Examples with MidPointPrincipal com.evolveum.midpoint.security.api.MidPointPrincipal used on opensource projects

Example 71 with MidPointPrincipal

use of com.evolveum.midpoint.security.api.MidPointPrincipal in project midpoint by Evolveum.

the class TestValidityRecomputeTask method testJackAssignRoleJudgeInvalid.

private void testJackAssignRoleJudgeInvalid(final String TEST_NAME, ActivationType activationType, Task task, OperationResult result) throws Exception {
    // WHEN
    TestUtil.displayWhen(TEST_NAME);
    assignRole(USER_JACK_OID, ROLE_BIG_JUDGE_OID, activationType, task, result);
    // THEN
    TestUtil.displayThen(TEST_NAME);
    assertNoDummyAccount(null, USER_JACK_USERNAME);
    // WHEN
    TestUtil.displayWhen(TEST_NAME);
    waitForTaskNextRunAssertSuccess(TASK_VALIDITY_SCANNER_OID, true);
    // THEN
    TestUtil.displayThen(TEST_NAME);
    assertNoDummyAccount(null, USER_JACK_USERNAME);
    assertNoDummyAccount(RESOURCE_DUMMY_RED_NAME, USER_JACK_USERNAME);
    PrismObject<UserType> user = getUser(USER_JACK_OID);
    display("User after", user);
    assertNoLinkedAccount(user);
    assert11xUserOk(user);
    MidPointPrincipal principal = userProfileService.getPrincipal(user);
    assertNotAuthorized(principal, AUTZ_PUNISH_URL);
    // CLEANUP
    unassignAllRoles(USER_JACK_OID);
    assertNoDummyAccount(null, USER_JACK_USERNAME);
}

Example 72 with MidPointPrincipal

use of com.evolveum.midpoint.security.api.MidPointPrincipal in project midpoint by Evolveum.

the class WorkItemManager method releaseWorkItem.

public void releaseWorkItem(String workItemId, OperationResult parentResult) throws ObjectNotFoundException, SecurityViolationException {
    OperationResult result = parentResult.createSubresult(OPERATION_RELEASE_WORK_ITEM);
    result.addParam("workItemId", workItemId);
    try {
        MidPointPrincipal principal = securityEnforcer.getPrincipal();
        result.addContext("user", toShortString(principal.getUser()));
        if (LOGGER.isTraceEnabled()) {
            LOGGER.trace("Releasing work item {} by {}", workItemId, toShortString(principal.getUser()));
        }
        TaskService taskService = activitiEngine.getTaskService();
        Task task = taskService.createTaskQuery().taskId(workItemId).singleResult();
        if (task == null) {
            throw new ObjectNotFoundException("The work item does not exist");
        }
        if (task.getAssignee() == null) {
            throw new SystemException("The work item is not assigned to a user");
        }
        if (!MiscDataUtil.stringToRef(task.getAssignee()).getOid().equals(principal.getOid())) {
            throw new SystemException("The work item is not assigned to the current user");
        }
        boolean candidateFound = false;
        for (IdentityLink link : taskService.getIdentityLinksForTask(workItemId)) {
            if (IdentityLinkType.CANDIDATE.equals(link.getType())) {
                candidateFound = true;
                break;
            }
        }
        if (!candidateFound) {
            throw new SystemException("It has no candidates to be offered to");
        }
        taskService.unclaim(workItemId);
        task = taskService.createTaskQuery().taskId(workItemId).singleResult();
        if (task == null) {
            throw new ObjectNotFoundException("The work item does not exist");
        }
        setNewAssignees(task, Collections.emptyList(), taskService);
    } catch (ObjectNotFoundException | SecurityViolationException | RuntimeException e) {
        result.recordFatalError("Couldn't release work item " + workItemId + ": " + e.getMessage(), e);
        throw e;
    } finally {
        result.computeStatusIfUnknown();
    }
}

Example 73 with MidPointPrincipal

use of com.evolveum.midpoint.security.api.MidPointPrincipal in project midpoint by Evolveum.

the class WorkItemManager method claimWorkItem.

public void claimWorkItem(String workItemId, OperationResult parentResult) throws SecurityViolationException, ObjectNotFoundException {
    OperationResult result = parentResult.createSubresult(OPERATION_CLAIM_WORK_ITEM);
    result.addParam("workItemId", workItemId);
    try {
        MidPointPrincipal principal = securityEnforcer.getPrincipal();
        result.addContext("user", toShortString(principal.getUser()));
        if (LOGGER.isTraceEnabled()) {
            LOGGER.trace("Claiming work item {} by {}", workItemId, toShortString(principal.getUser()));
        }
        TaskService taskService = activitiEngine.getTaskService();
        Task task = taskService.createTaskQuery().taskId(workItemId).singleResult();
        if (task == null) {
            throw new ObjectNotFoundException("The work item does not exist");
        }
        if (task.getAssignee() != null) {
            String desc = MiscDataUtil.stringToRef(task.getAssignee()).getOid().equals(principal.getOid()) ? "the current" : "another";
            throw new SystemException("The work item is already assigned to " + desc + " user");
        }
        if (!miscDataUtil.isAuthorizedToClaim(task.getId())) {
            throw new SecurityViolationException("You are not authorized to claim the selected work item.");
        }
        taskService.claim(workItemId, principal.getOid());
        task = taskService.createTaskQuery().taskId(workItemId).singleResult();
        if (task == null) {
            throw new ObjectNotFoundException("The work item does not exist");
        }
        setNewAssignees(task, Collections.singletonList(ObjectTypeUtil.createObjectRef(principal.getOid(), ObjectTypes.USER)), taskService);
    } catch (ObjectNotFoundException | SecurityViolationException | RuntimeException e) {
        result.recordFatalError("Couldn't claim the work item " + workItemId + ": " + e.getMessage(), e);
        throw e;
    } finally {
        result.computeStatusIfUnknown();
    }
}

Example 74 with MidPointPrincipal

use of com.evolveum.midpoint.security.api.MidPointPrincipal in project midpoint by Evolveum.

the class WorkItemManager method delegateWorkItem.

// TODO when calling from model API, what should we put into escalationLevelName+DisplayName ?
// Probably the API should look different. E.g. there could be an "Escalate" button, that would look up the
// appropriate escalation timed action, and invoke it. We'll solve this when necessary. Until that time, be
// aware that escalationLevelName/DisplayName are for internal use only.
public void delegateWorkItem(String workItemId, List<ObjectReferenceType> delegates, WorkItemDelegationMethodType method, WorkItemEscalationLevelType escalation, Duration newDuration, WorkItemEventCauseInformationType causeInformation, OperationResult parentResult) throws ObjectNotFoundException, SecurityViolationException, SchemaException {
    OperationResult result = parentResult.createSubresult(OPERATION_DELEGATE_WORK_ITEM);
    result.addParam("workItemId", workItemId);
    result.addParam("escalation", escalation);
    result.addCollectionOfSerializablesAsParam("delegates", delegates);
    try {
        MidPointPrincipal principal = securityEnforcer.getPrincipal();
        result.addContext("user", toShortString(principal.getUser()));
        ObjectReferenceType initiator = causeInformation == null || causeInformation.getType() == WorkItemEventCauseTypeType.USER_ACTION ? ObjectTypeUtil.createObjectRef(principal.getUser()) : null;
        LOGGER.trace("Delegating work item {} to {}: escalation={}; cause={}", workItemId, delegates, escalation != null ? escalation.getName() + "/" + escalation.getDisplayName() : "none", causeInformation);
        WorkItemType workItem = workItemProvider.getWorkItem(workItemId, result);
        if (!miscDataUtil.isAuthorized(workItem, MiscDataUtil.RequestedOperation.DELEGATE)) {
            throw new SecurityViolationException("You are not authorized to delegate this work item.");
        }
        List<ObjectReferenceType> assigneesBefore = CloneUtil.cloneCollectionMembers(workItem.getAssigneeRef());
        WorkItemOperationKindType operationKind = escalation != null ? ESCALATE : DELEGATE;
        com.evolveum.midpoint.task.api.Task wfTask = taskManager.getTask(WfContextUtil.getTask(workItem).getOid(), result);
        WorkItemAllocationChangeOperationInfo operationInfoBefore = new WorkItemAllocationChangeOperationInfo(operationKind, assigneesBefore, null);
        WorkItemOperationSourceInfo sourceInfo = new WorkItemOperationSourceInfo(initiator, causeInformation, null);
        wfTaskController.notifyWorkItemAllocationChangeCurrentActors(workItem, operationInfoBefore, sourceInfo, null, wfTask, result);
        if (method == null) {
            method = WorkItemDelegationMethodType.REPLACE_ASSIGNEES;
        }
        List<ObjectReferenceType> newAssignees = new ArrayList<>();
        List<ObjectReferenceType> delegatedTo = new ArrayList<>();
        WfContextUtil.computeAssignees(newAssignees, delegatedTo, delegates, method, workItem);
        // don't change the current assignee, if not necessary
        TaskService taskService = activitiEngine.getTaskService();
        Task task = taskService.createTaskQuery().taskId(workItemId).singleResult();
        setNewAssignees(task, newAssignees, taskService);
        Date deadline = task.getDueDate();
        if (newDuration != null) {
            deadline = setNewDuration(task.getId(), newDuration, taskService);
        }
        Map<String, Object> variables = taskService.getVariables(workItemId);
        int escalationLevel = WfContextUtil.getEscalationLevelNumber(workItem);
        WorkItemEscalationLevelType newEscalation = WfContextUtil.createNewEscalation(escalationLevel, escalation);
        WorkItemDelegationEventType event = WfContextUtil.createDelegationEvent(newEscalation, assigneesBefore, delegatedTo, method, causeInformation);
        if (newEscalation != null) {
            escalationLevel++;
            taskService.setVariableLocal(workItemId, CommonProcessVariableNames.VARIABLE_ESCALATION_LEVEL_NUMBER, newEscalation.getNumber());
            taskService.setVariableLocal(workItemId, CommonProcessVariableNames.VARIABLE_ESCALATION_LEVEL_NAME, newEscalation.getName());
            taskService.setVariableLocal(workItemId, CommonProcessVariableNames.VARIABLE_ESCALATION_LEVEL_DISPLAY_NAME, newEscalation.getDisplayName());
        }
        ActivitiUtil.fillInWorkItemEvent(event, principal, workItemId, variables, prismContext);
        MidpointUtil.recordEventInTask(event, null, ActivitiUtil.getTaskOid(variables), result);
        ApprovalStageDefinitionType level = WfContextUtil.getCurrentStageDefinition(wfTask.getWorkflowContext());
        MidpointUtil.createTriggersForTimedActions(workItemId, escalationLevel, XmlTypeConverter.toDate(workItem.getCreateTimestamp()), deadline, wfTask, level.getTimedActions(), result);
        WorkItemType workItemAfter = workItemProvider.getWorkItem(workItemId, result);
        com.evolveum.midpoint.task.api.Task wfTaskAfter = taskManager.getTask(wfTask.getOid(), result);
        WorkItemAllocationChangeOperationInfo operationInfoAfter = new WorkItemAllocationChangeOperationInfo(operationKind, assigneesBefore, workItemAfter.getAssigneeRef());
        wfTaskController.notifyWorkItemAllocationChangeNewActors(workItemAfter, operationInfoAfter, sourceInfo, wfTaskAfter, result);
    } catch (SecurityViolationException | RuntimeException | ObjectNotFoundException | SchemaException e) {
        result.recordFatalError("Couldn't delegate/escalate work item " + workItemId + ": " + e.getMessage(), e);
        throw e;
    } finally {
        result.computeStatusIfUnknown();
    }
}

Example 75 with MidPointPrincipal

use of com.evolveum.midpoint.security.api.MidPointPrincipal in project midpoint by Evolveum.

the class TaskCompleteListener method notify.

@Override
public void notify(DelegateTask delegateTask) {
    DelegateExecution execution = delegateTask.getExecution();
    PrismContext prismContext = getPrismContext();
    OperationResult opResult = new OperationResult(TaskCompleteListener.class.getName() + ".notify");
    Task wfTask = ActivitiUtil.getTask(execution, opResult);
    ApprovalStageDefinitionType stageDef = ActivitiUtil.getAndVerifyCurrentStage(execution, wfTask, true, prismContext);
    delegateTask.setVariableLocal(CommonProcessVariableNames.VARIABLE_WORK_ITEM_WAS_COMPLETED, Boolean.TRUE);
    //		System.out.println("%%% Task " + delegateTask + " has been completed.");
    //		LOGGER.info("%%% Task {} has been completed", delegateTask);
    MidPointPrincipal user;
    try {
        user = SecurityUtil.getPrincipal();
    } catch (SecurityViolationException e) {
        throw new SystemException("Couldn't record a decision: " + e.getMessage(), e);
    }
    if (user != null && user.getOid() != null) {
        delegateTask.setVariableLocal(CommonProcessVariableNames.VARIABLE_WORK_ITEM_COMPLETED_BY, user.getOid());
    }
    LOGGER.trace("======================================== Recording individual decision of {}", user);
    @NotNull WorkItemResultType result1 = getItemApprovalProcessInterface().extractWorkItemResult(delegateTask.getVariables());
    boolean isApproved = ApprovalUtils.isApproved(result1);
    LevelEvaluationStrategyType levelEvaluationStrategyType = stageDef.getEvaluationStrategy();
    Boolean setLoopApprovesInStageStop = null;
    if (levelEvaluationStrategyType == LevelEvaluationStrategyType.FIRST_DECIDES) {
        LOGGER.trace("Setting " + LOOP_APPROVERS_IN_STAGE_STOP + " to true, because the stage evaluation strategy is 'firstDecides'.");
        setLoopApprovesInStageStop = true;
    } else if ((levelEvaluationStrategyType == null || levelEvaluationStrategyType == LevelEvaluationStrategyType.ALL_MUST_AGREE) && !isApproved) {
        LOGGER.trace("Setting " + LOOP_APPROVERS_IN_STAGE_STOP + " to true, because the stage eval strategy is 'allMustApprove' and the decision was 'reject'.");
        setLoopApprovesInStageStop = true;
    }
    if (setLoopApprovesInStageStop != null) {
        //noinspection ConstantConditions
        execution.setVariable(LOOP_APPROVERS_IN_STAGE_STOP, setLoopApprovesInStageStop);
    }
    if (LOGGER.isDebugEnabled()) {
        LOGGER.debug("Approval process instance {} (id {}), stage {}: recording decision {}; stage stops now: {}", execution.getVariable(CommonProcessVariableNames.VARIABLE_PROCESS_INSTANCE_NAME), execution.getProcessInstanceId(), WfContextUtil.getStageDiagName(stageDef), result1.getOutcome(), setLoopApprovesInStageStop);
    }
    getActivitiInterface().notifyMidpointAboutTaskEvent(delegateTask);
    getActivitiInterface().notifyMidpointAboutProcessEvent(execution);
}