use of com.evolveum.prism.xml.ns._public.types_3.ProtectedStringType in project midpoint by Evolveum.
the class ModelClientUtil method createProtectedString.
public static ProtectedStringType createProtectedString(String clearValue) {
ProtectedStringType protectedString = new ProtectedStringType();
protectedString.setClearValue(clearValue);
return protectedString;
}
use of com.evolveum.prism.xml.ns._public.types_3.ProtectedStringType in project midpoint by Evolveum.
the class ConnectorInstanceConnIdImpl method modifyObject.
// TODO [med] beware, this method does not obey its contract specified in the interface
// (1) currently it does not return all the changes, only the 'side effect' changes
// (2) it throws exceptions even if some of the changes were made
// (3) among identifiers, only the UID value is updated on object rename
// (other identifiers are ignored on input and output of this method)
@Override
public AsynchronousOperationReturnValue<Collection<PropertyModificationOperation>> modifyObject(ObjectClassComplexTypeDefinition objectClassDef, Collection<? extends ResourceAttribute<?>> identifiers, Collection<Operation> changes, StateReporter reporter, OperationResult parentResult) throws ObjectNotFoundException, CommunicationException, GenericFrameworkException, SchemaException, SecurityViolationException, ObjectAlreadyExistsException {
OperationResult result = parentResult.createSubresult(ConnectorInstance.class.getName() + ".modifyObject");
result.addParam("objectClass", objectClassDef);
result.addCollectionOfSerializablesAsParam("identifiers", identifiers);
result.addArbitraryCollectionAsParam("changes", changes);
if (changes.isEmpty()) {
LOGGER.info("No modifications for connector object specified. Skipping processing.");
result.recordNotApplicableIfUnknown();
return AsynchronousOperationReturnValue.wrap(new ArrayList<PropertyModificationOperation>(0), result);
}
ObjectClass objClass = connIdNameMapper.objectClassToIcf(objectClassDef, getSchemaNamespace(), connectorType, legacySchema);
Uid uid;
try {
uid = getUid(objectClassDef, identifiers);
} catch (SchemaException e) {
result.recordFatalError(e);
throw e;
}
if (uid == null) {
result.recordFatalError("Cannot detemine UID from identifiers: " + identifiers);
throw new IllegalArgumentException("Cannot detemine UID from identifiers: " + identifiers);
}
String originalUid = uid.getUidValue();
Set<Attribute> attributesToAdd = new HashSet<>();
Set<Attribute> attributesToUpdate = new HashSet<>();
Set<Attribute> attributesToRemove = new HashSet<>();
Set<Operation> additionalOperations = new HashSet<Operation>();
PasswordChangeOperation passwordChangeOperation = null;
Collection<PropertyDelta<?>> activationDeltas = new HashSet<PropertyDelta<?>>();
PropertyDelta<ProtectedStringType> passwordDelta = null;
PropertyDelta<QName> auxiliaryObjectClassDelta = null;
for (Operation operation : changes) {
if (operation == null) {
IllegalArgumentException e = new IllegalArgumentException("Null operation in modifyObject");
result.recordFatalError(e);
throw e;
}
if (operation instanceof PropertyModificationOperation) {
PropertyDelta<?> delta = ((PropertyModificationOperation) operation).getPropertyDelta();
if (delta.getPath().equivalent(new ItemPath(ShadowType.F_AUXILIARY_OBJECT_CLASS))) {
auxiliaryObjectClassDelta = (PropertyDelta<QName>) delta;
}
}
}
try {
ObjectClassComplexTypeDefinition structuralObjectClassDefinition = resourceSchema.findObjectClassDefinition(objectClassDef.getTypeName());
if (structuralObjectClassDefinition == null) {
throw new SchemaException("No definition of structural object class " + objectClassDef.getTypeName() + " in " + description);
}
Map<QName, ObjectClassComplexTypeDefinition> auxiliaryObjectClassMap = new HashMap<>();
if (auxiliaryObjectClassDelta != null) {
// Activation change means modification of attributes
if (auxiliaryObjectClassDelta.isReplace()) {
if (auxiliaryObjectClassDelta.getValuesToReplace() == null || auxiliaryObjectClassDelta.getValuesToReplace().isEmpty()) {
attributesToUpdate.add(AttributeBuilder.build(PredefinedAttributes.AUXILIARY_OBJECT_CLASS_NAME));
} else {
addConvertedValues(auxiliaryObjectClassDelta.getValuesToReplace(), attributesToUpdate, auxiliaryObjectClassMap);
}
} else {
addConvertedValues(auxiliaryObjectClassDelta.getValuesToAdd(), attributesToAdd, auxiliaryObjectClassMap);
addConvertedValues(auxiliaryObjectClassDelta.getValuesToDelete(), attributesToRemove, auxiliaryObjectClassMap);
}
}
for (Operation operation : changes) {
if (operation instanceof PropertyModificationOperation) {
PropertyModificationOperation change = (PropertyModificationOperation) operation;
PropertyDelta<?> delta = change.getPropertyDelta();
if (delta.getParentPath().equivalent(new ItemPath(ShadowType.F_ATTRIBUTES))) {
if (delta.getDefinition() == null || !(delta.getDefinition() instanceof ResourceAttributeDefinition)) {
ResourceAttributeDefinition def = objectClassDef.findAttributeDefinition(delta.getElementName());
if (def == null) {
String message = "No definition for attribute " + delta.getElementName() + " used in modification delta";
result.recordFatalError(message);
throw new SchemaException(message);
}
try {
delta.applyDefinition(def);
} catch (SchemaException e) {
result.recordFatalError(e.getMessage(), e);
throw e;
}
}
boolean isInRemovedAuxClass = false;
boolean isInAddedAuxClass = false;
ResourceAttributeDefinition<Object> structAttrDef = structuralObjectClassDefinition.findAttributeDefinition(delta.getElementName());
// aux object class, we cannot add/remove it with the object class unless it is normally requested
if (structAttrDef == null) {
if (auxiliaryObjectClassDelta != null && auxiliaryObjectClassDelta.isDelete()) {
// is removed, the attributes must be removed as well.
for (PrismPropertyValue<QName> auxPval : auxiliaryObjectClassDelta.getValuesToDelete()) {
ObjectClassComplexTypeDefinition auxDef = auxiliaryObjectClassMap.get(auxPval.getValue());
ResourceAttributeDefinition<Object> attrDef = auxDef.findAttributeDefinition(delta.getElementName());
if (attrDef != null) {
isInRemovedAuxClass = true;
break;
}
}
}
if (auxiliaryObjectClassDelta != null && auxiliaryObjectClassDelta.isAdd()) {
// is added, the attributes must be added as well.
for (PrismPropertyValue<QName> auxPval : auxiliaryObjectClassDelta.getValuesToAdd()) {
ObjectClassComplexTypeDefinition auxOcDef = auxiliaryObjectClassMap.get(auxPval.getValue());
ResourceAttributeDefinition<Object> auxAttrDef = auxOcDef.findAttributeDefinition(delta.getElementName());
if (auxAttrDef != null) {
isInAddedAuxClass = true;
break;
}
}
}
}
// Change in (ordinary) attributes. Transform to the ConnId attributes.
if (delta.isAdd()) {
ResourceAttribute<?> mpAttr = (ResourceAttribute<?>) delta.instantiateEmptyProperty();
mpAttr.addValues((Collection) PrismValue.cloneCollection(delta.getValuesToAdd()));
Attribute connIdAttr = connIdConvertor.convertToConnIdAttribute(mpAttr, objectClassDef);
if (mpAttr.getDefinition().isMultiValue()) {
attributesToAdd.add(connIdAttr);
} else {
// Force "update" for single-valued attributes instead of "add". This is saving one
// read in some cases. It should also make no substantial difference in such case.
// But it is working around some connector bugs.
attributesToUpdate.add(connIdAttr);
}
}
if (delta.isDelete()) {
ResourceAttribute<?> mpAttr = (ResourceAttribute<?>) delta.instantiateEmptyProperty();
if (mpAttr.getDefinition().isMultiValue() || isInRemovedAuxClass) {
mpAttr.addValues((Collection) PrismValue.cloneCollection(delta.getValuesToDelete()));
Attribute connIdAttr = connIdConvertor.convertToConnIdAttribute(mpAttr, objectClassDef);
attributesToRemove.add(connIdAttr);
} else {
// Force "update" for single-valued attributes instead of "add". This is saving one
// read in some cases.
// Update attribute to no values. This will efficiently clean up the attribute.
// It should also make no substantial difference in such case.
// But it is working around some connector bugs.
Attribute connIdAttr = connIdConvertor.convertToConnIdAttribute(mpAttr, objectClassDef);
// update with EMTPY value. The mpAttr.addValues() is NOT in this branch
attributesToUpdate.add(connIdAttr);
}
}
if (delta.isReplace()) {
ResourceAttribute<?> mpAttr = (ResourceAttribute<?>) delta.instantiateEmptyProperty();
mpAttr.addValues((Collection) PrismValue.cloneCollection(delta.getValuesToReplace()));
Attribute connIdAttr = connIdConvertor.convertToConnIdAttribute(mpAttr, objectClassDef);
if (isInAddedAuxClass) {
attributesToAdd.add(connIdAttr);
} else {
attributesToUpdate.add(connIdAttr);
}
}
} else if (delta.getParentPath().equivalent(new ItemPath(ShadowType.F_ACTIVATION))) {
activationDeltas.add(delta);
} else if (delta.getParentPath().equivalent(new ItemPath(new ItemPath(ShadowType.F_CREDENTIALS), CredentialsType.F_PASSWORD))) {
passwordDelta = (PropertyDelta<ProtectedStringType>) delta;
} else if (delta.getPath().equivalent(new ItemPath(ShadowType.F_AUXILIARY_OBJECT_CLASS))) {
// already processed
} else {
throw new SchemaException("Change of unknown attribute " + delta.getPath());
}
} else if (operation instanceof PasswordChangeOperation) {
passwordChangeOperation = (PasswordChangeOperation) operation;
// TODO: check for multiple occurrences and fail
} else if (operation instanceof ExecuteProvisioningScriptOperation) {
ExecuteProvisioningScriptOperation scriptOperation = (ExecuteProvisioningScriptOperation) operation;
additionalOperations.add(scriptOperation);
} else {
throw new IllegalArgumentException("Unknown operation type " + operation.getClass().getName() + ": " + operation);
}
}
} catch (SchemaException | RuntimeException e) {
result.recordFatalError(e);
throw e;
}
if (LOGGER.isTraceEnabled()) {
LOGGER.trace("attributes:\nADD: {}\nUPDATE: {}\nREMOVE: {}", attributesToAdd, attributesToUpdate, attributesToRemove);
}
// Needs three complete try-catch blocks because we need to create
// icfResult for each operation
// and handle the faults individually
checkAndExecuteAdditionalOperation(reporter, additionalOperations, BeforeAfterType.BEFORE, result);
OperationResult connIdResult = null;
try {
if (!attributesToAdd.isEmpty()) {
OperationOptions options = new OperationOptionsBuilder().build();
connIdResult = result.createSubresult(ConnectorFacade.class.getName() + ".addAttributeValues");
connIdResult.addParam("objectClass", objectClassDef);
connIdResult.addParam("uid", uid.getUidValue());
connIdResult.addArbitraryCollectionAsParam("attributes", attributesToAdd);
connIdResult.addArbitraryObjectAsParam("options", options);
connIdResult.addContext("connector", connIdConnectorFacade.getClass());
if (LOGGER.isTraceEnabled()) {
LOGGER.trace("Invoking ICF addAttributeValues(), objectclass={}, uid={}, attributes: {}", new Object[] { objClass, uid, dumpAttributes(attributesToAdd) });
}
InternalMonitor.recordConnectorOperation("addAttributeValues");
// Invoking ConnId
recordIcfOperationStart(reporter, ProvisioningOperation.ICF_UPDATE, objectClassDef, uid);
uid = connIdConnectorFacade.addAttributeValues(objClass, uid, attributesToAdd, options);
recordIcfOperationEnd(reporter, ProvisioningOperation.ICF_UPDATE, objectClassDef, null, uid);
connIdResult.recordSuccess();
}
} catch (Throwable ex) {
recordIcfOperationEnd(reporter, ProvisioningOperation.ICF_UPDATE, objectClassDef, ex, uid);
String desc = this.getHumanReadableName() + " while adding attribute values to object identified by ICF UID '" + uid.getUidValue() + "'";
Throwable midpointEx = processIcfException(ex, desc, connIdResult);
result.computeStatus("Adding attribute values failed");
// exception
if (midpointEx instanceof ObjectNotFoundException) {
throw (ObjectNotFoundException) midpointEx;
} else if (midpointEx instanceof CommunicationException) {
//in this situation this is not a critical error, becasue we know to handle it..so mute the error and sign it as expected
result.muteError();
connIdResult.muteError();
throw (CommunicationException) midpointEx;
} else if (midpointEx instanceof GenericFrameworkException) {
throw (GenericFrameworkException) midpointEx;
} else if (midpointEx instanceof SchemaException) {
throw (SchemaException) midpointEx;
} else if (midpointEx instanceof AlreadyExistsException) {
throw (AlreadyExistsException) midpointEx;
} else if (midpointEx instanceof RuntimeException) {
throw (RuntimeException) midpointEx;
} else if (midpointEx instanceof SecurityViolationException) {
throw (SecurityViolationException) midpointEx;
} else if (midpointEx instanceof Error) {
throw (Error) midpointEx;
} else {
throw new SystemException("Got unexpected exception: " + ex.getClass().getName() + ": " + ex.getMessage(), ex);
}
}
if (!attributesToUpdate.isEmpty() || activationDeltas != null || passwordDelta != null || auxiliaryObjectClassDelta != null) {
try {
if (activationDeltas != null) {
// Activation change means modification of attributes
convertFromActivation(attributesToUpdate, activationDeltas);
}
if (passwordDelta != null) {
// Activation change means modification of attributes
convertFromPassword(attributesToUpdate, passwordDelta);
}
} catch (SchemaException ex) {
result.recordFatalError("Error while converting resource object attributes. Reason: " + ex.getMessage(), ex);
throw new SchemaException("Error while converting resource object attributes. Reason: " + ex.getMessage(), ex);
} catch (RuntimeException ex) {
result.recordFatalError("Error while converting resource object attributes. Reason: " + ex.getMessage(), ex);
throw ex;
}
if (!attributesToUpdate.isEmpty()) {
OperationOptions options = new OperationOptionsBuilder().build();
connIdResult = result.createSubresult(ConnectorFacade.class.getName() + ".update");
connIdResult.addParam("objectClass", objectClassDef);
connIdResult.addParam("uid", uid == null ? "null" : uid.getUidValue());
connIdResult.addArbitraryCollectionAsParam("attributes", attributesToUpdate);
connIdResult.addArbitraryObjectAsParam("options", options);
connIdResult.addContext("connector", connIdConnectorFacade.getClass());
if (LOGGER.isTraceEnabled()) {
LOGGER.trace("Invoking ICF update(), objectclass={}, uid={}, attributes: {}", new Object[] { objClass, uid, dumpAttributes(attributesToUpdate) });
}
try {
// Call ICF
InternalMonitor.recordConnectorOperation("update");
recordIcfOperationStart(reporter, ProvisioningOperation.ICF_UPDATE, objectClassDef, uid);
uid = connIdConnectorFacade.update(objClass, uid, attributesToUpdate, options);
recordIcfOperationEnd(reporter, ProvisioningOperation.ICF_UPDATE, objectClassDef, null, uid);
connIdResult.recordSuccess();
} catch (Throwable ex) {
recordIcfOperationEnd(reporter, ProvisioningOperation.ICF_UPDATE, objectClassDef, ex, uid);
String desc = this.getHumanReadableName() + " while updating object identified by ICF UID '" + uid.getUidValue() + "'";
Throwable midpointEx = processIcfException(ex, desc, connIdResult);
result.computeStatus("Update failed");
// exception
if (midpointEx instanceof ObjectNotFoundException) {
throw (ObjectNotFoundException) midpointEx;
} else if (midpointEx instanceof CommunicationException) {
//in this situation this is not a critical error, becasue we know to handle it..so mute the error and sign it as expected
result.muteError();
connIdResult.muteError();
throw (CommunicationException) midpointEx;
} else if (midpointEx instanceof GenericFrameworkException) {
throw (GenericFrameworkException) midpointEx;
} else if (midpointEx instanceof SchemaException) {
throw (SchemaException) midpointEx;
} else if (midpointEx instanceof ObjectAlreadyExistsException) {
throw (ObjectAlreadyExistsException) midpointEx;
} else if (midpointEx instanceof RuntimeException) {
throw (RuntimeException) midpointEx;
} else if (midpointEx instanceof SecurityViolationException) {
throw (SecurityViolationException) midpointEx;
} else if (midpointEx instanceof Error) {
throw (Error) midpointEx;
} else {
throw new SystemException("Got unexpected exception: " + ex.getClass().getName() + ": " + ex.getMessage(), ex);
}
}
}
}
try {
if (!attributesToRemove.isEmpty()) {
OperationOptions options = new OperationOptionsBuilder().build();
connIdResult = result.createSubresult(ConnectorFacade.class.getName() + ".removeAttributeValues");
connIdResult.addParam("objectClass", objectClassDef);
connIdResult.addParam("uid", uid.getUidValue());
connIdResult.addArbitraryCollectionAsParam("attributes", attributesToRemove);
connIdResult.addArbitraryObjectAsParam("options", options);
connIdResult.addContext("connector", connIdConnectorFacade.getClass());
if (LOGGER.isTraceEnabled()) {
LOGGER.trace("Invoking ICF removeAttributeValues(), objectclass={}, uid={}, attributes: {}", new Object[] { objClass, uid, dumpAttributes(attributesToRemove) });
}
InternalMonitor.recordConnectorOperation("removeAttributeValues");
recordIcfOperationStart(reporter, ProvisioningOperation.ICF_UPDATE, objectClassDef, uid);
uid = connIdConnectorFacade.removeAttributeValues(objClass, uid, attributesToRemove, options);
recordIcfOperationEnd(reporter, ProvisioningOperation.ICF_UPDATE, objectClassDef, null, uid);
connIdResult.recordSuccess();
}
} catch (Throwable ex) {
recordIcfOperationEnd(reporter, ProvisioningOperation.ICF_UPDATE, objectClassDef, ex, uid);
String desc = this.getHumanReadableName() + " while removing attribute values from object identified by ICF UID '" + uid.getUidValue() + "'";
Throwable midpointEx = processIcfException(ex, desc, connIdResult);
result.computeStatus("Removing attribute values failed");
// exception
if (midpointEx instanceof ObjectNotFoundException) {
throw (ObjectNotFoundException) midpointEx;
} else if (midpointEx instanceof CommunicationException) {
//in this situation this is not a critical error, becasue we know to handle it..so mute the error and sign it as expected
result.muteError();
connIdResult.muteError();
throw (CommunicationException) midpointEx;
} else if (midpointEx instanceof GenericFrameworkException) {
throw (GenericFrameworkException) midpointEx;
} else if (midpointEx instanceof SchemaException) {
throw (SchemaException) midpointEx;
} else if (midpointEx instanceof ObjectAlreadyExistsException) {
throw (ObjectAlreadyExistsException) midpointEx;
} else if (midpointEx instanceof RuntimeException) {
throw (RuntimeException) midpointEx;
} else if (midpointEx instanceof SecurityViolationException) {
throw (SecurityViolationException) midpointEx;
} else if (midpointEx instanceof Error) {
throw (Error) midpointEx;
} else {
throw new SystemException("Got unexpected exception: " + ex.getClass().getName() + ": " + ex.getMessage(), ex);
}
}
checkAndExecuteAdditionalOperation(reporter, additionalOperations, BeforeAfterType.AFTER, result);
result.computeStatus();
Collection<PropertyModificationOperation> sideEffectChanges = new ArrayList<>();
if (!originalUid.equals(uid.getUidValue())) {
// UID was changed during the operation, this is most likely a
// rename
PropertyDelta<String> uidDelta = createUidDelta(uid, getUidDefinition(objectClassDef, identifiers));
PropertyModificationOperation uidMod = new PropertyModificationOperation(uidDelta);
// TODO what about matchingRuleQName ?
sideEffectChanges.add(uidMod);
replaceUidValue(objectClassDef, identifiers, uid);
}
return AsynchronousOperationReturnValue.wrap(sideEffectChanges, result);
}
use of com.evolveum.prism.xml.ns._public.types_3.ProtectedStringType in project midpoint by Evolveum.
the class TestUcfOpenDj method test600CreateAccountWithPassword.
@Test
public void test600CreateAccountWithPassword() throws Exception {
final String TEST_NAME = "test600CreateAccountWithPassword";
TestUtil.displayTestTile(this, TEST_NAME);
// GIVEN
ResourceAttributeContainer resourceObject = createResourceObject("uid=lechuck,ou=people,dc=example,dc=com", "Ghost Pirate LeChuck", "LeChuck");
Set<Operation> additionalOperations = new HashSet<Operation>();
ProtectedStringType ps = protector.encryptString("t4k30v3rTh3W0rld");
// PasswordChangeOperation passOp = new PasswordChangeOperation(ps);
// additionalOperations.add(passOp);
OperationResult addResult = new OperationResult(this.getClass().getName() + "." + TEST_NAME);
PrismObject<ShadowType> shadow = wrapInShadow(ShadowType.class, resourceObject);
CredentialsType credentials = new CredentialsType();
PasswordType pass = new PasswordType();
pass.setValue(ps);
credentials.setPassword(pass);
shadow.asObjectable().setCredentials(credentials);
// WHEN
cc.addObject(shadow, additionalOperations, null, addResult);
// THEN
String entryUuid = (String) resourceObject.getPrimaryIdentifier().getValue().getValue();
Entry entry = openDJController.searchAndAssertByEntryUuid(entryUuid);
display("Entry before change", entry);
String passwordAfter = OpenDJController.getAttributeValue(entry, "userPassword");
assertNotNull(passwordAfter);
System.out.println("Changed password: " + passwordAfter);
// TODO
}
use of com.evolveum.prism.xml.ns._public.types_3.ProtectedStringType in project midpoint by Evolveum.
the class AbstractIntegrationTest method assertProtectedString.
protected void assertProtectedString(String message, String expectedClearValue, ProtectedStringType actualValue, CredentialsStorageTypeType storageType) throws EncryptionException, SchemaException {
switch(storageType) {
case NONE:
assertNull(message + ": unexpected value: " + actualValue, actualValue);
break;
case ENCRYPTION:
assertNotNull(message + ": no value", actualValue);
assertTrue(message + ": unenctypted value: " + actualValue, actualValue.isEncrypted());
String actualClearPassword = protector.decryptString(actualValue);
assertEquals(message + ": wrong value", expectedClearValue, actualClearPassword);
break;
case HASHING:
assertNotNull(message + ": no value", actualValue);
assertTrue(message + ": value not hashed: " + actualValue, actualValue.isHashed());
ProtectedStringType expectedPs = new ProtectedStringType();
expectedPs.setClearValue(expectedClearValue);
assertTrue(message + ": hash does not match, expected " + expectedClearValue + ", but was " + actualValue, protector.compare(actualValue, expectedPs));
break;
default:
throw new IllegalArgumentException("Unknown storage " + storageType);
}
}
use of com.evolveum.prism.xml.ns._public.types_3.ProtectedStringType in project midpoint by Evolveum.
the class AbstractIntegrationTest method setPassword.
protected void setPassword(PrismObject<UserType> user, String password) {
UserType userType = user.asObjectable();
CredentialsType creds = userType.getCredentials();
if (creds == null) {
creds = new CredentialsType();
userType.setCredentials(creds);
}
PasswordType passwordType = creds.getPassword();
if (passwordType == null) {
passwordType = new PasswordType();
creds.setPassword(passwordType);
}
ProtectedStringType ps = new ProtectedStringType();
ps.setClearValue(password);
passwordType.setValue(ps);
}
Aggregations