Examples with Authorization com.evolveum.midpoint.security.api.Authorization used on opensource projects

Example 6 with Authorization

use of com.evolveum.midpoint.security.api.Authorization in project midpoint by Evolveum.

the class MidPointAuthWebSession method getRoles.

@Override
public Roles getRoles() {
    Roles roles = new Roles();
    //todo - used for wicket auth roles...
    MidPointPrincipal principal = SecurityUtils.getPrincipalUser();
    if (principal == null) {
        return roles;
    }
    for (Authorization authz : principal.getAuthorities()) {
        roles.addAll(authz.getAction());
    }
    return roles;
}

Example 7 with Authorization

use of com.evolveum.midpoint.security.api.Authorization in project midpoint by Evolveum.

the class EvaluatedAssignmentImpl method debugDump.

@Override
public String debugDump(int indent) {
    StringBuilder sb = new StringBuilder();
    DebugUtil.debugDumpLabelLn(sb, "EvaluatedAssignment", indent);
    DebugUtil.debugDumpWithLabelLn(sb, "assignment old", String.valueOf(assignmentIdi.getItemOld()), indent + 1);
    DebugUtil.debugDumpWithLabelLn(sb, "assignment delta", String.valueOf(assignmentIdi.getDelta()), indent + 1);
    DebugUtil.debugDumpWithLabelLn(sb, "assignment new", String.valueOf(assignmentIdi.getItemNew()), indent + 1);
    DebugUtil.debugDumpWithLabelLn(sb, "target", String.valueOf(target), indent + 1);
    DebugUtil.debugDumpWithLabel(sb, "isValid", isValid, indent + 1);
    if (forceRecon) {
        sb.append("\n");
        DebugUtil.debugDumpWithLabel(sb, "forceRecon", forceRecon, indent + 1);
    }
    if (!constructionTriple.isEmpty()) {
        sb.append("\n");
        DebugUtil.debugDumpWithLabel(sb, "Constructions", constructionTriple, indent + 1);
    }
    if (!personaConstructionTriple.isEmpty()) {
        sb.append("\n");
        DebugUtil.debugDumpWithLabel(sb, "Persona constructions", personaConstructionTriple, indent + 1);
    }
    if (!roles.isEmpty()) {
        sb.append("\n");
        DebugUtil.debugDumpWithLabel(sb, "Roles", roles, indent + 1);
    }
    dumpRefList(indent, sb, "Orgs", orgRefVals);
    dumpRefList(indent, sb, "Membership", membershipRefVals);
    dumpRefList(indent, sb, "Delegation", delegationRefVals);
    if (!authorizations.isEmpty()) {
        sb.append("\n");
        DebugUtil.debugDumpLabel(sb, "Authorizations", indent + 1);
        for (Authorization autz : authorizations) {
            sb.append("\n");
            DebugUtil.indentDebugDump(sb, indent + 2);
            sb.append(autz.toString());
        }
    }
    if (!focusMappings.isEmpty()) {
        sb.append("\n");
        DebugUtil.debugDumpLabel(sb, "Focus Mappings", indent + 1);
        for (PrismValueDeltaSetTripleProducer<?, ?> mapping : focusMappings) {
            sb.append("\n");
            DebugUtil.indentDebugDump(sb, indent + 2);
            sb.append(mapping.toString());
        }
    }
    if (target != null) {
        sb.append("\n");
        DebugUtil.debugDumpWithLabel(sb, "Target", target.toString(), indent + 1);
    }
    sb.append("\n");
    DebugUtil.debugDumpWithLabelLn(sb, "focusPolicyRules " + ruleCountInfo(focusPolicyRules), focusPolicyRules, indent + 1);
    DebugUtil.debugDumpWithLabelLn(sb, "thisTargetPolicyRules " + ruleCountInfo(thisTargetPolicyRules), thisTargetPolicyRules, indent + 1);
    DebugUtil.debugDumpWithLabelLn(sb, "otherTargetsPolicyRules " + ruleCountInfo(otherTargetsPolicyRules), otherTargetsPolicyRules, indent + 1);
    DebugUtil.debugDumpWithLabelLn(sb, "Present in old object", isPresentInOldObject(), indent + 1);
    DebugUtil.debugDumpWithLabel(sb, "Present in current object", isPresentInCurrentObject(), indent + 1);
    return sb.toString();
}

Example 8 with Authorization

use of com.evolveum.midpoint.security.api.Authorization in project midpoint by Evolveum.

the class AbstractModelIntegrationTest method assertAuthorizations.

protected void assertAuthorizations(MidPointPrincipal principal, String... expectedAuthorizations) {
    List<String> actualAuthorizations = new ArrayList<>();
    for (Authorization authorization : principal.getAuthorities()) {
        actualAuthorizations.addAll(authorization.getAction());
    }
    PrismAsserts.assertSets("Wrong authorizations in " + principal, actualAuthorizations, expectedAuthorizations);
}

Example 9 with Authorization

use of com.evolveum.midpoint.security.api.Authorization in project midpoint by Evolveum.

the class AbstractModelIntegrationTest method loginSuperUser.

protected void loginSuperUser(MidPointPrincipal principal) throws SchemaException {
    AuthorizationType superAutzType = new AuthorizationType();
    prismContext.adopt(superAutzType, RoleType.class, new ItemPath(RoleType.F_AUTHORIZATION));
    superAutzType.getAction().add(AuthorizationConstants.AUTZ_ALL_URL);
    Authorization superAutz = new Authorization(superAutzType);
    Collection<Authorization> authorities = principal.getAuthorities();
    authorities.add(superAutz);
    SecurityContext securityContext = SecurityContextHolder.getContext();
    Authentication authentication = new UsernamePasswordAuthenticationToken(principal, null);
    securityContext.setAuthentication(authentication);
}

Example 10 with Authorization

use of com.evolveum.midpoint.security.api.Authorization in project midpoint by Evolveum.

the class UserProfileServiceImpl method initializePrincipalFromAssignments.

private void initializePrincipalFromAssignments(MidPointPrincipal principal, PrismObject<SystemConfigurationType> systemConfiguration) throws SchemaException {
    UserType userType = principal.getUser();
    Collection<Authorization> authorizations = principal.getAuthorities();
    List<AdminGuiConfigurationType> adminGuiConfigurations = new ArrayList<>();
    Task task = taskManager.createTaskInstance(UserProfileServiceImpl.class.getName() + ".initializePrincipalFromAssignments");
    OperationResult result = task.getResult();
    principal.setApplicableSecurityPolicy(securityHelper.locateSecurityPolicy(userType.asPrismObject(), systemConfiguration, task, result));
    if (!userType.getAssignment().isEmpty()) {
        LensContext<UserType> lensContext = new LensContextPlaceholder<>(userType.asPrismObject(), prismContext);
        AssignmentEvaluator.Builder<UserType> builder = new AssignmentEvaluator.Builder<UserType>().repository(repositoryService).focusOdo(new ObjectDeltaObject<>(userType.asPrismObject(), null, userType.asPrismObject())).channel(null).objectResolver(objectResolver).systemObjectCache(systemObjectCache).prismContext(prismContext).mappingFactory(mappingFactory).mappingEvaluator(mappingEvaluator).activationComputer(activationComputer).now(clock.currentTimeXMLGregorianCalendar()).loginMode(true).lensContext(lensContext);
        AssignmentEvaluator<UserType> assignmentEvaluator = builder.build();
        try {
            RepositoryCache.enter();
            for (AssignmentType assignmentType : userType.getAssignment()) {
                try {
                    ItemDeltaItem<PrismContainerValue<AssignmentType>, PrismContainerDefinition<AssignmentType>> assignmentIdi = new ItemDeltaItem<>();
                    assignmentIdi.setItemOld(LensUtil.createAssignmentSingleValueContainerClone(assignmentType));
                    assignmentIdi.recompute();
                    EvaluatedAssignment<UserType> assignment = assignmentEvaluator.evaluate(assignmentIdi, PlusMinusZero.ZERO, false, userType, userType.toString(), task, result);
                    if (assignment.isValid()) {
                        authorizations.addAll(assignment.getAuthorizations());
                        adminGuiConfigurations.addAll(assignment.getAdminGuiConfigurations());
                    }
                    for (EvaluatedAssignmentTarget target : assignment.getRoles().getNonNegativeValues()) {
                        if (target.getTarget() != null && target.getTarget().asObjectable() instanceof UserType && DeputyUtils.isDelegationPath(target.getAssignmentPath())) {
                            List<OtherPrivilegesLimitationType> limitations = DeputyUtils.extractLimitations(target.getAssignmentPath());
                            principal.addDelegatorWithOtherPrivilegesLimitations(new DelegatorWithOtherPrivilegesLimitations((UserType) target.getTarget().asObjectable(), limitations));
                        }
                    }
                } catch (SchemaException e) {
                    LOGGER.error("Schema violation while processing assignment of {}: {}; assignment: {}", userType, e.getMessage(), assignmentType, e);
                } catch (ObjectNotFoundException e) {
                    LOGGER.error("Object not found while processing assignment of {}: {}; assignment: {}", userType, e.getMessage(), assignmentType, e);
                } catch (ExpressionEvaluationException e) {
                    LOGGER.error("Evaluation error while processing assignment of {}: {}; assignment: {}", userType, e.getMessage(), assignmentType, e);
                } catch (PolicyViolationException e) {
                    LOGGER.error("Policy violation while processing assignment of {}: {}; assignment: {}", userType, e.getMessage(), assignmentType, e);
                }
            }
        } finally {
            RepositoryCache.exit();
        }
    }
    if (userType.getAdminGuiConfiguration() != null) {
        // config from the user object should go last (to be applied as the last one)
        adminGuiConfigurations.add(userType.getAdminGuiConfiguration());
    }
    principal.setAdminGuiConfiguration(AdminGuiConfigTypeUtil.compileAdminGuiConfiguration(adminGuiConfigurations, systemConfiguration));
}