Examples with DelegatorWithOtherPrivilegesLimitations com.evolveum.midpoint.security.api.DelegatorWithOtherPrivilegesLimitations used on opensource projects

Example 1 with DelegatorWithOtherPrivilegesLimitations

use of com.evolveum.midpoint.security.api.DelegatorWithOtherPrivilegesLimitations in project midpoint by Evolveum.

the class QueryUtils method getPotentialAssigneesForUser.

private static List<PrismReferenceValue> getPotentialAssigneesForUser(MidPointPrincipal principal, QName limitationItemName) throws SchemaException {
    List<PrismReferenceValue> rv = new ArrayList<>();
    rv.add(new PrismReferenceValue(principal.getOid(), UserType.COMPLEX_TYPE));
    for (DelegatorWithOtherPrivilegesLimitations delegator : principal.getDelegatorWithOtherPrivilegesLimitationsCollection()) {
        if (DeputyUtils.limitationsAllow(delegator.getLimitations(), limitationItemName)) {
            rv.add(ObjectTypeUtil.createObjectRef(delegator.getDelegator()).asReferenceValue());
        }
    }
    return rv;
}

Example 2 with DelegatorWithOtherPrivilegesLimitations

use of com.evolveum.midpoint.security.api.DelegatorWithOtherPrivilegesLimitations in project midpoint by Evolveum.

the class GuiProfileCompiler method collect.

private void collect(List<AdminGuiConfigurationType> adminGuiConfigurations, GuiProfiledPrincipal principal, AuthorizationTransformer authorizationTransformer, Task task, OperationResult result) throws SchemaException {
    FocusType focusType = principal.getFocus();
    Collection<? extends EvaluatedAssignment<? extends FocusType>> evaluatedAssignments = assignmentCollector.collect(focusType.asPrismObject(), true, task, result);
    Collection<Authorization> authorizations = principal.getAuthorities();
    for (EvaluatedAssignment<? extends FocusType> assignment : evaluatedAssignments) {
        if (assignment.isValid()) {
            addAuthorizations(authorizations, assignment.getAuthorizations(), authorizationTransformer);
            adminGuiConfigurations.addAll(assignment.getAdminGuiConfigurations());
        }
        for (EvaluatedAssignmentTarget target : assignment.getRoles().getNonNegativeValues()) {
            // MID-6403
            if (target.isValid() && target.getTarget().asObjectable() instanceof UserType && DeputyUtils.isDelegationPath(target.getAssignmentPath(), relationRegistry)) {
                List<OtherPrivilegesLimitationType> limitations = DeputyUtils.extractLimitations(target.getAssignmentPath());
                principal.addDelegatorWithOtherPrivilegesLimitations(new DelegatorWithOtherPrivilegesLimitations((UserType) target.getTarget().asObjectable(), limitations));
            }
        }
    }
    if (focusType instanceof UserType && ((UserType) focusType).getAdminGuiConfiguration() != null) {
        // config from the user object should go last (to be applied as the last one)
        adminGuiConfigurations.add(((UserType) focusType).getAdminGuiConfiguration());
    }
}

Example 3 with DelegatorWithOtherPrivilegesLimitations

use of com.evolveum.midpoint.security.api.DelegatorWithOtherPrivilegesLimitations in project midpoint by Evolveum.

the class QueryUtils method getPotentialAssigneesForUser.

private static List<PrismReferenceValue> getPotentialAssigneesForUser(MidPointPrincipal principal, QName limitationItemName, RelationRegistry relationRegistry) {
    // As for relations, WorkItem.assigneeRef should contain only the default ones.
    QName defaultRelation = relationRegistry.getDefaultRelation();
    List<PrismReferenceValue> rv = new ArrayList<>();
    rv.add(ObjectTypeUtil.createObjectRef(principal.getOid(), ObjectTypes.USER).relation(defaultRelation).asReferenceValue());
    for (DelegatorWithOtherPrivilegesLimitations delegator : principal.getDelegatorWithOtherPrivilegesLimitationsCollection()) {
        if (SchemaDeputyUtil.limitationsAllow(delegator.getLimitations(), limitationItemName)) {
            rv.add(ObjectTypeUtil.createObjectRef(delegator.getDelegator(), defaultRelation).asReferenceValue());
        }
    }
    return rv;
}

Example 4 with DelegatorWithOtherPrivilegesLimitations

use of com.evolveum.midpoint.security.api.DelegatorWithOtherPrivilegesLimitations in project midpoint by Evolveum.

the class UserProfileServiceImpl method initializePrincipalFromAssignments.

private void initializePrincipalFromAssignments(MidPointPrincipal principal, PrismObject<SystemConfigurationType> systemConfiguration) throws SchemaException {
    UserType userType = principal.getUser();
    Collection<Authorization> authorizations = principal.getAuthorities();
    List<AdminGuiConfigurationType> adminGuiConfigurations = new ArrayList<>();
    Task task = taskManager.createTaskInstance(UserProfileServiceImpl.class.getName() + ".initializePrincipalFromAssignments");
    OperationResult result = task.getResult();
    principal.setApplicableSecurityPolicy(securityHelper.locateSecurityPolicy(userType.asPrismObject(), systemConfiguration, task, result));
    if (!userType.getAssignment().isEmpty()) {
        LensContext<UserType> lensContext = new LensContextPlaceholder<>(userType.asPrismObject(), prismContext);
        AssignmentEvaluator.Builder<UserType> builder = new AssignmentEvaluator.Builder<UserType>().repository(repositoryService).focusOdo(new ObjectDeltaObject<>(userType.asPrismObject(), null, userType.asPrismObject())).channel(null).objectResolver(objectResolver).systemObjectCache(systemObjectCache).prismContext(prismContext).mappingFactory(mappingFactory).mappingEvaluator(mappingEvaluator).activationComputer(activationComputer).now(clock.currentTimeXMLGregorianCalendar()).loginMode(true).lensContext(lensContext);
        AssignmentEvaluator<UserType> assignmentEvaluator = builder.build();
        try {
            RepositoryCache.enter();
            for (AssignmentType assignmentType : userType.getAssignment()) {
                try {
                    ItemDeltaItem<PrismContainerValue<AssignmentType>, PrismContainerDefinition<AssignmentType>> assignmentIdi = new ItemDeltaItem<>();
                    assignmentIdi.setItemOld(LensUtil.createAssignmentSingleValueContainerClone(assignmentType));
                    assignmentIdi.recompute();
                    EvaluatedAssignment<UserType> assignment = assignmentEvaluator.evaluate(assignmentIdi, PlusMinusZero.ZERO, false, userType, userType.toString(), task, result);
                    if (assignment.isValid()) {
                        authorizations.addAll(assignment.getAuthorizations());
                        adminGuiConfigurations.addAll(assignment.getAdminGuiConfigurations());
                    }
                    for (EvaluatedAssignmentTarget target : assignment.getRoles().getNonNegativeValues()) {
                        if (target.getTarget() != null && target.getTarget().asObjectable() instanceof UserType && DeputyUtils.isDelegationPath(target.getAssignmentPath())) {
                            List<OtherPrivilegesLimitationType> limitations = DeputyUtils.extractLimitations(target.getAssignmentPath());
                            principal.addDelegatorWithOtherPrivilegesLimitations(new DelegatorWithOtherPrivilegesLimitations((UserType) target.getTarget().asObjectable(), limitations));
                        }
                    }
                } catch (SchemaException e) {
                    LOGGER.error("Schema violation while processing assignment of {}: {}; assignment: {}", userType, e.getMessage(), assignmentType, e);
                } catch (ObjectNotFoundException e) {
                    LOGGER.error("Object not found while processing assignment of {}: {}; assignment: {}", userType, e.getMessage(), assignmentType, e);
                } catch (ExpressionEvaluationException e) {
                    LOGGER.error("Evaluation error while processing assignment of {}: {}; assignment: {}", userType, e.getMessage(), assignmentType, e);
                } catch (PolicyViolationException e) {
                    LOGGER.error("Policy violation while processing assignment of {}: {}; assignment: {}", userType, e.getMessage(), assignmentType, e);
                }
            }
        } finally {
            RepositoryCache.exit();
        }
    }
    if (userType.getAdminGuiConfiguration() != null) {
        // config from the user object should go last (to be applied as the last one)
        adminGuiConfigurations.add(userType.getAdminGuiConfiguration());
    }
    principal.setAdminGuiConfiguration(AdminGuiConfigTypeUtil.compileAdminGuiConfiguration(adminGuiConfigurations, systemConfiguration));
}

Example 5 with DelegatorWithOtherPrivilegesLimitations

use of com.evolveum.midpoint.security.api.DelegatorWithOtherPrivilegesLimitations in project midpoint by Evolveum.

the class TestGuiProfiledPrincipalManager method executeDeputyLimitationsTest.

private void executeDeputyLimitationsTest(List<OtherPrivilegesLimitationType> expectedLimitations, Consumer<AssignmentType> assignmentModifier) throws CommonException {
    // GIVEN
    AssignmentType assignment = new AssignmentType().targetRef(USER_JACK_OID, UserType.COMPLEX_TYPE, SchemaConstants.ORG_DEPUTY);
    if (assignmentModifier != null) {
        assignmentModifier.accept(assignment);
    }
    UserType deputy = prismContext.createObjectable(UserType.class).name("deputy").oid("deputy").assignment(assignment);
    // WHEN
    when();
    AbstractIntegrationTest.display("Logging in as", deputy);
    login(deputy.asPrismObject());
    // THEN
    then();
    MidPointPrincipal principal = securityContextManager.getPrincipal();
    Collection<DelegatorWithOtherPrivilegesLimitations> delegators = principal.getDelegatorWithOtherPrivilegesLimitationsCollection();
    AbstractIntegrationTest.display("delegators with other privileges limitations", delegators);
    if (expectedLimitations == null) {
        AssertJUnit.assertEquals("Wrong # of delegator records: " + DebugUtil.debugDump(delegators), 0, delegators.size());
    } else {
        AssertJUnit.assertEquals("Wrong # of delegator records: " + DebugUtil.debugDump(delegators), 1, delegators.size());
        DelegatorWithOtherPrivilegesLimitations record = delegators.iterator().next();
        AssertJUnit.assertEquals("Unexpected limitations: " + DebugUtil.debugDump(delegators), new HashSet<>(expectedLimitations), new HashSet<>(record.getLimitations()));
    }
}