Examples with AccAccountDto eu.bcvsolutions.idm.acc.dto.AccAccountDto used on opensource projects

Example 56 with AccAccountDto

use of eu.bcvsolutions.idm.acc.dto.AccAccountDto in project CzechIdMng by bcvsolutions.

the class DefaultAccAuthenticator method authenticate.

@Override
public LoginDto authenticate(LoginDto loginDto) {
    // temporary solution for get system id, this is not nice.
    String systemCodeable = configurationService.getValue(PROPERTY_AUTH_SYSTEM_ID);
    if (StringUtils.isEmpty(systemCodeable)) {
        // without system can't check
        return null;
    }
    // 
    SysSystemDto system = (SysSystemDto) lookupService.lookupDto(SysSystemDto.class, systemCodeable);
    // 
    if (system == null) {
        LOG.warn("System by codeable identifier [{}] not found. Check configuration property [{}]", systemCodeable, PROPERTY_AUTH_SYSTEM_ID);
        // system doesn't exist
        return null;
    }
    IdmIdentityDto identity = (IdmIdentityDto) lookupService.lookupDto(IdmIdentityDto.class, loginDto.getUsername());
    if (identity == null) {
        throw new IdmAuthenticationException(MessageFormat.format("Check identity can login: The identity [{0}] either doesn't exist or is deleted.", loginDto.getUsername()));
    }
    // 
    // search authentication attribute for system with provisioning mapping, only for identity
    SysSystemAttributeMappingDto attribute = systemAttributeMappingService.getAuthenticationAttribute(system.getId(), SystemEntityType.IDENTITY);
    // 
    if (attribute == null) {
        // attribute MUST exist
        throw new ResultCodeException(AccResultCode.AUTHENTICATION_AUTHENTICATION_ATTRIBUTE_DONT_SET, ImmutableMap.of("name", system.getName()));
    }
    // 
    // find if identity has account on system
    List<AccAccountDto> accounts = accountService.getAccounts(system.getId(), identity.getId());
    if (accounts.isEmpty()) {
        // user hasn't account on system, continue
        return null;
    }
    // 
    ResultCodeException authFailedException = null;
    IcUidAttribute auth = null;
    for (AccAccountDto account : accounts) {
        SysSchemaAttributeDto schemaAttribute = schemaAttributeService.get(attribute.getSchemaAttribute());
        SysSchemaObjectClassDto schemaObjectClassDto = DtoUtils.getEmbedded(schemaAttribute, SysSchemaAttribute_.objectClass, SysSchemaObjectClassDto.class);
        SysSystemEntityDto systemEntityDto = systemEntityService.get(account.getSystemEntity());
        IcObjectClass objectClass = new IcObjectClassImpl(schemaObjectClassDto.getObjectClassName());
        IcConnectorObject connectorObject = systemService.readConnectorObject(system.getId(), systemEntityDto.getUid(), objectClass);
        // 
        if (connectorObject == null) {
            continue;
        }
        // 
        String transformUsername = null;
        // iterate over all attributes to find authentication attribute
        for (IcAttribute icAttribute : connectorObject.getAttributes()) {
            if (icAttribute.getName().equals(schemaAttributeService.get(attribute.getSchemaAttribute()).getName())) {
                transformUsername = String.valueOf(icAttribute.getValue());
                break;
            }
        }
        if (transformUsername == null) {
            throw new ResultCodeException(AccResultCode.AUTHENTICATION_USERNAME_DONT_EXISTS, ImmutableMap.of("username", loginDto.getUsername(), "name", system.getName()));
        }
        // authentication over system, when password or username not exist or bad credentials - throw error
        try {
            // authentication against system
            auth = provisioningService.authenticate(transformUsername, loginDto.getPassword(), system, SystemEntityType.IDENTITY);
            authFailedException = null;
            // check auth
            if (auth == null || auth.getValue() == null) {
                authFailedException = new ResultCodeException(AccResultCode.AUTHENTICATION_AGAINST_SYSTEM_FAILED, ImmutableMap.of("name", system.getName(), "username", loginDto.getUsername()));
                // failed, continue to another
                break;
            }
            // everything success break
            break;
        } catch (ResultCodeException e) {
            // failed, continue to another
            authFailedException = new ResultCodeException(CoreResultCode.AUTH_FAILED, "Invalid login or password.", e);
        }
    }
    if (auth == null || auth.getValue() == null) {
        authFailedException = new ResultCodeException(AccResultCode.AUTHENTICATION_AGAINST_SYSTEM_FAILED, ImmutableMap.of("name", system.getName(), "username", loginDto.getUsername()));
    }
    // 
    if (authFailedException != null) {
        throw authFailedException;
    }
    String module = this.getModule();
    loginDto = jwtAuthenticationService.createJwtAuthenticationAndAuthenticate(loginDto, identity, module);
    LOG.info("Identity with username [{}] is authenticated by system [{}]", loginDto.getUsername(), system.getName());
    return loginDto;
}

Example 57 with AccAccountDto

use of eu.bcvsolutions.idm.acc.dto.AccAccountDto in project CzechIdMng by bcvsolutions.

the class AbstractProvisioningExecutor method createEntityAccount.

/**
 * Create AccAccount and relation between account and entity
 *
 * @param uid
 * @param entityId
 * @param systemId
 * @return Id of new EntityAccount
 */
protected UUID createEntityAccount(String uid, UUID entityId, UUID systemId) {
    AccAccountDto account = new AccAccountDto();
    account.setSystem(systemId);
    account.setAccountType(AccountType.PERSONAL);
    account.setUid(uid);
    account.setEntityType(getEntityType());
    account = accountService.save(account);
    // Create new entity account relation
    EntityAccountDto entityAccount = this.createEntityAccountDto();
    entityAccount.setAccount(account.getId());
    entityAccount.setEntity(entityId);
    entityAccount.setOwnership(true);
    entityAccount = getEntityAccountService().save(entityAccount);
    return (UUID) entityAccount.getId();
}

Example 58 with AccAccountDto

use of eu.bcvsolutions.idm.acc.dto.AccAccountDto in project CzechIdMng by bcvsolutions.

the class AbstractProvisioningExecutor method changePassword.

@Override
public List<OperationResult> changePassword(DTO dto, PasswordChangeDto passwordChange) {
    Assert.notNull(dto);
    Assert.notNull(dto.getId(), "Password can be changed, when dto is already persisted.");
    Assert.notNull(passwordChange);
    List<SysProvisioningOperationDto> preparedOperations = new ArrayList<>();
    // 
    EntityAccountFilter filter = this.createEntityAccountFilter();
    filter.setEntityId(dto.getId());
    List<? extends EntityAccountDto> entityAccountList = getEntityAccountService().find(filter, null).getContent();
    if (entityAccountList == null) {
        return Collections.<OperationResult>emptyList();
    }
    // Distinct by accounts
    List<UUID> accountIds = new ArrayList<>();
    entityAccountList.stream().filter(entityAccount -> {
        if (!entityAccount.isOwnership()) {
            return false;
        }
        if (passwordChange.isAll()) {
            // Add all account supports change password
            if (entityAccount.getAccount() == null) {
                return false;
            }
            // Check if system for this account support change password
            AccAccountFilter accountFilter = new AccAccountFilter();
            accountFilter.setSupportChangePassword(Boolean.TRUE);
            accountFilter.setId(entityAccount.getAccount());
            List<AccAccountDto> accountsChecked = accountService.find(accountFilter, null).getContent();
            if (accountsChecked.size() == 1) {
                return true;
            }
            return false;
        } else {
            return passwordChange.getAccounts().contains(entityAccount.getAccount().toString());
        }
    }).forEach(entityAccount -> {
        if (!accountIds.contains(entityAccount.getAccount())) {
            accountIds.add(entityAccount.getAccount());
        }
    });
    // 
    List<AccAccountDto> accounts = new ArrayList<>();
    accountIds.forEach(accountId -> {
        AccAccountDto account = accountService.get(accountId);
        accounts.add(account);
        // find uid from system entity or from account
        String uid = account.getUid();
        SysSystemDto system = DtoUtils.getEmbedded(account, AccAccount_.system, SysSystemDto.class);
        SysSystemEntityDto systemEntity = systemEntityService.get(account.getSystemEntity());
        // 
        // Find mapped attributes (include overloaded attributes)
        List<AttributeMapping> finalAttributes = resolveMappedAttributes(account, dto, system, systemEntity.getEntityType());
        if (CollectionUtils.isEmpty(finalAttributes)) {
            return;
        }
        // We try find __PASSWORD__ attribute in mapped attributes
        Optional<? extends AttributeMapping> attriubuteHandlingOptional = finalAttributes.stream().filter((attribute) -> {
            SysSchemaAttributeDto schemaAttributeDto = getSchemaAttribute(attribute);
            return ProvisioningService.PASSWORD_SCHEMA_PROPERTY_NAME.equals(schemaAttributeDto.getName());
        }).findFirst();
        if (!attriubuteHandlingOptional.isPresent()) {
            throw new ProvisioningException(AccResultCode.PROVISIONING_PASSWORD_FIELD_NOT_FOUND, ImmutableMap.of("uid", uid, "system", system.getName()));
        }
        AttributeMapping mappedAttribute = attriubuteHandlingOptional.get();
        // 
        // add all account attributes => standard provisioning
        SysProvisioningOperationDto additionalProvisioningOperation = null;
        List<AttributeMapping> additionalPasswordChangeAttributes = resolveAdditionalPasswordChangeAttributes(account, dto, system, systemEntity.getEntityType());
        if (!additionalPasswordChangeAttributes.isEmpty()) {
            additionalProvisioningOperation = prepareProvisioning(systemEntity, dto, dto.getId(), ProvisioningOperationType.UPDATE, additionalPasswordChangeAttributes);
        }
        // 
        // password change operation
        SysProvisioningOperationDto operation;
        if (provisioningExecutor.getConfiguration().isSendPasswordAttributesTogether() && additionalProvisioningOperation != null) {
            // all attributes as start
            operation = additionalProvisioningOperation;
            // 
            // add wish for password
            ProvisioningAttributeDto passwordAttribute = ProvisioningAttributeDto.createProvisioningAttributeKey(mappedAttribute, schemaAttributeService.get(mappedAttribute.getSchemaAttribute()).getName());
            Object value = passwordChange.getNewPassword();
            if (!mappedAttribute.isEntityAttribute() && !mappedAttribute.isExtendedAttribute()) {
            // If is attribute handling resolve as constant, then we
            // don't want
            // do transformation again (was did in getAttributeValue)
            } else {
                value = attributeMappingService.transformValueToResource(systemEntity.getUid(), value, mappedAttribute, dto);
            }
            operation.getProvisioningContext().getAccountObject().put(passwordAttribute, value);
            // 
            // do provisioning for additional attributes and password
            // together
            preparedOperations.add(operation);
        } else {
            // Change password on target system - only
            // TODO: refactor password change - use account wish instead
            // filling connector object attributes directly
            operation = prepareProvisioningForAttribute(systemEntity, mappedAttribute, passwordChange.getNewPassword(), ProvisioningOperationType.UPDATE, dto);
            preparedOperations.add(operation);
            // do provisioning for additional attributes in second
            if (additionalProvisioningOperation != null) {
                preparedOperations.add(additionalProvisioningOperation);
            }
        }
    });
    // execute prepared operations
    return preparedOperations.stream().map(operation -> {
        SysProvisioningOperationDto result = provisioningExecutor.executeSync(operation);
        Map<String, Object> parameters = new LinkedHashMap<String, Object>();
        AccAccountDto account = accounts.stream().filter(a -> {
            return a.getUid().equals(result.getSystemEntityUid()) && a.getSystem().equals(operation.getSystem());
        }).findFirst().get();
        SysSystemDto system = DtoUtils.getEmbedded(account, AccAccount_.system, SysSystemDto.class);
        // 
        IdmAccountDto resultAccountDto = new IdmAccountDto();
        resultAccountDto.setId(account.getId());
        resultAccountDto.setUid(account.getUid());
        resultAccountDto.setRealUid(account.getRealUid());
        resultAccountDto.setSystemId(system.getId());
        resultAccountDto.setSystemName(system.getName());
        parameters.put(IdmAccountDto.PARAMETER_NAME, resultAccountDto);
        // 
        if (result.getResult().getState() == OperationState.EXECUTED) {
            // Add success changed password account
            return new OperationResult.Builder(OperationState.EXECUTED).setModel(new DefaultResultModel(CoreResultCode.PASSWORD_CHANGE_ACCOUNT_SUCCESS, parameters)).build();
        }
        OperationResult changeResult = new OperationResult.Builder(result.getResult().getState()).setModel(new DefaultResultModel(CoreResultCode.PASSWORD_CHANGE_ACCOUNT_FAILED, parameters)).build();
        changeResult.setCause(result.getResult().getCause());
        changeResult.setCode(result.getResult().getCode());
        return changeResult;
    }).collect(Collectors.toList());
}

Example 59 with AccAccountDto

use of eu.bcvsolutions.idm.acc.dto.AccAccountDto in project CzechIdMng by bcvsolutions.

the class AbstractSynchronizationExecutor method findAccount.

private AccAccountDto findAccount(SynchronizationContext context) {
    String uid = context.getUid();
    SysSystemDto system = context.getSystem();
    SysSyncItemLogDto logItem = context.getLogItem();
    SysSystemEntityDto systemEntity = context.getSystemEntity();
    AccAccountFilter accountFilter = new AccAccountFilter();
    accountFilter.setSystemId(system.getId());
    List<AccAccountDto> accounts = null;
    if (systemEntity != null) {
        // System entity for this uid was found. We will find account
        // for this system entity.
        addToItemLog(logItem, MessageFormat.format("System entity ({1}) for this UID ({0}) was found. We try to find account for this system entity", uid, systemEntity.getId()));
        accountFilter.setSystemEntityId(systemEntity.getId());
        accounts = accountService.find(accountFilter, null).getContent();
    }
    if (CollectionUtils.isEmpty(accounts)) {
        // System entity was not found. We will find account by generated UID directly.
        // Generate UID value from mapped attribute marked as UID (Unique ID).
        // UID mapped attribute must exist and returned value must be not null
        // and must be String
        String attributeUid = this.generateUID(context);
        addToItemLog(logItem, MessageFormat.format("Account was not found. We try to find account for UID (generated from the mapped attribute marks as 'Identifier')", attributeUid));
        accountFilter.setUid(attributeUid);
        accountFilter.setSystemEntityId(null);
        accounts = accountService.find(accountFilter, null).getContent();
    }
    if (accounts.size() > 1) {
        throw new ProvisioningException(AccResultCode.SYNCHRONIZATION_TO_MANY_ACC_ACCOUNT, uid);
    }
    if (!accounts.isEmpty()) {
        return accounts.get(0);
    }
    return null;
}

Example 60 with AccAccountDto

use of eu.bcvsolutions.idm.acc.dto.AccAccountDto in project CzechIdMng by bcvsolutions.

the class AbstractSynchronizationExecutor method resolveMissingAccountSituation.

/**
 * Method for resolve missing account situation for one item.
 */
@Override
public void resolveMissingAccountSituation(ReconciliationMissingAccountActionType action, SynchronizationContext context) {
    SystemEntityType entityType = context.getEntityType();
    SysSyncLogDto log = context.getLog();
    SysSyncItemLogDto logItem = context.getLogItem();
    List<SysSyncActionLogDto> actionLogs = context.getActionLogs();
    AccAccountDto account = context.getAccount();
    addToItemLog(logItem, "Account doesn't exist on target system, but account in IdM was found (missing account).");
    addToItemLog(logItem, MessageFormat.format("Missing account action is {0}", action));
    switch(action) {
        case IGNORE:
            // Ignore we will do nothing
            initSyncActionLog(SynchronizationActionType.MISSING_ACCOUNT, OperationResultType.IGNORE, logItem, log, actionLogs);
            return;
        case CREATE_ACCOUNT:
            doUpdateAccount(account, entityType, log, logItem, actionLogs);
            initSyncActionLog(SynchronizationActionType.CREATE_ACCOUNT, OperationResultType.SUCCESS, logItem, log, actionLogs);
            return;
        case DELETE_ENTITY:
            doDeleteEntity(account, entityType, log, logItem, actionLogs);
            initSyncActionLog(SynchronizationActionType.DELETE_ENTITY, OperationResultType.SUCCESS, logItem, log, actionLogs);
            return;
        case UNLINK:
            doUnlink(account, false, log, logItem, actionLogs);
            initSyncActionLog(SynchronizationActionType.UNLINK, OperationResultType.SUCCESS, logItem, log, actionLogs);
            return;
        case UNLINK_AND_REMOVE_ROLE:
            doUnlink(account, true, log, logItem, actionLogs);
            initSyncActionLog(SynchronizationActionType.UNLINK_AND_REMOVE_ROLE, OperationResultType.SUCCESS, logItem, log, actionLogs);
            return;
    }
}