Examples with SecurityViolationException com.evolveum.midpoint.util.exception.SecurityViolationException used on opensource projects

Example 46 with SecurityViolationException

use of com.evolveum.midpoint.util.exception.SecurityViolationException in project midpoint by Evolveum.

the class AbstractSecurityTest method assertModifyDenyOptions.

protected <O extends ObjectType> void assertModifyDenyOptions(Class<O> type, String oid, ItemPath itemPath, ModelExecuteOptions options, Object... newRealValue) throws ObjectAlreadyExistsException, ObjectNotFoundException, SchemaException, ExpressionEvaluationException, CommunicationException, ConfigurationException, PolicyViolationException, SecurityViolationException {
    Task task = taskManager.createTaskInstance(AbstractSecurityTest.class.getName() + ".assertModifyDeny");
    OperationResult result = task.getResult();
    ObjectDelta<O> objectDelta = ObjectDelta.createModificationReplaceProperty(type, oid, itemPath, prismContext, newRealValue);
    Collection<ObjectDelta<? extends ObjectType>> deltas = MiscSchemaUtil.createCollection(objectDelta);
    try {
        logAttempt("modify", type, oid, itemPath);
        modelService.executeChanges(deltas, options, task, result);
        failDeny("modify", type, oid, itemPath);
    } catch (SecurityViolationException e) {
        // this is expected
        logDeny("modify", type, oid, itemPath);
        result.computeStatus();
        TestUtil.assertFailure(result);
    }
}

Example 47 with SecurityViolationException

use of com.evolveum.midpoint.util.exception.SecurityViolationException in project midpoint by Evolveum.

the class AbstractModelIntegrationTest method assertAllowRequestItems.

protected void assertAllowRequestItems(String userOid, String targetRoleOid, AuthorizationDecisionType expectedDefaultDecision, QName... expectedAllowedItemQNames) throws SchemaException, SecurityViolationException, CommunicationException, ObjectNotFoundException, ConfigurationException, ExpressionEvaluationException {
    PrismObject<UserType> user = getUser(userOid);
    PrismObject<RoleType> target = getRole(targetRoleOid);
    ItemSecurityDecisions decisions = modelInteractionService.getAllowedRequestAssignmentItems(user, target);
    display("Request decisions for " + target, decisions);
    assertEquals("Wrong assign default decision", expectedDefaultDecision, decisions.getDefaultDecision());
    assertEquals("Unexpected number of allowed items", expectedAllowedItemQNames.length, decisions.getItemDecisionMap().size());
    decisions.getItemDecisionMap().forEach((path, decision) -> {
        assertEquals("wrong item " + path + " decision", AuthorizationDecisionType.ALLOW, decision);
        QName lastPathName = path.lastNamed().getName();
        if (!Arrays.stream(expectedAllowedItemQNames).anyMatch(qname -> QNameUtil.match(qname, lastPathName))) {
            AssertJUnit.fail("Unexpected path " + path);
        }
    });
}

Example 48 with SecurityViolationException

use of com.evolveum.midpoint.util.exception.SecurityViolationException in project midpoint by Evolveum.

the class TestDummy method test509DeleteProtectedAccountShadow.

@Test
public void test509DeleteProtectedAccountShadow() throws Exception {
    final String TEST_NAME = "test509DeleteProtectedAccountShadow";
    TestUtil.displayTestTile(TEST_NAME);
    // GIVEN
    Task task = createTask(TEST_NAME);
    OperationResult result = task.getResult();
    syncServiceMock.reset();
    // WHEN
    try {
        provisioningService.deleteObject(ShadowType.class, ACCOUNT_DAEMON_OID, null, null, task, result);
        AssertJUnit.fail("Expected security exception while deleting 'daemon' account");
    } catch (SecurityViolationException e) {
        // This is expected
        display("Expected exception", e);
    }
    result.computeStatus();
    display("deleteObject result (expected failure)", result);
    TestUtil.assertFailure(result);
    syncServiceMock.assertNotifyFailureOnly();
    //		checkConsistency();
    assertSteadyResource();
}

Example 49 with SecurityViolationException

use of com.evolveum.midpoint.util.exception.SecurityViolationException in project midpoint by Evolveum.

the class TestDelegation method test110DelegateToUser2Unauthorized.

@Test
public void test110DelegateToUser2Unauthorized() throws Exception {
    final String TEST_NAME = "test110DelegateToUser2Unauthorized";
    TestUtil.displayTestTile(this, TEST_NAME);
    login(userLead3);
    Task task = createTask(TEST_NAME);
    OperationResult result = task.getResult();
    try {
        workflowService.delegateWorkItem(workItemId, Collections.singletonList(ort(userLead2Oid)), ADD_ASSIGNEES, result);
        fail("delegate succeeded even if it shouldn't");
    } catch (SecurityViolationException e) {
    // ok
    }
    WorkItemType workItem = getWorkItem(task, result);
    PrismAsserts.assertReferenceValues(ref(workItem.getAssigneeRef()), userLead1Oid);
}

Example 50 with SecurityViolationException

use of com.evolveum.midpoint.util.exception.SecurityViolationException in project midpoint by Evolveum.

the class SecurityUtil method getPrincipal.

/**
	 * Returns principal representing currently logged-in user. Returns null if the user is anonymous.
	 */
public static MidPointPrincipal getPrincipal() throws SecurityViolationException {
    Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
    if (authentication == null) {
        SecurityViolationException ex = new SecurityViolationException("No authentication");
        LOGGER.error("No authentication", ex);
        throw ex;
    }
    Object principalObject = authentication.getPrincipal();
    if (!(principalObject instanceof MidPointPrincipal)) {
        if (authentication.getPrincipal() instanceof String && "anonymousUser".equals(principalObject)) {
            return null;
        } else {
            throw new IllegalArgumentException("Expected that spring security principal will be of type " + MidPointPrincipal.class.getName() + " but it was " + MiscUtil.getObjectName(principalObject));
        }
    }
    return (MidPointPrincipal) principalObject;
}