Examples with GuardedString eu.bcvsolutions.idm.core.security.api.domain.GuardedString used on opensource projects

Example 61 with GuardedString

use of eu.bcvsolutions.idm.core.security.api.domain.GuardedString in project CzechIdMng by bcvsolutions.

the class RoleAccountByRoleEvaluatorIntegrationTest method createIdentityWithRole.

private IdmIdentityDto createIdentityWithRole(boolean transitive) {
    loginAsAdmin(InitTestData.TEST_ADMIN_USERNAME);
    IdmRoleDto role = helper.createRole();
    TEST_ROLE_ID = role.getId();
    // self policy
    IdmAuthorizationPolicyDto readRolePolicy = new IdmAuthorizationPolicyDto();
    readRolePolicy.setPermissions(IdmBasePermission.READ);
    readRolePolicy.setRole(role.getId());
    readRolePolicy.setGroupPermission(CoreGroupPermission.ROLE.getName());
    readRolePolicy.setAuthorizableType(IdmRole.class.getCanonicalName());
    readRolePolicy.setEvaluator(CodeableEvaluator.class);
    readRolePolicy.getEvaluatorProperties().put(CodeableEvaluator.PARAMETER_IDENTIFIER, role.getId());
    authorizationPolicyService.save(readRolePolicy);
    if (transitive) {
        // create transitive policies
        IdmAuthorizationPolicyDto readAuthoritiesPolicy = new IdmAuthorizationPolicyDto();
        readAuthoritiesPolicy.setRole(role.getId());
        readAuthoritiesPolicy.setGroupPermission(CoreGroupPermission.AUTHORIZATIONPOLICY.getName());
        readAuthoritiesPolicy.setAuthorizableType(IdmAuthorizationPolicy.class.getCanonicalName());
        readAuthoritiesPolicy.setEvaluator(AuthorizationPolicyByRoleEvaluator.class);
        authorizationPolicyService.save(readAuthoritiesPolicy);
        IdmAuthorizationPolicyDto readRoleAccountPolicy = new IdmAuthorizationPolicyDto();
        readRoleAccountPolicy.setRole(role.getId());
        readRoleAccountPolicy.setGroupPermission(AccGroupPermission.ROLEACCOUNT.getName());
        readRoleAccountPolicy.setAuthorizableType(AccRoleAccount.class.getCanonicalName());
        readRoleAccountPolicy.setEvaluator(RoleAccountByRoleEvaluator.class);
        authorizationPolicyService.save(readRoleAccountPolicy);
    }
    // prepare identity
    IdmIdentityDto identity = helper.createIdentity();
    identity.setPassword(new GuardedString("heslo"));
    identity = identityService.save(identity);
    // assign role
    helper.createIdentityRole(identity, role);
    logout();
    // 
    return identity;
}

Example 62 with GuardedString

use of eu.bcvsolutions.idm.core.security.api.domain.GuardedString in project CzechIdMng by bcvsolutions.

the class DefaultProvisioningExecutorIntegrationTest method testDisabledSystem.

@Test
public void testDisabledSystem() {
    SysSystemDto system = helper.createTestResourceSystem(true);
    system.setDisabled(true);
    system = systemService.save(system);
    // 
    ProvisioningAttributeDto usernameAttribute = getProvisioningAttribute(TestHelper.ATTRIBUTE_MAPPING_NAME);
    ProvisioningAttributeDto firstNameAttribute = getProvisioningAttribute(TestHelper.ATTRIBUTE_MAPPING_FIRSTNAME);
    ProvisioningAttributeDto lastNameAttribute = getProvisioningAttribute(TestHelper.ATTRIBUTE_MAPPING_LASTNAME);
    ProvisioningAttributeDto passwordAttribute = getProvisioningAttribute(TestHelper.ATTRIBUTE_MAPPING_PASSWORD);
    // 
    // create test provisioning context
    SysProvisioningOperationDto provisioningOperation = createProvisioningOperation(system, "firstname");
    IcObjectClass objectClass = provisioningOperation.getProvisioningContext().getConnectorObject().getObjectClass();
    Map<ProvisioningAttributeDto, Object> accoutObject = provisioningOperation.getProvisioningContext().getAccountObject();
    String uid = (String) accoutObject.get(usernameAttribute);
    GuardedString password = (GuardedString) accoutObject.get(passwordAttribute);
    // 
    // publish event
    provisioningExecutor.execute(provisioningOperation);
    // is necessary to get again operation from service
    SysProvisioningOperationFilter filter = new SysProvisioningOperationFilter();
    filter.setSystemEntity(provisioningOperation.getSystemEntity());
    filter.setSystemId(system.getId());
    SysProvisioningOperationDto operation = provisioningOperationService.find(filter, null).getContent().get(0);
    // 
    assertEquals(OperationState.NOT_EXECUTED, operation.getResultState());
    assertEquals(AccResultCode.PROVISIONING_SYSTEM_DISABLED.name(), operation.getResult().getModel().getStatusEnum());
    // 
    IcUidAttribute uidAttribute = new IcUidAttributeImpl(null, uid, null);
    IcConnectorObject existsConnectorObject = connectorFacade.readObject(system.getConnectorInstance(), systemService.getConnectorConfiguration(system), objectClass, uidAttribute);
    // 
    assertNull(existsConnectorObject);
    // password is stored in confidential storage
    assertNotNull(confidentialStorage.get(operation.getId(), SysProvisioningOperation.class, provisioningOperationService.createAccountObjectPropertyKey(passwordAttribute.getKey(), 0)));
    // 
    system.setDisabled(false);
    system = systemService.save(system);
    // 
    provisioningExecutor.execute(operation);
    // 
    // check target account
    existsConnectorObject = connectorFacade.readObject(system.getConnectorInstance(), systemService.getConnectorConfiguration(system), objectClass, uidAttribute);
    // 
    assertNotNull(existsConnectorObject);
    assertEquals(uid, existsConnectorObject.getUidValue());
    assertEquals(accoutObject.get(firstNameAttribute), existsConnectorObject.getAttributeByName(TestHelper.ATTRIBUTE_MAPPING_FIRSTNAME).getValue());
    assertEquals(accoutObject.get(lastNameAttribute), existsConnectorObject.getAttributeByName(TestHelper.ATTRIBUTE_MAPPING_LASTNAME).getValue());
    // authenticate for password check
    IcUidAttribute attribute = connectorFacade.authenticateObject(system.getConnectorInstance(), systemService.getConnectorConfiguration(system), objectClass, uid, password);
    assertNotNull(attribute);
    assertEquals(uid, attribute.getUidValue());
    // password is removed in confidential storage
    assertNull(confidentialStorage.get(operation.getId(), SysProvisioningOperation.class, provisioningOperationService.createAccountObjectPropertyKey(passwordAttribute.getKey(), 0)));
}

Example 63 with GuardedString

use of eu.bcvsolutions.idm.core.security.api.domain.GuardedString in project CzechIdMng by bcvsolutions.

the class DefaultProvisioningExecutorIntegrationTest method testGreenLineAccountProvisioning.

@Test
public void testGreenLineAccountProvisioning() {
    SysSystemDto system = helper.createTestResourceSystem(true);
    ProvisioningAttributeDto usernameAttribute = getProvisioningAttribute(TestHelper.ATTRIBUTE_MAPPING_NAME);
    ProvisioningAttributeDto firstNameAttribute = getProvisioningAttribute(TestHelper.ATTRIBUTE_MAPPING_FIRSTNAME);
    ProvisioningAttributeDto lastNameAttribute = getProvisioningAttribute(TestHelper.ATTRIBUTE_MAPPING_LASTNAME);
    ProvisioningAttributeDto passwordAttribute = getProvisioningAttribute(TestHelper.ATTRIBUTE_MAPPING_PASSWORD);
    // 
    // create test provisioning context
    SysProvisioningOperationDto provisioningOperation = createProvisioningOperation(system, "firstname");
    IcObjectClass objectClass = provisioningOperation.getProvisioningContext().getConnectorObject().getObjectClass();
    Map<ProvisioningAttributeDto, Object> accoutObject = provisioningOperation.getProvisioningContext().getAccountObject();
    String uid = (String) accoutObject.get(usernameAttribute);
    GuardedString password = (GuardedString) accoutObject.get(passwordAttribute);
    // 
    // publish event
    provisioningExecutor.execute(provisioningOperation);
    // 
    // check target account
    IcUidAttribute uidAttribute = new IcUidAttributeImpl(null, uid, null);
    IcConnectorObject existsConnectorObject = connectorFacade.readObject(system.getConnectorInstance(), systemService.getConnectorConfiguration(system), objectClass, uidAttribute);
    // 
    assertNotNull(existsConnectorObject);
    assertEquals(uid, existsConnectorObject.getUidValue());
    assertEquals(accoutObject.get(firstNameAttribute), existsConnectorObject.getAttributeByName(TestHelper.ATTRIBUTE_MAPPING_FIRSTNAME).getValue());
    assertEquals(accoutObject.get(lastNameAttribute), existsConnectorObject.getAttributeByName(TestHelper.ATTRIBUTE_MAPPING_LASTNAME).getValue());
    // authenticate for password check
    IcUidAttribute attribute = connectorFacade.authenticateObject(system.getConnectorInstance(), systemService.getConnectorConfiguration(system), objectClass, uid, password);
    assertNotNull(attribute);
    assertEquals(uid, attribute.getUidValue());
    // 
    // check system entity
    SysSystemEntityDto systemEntity = systemEntityService.getBySystemAndEntityTypeAndUid(system, SystemEntityType.IDENTITY, uid);
    assertFalse(systemEntity.isWish());
}

Example 64 with GuardedString

use of eu.bcvsolutions.idm.core.security.api.domain.GuardedString in project CzechIdMng by bcvsolutions.

the class DefaultProvisioningExecutorIntegrationTest method testReadonlySystem.

@Test
public void testReadonlySystem() {
    SysSystemDto system = helper.createTestResourceSystem(true);
    system.setReadonly(true);
    system = systemService.save(system);
    ProvisioningAttributeDto usernameAttribute = getProvisioningAttribute(TestHelper.ATTRIBUTE_MAPPING_NAME);
    ProvisioningAttributeDto firstNameAttribute = getProvisioningAttribute(TestHelper.ATTRIBUTE_MAPPING_FIRSTNAME);
    ProvisioningAttributeDto lastNameAttribute = getProvisioningAttribute(TestHelper.ATTRIBUTE_MAPPING_LASTNAME);
    ProvisioningAttributeDto passwordAttribute = getProvisioningAttribute(TestHelper.ATTRIBUTE_MAPPING_PASSWORD);
    // 
    // create test provisioning context
    SysProvisioningOperationDto provisioningOperation = createProvisioningOperation(system, "firstname");
    IcObjectClass objectClass = provisioningOperation.getProvisioningContext().getConnectorObject().getObjectClass();
    Map<ProvisioningAttributeDto, Object> accoutObject = provisioningOperation.getProvisioningContext().getAccountObject();
    String uid = (String) accoutObject.get(usernameAttribute);
    GuardedString password = (GuardedString) accoutObject.get(passwordAttribute);
    // 
    // publish event
    provisioningExecutor.execute(provisioningOperation);
    // is necessary to get again operation from service
    SysProvisioningOperationFilter filter = new SysProvisioningOperationFilter();
    filter.setSystemEntity(provisioningOperation.getSystemEntity());
    filter.setSystemId(system.getId());
    SysProvisioningOperationDto readOnlyoperation = provisioningOperationService.find(filter, null).getContent().get(0);
    // 
    assertEquals(OperationState.NOT_EXECUTED, readOnlyoperation.getResultState());
    assertEquals(AccResultCode.PROVISIONING_SYSTEM_READONLY.name(), readOnlyoperation.getResult().getModel().getStatusEnum());
    // 
    IcUidAttribute uidAttribute = new IcUidAttributeImpl(null, uid, null);
    IcConnectorObject existsConnectorObject = connectorFacade.readObject(system.getConnectorInstance(), systemService.getConnectorConfiguration(system), objectClass, uidAttribute);
    // 
    assertNull(existsConnectorObject);
    // passwords are stored in confidential storage
    assertNotNull(confidentialStorage.get(readOnlyoperation.getId(), SysProvisioningOperation.class, provisioningOperationService.createAccountObjectPropertyKey(passwordAttribute.getKey(), 0)));
    assertNotNull(confidentialStorage.get(readOnlyoperation.getId(), SysProvisioningOperation.class, provisioningOperationService.createConnectorObjectPropertyKey(readOnlyoperation.getProvisioningContext().getConnectorObject().getAttributeByName(passwordAttribute.getSchemaAttributeName()), 0)));
    // 
    system.setReadonly(false);
    system = systemService.save(system);
    // 
    provisioningExecutor.execute(readOnlyoperation);
    // is necessary to get again operation from service
    Assert.assertNull(provisioningOperationService.get(readOnlyoperation.getId()));
    // 
    // check target account
    existsConnectorObject = connectorFacade.readObject(system.getConnectorInstance(), systemService.getConnectorConfiguration(system), objectClass, uidAttribute);
    // 
    assertNotNull(existsConnectorObject);
    assertEquals(uid, existsConnectorObject.getUidValue());
    assertEquals(accoutObject.get(firstNameAttribute), existsConnectorObject.getAttributeByName(TestHelper.ATTRIBUTE_MAPPING_FIRSTNAME).getValue());
    assertEquals(accoutObject.get(lastNameAttribute), existsConnectorObject.getAttributeByName(TestHelper.ATTRIBUTE_MAPPING_LASTNAME).getValue());
    // authenticate for password check
    IcUidAttribute attribute = connectorFacade.authenticateObject(system.getConnectorInstance(), systemService.getConnectorConfiguration(system), objectClass, uid, password);
    assertNotNull(attribute);
    assertEquals(uid, attribute.getUidValue());
    // passwords are removed in confidential storage
    assertNull(confidentialStorage.get(readOnlyoperation.getId(), SysProvisioningOperation.class, provisioningOperationService.createAccountObjectPropertyKey(TestHelper.ATTRIBUTE_MAPPING_PASSWORD, 0)));
    // 
    String connectorObjectPropertyKey = provisioningOperationService.createConnectorObjectPropertyKey(readOnlyoperation.getProvisioningContext().getConnectorObject().getAttributeByName(TestHelper.ATTRIBUTE_MAPPING_PASSWORD), 0);
    // 
    assertNull(confidentialStorage.get(readOnlyoperation.getId(), SysProvisioningOperation.class, connectorObjectPropertyKey));
}

Example 65 with GuardedString

use of eu.bcvsolutions.idm.core.security.api.domain.GuardedString in project CzechIdMng by bcvsolutions.

the class DefaultSysProvisioningOperationServiceUnitTest method testReplaceArrayGuardedStringsInAccountObject.

@Test
public void testReplaceArrayGuardedStringsInAccountObject() {
    ProvisioningContext context = new ProvisioningContext();
    Map<ProvisioningAttributeDto, Object> accoutObject = new HashMap<>();
    context.setAccountObject(accoutObject);
    // 
    // fill properties
    ProvisioningAttributeDto guarded = new ProvisioningAttributeDto("guarded", AttributeMappingStrategyType.SET);
    GuardedString guardedOne = new GuardedString("one");
    GuardedString guardedTwo = new GuardedString("two");
    accoutObject.put(guarded, new GuardedString[] { guardedOne, guardedTwo });
    // 
    // run
    Map<String, Serializable> confidentiaValues = service.replaceGuardedStrings(context);
    // 
    // check
    assertEquals(2, confidentiaValues.size());
    assertEquals(guardedOne.asString(), confidentiaValues.get(service.createAccountObjectPropertyKey(guarded.getKey(), 0)));
    assertEquals(guardedTwo.asString(), confidentiaValues.get(service.createAccountObjectPropertyKey(guarded.getKey(), 1)));
    assertEquals(2, ((Object[]) accoutObject.get(guarded)).length);
    assertEquals(service.createAccountObjectPropertyKey(guarded.getKey(), 0), ((ConfidentialString) ((Object[]) accoutObject.get(guarded))[0]).getKey());
    assertEquals(service.createAccountObjectPropertyKey(guarded.getKey(), 1), ((ConfidentialString) ((Object[]) accoutObject.get(guarded))[1]).getKey());
}