Examples with AccIdentityAccount_ eu.bcvsolutions.idm.acc.entity.AccIdentityAccount_ used on opensource projects

Example 1 with AccIdentityAccount_

use of eu.bcvsolutions.idm.acc.entity.AccIdentityAccount_ in project CzechIdMng by bcvsolutions.

the class IdentityProvisioningExecutor method findOverloadingAttributes.

/**
 * Return list of all overloading attributes for given identity, system and
 * uid
 *
 * @param identityAccount
 * @param idenityAccoutnList
 * @param operationType
 * @param entityType
 * @return
 */
@Override
protected List<SysRoleSystemAttributeDto> findOverloadingAttributes(IdmIdentityDto entity, SysSystemDto system, List<? extends EntityAccountDto> idenityAccoutnList, SystemEntityType entityType) {
    List<SysRoleSystemAttributeDto> roleSystemAttributesAll = new ArrayList<>();
    idenityAccoutnList.stream().filter(ia -> {
        AccAccountDto account = DtoUtils.getEmbedded((AccIdentityAccountDto) ia, AccIdentityAccount_.account, AccAccountDto.class);
        return ((AccIdentityAccountDto) ia).getIdentityRole() != null && account.getSystem() != null && account.getSystem().equals(system.getId()) && ia.isOwnership();
    }).forEach((identityAccountInner) -> {
        AbstractDto identityAccount = (AbstractDto) identityAccountInner;
        // All identity account with same system and with filled
        // identityRole
        AccAccountDto account = DtoUtils.getEmbedded(identityAccount, AccIdentityAccount_.account, AccAccountDto.class);
        IdmIdentityRoleDto identityRole = DtoUtils.getEmbedded(identityAccount, AccIdentityAccount_.identityRole, IdmIdentityRoleDto.class);
        SysRoleSystemFilter roleSystemFilter = new SysRoleSystemFilter();
        roleSystemFilter.setRoleId(identityRole.getRole());
        roleSystemFilter.setSystemId(account.getSystem());
        List<SysRoleSystemDto> roleSystems = roleSystemService.find(roleSystemFilter, null).getContent();
        if (roleSystems.size() > 1) {
            SysRoleSystemDto roleSystem = roleSystems.get(0);
            IdmRoleDto roleDto = roleService.get(roleSystem.getRole());
            SysSystemDto systemDto = DtoUtils.getEmbedded(roleSystem, SysRoleSystem_.system, SysSystemDto.class);
            throw new ProvisioningException(AccResultCode.PROVISIONING_DUPLICATE_ROLE_MAPPING, ImmutableMap.of("role", roleDto.getName(), "system", systemDto.getName(), "entityType", entityType));
        }
        if (!roleSystems.isEmpty()) {
            SysRoleSystemDto roleSystem = roleSystems.get(0);
            SysRoleSystemAttributeFilter roleSystemAttributeFilter = new SysRoleSystemAttributeFilter();
            roleSystemAttributeFilter.setRoleSystemId(roleSystem.getId());
            List<SysRoleSystemAttributeDto> roleAttributes = roleSystemAttributeService.find(roleSystemAttributeFilter, null).getContent();
            if (!CollectionUtils.isEmpty(roleAttributes)) {
                roleSystemAttributesAll.addAll(roleAttributes);
            }
        }
    });
    return roleSystemAttributesAll;
}

Example 2 with AccIdentityAccount_

use of eu.bcvsolutions.idm.acc.entity.AccIdentityAccount_ in project CzechIdMng by bcvsolutions.

the class DefaultAccAccountManagementService method resolveIdentityAccountForDelete.

/**
 * Resolve identity account to delete
 *
 * @param identityAccountList
 * @param identityRoles
 * @param identityAccountsToDelete
 */
private void resolveIdentityAccountForDelete(List<AccIdentityAccountDto> identityAccountList, List<IdmIdentityRoleDto> identityRoles, List<AccIdentityAccountDto> identityAccountsToDelete) {
    // Search IdentityAccounts to delete
    identityRoles.stream().filter(identityRole -> {
        return !identityRole.isValid();
    }).forEach(identityRole -> {
        // 
        identityAccountList.stream().filter(// 
        identityAccount -> identityRole.getId().equals(identityAccount.getIdentityRole())).filter(identityAccount -> identityAccount.getRoleSystem() == null || !(((SysRoleSystemDto) DtoUtils.getEmbedded(identityAccount, AccIdentityAccount_.roleSystem)).isForwardAccountManagemen() && // 
        identityRole.isValidNowOrInFuture())).forEach(identityAccountsToDelete::add);
    });
    // Search IdentityAccounts to delete - we want to delete identity-account if
    // identity-role is valid, but mapped system on the role does not longer exist.
    identityRoles.stream().filter(identityRole -> {
        return identityRole.isValid();
    }).forEach(identityRole -> {
        // 
        identityAccountList.stream().filter(identityAccount -> identityRole.getId().equals(identityAccount.getIdentityRole())).filter(identityAccount -> {
            // Remove account if role-system is null.
            if (identityAccount.getRoleSystem() == null) {
                return true;
            }
            // Remove an account if role-system does not supports creation by default or if is in cross-domain group.
            SysRoleSystemDto roleSystem = lookupService.lookupEmbeddedDto(identityAccount, AccIdentityAccount_.roleSystem);
            if (roleSystem != null && !roleSystem.isCreateAccountByDefault()) {
                return true;
            } else if (roleSystem != null) {
                SysSystemGroupSystemFilter systemGroupSystemFilter = new SysSystemGroupSystemFilter();
                systemGroupSystemFilter.setCrossDomainsGroupsForRoleSystemId(roleSystem.getId());
                if (systemGroupSystemService.count(systemGroupSystemFilter) >= 1) {
                    // active cross-domain group. -> Identity account should be deleted.
                    return true;
                }
            }
            return false;
        }).forEach(identityAccountsToDelete::add);
    });
}

Example 3 with AccIdentityAccount_

use of eu.bcvsolutions.idm.acc.entity.AccIdentityAccount_ in project CzechIdMng by bcvsolutions.

the class DefaultAccAccountManagementService method resolveIdentityAccountForCreate.

/**
 * Resolve Identity account - to create.
 */
private void resolveIdentityAccountForCreate(IdmIdentityDto identity, List<AccIdentityAccountDto> identityAccountList, List<IdmIdentityRoleDto> identityRoles, List<AccIdentityAccountDto> identityAccountsToCreate, List<AccIdentityAccountDto> identityAccountsToDelete, boolean onlyCreateNew, List<UUID> additionalAccountsForProvisioning) {
    identityRoles.forEach(identityRole -> {
        UUID role = identityRole.getRole();
        SysRoleSystemFilter roleSystemFilter = new SysRoleSystemFilter();
        roleSystemFilter.setRoleId(role);
        List<SysRoleSystemDto> roleSystems = roleSystemService.find(roleSystemFilter, null).getContent();
        // Is role valid in this moment or
        // role-system has enabled forward account management (identity-role have to be
        // valid in the future)
        roleSystems.stream().filter(roleSystem -> (identityRole.isValid() || (roleSystem.isForwardAccountManagemen() && identityRole.isValidNowOrInFuture()))).filter(roleSystem -> {
            boolean canBeCreated = roleSystem.isCreateAccountByDefault();
            if (canBeCreated) {
                SysSystemGroupSystemFilter systemGroupSystemFilter = new SysSystemGroupSystemFilter();
                systemGroupSystemFilter.setCrossDomainsGroupsForRoleSystemId(roleSystem.getId());
                if (systemGroupSystemService.count(systemGroupSystemFilter) >= 1) {
                    // This role-system overriding a merge attribute which is using in
                    // active cross-domain group. -> Account will be not created.
                    canBeCreated = false;
                }
            }
            if (!canBeCreated) {
                // We need to made provisioning for skipped identity-role/accounts (because Cross-domains).
                // We have to find all identity-accounts for identity and system.
                AccIdentityAccountFilter identityAccountFilter = new AccIdentityAccountFilter();
                identityAccountFilter.setSystemId(roleSystem.getSystem());
                identityAccountFilter.setIdentityId(identity.getId());
                AccIdentityAccountDto identityAccountDto = identityAccountService.find(identityAccountFilter, null).getContent().stream().filter(identityAccount -> {
                    SysRoleSystemDto roleSystemFromIdentityAccount = lookupService.lookupEmbeddedDto(identityAccount, AccIdentityAccount_.roleSystem);
                    return roleSystemFromIdentityAccount != null && roleSystem.getSystemMapping().equals(roleSystemFromIdentityAccount.getSystemMapping());
                }).findFirst().orElse(null);
                if (identityAccountDto != null && additionalAccountsForProvisioning != null) {
                    additionalAccountsForProvisioning.add(identityAccountDto.getAccount());
                }
            }
            return canBeCreated;
        }).forEach(roleSystem -> {
            String uid = generateUID(identity, roleSystem);
            // Check on change of UID is not executed if all given identity-roles are new
            if (!onlyCreateNew) {
                // Check identity-account for that role-system on change the definition of UID
                checkOnChangeUID(uid, roleSystem, identityAccountList, identityAccountsToDelete);
            }
            // Try to find identity-account for this identity-role. If exists and doesn't in
            // list of identity-account to delete, then we are done.
            AccIdentityAccountDto existsIdentityAccount = findAlreadyExistsIdentityAccount(identityAccountList, identityAccountsToDelete, identityRole, roleSystem);
            if (existsIdentityAccount != null) {
                if (existsIdentityAccount.getRoleSystem() == null) {
                    // IdentityAccount already exist, but doesn't have relation on RoleSystem. This
                    // could happen if system mapping was deleted and recreated or if was role use
                    // as sync default role, but without mapping on this system.
                    // We have to create missing relation, so we will set and save RoleSystem.
                    existsIdentityAccount.setRoleSystem(roleSystem.getId());
                    identityAccountService.save(existsIdentityAccount);
                }
                return;
            }
            // For this system we need to create new (or found exists) account
            AccAccountDto account = createAccountByRoleSystem(uid, identity, roleSystem, identityAccountsToCreate);
            if (account == null) {
                return;
            }
            // Prevent to create the same identity account
            if (identityAccountList.stream().filter(identityAccount -> {
                return identityAccount.getAccount().equals(account.getId()) && identityRole.getId().equals(identityAccount.getIdentityRole()) && roleSystem.getId().equals(identityAccount.getRoleSystem());
            }).count() == 0) {
                AccIdentityAccountDto identityAccount = new AccIdentityAccountDto();
                identityAccount.setAccount(account.getId());
                identityAccount.setIdentity(identity.getId());
                identityAccount.setIdentityRole(identityRole.getId());
                identityAccount.setRoleSystem(roleSystem.getId());
                identityAccount.setOwnership(true);
                identityAccount.getEmbedded().put(AccIdentityAccount_.account.getName(), account);
                identityAccountsToCreate.add(identityAccount);
            }
        });
    });
}

Example 4 with AccIdentityAccount_

use of eu.bcvsolutions.idm.acc.entity.AccIdentityAccount_ in project CzechIdMng by bcvsolutions.

the class IdentityProvisioningExecutor method doProvisioning.

@Override
public void doProvisioning(AccAccountDto account) {
    Assert.notNull(account, "Account is required.");
    // 
    AccIdentityAccountFilter filter = new AccIdentityAccountFilter();
    filter.setAccountId(account.getId());
    identityAccountService.find(filter, null).getContent().stream().filter(identityAccount -> {
        return identityAccount.isOwnership();
    }).forEach((identityAccount) -> {
        doProvisioning(account, DtoUtils.getEmbedded(identityAccount, AccIdentityAccount_.identity, IdmIdentityDto.class));
    });
}