Examples with RoleCannotBeManagedException cz.metacentrum.perun.core.api.exceptions.RoleCannotBeManagedException used on opensource projects

Example 6 with RoleCannotBeManagedException

use of cz.metacentrum.perun.core.api.exceptions.RoleCannotBeManagedException in project perun by CESNET.

the class GroupsManagerBlImpl method deleteAnyGroup.

/**
 * If forceDelete is false, delete only group which has no subgroup and no member.
 * If forceDelete is true, delete group with all subgroups and members.
 *
 * @param sess
 * @param group
 * @param forceDelete if false, delete only empty group without subgroups. If true, delete group including subgroups and members.
 * @throws InternalErrorException
 * @throws RelationExistsException Raise only if forceDelete is false and the group has any subgroup or member.
 * @throws GroupAlreadyRemovedException if there are 0 rows affected by deleting from DB
 */
private void deleteAnyGroup(PerunSession sess, Group group, boolean forceDelete) throws RelationExistsException, GroupAlreadyRemovedException, GroupAlreadyRemovedFromResourceException, GroupNotExistsException, GroupRelationDoesNotExist, GroupRelationCannotBeRemoved {
    Vo vo = this.getVo(sess, group);
    if (getGroupsManagerImpl().getSubGroupsCount(sess, group) > 0) {
        if (!forceDelete)
            throw new RelationExistsException("Group group=" + group + " contains subgroups");
        // get subgroups of this group
        List<Group> subGroups = getSubGroups(sess, group);
        for (Group subGroup : subGroups) {
            deleteAnyGroup(sess, subGroup, true);
        }
    }
    if ((this.getGroupMembersCount(sess, group) > 0) && !forceDelete) {
        throw new RelationExistsException("Group group=" + group + " contains members");
    }
    List<AssignedResource> assignedResources = getPerunBl().getResourcesManagerBl().getResourceAssignments(sess, group, List.of());
    try {
        for (AssignedResource assignedResource : assignedResources) {
            if (assignedResource.getSourceGroupId() == null) {
                getPerunBl().getResourcesManagerBl().removeGroupFromResource(sess, group, assignedResource.getEnrichedResource().getResource());
            } else {
                getPerunBl().getResourcesManagerBl().removeAutomaticGroupFromResource(sess, group, assignedResource.getEnrichedResource().getResource(), assignedResource.getSourceGroupId());
            }
        }
        // remove group's attributes
        getPerunBl().getAttributesManagerBl().removeAllAttributes(sess, group);
    } catch (GroupNotDefinedOnResourceException ex) {
        throw new ConsistencyErrorException(ex);
    } catch (AttributeValueException ex) {
        throw new ConsistencyErrorException("All resources was removed from this group, so no attributes should remain assigned.", ex);
    }
    // delete all Groups reserved logins from KDC
    List<Integer> list = getGroupsManagerImpl().getGroupApplicationIds(sess, group);
    for (Integer appId : list) {
        // for each application
        for (Pair<String, String> login : getGroupsManagerImpl().getApplicationReservedLogins(appId)) {
            // for all reserved logins - delete them in ext. system (e.g. KDC)
            try {
                // left = namespace / right = login
                getPerunBl().getUsersManagerBl().deletePassword(sess, login.getRight(), login.getLeft());
            } catch (LoginNotExistsException ex) {
                log.error("Login: {} not exists in namespace: {} while deleting passwords.", login.getRight(), login.getLeft());
            } catch (InvalidLoginException e) {
                throw new InternalErrorException("We are deleting reserved login from group applications, but its syntax is not allowed by namespace configuration.", e);
            } catch (PasswordDeletionFailedException | PasswordOperationTimeoutException ex) {
                throw new InternalErrorException("Failed to delete reserved login " + login.getRight() + " from KDC.", ex);
            }
        }
    }
    // delete all Groups reserved logins from DB
    getGroupsManagerImpl().deleteGroupReservedLogins(sess, group);
    // remove all assigned ExtSources to this group
    List<ExtSource> assignedSources = getPerunBl().getExtSourcesManagerBl().getGroupExtSources(sess, group);
    for (ExtSource source : assignedSources) {
        try {
            getPerunBl().getExtSourcesManagerBl().removeExtSource(sess, group, source);
        } catch (ExtSourceNotAssignedException | ExtSourceAlreadyRemovedException ex) {
            // Just log this, because if method can't remove it, it is probably not assigned now
            log.warn("Try to remove not existing extSource {} from group {} when deleting group.", source, group);
        }
    }
    // 1. remove all relations with group g as an operand group.
    // this removes all relations that depend on this group
    List<Integer> relations = groupsManagerImpl.getResultGroupsIds(sess, group.getId());
    for (Integer groupId : relations) {
        removeGroupUnion(sess, groupsManagerImpl.getGroupById(sess, groupId), group, true);
    }
    // 2. remove all relations with group as a result group
    // We can remove relations without recalculation (@see removeRelationMembers)
    // because all dependencies of group were deleted in step 1.
    groupsManagerImpl.removeResultGroupRelations(sess, group);
    // Group applications, submitted data and app_form are deleted on cascade with "deleteGroup()"
    List<Member> membersFromDeletedGroup = getGroupMembers(sess, group);
    // delete all member-group attributes
    for (Member member : membersFromDeletedGroup) {
        try {
            perunBl.getAttributesManagerBl().removeAllAttributes(sess, member, group);
        } catch (AttributeValueException ex) {
            throw new ConsistencyErrorException("All members were removed from this group. So all member-group attribute values can be removed.", ex);
        } catch (MemberGroupMismatchException e) {
            throw new InternalErrorException("Member we tried to remove all member-group attributes doesn't come from the same VO as group", e);
        }
    }
    // remove admin roles of group
    List<Facility> facilitiesWhereGroupIsAdmin = getGroupsManagerImpl().getFacilitiesWhereGroupIsAdmin(sess, group);
    for (Facility facility : facilitiesWhereGroupIsAdmin) {
        try {
            AuthzResolverBlImpl.unsetRole(sess, group, facility, Role.FACILITYADMIN);
        } catch (GroupNotAdminException e) {
            log.warn("Can't unset group {} as admin of facility {} due to group not admin exception {}.", group, facility, e);
        } catch (RoleCannotBeManagedException e) {
            throw new InternalErrorException(e);
        }
    }
    List<Group> groupsWhereGroupIsAdmin = getGroupsManagerImpl().getGroupsWhereGroupIsAdmin(sess, group);
    for (Group group1 : groupsWhereGroupIsAdmin) {
        try {
            AuthzResolverBlImpl.unsetRole(sess, group, group1, Role.GROUPADMIN);
        } catch (GroupNotAdminException e) {
            log.warn("Can't unset group {} as admin of group {} due to group not admin exception {}.", group, group1, e);
        } catch (RoleCannotBeManagedException e) {
            throw new InternalErrorException(e);
        }
    }
    List<Resource> resourcesWhereGroupIsAdmin = getGroupsManagerImpl().getResourcesWhereGroupIsAdmin(sess, group);
    for (Resource resource : resourcesWhereGroupIsAdmin) {
        try {
            AuthzResolverBlImpl.unsetRole(sess, group, resource, Role.RESOURCEADMIN);
        } catch (GroupNotAdminException e) {
            log.warn("Can't unset group {} as admin of resource {} due to group not admin exception {}.", group, resource, e);
        } catch (RoleCannotBeManagedException e) {
            throw new InternalErrorException(e);
        }
    }
    List<Resource> resourcesWhereGroupIsResourceSelfService = getGroupsManagerImpl().getResourcesWhereGroupIsResourceSelfService(sess, group);
    for (Resource resource : resourcesWhereGroupIsResourceSelfService) {
        try {
            perunBl.getResourcesManagerBl().removeResourceSelfServiceGroup(sess, resource, group);
        } catch (GroupNotAdminException e) {
            log.warn("Can't unset group {} as admin of resource {} due to group not admin exception {}.", group, resource, e);
        }
    }
    List<SecurityTeam> securityTeamsWhereGroupIsAdmin = getGroupsManagerImpl().getSecurityTeamsWhereGroupIsAdmin(sess, group);
    for (SecurityTeam securityTeam : securityTeamsWhereGroupIsAdmin) {
        try {
            AuthzResolverBlImpl.unsetRole(sess, group, securityTeam, Role.SECURITYADMIN);
        } catch (GroupNotAdminException e) {
            log.warn("Can't unset group {} as admin of security team {} due to group not admin exception {}.", group, securityTeam, e);
        } catch (RoleCannotBeManagedException e) {
            throw new InternalErrorException(e);
        }
    }
    List<Vo> vosWhereGroupIsAdmin = getGroupsManagerImpl().getVosWhereGroupIsAdmin(sess, group);
    for (Vo vo1 : vosWhereGroupIsAdmin) {
        try {
            AuthzResolverBlImpl.unsetRole(sess, group, vo1, Role.VOADMIN);
        } catch (GroupNotAdminException e) {
            log.warn("Can't unset group {} as admin of facility {} due to group not admin exception {}.", group, vo1, e);
        } catch (RoleCannotBeManagedException e) {
            throw new InternalErrorException(e);
        }
    }
    // remove admins of this group
    List<Group> adminGroups = getGroupsManagerImpl().getGroupAdmins(sess, group);
    for (Group adminGroup : adminGroups) {
        try {
            AuthzResolverBlImpl.unsetRole(sess, adminGroup, group, Role.GROUPADMIN);
        } catch (GroupNotAdminException e) {
            log.warn("When trying to unsetRole GroupAdmin for group {} in the group {} the exception was thrown {}", adminGroup, group, e);
        // skip and log as warning
        } catch (RoleCannotBeManagedException e) {
            throw new InternalErrorException(e);
        }
    }
    List<User> adminUsers = getGroupsManagerImpl().getAdmins(sess, group);
    for (User adminUser : adminUsers) {
        try {
            AuthzResolverBlImpl.unsetRole(sess, adminUser, group, Role.GROUPADMIN);
        } catch (UserNotAdminException e) {
            log.warn("When trying to unsetRole GroupAdmin for user {} in the group {} the exception was thrown {}", adminUser, group, e);
        // skip and log as warning
        } catch (RoleCannotBeManagedException e) {
            throw new InternalErrorException(e);
        }
    }
    // Deletes also all direct and indirect members of the group
    getGroupsManagerImpl().deleteGroup(sess, vo, group);
    logTotallyRemovedMembers(sess, group.getParentGroupId(), membersFromDeletedGroup);
    getPerunBl().getAuditer().log(sess, new GroupDeleted(group));
}

Example 7 with RoleCannotBeManagedException

use of cz.metacentrum.perun.core.api.exceptions.RoleCannotBeManagedException in project perun by CESNET.

the class EduGain method approveApplication.

/**
 * All new members will be given role VOOBSERVER and TOPGROUPCREATOR
 */
@Override
public Application approveApplication(PerunSession session, Application app) throws UserNotExistsException, PrivilegeException, AlreadyAdminException, GroupNotExistsException, VoNotExistsException {
    if (Application.AppType.INITIAL.equals(app.getType())) {
        Vo vo = app.getVo();
        User user = app.getUser();
        try {
            AuthzResolver.setRole(session, user, vo, Role.TOPGROUPCREATOR);
            Group membersGroup = session.getPerun().getGroupsManager().getGroupByName(session, vo, "members");
            AuthzResolver.setRole(session, user, membersGroup, Role.GROUPADMIN);
        } catch (RoleCannotBeManagedException e) {
            throw new InternalErrorException(e);
        }
    }
    return app;
}

Example 8 with RoleCannotBeManagedException

use of cz.metacentrum.perun.core.api.exceptions.RoleCannotBeManagedException in project perun by CESNET.

the class MembersManagerBlImpl method moveMembersSponsorships.

/**
 * Moves sponsorships in VO from source user to target user - moves sponsorships
 * where the source user is sponsor or where the source member is sponsored.
 *
 * @param sess
 * @param vo VO to move sponsorships in
 * @param sourceUser user to move sponsorships from
 * @param targetUser user to move sponsorships to
 * @param sourceMember member of the source user in the VO
 * @param targetMember member of the target user in the VO
 */
private void moveMembersSponsorships(PerunSession sess, Vo vo, User sourceUser, User targetUser, Member sourceMember, Member targetMember) {
    // move sponsorships where sourceUser is sponsor
    List<Member> sponsoredMembers = this.getSponsoredMembers(sess, vo, sourceUser);
    for (Member sponsoredMember : sponsoredMembers) {
        try {
            Sponsorship sponsorship = this.getSponsorship(sess, sponsoredMember, sourceUser);
            // if target user isn't in role SPONSOR for the VO, assign the role to him
            if (!getPerunBl().getVosManagerBl().isUserInRoleForVo(sess, targetUser, Role.SPONSOR, vo, true)) {
                AuthzResolverBlImpl.setRole(sess, targetUser, vo, Role.SPONSOR);
            }
            // first add sponsorship to targetUser
            this.sponsorMember(sess, sponsoredMember, targetUser, sponsorship.getValidityTo());
            // then remove sponsorship from sourceUser
            this.removeSponsor(sess, sponsoredMember, sourceUser);
        } catch (SponsorshipDoesNotExistException | MemberNotSponsoredException e) {
            throw new ConsistencyErrorException(e);
        } catch (AlreadySponsorException e) {
            log.warn("When moving sponsorships from sponsor {} to sponsor {}, the sponsor already sponsored " + "member {}. Exception: {}", sourceUser, targetUser, sponsoredMember, e);
        } catch (UserNotInRoleException | AlreadyAdminException | RoleCannotBeManagedException e) {
            throw new InternalErrorException(e);
        }
    }
    // move sponsorships where sourceMember is sponsored
    if (sourceMember.isSponsored()) {
        List<User> sponsors = getPerunBl().getUsersManagerBl().getSponsors(sess, sourceMember);
        try {
            for (int i = 0; i < sponsors.size(); i++) {
                User sponsor = sponsors.get(i);
                Sponsorship sponsorship = this.getSponsorship(sess, sourceMember, sponsor);
                // because the member needs to be marked as sponsored first
                if (i == 0) {
                    this.setSponsorshipForMember(sess, targetMember, sponsor, sponsorship.getValidityTo());
                } else {
                    this.sponsorMember(sess, targetMember, sponsor, sponsorship.getValidityTo());
                }
            }
        } catch (SponsorshipDoesNotExistException e) {
            throw new ConsistencyErrorException(e);
        } catch (AlreadySponsoredMemberException | MemberNotSponsoredException | AlreadySponsorException | UserNotInRoleException e) {
            throw new InternalErrorException(e);
        }
    }
}

Example 9 with RoleCannotBeManagedException

use of cz.metacentrum.perun.core.api.exceptions.RoleCannotBeManagedException in project perun by CESNET.

the class ResourcesManagerBlImpl method deleteResource.

@Override
public void deleteResource(PerunSession sess, Resource resource) throws ResourceAlreadyRemovedException, GroupAlreadyRemovedFromResourceException {
    // Get facility for audit messages
    Facility facility = this.getFacility(sess, resource);
    // remove admins of this resource
    List<Group> adminGroups = getResourcesManagerImpl().getAdminGroups(sess, resource);
    for (Group adminGroup : adminGroups) {
        try {
            AuthzResolverBlImpl.unsetRole(sess, adminGroup, resource, Role.RESOURCEADMIN);
        } catch (GroupNotAdminException e) {
            log.warn("When trying to unsetRole ResourceAdmin for group {} in the resource {} the exception was thrown {}", adminGroup, resource, e);
        // skip and log as warning
        } catch (RoleCannotBeManagedException e) {
            throw new InternalErrorException(e);
        }
    }
    List<User> adminUsers = getResourcesManagerImpl().getAdmins(sess, resource);
    for (User adminUser : adminUsers) {
        try {
            AuthzResolverBlImpl.unsetRole(sess, adminUser, resource, Role.RESOURCEADMIN);
        } catch (UserNotAdminException e) {
            log.warn("When trying to unsetRole ResourceAdmin for user {} in the resource {} the exception was thrown {}", adminUser, resource, e);
        // skip and log as warning
        } catch (RoleCannotBeManagedException e) {
            throw new InternalErrorException(e);
        }
    }
    // Remove binding between resource and service
    List<Service> services = getAssignedServices(sess, resource);
    for (Service service : services) {
        try {
            this.removeService(sess, resource, service);
        } catch (ServiceNotAssignedException e) {
            throw new ConsistencyErrorException(e);
        }
    }
    List<AssignedGroup> assignedGroups = getGroupAssignments(sess, resource, List.of());
    for (AssignedGroup assignedGroup : assignedGroups) {
        if (assignedGroup.getSourceGroupId() == null) {
            try {
                removeGroupFromResource(sess, assignedGroup.getEnrichedGroup().getGroup(), resource);
            } catch (GroupNotDefinedOnResourceException ex) {
                throw new GroupAlreadyRemovedFromResourceException(ex);
            }
        }
    }
    // Remove attr values for the resource
    try {
        perunBl.getAttributesManagerBl().removeAllAttributes(sess, resource);
    } catch (AttributeValueException ex) {
        throw new ConsistencyErrorException("All services are removed from this resource. There is no required attribute. So all attribtes for this resource can be removed withou problem.", ex);
    }
    // Remove group-resource attr values for all group and resource
    try {
        this.perunBl.getAttributesManagerBl().removeAllGroupResourceAttributes(sess, resource);
    } catch (WrongAttributeValueException | GroupResourceMismatchException | WrongReferenceAttributeValueException ex) {
        throw new InternalErrorException(ex);
    }
    // Remove all resources tags
    this.removeAllResourcesTagFromResource(sess, resource);
    // Remove all resource bans
    List<BanOnResource> bansOnResource = this.getBansForResource(sess, resource.getId());
    for (BanOnResource banOnResource : bansOnResource) {
        try {
            this.removeBan(sess, banOnResource.getId());
        } catch (BanNotExistsException ex) {
        // it is ok, we just want to remove it anyway
        }
    }
    // Because resource will be tottaly deleted, we can also delete all member-resource attributes
    this.perunBl.getAttributesManagerBl().removeAllMemberResourceAttributes(sess, resource);
    // Get the resource VO
    Vo vo = this.getVo(sess, resource);
    getResourcesManagerImpl().deleteResource(sess, vo, resource);
    getPerunBl().getAuditer().log(sess, new ResourceDeleted(resource, facility));
}

Example 10 with RoleCannotBeManagedException

use of cz.metacentrum.perun.core.api.exceptions.RoleCannotBeManagedException in project perun by CESNET.

the class SecurityTeamsManagerBlImpl method createSecurityTeam.

@Override
public SecurityTeam createSecurityTeam(PerunSession sess, SecurityTeam securityTeam) {
    securityTeam = getSecurityTeamsManagerImpl().createSecurityTeam(sess, securityTeam);
    getPerunBl().getAuditer().log(sess, new SecurityTeamCreated(securityTeam));
    // set creator as security team admin
    User user = sess.getPerunPrincipal().getUser();
    if (user != null) {
        // user can be null in tests
        try {
            AuthzResolverBlImpl.setRole(sess, user, securityTeam, Role.SECURITYADMIN);
        } catch (AlreadyAdminException e) {
            throw new ConsistencyErrorException("Newly created securityTeam already have an admin.", e);
        } catch (RoleCannotBeManagedException e) {
            throw new InternalErrorException(e);
        }
    }
    return securityTeam;
}