use of eu.bcvsolutions.idm.core.api.dto.IdmRoleCompositionDto in project CzechIdMng by bcvsolutions.
the class IdmIdentityRoleControllerRestTest method testFindByRoleComposition.
@Test
public void testFindByRoleComposition() {
IdmRoleDto roleOne = getHelper().createRole();
IdmRoleDto roleTwo = getHelper().createRole();
IdmRoleDto roleThree = getHelper().createRole();
//
IdmRoleCompositionDto roleCompositionOne = getHelper().createRoleComposition(roleOne, roleTwo);
getHelper().createRoleComposition(roleTwo, roleThree);
//
IdmIdentityDto identity = getHelper().createIdentity((GuardedString) null);
IdmIdentityRoleDto directRole = getHelper().createIdentityRole(identity, roleOne);
//
IdmIdentityRoleFilter filter = new IdmIdentityRoleFilter();
filter.setIdentityId(identity.getId());
filter.setRoleCompositionId(roleCompositionOne.getId());
List<IdmIdentityRoleDto> results = find(filter);
//
Assert.assertEquals(1, results.size());
Assert.assertTrue(results.stream().anyMatch(ir -> ir.getDirectRole().equals(directRole.getId()) && ir.getRole().equals(roleTwo.getId())));
}
use of eu.bcvsolutions.idm.core.api.dto.IdmRoleCompositionDto in project CzechIdMng by bcvsolutions.
the class CrossDomainAdUserConnectorTypeTest method testRoleInCrossDomainGroupProvisioningForBusinessRole.
@Test
public void testRoleInCrossDomainGroupProvisioningForBusinessRole() {
ConnectorType connectorType = connectorManager.getConnectorType(MockCrossDomainAdUserConnectorType.NAME);
SysSystemDto systemDto = initSystem(connectorType);
SysSystemAttributeMappingFilter filter = new SysSystemAttributeMappingFilter();
filter.setSystemId(systemDto.getId());
filter.setName(MockCrossDomainAdUserConnectorType.LDAP_GROUPS_ATTRIBUTE);
List<SysSystemAttributeMappingDto> attributes = attributeMappingService.find(filter, null).getContent();
assertEquals(1, attributes.size());
SysSystemAttributeMappingDto ldapGroupsAttribute = attributes.stream().findFirst().get();
// Creates cross-domain group.
SysSystemGroupDto groupSystemDto = new SysSystemGroupDto();
groupSystemDto.setCode(getHelper().createName());
groupSystemDto.setType(SystemGroupType.CROSS_DOMAIN);
groupSystemDto = systemGroupService.save(groupSystemDto);
SysSystemGroupSystemDto systemGroupSystemOne = new SysSystemGroupSystemDto();
systemGroupSystemOne.setSystemGroup(groupSystemDto.getId());
systemGroupSystemOne.setMergeAttribute(ldapGroupsAttribute.getId());
systemGroupSystemOne.setSystem(systemDto.getId());
systemGroupSystemService.save(systemGroupSystemOne);
// Creates the login role.
IdmRoleDto loginRole = helper.createRole();
helper.createRoleSystem(loginRole, systemDto);
IdmRoleDto parentNoLoginRole = helper.createRole();
// Creates no-login role.
IdmRoleDto noLoginRole = helper.createRole();
SysRoleSystemDto roleSystem = helper.createRoleSystem(noLoginRole, systemDto);
roleSystem.setCreateAccountByDefault(true);
roleSystemService.save(roleSystem);
SysRoleSystemFilter roleSystemFilter = new SysRoleSystemFilter();
roleSystemFilter.setIsInCrossDomainGroupRoleId(noLoginRole.getId());
roleSystemFilter.setCheckIfIsInCrossDomainGroup(Boolean.TRUE);
roleSystemFilter.setId(roleSystem.getId());
List<SysRoleSystemDto> roleSystemDtos = roleSystemService.find(roleSystemFilter, null).getContent();
assertEquals(0, roleSystemDtos.size());
// Creates overridden ldapGroup merge attribute.
createOverriddenLdapGroupAttribute(ldapGroupsAttribute, roleSystem);
// Role-system should be in cross-domain group now.
roleSystemDtos = roleSystemService.find(roleSystemFilter, null).getContent();
assertEquals(1, roleSystemDtos.size());
SysRoleSystemDto roleSystemDto = roleSystemDtos.stream().findFirst().get();
assertTrue(roleSystemDto.isInCrossDomainGroup());
IdmRoleCompositionDto roleComposition = getHelper().createRoleComposition(parentNoLoginRole, noLoginRole);
IdmIdentityDto identity = getHelper().createIdentity();
IdmIdentityContractDto contract = getHelper().getPrimeContract(identity.getId());
IdmIdentityRoleFilter identityRoleFilter = new IdmIdentityRoleFilter();
identityRoleFilter.setIdentityId(identity.getId());
identityRoleFilter.setRoleId(noLoginRole.getId());
assertEquals(0, identityRoleService.count(identityRoleFilter));
AccIdentityAccountFilter identityAccountFilter = new AccIdentityAccountFilter();
identityAccountFilter.setIdentityId(identity.getId());
identityAccountFilter.setSystemId(systemDto.getId());
assertEquals(0, identityAccountService.find(identityAccountFilter, null).getContent().size());
IdmRoleRequestDto roleRequestDto = getHelper().assignRoles(contract, false, loginRole);
assertEquals(RoleRequestState.EXECUTED, roleRequestDto.getState());
assertNotNull(roleRequestDto.getSystemState());
assertEquals(1, identityAccountService.find(identityAccountFilter, null).getContent().size());
// Check if provisioning NOT contains ldapGroups attribute with value ('ONE') from the role.
SysProvisioningOperationFilter provisioningOperationFilter = new SysProvisioningOperationFilter();
provisioningOperationFilter.setSystemId(systemDto.getId());
provisioningOperationFilter.setEntityType(SystemEntityType.IDENTITY);
provisioningOperationFilter.setEntityIdentifier(identity.getId());
List<SysProvisioningOperationDto> provisioningOperationDtos = provisioningOperationService.find(provisioningOperationFilter, null).getContent();
assertEquals(1, provisioningOperationDtos.size());
SysProvisioningOperationDto provisioningOperationDto = provisioningOperationDtos.stream().findFirst().get();
ProvisioningAttributeDto provisioningAttributeLdapGroupsDto = provisioningOperationDto.getProvisioningContext().getAccountObject().keySet().stream().filter(provisioningAtt -> MockCrossDomainAdUserConnectorType.LDAP_GROUPS_ATTRIBUTE.equals(provisioningAtt.getSchemaAttributeName())).findFirst().get();
assertNotNull(provisioningAttributeLdapGroupsDto);
Object ldapGroupsValue = provisioningOperationDto.getProvisioningContext().getAccountObject().get(provisioningAttributeLdapGroupsDto);
assertEquals(0, ((List<?>) ldapGroupsValue).size());
// Delete old provisioning.
provisioningOperationService.delete(provisioningOperationDto);
// Assign parent role.
roleRequestDto = getHelper().assignRoles(contract, false, parentNoLoginRole);
assertEquals(RoleRequestState.EXECUTED, roleRequestDto.getState());
assertNotNull(roleRequestDto.getSystemState());
// Check if provisioning contains ldapGroups attribute with value ('ONE') from the role.
provisioningOperationFilter = new SysProvisioningOperationFilter();
provisioningOperationFilter.setSystemId(systemDto.getId());
provisioningOperationFilter.setEntityType(SystemEntityType.IDENTITY);
provisioningOperationFilter.setEntityIdentifier(identity.getId());
provisioningOperationDtos = provisioningOperationService.find(provisioningOperationFilter, null).getContent();
assertEquals(1, provisioningOperationDtos.size());
provisioningOperationDto = provisioningOperationDtos.stream().findFirst().get();
provisioningAttributeLdapGroupsDto = provisioningOperationDto.getProvisioningContext().getAccountObject().keySet().stream().filter(provisioningAtt -> MockCrossDomainAdUserConnectorType.LDAP_GROUPS_ATTRIBUTE.equals(provisioningAtt.getSchemaAttributeName())).findFirst().get();
assertNotNull(provisioningAttributeLdapGroupsDto);
ldapGroupsValue = provisioningOperationDto.getProvisioningContext().getAccountObject().get(provisioningAttributeLdapGroupsDto);
assertEquals("ONE", ((List<?>) ldapGroupsValue).get(0));
assertEquals(1, identityRoleService.count(identityRoleFilter));
// Clean
provisioningOperationService.deleteOperations(systemDto.getId());
getHelper().deleteIdentity(identity.getId());
roleCompositionService.delete(roleComposition);
getHelper().deleteRole(noLoginRole.getId());
getHelper().deleteRole(parentNoLoginRole.getId());
}
use of eu.bcvsolutions.idm.core.api.dto.IdmRoleCompositionDto in project CzechIdMng by bcvsolutions.
the class RoleExportBulkAction method exportBusinessRoles.
/**
* Export business roles for given role.
*
* @param role
*/
private void exportBusinessRoles(IdmRoleDto role) {
IdmRoleCompositionFilter compositionFilter = new IdmRoleCompositionFilter();
compositionFilter.setRoleId(role.getId());
List<IdmRoleCompositionDto> compositions = roleCompositionService.find(compositionFilter, null).getContent();
if (compositions.isEmpty()) {
roleCompositionService.export(ExportManager.BLANK_UUID, this.getBatch());
}
compositions.forEach(composition -> {
roleCompositionService.export(composition.getId(), this.getBatch());
});
// Set parent fields -> set authoritative mode. Here are two parent fields!
Set<String> parents = new LinkedHashSet<>();
parents.add(IdmRoleComposition_.superior.getName());
parents.add(IdmRoleComposition_.sub.getName());
this.getExportManager().setAuthoritativeMode(parents, IdmRoleCompositionFilter.PARAMETER_ROLE_ID, IdmRoleCompositionDto.class, this.getBatch());
}
use of eu.bcvsolutions.idm.core.api.dto.IdmRoleCompositionDto in project CzechIdMng by bcvsolutions.
the class DefaultIdmRoleCompositionService method findAllSubRoles.
@Override
@SuppressWarnings({ "unchecked", "rawtypes" })
public List<IdmRoleCompositionDto> findAllSubRoles(UUID superiorId, BasePermission... permission) {
Assert.notNull(superiorId, "Superior role identifier is required.");
//
ValueWrapper value = cacheManager.getValue(ALL_SUB_ROLES_CACHE_NAME, superiorId);
if (value != null) {
// never null
return (List) value.get();
}
//
List<IdmRoleCompositionDto> results = new ArrayList<>();
findAllSubRoles(results, new ArrayList<>(), superiorId, permission);
cacheManager.cacheValue(ALL_SUB_ROLES_CACHE_NAME, superiorId, results);
//
return results;
}
use of eu.bcvsolutions.idm.core.api.dto.IdmRoleCompositionDto in project CzechIdMng by bcvsolutions.
the class DefaultIdmRoleCompositionService method assignSubRoles.
/**
* @Transactional is not needed - (asynchronous) events is thrown for every sub role anyway ...
* Can be called repetitively for given identity role => checks or creates missing sub roles by composition.
*/
@Override
@SuppressWarnings("unchecked")
public void assignSubRoles(EntityEvent<IdmIdentityRoleDto> event, UUID roleCompositionId, BasePermission... permission) {
Assert.notNull(event, "Event is required.");
IdmIdentityRoleDto identityRole = event.getContent();
Assert.notNull(identityRole, "Identity role identifier is required.");
// find direct sub roles
IdmRoleCompositionFilter compositionFilter = new IdmRoleCompositionFilter();
compositionFilter.setSuperiorId(identityRole.getRole());
compositionFilter.setId(roleCompositionId);
//
List<IdmRoleCompositionDto> directSubRoles = find(compositionFilter, null, permission).getContent();
LOG.debug("Assign sub roles [{}] for identity role [{}], role [{}]", directSubRoles.size(), identityRole.getId(), identityRole.getRole());
//
Map<String, Serializable> props = resolveProperties(event);
Set<UUID> processedRoles = (Set<UUID>) props.get(IdentityRoleEvent.PROPERTY_PROCESSED_ROLES);
processedRoles.add(identityRole.getRole());
//
directSubRoles.forEach(subRoleComposition -> {
IdmRoleDto subRole = DtoUtils.getEmbedded(subRoleComposition, IdmRoleComposition_.sub);
if (processedRoles.contains(subRole.getId())) {
LOG.debug("Role [{}] was already processed by other business role composition - cycle, skipping", subRole.getCode());
} else {
// try to find currently assigned subrole by this configuration (return operation)
IdmIdentityRoleFilter filter = new IdmIdentityRoleFilter();
filter.setRoleCompositionId(subRoleComposition.getId());
filter.setDirectRoleId(identityRole.getDirectRole() == null ? identityRole.getId() : identityRole.getDirectRole());
if (identityRoleService.find(filter, null).getTotalElements() > 0) {
LOG.debug("Role [{}] was already processed by other business role composition - cycle, skipping", subRole.getCode());
} else {
//
IdmIdentityRoleDto subIdentityRole = new IdmIdentityRoleDto();
subIdentityRole.setRole(subRole.getId());
subIdentityRole.getEmbedded().put(IdmIdentityRoleDto.PROPERTY_ROLE, subRole);
subIdentityRole.setIdentityContract(identityRole.getIdentityContract());
subIdentityRole.setContractPosition(identityRole.getContractPosition());
subIdentityRole.getEmbedded().put(IdmIdentityRoleDto.PROPERTY_IDENTITY_CONTRACT, identityRole.getEmbedded().get(IdmIdentityRoleDto.PROPERTY_IDENTITY_CONTRACT));
subIdentityRole.setValidFrom(identityRole.getValidFrom());
subIdentityRole.setValidTill(identityRole.getValidTill());
subIdentityRole.setDirectRole(identityRole.getDirectRole() == null ? identityRole.getId() : identityRole.getDirectRole());
subIdentityRole.setRoleComposition(subRoleComposition.getId());
//
processedRoles.add(subRole.getId());
IdentityRoleEvent subEvent = new IdentityRoleEvent(IdentityRoleEventType.CREATE, subIdentityRole, props);
//
identityRoleService.publish(subEvent, event, permission);
// Notes new created assigned role to parent event
IdmIdentityRoleDto subContent = subEvent.getContent();
notingAssignedRole(event, subEvent, subContent, IdentityRoleEvent.PROPERTY_ASSIGNED_NEW_ROLES);
}
}
});
}
Aggregations