Examples with COMPLETE com.evolveum.midpoint.xml.ns._public.common.common_3.WorkBucketStateType.COMPLETE used on opensource projects

Example 21 with COMPLETE

use of com.evolveum.midpoint.xml.ns._public.common.common_3.WorkBucketStateType.COMPLETE in project midpoint by Evolveum.

the class TestSanity method test031EnableUser.

/**
     * Try to enable user after it has been disabled. As the user has an account, the account should be enabled as well.
     */
@Test
public void test031EnableUser() throws Exception {
    final String TEST_NAME = "test031EnableUser";
    TestUtil.displayTestTile(TEST_NAME);
    // GIVEN
    ObjectDeltaType objectChange = unmarshallValueFromFile(REQUEST_USER_MODIFY_ACTIVATION_ENABLE_FILENAME, ObjectDeltaType.class);
    assertNoRepoCache();
    // WHEN ObjectTypes.USER.getTypeQName(), 
    OperationResultType result = modifyObjectViaModelWS(objectChange);
    // THEN
    assertNoRepoCache();
    displayJaxb("modifyObject result:", result, SchemaConstants.C_RESULT);
    TestUtil.assertSuccess("modifyObject has failed", result);
    // Check if user object was modified in the repo
    OperationResult repoResult = new OperationResult("getObject");
    PrismObject<UserType> uObject = repositoryService.getObject(UserType.class, USER_JACK_OID, null, repoResult);
    UserType repoUser = uObject.asObjectable();
    display("repo user", repoUser);
    // Check if nothing else was modified
    PrismAsserts.assertEqualsPolyString("wrong repo fullName", "Cpt. Jack Sparrow", repoUser.getFullName());
    PrismAsserts.assertEqualsPolyString("wrong repo locality", "somewhere", repoUser.getLocality());
    // Check if appropriate accountRef is still there
    List<ObjectReferenceType> accountRefs = repoUser.getLinkRef();
    assertEquals(2, accountRefs.size());
    for (ObjectReferenceType accountRef : accountRefs) {
        assertTrue("No OID in " + accountRef + " in " + repoUser, accountRef.getOid().equals(accountShadowOidOpendj) || accountRef.getOid().equals(accountShadowOidDerby));
    }
    // Check if shadow is still in the repo and that it is untouched
    repoResult = new OperationResult("getObject");
    PrismObject<ShadowType> repoShadow = repositoryService.getObject(ShadowType.class, accountShadowOidOpendj, null, repoResult);
    ShadowType repoShadowType = repoShadow.asObjectable();
    repoResult.computeStatus();
    TestUtil.assertSuccess("getObject(repo) has failed", repoResult);
    display("repo shadow", repoShadowType);
    AssertJUnit.assertNotNull(repoShadowType);
    AssertJUnit.assertEquals(RESOURCE_OPENDJ_OID, repoShadowType.getResourceRef().getOid());
    // check attributes in the shadow: should be only identifiers (ICF UID)
    String uid = checkRepoShadow(repoShadow);
    // Use getObject to test fetch of complete shadow
    Holder<OperationResultType> resultHolder = new Holder<OperationResultType>();
    Holder<ObjectType> objectHolder = new Holder<ObjectType>();
    SelectorQualifiedGetOptionsType options = new SelectorQualifiedGetOptionsType();
    assertNoRepoCache();
    // WHEN
    modelWeb.getObject(ObjectTypes.SHADOW.getTypeQName(), accountShadowOidOpendj, options, objectHolder, resultHolder);
    // THEN
    assertNoRepoCache();
    displayJaxb("getObject result", resultHolder.value, SchemaConstants.C_RESULT);
    TestUtil.assertSuccess("getObject has failed", resultHolder.value);
    ShadowType modelShadow = (ShadowType) objectHolder.value;
    display("Shadow (model)", modelShadow);
    AssertJUnit.assertNotNull(modelShadow);
    AssertJUnit.assertEquals(RESOURCE_OPENDJ_OID, modelShadow.getResourceRef().getOid());
    assertAttributeNotNull(modelShadow, getOpenDjPrimaryIdentifierQName());
    assertAttribute(resourceTypeOpenDjrepo, modelShadow, "uid", "jack");
    assertAttribute(resourceTypeOpenDjrepo, modelShadow, "givenName", "Jack");
    assertAttribute(resourceTypeOpenDjrepo, modelShadow, "sn", "Sparrow");
    assertAttribute(resourceTypeOpenDjrepo, modelShadow, "cn", "Cpt. Jack Sparrow");
    assertAttribute(resourceTypeOpenDjrepo, modelShadow, "displayName", "Cpt. Jack Sparrow");
    assertAttribute(resourceTypeOpenDjrepo, modelShadow, "l", "somewhere");
    assertNotNull("The account activation is null in the shadow", modelShadow.getActivation());
    assertNotNull("The account activation status was not present in shadow", modelShadow.getActivation().getAdministrativeStatus());
    assertEquals("The account was not enabled in the shadow", ActivationStatusType.ENABLED, modelShadow.getActivation().getAdministrativeStatus());
    // Check if LDAP account was updated
    Entry entry = openDJController.searchAndAssertByEntryUuid(uid);
    assertOpenDJAccountJack(entry, "jack");
    // The value of ds-pwp-account-disabled should have been removed
    String pwpAccountDisabled = OpenDJController.getAttributeValue(entry, "ds-pwp-account-disabled");
    System.out.println("ds-pwp-account-disabled after change: " + pwpAccountDisabled);
    assertTrue("LDAP account was not enabled", openDJController.isAccountEnabled(entry));
}

Example 22 with COMPLETE

use of com.evolveum.midpoint.xml.ns._public.common.common_3.WorkBucketStateType.COMPLETE in project midpoint by Evolveum.

the class TestSanity method test400ImportFromResource.

@Test
public void test400ImportFromResource() throws Exception {
    final String TEST_NAME = "test400ImportFromResource";
    TestUtil.displayTestTile(TEST_NAME);
    // GIVEN
    checkAllShadows();
    assertNoRepoCache();
    OperationResult result = new OperationResult(TestSanity.class.getName() + "." + TEST_NAME);
    // Make sure Mr. Gibbs has "l" attribute set to the same value as an outbound expression is setting
    ChangeRecordEntry entry = openDJController.executeLdifChange(LDIF_GIBBS_MODIFY_FILE);
    display("Entry from LDIF", entry);
    // Let's add an entry with multiple uids.
    Entry addEntry = openDJController.addEntryFromLdifFile(LDIF_HERMAN_FILENAME);
    display("Entry from LDIF", addEntry);
    // WHEN
    TestUtil.displayWhen(TEST_NAME);
    TaskType taskType = modelWeb.importFromResource(RESOURCE_OPENDJ_OID, RESOURCE_OPENDJ_ACCOUNT_OBJECTCLASS);
    // THEN
    TestUtil.displayThen(TEST_NAME);
    assertNoRepoCache();
    displayJaxb("importFromResource result", taskType.getResult(), SchemaConstants.C_RESULT);
    AssertJUnit.assertEquals("importFromResource has failed", OperationResultStatusType.IN_PROGRESS, taskType.getResult().getStatus());
    // Convert the returned TaskType to a more usable Task
    Task task = taskManager.createTaskInstance(taskType.asPrismObject(), result);
    AssertJUnit.assertNotNull(task);
    assertNotNull(task.getOid());
    AssertJUnit.assertTrue(task.isAsynchronous());
    AssertJUnit.assertEquals(TaskExecutionStatus.RUNNABLE, task.getExecutionStatus());
    //        AssertJUnit.assertEquals(TaskExclusivityStatus.CLAIMED, task.getExclusivityStatus());
    display("Import task after launch", task);
    PrismObject<TaskType> tObject = repositoryService.getObject(TaskType.class, task.getOid(), null, result);
    TaskType taskAfter = tObject.asObjectable();
    display("Import task in repo after launch", taskAfter);
    result.computeStatus();
    TestUtil.assertSuccess("getObject has failed", result);
    final String taskOid = task.getOid();
    waitFor("Waiting for import to complete", new Checker() {

        @Override
        public boolean check() throws CommonException {
            Holder<OperationResultType> resultHolder = new Holder<OperationResultType>();
            Holder<ObjectType> objectHolder = new Holder<ObjectType>();
            OperationResult opResult = new OperationResult("import check");
            assertNoRepoCache();
            SelectorQualifiedGetOptionsType options = new SelectorQualifiedGetOptionsType();
            try {
                modelWeb.getObject(ObjectTypes.TASK.getTypeQName(), taskOid, options, objectHolder, resultHolder);
            } catch (FaultMessage faultMessage) {
                throw new SystemException(faultMessage);
            }
            assertNoRepoCache();
            //				display("getObject result (wait loop)",resultHolder.value);
            TestUtil.assertSuccess("getObject has failed", resultHolder.value);
            Task task = taskManager.createTaskInstance((PrismObject<TaskType>) objectHolder.value.asPrismObject(), opResult);
            System.out.println(new Date() + ": Import task status: " + task.getExecutionStatus() + ", progress: " + task.getProgress());
            if (task.getExecutionStatus() == TaskExecutionStatus.CLOSED) {
                // Task closed, wait finished
                return true;
            }
            //				IntegrationTestTools.display("Task result while waiting: ", task.getResult());
            return false;
        }

        @Override
        public void timeout() {
        // No reaction, the test will fail right after return from this
        }
    }, 180000);
    // wait a second until the task will be definitely saved
    Thread.sleep(1000);
    //### Check task state after the task is finished ###
    Holder<ObjectType> objectHolder = new Holder<ObjectType>();
    Holder<OperationResultType> resultHolder = new Holder<OperationResultType>();
    SelectorQualifiedGetOptionsType options = new SelectorQualifiedGetOptionsType();
    assertNoRepoCache();
    modelWeb.getObject(ObjectTypes.TASK.getTypeQName(), task.getOid(), options, objectHolder, resultHolder);
    assertNoRepoCache();
    TestUtil.assertSuccess("getObject has failed", resultHolder.value);
    task = taskManager.createTaskInstance((PrismObject<TaskType>) objectHolder.value.asPrismObject(), result);
    display("Import task after finish (fetched from model)", task);
    AssertJUnit.assertEquals(TaskExecutionStatus.CLOSED, task.getExecutionStatus());
    assertNotNull("Null lastRunStartTimestamp in " + task, task.getLastRunStartTimestamp());
    assertNotNull("Null lastRunFinishTimestamp in " + task, task.getLastRunFinishTimestamp());
    long importDuration = task.getLastRunFinishTimestamp() - task.getLastRunStartTimestamp();
    double usersPerSec = (task.getProgress() * 1000) / importDuration;
    display("Imported " + task.getProgress() + " users in " + importDuration + " milliseconds (" + usersPerSec + " users/sec)");
    OperationResult taskResult = task.getResult();
    AssertJUnit.assertNotNull("Task has no result", taskResult);
    TestUtil.assertSuccess("Import task result is not success", taskResult);
    AssertJUnit.assertTrue("Task failed", taskResult.isSuccess());
    AssertJUnit.assertTrue("No progress", task.getProgress() > 0);
    //### Check if the import created users and shadows ###
    // Listing of shadows is not supported by the provisioning. So we need
    // to look directly into repository
    List<PrismObject<ShadowType>> sobjects = repositoryService.searchObjects(ShadowType.class, null, null, result);
    result.computeStatus();
    TestUtil.assertSuccess("listObjects has failed", result);
    AssertJUnit.assertFalse("No shadows created", sobjects.isEmpty());
    for (PrismObject<ShadowType> aObject : sobjects) {
        ShadowType shadow = aObject.asObjectable();
        display("Shadow object after import (repo)", shadow);
        // This would be really strange ;-)
        assertNotEmpty("No OID in shadow", shadow.getOid());
        assertNotEmpty("No name in shadow", shadow.getName());
        AssertJUnit.assertNotNull("No objectclass in shadow", shadow.getObjectClass());
        AssertJUnit.assertNotNull("Null attributes in shadow", shadow.getAttributes());
        String resourceOid = shadow.getResourceRef().getOid();
        if (resourceOid.equals(RESOURCE_OPENDJ_OID)) {
            assertAttributeNotNull("No identifier in shadow", shadow, getOpenDjPrimaryIdentifierQName());
        } else {
            assertAttributeNotNull("No UID in shadow", shadow, SchemaConstants.ICFS_UID);
        }
    }
    Holder<ObjectListType> listHolder = new Holder<>();
    assertNoRepoCache();
    modelWeb.searchObjects(ObjectTypes.USER.getTypeQName(), null, null, listHolder, resultHolder);
    assertNoRepoCache();
    ObjectListType uobjects = listHolder.value;
    TestUtil.assertSuccess("listObjects has failed", resultHolder.value);
    AssertJUnit.assertFalse("No users created", uobjects.getObject().isEmpty());
    // TODO: use another account, not guybrush
    display("Users after import " + uobjects.getObject().size());
    for (ObjectType oo : uobjects.getObject()) {
        UserType user = (UserType) oo;
        if (SystemObjectsType.USER_ADMINISTRATOR.value().equals(user.getOid())) {
            //skip administrator check
            continue;
        }
        display("User after import (repo)", user);
        // This would be
        assertNotEmpty("No OID in user", user.getOid());
        // really
        // strange ;-)
        assertNotEmpty("No name in user", user.getName());
        assertNotNull("No fullName in user", user.getFullName());
        assertNotEmpty("No fullName in user", user.getFullName().getOrig());
        assertNotEmpty("No familyName in user", user.getFamilyName().getOrig());
        if (user.getName().getOrig().equals(USER_GUYBRUSH_USERNAME)) {
            // skip the rest of checks for guybrush, he does not have LDAP account now
            continue;
        }
        assertTrue("User " + user.getName() + " is disabled (" + user.getActivation().getAdministrativeStatus() + ")", user.getActivation() == null || user.getActivation().getAdministrativeStatus() == ActivationStatusType.ENABLED);
        List<ObjectReferenceType> accountRefs = user.getLinkRef();
        AssertJUnit.assertEquals("Wrong accountRef for user " + user.getName(), 1, accountRefs.size());
        ObjectReferenceType accountRef = accountRefs.get(0);
        boolean found = false;
        for (PrismObject<ShadowType> aObject : sobjects) {
            ShadowType acc = aObject.asObjectable();
            if (accountRef.getOid().equals(acc.getOid())) {
                found = true;
                break;
            }
        }
        if (!found) {
            AssertJUnit.fail("accountRef does not point to existing account " + accountRef.getOid());
        }
        PrismObject<ShadowType> aObject = modelService.getObject(ShadowType.class, accountRef.getOid(), null, task, result);
        ShadowType account = aObject.asObjectable();
        display("Account after import ", account);
        String attributeValueL = ShadowUtil.getMultiStringAttributeValueAsSingle(account, new QName(ResourceTypeUtil.getResourceNamespace(resourceTypeOpenDjrepo), "l"));
        //            assertEquals("Unexcpected value of l", "middle of nowhere", attributeValueL);
        assertEquals("Unexcpected value of l", getUserLocality(user), attributeValueL);
    }
    // This also includes "idm" user imported from LDAP. Later we need to ignore that one.
    assertEquals("Wrong number of users after import", 10, uobjects.getObject().size());
    checkAllShadows();
}

Example 23 with COMPLETE

use of com.evolveum.midpoint.xml.ns._public.common.common_3.WorkBucketStateType.COMPLETE in project midpoint by Evolveum.

the class TestSanity method test013AddOpenDjAccountToUser.

/**
     * Add account to user. This should result in account provisioning. Check if
     * that happens in repo and in LDAP.
     */
@Test
public void test013AddOpenDjAccountToUser() throws Exception {
    final String TEST_NAME = "test013AddOpenDjAccountToUser";
    TestUtil.displayTestTile(TEST_NAME);
    try {
        // GIVEN
        checkRepoOpenDjResource();
        assertNoRepoCache();
        // IMPORTANT! SWITCHING OFF ASSIGNMENT ENFORCEMENT HERE!
        setAssignmentEnforcement(AssignmentPolicyEnforcementType.NONE);
        // This is not redundant. It checks that the previous command set the policy correctly
        assertSyncSettingsAssignmentPolicyEnforcement(AssignmentPolicyEnforcementType.NONE);
        ObjectDeltaType objectChange = unmarshallValueFromFile(REQUEST_USER_MODIFY_ADD_ACCOUNT_OPENDJ_FILENAME, ObjectDeltaType.class);
        // WHEN
        TestUtil.displayWhen(TEST_NAME);
        OperationResultType result = modifyObjectViaModelWS(objectChange);
        // THEN
        TestUtil.displayThen(TEST_NAME);
        assertNoRepoCache();
        displayJaxb("modifyObject result", result, SchemaConstants.C_RESULT);
        TestUtil.assertSuccess("modifyObject has failed", result);
        // Check if user object was modified in the repo
        OperationResult repoResult = new OperationResult("getObject");
        PrismObject<UserType> repoUser = repositoryService.getObject(UserType.class, USER_JACK_OID, null, repoResult);
        UserType repoUserType = repoUser.asObjectable();
        repoResult.computeStatus();
        TestUtil.assertSuccess("getObject has failed", repoResult);
        display("User (repository)", repoUser);
        List<ObjectReferenceType> accountRefs = repoUserType.getLinkRef();
        assertEquals("No accountRefs", 1, accountRefs.size());
        ObjectReferenceType accountRef = accountRefs.get(0);
        accountShadowOidOpendj = accountRef.getOid();
        assertFalse(accountShadowOidOpendj.isEmpty());
        // Check if shadow was created in the repo
        repoResult = new OperationResult("getObject");
        PrismObject<ShadowType> repoShadow = repositoryService.getObject(ShadowType.class, accountShadowOidOpendj, null, repoResult);
        ShadowType repoShadowType = repoShadow.asObjectable();
        repoResult.computeStatus();
        TestUtil.assertSuccess("getObject has failed", repoResult);
        display("Shadow (repository)", repoShadow);
        assertNotNull(repoShadowType);
        assertEquals(RESOURCE_OPENDJ_OID, repoShadowType.getResourceRef().getOid());
        assertNotNull("Shadow stored in repository has no name", repoShadowType.getName());
        // Check the "name" property, it should be set to DN, not entryUUID
        assertEquals("Wrong name property", USER_JACK_LDAP_DN.toLowerCase(), repoShadowType.getName().getOrig().toLowerCase());
        // check attributes in the shadow: should be only identifiers (ICF UID)
        String uid = checkRepoShadow(repoShadow);
        // check if account was created in LDAP
        Entry entry = openDJController.searchAndAssertByEntryUuid(uid);
        display("LDAP account", entry);
        OpenDJController.assertAttribute(entry, "uid", "jack");
        OpenDJController.assertAttribute(entry, "givenName", "Jack");
        OpenDJController.assertAttribute(entry, "sn", "Sparrow");
        OpenDJController.assertAttribute(entry, "cn", "Jack Sparrow");
        OpenDJController.assertAttribute(entry, "displayName", "Jack Sparrow");
        // The "l" attribute is assigned indirectly through schemaHandling and
        // config object
        OpenDJController.assertAttribute(entry, "l", "Black Pearl");
        assertTrue("LDAP account is not enabled", openDJController.isAccountEnabled(entry));
        originalJacksLdapPassword = OpenDJController.getAttributeValue(entry, "userPassword");
        assertNotNull("Pasword was not set on create", originalJacksLdapPassword);
        System.out.println("password after create: " + originalJacksLdapPassword);
        // Use getObject to test fetch of complete shadow
        assertNoRepoCache();
        Holder<OperationResultType> resultHolder = new Holder<OperationResultType>();
        Holder<ObjectType> objectHolder = new Holder<ObjectType>();
        SelectorQualifiedGetOptionsType options = new SelectorQualifiedGetOptionsType();
        // WHEN
        modelWeb.getObject(ObjectTypes.SHADOW.getTypeQName(), accountShadowOidOpendj, options, objectHolder, resultHolder);
        // THEN
        assertNoRepoCache();
        displayJaxb("getObject result", resultHolder.value, SchemaConstants.C_RESULT);
        TestUtil.assertSuccess("getObject has failed", resultHolder.value);
        ShadowType modelShadow = (ShadowType) objectHolder.value;
        display("Shadow (model)", modelShadow);
        AssertJUnit.assertNotNull(modelShadow);
        AssertJUnit.assertEquals(RESOURCE_OPENDJ_OID, modelShadow.getResourceRef().getOid());
        assertAttributeNotNull(modelShadow, getOpenDjPrimaryIdentifierQName());
        assertAttribute(resourceTypeOpenDjrepo, modelShadow, "uid", "jack");
        assertAttribute(resourceTypeOpenDjrepo, modelShadow, "givenName", "Jack");
        assertAttribute(resourceTypeOpenDjrepo, modelShadow, "sn", "Sparrow");
        assertAttribute(resourceTypeOpenDjrepo, modelShadow, "cn", "Jack Sparrow");
        assertAttribute(resourceTypeOpenDjrepo, modelShadow, "displayName", "Jack Sparrow");
        assertAttribute(resourceTypeOpenDjrepo, modelShadow, "l", "Black Pearl");
        assertNull("carLicense attribute sneaked to LDAP", OpenDJController.getAttributeValue(entry, "carLicense"));
        assertNull("postalAddress attribute sneaked to LDAP", OpenDJController.getAttributeValue(entry, "postalAddress"));
        assertNotNull("Activation is null (model)", modelShadow.getActivation());
        assertEquals("Wrong administrativeStatus in the shadow (model)", ActivationStatusType.ENABLED, modelShadow.getActivation().getAdministrativeStatus());
    } catch (Exception ex) {
        LOGGER.info("ERROR: {}", ex);
        throw ex;
    }
}

Example 24 with COMPLETE

use of com.evolveum.midpoint.xml.ns._public.common.common_3.WorkBucketStateType.COMPLETE in project midpoint by Evolveum.

the class ExpressionUtil method addActorVariable.

public static void addActorVariable(ExpressionVariables scriptVariables, SecurityEnforcer securityEnforcer) {
    // There can already be a value, because for mappings, we create the
    // variable before parsing sources.
    // For other scripts we do it just before the execution, to catch all
    // possible places where scripts can be executed.
    UserType oldActor = (UserType) scriptVariables.get(ExpressionConstants.VAR_ACTOR);
    if (oldActor != null) {
        return;
    }
    UserType actor = null;
    try {
        if (securityEnforcer != null) {
            if (!securityEnforcer.isAuthenticated()) {
                // This is most likely evaluation of role
                // condition before
                // the authentication is complete.
                scriptVariables.addVariableDefinition(ExpressionConstants.VAR_ACTOR, null);
                return;
            }
            MidPointPrincipal principal = securityEnforcer.getPrincipal();
            if (principal != null) {
                actor = principal.getUser();
            }
        }
        if (actor == null) {
            LOGGER.debug("Couldn't get principal information - the 'actor' variable is set to null");
        }
    } catch (SecurityViolationException e) {
        LoggingUtils.logUnexpectedException(LOGGER, "Couldn't get principal information - the 'actor' variable is set to null", e);
    }
    scriptVariables.addVariableDefinition(ExpressionConstants.VAR_ACTOR, actor);
}

Example 25 with COMPLETE

use of com.evolveum.midpoint.xml.ns._public.common.common_3.WorkBucketStateType.COMPLETE in project midpoint by Evolveum.

the class TestSanityLegacy method test031EnableUser.

/**
     * Try to enable user after it has been disabled. As the user has an account, the account should be enabled as well.
     */
@Test
public void test031EnableUser() throws Exception {
    final String TEST_NAME = "test031EnableUser";
    TestUtil.displayTestTile(TEST_NAME);
    // GIVEN
    ObjectDeltaType objectChange = unmarshallValueFromFile(REQUEST_USER_MODIFY_ACTIVATION_ENABLE_FILENAME, ObjectDeltaType.class);
    assertNoRepoCache();
    // WHEN ObjectTypes.USER.getTypeQName(), 
    OperationResultType result = modifyObjectViaModelWS(objectChange);
    // THEN
    assertNoRepoCache();
    displayJaxb("modifyObject result:", result, SchemaConstants.C_RESULT);
    TestUtil.assertSuccess("modifyObject has failed", result);
    // Check if user object was modified in the repo
    OperationResult repoResult = new OperationResult("getObject");
    PrismObject<UserType> uObject = repositoryService.getObject(UserType.class, USER_JACK_OID, null, repoResult);
    UserType repoUser = uObject.asObjectable();
    display("repo user", repoUser);
    // Check if nothing else was modified
    PrismAsserts.assertEqualsPolyString("wrong repo fullName", "Cpt. Jack Sparrow", repoUser.getFullName());
    PrismAsserts.assertEqualsPolyString("wrong repo locality", "somewhere", repoUser.getLocality());
    // Check if appropriate accountRef is still there
    List<ObjectReferenceType> accountRefs = repoUser.getLinkRef();
    assertEquals(1, accountRefs.size());
    for (ObjectReferenceType accountRef : accountRefs) {
        assertTrue("No OID in " + accountRef + " in " + repoUser, accountRef.getOid().equals(accountShadowOidOpendj));
    }
    // Check if shadow is still in the repo and that it is untouched
    repoResult = new OperationResult("getObject");
    PrismObject<ShadowType> repoShadow = repositoryService.getObject(ShadowType.class, accountShadowOidOpendj, null, repoResult);
    ShadowType repoShadowType = repoShadow.asObjectable();
    repoResult.computeStatus();
    TestUtil.assertSuccess("getObject(repo) has failed", repoResult);
    display("repo shadow", repoShadowType);
    AssertJUnit.assertNotNull(repoShadowType);
    AssertJUnit.assertEquals(RESOURCE_OPENDJ_OID, repoShadowType.getResourceRef().getOid());
    // check attributes in the shadow: should be only identifiers (ICF UID)
    String uid = checkRepoShadow(repoShadow);
    // Use getObject to test fetch of complete shadow
    Holder<OperationResultType> resultHolder = new Holder<OperationResultType>();
    Holder<ObjectType> objectHolder = new Holder<ObjectType>();
    SelectorQualifiedGetOptionsType options = new SelectorQualifiedGetOptionsType();
    assertNoRepoCache();
    // WHEN
    modelWeb.getObject(ObjectTypes.SHADOW.getTypeQName(), accountShadowOidOpendj, options, objectHolder, resultHolder);
    // THEN
    assertNoRepoCache();
    displayJaxb("getObject result", resultHolder.value, SchemaConstants.C_RESULT);
    TestUtil.assertSuccess("getObject has failed", resultHolder.value);
    ShadowType modelShadow = (ShadowType) objectHolder.value;
    display("Shadow (model)", modelShadow);
    AssertJUnit.assertNotNull(modelShadow);
    AssertJUnit.assertEquals(RESOURCE_OPENDJ_OID, modelShadow.getResourceRef().getOid());
    assertAttributeNotNull(modelShadow, SchemaConstants.ICFS_UID);
    assertAttribute(resourceTypeOpenDjrepo, modelShadow, "uid", "jack");
    assertAttribute(resourceTypeOpenDjrepo, modelShadow, "givenName", "Jack");
    assertAttribute(resourceTypeOpenDjrepo, modelShadow, "sn", "Sparrow");
    assertAttribute(resourceTypeOpenDjrepo, modelShadow, "cn", "Cpt. Jack Sparrow");
    assertAttribute(resourceTypeOpenDjrepo, modelShadow, "displayName", "Cpt. Jack Sparrow");
    assertAttribute(resourceTypeOpenDjrepo, modelShadow, "l", "somewhere");
    assertNotNull("The account activation is null in the shadow", modelShadow.getActivation());
    assertNotNull("The account activation status was not present in shadow", modelShadow.getActivation().getAdministrativeStatus());
    assertEquals("The account was not enabled in the shadow", ActivationStatusType.ENABLED, modelShadow.getActivation().getAdministrativeStatus());
    // Check if LDAP account was updated
    Entry entry = openDJController.searchAndAssertByEntryUuid(uid);
    assertOpenDJAccountJack(entry, "jack");
    // The value of ds-pwp-account-disabled should have been removed
    String pwpAccountDisabled = OpenDJController.getAttributeValue(entry, "ds-pwp-account-disabled");
    System.out.println("ds-pwp-account-disabled after change: " + pwpAccountDisabled);
    assertTrue("LDAP account was not enabled", openDJController.isAccountEnabled(entry));
}