Examples with PolicyExceptionType com.evolveum.midpoint.xml.ns._public.common.common_3.PolicyExceptionType used on opensource projects

Example 1 with PolicyExceptionType

use of com.evolveum.midpoint.xml.ns._public.common.common_3.PolicyExceptionType in project midpoint by Evolveum.

the class TestSecurityBasic method test273AutzJackRedyAssignmentExceptionRules.

/**
	 * Check that the #assign authorization does not allow assignment that contains
	 * policyException or policyRule.
	 */
@Test
public void test273AutzJackRedyAssignmentExceptionRules() throws Exception {
    final String TEST_NAME = "test273AutzJackRedyAssignmentExceptionRules";
    TestUtil.displayTestTile(this, TEST_NAME);
    // GIVEN
    cleanupAutzTest(USER_JACK_OID);
    assignRole(USER_JACK_OID, ROLE_ASSIGN_ANY_ROLES_OID);
    assumeAssignmentPolicy(AssignmentPolicyEnforcementType.RELATIVE);
    login(USER_JACK_USERNAME);
    // WHEN
    TestUtil.displayWhen(TEST_NAME);
    assertReadAllow(NUMBER_OF_ALL_USERS + 1);
    assertAddDeny();
    assertModifyDeny();
    assertDeleteDeny();
    PrismObject<UserType> user = getUser(USER_JACK_OID);
    assertAssignments(user, 2);
    assertAssignedRole(user, ROLE_ASSIGN_ANY_ROLES_OID);
    assertDeny("assign application role to jack", (task, result) -> assignRole(USER_JACK_OID, ROLE_APPLICATION_1_OID, null, assignment -> {
        PolicyExceptionType policyException = new PolicyExceptionType();
        policyException.setRuleName("whatever");
        assignment.getPolicyException().add(policyException);
    }, task, result));
    user = getUser(USER_JACK_OID);
    assertAssignments(user, 2);
    assertDeny("assign application role to jack", (task, result) -> assignRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, null, assignment -> {
        PolicyRuleType policyRule = new PolicyRuleType();
        policyRule.setName("whatever");
        assignment.setPolicyRule(policyRule);
    }, task, result));
    user = getUser(USER_JACK_OID);
    assertAssignments(user, 2);
    assertGlobalStateUntouched();
}

Example 2 with PolicyExceptionType

use of com.evolveum.midpoint.xml.ns._public.common.common_3.PolicyExceptionType in project midpoint by Evolveum.

the class TestSecurityMultitenant method test116AutzLetoProtectTenantAdminRole.

/**
 * Make sure that tenant admin cannot break tenant admin role.
 */
@Test
public void test116AutzLetoProtectTenantAdminRole() throws Exception {
    // GIVEN
    cleanupAutzTest(null);
    login(USER_LETO_ATREIDES_NAME);
    // WHEN
    when();
    assertAddDeny(ROLE_ATREIDES_HACKER_FILE);
    AuthorizationType superuserAuthorization = new AuthorizationType().action(AuthorizationConstants.AUTZ_ALL_URL);
    assertDeny("add authorizations to atreides admin", (task, result) -> modifyObjectAddContainer(RoleType.class, ROLE_ATREIDES_ADMIN_OID, RoleType.F_AUTHORIZATION, task, result, superuserAuthorization));
    assertDeny("induce superuser", (task, result) -> induceRole(ROLE_ATREIDES_ADMIN_OID, ROLE_SUPERUSER_OID, task, result));
    assertDeny("add dummy account", (task, result) -> assignAccount(UserType.class, USER_PAUL_ATREIDES_OID, RESOURCE_DUMMY_OID, null, task, result));
    PolicyRuleType policyRule = new PolicyRuleType();
    policyRule.beginPolicyConstraints().beginMinAssignees().multiplicity("1");
    assertDeny("assign policy rule", (task, result) -> assignPolicyRule(RoleType.class, ROLE_ATREIDES_ADMIN_OID, policyRule, task, result));
    AssignmentType policyExceptionAssignment = new AssignmentType();
    policyExceptionAssignment.beginPolicyException().ruleName("foobar");
    assertDeny("assign policy exception", (task, result) -> assign(RoleType.class, ROLE_ATREIDES_ADMIN_OID, policyExceptionAssignment, task, result));
    PolicyExceptionType policyException = new PolicyExceptionType().ruleName("foofoo");
    assertDeny("add policyException to atreides admin", (task, result) -> modifyObjectAddContainer(RoleType.class, ROLE_ATREIDES_ADMIN_OID, RoleType.F_POLICY_EXCEPTION, task, result, policyException));
    // THEN
    then();
    assertGlobalStateUntouched();
}