Examples with IcUidAttribute eu.bcvsolutions.idm.ic.api.IcUidAttribute used on opensource projects

Example 11 with IcUidAttribute

use of eu.bcvsolutions.idm.ic.api.IcUidAttribute in project CzechIdMng by bcvsolutions.

the class DefaultAccAuthenticator method authenticate.

@Override
public LoginDto authenticate(LoginDto loginDto) {
    // temporary solution for get system id, this is not nice.
    String systemCodeable = configurationService.getValue(PROPERTY_AUTH_SYSTEM_ID);
    if (StringUtils.isEmpty(systemCodeable)) {
        // without system can't check
        return null;
    }
    // 
    SysSystemDto system = (SysSystemDto) lookupService.lookupDto(SysSystemDto.class, systemCodeable);
    // 
    if (system == null) {
        LOG.warn("System by codeable identifier [{}] not found. Check configuration property [{}]", systemCodeable, PROPERTY_AUTH_SYSTEM_ID);
        // system doesn't exist
        return null;
    }
    IdmIdentityDto identity = (IdmIdentityDto) lookupService.lookupDto(IdmIdentityDto.class, loginDto.getUsername());
    if (identity == null) {
        throw new IdmAuthenticationException(MessageFormat.format("Check identity can login: The identity [{0}] either doesn't exist or is deleted.", loginDto.getUsername()));
    }
    // 
    // search authentication attribute for system with provisioning mapping, only for identity
    SysSystemAttributeMappingDto attribute = systemAttributeMappingService.getAuthenticationAttribute(system.getId(), SystemEntityType.IDENTITY);
    // 
    if (attribute == null) {
        // attribute MUST exist
        throw new ResultCodeException(AccResultCode.AUTHENTICATION_AUTHENTICATION_ATTRIBUTE_DONT_SET, ImmutableMap.of("name", system.getName()));
    }
    // 
    // find if identity has account on system
    List<AccAccountDto> accounts = accountService.getAccounts(system.getId(), identity.getId());
    if (accounts.isEmpty()) {
        // user hasn't account on system, continue
        return null;
    }
    // 
    ResultCodeException authFailedException = null;
    IcUidAttribute auth = null;
    for (AccAccountDto account : accounts) {
        SysSchemaAttributeDto schemaAttribute = schemaAttributeService.get(attribute.getSchemaAttribute());
        SysSchemaObjectClassDto schemaObjectClassDto = DtoUtils.getEmbedded(schemaAttribute, SysSchemaAttribute_.objectClass, SysSchemaObjectClassDto.class);
        SysSystemEntityDto systemEntityDto = systemEntityService.get(account.getSystemEntity());
        IcObjectClass objectClass = new IcObjectClassImpl(schemaObjectClassDto.getObjectClassName());
        IcConnectorObject connectorObject = systemService.readConnectorObject(system.getId(), systemEntityDto.getUid(), objectClass);
        // 
        if (connectorObject == null) {
            continue;
        }
        // 
        String transformUsername = null;
        // iterate over all attributes to find authentication attribute
        for (IcAttribute icAttribute : connectorObject.getAttributes()) {
            if (icAttribute.getName().equals(schemaAttributeService.get(attribute.getSchemaAttribute()).getName())) {
                transformUsername = String.valueOf(icAttribute.getValue());
                break;
            }
        }
        if (transformUsername == null) {
            throw new ResultCodeException(AccResultCode.AUTHENTICATION_USERNAME_DONT_EXISTS, ImmutableMap.of("username", loginDto.getUsername(), "name", system.getName()));
        }
        // authentication over system, when password or username not exist or bad credentials - throw error
        try {
            // authentication against system
            auth = provisioningService.authenticate(transformUsername, loginDto.getPassword(), system, SystemEntityType.IDENTITY);
            authFailedException = null;
            // check auth
            if (auth == null || auth.getValue() == null) {
                authFailedException = new ResultCodeException(AccResultCode.AUTHENTICATION_AGAINST_SYSTEM_FAILED, ImmutableMap.of("name", system.getName(), "username", loginDto.getUsername()));
                // failed, continue to another
                break;
            }
            // everything success break
            break;
        } catch (ResultCodeException e) {
            // failed, continue to another
            authFailedException = new ResultCodeException(CoreResultCode.AUTH_FAILED, "Invalid login or password.", e);
        }
    }
    if (auth == null || auth.getValue() == null) {
        authFailedException = new ResultCodeException(AccResultCode.AUTHENTICATION_AGAINST_SYSTEM_FAILED, ImmutableMap.of("name", system.getName(), "username", loginDto.getUsername()));
    }
    // 
    if (authFailedException != null) {
        throw authFailedException;
    }
    String module = this.getModule();
    loginDto = jwtAuthenticationService.createJwtAuthenticationAndAuthenticate(loginDto, identity, module);
    LOG.info("Identity with username [{}] is authenticated by system [{}]", loginDto.getUsername(), system.getName());
    return loginDto;
}

Example 12 with IcUidAttribute

use of eu.bcvsolutions.idm.ic.api.IcUidAttribute in project CzechIdMng by bcvsolutions.

the class DefaultProvisioningExecutorIntegrationTest method testDisabledSystem.

@Test
public void testDisabledSystem() {
    SysSystemDto system = helper.createTestResourceSystem(true);
    system.setDisabled(true);
    system = systemService.save(system);
    // 
    ProvisioningAttributeDto usernameAttribute = getProvisioningAttribute(TestHelper.ATTRIBUTE_MAPPING_NAME);
    ProvisioningAttributeDto firstNameAttribute = getProvisioningAttribute(TestHelper.ATTRIBUTE_MAPPING_FIRSTNAME);
    ProvisioningAttributeDto lastNameAttribute = getProvisioningAttribute(TestHelper.ATTRIBUTE_MAPPING_LASTNAME);
    ProvisioningAttributeDto passwordAttribute = getProvisioningAttribute(TestHelper.ATTRIBUTE_MAPPING_PASSWORD);
    // 
    // create test provisioning context
    SysProvisioningOperationDto provisioningOperation = createProvisioningOperation(system, "firstname");
    IcObjectClass objectClass = provisioningOperation.getProvisioningContext().getConnectorObject().getObjectClass();
    Map<ProvisioningAttributeDto, Object> accoutObject = provisioningOperation.getProvisioningContext().getAccountObject();
    String uid = (String) accoutObject.get(usernameAttribute);
    GuardedString password = (GuardedString) accoutObject.get(passwordAttribute);
    // 
    // publish event
    provisioningExecutor.execute(provisioningOperation);
    // is necessary to get again operation from service
    SysProvisioningOperationFilter filter = new SysProvisioningOperationFilter();
    filter.setSystemEntity(provisioningOperation.getSystemEntity());
    filter.setSystemId(system.getId());
    SysProvisioningOperationDto operation = provisioningOperationService.find(filter, null).getContent().get(0);
    // 
    assertEquals(OperationState.NOT_EXECUTED, operation.getResultState());
    assertEquals(AccResultCode.PROVISIONING_SYSTEM_DISABLED.name(), operation.getResult().getModel().getStatusEnum());
    // 
    IcUidAttribute uidAttribute = new IcUidAttributeImpl(null, uid, null);
    IcConnectorObject existsConnectorObject = connectorFacade.readObject(system.getConnectorInstance(), systemService.getConnectorConfiguration(system), objectClass, uidAttribute);
    // 
    assertNull(existsConnectorObject);
    // password is stored in confidential storage
    assertNotNull(confidentialStorage.get(operation.getId(), SysProvisioningOperation.class, provisioningOperationService.createAccountObjectPropertyKey(passwordAttribute.getKey(), 0)));
    // 
    system.setDisabled(false);
    system = systemService.save(system);
    // 
    provisioningExecutor.execute(operation);
    // 
    // check target account
    existsConnectorObject = connectorFacade.readObject(system.getConnectorInstance(), systemService.getConnectorConfiguration(system), objectClass, uidAttribute);
    // 
    assertNotNull(existsConnectorObject);
    assertEquals(uid, existsConnectorObject.getUidValue());
    assertEquals(accoutObject.get(firstNameAttribute), existsConnectorObject.getAttributeByName(TestHelper.ATTRIBUTE_MAPPING_FIRSTNAME).getValue());
    assertEquals(accoutObject.get(lastNameAttribute), existsConnectorObject.getAttributeByName(TestHelper.ATTRIBUTE_MAPPING_LASTNAME).getValue());
    // authenticate for password check
    IcUidAttribute attribute = connectorFacade.authenticateObject(system.getConnectorInstance(), systemService.getConnectorConfiguration(system), objectClass, uid, password);
    assertNotNull(attribute);
    assertEquals(uid, attribute.getUidValue());
    // password is removed in confidential storage
    assertNull(confidentialStorage.get(operation.getId(), SysProvisioningOperation.class, provisioningOperationService.createAccountObjectPropertyKey(passwordAttribute.getKey(), 0)));
}

Example 13 with IcUidAttribute

use of eu.bcvsolutions.idm.ic.api.IcUidAttribute in project CzechIdMng by bcvsolutions.

the class DefaultProvisioningExecutorIntegrationTest method testGreenLineAccountProvisioning.

@Test
public void testGreenLineAccountProvisioning() {
    SysSystemDto system = helper.createTestResourceSystem(true);
    ProvisioningAttributeDto usernameAttribute = getProvisioningAttribute(TestHelper.ATTRIBUTE_MAPPING_NAME);
    ProvisioningAttributeDto firstNameAttribute = getProvisioningAttribute(TestHelper.ATTRIBUTE_MAPPING_FIRSTNAME);
    ProvisioningAttributeDto lastNameAttribute = getProvisioningAttribute(TestHelper.ATTRIBUTE_MAPPING_LASTNAME);
    ProvisioningAttributeDto passwordAttribute = getProvisioningAttribute(TestHelper.ATTRIBUTE_MAPPING_PASSWORD);
    // 
    // create test provisioning context
    SysProvisioningOperationDto provisioningOperation = createProvisioningOperation(system, "firstname");
    IcObjectClass objectClass = provisioningOperation.getProvisioningContext().getConnectorObject().getObjectClass();
    Map<ProvisioningAttributeDto, Object> accoutObject = provisioningOperation.getProvisioningContext().getAccountObject();
    String uid = (String) accoutObject.get(usernameAttribute);
    GuardedString password = (GuardedString) accoutObject.get(passwordAttribute);
    // 
    // publish event
    provisioningExecutor.execute(provisioningOperation);
    // 
    // check target account
    IcUidAttribute uidAttribute = new IcUidAttributeImpl(null, uid, null);
    IcConnectorObject existsConnectorObject = connectorFacade.readObject(system.getConnectorInstance(), systemService.getConnectorConfiguration(system), objectClass, uidAttribute);
    // 
    assertNotNull(existsConnectorObject);
    assertEquals(uid, existsConnectorObject.getUidValue());
    assertEquals(accoutObject.get(firstNameAttribute), existsConnectorObject.getAttributeByName(TestHelper.ATTRIBUTE_MAPPING_FIRSTNAME).getValue());
    assertEquals(accoutObject.get(lastNameAttribute), existsConnectorObject.getAttributeByName(TestHelper.ATTRIBUTE_MAPPING_LASTNAME).getValue());
    // authenticate for password check
    IcUidAttribute attribute = connectorFacade.authenticateObject(system.getConnectorInstance(), systemService.getConnectorConfiguration(system), objectClass, uid, password);
    assertNotNull(attribute);
    assertEquals(uid, attribute.getUidValue());
    // 
    // check system entity
    SysSystemEntityDto systemEntity = systemEntityService.getBySystemAndEntityTypeAndUid(system, SystemEntityType.IDENTITY, uid);
    assertFalse(systemEntity.isWish());
}

Example 14 with IcUidAttribute

use of eu.bcvsolutions.idm.ic.api.IcUidAttribute in project CzechIdMng by bcvsolutions.

the class DefaultProvisioningExecutorIntegrationTest method testReadonlySystem.

@Test
public void testReadonlySystem() {
    SysSystemDto system = helper.createTestResourceSystem(true);
    system.setReadonly(true);
    system = systemService.save(system);
    ProvisioningAttributeDto usernameAttribute = getProvisioningAttribute(TestHelper.ATTRIBUTE_MAPPING_NAME);
    ProvisioningAttributeDto firstNameAttribute = getProvisioningAttribute(TestHelper.ATTRIBUTE_MAPPING_FIRSTNAME);
    ProvisioningAttributeDto lastNameAttribute = getProvisioningAttribute(TestHelper.ATTRIBUTE_MAPPING_LASTNAME);
    ProvisioningAttributeDto passwordAttribute = getProvisioningAttribute(TestHelper.ATTRIBUTE_MAPPING_PASSWORD);
    // 
    // create test provisioning context
    SysProvisioningOperationDto provisioningOperation = createProvisioningOperation(system, "firstname");
    IcObjectClass objectClass = provisioningOperation.getProvisioningContext().getConnectorObject().getObjectClass();
    Map<ProvisioningAttributeDto, Object> accoutObject = provisioningOperation.getProvisioningContext().getAccountObject();
    String uid = (String) accoutObject.get(usernameAttribute);
    GuardedString password = (GuardedString) accoutObject.get(passwordAttribute);
    // 
    // publish event
    provisioningExecutor.execute(provisioningOperation);
    // is necessary to get again operation from service
    SysProvisioningOperationFilter filter = new SysProvisioningOperationFilter();
    filter.setSystemEntity(provisioningOperation.getSystemEntity());
    filter.setSystemId(system.getId());
    SysProvisioningOperationDto readOnlyoperation = provisioningOperationService.find(filter, null).getContent().get(0);
    // 
    assertEquals(OperationState.NOT_EXECUTED, readOnlyoperation.getResultState());
    assertEquals(AccResultCode.PROVISIONING_SYSTEM_READONLY.name(), readOnlyoperation.getResult().getModel().getStatusEnum());
    // 
    IcUidAttribute uidAttribute = new IcUidAttributeImpl(null, uid, null);
    IcConnectorObject existsConnectorObject = connectorFacade.readObject(system.getConnectorInstance(), systemService.getConnectorConfiguration(system), objectClass, uidAttribute);
    // 
    assertNull(existsConnectorObject);
    // passwords are stored in confidential storage
    assertNotNull(confidentialStorage.get(readOnlyoperation.getId(), SysProvisioningOperation.class, provisioningOperationService.createAccountObjectPropertyKey(passwordAttribute.getKey(), 0)));
    assertNotNull(confidentialStorage.get(readOnlyoperation.getId(), SysProvisioningOperation.class, provisioningOperationService.createConnectorObjectPropertyKey(readOnlyoperation.getProvisioningContext().getConnectorObject().getAttributeByName(passwordAttribute.getSchemaAttributeName()), 0)));
    // 
    system.setReadonly(false);
    system = systemService.save(system);
    // 
    provisioningExecutor.execute(readOnlyoperation);
    // is necessary to get again operation from service
    Assert.assertNull(provisioningOperationService.get(readOnlyoperation.getId()));
    // 
    // check target account
    existsConnectorObject = connectorFacade.readObject(system.getConnectorInstance(), systemService.getConnectorConfiguration(system), objectClass, uidAttribute);
    // 
    assertNotNull(existsConnectorObject);
    assertEquals(uid, existsConnectorObject.getUidValue());
    assertEquals(accoutObject.get(firstNameAttribute), existsConnectorObject.getAttributeByName(TestHelper.ATTRIBUTE_MAPPING_FIRSTNAME).getValue());
    assertEquals(accoutObject.get(lastNameAttribute), existsConnectorObject.getAttributeByName(TestHelper.ATTRIBUTE_MAPPING_LASTNAME).getValue());
    // authenticate for password check
    IcUidAttribute attribute = connectorFacade.authenticateObject(system.getConnectorInstance(), systemService.getConnectorConfiguration(system), objectClass, uid, password);
    assertNotNull(attribute);
    assertEquals(uid, attribute.getUidValue());
    // passwords are removed in confidential storage
    assertNull(confidentialStorage.get(readOnlyoperation.getId(), SysProvisioningOperation.class, provisioningOperationService.createAccountObjectPropertyKey(TestHelper.ATTRIBUTE_MAPPING_PASSWORD, 0)));
    // 
    String connectorObjectPropertyKey = provisioningOperationService.createConnectorObjectPropertyKey(readOnlyoperation.getProvisioningContext().getConnectorObject().getAttributeByName(TestHelper.ATTRIBUTE_MAPPING_PASSWORD), 0);
    // 
    assertNull(confidentialStorage.get(readOnlyoperation.getId(), SysProvisioningOperation.class, connectorObjectPropertyKey));
}

Example 15 with IcUidAttribute

use of eu.bcvsolutions.idm.ic.api.IcUidAttribute in project CzechIdMng by bcvsolutions.

the class ConnIdIcConvertUtil method convertConnIdSyncDelta.

public static IcSyncDelta convertConnIdSyncDelta(SyncDelta delta) {
    if (delta == null) {
        return null;
    }
    IcSyncToken token = ConnIdIcConvertUtil.convertConnIdSyncToken(delta.getToken());
    IcSyncDeltaTypeEnum deltaType = IcSyncDeltaTypeEnum.valueOf(delta.getDeltaType().name());
    IcUidAttribute previousUid = ConnIdIcConvertUtil.convertConnIdUid(delta.getPreviousUid());
    IcObjectClass objectClass = ConnIdIcConvertUtil.convertConnIdObjectClass(delta.getObjectClass());
    IcUidAttribute uid = ConnIdIcConvertUtil.convertConnIdUid(delta.getUid());
    IcConnectorObject object = ConnIdIcConvertUtil.convertConnIdConnectorObject(delta.getObject());
    return new IcSyncDeltaImpl(token, deltaType, previousUid, objectClass, uid, object);
}