Examples with PolicyViolationException com.evolveum.midpoint.util.exception.PolicyViolationException used on opensource projects

Example 11 with PolicyViolationException

use of com.evolveum.midpoint.util.exception.PolicyViolationException in project midpoint by Evolveum.

the class ProjectionValuesProcessor method checkSchemaAndPolicies.

/**
	 * Check that the primary deltas do not violate schema and policies
	 * TODO: implement schema check 
	 */
public <F extends ObjectType> void checkSchemaAndPolicies(LensContext<F> context, LensProjectionContext accountContext, String activityDescription, OperationResult result) throws SchemaException, PolicyViolationException {
    ObjectDelta<ShadowType> primaryDelta = accountContext.getPrimaryDelta();
    if (primaryDelta == null || primaryDelta.isDelete()) {
        return;
    }
    RefinedObjectClassDefinition rAccountDef = accountContext.getCompositeObjectClassDefinition();
    if (rAccountDef == null) {
        throw new SchemaException("No definition for account type '" + accountContext.getResourceShadowDiscriminator() + "' in " + accountContext.getResource());
    }
    if (primaryDelta.isAdd()) {
        PrismObject<ShadowType> accountToAdd = primaryDelta.getObjectToAdd();
        ResourceAttributeContainer attributesContainer = ShadowUtil.getAttributesContainer(accountToAdd);
        if (attributesContainer != null) {
            for (ResourceAttribute<?> attribute : attributesContainer.getAttributes()) {
                RefinedAttributeDefinition rAttrDef = rAccountDef.findAttributeDefinition(attribute.getElementName());
                if (!rAttrDef.isTolerant()) {
                    throw new PolicyViolationException("Attempt to add object with non-tolerant attribute " + attribute.getElementName() + " in " + "account " + accountContext.getResourceShadowDiscriminator() + " during " + activityDescription);
                }
            }
        }
    } else if (primaryDelta.isModify()) {
        for (ItemDelta<?, ?> modification : primaryDelta.getModifications()) {
            if (modification.getParentPath().equivalent(SchemaConstants.PATH_ATTRIBUTES)) {
                PropertyDelta<?> attrDelta = (PropertyDelta<?>) modification;
                RefinedAttributeDefinition rAttrDef = rAccountDef.findAttributeDefinition(attrDelta.getElementName());
                if (!rAttrDef.isTolerant()) {
                    throw new PolicyViolationException("Attempt to modify non-tolerant attribute " + attrDelta.getElementName() + " in " + "account " + accountContext.getResourceShadowDiscriminator() + " during " + activityDescription);
                }
            }
        }
    } else {
        throw new IllegalStateException("Whoops!");
    }
}

Example 12 with PolicyViolationException

use of com.evolveum.midpoint.util.exception.PolicyViolationException in project midpoint by Evolveum.

the class Projector method projectInternal.

private <F extends ObjectType> void projectInternal(LensContext<F> context, String activityDescription, boolean fromStart, boolean allWaves, Task task, OperationResult parentResult) throws SchemaException, PolicyViolationException, ExpressionEvaluationException, ObjectNotFoundException, ObjectAlreadyExistsException, CommunicationException, ConfigurationException, SecurityViolationException {
    context.checkAbortRequested();
    if (context.getDebugListener() != null) {
        context.getDebugListener().beforeProjection(context);
    }
    // Read the time at the beginning so all processors have the same notion of "now"
    // this provides nicer unified timestamp that can be used in equality checks in tests and also for
    // troubleshooting
    XMLGregorianCalendar now = clock.currentTimeXMLGregorianCalendar();
    String traceTitle = fromStart ? "projector start" : "projector resume";
    LensUtil.traceContext(LOGGER, activityDescription, traceTitle, false, context, false);
    if (consistencyChecks)
        context.checkConsistence();
    if (fromStart) {
        context.normalize();
        context.resetProjectionWave();
    }
    OperationResult result = parentResult.createSubresult(Projector.class.getName() + ".project");
    result.addParam("fromStart", fromStart);
    result.addContext("projectionWave", context.getProjectionWave());
    result.addContext("executionWave", context.getExecutionWave());
    PartialProcessingOptionsType partialProcessingOptions = context.getPartialProcessingOptions();
    try {
        context.reportProgress(new ProgressInformation(PROJECTOR, ENTERING));
        if (fromStart) {
            LensUtil.partialExecute("load", () -> {
                contextLoader.load(context, activityDescription, task, result);
                // Set the "fresh" mark now so following consistency check will be stricter
                context.setFresh(true);
                if (consistencyChecks)
                    context.checkConsistence();
            }, partialProcessingOptions::getLoad, result);
        }
        // For now let's pretend to do just one wave. The maxWaves number will be corrected in the
        // first wave when dependencies are sorted out for the first time.
        int maxWaves = context.getExecutionWave() + 1;
        // Start the waves ....
        LOGGER.trace("WAVE: Starting the waves.");
        boolean firstWave = true;
        while ((allWaves && context.getProjectionWave() < maxWaves) || (!allWaves && context.getProjectionWave() <= context.getExecutionWave())) {
            boolean inFirstWave = firstWave;
            // in order to not forget to reset it ;)
            firstWave = false;
            context.checkAbortRequested();
            LOGGER.trace("WAVE {} (maxWaves={}, executionWave={})", context.getProjectionWave(), maxWaves, context.getExecutionWave());
            //just make sure everything is loaded and set as needed
            dependencyProcessor.preprocessDependencies(context);
            // Process the focus-related aspects of the context. That means inbound, focus activation,
            // object template and assignments.
            LensUtil.partialExecute("focus", () -> {
                focusProcessor.processFocus(context, activityDescription, now, task, result);
                context.recomputeFocus();
                if (consistencyChecks)
                    context.checkConsistence();
            }, partialProcessingOptions::getFocus, result);
            LensUtil.traceContext(LOGGER, activityDescription, "focus processing", false, context, false);
            LensUtil.checkContextSanity(context, "focus processing", result);
            // a projection is provisioned or deprovisioned only after the activation is processed.
            if (fromStart && inFirstWave) {
                LOGGER.trace("Processing activation for all contexts");
                for (LensProjectionContext projectionContext : context.getProjectionContexts()) {
                    if (projectionContext.getSynchronizationPolicyDecision() == SynchronizationPolicyDecision.BROKEN || projectionContext.getSynchronizationPolicyDecision() == SynchronizationPolicyDecision.IGNORE) {
                        continue;
                    }
                    activationProcessor.processActivation(context, projectionContext, now, task, result);
                    projectionContext.recompute();
                }
                // TODO move implementation of this method elsewhere; but it has to be invoked here, as activationProcessor sets the IGNORE flag
                assignmentProcessor.removeIgnoredContexts(context);
            }
            LensUtil.traceContext(LOGGER, activityDescription, "projection activation of all resources", true, context, true);
            if (consistencyChecks)
                context.checkConsistence();
            dependencyProcessor.sortProjectionsToWaves(context);
            maxWaves = dependencyProcessor.computeMaxWaves(context);
            LOGGER.trace("Continuing wave {}, maxWaves={}", context.getProjectionWave(), maxWaves);
            for (LensProjectionContext projectionContext : context.getProjectionContexts()) {
                LensUtil.partialExecute("projection " + projectionContext.getHumanReadableName(), () -> projectProjection(context, projectionContext, partialProcessingOptions, now, activityDescription, task, result), partialProcessingOptions::getProjection);
            // TODO: make this condition more complex in the future. We may want the ability
            // to select only some projections to process
            }
            // if there exists some conflicting projection contexts, add them to the context so they will be recomputed in the next wave..
            addConflictingContexts(context);
            if (consistencyChecks)
                context.checkConsistence();
            context.incrementProjectionWave();
        }
        LOGGER.trace("WAVE: Stopping the waves. There was {} waves", context.getProjectionWave());
        // We can do this only when computation of all the waves is finished. Before that we do not know
        // activation of every account and therefore cannot decide what is OK and what is not
        dependencyProcessor.checkDependenciesFinal(context, result);
        if (consistencyChecks)
            context.checkConsistence();
        computeResultStatus(now, result);
    } catch (SchemaException | PolicyViolationException | ExpressionEvaluationException | ObjectAlreadyExistsException | ObjectNotFoundException | CommunicationException | ConfigurationException | SecurityViolationException e) {
        recordFatalError(e, now, result);
        throw e;
    } catch (RuntimeException e) {
        recordFatalError(e, now, result);
        // This should not normally happen unless there is something really bad or there is a bug.
        // Make sure that it is logged.
        LOGGER.error("Runtime error in projector: {}", e.getMessage(), e);
        throw e;
    } finally {
        if (context.getDebugListener() != null) {
            context.getDebugListener().afterProjection(context);
        }
        context.reportProgress(new ProgressInformation(PROJECTOR, result));
    }
}

Example 13 with PolicyViolationException

use of com.evolveum.midpoint.util.exception.PolicyViolationException in project midpoint by Evolveum.

the class Projector method projectProjection.

private <F extends ObjectType> void projectProjection(LensContext<F> context, LensProjectionContext projectionContext, PartialProcessingOptionsType partialProcessingOptions, XMLGregorianCalendar now, String activityDescription, Task task, OperationResult parentResult) throws ObjectNotFoundException, CommunicationException, SchemaException, ConfigurationException, SecurityViolationException, PolicyViolationException, ExpressionEvaluationException, ObjectAlreadyExistsException {
    if (projectionContext.getWave() != context.getProjectionWave()) {
        // Let's skip accounts that do not belong into this wave.
        return;
    }
    String projectionDesc = getProjectionDesc(projectionContext);
    OperationResult result = parentResult.createMinorSubresult(OPERATION_PROJECT_PROJECTION);
    result.addParam(OperationResult.PARAM_PROJECTION, projectionDesc);
    try {
        context.checkAbortRequested();
        if (projectionContext.getSynchronizationPolicyDecision() == SynchronizationPolicyDecision.BROKEN || projectionContext.getSynchronizationPolicyDecision() == SynchronizationPolicyDecision.IGNORE) {
            result.recordStatus(OperationResultStatus.NOT_APPLICABLE, "Skipping projection because it is " + projectionContext.getSynchronizationPolicyDecision());
            return;
        }
        if (projectionContext.isThombstone()) {
            result.recordStatus(OperationResultStatus.NOT_APPLICABLE, "Skipping projection because it is a thombstone");
            return;
        }
        LOGGER.trace("WAVE {} PROJECTION {}", context.getProjectionWave(), projectionDesc);
        // Some projections may not be loaded at this point, e.g. high-order dependency projections
        contextLoader.makeSureProjectionIsLoaded(context, projectionContext, task, result);
        if (consistencyChecks)
            context.checkConsistence();
        if (!dependencyProcessor.checkDependencies(context, projectionContext, result)) {
            result.recordStatus(OperationResultStatus.NOT_APPLICABLE, "Skipping projection because it has unsatisfied dependencies");
            return;
        }
        // TODO: decide if we need to continue
        LensUtil.partialExecute("projectionValues", () -> {
            // This is a "composite" processor. it contains several more processor invocations inside
            projectionValuesProcessor.process(context, projectionContext, activityDescription, task, result);
            if (consistencyChecks)
                context.checkConsistence();
            projectionContext.recompute();
            if (consistencyChecks)
                context.checkConsistence();
        }, partialProcessingOptions::getProjectionValues);
        LensUtil.partialExecute("projectionCredentials", () -> {
            projectionCredentialsProcessor.processProjectionCredentials(context, projectionContext, now, task, result);
            if (consistencyChecks)
                context.checkConsistence();
            projectionContext.recompute();
            LensUtil.traceContext(LOGGER, activityDescription, "projection values and credentials of " + projectionDesc, false, context, true);
            if (consistencyChecks)
                context.checkConsistence();
        }, partialProcessingOptions::getProjectionCredentials);
        LensUtil.partialExecute("projectionReconciliation", () -> {
            reconciliationProcessor.processReconciliation(context, projectionContext, task, result);
            projectionContext.recompute();
            LensUtil.traceContext(LOGGER, activityDescription, "projection reconciliation of " + projectionDesc, false, context, false);
            if (consistencyChecks)
                context.checkConsistence();
        }, partialProcessingOptions::getProjectionReconciliation);
        LensUtil.partialExecute("projectionLifecycle", () -> {
            activationProcessor.processLifecycle(context, projectionContext, now, task, result);
            if (consistencyChecks)
                context.checkConsistence();
            projectionContext.recompute();
            //				    	LensUtil.traceContext(LOGGER, activityDescription, "projection lifecycle of "+projectionDesc, false, context, false);
            if (consistencyChecks)
                context.checkConsistence();
        }, partialProcessingOptions::getProjectionLifecycle);
        result.recordSuccess();
    } catch (ObjectNotFoundException | CommunicationException | SchemaException | ConfigurationException | SecurityViolationException | PolicyViolationException | ExpressionEvaluationException | ObjectAlreadyExistsException | RuntimeException | Error e) {
        result.recordFatalError(e);
        ResourceType resourceType = projectionContext.getResource();
        if (resourceType == null) {
            throw e;
        } else {
            ErrorSelectorType errorSelector = null;
            if (resourceType.getConsistency() != null) {
                errorSelector = resourceType.getConsistency().getConnectorErrorCriticality();
            }
            if (errorSelector == null) {
                if (e instanceof CommunicationException) {
                // Just continue evaluation. The error is recorded in the result.
                // The consistency mechanism has (most likely) already done the best.
                // We cannot do any better.
                } else {
                    throw e;
                }
            } else {
                if (ExceptionUtil.isSelected(errorSelector, e)) {
                    throw e;
                } else {
                // Just continue evaluation. The error is recorded in the result.
                }
            }
        }
    }
}

Example 14 with PolicyViolationException

use of com.evolveum.midpoint.util.exception.PolicyViolationException in project midpoint by Evolveum.

the class ContextLoader method getOrCreateAccountContext.

private <F extends FocusType> LensProjectionContext getOrCreateAccountContext(LensContext<F> context, PrismObject<ShadowType> projection, Task task, OperationResult result) throws ObjectNotFoundException, CommunicationException, SchemaException, ConfigurationException, SecurityViolationException, PolicyViolationException, ExpressionEvaluationException {
    ShadowType accountType = projection.asObjectable();
    String resourceOid = ShadowUtil.getResourceOid(accountType);
    if (resourceOid == null) {
        throw new SchemaException("The " + projection + " has null resource reference OID");
    }
    LensProjectionContext projectionContext = context.findProjectionContextByOid(accountType.getOid());
    if (projectionContext == null) {
        String intent = ShadowUtil.getIntent(accountType);
        ShadowKindType kind = ShadowUtil.getKind(accountType);
        ResourceType resource = LensUtil.getResourceReadOnly(context, resourceOid, provisioningService, task, result);
        intent = LensUtil.refineProjectionIntent(kind, intent, resource, prismContext);
        boolean thombstone = false;
        if (ShadowUtil.isDead(accountType)) {
            thombstone = true;
        }
        ResourceShadowDiscriminator rsd = new ResourceShadowDiscriminator(resourceOid, kind, intent, thombstone);
        projectionContext = LensUtil.getOrCreateProjectionContext(context, rsd);
        if (projectionContext.getOid() == null) {
            projectionContext.setOid(projection.getOid());
        } else if (projection.getOid() != null && !projectionContext.getOid().equals(projection.getOid())) {
            // slightly inefficient here and check for existing shadow existence
            try {
                GetOperationOptions rootOpt = GetOperationOptions.createPointInTimeType(PointInTimeType.FUTURE);
                rootOpt.setDoNotDiscovery(true);
                Collection<SelectorOptions<GetOperationOptions>> opts = SelectorOptions.createCollection(rootOpt);
                LOGGER.trace("Projection conflict detected, exsting: {}, new {}", projectionContext.getOid(), projection.getOid());
                PrismObject<ShadowType> existingShadow = provisioningService.getObject(ShadowType.class, projectionContext.getOid(), opts, task, result);
                // Maybe it is the other way around
                try {
                    PrismObject<ShadowType> newShadow = provisioningService.getObject(ShadowType.class, projection.getOid(), opts, task, result);
                    // Obviously, two projections with the same discriminator exists
                    if (LOGGER.isTraceEnabled()) {
                        LOGGER.trace("Projection {} already exists in context\nExisting:\n{}\nNew:\n{}", new Object[] { rsd, existingShadow.debugDump(1), newShadow.debugDump(1) });
                    }
                    throw new PolicyViolationException("Projection " + rsd + " already exists in context (existing " + existingShadow + ", new " + projection);
                } catch (ObjectNotFoundException e) {
                    // This is somehow expected, fix it and we can go on
                    result.muteLastSubresultError();
                    // We have to create new context in this case, but it has to have thumbstone set
                    rsd.setThombstone(true);
                    projectionContext = LensUtil.getOrCreateProjectionContext(context, rsd);
                    // We have to mark it as dead right now, otherwise the uniqueness check may fail
                    markShadowDead(projection.getOid(), result);
                }
            } catch (ObjectNotFoundException e) {
                // This is somehow expected, fix it and we can go on
                result.muteLastSubresultError();
                String shadowOid = projectionContext.getOid();
                projectionContext.getResourceShadowDiscriminator().setThombstone(true);
                projectionContext = LensUtil.getOrCreateProjectionContext(context, rsd);
                // We have to mark it as dead right now, otherwise the uniqueness check may fail
                markShadowDead(shadowOid, result);
            }
        }
    }
    return projectionContext;
}

Example 15 with PolicyViolationException

use of com.evolveum.midpoint.util.exception.PolicyViolationException in project midpoint by Evolveum.

the class DependencyProcessor method determineProjectionWaveProvision.

private <F extends ObjectType> LensProjectionContext determineProjectionWaveProvision(LensContext<F> context, LensProjectionContext projectionContext, ResourceObjectTypeDependencyType inDependency, List<ResourceObjectTypeDependencyType> depPath) throws PolicyViolationException {
    if (depPath == null) {
        depPath = new ArrayList<ResourceObjectTypeDependencyType>();
    }
    int determinedWave = 0;
    int determinedOrder = 0;
    for (ResourceObjectTypeDependencyType outDependency : projectionContext.getDependencies()) {
        if (LOGGER.isTraceEnabled()) {
            LOGGER.trace("DEP: {}", outDependency);
        }
        if (inDependency != null && isHigerOrder(outDependency, inDependency)) {
            // otherwise we can end up in endless loop even for legal dependencies.
            continue;
        }
        checkForCircular(depPath, outDependency);
        depPath.add(outDependency);
        ResourceShadowDiscriminator refDiscr = new ResourceShadowDiscriminator(outDependency, projectionContext.getResource().getOid(), projectionContext.getKind());
        LensProjectionContext dependencyProjectionContext = findDependencyTargetContext(context, projectionContext, outDependency);
        //			}
        if (dependencyProjectionContext == null || dependencyProjectionContext.isDelete()) {
            ResourceObjectTypeDependencyStrictnessType outDependencyStrictness = ResourceTypeUtil.getDependencyStrictness(outDependency);
            if (outDependencyStrictness == ResourceObjectTypeDependencyStrictnessType.STRICT) {
                throw new PolicyViolationException("Unsatisfied strict dependency of account " + projectionContext.getResourceShadowDiscriminator() + " dependent on " + refDiscr + ": Account not provisioned");
            } else if (outDependencyStrictness == ResourceObjectTypeDependencyStrictnessType.LAX) {
                // independent object not in the context, just ignore it
                LOGGER.debug("Unsatisfied lax dependency of account " + projectionContext.getResourceShadowDiscriminator() + " dependent on " + refDiscr + "; dependency skipped");
            } else if (outDependencyStrictness == ResourceObjectTypeDependencyStrictnessType.RELAXED) {
                // independent object not in the context, just ignore it
                LOGGER.debug("Unsatisfied relaxed dependency of account " + projectionContext.getResourceShadowDiscriminator() + " dependent on " + refDiscr + "; dependency skipped");
            } else {
                throw new IllegalArgumentException("Unknown dependency strictness " + outDependency.getStrictness() + " in " + refDiscr);
            }
        } else {
            dependencyProjectionContext = determineProjectionWave(context, dependencyProjectionContext, outDependency, depPath);
            if (dependencyProjectionContext.getWave() + 1 > determinedWave) {
                determinedWave = dependencyProjectionContext.getWave() + 1;
                if (outDependency.getOrder() == null) {
                    determinedOrder = 0;
                } else {
                    determinedOrder = outDependency.getOrder();
                }
            }
        }
        depPath.remove(outDependency);
    }
    LensProjectionContext resultAccountContext = projectionContext;
    if (projectionContext.getWave() >= 0 && projectionContext.getWave() != determinedWave) {
        // Wave for this context was set during the run of this method (it was not set when we
        // started, we checked at the beginning). Therefore this context must have been visited again.
        // therefore there is a circular dependency. Therefore we need to create another context to split it.
        ResourceShadowDiscriminator origDiscr = projectionContext.getResourceShadowDiscriminator();
        ResourceShadowDiscriminator discr = new ResourceShadowDiscriminator(origDiscr.getResourceOid(), origDiscr.getKind(), origDiscr.getIntent(), origDiscr.isThombstone());
        discr.setOrder(determinedOrder);
        if (!projectionContext.compareResourceShadowDiscriminator(discr, true)) {
            resultAccountContext = createAnotherContext(context, projectionContext, discr);
        }
    }
    //		LOGGER.trace("Wave for {}: {}", resultAccountContext.getResourceAccountType(), wave);
    resultAccountContext.setWave(determinedWave);
    return resultAccountContext;
}