Examples with SysRoleSystemDto eu.bcvsolutions.idm.acc.dto.SysRoleSystemDto used on opensource projects

Example 36 with SysRoleSystemDto

use of eu.bcvsolutions.idm.acc.dto.SysRoleSystemDto in project CzechIdMng by bcvsolutions.

the class RoleSynchronizationExecutor method resolveSkipValueIfExcluded.

/**
 * Resolve 'Skip value if is contract excluded'.
 */
private void resolveSkipValueIfExcluded(boolean isNew, SynchronizationContext context, IdmRoleDto roleDto, SysSyncItemLogDto logItem, IcConnectorObject connectorObject, SysSystemAttributeMappingDto memberOfAttributeDto, SysSchemaObjectClassDto schemaObjectClassDto) {
    SysSystemAttributeMappingDto skipValueIfExcludeAttributeDto = context.getMappedAttributes().stream().filter(attribute -> !attribute.isDisabledAttribute() && attribute.isEntityAttribute() && ROLE_SKIP_VALUE_IF_EXCLUDED_FIELD.equals(attribute.getIdmPropertyName())).findFirst().orElse(null);
    Assert.notNull(skipValueIfExcludeAttributeDto, "Skip value if is contract excluded attribute cannot be null!");
    if (!isNew && AttributeMappingStrategyType.CREATE == skipValueIfExcludeAttributeDto.getStrategyType()) {
        addToItemLog(logItem, "The attribute for 'Skip value if is contract excluded' has strategy set to 'Set only for new entity'. Role isn't new, so resolving of forward ACM will be skipped for this role.");
    } else {
        addToItemLog(logItem, MessageFormat.format("Resolving of 'Skip value if is contract excluded' is activated for this role [{0}].", roleDto.getCode()));
        // Get value from attribute transformation.
        Object skipIfValueExcludedObj = this.getValueByMappedAttribute(skipValueIfExcludeAttributeDto, connectorObject.getAttributes(), context);
        boolean skipIfValueExcluded = getSkipIfValueExcludedFromValue(skipIfValueExcludedObj);
        // Save member attribute with new skip value if excluded value.
        SysRoleSystemDto roleSystemDto = findRoleSystemDto(roleDto, memberOfAttributeDto, schemaObjectClassDto);
        if (roleSystemDto != null) {
            // Find member attribute.
            SysRoleSystemAttributeDto memberAttribute = findMemberAttribute(memberOfAttributeDto, schemaObjectClassDto, roleSystemDto);
            if (memberAttribute != null) {
                memberAttribute.setSkipValueIfExcluded(skipIfValueExcluded);
                roleSystemAttributeService.save(memberAttribute);
                addToItemLog(logItem, MessageFormat.format("'Skip value if is contract excluded' parameter [{0}] was save for this role.", skipIfValueExcluded));
            }
        }
    }
}

Example 37 with SysRoleSystemDto

use of eu.bcvsolutions.idm.acc.dto.SysRoleSystemDto in project CzechIdMng by bcvsolutions.

the class RoleSynchronizationExecutor method checkSkipValueIfExcludedChange.

/**
 * Check if 'SkipIfValueExcluded' value is different then value form a transformation.
 */
private void checkSkipValueIfExcludedChange(IdmRoleDto dto, SynchronizationContext context, String attributeProperty, Object transformedValue) {
    if (!context.isEntityDifferent() && dto.getId() != null && getConfig(context).isSkipValueIfExcludedSwitch()) {
        // Check if 'SkipIfValueExcluded' value should be modified (differential sync).
        SysSystemAttributeMappingDto memberOfAttributeDto = lookupService.lookupEmbeddedDto(getConfig(context), SysSyncRoleConfig_.memberOfAttribute);
        Assert.notNull(memberOfAttributeDto, "Member attribute cannot be null!");
        SysSchemaAttributeDto schemaAttributeDto = lookupService.lookupEmbeddedDto(memberOfAttributeDto, SysSystemAttributeMapping_.schemaAttribute);
        SysSchemaObjectClassDto schemaObjectClassDto = lookupService.lookupEmbeddedDto(schemaAttributeDto, SysSchemaAttribute_.objectClass);
        Assert.notNull(schemaObjectClassDto, "Schema cannot be null!");
        boolean skipIfValueExcludedFromValue = getSkipIfValueExcludedFromValue(transformedValue);
        SysRoleSystemDto roleSystemDto = findRoleSystemDto(dto, memberOfAttributeDto, schemaObjectClassDto);
        if (roleSystemDto == null) {
            setDifferentChange(context, attributeProperty);
            return;
        }
        // Find member attribute.
        SysRoleSystemAttributeDto memberAttribute = findMemberAttribute(memberOfAttributeDto, schemaObjectClassDto, roleSystemDto);
        if (memberAttribute == null || memberAttribute.isSkipValueIfExcluded() != skipIfValueExcludedFromValue) {
            setDifferentChange(context, attributeProperty);
        }
    }
}

Example 38 with SysRoleSystemDto

use of eu.bcvsolutions.idm.acc.dto.SysRoleSystemDto in project CzechIdMng by bcvsolutions.

the class RoleSynchronizationExecutor method resolveRoleSystem.

/**
 * Resolve (create or update) relation on system.
 */
private SysRoleSystemDto resolveRoleSystem(IdmRoleDto roleDto, SysSystemAttributeMappingDto memberOfAttributeDto, SysSchemaObjectClassDto schemaObjectClassDto) {
    SysRoleSystemDto roleSystemDto = findRoleSystemDto(roleDto, memberOfAttributeDto, schemaObjectClassDto);
    // Create a role-system relation.
    if (roleSystemDto == null) {
        roleSystemDto = new SysRoleSystemDto();
        roleSystemDto.setRole(roleDto.getId());
        roleSystemDto.setSystemMapping(memberOfAttributeDto.getSystemMapping());
        roleSystemDto.setSystem(schemaObjectClassDto.getSystem());
    }
    roleSystemDto = roleSystemService.save(roleSystemDto);
    return roleSystemDto;
}

Example 39 with SysRoleSystemDto

use of eu.bcvsolutions.idm.acc.dto.SysRoleSystemDto in project CzechIdMng by bcvsolutions.

the class RoleSynchronizationExecutor method checkMembershipChange.

/**
 * Check if role membership value is different.
 */
private void checkMembershipChange(IdmRoleDto dto, SynchronizationContext context, String attributeProperty, Object transformedValue) {
    if (!context.isEntityDifferent() && dto.getId() != null && getConfig(context).isMembershipSwitch()) {
        // Check if forward ACM value should be modified (differential sync).
        SysSystemAttributeMappingDto memberOfAttributeDto = lookupService.lookupEmbeddedDto(getConfig(context), SysSyncRoleConfig_.memberOfAttribute);
        Assert.notNull(memberOfAttributeDto, "Member attribute cannot be null!");
        SysSchemaAttributeDto schemaAttributeDto = lookupService.lookupEmbeddedDto(memberOfAttributeDto, SysSystemAttributeMapping_.schemaAttribute);
        SysSchemaObjectClassDto schemaObjectClassDto = lookupService.lookupEmbeddedDto(schemaAttributeDto, SysSchemaAttribute_.objectClass);
        Assert.notNull(schemaObjectClassDto, "Schema cannot be null!");
        String roleIdentifier = null;
        if (transformedValue != null) {
            Assert.isInstanceOf(String.class, transformedValue, "Role identifier must be String!");
            roleIdentifier = (String) transformedValue;
        } else {
            // Identifier form transformation is null -> We will delete role-system relations.
            setDifferentChange(context, attributeProperty);
            return;
        }
        SysRoleSystemDto roleSystemDto = findRoleSystemDto(dto, memberOfAttributeDto, schemaObjectClassDto);
        if (roleSystemDto != null) {
            SysRoleSystemAttributeDto roleMemberOfAttributeDto = findMemberAttribute(memberOfAttributeDto, schemaObjectClassDto, roleSystemDto);
            if (roleMemberOfAttributeDto == null) {
                // Role attribute by mapping system attribute will be created.
                setDifferentChange(context, attributeProperty);
                return;
            }
            String membershipTransformationScript = getMembershipTransformationScript(roleIdentifier);
            if (!roleMemberOfAttributeDto.getTransformScript().equals(membershipTransformationScript)) {
                // Transformation script is different and will be updated.
                setDifferentChange(context, attributeProperty);
            }
        } else {
            // Role system will be created.
            setDifferentChange(context, attributeProperty);
        }
    }
}

Example 40 with SysRoleSystemDto

use of eu.bcvsolutions.idm.acc.dto.SysRoleSystemDto in project CzechIdMng by bcvsolutions.

the class CrossDomainAdUserConnectorTypeTest method testUpdateAccountInCrossDomain.

@Test
public void testUpdateAccountInCrossDomain() {
    ConnectorType connectorType = connectorManager.getConnectorType(MockCrossDomainAdUserConnectorType.NAME);
    SysSystemDto systemDto = initSystem(connectorType);
    SysSystemAttributeMappingFilter filter = new SysSystemAttributeMappingFilter();
    filter.setSystemId(systemDto.getId());
    filter.setName(MockCrossDomainAdUserConnectorType.LDAP_GROUPS_ATTRIBUTE);
    List<SysSystemAttributeMappingDto> attributes = attributeMappingService.find(filter, null).getContent();
    assertEquals(1, attributes.size());
    SysSystemAttributeMappingDto ldapGroupsAttribute = attributes.stream().findFirst().get();
    // Creates cross-domain group.
    SysSystemGroupDto groupSystemDto = new SysSystemGroupDto();
    groupSystemDto.setCode(getHelper().createName());
    groupSystemDto.setType(SystemGroupType.CROSS_DOMAIN);
    groupSystemDto = systemGroupService.save(groupSystemDto);
    SysSystemGroupSystemDto systemGroupSystemOne = new SysSystemGroupSystemDto();
    systemGroupSystemOne.setSystemGroup(groupSystemDto.getId());
    systemGroupSystemOne.setMergeAttribute(ldapGroupsAttribute.getId());
    systemGroupSystemOne.setSystem(systemDto.getId());
    systemGroupSystemService.save(systemGroupSystemOne);
    // Creates the login role.
    IdmRoleDto loginRole = helper.createRole();
    helper.createRoleSystem(loginRole, systemDto);
    // Creates cross-domain no-login role.
    IdmRoleDto roleInCrossDomainGroup = helper.createRole();
    SysRoleSystemDto roleSystem = helper.createRoleSystem(roleInCrossDomainGroup, systemDto);
    SysRoleSystemFilter roleSystemFilter = new SysRoleSystemFilter();
    roleSystemFilter.setIsInCrossDomainGroupRoleId(roleInCrossDomainGroup.getId());
    roleSystemFilter.setCheckIfIsInCrossDomainGroup(Boolean.TRUE);
    roleSystemFilter.setId(roleSystem.getId());
    List<SysRoleSystemDto> roleSystemDtos = roleSystemService.find(roleSystemFilter, null).getContent();
    assertEquals(0, roleSystemDtos.size());
    // Creates overridden ldapGroup merge attribute.
    createOverriddenLdapGroupAttribute(ldapGroupsAttribute, roleSystem);
    // Role-system should be in cross-domain group now.
    roleSystemDtos = roleSystemService.find(roleSystemFilter, null).getContent();
    assertEquals(1, roleSystemDtos.size());
    SysRoleSystemDto roleSystemDto = roleSystemDtos.stream().findFirst().get();
    assertTrue(roleSystemDto.isInCrossDomainGroup());
    IdmIdentityDto identity = getHelper().createIdentity();
    IdmIdentityContractDto contract = getHelper().createContract(identity);
    mockCrossDomainAdUserConnectorType.setReadConnectorObjectCallBack((system, uid, objectClass) -> {
        IcConnectorObjectImpl connectorObject = new IcConnectorObjectImpl(identity.getUsername(), null, null);
        connectorObject.getAttributes().add(new IcAttributeImpl(MockCrossDomainAdUserConnectorType.LDAP_GROUPS_ATTRIBUTE, "TWO"));
        return mockCrossDomainAdUserConnectorType.getCrossDomainConnectorObject(system, uid, objectClass, connectorObject);
    });
    IdmRoleRequestDto roleRequestDto = getHelper().assignRoles(contract, roleInCrossDomainGroup, loginRole);
    assertEquals(RoleRequestState.EXECUTED, roleRequestDto.getState());
    assertNotNull(roleRequestDto.getSystemState());
    AccIdentityAccountFilter identityAccountFilter = new AccIdentityAccountFilter();
    identityAccountFilter.setIdentityId(identity.getId());
    identityAccountFilter.setSystemId(systemDto.getId());
    assertEquals(1, identityAccountService.find(identityAccountFilter, null).getContent().size());
    // Check if provisioning contains ldapGroups attribute with value ('ONE') from the role.
    SysProvisioningOperationFilter provisioningOperationFilter = new SysProvisioningOperationFilter();
    provisioningOperationFilter.setSystemId(systemDto.getId());
    provisioningOperationFilter.setEntityType(SystemEntityType.IDENTITY);
    provisioningOperationFilter.setEntityIdentifier(identity.getId());
    List<SysProvisioningOperationDto> provisioningOperationDtos = provisioningOperationService.find(provisioningOperationFilter, null).getContent();
    assertEquals(1, provisioningOperationDtos.size());
    SysProvisioningOperationDto provisioningOperationDto = provisioningOperationDtos.stream().findFirst().get();
    assertEquals(ProvisioningEventType.UPDATE, provisioningOperationDto.getOperationType());
    ProvisioningAttributeDto provisioningAttributeLdapGroupsDto = provisioningOperationDto.getProvisioningContext().getAccountObject().keySet().stream().filter(provisioningAtt -> MockCrossDomainAdUserConnectorType.LDAP_GROUPS_ATTRIBUTE.equals(provisioningAtt.getSchemaAttributeName())).findFirst().get();
    assertNotNull(provisioningAttributeLdapGroupsDto);
    Object ldapGroupsValue = provisioningOperationDto.getProvisioningContext().getAccountObject().get(provisioningAttributeLdapGroupsDto);
    assertEquals(1, ((List<?>) ldapGroupsValue).size());
    assertTrue(((List<?>) ldapGroupsValue).stream().anyMatch(value -> value.equals("ONE")));
    IcAttribute ldapGroups = provisioningOperationDto.getProvisioningContext().getConnectorObject().getAttributeByName(MockCrossDomainAdUserConnectorType.LDAP_GROUPS_ATTRIBUTE);
    IcAttribute ldapGroupsOld = provisioningOperationDto.getProvisioningContext().getConnectorObject().getAttributeByName(MessageFormat.format(MockCrossDomainAdUserConnectorType.OLD_ATTRIBUTE_PATTERN, MockCrossDomainAdUserConnectorType.LDAP_GROUPS_ATTRIBUTE));
    assertNotNull(ldapGroups);
    assertTrue(ldapGroups.getValues().stream().anyMatch(value -> value.equals("ONE")));
    assertTrue(ldapGroups.getValues().stream().anyMatch(value -> value.equals("TWO")));
    assertNotNull(ldapGroupsOld);
    assertEquals(1, ldapGroupsOld.getValues().size());
    assertTrue(ldapGroupsOld.getValues().stream().anyMatch(value -> value.equals("TWO")));
    // Clean
    provisioningOperationService.deleteOperations(systemDto.getId());
    systemGroupService.delete(groupSystemDto);
    getHelper().deleteIdentity(identity.getId());
    mockCrossDomainAdUserConnectorType.setReadConnectorObjectCallBack(null);
}