Examples with SDSet org.apache.directory.fortress.core.model.SDSet used on opensource projects

Example 56 with SDSet

use of org.apache.directory.fortress.core.model.SDSet in project directory-fortress-core by apache.

the class AdminMgrImpl method addDsdRoleMember.

/**
 * {@inheritDoc}
 */
@Override
@AdminPermissionOperation
public SDSet addDsdRoleMember(SDSet dsdSet, Role role) throws SecurityException {
    String methodName = "addDsdRoleMember";
    assertContext(CLS_NM, methodName, dsdSet, GlobalErrIds.DSD_NULL);
    assertContext(CLS_NM, methodName, role, GlobalErrIds.ROLE_NULL);
    setEntitySession(CLS_NM, methodName, dsdSet);
    SDSet entity = sdP.read(dsdSet);
    entity.setContextId(this.contextId);
    entity.addMember(role.getName());
    setAdminData(CLS_NM, methodName, entity);
    SDSet dsdOut = sdP.update(entity);
    // remove any references to the old DSD from cache:
    clearDSDCache(dsdSet);
    return dsdOut;
}

Example 57 with SDSet

use of org.apache.directory.fortress.core.model.SDSet in project directory-fortress-core by apache.

the class ReviewMgrImpl method ssdRoleSetRoles.

/**
 * {@inheritDoc}
 */
@Override
@AdminPermissionOperation
public Set<String> ssdRoleSetRoles(SDSet ssd) throws SecurityException {
    String methodName = "ssdRoleSetRoles";
    assertContext(CLS_NM, methodName, ssd, GlobalErrIds.SSD_NULL);
    checkAccess(CLS_NM, methodName);
    ssd.setType(SDSet.SDType.STATIC);
    SDSet se = ssdP.read(ssd);
    return se.getMembers();
}

Example 58 with SDSet

use of org.apache.directory.fortress.core.model.SDSet in project directory-fortress-core by apache.

the class DSDChecker method validate.

/**
 * This method is called during entity activation, {@link org.apache.directory.fortress.core.util.VUtil#validateConstraints} and ensures the role does not violate dynamic separation of duty constraints.
 *
 * @param session    contains list of RBAC roles {@link org.apache.directory.fortress.core.model.UserRole} targeted for activation.
 * @param constraint required for Validator interface, not used here..
 * @param time       required for Validator interface, not used here.
 * @param type       required by interface, not used here.
 * @return '0' if validation succeeds else {@link org.apache.directory.fortress.core.GlobalErrIds#ACTV_FAILED_DSD} if failed.
 */
@Override
public int validate(Session session, Constraint constraint, Time time, VUtil.ConstraintType type) throws org.apache.directory.fortress.core.SecurityException {
    int rc = 0;
    int matchCount;
    // get all candidate activated roles user:
    List<UserRole> activeRoleList = session.getRoles();
    if (activeRoleList == null || activeRoleList.size() == 0) {
        return rc;
    }
    // Depending on if session is group or user session, fill objects
    String contextId = session.isGroupSession() ? session.getGroup().getContextId() : session.getUser().getContextId();
    String entityId = session.isGroupSession() ? session.getGroupName() : session.getUserId();
    String entityType = session.isGroupSession() ? "groupName" : "userId";
    // get the list of authorized roles for this user/group:
    Set<String> authorizedRoleSet = RoleUtil.getInstance().getInheritedRoles(activeRoleList, contextId);
    // only need to check DSD constraints if more than one role is being activated:
    if (authorizedRoleSet != null && authorizedRoleSet.size() > 1) {
        // get all DSD sets that contain the candidate activated and authorized roles,
        // If DSD cache is disabled, this will search the directory using authorizedRoleSet
        Set<SDSet> dsdSets = SDUtil.getInstance().getDsdCache(authorizedRoleSet, contextId);
        if (dsdSets != null && dsdSets.size() > 0) {
            for (SDSet dsd : dsdSets) {
                Iterator<UserRole> activatedRoles = activeRoleList.iterator();
                matchCount = 0;
                Set<String> map = dsd.getMembers();
                // now check the DSD on every role activation candidate contained within session object:
                while (activatedRoles.hasNext()) {
                    UserRole activatedRole = activatedRoles.next();
                    if (map.contains(activatedRole.getName())) {
                        matchCount++;
                        if (matchCount >= dsd.getCardinality()) {
                            activatedRoles.remove();
                            String warning = "validate " + entityType + " [" + entityId + "] failed activation of assignedRole [" + activatedRole.getName() + "] validates DSD Set Name:" + dsd.getName() + " Cardinality:" + dsd.getCardinality();
                            LOG.warn(warning);
                            rc = GlobalErrIds.ACTV_FAILED_DSD;
                            session.setWarning(new ObjectFactory().createWarning(rc, warning, Warning.Type.ROLE, activatedRole.getName()));
                        }
                    } else {
                        Set<String> parentSet = RoleUtil.getInstance().getAscendants(activatedRole.getName(), contextId);
                        // now check for every role inherited from this activated role:
                        for (String parentRole : parentSet) {
                            if (map.contains(parentRole)) {
                                matchCount++;
                                if (matchCount >= dsd.getCardinality()) {
                                    String warning = "validate " + entityType + " [" + entityId + "] assignedRole [" + activatedRole.getName() + "] parentRole [" + parentRole + "] validates DSD Set Name:" + dsd.getName() + " Cardinality:" + dsd.getCardinality();
                                    rc = GlobalErrIds.ACTV_FAILED_DSD;
                                    // remove the assigned role from session (not the authorized role):
                                    activatedRoles.remove();
                                    session.setWarning(new ObjectFactory().createWarning(rc, warning, Warning.Type.ROLE, activatedRole.getName()));
                                    LOG.warn(warning);
                                    // Breaking out of the loop because assigned role has been removed from session.
                                    break;
                                }
                            }
                        }
                    }
                }
            }
        }
    }
    return rc;
}