Examples with SecurityViolationException com.evolveum.midpoint.util.exception.SecurityViolationException used on opensource projects

Example 86 with SecurityViolationException

use of com.evolveum.midpoint.util.exception.SecurityViolationException in project midpoint by Evolveum.

the class Construction method resolveTarget.

private ResourceType resolveTarget(String sourceDescription, Task task, OperationResult result) throws SchemaException, ObjectNotFoundException, ExpressionEvaluationException, CommunicationException, ConfigurationException, SecurityViolationException {
    // SearchFilterType filter = targetRef.getFilter();
    ExpressionVariables variables = Utils.getDefaultExpressionVariables(getFocusOdo().getNewObject().asObjectable(), null, null, null);
    if (assignmentPathVariables == null) {
        assignmentPathVariables = LensUtil.computeAssignmentPathVariables(getAssignmentPath());
    }
    Utils.addAssignmentPathVariables(assignmentPathVariables, variables);
    LOGGER.info("Expression variables for filter evaluation: {}", variables);
    ObjectFilter origFilter = QueryConvertor.parseFilter(getConstructionType().getResourceRef().getFilter(), ResourceType.class, getPrismContext());
    LOGGER.info("Orig filter {}", origFilter);
    ObjectFilter evaluatedFilter = ExpressionUtil.evaluateFilterExpressions(origFilter, variables, getMappingFactory().getExpressionFactory(), getPrismContext(), " evaluating resource filter expression ", task, result);
    LOGGER.info("evaluatedFilter filter {}", evaluatedFilter);
    if (evaluatedFilter == null) {
        throw new SchemaException("The OID is null and filter could not be evaluated in assignment targetRef in " + getSource());
    }
    final Collection<PrismObject<ResourceType>> results = new ArrayList<>();
    ResultHandler<ResourceType> handler = (object, parentResult) -> {
        LOGGER.info("Found object {}", object);
        return results.add(object);
    };
    getObjectResolver().searchIterative(ResourceType.class, ObjectQuery.createObjectQuery(evaluatedFilter), null, handler, task, result);
    if (org.apache.commons.collections.CollectionUtils.isEmpty(results)) {
        throw new IllegalArgumentException("Got no target from repository, filter:" + evaluatedFilter + ", class:" + ResourceType.class + " in " + sourceDescription);
    }
    if (results.size() > 1) {
        throw new IllegalArgumentException("Got more than one target from repository, filter:" + evaluatedFilter + ", class:" + ResourceType.class + " in " + sourceDescription);
    }
    PrismObject<ResourceType> target = results.iterator().next();
    // assignmentType.getTargetRef().setOid(target.getOid());
    return target.asObjectable();
}

Example 87 with SecurityViolationException

use of com.evolveum.midpoint.util.exception.SecurityViolationException in project midpoint by Evolveum.

the class Clockwork method click.

public <F extends ObjectType> HookOperationMode click(LensContext<F> context, Task task, OperationResult result) throws SchemaException, PolicyViolationException, ExpressionEvaluationException, ObjectNotFoundException, ObjectAlreadyExistsException, CommunicationException, ConfigurationException, SecurityViolationException {
    if (context.getDebugListener() == null) {
        context.setDebugListener(debugListener);
    }
    try {
        XMLGregorianCalendar now = clock.currentTimeXMLGregorianCalendar();
        // We need to determine focus before auditing. Otherwise we will not know user
        // for the accounts (unless there is a specific delta for it).
        // This is ugly, but it is the easiest way now (TODO: cleanup).
        contextLoader.determineFocusContext((LensContext<? extends FocusType>) context, result);
        ModelState state = context.getState();
        if (state == ModelState.INITIAL) {
            if (debugListener != null) {
                debugListener.beforeSync(context);
            }
            metadataManager.applyRequestMetadata(context, now, task, result);
            context.getStats().setRequestTimestamp(now);
            // We need to do this BEFORE projection. If we would do that after projection
            // there will be secondary changes that are not part of the request.
            audit(context, AuditEventStage.REQUEST, task, result);
        }
        boolean recompute = false;
        if (!context.isFresh()) {
            LOGGER.trace("Context is not fresh -- forcing cleanup and recomputation");
            recompute = true;
        } else if (context.getExecutionWave() > context.getProjectionWave()) {
            // should not occur
            LOGGER.warn("Execution wave is greater than projection wave -- forcing cleanup and recomputation");
            recompute = true;
        }
        if (recompute) {
            context.cleanup();
            projector.project(context, "PROJECTOR (" + state + ")", task, result);
        } else if (context.getExecutionWave() == context.getProjectionWave()) {
            LOGGER.trace("Running projector for current execution wave");
            projector.resume(context, "PROJECTOR (" + state + ")", task, result);
        } else {
            LOGGER.trace("Skipping projection because the context is fresh and projection for current wave has already run");
        }
        if (!context.isRequestAuthorized()) {
            authorizeContextRequest(context, task, result);
        }
        LensUtil.traceContext(LOGGER, "CLOCKWORK (" + state + ")", "before processing", true, context, false);
        if (InternalsConfig.consistencyChecks) {
            try {
                context.checkConsistence();
            } catch (IllegalStateException e) {
                throw new IllegalStateException(e.getMessage() + " in clockwork, state=" + state, e);
            }
        }
        if (InternalsConfig.encryptionChecks && !ModelExecuteOptions.isNoCrypt(context.getOptions())) {
            context.checkEncrypted();
        }
        switch(state) {
            case INITIAL:
                processInitialToPrimary(context, task, result);
                break;
            case PRIMARY:
                processPrimaryToSecondary(context, task, result);
                break;
            case SECONDARY:
                processSecondary(context, task, result);
                break;
            case FINAL:
                HookOperationMode mode = processFinal(context, task, result);
                if (debugListener != null) {
                    debugListener.afterSync(context);
                }
                return mode;
        }
        result.recomputeStatus();
        result.cleanupResult();
        return invokeHooks(context, task, result);
    } catch (CommunicationException | ConfigurationException | ExpressionEvaluationException | ObjectNotFoundException | PolicyViolationException | SchemaException | SecurityViolationException | RuntimeException | ObjectAlreadyExistsException e) {
        processClockworkException(context, e, task, result);
        throw e;
    }
}

Example 88 with SecurityViolationException

use of com.evolveum.midpoint.util.exception.SecurityViolationException in project midpoint by Evolveum.

the class Clockwork method authorizeContextRequest.

private <F extends ObjectType> void authorizeContextRequest(LensContext<F> context, Task task, OperationResult parentResult) throws SecurityViolationException, SchemaException {
    OperationResult result = parentResult.createMinorSubresult(Clockwork.class.getName() + ".authorizeRequest");
    try {
        final LensFocusContext<F> focusContext = context.getFocusContext();
        OwnerResolver ownerResolver = new LensOwnerResolver<>(context, objectResolver, task, result);
        if (focusContext != null) {
            authorizeElementContext(context, focusContext, ownerResolver, true, task, result);
        }
        for (LensProjectionContext projectionContext : context.getProjectionContexts()) {
            authorizeElementContext(context, projectionContext, ownerResolver, false, task, result);
        }
        context.setRequestAuthorized(true);
        result.recordSuccess();
    } catch (SecurityViolationException | SchemaException | RuntimeException | Error e) {
        result.recordFatalError(e);
        throw e;
    }
}

Example 89 with SecurityViolationException

use of com.evolveum.midpoint.util.exception.SecurityViolationException in project midpoint by Evolveum.

the class SynchronizationServiceImpl method reactToChange.

private <F extends FocusType> SynchronizationSituationType reactToChange(Class<F> focusClass, ResourceObjectShadowChangeDescription change, ObjectSynchronizationType synchronizationPolicy, SynchronizationSituation<F> situation, ResourceType resource, boolean logDebug, PrismObject<SystemConfigurationType> configuration, Task task, OperationResult parentResult) throws ConfigurationException, ObjectNotFoundException, SchemaException, PolicyViolationException, ExpressionEvaluationException, ObjectAlreadyExistsException, CommunicationException, SecurityViolationException {
    SynchronizationSituationType newSituation = situation.getSituation();
    SynchronizationReactionType reactionDefinition = findReactionDefinition(synchronizationPolicy, situation, change.getSourceChannel(), resource);
    if (reactionDefinition == null) {
        LOGGER.trace("No reaction is defined for situation {} in {}", situation.getSituation(), resource);
        return newSituation;
    }
    // seems to be unused so commented it out [med]
    // PrismObject<? extends ObjectType> shadow = null;
    // if (change.getCurrentShadow() != null) {
    // shadow = change.getCurrentShadow();
    // } else if (change.getOldShadow() != null) {
    // shadow = change.getOldShadow();
    // }
    Boolean doReconciliation = determineReconciliation(synchronizationPolicy, reactionDefinition);
    if (doReconciliation == null) {
        // shadow.
        if (change.getObjectDelta() == null) {
            doReconciliation = true;
        }
    }
    Boolean limitPropagation = determinePropagationLimitation(synchronizationPolicy, reactionDefinition, change.getSourceChannel());
    ModelExecuteOptions options = new ModelExecuteOptions();
    options.setReconcile(doReconciliation);
    options.setLimitPropagation(limitPropagation);
    final boolean willSynchronize = isSynchronize(reactionDefinition);
    LensContext<F> lensContext = null;
    if (willSynchronize) {
        lensContext = createLensContext(focusClass, change, reactionDefinition, synchronizationPolicy, situation, options, configuration, parentResult);
    }
    if (LOGGER.isTraceEnabled() && lensContext != null) {
        LOGGER.trace("---[ SYNCHRONIZATION context before action execution ]-------------------------\n" + "{}\n------------------------------------------", lensContext.debugDump());
    }
    if (willSynchronize) {
        // there's no point in calling executeAction without context - so
        // the actions are executed only if synchronize == true
        executeActions(reactionDefinition, lensContext, situation, BeforeAfterType.BEFORE, resource, logDebug, task, parentResult);
        Iterator<LensProjectionContext> iterator = lensContext.getProjectionContextsIterator();
        LensProjectionContext originalProjectionContext = iterator.hasNext() ? iterator.next() : null;
        try {
            clockwork.run(lensContext, task, parentResult);
        } catch (ConfigurationException | ObjectNotFoundException | SchemaException | PolicyViolationException | ExpressionEvaluationException | ObjectAlreadyExistsException | CommunicationException | SecurityViolationException e) {
            LOGGER.error("SYNCHRONIZATION: Error in synchronization on {} for situation {}: {}: {}. Change was {}", new Object[] { resource, situation.getSituation(), e.getClass().getSimpleName(), e.getMessage(), change, e });
        // what to do here? We cannot throw the error back. All that the notifyChange method
        // could do is to convert it to SystemException. But that indicates an internal error and it will
        // break whatever code called the notifyChange in the first place. We do not want that.
        // If the clockwork could not do anything with the exception then perhaps nothing can be done at all.
        // So just log the error (the error should be remembered in the result and task already)
        // and then just go on.
        }
        // note: actions "AFTER" seem to be useless here (basically they
        // modify lens context - which is relevant only if followed by
        // clockwork run)
        executeActions(reactionDefinition, lensContext, situation, BeforeAfterType.AFTER, resource, logDebug, task, parentResult);
        if (originalProjectionContext != null) {
            newSituation = originalProjectionContext.getSynchronizationSituationResolved();
        }
    } else {
        LOGGER.trace("Skipping clockwork run on {} for situation {}, synchronize is set to false.", new Object[] { resource, situation.getSituation() });
    }
    return newSituation;
}

Example 90 with SecurityViolationException

use of com.evolveum.midpoint.util.exception.SecurityViolationException in project midpoint by Evolveum.

the class LiveSyncTaskHandler method runInternal.

private TaskRunResult runInternal(Task task) {
    LOGGER.trace("LiveSyncTaskHandler.run starting");
    long progress = task.getProgress();
    OperationResult opResult = new OperationResult(OperationConstants.LIVE_SYNC);
    TaskRunResult runResult = new TaskRunResult();
    runResult.setOperationResult(opResult);
    String resourceOid = task.getObjectOid();
    if (resourceOid == null) {
        LOGGER.error("Live Sync: No resource OID specified in the task");
        opResult.recordFatalError("No resource OID specified in the task");
        runResult.setRunResultStatus(TaskRunResultStatus.PERMANENT_ERROR);
        return runResult;
    }
    ResourceType resource = null;
    try {
        resource = provisioningService.getObject(ResourceType.class, resourceOid, null, task, opResult).asObjectable();
    } catch (ObjectNotFoundException ex) {
        LOGGER.error("Live Sync: Resource {} not found: {}", new Object[] { resourceOid, ex.getMessage(), ex });
        // This is bad. The resource does not exist. Permanent problem.
        opResult.recordFatalError("Resource not found " + resourceOid, ex);
        runResult.setRunResultStatus(TaskRunResultStatus.PERMANENT_ERROR);
        return runResult;
    } catch (SchemaException ex) {
        LOGGER.error("Live Sync: Error dealing with schema: {}", ex.getMessage(), ex);
        // Not sure about this. But most likely it is a misconfigured resource or connector
        // It may be worth to retry. Error is fatal, but may not be permanent.
        opResult.recordFatalError("Error dealing with schema: " + ex.getMessage(), ex);
        runResult.setRunResultStatus(TaskRunResultStatus.TEMPORARY_ERROR);
        return runResult;
    } catch (RuntimeException ex) {
        LOGGER.error("Live Sync: Internal Error: {}", ex.getMessage(), ex);
        // Can be anything ... but we can't recover from that.
        // It is most likely a programming error. Does not make much sense to retry.
        opResult.recordFatalError("Internal Error: " + ex.getMessage(), ex);
        runResult.setRunResultStatus(TaskRunResultStatus.PERMANENT_ERROR);
        return runResult;
    } catch (CommunicationException ex) {
        LOGGER.error("Live Sync: Error getting resource {}: {}", new Object[] { resourceOid, ex.getMessage(), ex });
        opResult.recordFatalError("Error getting resource " + resourceOid + ": " + ex.getMessage(), ex);
        runResult.setRunResultStatus(TaskRunResultStatus.TEMPORARY_ERROR);
        return runResult;
    } catch (ConfigurationException ex) {
        LOGGER.error("Live Sync: Error getting resource {}: {}", new Object[] { resourceOid, ex.getMessage(), ex });
        opResult.recordFatalError("Error getting resource " + resourceOid + ": " + ex.getMessage(), ex);
        runResult.setRunResultStatus(TaskRunResultStatus.PERMANENT_ERROR);
        return runResult;
    } catch (SecurityViolationException ex) {
        LOGGER.error("Live Sync: Error getting resource {}: {}", new Object[] { resourceOid, ex.getMessage(), ex });
        opResult.recordFatalError("Error getting resource " + resourceOid + ": " + ex.getMessage(), ex);
        runResult.setRunResultStatus(TaskRunResultStatus.PERMANENT_ERROR);
        return runResult;
    } catch (ExpressionEvaluationException ex) {
        LOGGER.error("Live Sync: Error getting resource {}: {}", new Object[] { resourceOid, ex.getMessage(), ex });
        opResult.recordFatalError("Error getting resource " + resourceOid + ": " + ex.getMessage(), ex);
        runResult.setRunResultStatus(TaskRunResultStatus.PERMANENT_ERROR);
        return runResult;
    }
    if (resource == null) {
        LOGGER.error("Live Sync: No resource specified");
        opResult.recordFatalError("No resource specified");
        runResult.setRunResultStatus(TaskRunResultStatus.PERMANENT_ERROR);
        return runResult;
    }
    RefinedResourceSchema refinedSchema;
    try {
        refinedSchema = RefinedResourceSchemaImpl.getRefinedSchema(resource, LayerType.MODEL, prismContext);
    } catch (SchemaException e) {
        LOGGER.error("Live Sync: Schema error during processing account definition: {}", e.getMessage());
        opResult.recordFatalError("Schema error during processing account definition: " + e.getMessage(), e);
        runResult.setRunResultStatus(TaskRunResultStatus.PERMANENT_ERROR);
        return runResult;
    }
    if (refinedSchema == null) {
        opResult.recordFatalError("No refined schema defined. Probably some configuration problem.");
        runResult.setRunResultStatus(TaskRunResultStatus.PERMANENT_ERROR);
        LOGGER.error("Live Sync: No refined schema defined. Probably some configuration problem.");
        return runResult;
    }
    ObjectClassComplexTypeDefinition objectClass;
    try {
        objectClass = Utils.determineObjectClass(refinedSchema, task);
    } catch (SchemaException e) {
        LOGGER.error("Live Sync: schema error: {}", e.getMessage());
        opResult.recordFatalError(e);
        runResult.setRunResultStatus(TaskRunResultStatus.PERMANENT_ERROR);
        return runResult;
    }
    if (objectClass == null) {
        LOGGER.debug("Syncing all object classes");
    }
    ResourceShadowDiscriminator coords = new ResourceShadowDiscriminator(resourceOid, objectClass == null ? null : objectClass.getTypeName());
    int changesProcessed;
    try {
        // MAIN PART
        // Calling synchronize(..) in provisioning.
        // This will detect the changes and notify model about them.
        // It will use extension of task to store synchronization state
        Utils.clearRequestee(task);
        changesProcessed = provisioningService.synchronize(coords, task, opResult);
        progress += changesProcessed;
    } catch (ObjectNotFoundException ex) {
        LOGGER.error("Live Sync: A required object does not exist, OID: {}", ex.getOid());
        LOGGER.error("Exception stack trace", ex);
        // This is bad. The resource or task or something like that does not exist. Permanent problem.
        opResult.recordFatalError("A required object does not exist, OID: " + ex.getOid(), ex);
        runResult.setRunResultStatus(TaskRunResultStatus.PERMANENT_ERROR);
        runResult.setProgress(progress);
        return runResult;
    } catch (CommunicationException ex) {
        LOGGER.error("Live Sync: Communication error:", ex);
        // Error, but not critical. Just try later.
        opResult.recordPartialError("Communication error: " + ex.getMessage(), ex);
        runResult.setRunResultStatus(TaskRunResultStatus.TEMPORARY_ERROR);
        runResult.setProgress(progress);
        return runResult;
    } catch (SchemaException ex) {
        LOGGER.error("Live Sync: Error dealing with schema:", ex);
        // Not sure about this. But most likely it is a misconfigured resource or connector
        // It may be worth to retry. Error is fatal, but may not be permanent.
        opResult.recordFatalError("Error dealing with schema: " + ex.getMessage(), ex);
        runResult.setRunResultStatus(TaskRunResultStatus.TEMPORARY_ERROR);
        runResult.setProgress(progress);
        return runResult;
    } catch (RuntimeException ex) {
        LOGGER.error("Live Sync: Internal Error:", ex);
        // Can be anything ... but we can't recover from that.
        // It is most likely a programming error. Does not make much sense to retry.
        opResult.recordFatalError("Internal Error: " + ex.getMessage(), ex);
        runResult.setRunResultStatus(TaskRunResultStatus.PERMANENT_ERROR);
        runResult.setProgress(progress);
        return runResult;
    } catch (ConfigurationException ex) {
        LOGGER.error("Live Sync: Configuration error:", ex);
        // Not sure about this. But most likely it is a misconfigured resource or connector
        // It may be worth to retry. Error is fatal, but may not be permanent.
        opResult.recordFatalError("Configuration error: " + ex.getMessage(), ex);
        runResult.setRunResultStatus(TaskRunResultStatus.TEMPORARY_ERROR);
        runResult.setProgress(progress);
        return runResult;
    } catch (SecurityViolationException ex) {
        LOGGER.error("Recompute: Security violation: {}", ex.getMessage(), ex);
        opResult.recordFatalError("Security violation: " + ex.getMessage(), ex);
        runResult.setRunResultStatus(TaskRunResultStatus.PERMANENT_ERROR);
        runResult.setProgress(progress);
        return runResult;
    } catch (ExpressionEvaluationException ex) {
        LOGGER.error("Recompute: Expression error: {}", ex.getMessage(), ex);
        opResult.recordFatalError("Expression error: " + ex.getMessage(), ex);
        runResult.setRunResultStatus(TaskRunResultStatus.PERMANENT_ERROR);
        runResult.setProgress(progress);
        return runResult;
    }
    opResult.computeStatus("Live sync run has failed");
    opResult.createSubresult(OperationConstants.LIVE_SYNC_STATISTICS).recordStatus(OperationResultStatus.SUCCESS, "Changes processed: " + changesProcessed);
    // This "run" is finished. But the task goes on ...
    runResult.setRunResultStatus(TaskRunResultStatus.FINISHED);
    // Might collide with increasing progress in provisioning module, e.g. when an exception is thrown. But that's OK for now.
    runResult.setProgress(progress);
    LOGGER.trace("LiveSyncTaskHandler.run stopping (resource {})", resourceOid);
    return runResult;
}