Examples with IdmIdentityRoleDto eu.bcvsolutions.idm.core.api.dto.IdmIdentityRoleDto used on opensource projects

Example 76 with IdmIdentityRoleDto

use of eu.bcvsolutions.idm.core.api.dto.IdmIdentityRoleDto in project CzechIdMng by bcvsolutions.

the class IdentityProvisioningExecutor method getAttributeValue.

@Override
protected Object getAttributeValue(String uid, IdmIdentityDto dto, AttributeMapping attribute, SysSystemDto system, MappingContext mappingContext) {
    if (attribute instanceof SysRoleSystemAttributeDto) {
        SysRoleSystemAttributeDto roleSystemAttributeDto = (SysRoleSystemAttributeDto) attribute;
        if (roleSystemAttributeDto.isSkipValueIfExcluded() && (AttributeMappingStrategyType.MERGE == roleSystemAttributeDto.getStrategyType() || AttributeMappingStrategyType.AUTHORITATIVE_MERGE == roleSystemAttributeDto.getStrategyType())) {
            // Get ID of the role
            Assert.notNull(roleSystemAttributeDto.getRoleSystem(), "SysRoleSystem cannot be null!");
            SysRoleSystemDto roleSystemDto = DtoUtils.getEmbedded(roleSystemAttributeDto, SysRoleSystemAttribute_.roleSystem.getName(), SysRoleSystemDto.class, (SysRoleSystemDto) null);
            if (roleSystemDto == null) {
                roleSystemDto = roleSystemService.get(roleSystemAttributeDto.getId());
            }
            UUID roleId = roleSystemDto.getRole();
            Assert.notNull(roleId, "Role cannot be null!");
            // Find count of NOT excluded contracts for this identity and role
            IdmIdentityContractFilter contractFilter = new IdmIdentityContractFilter();
            contractFilter.setIdentity(dto.getId());
            contractFilter.setExcluded(Boolean.FALSE);
            contractFilter.setRoleId(roleId);
            // If exists some not excluded contract, then value will be not skipped!
            long countOfNotExcludedContracts = identityContractService.count(contractFilter);
            if (countOfNotExcludedContracts == 0) {
                contractFilter.setExcluded(Boolean.TRUE);
                // For skip the value must exist at least one excluded contract
                long countOfexcludedContracts = identityContractService.count(contractFilter);
                if (countOfexcludedContracts >= 0) {
                    return null;
                }
            }
        }
    }
    // identity-roles). That list will be input for that fields.
    if (// 
    attribute != null && (// 
    ASSIGNED_ROLES_FIELD.equals(attribute.getIdmPropertyName()) || // 
    ASSIGNED_ROLES_FOR_SYSTEM_FIELD.equals(attribute.getIdmPropertyName()))) {
        // 
        assertNotNull(dto.getId());
        IdmIdentityRoleFilter identityRoleFilter = new IdmIdentityRoleFilter();
        identityRoleFilter.setIdentityId(dto.getId());
        identityRoleFilter.setValid(Boolean.TRUE);
        List<IdmIdentityRoleDto> identityRoles = identityRoleService.find(identityRoleFilter, PageRequest.of(0, Integer.MAX_VALUE, Sort.by(IdmIdentityRole_.created.getName()))).getContent();
        List<IdmIdentityRoleDto> identityRolesToProcess;
        if (ASSIGNED_ROLES_FOR_SYSTEM_FIELD.equals(attribute.getIdmPropertyName())) {
            // For ASSIGNED_ROLES_FOR_SYSTEM_FIELD we will convert only identity-roles for
            // that identity and given system
            assertNotNull(system.getId());
            List<IdmIdentityRoleDto> identityRolesForSystem = Lists.newArrayList();
            AccIdentityAccountFilter identityAccountFilter = new AccIdentityAccountFilter();
            identityAccountFilter.setIdentityId(dto.getId());
            identityAccountFilter.setSystemId(system.getId());
            List<AccIdentityAccountDto> identityAccounts = identityAccountService.find(identityAccountFilter, null).getContent();
            // Filtering only identity-roles for that system
            identityAccounts.forEach(identityAccount -> {
                identityRolesForSystem.addAll(// 
                identityRoles.stream().filter(// 
                identityRole -> identityRole.getId().equals(identityAccount.getIdentityRole())).collect(// 
                Collectors.toList()));
            });
            identityRolesToProcess = identityRolesForSystem;
        } else {
            // For ASSIGNED_ROLES_FIELD we will convert all identity-roles for that identity
            identityRolesToProcess = identityRoles;
        }
        List<AssignedRoleDto> assignedRoles = new ArrayList<>();
        identityRolesToProcess.forEach(identityRole -> {
            IdmFormInstanceDto formInstanceDto = identityRoleService.getRoleAttributeValues(identityRole);
            identityRole.getEavs().clear();
            identityRole.getEavs().add(formInstanceDto);
            // Convert identityRole to AssignedRoleDto
            assignedRoles.add(IdentityProvisioningExecutor.convertToAssignedRoleDto(identityRole));
        });
        return attributeMappingService.transformValueToResource(uid, assignedRoles, attribute, dto);
    }
    // For user-type (projection) will be attribute value IdmFormProjectionDto.
    if (attribute != null && dto != null && dto.getFormProjection() != null && IdmIdentity_.formProjection.getName().equals(attribute.getIdmPropertyName())) {
        BaseDto projection = lookupService.lookupEmbeddedDto(dto, IdmIdentity_.formProjection);
        return attributeMappingService.transformValueToResource(uid, projection, attribute, dto);
    }
    // Default transformation of Identity state enum to string
    if (attribute != null && dto != null && IDENTITY_STATE_IDM_NAME.equals(attribute.getIdmPropertyName())) {
        String state = dto.getState().toString();
        return attributeMappingService.transformValueToResource(uid, state, attribute, dto);
    }
    return super.getAttributeValue(uid, dto, attribute, system, mappingContext);
}

Example 77 with IdmIdentityRoleDto

use of eu.bcvsolutions.idm.core.api.dto.IdmIdentityRoleDto in project CzechIdMng by bcvsolutions.

the class IdentityRoleByIdentityDeduplicationBulkAction method getDuplicatesIdentityRoleForContract.

/**
 * Method return duplicities for {@link IdmIdentityContractDto}
 * @param contract
 * @return
 */
public List<IdmIdentityRoleDto> getDuplicatesIdentityRoleForContract(IdmIdentityContractDto contract) {
    boolean checkSubdefinition = isCheckSubdefinition();
    // Get all identity roles
    IdmIdentityRoleFilter identityRoleFilter = new IdmIdentityRoleFilter();
    identityRoleFilter.setIdentityId(contract.getIdentity());
    identityRoleFilter.setIdentityContractId(contract.getId());
    // Identity roles must be sorted by create, for duplicities with manually will be removed always the newer.
    List<IdmIdentityRoleDto> identityRoles = identityRoleService.find(identityRoleFilter, PageRequest.of(0, Integer.MAX_VALUE, new Sort(Direction.DESC, IdmIdentityRole_.created.getName())), PermissionUtils.toPermissions(getAuthoritiesForIdentityRole()).toArray(new BasePermission[] {})).getContent();
    // load eav instance, if eav values has to be checked
    if (checkSubdefinition) {
        identityRoles.forEach(identityRole -> {
            identityRole.setEavs(Lists.newArrayList(identityRoleService.getRoleAttributeValues(identityRole)));
        });
    }
    // Get map of duplicity roles (roleId, assignedRoles).
    Map<UUID, List<IdmIdentityRoleDto>> duplicateRoles = identityRoles.stream().collect(// Group identity roles by role.
    Collectors.groupingBy(// 
    IdmIdentityRoleDto::getRole)).entrySet().stream().filter(// Filter only by values where is more than one record (possible duplicates).
    entry -> entry.getValue().size() > 1).collect(// 
    Collectors.toMap(// Collect as map where key is UUID of role.
    k -> k.getKey(), // And value is list of identity roles for this role.
    v -> v.getValue()));
    // 
    // 
    List<IdmIdentityRoleDto> resolvedDuplicities = new ArrayList<>();
    // Iterate over duplicated roles. In Key is ID of role that has more finding for the contract.
    for (Entry<UUID, List<IdmIdentityRoleDto>> entry : duplicateRoles.entrySet()) {
        List<IdmIdentityRoleDto> assignedRoles = entry.getValue();
        List<IdmIdentityRoleDto> rolesToCheck = // ~ manually assigned direct roles can be removed only
        assignedRoles.stream().filter(idenityRole -> {
            // not automatic
            return idenityRole.getAutomaticRole() == null;
        }).filter(idenityRole -> {
            // not sub role
            return idenityRole.getDirectRole() == null;
        }).collect(Collectors.toList());
        if (rolesToCheck.isEmpty()) {
            continue;
        }
        // 
        for (IdmIdentityRoleDto checkRoleOne : rolesToCheck) {
            // skip already processed assigned role
            if (resolvedDuplicities.contains(checkRoleOne)) {
                continue;
            }
            // 
            while (true) {
                IdmIdentityRoleDto duplicate = null;
                for (Iterator<IdmIdentityRoleDto> i = assignedRoles.iterator(); i.hasNext(); ) {
                    IdmIdentityRoleDto checkRoleTwo = i.next();
                    if (Objects.equals(checkRoleOne.getId(), checkRoleTwo.getId())) {
                        // the same assigned role is not duplicate
                        continue;
                    }
                    // 
                    duplicate = identityRoleService.getDuplicated(checkRoleOne, checkRoleTwo, !checkSubdefinition);
                    // 
                    if (duplicate != null) {
                        // add duplicate
                        if (!resolvedDuplicities.contains(duplicate)) {
                            resolvedDuplicities.add(duplicate);
                        }
                        assignedRoles.remove(duplicate);
                        // ~ run again, until no duplicate is found
                        break;
                    } else {
                        continue;
                    }
                }
                // end => no duplicates was found finally, or duplicate is controlled role itself
                if (duplicate == null || duplicate.getId().equals(checkRoleOne.getId())) {
                    break;
                }
            }
        }
    }
    // 
    return resolvedDuplicities;
}

Example 78 with IdmIdentityRoleDto

use of eu.bcvsolutions.idm.core.api.dto.IdmIdentityRoleDto in project CzechIdMng by bcvsolutions.

the class IdmIdentityRoleControllerRestTest method testFindCanBeRequestedRoles.

@Test
public void testFindCanBeRequestedRoles() throws Exception {
    String defaultRoleCode = roleConfiguration.getDefaultRoleCode();
    // 
    try {
        // empty property => disable default role
        getHelper().setConfigurationValue(RoleConfiguration.PROPERTY_DEFAULT_ROLE, "");
        IdmRoleDto roleOne = createRole(true);
        // other
        IdmRoleDto roleTwo = createRole(false);
        // 
        IdmIdentityDto identity = getHelper().createIdentity();
        IdmRoleDto assignedRole = getHelper().createRole();
        // 
        getHelper().createIdentityRole(identity, assignedRole);
        // 
        // other identity - their identity roles we will read
        IdmIdentityDto identityTwo = getHelper().createIdentity((GuardedString) null);
        getHelper().createIdentityRole(identityTwo, roleOne);
        getHelper().createIdentityRole(identityTwo, roleTwo);
        // 
        // create authorization policy - assign to role
        getHelper().createAuthorizationPolicy(assignedRole.getId(), CoreGroupPermission.ROLE, IdmRole.class, RoleCanBeRequestedEvaluator.class, RoleBasePermission.CANBEREQUESTED, IdmBasePermission.UPDATE, IdmBasePermission.READ);
        // with update transitively
        ConfigurationMap evaluatorProperties = new ConfigurationMap();
        evaluatorProperties.put(IdentityRoleByRoleEvaluator.PARAMETER_CAN_BE_REQUESTED_ONLY, false);
        IdmAuthorizationPolicyDto transientIdentityRolePolicy = getHelper().createAuthorizationPolicy(assignedRole.getId(), CoreGroupPermission.IDENTITYROLE, IdmIdentityRole.class, IdentityRoleByRoleEvaluator.class, evaluatorProperties);
        // 
        IdmIdentityRoleFilter filter = new IdmIdentityRoleFilter();
        filter.setIdentityId(identityTwo.getId());
        List<IdmIdentityRoleDto> identityRoles = find("can-be-requested", filter, getAuthentication(identity.getUsername()));
        // 
        Assert.assertFalse(identityRoles.isEmpty());
        Assert.assertEquals(1, identityRoles.size());
        Assert.assertTrue(identityRoles.stream().anyMatch(r -> r.getRole().equals(roleOne.getId())));
        // 
        List<String> permissions = getPermissions(identityRoles.get(0), getAuthentication(identity.getUsername()));
        // 
        Assert.assertEquals(3, permissions.size());
        Assert.assertTrue(permissions.stream().anyMatch(p -> p.equals(RoleBasePermission.CANBEREQUESTED.name())));
        Assert.assertTrue(permissions.stream().anyMatch(p -> p.equals(IdmBasePermission.UPDATE.name())));
        Assert.assertTrue(permissions.stream().anyMatch(p -> p.equals(IdmBasePermission.READ.name())));
        // 
        // can be requested only
        evaluatorProperties = new ConfigurationMap();
        evaluatorProperties.put(IdentityRoleByRoleEvaluator.PARAMETER_CAN_BE_REQUESTED_ONLY, true);
        transientIdentityRolePolicy.setEvaluatorProperties(evaluatorProperties);
        authorizationPolicyService.save(transientIdentityRolePolicy);
        // 
        identityRoles = find("can-be-requested", filter, getAuthentication(identity.getUsername()));
        // 
        Assert.assertFalse(identityRoles.isEmpty());
        Assert.assertEquals(1, identityRoles.size());
        Assert.assertTrue(identityRoles.stream().anyMatch(r -> r.getRole().equals(roleOne.getId())));
        // read authority is not available now
        try {
            getHelper().login(identity);
            // 
            Set<String> canBeRequestedPermissions = identityRoleService.getPermissions(identityRoles.get(0).getId());
            // 
            Assert.assertEquals(1, canBeRequestedPermissions.size());
            Assert.assertTrue(canBeRequestedPermissions.stream().anyMatch(p -> p.equals(RoleBasePermission.CANBEREQUESTED.name())));
        } finally {
            logout();
        }
    } finally {
        getHelper().setConfigurationValue(RoleConfiguration.PROPERTY_DEFAULT_ROLE, defaultRoleCode);
    }
}

Example 79 with IdmIdentityRoleDto

use of eu.bcvsolutions.idm.core.api.dto.IdmIdentityRoleDto in project CzechIdMng by bcvsolutions.

the class IdmIdentityRoleControllerRestTest method testFindByRoleComposition.

@Test
public void testFindByRoleComposition() {
    IdmRoleDto roleOne = getHelper().createRole();
    IdmRoleDto roleTwo = getHelper().createRole();
    IdmRoleDto roleThree = getHelper().createRole();
    // 
    IdmRoleCompositionDto roleCompositionOne = getHelper().createRoleComposition(roleOne, roleTwo);
    getHelper().createRoleComposition(roleTwo, roleThree);
    // 
    IdmIdentityDto identity = getHelper().createIdentity((GuardedString) null);
    IdmIdentityRoleDto directRole = getHelper().createIdentityRole(identity, roleOne);
    // 
    IdmIdentityRoleFilter filter = new IdmIdentityRoleFilter();
    filter.setIdentityId(identity.getId());
    filter.setRoleCompositionId(roleCompositionOne.getId());
    List<IdmIdentityRoleDto> results = find(filter);
    // 
    Assert.assertEquals(1, results.size());
    Assert.assertTrue(results.stream().anyMatch(ir -> ir.getDirectRole().equals(directRole.getId()) && ir.getRole().equals(roleTwo.getId())));
}

Example 80 with IdmIdentityRoleDto

use of eu.bcvsolutions.idm.core.api.dto.IdmIdentityRoleDto in project CzechIdMng by bcvsolutions.

the class IdmIdentityRoleControllerRestTest method testFindByRoleText.

@Test
public void testFindByRoleText() {
    IdmIdentityDto identity = getHelper().createIdentity();
    IdmRoleDto roleOne = getHelper().createRole();
    IdmRoleDto roleTwo = getHelper().createRole();
    IdmIdentityRoleDto createIdentityRole = getHelper().createIdentityRole(identity, roleOne);
    getHelper().createIdentityRole(identity, roleTwo);
    // 
    IdmIdentityRoleFilter filter = new IdmIdentityRoleFilter();
    filter.setRoleText(roleOne.getCode());
    List<IdmIdentityRoleDto> results = find(filter);
    Assert.assertEquals(1, results.size());
    Assert.assertTrue(results.stream().anyMatch(r -> r.getId().equals(createIdentityRole.getId())));
}