Examples with AdminRole org.apache.directory.fortress.core.model.AdminRole used on opensource projects

Example 1 with AdminRole

use of org.apache.directory.fortress.core.model.AdminRole in project directory-fortress-core by apache.

the class AdminMgrImpl method grantPermission.

/**
 * {@inheritDoc}
 */
@Override
@AdminPermissionOperation
public void grantPermission(Permission perm, Role role) throws SecurityException {
    String methodName = "grantPermission";
    assertContext(CLS_NM, methodName, perm, GlobalErrIds.PERM_OPERATION_NULL);
    assertContext(CLS_NM, methodName, role, GlobalErrIds.ROLE_NULL);
    setEntitySession(CLS_NM, methodName, perm);
    // validate role
    if (perm.isAdmin()) {
        AdminRole adminRole = new AdminRole(role.getName());
        adminRole.setContextId(this.contextId);
        adminP.read(adminRole);
    } else {
        AdminUtil.canGrant(perm.getAdminSession(), role, perm, contextId);
        roleP.read(role);
    }
    permP.grant(perm, role);
}

Example 2 with AdminRole

use of org.apache.directory.fortress.core.model.AdminRole in project directory-fortress-core by apache.

the class AdminRoleP method removeOccupant.

/**
 * Remove the User dn occupant attribute from the OrganizationalRole entity in ldap.  This method is called by AdminMgrImpl
 * when the User is being deleted.
 *
 * @param userDn contains the userId targeted for attribute removal.
 * @param contextId maps to sub-tree in DIT, e.g. ou=contextId, dc=example, dc=com.
 * @throws SecurityException in the event of DAO search error.
 */
void removeOccupant(String userDn, String contextId) throws SecurityException {
    List<String> list;
    try {
        list = rDao.findAssignedRoles(userDn, contextId);
        for (String roleNm : list) {
            AdminRole role = new AdminRole(roleNm);
            role.setContextId(contextId);
            deassign(role, userDn);
        }
    } catch (FinderException fe) {
        String error = "removeOccupant userDn [" + userDn + "] caught FinderException=" + fe;
        throw new SecurityException(GlobalErrIds.ARLE_REMOVE_OCCUPANT_FAILED, error, fe);
    }
}

Example 3 with AdminRole

use of org.apache.directory.fortress.core.model.AdminRole in project directory-fortress-core by apache.

the class DelAdminMgrImpl method updateRole.

/**
 * {@inheritDoc}
 */
@Override
@AdminPermissionOperation
public AdminRole updateRole(AdminRole role) throws SecurityException {
    String methodName = "updateRole";
    assertContext(CLS_NM, methodName, role, GlobalErrIds.ARLE_NULL);
    setEntitySession(CLS_NM, methodName, role);
    AdminRole re = admRP.update(role);
    // search for all users assigned this role and update:
    List<User> users = userP.getAssignedUsers(role);
    if (CollectionUtils.isNotEmpty(users)) {
        final AdminMgr aMgr = AdminMgrFactory.createInstance(this.contextId);
        for (User ue : users) {
            User upUe = new User(ue.getUserId());
            setAdminData(CLS_NM, methodName, upUe);
            List<UserAdminRole> uaRoles = ue.getAdminRoles();
            UserAdminRole chgRole = new UserAdminRole();
            chgRole.setName(role.getName());
            chgRole.setUserId(ue.getUserId());
            chgRole.setOsPSet(role.getOsPSet());
            chgRole.setOsUSet(role.getOsUSet());
            uaRoles.remove(chgRole);
            ConstraintUtil.copy(re, chgRole);
            uaRoles.add(chgRole);
            upUe.setUserId(ue.getUserId());
            upUe.setAdminRole(chgRole);
            aMgr.updateUser(upUe);
        }
    }
    return re;
}

Example 4 with AdminRole

use of org.apache.directory.fortress.core.model.AdminRole in project directory-fortress-core by apache.

the class DelAdminMgrImpl method deassignUser.

/**
 * {@inheritDoc}
 */
@Override
@AdminPermissionOperation
public void deassignUser(UserAdminRole uAdminRole) throws SecurityException {
    String methodName = "deassignUser";
    assertContext(CLS_NM, methodName, uAdminRole, GlobalErrIds.ARLE_NULL);
    setEntitySession(CLS_NM, methodName, uAdminRole);
    String dn = userP.deassign(uAdminRole);
    AdminRole adminRole = new AdminRole(uAdminRole.getName());
    // copy the ARBAC attributes to AdminRole:
    setAdminData(CLS_NM, methodName, adminRole);
    // Deassign user dn attribute to the adminRole, this will remove a single, standard attribute value, called "roleOccupant", directly onto the adminRole node:
    admRP.deassign(adminRole, dn);
}

Example 5 with AdminRole

use of org.apache.directory.fortress.core.model.AdminRole in project directory-fortress-core by apache.

the class DelAdminMgrImpl method deleteInheritance.

/**
 * {@inheritDoc}
 */
@Override
@AdminPermissionOperation
public void deleteInheritance(AdminRole parentRole, AdminRole childRole) throws SecurityException {
    String methodName = "deleteInheritanceRole";
    assertContext(CLS_NM, methodName, parentRole, GlobalErrIds.ARLE_PARENT_NULL);
    assertContext(CLS_NM, methodName, childRole, GlobalErrIds.ARLE_CHILD_NULL);
    setEntitySession(CLS_NM, methodName, parentRole);
    AdminRoleUtil.validateRelationship(childRole, parentRole, true);
    AdminRoleUtil.updateHier(this.contextId, new Relationship(childRole.getName().toUpperCase(), parentRole.getName().toUpperCase()), Hier.Op.REM);
    // need to remove the parent from the child role:
    AdminRole cRole = new AdminRole(childRole.getName());
    cRole.setContextId(this.contextId);
    cRole = admRP.read(cRole);
    // Use cRole2 to update ONLY the parents attribute on the child role and nothing else:
    AdminRole cRole2 = new AdminRole(childRole.getName());
    cRole2.setParents(cRole.getParents());
    cRole2.delParent(parentRole.getName());
    cRole2.setContextId(this.contextId);
    setAdminData(CLS_NM, methodName, cRole2);
    // are there any parents left?
    if (!CollectionUtils.isNotEmpty(cRole2.getParents())) {
        // The updates only update non-empty multi-occurring attributes
        // so if last parent assigned, so must remove the attribute completely:
        admRP.deleteParent(cRole2);
    } else {
        admRP.update(cRole2);
    }
}