Examples with SysSyncRoleConfigDto eu.bcvsolutions.idm.acc.dto.SysSyncRoleConfigDto used on opensource projects

Example 16 with SysSyncRoleConfigDto

use of eu.bcvsolutions.idm.acc.dto.SysSyncRoleConfigDto in project CzechIdMng by bcvsolutions.

the class RoleSynchronizationExecutor method resolveAssignRole.

private boolean resolveAssignRole(boolean isNew, SynchronizationContext context, IdmRoleDto roleDto, SysSyncRoleConfigDto config, SysSyncItemLogDto logItem, IcConnectorObject connectorObject, SysSystemAttributeMappingDto memberOfAttributeDto, SysSchemaObjectClassDto schemaObjectClassDto) {
    // Find attribute for get members (DNs)
    SysSystemAttributeMappingDto roleMembersAttributeDto = context.getMappedAttributes().stream().filter(attribute -> !attribute.isDisabledAttribute() && attribute.isEntityAttribute() && ROLE_MEMBERS_FIELD.equals(attribute.getIdmPropertyName())).findFirst().orElse(null);
    Assert.notNull(roleMembersAttributeDto, "Mapped attribute with role's members was not found. Please create it!");
    if (!isNew && AttributeMappingStrategyType.CREATE == roleMembersAttributeDto.getStrategyType()) {
        addToItemLog(logItem, "The attribute with role's members has strategy set to 'Set only for new entity'. Role isn't new, so resolving controlling an assignment of roles to users by the external system will be skipped for this role.");
    } else {
        addToItemLog(logItem, "Controlling an assignment of roles to users by the external system is activated.");
        Object membersObj = this.getValueByMappedAttribute(roleMembersAttributeDto, connectorObject.getAttributes(), context);
        if (membersObj == null) {
            membersObj = Lists.newArrayList();
        }
        if (membersObj instanceof String) {
            membersObj = Lists.newArrayList(membersObj);
        }
        Assert.isInstanceOf(List.class, membersObj, "The value from attribute with role's members must be List of Strings!");
        @SuppressWarnings("unchecked") List<String> members = (List<String>) membersObj;
        SysRoleSystemDto roleSystemDto = findRoleSystemDto(roleDto, memberOfAttributeDto, schemaObjectClassDto);
        if (roleSystemDto == null) {
            addToItemLog(logItem, "Relation between this role and system was not found. Assigning of role to users will be skip for this role.");
            return false;
        }
        SysRoleSystemAttributeDto memberAttribute = findMemberAttribute(memberOfAttributeDto, schemaObjectClassDto, roleSystemDto);
        if (memberAttribute == null) {
            addToItemLog(logItem, "The member attribute between this role and system was not found. Assigning of role to users will be skip for this role.");
            return false;
        }
        // Find identities with this role.
        IdmIdentityRoleFilter identityRoleFilter = new IdmIdentityRoleFilter();
        identityRoleFilter.setRoleId(roleDto.getId());
        List<IdmIdentityRoleDto> existsIdentityRoleDtos = identityRoleService.find(identityRoleFilter, null).getContent();
        // Get cache with users (DN vs UID).
        Map<String, String> usersUidCache = getUserUidCache();
        SysSchemaAttributeDto memberIdentifierAttribute = lookupService.lookupEmbeddedDto(config, SysSyncRoleConfig_.memberIdentifierAttribute);
        Assert.notNull(memberIdentifierAttribute, "User identifier attribute cannot be null!");
        Set<String> membersUid = Sets.newHashSet();
        Set<UUID> membersContractIds = Sets.newHashSet();
        // Call user system for every member (if isn't already in the cache).
        SysSystemDto userSystemDto = systemService.get(roleSystemDto.getSystem());
        IcConnectorConfiguration icConfig = systemService.getConnectorConfiguration(userSystemDto);
        IcConnectorInstance connectorInstance = systemService.getConnectorInstance(userSystemDto);
        IcObjectClass objectClass = new IcObjectClassImpl(schemaObjectClassDto.getObjectClassName());
        if (icConfig instanceof IcConnectorConfigurationImpl) {
            // Enable pooling - a performance reason.
            IcConnectorConfigurationImpl icConfigImpl = (IcConnectorConfigurationImpl) icConfig;
            icConfigImpl.setConnectorPoolingSupported(true);
        }
        final int[] count = { 0 };
        for (String member : members) {
            if (!transformDnToUid(config, usersUidCache, memberIdentifierAttribute, membersUid, icConfig, connectorInstance, objectClass, count, member)) {
                return false;
            }
        }
        count[0] = 0;
        membersUid.forEach(uid -> assignMissingIdentityRoles(roleDto, config, logItem, existsIdentityRoleDtos, membersContractIds, userSystemDto, count, uid, context));
        if (!checkForCancelAndFlush(config)) {
            return false;
        }
        // Remove redundant identity roles.
        List<IdmIdentityRoleDto> redundantIdentityRoles = existsIdentityRoleDtos.stream().filter(existsIdentityRole -> !membersContractIds.contains(existsIdentityRole.getIdentityContract())).collect(Collectors.toList());
        count[0] = 0;
        redundantIdentityRoles.forEach(redundantIdentityRole -> removeRedundantIdentityRoles(roleDto, config, logItem, count, redundantIdentityRole));
    }
    return true;
}

Example 17 with SysSyncRoleConfigDto

use of eu.bcvsolutions.idm.acc.dto.SysSyncRoleConfigDto in project CzechIdMng by bcvsolutions.

the class RoleSynchronizationExecutor method findRedundantRoleCatalogs.

private List<IdmRoleCatalogueRoleDto> findRedundantRoleCatalogs(IdmRoleDto roleDto, List<UUID> currentRoleCatalogueRoles, SysSyncRoleConfigDto config) {
    UUID removeCatalogueRoleParentNode = config.getRemoveCatalogueRoleParentNode();
    Assert.notNull(removeCatalogueRoleParentNode, "A parent catalogue for remove redundant roles cannot be null!");
    IdmRoleCatalogueDto removeCatalogueRoleParentNodeDto = roleCatalogueService.get(removeCatalogueRoleParentNode);
    Assert.notNull(removeCatalogueRoleParentNodeDto, "A parent catalogue for remove redundant roles cannot be null!");
    IdmRoleCatalogueRoleFilter catalogueRoleFilter = new IdmRoleCatalogueRoleFilter();
    catalogueRoleFilter.setRoleId(roleDto.getId());
    List<IdmRoleCatalogueRoleDto> cataloguesWithRole = roleCatalogueRoleService.find(catalogueRoleFilter, null).getContent().stream().filter(catalogueRole -> {
        // Check if catalog is under main remove catalog.
        if (catalogueRole.getRoleCatalogue().equals(removeCatalogueRoleParentNodeDto.getId())) {
            // If is role connected directly to parent remove catalog, then should checked too.
            return true;
        }
        IdmRoleCatalogueFilter catalogueFilter = new IdmRoleCatalogueFilter();
        catalogueFilter.setParent(removeCatalogueRoleParentNodeDto.getId());
        catalogueFilter.setId(catalogueRole.getRoleCatalogue());
        catalogueFilter.setRecursively(true);
        return roleCatalogueService.count(catalogueFilter) > 0;
    }).collect(Collectors.toList());
    return cataloguesWithRole.stream().filter(catalogueWithRole -> !currentRoleCatalogueRoles.contains(catalogueWithRole.getId())).collect(Collectors.toList());
}

Example 18 with SysSyncRoleConfigDto

use of eu.bcvsolutions.idm.acc.dto.SysSyncRoleConfigDto in project CzechIdMng by bcvsolutions.

the class RoleSynchronizationExecutor method resolveRoleCatalogue.

/**
 * Resolve 'Role catalogues'.
 */
private void resolveRoleCatalogue(boolean isNew, SynchronizationContext context, IdmRoleDto roleDto, SysSyncItemLogDto logItem, IcConnectorObject connectorObject) {
    SysSystemAttributeMappingDto roleCatalogueAttributeDto = context.getMappedAttributes().stream().filter(attribute -> !attribute.isDisabledAttribute() && attribute.isEntityAttribute() && ROLE_CATALOGUE_FIELD.equals(attribute.getIdmPropertyName())).findFirst().orElse(null);
    Assert.notNull(roleCatalogueAttributeDto, "Attribute for resolve role catalogues cannot be null!");
    if (isNew && AttributeMappingStrategyType.CREATE == roleCatalogueAttributeDto.getStrategyType()) {
        addToItemLog(logItem, "The attribute for 'role catalogues' has strategy set to 'Set only for new entity'. Role isn't new, so resolving will be skipped for this role.");
        return;
    }
    addToItemLog(logItem, MessageFormat.format("Resolving of 'role catalogues' is activated for this role [{0}].", roleDto.getCode()));
    // Get role-catalogue values from attribute transformation.
    Object roleCataloguesObj = this.getValueByMappedAttribute(roleCatalogueAttributeDto, connectorObject.getAttributes(), context);
    List<IdmRoleCatalogueDto> roleCatalogueRoleDtos = getRoleCatalogueFromValue(roleCataloguesObj);
    List<UUID> currentRoleCatalogueRoles = Lists.newArrayList();
    roleCatalogueRoleDtos.forEach(roleCatalogueDto -> {
        List<IdmRoleCatalogueDto> parents = extractCatalogStructure(roleCatalogueDto);
        AtomicReference<IdmRoleCatalogueDto> parent = new AtomicReference<>();
        Lists.reverse(parents).forEach(catalogueDto -> {
            if (roleCatalogueService.isNew(catalogueDto)) {
                IdmRoleCatalogueDto newCatalogDto = new IdmRoleCatalogueDto();
                newCatalogDto.setCode(catalogueDto.getCode());
                newCatalogDto.setName(catalogueDto.getName());
                newCatalogDto.setExternalId(catalogueDto.getExternalId());
                newCatalogDto.setParent(catalogueDto.getParent());
                if (newCatalogDto.getParent() == null && parent.get() != null) {
                    newCatalogDto.setParent(parent.get().getId());
                }
                if (newCatalogDto.getName() == null) {
                    throw new ResultCodeException(AccResultCode.SYNC_OF_ROLES_CATALOGUE_NAME_IS_NULL);
                }
                // Make sure that the catalog with the same code and parent does not really exist.
                IdmRoleCatalogueFilter catalogueFilter = new IdmRoleCatalogueFilter();
                catalogueFilter.setCode(newCatalogDto.getCode());
                catalogueFilter.setParent(newCatalogDto.getParent());
                IdmRoleCatalogueDto byCode = roleCatalogueService.find(catalogueFilter, null).getContent().stream().findFirst().orElse(null);
                if (byCode != null) {
                    parent.set(roleCatalogueService.save(byCode));
                    addToItemLog(logItem, MessageFormat.format("Role catalog item with code [{0}] was reused (catalog with same code and parent already exist).", parent.get().getCode()));
                } else {
                    parent.set(roleCatalogueService.save(newCatalogDto));
                    addToItemLog(logItem, MessageFormat.format("Role catalog item with code [{0}] was created.", parent.get().getCode()));
                }
            } else {
                parent.set(catalogueDto);
            }
        });
        // Last parent should be leaf catalog.
        IdmRoleCatalogueDto leafCatalogueDto = parent.get();
        IdmRoleCatalogueRoleDto roleCatalogueRoleDto = null;
        if (leafCatalogueDto.getId() != null) {
            IdmRoleCatalogueRoleFilter roleCatalogueRoleFilter = new IdmRoleCatalogueRoleFilter();
            roleCatalogueRoleFilter.setRoleCatalogueId(leafCatalogueDto.getId());
            roleCatalogueRoleFilter.setRoleId(roleDto.getId());
            roleCatalogueRoleDto = roleCatalogueRoleService.find(roleCatalogueRoleFilter, null).getContent().stream().findFirst().orElse(null);
        }
        if (roleCatalogueRoleDto == null) {
            // Create new role-catalogue-role.
            roleCatalogueRoleDto = new IdmRoleCatalogueRoleDto();
            roleCatalogueRoleDto.setRole(roleDto.getId());
            roleCatalogueRoleDto.setRoleCatalogue(leafCatalogueDto.getId());
            roleCatalogueRoleDto = roleCatalogueRoleService.save(roleCatalogueRoleDto);
            addToItemLog(logItem, MessageFormat.format("This role was included to the catalog with code [{0}].", leafCatalogueDto.getCode()));
        }
        currentRoleCatalogueRoles.add(roleCatalogueRoleDto.getId());
    });
    SysSyncRoleConfigDto config = getConfig(context);
    if (config.isRemoveCatalogueRoleSwitch()) {
        resolveRedundantCatalogueRole(roleDto, logItem, currentRoleCatalogueRoles, config);
    }
}

Example 19 with SysSyncRoleConfigDto

use of eu.bcvsolutions.idm.acc.dto.SysSyncRoleConfigDto in project CzechIdMng by bcvsolutions.

the class RoleSynchronizationExecutor method validate.

@Override
protected SynchronizationContext validate(UUID synchronizationConfigId) {
    syncContext = super.validate(synchronizationConfigId);
    SysSyncRoleConfigDto config = getConfig(syncContext);
    SysSystemAttributeMappingFilter attributeMappingFilter = new SysSystemAttributeMappingFilter();
    attributeMappingFilter.setSystemMappingId(config.getSystemMapping());
    attributeMappingFilter.setDisabledAttribute(Boolean.FALSE);
    // Check if exist mapping attribute for 'UID attribute'.
    attributeMappingFilter.setIsUid(Boolean.TRUE);
    SysSystemAttributeMappingDto attributeMappingDto = systemAttributeMappingService.find(attributeMappingFilter, null).getContent().stream().findFirst().orElse(null);
    if (attributeMappingDto == null) {
        throw new ResultCodeException(AccResultCode.SYNC_OF_ROLES_MAPPING_ATTRIBUTE_MISSING, ImmutableMap.of("attribute", "UID"));
    }
    if (config.isForwardAcmSwitch() && config.getForwardAcmMappingAttribute() == null) {
        throw new ResultCodeException(AccResultCode.SYNC_OF_ROLES_MAPPING_ATTRIBUTE_MISSING, ImmutableMap.of("attribute", ROLE_FORWARD_ACM_FIELD));
    }
    if (config.isSkipValueIfExcludedSwitch() && config.getSkipValueIfExcludedMappingAttribute() == null) {
        throw new ResultCodeException(AccResultCode.SYNC_OF_ROLES_MAPPING_ATTRIBUTE_MISSING, ImmutableMap.of("attribute", ROLE_SKIP_VALUE_IF_EXCLUDED_FIELD));
    }
    if (config.isMembershipSwitch()) {
        if (config.getRoleIdentifiersMappingAttribute() == null) {
            throw new ResultCodeException(AccResultCode.SYNC_OF_ROLES_MAPPING_ATTRIBUTE_MISSING, ImmutableMap.of("attribute", ROLE_MEMBERSHIP_ID_FIELD));
        }
        if (config.getMemberSystemMapping() == null) {
            throw new ResultCodeException(AccResultCode.SYNC_OF_ROLES_MAPPING_ATTRIBUTE_MISSING, ImmutableMap.of("attribute", "System mapping from an identity system"));
        }
        if (config.getMemberOfAttribute() == null) {
            throw new ResultCodeException(AccResultCode.SYNC_OF_ROLES_MAPPING_ATTRIBUTE_MISSING, ImmutableMap.of("attribute", "Member of from an identity system"));
        }
    }
    if (config.isAssignRoleSwitch()) {
        if (config.getRoleMembersMappingAttribute() == null) {
            throw new ResultCodeException(AccResultCode.SYNC_OF_ROLES_MAPPING_ATTRIBUTE_MISSING, ImmutableMap.of("attribute", ROLE_MEMBERS_FIELD));
        }
        if (config.getMemberIdentifierAttribute() == null) {
            throw new ResultCodeException(AccResultCode.SYNC_OF_ROLES_MAPPING_ATTRIBUTE_MISSING, ImmutableMap.of("attribute", "Identity identifier from an identity system"));
        }
    }
    if (config.isAssignCatalogueSwitch() && config.getAssignCatalogueMappingAttribute() == null) {
        throw new ResultCodeException(AccResultCode.SYNC_OF_ROLES_MAPPING_ATTRIBUTE_MISSING, ImmutableMap.of("attribute", ROLE_CATALOGUE_FIELD));
    }
    return syncContext;
}

Example 20 with SysSyncRoleConfigDto

use of eu.bcvsolutions.idm.acc.dto.SysSyncRoleConfigDto in project CzechIdMng by bcvsolutions.

the class RoleSynchronizationExecutor method save.

/**
 * Save entity
 * @param entity
 * @param skipProvisioning
 * @return
 */
@Override
protected IdmRoleDto save(IdmRoleDto entity, boolean skipProvisioning, SynchronizationContext context) {
    boolean isNew = roleService.isNew(entity);
    EntityEvent<IdmRoleDto> event = new RoleEvent(isNew ? RoleEventType.CREATE : RoleEventType.UPDATE, entity, ImmutableMap.of(ProvisioningService.SKIP_PROVISIONING, skipProvisioning));
    IdmRoleDto roleDto = roleService.publish(event).getContent();
    SysSyncRoleConfigDto config = this.getConfig(context);
    SysSyncItemLogDto logItem = context.getLogItem();
    IcConnectorObject connectorObject = context.getIcObject();
    // Resolve 'Role catalogue'.
    if (roleDto != null && config.isAssignCatalogueSwitch()) {
        resolveRoleCatalogue(isNew, context, roleDto, logItem, connectorObject);
    }
    if (roleDto != null && (config.isMembershipSwitch() || config.isForwardAcmSwitch() || config.isSkipValueIfExcludedSwitch() || config.isAssignRoleSwitch())) {
        Assert.notNull(connectorObject, "Connector object cannot be null!");
        SysSystemAttributeMappingDto memberOfAttributeDto = lookupService.lookupEmbeddedDto(config, SysSyncRoleConfig_.memberOfAttribute);
        Assert.notNull(memberOfAttributeDto, "Member attribute cannot be null!");
        SysSchemaAttributeDto schemaAttributeDto = lookupService.lookupEmbeddedDto(memberOfAttributeDto, SysSystemAttributeMapping_.schemaAttribute);
        SysSchemaObjectClassDto schemaObjectClassDto = lookupService.lookupEmbeddedDto(schemaAttributeDto, SysSchemaAttribute_.objectClass);
        Assert.notNull(schemaObjectClassDto, "Schema cannot be null!");
        // Resolve role membership.
        if (config.isMembershipSwitch()) {
            boolean couldContinue = resolveMembership(isNew, context, roleDto, config, logItem, connectorObject, memberOfAttributeDto, schemaObjectClassDto);
            if (!couldContinue) {
                return roleDto;
            }
        }
        // Resolve 'Forward ACM'.
        if (config.isForwardAcmSwitch()) {
            resolveForwardAcm(isNew, context, roleDto, logItem, connectorObject, memberOfAttributeDto, schemaObjectClassDto);
        }
        // Resolve 'Skip value if is contract excluded'.
        if (config.isSkipValueIfExcludedSwitch()) {
            resolveSkipValueIfExcluded(isNew, context, roleDto, logItem, connectorObject, memberOfAttributeDto, schemaObjectClassDto);
        }
        // Resolve 'Assign the role to members'.
        if (config.isAssignRoleSwitch()) {
            boolean canContinue = resolveAssignRole(isNew, context, roleDto, config, logItem, connectorObject, memberOfAttributeDto, schemaObjectClassDto);
            if (!canContinue) {
                return roleDto;
            }
        }
    }
    return roleDto;
}