExpressionEvaluationException, ObjectNotFoundException, SchemaException, CommunicationException, ConfigurationException, SecurityViolationException {
LensFocusContext<F> focusContext = context.getFocusContext();
PrismObject<F> focusNew = focusContext.getObjectNew();
if (focusNew == null) {
// This must be a focus delete or something similar. No point in proceeding
LOGGER.trace("focusNew is null, skipping credentials processing");
return;
}
PrismObjectDefinition<ShadowType> accountDefinition = prismContext.getSchemaRegistry().findObjectDefinitionByCompileTimeClass(ShadowType.class);
PrismPropertyDefinition<ProtectedStringType> projPasswordPropertyDefinition = accountDefinition.findPropertyDefinition(SchemaConstants.PATH_PASSWORD_VALUE);
ResourceShadowDiscriminator rsd = projCtx.getResourceShadowDiscriminator();
ResourceObjectDefinition objectDefinition = projCtx.getStructuralObjectDefinition();
if (objectDefinition == null) {
LOGGER.trace("No ResourceObjectTypeDefinition, therefore also no password outbound definition," + " skipping credentials processing for projection {}", rsd);
return;
}
List<MappingType> outboundMappingBeans = objectDefinition.getPasswordOutbound();
if (outboundMappingBeans.isEmpty()) {
LOGGER.trace("No outbound password mapping for {}, skipping credentials processing", rsd);
return;
}
ObjectDeltaObject<F> objectDeltaObject = focusContext.getObjectDeltaObjectAbsolute();
// HACK
if (!projCtx.isDoReconciliation() && !projCtx.isAdd() && !isActivated(outboundMappingBeans, objectDeltaObject.getObjectDelta())) {
LOGGER.trace("Outbound password mappings not activated for type {}, skipping credentials processing", rsd);
return;
}
ObjectDelta<ShadowType> projDelta = projCtx.getCurrentDelta();
PropertyDelta<ProtectedStringType> projPasswordDelta;
if (projDelta != null && projDelta.getChangeType() == MODIFY) {
projPasswordDelta = projDelta.findPropertyDelta(SchemaConstants.PATH_PASSWORD_VALUE);
} else {
projPasswordDelta = null;
}
checkExistingDeltaSanity(projCtx, projPasswordDelta);
boolean evaluateWeak = getEvaluateWeak(projCtx);
// TODO wave
ItemDeltaItem<PrismPropertyValue<ProtectedStringType>, PrismPropertyDefinition<ProtectedStringType>> focusPasswordIdi = objectDeltaObject.findIdi(SchemaConstants.PATH_PASSWORD_VALUE);
ConfigurableValuePolicySupplier valuePolicySupplier = (result1) -> SecurityUtil.getPasswordPolicy(securityPolicy);
MappingInitializer<PrismPropertyValue<ProtectedStringType>, PrismPropertyDefinition<ProtectedStringType>> initializer = (builder) -> {
builder.mappingKind(MappingKindType.OUTBOUND).implicitSourcePath(SchemaConstants.PATH_PASSWORD_VALUE).implicitTargetPath(SchemaConstants.PATH_PASSWORD_VALUE);
builder.defaultTargetDefinition(projPasswordPropertyDefinition);
builder.defaultSource(new Source<>(focusPasswordIdi, ExpressionConstants.VAR_INPUT_QNAME));
builder.valuePolicySupplier(valuePolicySupplier);
return builder;
};
MappingOutputProcessor<PrismPropertyValue<ProtectedStringType>> processor = (mappingOutputPath, outputStruct) -> {
PrismValueDeltaSetTriple<PrismPropertyValue<ProtectedStringType>> outputTriple = outputStruct.getOutputTriple();
if (outputTriple == null) {
LOGGER.trace("Credentials 'password' expression resulted in null output triple, skipping credentials processing for {}", rsd);
return false;
}
boolean projectionIsNew = projDelta != null && (projDelta.getChangeType() == ChangeType.ADD || projCtx.getSynchronizationPolicyDecision() == SynchronizationPolicyDecision.ADD);
Collection<PrismPropertyValue<ProtectedStringType>> newValues;
if (projectionIsNew) {
newValues = outputTriple.getNonNegativeValues();
} else {
newValues = outputTriple.getPlusSet();
}
if (!canGetCleartext(newValues)) {
ObjectDelta<ShadowType> projectionPrimaryDelta = projCtx.getPrimaryDelta();
if (projectionPrimaryDelta != null) {
PropertyDelta<ProtectedStringType> passwordPrimaryDelta = projectionPrimaryDelta.findPropertyDelta(SchemaConstants.PATH_PASSWORD_VALUE);
if (passwordPrimaryDelta != null) {
// We have only hashed value coming from the mapping. There are not very useful
// for provisioning. But we have primary projection delta - and that is very likely
// to be better.
// Skip all password mappings in this case. Primary delta trumps everything.
// No weak, normal or even strong mapping can change that.
// We need to disregard even strong mapping in this case. If we would heed the strong
// mapping then account initialization won't be possible.
LOGGER.trace("We have primary password delta in projection, skipping credentials processing");
return false;
}
}
}
Collection<PrismPropertyValue<ProtectedStringType>> minusSet = outputTriple.getMinusSet();
if (!minusSet.isEmpty()) {
if (!canGetCleartext(minusSet)) {
// We have hashed values in minus set. That is not great, we won't be able to get
// cleartext from that if we need it (e.g. for runAs in provisioning).
// Therefore try to get old value from focus password delta. If that matches with
// hashed value then we have the cleartext.
ProtectedStringType oldProjectionPassword = minusSet.iterator().next().getRealValue();
PropertyDelta<ProtectedStringType> focusPasswordDelta = (PropertyDelta<ProtectedStringType>) focusPasswordIdi.getDelta();
Collection<PrismPropertyValue<ProtectedStringType>> focusPasswordDeltaOldValues = focusPasswordDelta.getEstimatedOldValues();
if (focusPasswordDeltaOldValues != null && !focusPasswordDeltaOldValues.isEmpty()) {
ProtectedStringType oldFocusPassword = requireNonNull(focusPasswordDeltaOldValues.iterator().next().getRealValue());
try {
if (oldFocusPassword.canGetCleartext() && protector.compareCleartext(oldFocusPassword, oldProjectionPassword)) {
outputTriple.clearMinusSet();
outputTriple.addToMinusSet(prismContext.itemFactory().createPropertyValue(oldFocusPassword));
}
} catch (EncryptionException e) {
throw new SystemException(e.getMessage(), e);
}
}
}
}
return true;
};
String projCtxDesc = projCtx.toHumanReadableString();
PrismObject<ShadowType> shadowNew = projCtx.getObjectNew();
MappingInitializer<PrismPropertyValue<ProtectedStringType>, PrismPropertyDefinition<ProtectedStringType>> internalInitializer = builder -> {
builder.addVariableDefinitions(ModelImplUtils.getDefaultVariablesMap(context, projCtx, true));
builder.mappingKind(MappingKindType.OUTBOUND);
builder.originType(OriginType.OUTBOUND);
builder.implicitTargetPath(SchemaConstants.PATH_PASSWORD_VALUE);
builder.originObject(projCtx.getResource());
initializer.initialize(builder);
return builder;
};
MappingEvaluatorParams<PrismPropertyValue<ProtectedStringType>, PrismPropertyDefinition<ProtectedStringType>, ShadowType, F> params = new MappingEvaluatorParams<>();
params.setMappingTypes(outboundMappingBeans);
params.setMappingDesc("password mapping" + " in projection " + projCtxDesc);
params.setNow(now);
params.setInitializer(internalInitializer);
params.setProcessor(processor);
params.setTargetLoader(new ProjectionMappingLoader<>(projCtx, contextLoader));
params.setAPrioriTargetObject(shadowNew);
params.setAPrioriTargetDelta(LensUtil.findAPrioriDelta(context, projCtx));
params.setTargetContext(projCtx);
params.setDefaultTargetItemPath(SchemaConstants.PATH_PASSWORD_VALUE);
if (context.getFocusContext() != null) {
params.setSourceContext(context.getFocusContext().getObjectDeltaObjectAbsolute());
}
params.setEvaluateCurrent(MappingTimeEval.CURRENT);
params.setEvaluateWeak(evaluateWeak);
params.setContext(context);
params.setHasFullTargetObject(projCtx.hasFullShadow());
projectionMappingSetEvaluator.evaluateMappingsToTriples(params, task, result);
}
use of com.evolveum.midpoint.repo.common.expression.Source in project midpoint by Evolveum.
the class MappingParser method parseSource.
private <IV extends PrismValue, ID extends ItemDefinition<?>> Source<IV, ID> parseSource(VariableBindingDefinitionType sourceDefinition, OperationResult result) throws SchemaException, ObjectNotFoundException, ExpressionEvaluationException, CommunicationException, ConfigurationException, SecurityViolationException {
ItemPath path = getSourcePath(sourceDefinition);
@NotNull QName sourceQName = sourceDefinition.getName() != null ? sourceDefinition.getName() : ItemPath.toName(path.last());
String variableName = sourceQName.getLocalPart();
TypedValue<?> typedSourceObject = ExpressionUtil.resolvePathGetTypedValue(path, m.variables, true, m.getTypedSourceContext(), m.beans.objectResolver, m.beans.prismContext, "source definition in " + m.getMappingContextDescription(), m.getTask(), result);
Object sourceObject = typedSourceObject != null ? typedSourceObject.getValue() : null;
Item<IV, ID> itemOld = null;
ItemDelta<IV, ID> delta = null;
Item<IV, ID> itemNew = null;
ItemPath resolvePath = path;
ItemPath residualPath = null;
Collection<? extends ItemDelta<?, ?>> subItemDeltas = null;
if (sourceObject != null) {
if (sourceObject instanceof ItemDeltaItem<?, ?>) {
// noinspection unchecked
itemOld = ((ItemDeltaItem<IV, ID>) sourceObject).getItemOld();
// noinspection unchecked
delta = ((ItemDeltaItem<IV, ID>) sourceObject).getDelta();
// noinspection unchecked
itemNew = ((ItemDeltaItem<IV, ID>) sourceObject).getItemNew();
// noinspection unchecked
residualPath = ((ItemDeltaItem<IV, ID>) sourceObject).getResidualPath();
// noinspection unchecked
resolvePath = ((ItemDeltaItem<IV, ID>) sourceObject).getResolvePath();
// noinspection unchecked
subItemDeltas = ((ItemDeltaItem<IV, ID>) sourceObject).getSubItemDeltas();
} else if (sourceObject instanceof Item<?, ?>) {
// noinspection unchecked
itemOld = (Item<IV, ID>) sourceObject;
// noinspection unchecked
itemNew = (Item<IV, ID>) sourceObject;
} else {
throw new IllegalStateException("Unknown resolve result " + sourceObject);
}
}
ID sourceItemDefinition = typedSourceObject != null ? typedSourceObject.getDefinition() : null;
// apply domain
ValueSetDefinitionType domainSetType = sourceDefinition.getSet();
if (domainSetType != null) {
ValueSetDefinition<IV, ID> setDef = new ValueSetDefinition<>(domainSetType, sourceItemDefinition, m.valueMetadataDefinition, m.expressionProfile, variableName, null, "domain of " + variableName, "domain of " + variableName + " in " + m.getMappingContextDescription(), m.getTask(), result);
setDef.init(m.beans.expressionFactory);
setDef.setAdditionalVariables(m.variables);
try {
if (itemOld != null) {
// noinspection unchecked
itemOld = itemOld.clone();
itemOld.filterValues(setDef::containsTunnel);
itemOld.filterYields(setDef::containsYieldTunnel);
}
if (itemNew != null) {
// noinspection unchecked
itemNew = itemNew.clone();
itemNew.filterValues(setDef::containsTunnel);
itemNew.filterYields(setDef::containsYieldTunnel);
}
if (delta != null) {
delta = delta.clone();
delta.filterValues(setDef::containsTunnel);
delta.filterYields(setDef::containsYieldTunnel);
}
} catch (TunnelException te) {
unwrapTunnelException(te);
}
}
Source<IV, ID> source = new Source<>(itemOld, delta, itemNew, sourceQName, sourceItemDefinition);
source.setResidualPath(residualPath);
source.setResolvePath(resolvePath);
source.setSubItemDeltas(subItemDeltas);
return source;
}
Aggregations