Examples with AccAccountFilter eu.bcvsolutions.idm.acc.dto.filter.AccAccountFilter used on opensource projects

Example 36 with AccAccountFilter

use of eu.bcvsolutions.idm.acc.dto.filter.AccAccountFilter in project CzechIdMng by bcvsolutions.

the class RoleSynchronizationExecutor method assignMissingIdentityRoles.

/**
 * Assign missing identity roles.
 */
private void assignMissingIdentityRoles(IdmRoleDto roleDto, SysSyncRoleConfigDto config, SysSyncItemLogDto logItem, List<IdmIdentityRoleDto> existsIdentityRoleDtos, Set<UUID> membersContractIds, SysSystemDto userSystemDto, int[] count, String uid, SynchronizationContext context) {
    // On every 20th item will be hibernate flushed and check if sync was not ended.
    if (count[0] % 20 == 0 && count[0] > 0) {
        if (!checkForCancelAndFlush(config)) {
            return;
        }
    }
    count[0]++;
    // Need to find account using SysSystemEntityDto uid, because uid of AccAccountDto can be different.
    SysSystemEntityFilter entityFilter = new SysSystemEntityFilter();
    entityFilter.setEntityType(SystemEntityType.IDENTITY);
    entityFilter.setSystemId(userSystemDto.getId());
    entityFilter.setUid(uid);
    SysSystemEntityDto systemEntity = systemEntityService.find(entityFilter, null).stream().findFirst().orElse(null);
    if (systemEntity == null) {
        return;
    }
    AccAccountFilter accAccountFilter = new AccAccountFilter();
    accAccountFilter.setSystemEntityId(systemEntity.getId());
    final UUID accAccountId = accountService.findIds(accAccountFilter, null).stream().findFirst().orElse(null);
    if (accAccountId == null) {
        return;
    }
    AccIdentityAccountFilter identityAccountWithoutRelationFilter = new AccIdentityAccountFilter();
    identityAccountWithoutRelationFilter.setAccountId(accAccountId);
    AccIdentityAccountDto identityAccountDto = identityAccountService.find(identityAccountWithoutRelationFilter, null).getContent().stream().findFirst().orElse(null);
    if (identityAccountDto == null) {
        return;
    }
    UUID identityId = identityAccountDto.getIdentity();
    IdmIdentityContractDto primeContract = identityContractService.getPrimeContract(identityId);
    if (primeContract == null) {
        addToItemLog(logItem, MessageFormat.format("!!Role was not assigned to the user [{0}], because primary contract was not found!!", uid));
        initSyncActionLog(SynchronizationActionType.UPDATE_ENTITY, OperationResultType.WARNING, logItem, context.getLog(), context.getActionLogs());
        return;
    }
    membersContractIds.add(primeContract.getId());
    IdmIdentityRoleDto existIdentityRoleDto = existsIdentityRoleDtos.stream().filter(identityRole -> primeContract.getId().equals(identityRole.getIdentityContract())).findFirst().orElse(null);
    if (existIdentityRoleDto != null) {
        // Identity already has the role.
        return;
    }
    addToItemLog(logItem, MessageFormat.format("Role is not assigned for user [{0}] and contract [{1}]. Role request for add role will be created.", uid, primeContract.getId()));
    // Get cache with role-requests by identity-contract.
    Map<UUID, UUID> roleRequestCache = getRoleRequestCache();
    // Get role-request for the primary contract from a cache. If no request is present, then create one.
    initRoleRequest(primeContract, roleRequestCache, config);
    UUID roleRequestId = roleRequestCache.get(primeContract.getId());
    IdmRoleRequestDto mockRoleRequest = new IdmRoleRequestDto();
    mockRoleRequest.setId(roleRequestId);
    // Create a concept for assign a role to primary contract.
    roleRequestService.createConcept(mockRoleRequest, primeContract, null, roleDto.getId(), ConceptRoleRequestOperation.ADD);
}

Example 37 with AccAccountFilter

use of eu.bcvsolutions.idm.acc.dto.filter.AccAccountFilter in project CzechIdMng by bcvsolutions.

the class AbstractProvisioningExecutor method changePassword.

@Override
public List<OperationResult> changePassword(DTO dto, PasswordChangeDto passwordChange) {
    Assert.notNull(dto, "DTO is required.");
    Assert.notNull(dto.getId(), "Password can be changed, when dto is already persisted.");
    Assert.notNull(passwordChange, "Password change dto is required.");
    List<SysProvisioningOperationDto> preparedOperations = new ArrayList<>();
    // 
    EntityAccountFilter filter = this.createEntityAccountFilter();
    filter.setEntityId(dto.getId());
    List<? extends EntityAccountDto> entityAccountList = getEntityAccountService().find(filter, null).getContent();
    if (entityAccountList == null) {
        return Collections.<OperationResult>emptyList();
    }
    // Distinct by accounts
    List<UUID> accountIds = new ArrayList<>();
    entityAccountList.stream().filter(entityAccount -> {
        if (!entityAccount.isOwnership()) {
            return false;
        }
        if (passwordChange.isAll()) {
            // Add all account supports change password
            if (entityAccount.getAccount() == null) {
                return false;
            }
            // Check if system for this account support change password
            AccAccountFilter accountFilter = new AccAccountFilter();
            accountFilter.setSupportChangePassword(Boolean.TRUE);
            accountFilter.setId(entityAccount.getAccount());
            List<AccAccountDto> accountsChecked = accountService.find(accountFilter, null).getContent();
            if (accountsChecked.size() == 1) {
                return true;
            }
            return false;
        } else {
            return passwordChange.getAccounts().contains(entityAccount.getAccount().toString());
        }
    }).forEach(entityAccount -> {
        if (!accountIds.contains(entityAccount.getAccount())) {
            accountIds.add(entityAccount.getAccount());
        }
    });
    // 
    // Is possible that some account has disabled password attributes
    List<OperationResult> notExecutedPasswordChanged = new ArrayList<>();
    // 
    List<AccAccountDto> accounts = new ArrayList<>();
    accountIds.forEach(accountId -> {
        AccAccountDto account = accountService.get(accountId);
        // Skip account in protection
        if (account.isInProtection()) {
            // Skip this iteration
            return;
        }
        // 
        accounts.add(account);
        // find UID from system entity or from account
        SysSystemDto system = DtoUtils.getEmbedded(account, AccAccount_.system);
        if (account.getSystemEntity() == null) {
            throw new SystemEntityNotFoundException(AccResultCode.PROVISIONING_PASSWORD_SYSTEM_ENTITY_NOT_FOUND, String.valueOf(account.getUid()), system.getCode());
        }
        SysSystemEntityDto systemEntity = systemEntityService.get(account.getSystemEntity());
        // 
        // Find mapped attributes (include overloaded attributes)
        List<AttributeMapping> finalAttributes = resolveMappedAttributes(account, dto, system, systemEntity.getEntityType());
        if (CollectionUtils.isEmpty(finalAttributes)) {
            return;
        }
        // We try find __PASSWORD__ attribute in mapped attributes
        AttributeMapping mappedAttribute = finalAttributes.stream().filter((attribute) -> {
            SysSchemaAttributeDto schemaAttributeDto = getSchemaAttribute(attribute);
            return ProvisioningService.PASSWORD_SCHEMA_PROPERTY_NAME.equals(schemaAttributeDto.getName());
        }).findFirst().orElse(null);
        // 
        // get all another passwords, list with all passwords (included primary password marked as __PASSWORD__)
        SysSystemMappingDto systemMappingDto = getMapping(system, systemEntity.getEntityType());
        List<SysSystemAttributeMappingDto> passwordAttributes = attributeMappingService.getAllPasswordAttributes(system.getId(), systemMappingDto.getId());
        // 
        // create account object with all another password
        Map<ProvisioningAttributeDto, Object> accountObjectWithAnotherPassword = new HashMap<>(passwordAttributes.size());
        for (AttributeMapping passwordAttribute : passwordAttributes) {
            // all password attributes contains also main __PASSWORD__ the attribute must be skipped
            if (mappedAttribute != null && mappedAttribute.equals(passwordAttribute)) {
                continue;
            }
            GuardedString transformPassword = transformPassword(passwordChange.getNewPassword(), passwordAttribute, systemEntity.getUid(), dto);
            SysSchemaAttributeDto schemaAttribute = schemaAttributeService.get(passwordAttribute.getSchemaAttribute());
            ProvisioningAttributeDto passwordProvisiongAttributeDto = ProvisioningAttributeDto.createProvisioningAttributeKey(passwordAttribute, schemaAttribute.getName(), schemaAttribute.getClassType());
            accountObjectWithAnotherPassword.put(passwordProvisiongAttributeDto, transformPassword);
        }
        // for this account doesn't exist mapped attribute as password
        if (accountObjectWithAnotherPassword.isEmpty() && mappedAttribute == null) {
            // Beware we cant use AccAccountDto from acc module, in core is checked by this
            notExecutedPasswordChanged.add(new OperationResult.Builder(OperationState.NOT_EXECUTED).setModel(new DefaultResultModel(CoreResultCode.PASSWORD_CHANGE_ACCOUNT_FAILED, ImmutableMap.of(IdmAccountDto.PARAMETER_NAME, createResultAccount(account, system)))).build());
            // for this account is this failed password change
            return;
        }
        // 
        // add all account attributes => standard provisioning
        SysProvisioningOperationDto additionalProvisioningOperation = null;
        // resolve another attributes that must be sent together with password
        List<AttributeMapping> additionalPasswordChangeAttributes = resolveAdditionalPasswordChangeAttributes(account, dto, system, systemEntity.getEntityType());
        if (!additionalPasswordChangeAttributes.isEmpty()) {
            additionalProvisioningOperation = prepareProvisioning(systemEntity, dto, dto.getId(), ProvisioningOperationType.UPDATE, additionalPasswordChangeAttributes);
        }
        // add another password
        if (!accountObjectWithAnotherPassword.isEmpty()) {
            if (additionalProvisioningOperation == null) {
                // if additional operation is null create one
                additionalProvisioningOperation = prepareProvisioningOperationForAdditionalPassword(systemEntity, dto, dto.getId(), ProvisioningOperationType.UPDATE, systemMappingDto, accountObjectWithAnotherPassword);
            } else {
                // if additional operation exists just add all account object with additional passwords
                additionalProvisioningOperation.getProvisioningContext().getAccountObject().putAll(accountObjectWithAnotherPassword);
            }
        }
        // 
        // password change operation
        SysProvisioningOperationDto operation;
        if (provisioningExecutor.getConfiguration().isSendPasswordAttributesTogether() && additionalProvisioningOperation != null) {
            // all attributes including another password attributes will be sent with password one provisioning operation
            operation = additionalProvisioningOperation;
            // 
            if (mappedAttribute != null) {
                // Main password attribute isn't mapped
                // transform password value trough transformation
                GuardedString transformPassword = transformPassword(passwordChange.getNewPassword(), mappedAttribute, systemEntity.getUid(), dto);
                // 
                // add wish for password
                SysSchemaAttributeDto schemaAttributeDto = schemaAttributeService.get(mappedAttribute.getSchemaAttribute());
                ProvisioningAttributeDto passwordAttribute = ProvisioningAttributeDto.createProvisioningAttributeKey(mappedAttribute, schemaAttributeDto.getName(), schemaAttributeDto.getClassType());
                // 
                // newly isn't needed check if password is constant or etc.
                // 
                operation.getProvisioningContext().getAccountObject().put(passwordAttribute, transformPassword);
            }
            // 
            // do provisioning for additional attributes and password
            // together
            preparedOperations.add(operation);
        } else {
            // 
            if (mappedAttribute != null) {
                // Main password attribute isn't mapped
                // transform password value trough transformation
                GuardedString transformPassword = transformPassword(passwordChange.getNewPassword(), mappedAttribute, systemEntity.getUid(), dto);
                // 
                operation = prepareProvisioningForAttribute(systemEntity, mappedAttribute, transformPassword, ProvisioningOperationType.UPDATE, dto);
                preparedOperations.add(operation);
            }
            // do provisioning for additional attributes and passwords in second
            if (additionalProvisioningOperation != null) {
                preparedOperations.add(additionalProvisioningOperation);
            }
        }
    });
    // 
    // execute prepared operations
    List<OperationResult> results = preparedOperations.stream().map(operation -> {
        SysProvisioningOperationDto result = provisioningExecutor.executeSync(operation);
        Map<String, Object> parameters = new LinkedHashMap<String, Object>();
        AccAccountDto account = accounts.stream().filter(a -> {
            return a.getRealUid().equals(result.getSystemEntityUid()) && a.getSystem().equals(operation.getSystem());
        }).findFirst().get();
        SysSystemDto system = DtoUtils.getEmbedded(account, AccAccount_.system);
        // 
        parameters.put(IdmAccountDto.PARAMETER_NAME, createResultAccount(account, system));
        // 
        if (result.getResult().getState() == OperationState.EXECUTED) {
            // Add success changed password account
            return new OperationResult.Builder(OperationState.EXECUTED).setModel(new DefaultResultModel(CoreResultCode.PASSWORD_CHANGE_ACCOUNT_SUCCESS, parameters)).build();
        }
        OperationResult changeResult = new OperationResult.Builder(result.getResult().getState()).setModel(new DefaultResultModel(CoreResultCode.PASSWORD_CHANGE_ACCOUNT_FAILED, parameters)).build();
        changeResult.setCause(result.getResult().getCause());
        changeResult.setCode(result.getResult().getCode());
        return changeResult;
    }).collect(Collectors.toList());
    // 
    // add not executed changed from prepare stage
    results.addAll(notExecutedPasswordChanged);
    return results;
}

Example 38 with AccAccountFilter

use of eu.bcvsolutions.idm.acc.dto.filter.AccAccountFilter in project CzechIdMng by bcvsolutions.

the class DefaultSysSystemEntityService method deleteInternal.

@Override
@Transactional
public void deleteInternal(SysSystemEntityDto systemEntity) {
    Assert.notNull(systemEntity, "System entity is required.");
    // 
    SysProvisioningOperationFilter filter = new SysProvisioningOperationFilter();
    filter.setSystemId(systemEntity.getSystem());
    filter.setEntityType(systemEntity.getEntityType());
    filter.setSystemEntity(systemEntity.getId());
    // TODO: transform this behavior to events
    if (provisioningOperationService.count(filter) > 0) {
        SysSystemDto system = DtoUtils.getEmbedded(systemEntity, SysSystemEntity_.system);
        throw new ResultCodeException(AccResultCode.SYSTEM_ENTITY_DELETE_FAILED_HAS_OPERATIONS, ImmutableMap.of("uid", systemEntity.getUid(), "system", system.getName()));
    }
    // 
    // clear accounts - only link, can be rebuild
    AccAccountFilter accountFilter = new AccAccountFilter();
    accountFilter.setSystemEntityId(systemEntity.getId());
    accountService.find(accountFilter, null).forEach(account -> {
        account.setSystemEntity(null);
        accountService.save(account);
    });
    // 
    // clear batches
    SysProvisioningBatchDto batch = batchService.findBatch(systemEntity.getId());
    if (batch != null) {
        batchService.delete(batch);
    }
    // 
    super.deleteInternal(systemEntity);
}

Example 39 with AccAccountFilter

use of eu.bcvsolutions.idm.acc.dto.filter.AccAccountFilter in project CzechIdMng by bcvsolutions.

the class DefaultAccUniformPasswordService method findOptionsForPasswordChange.

@Override
public List<AccPasswordChangeOptionDto> findOptionsForPasswordChange(IdmIdentityDto identity, BasePermission... permissions) {
    List<AccPasswordChangeOptionDto> result = Lists.newArrayList();
    AccUniformPasswordSystemFilter filter = new AccUniformPasswordSystemFilter();
    filter.setIdentityId(identity.getId());
    filter.setUniformPasswordDisabled(Boolean.FALSE);
    List<AccUniformPasswordSystemDto> uniformPasswordSystems = this.uniformPasswordSystemService.find(filter, null).getContent();
    // Group uniform password system by uniform password definition
    Map<AccUniformPasswordDto, List<AccAccountDto>> accountsForUniformPassword = Maps.newHashMap();
    // Same behavior as previous versions
    AccAccountFilter accountFilter = new AccAccountFilter();
    accountFilter.setOwnership(Boolean.TRUE);
    accountFilter.setSupportChangePassword(Boolean.TRUE);
    accountFilter.setIdentityId(identity.getId());
    accountFilter.setInProtection(Boolean.FALSE);
    // Include given permissions
    List<AccAccountDto> accounts = accountService.find(accountFilter, null, permissions).getContent();
    for (AccAccountDto account : accounts) {
        // One system can be place more than one in uniform password systems
        List<AccUniformPasswordSystemDto> uniformBySystem = uniformPasswordSystems.stream().filter(pfs -> {
            return pfs.getSystem().equals(account.getSystem());
        }).collect(Collectors.toList());
        if (CollectionUtils.isEmpty(uniformBySystem)) {
            // Simple account as option
            AccPasswordChangeOptionDto optionDto = new AccPasswordChangeOptionDto(account);
            optionDto.setNiceLabel(getNiceLabelForOption(account));
            result.add(optionDto);
            continue;
        }
        for (AccUniformPasswordSystemDto uniformPasswordSystemDto : uniformBySystem) {
            AccUniformPasswordDto definition = DtoUtils.getEmbedded(uniformPasswordSystemDto, AccUniformPasswordSystem_.uniformPassword, AccUniformPasswordDto.class, null);
            if (accountsForUniformPassword.containsKey(definition)) {
                accountsForUniformPassword.get(definition).add(account);
            } else {
                accountsForUniformPassword.put(definition, Lists.newArrayList(account));
            }
        }
    }
    // Check if exists account for uniform password and process options for them
    if (!accountsForUniformPassword.isEmpty()) {
        for (Entry<AccUniformPasswordDto, List<AccAccountDto>> entry : accountsForUniformPassword.entrySet()) {
            // There is also needed
            AccUniformPasswordDto uniformPasswordDto = entry.getKey();
            AccPasswordChangeOptionDto optionDto = new AccPasswordChangeOptionDto(uniformPasswordDto, entry.getValue());
            optionDto.setNiceLabel(getNiceLabelForOption(uniformPasswordDto));
            optionDto.setChangeInIdm(uniformPasswordDto.isChangeInIdm());
            result.add(optionDto);
        }
    }
    return result;
}

Example 40 with AccAccountFilter

use of eu.bcvsolutions.idm.acc.dto.filter.AccAccountFilter in project CzechIdMng by bcvsolutions.

the class DefaultPasswordFilterManager method getAccountForSystemWithPasswordFilter.

/**
 * Return account for given system and identity. Only one may exists.
 *
 * @param system
 * @param identity
 * @return
 */
private List<AccAccountDto> getAccountForSystemWithPasswordFilter(SysSystemDto system, IdmIdentityDto identity) {
    AccAccountFilter filter = new AccAccountFilter();
    filter.setSystemId(system.getId());
    filter.setIdentityId(identity.getId());
    filter.setSupportPasswordFilter(Boolean.TRUE);
    return accountService.find(filter, null).getContent();
}