Examples with SecurityViolationException com.evolveum.midpoint.util.exception.SecurityViolationException used on opensource projects

Example 76 with SecurityViolationException

use of com.evolveum.midpoint.util.exception.SecurityViolationException in project midpoint by Evolveum.

the class AuditEventRecordProvider method listRecords.

private List<AuditEventRecordType> listRecords(String query, boolean orderBy, long first, long count) {
    String parameterQuery = generateFullQuery(query, orderBy, false);
    if (parameters.containsKey(SET_FIRST_RESULT_PARAMETER)) {
        parameters.remove(SET_FIRST_RESULT_PARAMETER);
    }
    parameters.put(SET_FIRST_RESULT_PARAMETER, ((Long) first).intValue());
    if (parameters.containsKey(SET_MAX_RESULTS_PARAMETER)) {
        parameters.remove(SET_MAX_RESULTS_PARAMETER);
    }
    parameters.put(SET_MAX_RESULTS_PARAMETER, ((Long) count).intValue());
    List<AuditEventRecord> auditRecords;
    try {
        auditRecords = getAuditService().listRecords(parameterQuery, parameters, new OperationResult("listRecords"));
    } catch (SecurityViolationException | SchemaException e) {
        // TODO: proper error handling (MID-3536)
        throw new SystemException(e.getMessage(), e);
    }
    if (auditRecords == null) {
        auditRecords = new ArrayList<>();
    }
    List<AuditEventRecordType> auditRecordList = new ArrayList<>();
    for (AuditEventRecord record : auditRecords) {
        auditRecordList.add(record.createAuditEventRecordType());
    }
    return auditRecordList;
}

Example 77 with SecurityViolationException

use of com.evolveum.midpoint.util.exception.SecurityViolationException in project midpoint by Evolveum.

the class TestRetirement method reconcileAllUsers.

private void reconcileAllUsers() throws SchemaException, ObjectNotFoundException, CommunicationException, ConfigurationException, SecurityViolationException, ExpressionEvaluationException {
    final Task task = createTask("reconcileAllUsers");
    OperationResult result = task.getResult();
    ResultHandler<UserType> handler = new ResultHandler<UserType>() {

        @Override
        public boolean handle(PrismObject<UserType> object, OperationResult parentResult) {
            try {
                display("reconciling " + object);
                reconcileUser(object.getOid(), task, parentResult);
            } catch (SchemaException | PolicyViolationException | ExpressionEvaluationException | ObjectNotFoundException | ObjectAlreadyExistsException | CommunicationException | ConfigurationException | SecurityViolationException e) {
                throw new SystemException(e.getMessage(), e);
            }
            return true;
        }
    };
    display("Reconciling all users");
    modelService.searchObjectsIterative(UserType.class, null, handler, null, task, result);
}

Example 78 with SecurityViolationException

use of com.evolveum.midpoint.util.exception.SecurityViolationException in project midpoint by Evolveum.

the class ConnectorInstanceConnIdImpl method modifyObject.

// TODO [med] beware, this method does not obey its contract specified in the interface
// (1) currently it does not return all the changes, only the 'side effect' changes
// (2) it throws exceptions even if some of the changes were made
// (3) among identifiers, only the UID value is updated on object rename
//     (other identifiers are ignored on input and output of this method)
@Override
public AsynchronousOperationReturnValue<Collection<PropertyModificationOperation>> modifyObject(ObjectClassComplexTypeDefinition objectClassDef, Collection<? extends ResourceAttribute<?>> identifiers, Collection<Operation> changes, StateReporter reporter, OperationResult parentResult) throws ObjectNotFoundException, CommunicationException, GenericFrameworkException, SchemaException, SecurityViolationException, ObjectAlreadyExistsException {
    OperationResult result = parentResult.createSubresult(ConnectorInstance.class.getName() + ".modifyObject");
    result.addParam("objectClass", objectClassDef);
    result.addCollectionOfSerializablesAsParam("identifiers", identifiers);
    result.addArbitraryCollectionAsParam("changes", changes);
    if (changes.isEmpty()) {
        LOGGER.info("No modifications for connector object specified. Skipping processing.");
        result.recordNotApplicableIfUnknown();
        return AsynchronousOperationReturnValue.wrap(new ArrayList<PropertyModificationOperation>(0), result);
    }
    ObjectClass objClass = connIdNameMapper.objectClassToIcf(objectClassDef, getSchemaNamespace(), connectorType, legacySchema);
    Uid uid;
    try {
        uid = getUid(objectClassDef, identifiers);
    } catch (SchemaException e) {
        result.recordFatalError(e);
        throw e;
    }
    if (uid == null) {
        result.recordFatalError("Cannot detemine UID from identifiers: " + identifiers);
        throw new IllegalArgumentException("Cannot detemine UID from identifiers: " + identifiers);
    }
    String originalUid = uid.getUidValue();
    Set<Attribute> attributesToAdd = new HashSet<>();
    Set<Attribute> attributesToUpdate = new HashSet<>();
    Set<Attribute> attributesToRemove = new HashSet<>();
    Set<Operation> additionalOperations = new HashSet<Operation>();
    PasswordChangeOperation passwordChangeOperation = null;
    Collection<PropertyDelta<?>> activationDeltas = new HashSet<PropertyDelta<?>>();
    PropertyDelta<ProtectedStringType> passwordDelta = null;
    PropertyDelta<QName> auxiliaryObjectClassDelta = null;
    for (Operation operation : changes) {
        if (operation == null) {
            IllegalArgumentException e = new IllegalArgumentException("Null operation in modifyObject");
            result.recordFatalError(e);
            throw e;
        }
        if (operation instanceof PropertyModificationOperation) {
            PropertyDelta<?> delta = ((PropertyModificationOperation) operation).getPropertyDelta();
            if (delta.getPath().equivalent(new ItemPath(ShadowType.F_AUXILIARY_OBJECT_CLASS))) {
                auxiliaryObjectClassDelta = (PropertyDelta<QName>) delta;
            }
        }
    }
    try {
        ObjectClassComplexTypeDefinition structuralObjectClassDefinition = resourceSchema.findObjectClassDefinition(objectClassDef.getTypeName());
        if (structuralObjectClassDefinition == null) {
            throw new SchemaException("No definition of structural object class " + objectClassDef.getTypeName() + " in " + description);
        }
        Map<QName, ObjectClassComplexTypeDefinition> auxiliaryObjectClassMap = new HashMap<>();
        if (auxiliaryObjectClassDelta != null) {
            // Activation change means modification of attributes
            if (auxiliaryObjectClassDelta.isReplace()) {
                if (auxiliaryObjectClassDelta.getValuesToReplace() == null || auxiliaryObjectClassDelta.getValuesToReplace().isEmpty()) {
                    attributesToUpdate.add(AttributeBuilder.build(PredefinedAttributes.AUXILIARY_OBJECT_CLASS_NAME));
                } else {
                    addConvertedValues(auxiliaryObjectClassDelta.getValuesToReplace(), attributesToUpdate, auxiliaryObjectClassMap);
                }
            } else {
                addConvertedValues(auxiliaryObjectClassDelta.getValuesToAdd(), attributesToAdd, auxiliaryObjectClassMap);
                addConvertedValues(auxiliaryObjectClassDelta.getValuesToDelete(), attributesToRemove, auxiliaryObjectClassMap);
            }
        }
        for (Operation operation : changes) {
            if (operation instanceof PropertyModificationOperation) {
                PropertyModificationOperation change = (PropertyModificationOperation) operation;
                PropertyDelta<?> delta = change.getPropertyDelta();
                if (delta.getParentPath().equivalent(new ItemPath(ShadowType.F_ATTRIBUTES))) {
                    if (delta.getDefinition() == null || !(delta.getDefinition() instanceof ResourceAttributeDefinition)) {
                        ResourceAttributeDefinition def = objectClassDef.findAttributeDefinition(delta.getElementName());
                        if (def == null) {
                            String message = "No definition for attribute " + delta.getElementName() + " used in modification delta";
                            result.recordFatalError(message);
                            throw new SchemaException(message);
                        }
                        try {
                            delta.applyDefinition(def);
                        } catch (SchemaException e) {
                            result.recordFatalError(e.getMessage(), e);
                            throw e;
                        }
                    }
                    boolean isInRemovedAuxClass = false;
                    boolean isInAddedAuxClass = false;
                    ResourceAttributeDefinition<Object> structAttrDef = structuralObjectClassDefinition.findAttributeDefinition(delta.getElementName());
                    // aux object class, we cannot add/remove it with the object class unless it is normally requested
                    if (structAttrDef == null) {
                        if (auxiliaryObjectClassDelta != null && auxiliaryObjectClassDelta.isDelete()) {
                            // is removed, the attributes must be removed as well.
                            for (PrismPropertyValue<QName> auxPval : auxiliaryObjectClassDelta.getValuesToDelete()) {
                                ObjectClassComplexTypeDefinition auxDef = auxiliaryObjectClassMap.get(auxPval.getValue());
                                ResourceAttributeDefinition<Object> attrDef = auxDef.findAttributeDefinition(delta.getElementName());
                                if (attrDef != null) {
                                    isInRemovedAuxClass = true;
                                    break;
                                }
                            }
                        }
                        if (auxiliaryObjectClassDelta != null && auxiliaryObjectClassDelta.isAdd()) {
                            // is added, the attributes must be added as well.
                            for (PrismPropertyValue<QName> auxPval : auxiliaryObjectClassDelta.getValuesToAdd()) {
                                ObjectClassComplexTypeDefinition auxOcDef = auxiliaryObjectClassMap.get(auxPval.getValue());
                                ResourceAttributeDefinition<Object> auxAttrDef = auxOcDef.findAttributeDefinition(delta.getElementName());
                                if (auxAttrDef != null) {
                                    isInAddedAuxClass = true;
                                    break;
                                }
                            }
                        }
                    }
                    // Change in (ordinary) attributes. Transform to the ConnId attributes.
                    if (delta.isAdd()) {
                        ResourceAttribute<?> mpAttr = (ResourceAttribute<?>) delta.instantiateEmptyProperty();
                        mpAttr.addValues((Collection) PrismValue.cloneCollection(delta.getValuesToAdd()));
                        Attribute connIdAttr = connIdConvertor.convertToConnIdAttribute(mpAttr, objectClassDef);
                        if (mpAttr.getDefinition().isMultiValue()) {
                            attributesToAdd.add(connIdAttr);
                        } else {
                            // Force "update" for single-valued attributes instead of "add". This is saving one
                            // read in some cases. It should also make no substantial difference in such case.
                            // But it is working around some connector bugs.
                            attributesToUpdate.add(connIdAttr);
                        }
                    }
                    if (delta.isDelete()) {
                        ResourceAttribute<?> mpAttr = (ResourceAttribute<?>) delta.instantiateEmptyProperty();
                        if (mpAttr.getDefinition().isMultiValue() || isInRemovedAuxClass) {
                            mpAttr.addValues((Collection) PrismValue.cloneCollection(delta.getValuesToDelete()));
                            Attribute connIdAttr = connIdConvertor.convertToConnIdAttribute(mpAttr, objectClassDef);
                            attributesToRemove.add(connIdAttr);
                        } else {
                            // Force "update" for single-valued attributes instead of "add". This is saving one
                            // read in some cases. 
                            // Update attribute to no values. This will efficiently clean up the attribute.
                            // It should also make no substantial difference in such case. 
                            // But it is working around some connector bugs.
                            Attribute connIdAttr = connIdConvertor.convertToConnIdAttribute(mpAttr, objectClassDef);
                            // update with EMTPY value. The mpAttr.addValues() is NOT in this branch
                            attributesToUpdate.add(connIdAttr);
                        }
                    }
                    if (delta.isReplace()) {
                        ResourceAttribute<?> mpAttr = (ResourceAttribute<?>) delta.instantiateEmptyProperty();
                        mpAttr.addValues((Collection) PrismValue.cloneCollection(delta.getValuesToReplace()));
                        Attribute connIdAttr = connIdConvertor.convertToConnIdAttribute(mpAttr, objectClassDef);
                        if (isInAddedAuxClass) {
                            attributesToAdd.add(connIdAttr);
                        } else {
                            attributesToUpdate.add(connIdAttr);
                        }
                    }
                } else if (delta.getParentPath().equivalent(new ItemPath(ShadowType.F_ACTIVATION))) {
                    activationDeltas.add(delta);
                } else if (delta.getParentPath().equivalent(new ItemPath(new ItemPath(ShadowType.F_CREDENTIALS), CredentialsType.F_PASSWORD))) {
                    passwordDelta = (PropertyDelta<ProtectedStringType>) delta;
                } else if (delta.getPath().equivalent(new ItemPath(ShadowType.F_AUXILIARY_OBJECT_CLASS))) {
                // already processed
                } else {
                    throw new SchemaException("Change of unknown attribute " + delta.getPath());
                }
            } else if (operation instanceof PasswordChangeOperation) {
                passwordChangeOperation = (PasswordChangeOperation) operation;
            // TODO: check for multiple occurrences and fail
            } else if (operation instanceof ExecuteProvisioningScriptOperation) {
                ExecuteProvisioningScriptOperation scriptOperation = (ExecuteProvisioningScriptOperation) operation;
                additionalOperations.add(scriptOperation);
            } else {
                throw new IllegalArgumentException("Unknown operation type " + operation.getClass().getName() + ": " + operation);
            }
        }
    } catch (SchemaException | RuntimeException e) {
        result.recordFatalError(e);
        throw e;
    }
    if (LOGGER.isTraceEnabled()) {
        LOGGER.trace("attributes:\nADD: {}\nUPDATE: {}\nREMOVE: {}", attributesToAdd, attributesToUpdate, attributesToRemove);
    }
    // Needs three complete try-catch blocks because we need to create
    // icfResult for each operation
    // and handle the faults individually
    checkAndExecuteAdditionalOperation(reporter, additionalOperations, BeforeAfterType.BEFORE, result);
    OperationResult connIdResult = null;
    try {
        if (!attributesToAdd.isEmpty()) {
            OperationOptions options = new OperationOptionsBuilder().build();
            connIdResult = result.createSubresult(ConnectorFacade.class.getName() + ".addAttributeValues");
            connIdResult.addParam("objectClass", objectClassDef);
            connIdResult.addParam("uid", uid.getUidValue());
            connIdResult.addArbitraryCollectionAsParam("attributes", attributesToAdd);
            connIdResult.addArbitraryObjectAsParam("options", options);
            connIdResult.addContext("connector", connIdConnectorFacade.getClass());
            if (LOGGER.isTraceEnabled()) {
                LOGGER.trace("Invoking ICF addAttributeValues(), objectclass={}, uid={}, attributes: {}", new Object[] { objClass, uid, dumpAttributes(attributesToAdd) });
            }
            InternalMonitor.recordConnectorOperation("addAttributeValues");
            // Invoking ConnId
            recordIcfOperationStart(reporter, ProvisioningOperation.ICF_UPDATE, objectClassDef, uid);
            uid = connIdConnectorFacade.addAttributeValues(objClass, uid, attributesToAdd, options);
            recordIcfOperationEnd(reporter, ProvisioningOperation.ICF_UPDATE, objectClassDef, null, uid);
            connIdResult.recordSuccess();
        }
    } catch (Throwable ex) {
        recordIcfOperationEnd(reporter, ProvisioningOperation.ICF_UPDATE, objectClassDef, ex, uid);
        String desc = this.getHumanReadableName() + " while adding attribute values to object identified by ICF UID '" + uid.getUidValue() + "'";
        Throwable midpointEx = processIcfException(ex, desc, connIdResult);
        result.computeStatus("Adding attribute values failed");
        // exception
        if (midpointEx instanceof ObjectNotFoundException) {
            throw (ObjectNotFoundException) midpointEx;
        } else if (midpointEx instanceof CommunicationException) {
            //in this situation this is not a critical error, becasue we know to handle it..so mute the error and sign it as expected
            result.muteError();
            connIdResult.muteError();
            throw (CommunicationException) midpointEx;
        } else if (midpointEx instanceof GenericFrameworkException) {
            throw (GenericFrameworkException) midpointEx;
        } else if (midpointEx instanceof SchemaException) {
            throw (SchemaException) midpointEx;
        } else if (midpointEx instanceof AlreadyExistsException) {
            throw (AlreadyExistsException) midpointEx;
        } else if (midpointEx instanceof RuntimeException) {
            throw (RuntimeException) midpointEx;
        } else if (midpointEx instanceof SecurityViolationException) {
            throw (SecurityViolationException) midpointEx;
        } else if (midpointEx instanceof Error) {
            throw (Error) midpointEx;
        } else {
            throw new SystemException("Got unexpected exception: " + ex.getClass().getName() + ": " + ex.getMessage(), ex);
        }
    }
    if (!attributesToUpdate.isEmpty() || activationDeltas != null || passwordDelta != null || auxiliaryObjectClassDelta != null) {
        try {
            if (activationDeltas != null) {
                // Activation change means modification of attributes
                convertFromActivation(attributesToUpdate, activationDeltas);
            }
            if (passwordDelta != null) {
                // Activation change means modification of attributes
                convertFromPassword(attributesToUpdate, passwordDelta);
            }
        } catch (SchemaException ex) {
            result.recordFatalError("Error while converting resource object attributes. Reason: " + ex.getMessage(), ex);
            throw new SchemaException("Error while converting resource object attributes. Reason: " + ex.getMessage(), ex);
        } catch (RuntimeException ex) {
            result.recordFatalError("Error while converting resource object attributes. Reason: " + ex.getMessage(), ex);
            throw ex;
        }
        if (!attributesToUpdate.isEmpty()) {
            OperationOptions options = new OperationOptionsBuilder().build();
            connIdResult = result.createSubresult(ConnectorFacade.class.getName() + ".update");
            connIdResult.addParam("objectClass", objectClassDef);
            connIdResult.addParam("uid", uid == null ? "null" : uid.getUidValue());
            connIdResult.addArbitraryCollectionAsParam("attributes", attributesToUpdate);
            connIdResult.addArbitraryObjectAsParam("options", options);
            connIdResult.addContext("connector", connIdConnectorFacade.getClass());
            if (LOGGER.isTraceEnabled()) {
                LOGGER.trace("Invoking ICF update(), objectclass={}, uid={}, attributes: {}", new Object[] { objClass, uid, dumpAttributes(attributesToUpdate) });
            }
            try {
                // Call ICF
                InternalMonitor.recordConnectorOperation("update");
                recordIcfOperationStart(reporter, ProvisioningOperation.ICF_UPDATE, objectClassDef, uid);
                uid = connIdConnectorFacade.update(objClass, uid, attributesToUpdate, options);
                recordIcfOperationEnd(reporter, ProvisioningOperation.ICF_UPDATE, objectClassDef, null, uid);
                connIdResult.recordSuccess();
            } catch (Throwable ex) {
                recordIcfOperationEnd(reporter, ProvisioningOperation.ICF_UPDATE, objectClassDef, ex, uid);
                String desc = this.getHumanReadableName() + " while updating object identified by ICF UID '" + uid.getUidValue() + "'";
                Throwable midpointEx = processIcfException(ex, desc, connIdResult);
                result.computeStatus("Update failed");
                // exception
                if (midpointEx instanceof ObjectNotFoundException) {
                    throw (ObjectNotFoundException) midpointEx;
                } else if (midpointEx instanceof CommunicationException) {
                    //in this situation this is not a critical error, becasue we know to handle it..so mute the error and sign it as expected
                    result.muteError();
                    connIdResult.muteError();
                    throw (CommunicationException) midpointEx;
                } else if (midpointEx instanceof GenericFrameworkException) {
                    throw (GenericFrameworkException) midpointEx;
                } else if (midpointEx instanceof SchemaException) {
                    throw (SchemaException) midpointEx;
                } else if (midpointEx instanceof ObjectAlreadyExistsException) {
                    throw (ObjectAlreadyExistsException) midpointEx;
                } else if (midpointEx instanceof RuntimeException) {
                    throw (RuntimeException) midpointEx;
                } else if (midpointEx instanceof SecurityViolationException) {
                    throw (SecurityViolationException) midpointEx;
                } else if (midpointEx instanceof Error) {
                    throw (Error) midpointEx;
                } else {
                    throw new SystemException("Got unexpected exception: " + ex.getClass().getName() + ": " + ex.getMessage(), ex);
                }
            }
        }
    }
    try {
        if (!attributesToRemove.isEmpty()) {
            OperationOptions options = new OperationOptionsBuilder().build();
            connIdResult = result.createSubresult(ConnectorFacade.class.getName() + ".removeAttributeValues");
            connIdResult.addParam("objectClass", objectClassDef);
            connIdResult.addParam("uid", uid.getUidValue());
            connIdResult.addArbitraryCollectionAsParam("attributes", attributesToRemove);
            connIdResult.addArbitraryObjectAsParam("options", options);
            connIdResult.addContext("connector", connIdConnectorFacade.getClass());
            if (LOGGER.isTraceEnabled()) {
                LOGGER.trace("Invoking ICF removeAttributeValues(), objectclass={}, uid={}, attributes: {}", new Object[] { objClass, uid, dumpAttributes(attributesToRemove) });
            }
            InternalMonitor.recordConnectorOperation("removeAttributeValues");
            recordIcfOperationStart(reporter, ProvisioningOperation.ICF_UPDATE, objectClassDef, uid);
            uid = connIdConnectorFacade.removeAttributeValues(objClass, uid, attributesToRemove, options);
            recordIcfOperationEnd(reporter, ProvisioningOperation.ICF_UPDATE, objectClassDef, null, uid);
            connIdResult.recordSuccess();
        }
    } catch (Throwable ex) {
        recordIcfOperationEnd(reporter, ProvisioningOperation.ICF_UPDATE, objectClassDef, ex, uid);
        String desc = this.getHumanReadableName() + " while removing attribute values from object identified by ICF UID '" + uid.getUidValue() + "'";
        Throwable midpointEx = processIcfException(ex, desc, connIdResult);
        result.computeStatus("Removing attribute values failed");
        // exception
        if (midpointEx instanceof ObjectNotFoundException) {
            throw (ObjectNotFoundException) midpointEx;
        } else if (midpointEx instanceof CommunicationException) {
            //in this situation this is not a critical error, becasue we know to handle it..so mute the error and sign it as expected
            result.muteError();
            connIdResult.muteError();
            throw (CommunicationException) midpointEx;
        } else if (midpointEx instanceof GenericFrameworkException) {
            throw (GenericFrameworkException) midpointEx;
        } else if (midpointEx instanceof SchemaException) {
            throw (SchemaException) midpointEx;
        } else if (midpointEx instanceof ObjectAlreadyExistsException) {
            throw (ObjectAlreadyExistsException) midpointEx;
        } else if (midpointEx instanceof RuntimeException) {
            throw (RuntimeException) midpointEx;
        } else if (midpointEx instanceof SecurityViolationException) {
            throw (SecurityViolationException) midpointEx;
        } else if (midpointEx instanceof Error) {
            throw (Error) midpointEx;
        } else {
            throw new SystemException("Got unexpected exception: " + ex.getClass().getName() + ": " + ex.getMessage(), ex);
        }
    }
    checkAndExecuteAdditionalOperation(reporter, additionalOperations, BeforeAfterType.AFTER, result);
    result.computeStatus();
    Collection<PropertyModificationOperation> sideEffectChanges = new ArrayList<>();
    if (!originalUid.equals(uid.getUidValue())) {
        // UID was changed during the operation, this is most likely a
        // rename
        PropertyDelta<String> uidDelta = createUidDelta(uid, getUidDefinition(objectClassDef, identifiers));
        PropertyModificationOperation uidMod = new PropertyModificationOperation(uidDelta);
        // TODO what about matchingRuleQName ?
        sideEffectChanges.add(uidMod);
        replaceUidValue(objectClassDef, identifiers, uid);
    }
    return AsynchronousOperationReturnValue.wrap(sideEffectChanges, result);
}

Example 79 with SecurityViolationException

use of com.evolveum.midpoint.util.exception.SecurityViolationException in project midpoint by Evolveum.

the class ConnIdUtil method lookForKnownCause.

private static Exception lookForKnownCause(Throwable ex, Throwable originalException, OperationResult parentResult) {
    if (ex instanceof FileNotFoundException) {
        //fix MID-2711 consider FileNotFoundException as CommunicationException
        Exception newEx = new com.evolveum.midpoint.util.exception.CommunicationException(createMessageFromAllExceptions(null, ex));
        parentResult.recordFatalError("File not found: " + ex.getMessage(), newEx);
        return newEx;
    } else if (ex instanceof NameAlreadyBoundException) {
        // This is thrown by LDAP connector and may be also throw by similar
        // connectors
        Exception newEx = new ObjectAlreadyExistsException(createMessageFromAllExceptions(null, ex));
        parentResult.recordFatalError("Object already exists: " + ex.getMessage(), newEx);
        return newEx;
    } else if (ex instanceof javax.naming.CommunicationException) {
        // This is thrown by LDAP connector and may be also throw by similar
        // connectors
        Exception newEx = new CommunicationException(createMessageFromAllExceptions("Communication error", ex));
        parentResult.recordFatalError("Communication error: " + ex.getMessage(), newEx);
        return newEx;
    } else if (ex instanceof ServiceUnavailableException) {
        // In some cases (e.g. JDK 1.6.0_31) this is thrown by LDAP connector and may be also throw by similar
        // connectors
        Exception newEx = new CommunicationException(createMessageFromAllExceptions("Communication error", ex));
        parentResult.recordFatalError("Communication error: " + ex.getMessage(), newEx);
        return newEx;
    } else if (ex instanceof ConnectionBrokenException) {
        Exception newEx = new CommunicationException(createMessageFromAllExceptions("Communication error", ex));
        parentResult.recordFatalError("Communication error: " + ex.getMessage(), newEx);
        return newEx;
    } else if (ex instanceof ConnectionFailedException) {
        Exception newEx = new CommunicationException(createMessageFromAllExceptions("Communication error", ex));
        parentResult.recordFatalError("Communication error: " + ex.getMessage(), newEx);
        return newEx;
    } else if (ex instanceof SchemaViolationException) {
        // This is thrown by LDAP connector and may be also throw by similar
        // connectors
        Exception newEx = new SchemaException(createMessageFromAllExceptions("Schema violation", ex));
        parentResult.recordFatalError("Schema violation: " + ex.getMessage(), newEx);
        return newEx;
    } else if (ex instanceof org.identityconnectors.framework.common.exceptions.InvalidAttributeValueException) {
        Exception newEx = new SchemaException(createMessageFromAllExceptions("Invalid attribute", ex));
        parentResult.recordFatalError("Invalid attribute: " + ex.getMessage(), newEx);
        return newEx;
    } else if (ex instanceof InvalidAttributeValueException) {
        // This is thrown by LDAP connector and may be also throw by similar
        // connectors
        InvalidAttributeValueException e = (InvalidAttributeValueException) ex;
        Exception newEx = null;
        if (e.getExplanation().contains("unique attribute conflict")) {
            newEx = new ObjectAlreadyExistsException(createMessageFromAllExceptions("Invalid attribute", ex));
        } else {
            newEx = new SchemaException(createMessageFromAllExceptions("Invalid attribute", ex));
        }
        parentResult.recordFatalError("Invalid attribute: " + ex.getMessage(), newEx);
        return newEx;
    } else if (ex instanceof ConnectException) {
        // Buried deep in many exceptions, usually connection refused or
        // similar errors
        // Note: needs to be after javax.naming.CommunicationException as the
        //   javax.naming exception has more info (e.g. hostname)
        Exception newEx = new CommunicationException(createMessageFromAllExceptions("Connect error", ex));
        parentResult.recordFatalError("Connect error: " + ex.getMessage(), newEx);
        return newEx;
    } else if (ex instanceof SQLSyntaxErrorException) {
        // Buried deep in many exceptions, usually DB schema problems of
        // DB-based connectors
        Exception newEx = new SchemaException(createMessageFromAllExceptions("DB syntax error", ex));
        parentResult.recordFatalError("DB syntax error: " + ex.getMessage(), newEx);
        return newEx;
    } else if (ex instanceof SQLException) {
        // Buried deep in many exceptions, usually DB connection problems
        Exception newEx = new GenericFrameworkException(createMessageFromAllExceptions("DB error", ex));
        parentResult.recordFatalError("DB error: " + ex.getMessage(), newEx);
        return newEx;
    } else if (ex instanceof UnknownUidException) {
        // Object not found
        Exception newEx = new ObjectNotFoundException(createMessageFromAllExceptions(null, ex));
        parentResult.recordFatalError("Object not found: " + ex.getMessage(), newEx);
        return newEx;
    } else if (ex instanceof NoPermissionException) {
        Exception newEx = new SecurityViolationException(createMessageFromAllExceptions(null, ex));
        parentResult.recordFatalError("Object not found: " + ex.getMessage(), newEx);
        return newEx;
    } else if (ex instanceof AttributeInUseException) {
        Exception newEx = new SchemaException(createMessageFromAllExceptions(null, ex));
        parentResult.recordFatalError("Attribute in use: " + ex.getMessage(), newEx);
        return newEx;
    } else if (ex instanceof NoSuchAttributeException) {
        Exception newEx = new SchemaException(createMessageFromAllExceptions(null, ex));
        parentResult.recordFatalError("No such attribute: " + ex.getMessage(), newEx);
        return newEx;
    }
    if (ex.getCause() == null) {
        // found nothing
        return null;
    } else {
        // Otherwise go one level deeper ...
        return lookForKnownCause(ex.getCause(), originalException, parentResult);
    }
}

Example 80 with SecurityViolationException

use of com.evolveum.midpoint.util.exception.SecurityViolationException in project midpoint by Evolveum.

the class ConnIdUtil method processIcfException.

/**
	 * Transform ConnId exception to something more usable.
	 *
	 * ICF throws exceptions that contains inner exceptions that cannot be
	 * reached by current classloader. Such inner exceptions may cause a lot
	 * of problems in upper layers, such as attempt to serialize/deserialize
	 * them. Therefore we cannot pass such exceptions to the upper layers.
	 * As Throwable is immutable and there is no good way how to copy it, we
	 * just cannot remove the "bad" exceptions from the inner exception stack.
	 * We need to do the brutal thing: remove all the ICF exceptions and do
	 * not pass then to upper layers. Try to save at least some information
	 * and "compress" the class names and messages of the inner ICF exceptions.
	 * The full exception with a stack trace is logged here, so the details are
	 * still in the log.
	 * 
	 * WARNING: This is black magic. Really. Blame Sun Identity Connector
	 * Framework interface design.
	 * 
	 * @param connIdException
	 *            exception from the ConnId
	 * @param connIdResult
	 *            OperationResult to record failure
	 * @return reasonable midPoint exception
	 */
static Throwable processIcfException(Throwable connIdException, String desc, OperationResult connIdResult) {
    if (connIdException == null) {
        connIdResult.recordFatalError("Null exception while processing ConnId exception ");
        throw new IllegalArgumentException("Null exception while processing ConnId exception ");
    }
    LOGGER.error("ConnId Exception {} in {}: {}", connIdException.getClass().getName(), desc, connIdException.getMessage(), connIdException);
    if (connIdException instanceof RemoteWrappedException) {
        // brutal hack, for now
        RemoteWrappedException remoteWrappedException = (RemoteWrappedException) connIdException;
        String className = remoteWrappedException.getExceptionClass();
        if (className == null) {
            LOGGER.error("Remote ConnId exception without inner exception class name. Continuing with original one: {}", connIdException);
        } else if (DOT_NET_ARGUMENT_EXCEPTION.equals(className) && remoteWrappedException.getMessage().contains("0x800708C5")) {
            // password too weak
            connIdException = new SecurityViolationException(connIdException.getMessage(), connIdException);
        } else {
            if (className.startsWith(DOT_NET_EXCEPTION_PACKAGE_PLUS_DOT)) {
                className = JAVA_EXCEPTION_PACKAGE + "." + className.substring(DOT_NET_EXCEPTION_PACKAGE_PLUS_DOT.length());
                LOGGER.trace("Translated exception class: {}", className);
            }
            try {
                connIdException = (Throwable) Class.forName(className).getConstructor(String.class, Throwable.class).newInstance(remoteWrappedException.getMessage(), remoteWrappedException);
            } catch (InstantiationException | IllegalAccessException | ClassNotFoundException | NoSuchMethodException | InvocationTargetException e) {
                LoggingUtils.logException(LOGGER, "Couldn't unwrap remote ConnId exception, continuing with original one {}", e, connIdException);
            }
        }
    }
    if (connIdException instanceof NullPointerException && connIdException.getMessage() != null) {
        // NPE with a message text is in fact not a NPE but an application exception
        // this usually means that some parameter is missing
        Exception newEx = new SchemaException(createMessageFromAllExceptions("Required attribute is missing", connIdException));
        connIdResult.recordFatalError("Required attribute is missing: " + connIdException.getMessage(), newEx);
        return newEx;
    } else if (connIdException instanceof IllegalArgumentException) {
        // Let's assume this must be a configuration problem
        Exception newEx = new com.evolveum.midpoint.util.exception.ConfigurationException(createMessageFromInnermostException("Configuration error", connIdException));
        connIdResult.recordFatalError("Configuration error: " + connIdException.getMessage(), newEx);
        return newEx;
    }
    //this exception is to be analyzed here before the following if clause
    if (connIdException.getCause() != null) {
        String exCauseClassName = connIdException.getCause().getClass().getSimpleName();
        if (exCauseClassName.equals(CONNECTIONS_EXCEPTION_CLASS_NAME)) {
            Exception newEx = new CommunicationException(createMessageFromAllExceptions("Connect error", connIdException));
            connIdResult.recordFatalError("Connect error: " + connIdException.getMessage(), newEx);
            return newEx;
        }
    }
    if (connIdException.getClass().getPackage().equals(NullPointerException.class.getPackage())) {
        // There are java.lang exceptions, they are safe to pass through
        connIdResult.recordFatalError(connIdException);
        return connIdException;
    }
    if (connIdException.getClass().getPackage().equals(SchemaException.class.getPackage())) {
        // Common midPoint exceptions, pass through
        connIdResult.recordFatalError(connIdException);
        return connIdException;
    }
    if (connIdResult == null) {
        throw new IllegalArgumentException(createMessageFromAllExceptions("Null parent result while processing ConnId exception", connIdException));
    }
    // Introspect the inner exceptions and look for known causes
    Exception knownCause = lookForKnownCause(connIdException, connIdException, connIdResult);
    if (knownCause != null) {
        connIdResult.recordFatalError(knownCause);
        return knownCause;
    }
    // Otherwise try few obvious things
    if (connIdException instanceof IllegalArgumentException) {
        // This is most likely missing attribute or similar schema thing
        Exception newEx = new SchemaException(createMessageFromAllExceptions("Schema violation (most likely)", connIdException));
        connIdResult.recordFatalError("Schema violation: " + connIdException.getMessage(), newEx);
        return newEx;
    } else if (connIdException instanceof ConfigurationException) {
        Exception newEx = new com.evolveum.midpoint.util.exception.ConfigurationException(createMessageFromInnermostException("Configuration error", connIdException));
        connIdResult.recordFatalError("Configuration error: " + connIdException.getMessage(), newEx);
        return newEx;
    } else if (connIdException instanceof AlreadyExistsException) {
        Exception newEx = new ObjectAlreadyExistsException(createMessageFromAllExceptions(null, connIdException));
        connIdResult.recordFatalError("Object already exists: " + connIdException.getMessage(), newEx);
        return newEx;
    } else if (connIdException instanceof PermissionDeniedException) {
        Exception newEx = new SecurityViolationException(createMessageFromAllExceptions(null, connIdException));
        connIdResult.recordFatalError("Security violation: " + connIdException.getMessage(), newEx);
        return newEx;
    } else if (connIdException instanceof ConnectionBrokenException) {
        Exception newEx = new CommunicationException(createMessageFromAllExceptions("Connection broken", connIdException));
        connIdResult.recordFatalError("Connection broken: " + connIdException.getMessage(), newEx);
        return newEx;
    } else if (connIdException instanceof ConnectionFailedException) {
        Exception newEx = new CommunicationException(createMessageFromAllExceptions("Connection failed", connIdException));
        connIdResult.recordFatalError("Connection failed: " + connIdException.getMessage(), newEx);
        return newEx;
    } else if (connIdException instanceof UnknownHostException) {
        Exception newEx = new CommunicationException(createMessageFromAllExceptions("Unknown host", connIdException));
        connIdResult.recordFatalError("Unknown host: " + connIdException.getMessage(), newEx);
        return newEx;
    } else if (connIdException instanceof ConnectorIOException) {
        Exception newEx = new CommunicationException(createMessageFromAllExceptions("IO error", connIdException));
        connIdResult.recordFatalError("IO error: " + connIdException.getMessage(), newEx);
        return newEx;
    } else if (connIdException instanceof InvalidCredentialException) {
        Exception newEx = new GenericFrameworkException(createMessageFromAllExceptions("Invalid credentials", connIdException));
        connIdResult.recordFatalError("Invalid credentials: " + connIdException.getMessage(), newEx);
        return newEx;
    } else if (connIdException instanceof OperationTimeoutException) {
        Exception newEx = new CommunicationException(createMessageFromAllExceptions("Operation timed out", connIdException));
        connIdResult.recordFatalError("Operation timed out: " + connIdException.getMessage(), newEx);
        return newEx;
    } else if (connIdException instanceof UnknownUidException) {
        Exception newEx = new ObjectNotFoundException(createMessageFromAllExceptions(null, connIdException));
        connIdResult.recordFatalError("Unknown UID: " + connIdException.getMessage(), newEx);
        return newEx;
    } else if (connIdException instanceof InvalidAttributeValueException) {
        Exception newEx = new SchemaException(createMessageFromAllExceptions(null, connIdException));
        connIdResult.recordFatalError("Schema violation: " + connIdException.getMessage(), newEx);
        return newEx;
    } else if (connIdException instanceof RetryableException) {
        Exception newEx = new CommunicationException(createMessageFromAllExceptions(null, connIdException));
        connIdResult.recordFatalError("Retryable errror: " + connIdException.getMessage(), newEx);
        return newEx;
    } else if (connIdException instanceof ConnectorSecurityException) {
        // Note: connection refused is also packed inside
        // ConnectorSecurityException. But that will get addressed by the
        // lookForKnownCause(..) before
        // Maybe we need special exception for security?
        Exception newEx = new SecurityViolationException(createMessageFromAllExceptions("Security violation", connIdException));
        connIdResult.recordFatalError("Security violation: " + connIdException.getMessage(), newEx);
        return newEx;
    }
    // Fallback
    Exception newEx = new GenericFrameworkException(createMessageFromAllExceptions(null, connIdException));
    connIdResult.recordFatalError(newEx);
    return newEx;
}