use of org.apache.syncope.core.persistence.api.entity.user.UMembership in project syncope by apache.
the class UserDataBinderImpl method create.
@Override
public void create(final User user, final UserTO userTO, final boolean storePassword) {
SyncopeClientCompositeException scce = SyncopeClientException.buildComposite();
// set username
user.setUsername(userTO.getUsername());
// set password
if (StringUtils.isBlank(userTO.getPassword()) || !storePassword) {
LOG.debug("Password was not provided or not required to be stored");
} else {
setPassword(user, userTO.getPassword(), scce);
}
user.setMustChangePassword(userTO.isMustChangePassword());
// security question / answer
if (userTO.getSecurityQuestion() != null) {
SecurityQuestion securityQuestion = securityQuestionDAO.find(userTO.getSecurityQuestion());
if (securityQuestion != null) {
user.setSecurityQuestion(securityQuestion);
}
}
user.setSecurityAnswer(userTO.getSecurityAnswer());
// roles
userTO.getRoles().forEach(roleKey -> {
Role role = roleDAO.find(roleKey);
if (role == null) {
LOG.warn("Ignoring unknown role with id {}", roleKey);
} else {
user.add(role);
}
});
// realm
Realm realm = realmDAO.findByFullPath(userTO.getRealm());
if (realm == null) {
SyncopeClientException noRealm = SyncopeClientException.build(ClientExceptionType.InvalidRealm);
noRealm.getElements().add("Invalid or null realm specified: " + userTO.getRealm());
scce.addException(noRealm);
}
user.setRealm(realm);
AnyUtils anyUtils = anyUtilsFactory.getInstance(AnyTypeKind.USER);
if (user.getRealm() != null) {
// relationships
userTO.getRelationships().forEach(relationshipTO -> {
AnyObject otherEnd = anyObjectDAO.find(relationshipTO.getOtherEndKey());
if (otherEnd == null) {
LOG.debug("Ignoring invalid anyObject " + relationshipTO.getOtherEndKey());
} else if (user.getRealm().getFullPath().startsWith(otherEnd.getRealm().getFullPath())) {
RelationshipType relationshipType = relationshipTypeDAO.find(relationshipTO.getType());
if (relationshipType == null) {
LOG.debug("Ignoring invalid relationship type {}", relationshipTO.getType());
} else {
URelationship relationship = entityFactory.newEntity(URelationship.class);
relationship.setType(relationshipType);
relationship.setRightEnd(otherEnd);
relationship.setLeftEnd(user);
user.add(relationship);
}
} else {
LOG.error("{} cannot be assigned to {}", otherEnd, user);
SyncopeClientException unassignabled = SyncopeClientException.build(ClientExceptionType.InvalidRelationship);
unassignabled.getElements().add("Cannot be assigned: " + otherEnd);
scce.addException(unassignabled);
}
});
// memberships
userTO.getMemberships().forEach(membershipTO -> {
Group group = membershipTO.getGroupKey() == null ? groupDAO.findByName(membershipTO.getGroupName()) : groupDAO.find(membershipTO.getGroupKey());
if (group == null) {
LOG.debug("Ignoring invalid group " + membershipTO.getGroupKey() + " / " + membershipTO.getGroupName());
} else if (user.getRealm().getFullPath().startsWith(group.getRealm().getFullPath())) {
UMembership membership = entityFactory.newEntity(UMembership.class);
membership.setRightEnd(group);
membership.setLeftEnd(user);
user.add(membership);
// membership attributes
fill(user, membership, membershipTO, anyUtils, scce);
} else {
LOG.error("{} cannot be assigned to {}", group, user);
SyncopeClientException unassignable = SyncopeClientException.build(ClientExceptionType.InvalidMembership);
unassignable.getElements().add("Cannot be assigned: " + group);
scce.addException(unassignable);
}
});
}
// attributes and resources
fill(user, userTO, anyUtils, scce);
// Throw composite exception if there is at least one element set in the composing exceptions
if (scce.hasExceptions()) {
throw scce;
}
}
use of org.apache.syncope.core.persistence.api.entity.user.UMembership in project syncope by apache.
the class UserDataBinderImpl method update.
@Override
public PropagationByResource update(final User toBeUpdated, final UserPatch userPatch) {
// Re-merge any pending change from workflow tasks
User user = userDAO.save(toBeUpdated);
PropagationByResource propByRes = new PropagationByResource();
SyncopeClientCompositeException scce = SyncopeClientException.buildComposite();
AnyUtils anyUtils = anyUtilsFactory.getInstance(AnyTypeKind.USER);
Collection<String> currentResources = userDAO.findAllResourceKeys(user.getKey());
// fetch connObjectKeys before update
Map<String, String> oldConnObjectKeys = getConnObjectKeys(user, anyUtils);
// realm
setRealm(user, userPatch);
// password
if (userPatch.getPassword() != null && StringUtils.isNotBlank(userPatch.getPassword().getValue())) {
if (userPatch.getPassword().isOnSyncope()) {
setPassword(user, userPatch.getPassword().getValue(), scce);
user.setChangePwdDate(new Date());
}
propByRes.addAll(ResourceOperation.UPDATE, userPatch.getPassword().getResources());
}
// username
if (userPatch.getUsername() != null && StringUtils.isNotBlank(userPatch.getUsername().getValue())) {
String oldUsername = user.getUsername();
user.setUsername(userPatch.getUsername().getValue());
if (oldUsername.equals(AuthContextUtils.getUsername())) {
AuthContextUtils.updateUsername(userPatch.getUsername().getValue());
}
AccessToken accessToken = accessTokenDAO.findByOwner(oldUsername);
if (accessToken != null) {
accessToken.setOwner(userPatch.getUsername().getValue());
accessTokenDAO.save(accessToken);
}
propByRes.addAll(ResourceOperation.UPDATE, currentResources);
}
// security question / answer:
if (userPatch.getSecurityQuestion() != null) {
if (userPatch.getSecurityQuestion().getValue() == null) {
user.setSecurityQuestion(null);
user.setSecurityAnswer(null);
} else {
SecurityQuestion securityQuestion = securityQuestionDAO.find(userPatch.getSecurityQuestion().getValue());
if (securityQuestion != null) {
user.setSecurityQuestion(securityQuestion);
user.setSecurityAnswer(userPatch.getSecurityAnswer().getValue());
}
}
}
if (userPatch.getMustChangePassword() != null) {
user.setMustChangePassword(userPatch.getMustChangePassword().getValue());
}
// roles
for (StringPatchItem patch : userPatch.getRoles()) {
Role role = roleDAO.find(patch.getValue());
if (role == null) {
LOG.warn("Ignoring unknown role with key {}", patch.getValue());
} else {
switch(patch.getOperation()) {
case ADD_REPLACE:
user.add(role);
break;
case DELETE:
default:
user.getRoles().remove(role);
}
}
}
// attributes and resources
propByRes.merge(fill(user, userPatch, anyUtils, scce));
// relationships
userPatch.getRelationships().stream().filter(patch -> patch.getRelationshipTO() != null).forEachOrdered((patch) -> {
RelationshipType relationshipType = relationshipTypeDAO.find(patch.getRelationshipTO().getType());
if (relationshipType == null) {
LOG.debug("Ignoring invalid relationship type {}", patch.getRelationshipTO().getType());
} else {
Optional<? extends URelationship> relationship = user.getRelationship(relationshipType, patch.getRelationshipTO().getOtherEndKey());
if (relationship.isPresent()) {
user.getRelationships().remove(relationship.get());
relationship.get().setLeftEnd(null);
}
if (patch.getOperation() == PatchOperation.ADD_REPLACE) {
AnyObject otherEnd = anyObjectDAO.find(patch.getRelationshipTO().getOtherEndKey());
if (otherEnd == null) {
LOG.debug("Ignoring invalid any object {}", patch.getRelationshipTO().getOtherEndKey());
} else if (user.getRealm().getFullPath().startsWith(otherEnd.getRealm().getFullPath())) {
URelationship newRelationship = entityFactory.newEntity(URelationship.class);
newRelationship.setType(relationshipType);
newRelationship.setRightEnd(otherEnd);
newRelationship.setLeftEnd(user);
user.add(newRelationship);
} else {
LOG.error("{} cannot be assigned to {}", otherEnd, user);
SyncopeClientException unassignable = SyncopeClientException.build(ClientExceptionType.InvalidRelationship);
unassignable.getElements().add("Cannot be assigned: " + otherEnd);
scce.addException(unassignable);
}
}
}
});
// prepare for membership-related resource management
Collection<ExternalResource> resources = userDAO.findAllResources(user);
Map<String, Set<String>> reasons = new HashMap<>();
user.getResources().forEach(resource -> {
reasons.put(resource.getKey(), new HashSet<>(Collections.singleton(user.getKey())));
});
userDAO.findAllGroupKeys(user).forEach(group -> {
groupDAO.findAllResourceKeys(group).forEach(resource -> {
if (!reasons.containsKey(resource)) {
reasons.put(resource, new HashSet<>());
}
reasons.get(resource).add(group);
});
});
Set<String> toBeDeprovisioned = new HashSet<>();
Set<String> toBeProvisioned = new HashSet<>();
SyncopeClientException invalidValues = SyncopeClientException.build(ClientExceptionType.InvalidValues);
// memberships
userPatch.getMemberships().stream().filter(membPatch -> membPatch.getGroup() != null).forEachOrdered((membPatch) -> {
Optional<? extends UMembership> membership = user.getMembership(membPatch.getGroup());
if (membership.isPresent()) {
user.getMemberships().remove(membership.get());
membership.get().setLeftEnd(null);
user.getPlainAttrs(membership.get()).forEach(attr -> {
user.remove(attr);
attr.setOwner(null);
attr.setMembership(null);
});
if (membPatch.getOperation() == PatchOperation.DELETE) {
groupDAO.findAllResourceKeys(membership.get().getRightEnd().getKey()).stream().filter(resource -> reasons.containsKey(resource)).forEach(resource -> {
reasons.get(resource).remove(membership.get().getRightEnd().getKey());
toBeProvisioned.add(resource);
});
}
}
if (membPatch.getOperation() == PatchOperation.ADD_REPLACE) {
Group group = groupDAO.find(membPatch.getGroup());
if (group == null) {
LOG.debug("Ignoring invalid group {}", membPatch.getGroup());
} else if (user.getRealm().getFullPath().startsWith(group.getRealm().getFullPath())) {
UMembership newMembership = entityFactory.newEntity(UMembership.class);
newMembership.setRightEnd(group);
newMembership.setLeftEnd(user);
user.add(newMembership);
membPatch.getPlainAttrs().forEach(attrTO -> {
PlainSchema schema = getPlainSchema(attrTO.getSchema());
if (schema == null) {
LOG.debug("Invalid " + PlainSchema.class.getSimpleName() + "{}, ignoring...", attrTO.getSchema());
} else {
UPlainAttr attr = user.getPlainAttr(schema.getKey(), newMembership).orElse(null);
if (attr == null) {
LOG.debug("No plain attribute found for {} and membership of {}", schema, newMembership.getRightEnd());
attr = anyUtils.newPlainAttr();
attr.setOwner(user);
attr.setMembership(newMembership);
attr.setSchema(schema);
user.add(attr);
AttrPatch patch = new AttrPatch.Builder().attrTO(attrTO).build();
processAttrPatch(user, patch, schema, attr, anyUtils, resources, propByRes, invalidValues);
}
}
});
if (!invalidValues.isEmpty()) {
scce.addException(invalidValues);
}
toBeProvisioned.addAll(groupDAO.findAllResourceKeys(group.getKey()));
// ensure that they are counted for password propagation
if (toBeUpdated.canDecodePassword()) {
if (userPatch.getPassword() == null) {
userPatch.setPassword(new PasswordPatch());
}
group.getResources().stream().filter(resource -> isPasswordMapped(resource)).forEachOrdered(resource -> {
userPatch.getPassword().getResources().add(resource.getKey());
});
}
} else {
LOG.error("{} cannot be assigned to {}", group, user);
SyncopeClientException unassignabled = SyncopeClientException.build(ClientExceptionType.InvalidMembership);
unassignabled.getElements().add("Cannot be assigned: " + group);
scce.addException(unassignabled);
}
}
});
// finalize resource management
reasons.entrySet().stream().filter(entry -> entry.getValue().isEmpty()).forEach(entry -> toBeDeprovisioned.add(entry.getKey()));
propByRes.addAll(ResourceOperation.DELETE, toBeDeprovisioned);
propByRes.addAll(ResourceOperation.UPDATE, toBeProvisioned);
// attribute values.
if (!toBeDeprovisioned.isEmpty() || !toBeProvisioned.isEmpty()) {
currentResources.removeAll(toBeDeprovisioned);
propByRes.addAll(ResourceOperation.UPDATE, currentResources);
}
// check if some connObjectKey was changed by the update above
Map<String, String> newcCnnObjectKeys = getConnObjectKeys(user, anyUtils);
oldConnObjectKeys.entrySet().stream().filter(entry -> newcCnnObjectKeys.containsKey(entry.getKey()) && !entry.getValue().equals(newcCnnObjectKeys.get(entry.getKey()))).forEach(entry -> {
propByRes.addOldConnObjectKey(entry.getKey(), entry.getValue());
propByRes.add(ResourceOperation.UPDATE, entry.getKey());
});
Pair<Set<String>, Set<String>> dynGroupMembs = userDAO.saveAndGetDynGroupMembs(user);
// finally check if any resource assignment is to be processed due to dynamic group membership change
dynGroupMembs.getLeft().stream().filter(group -> !dynGroupMembs.getRight().contains(group)).forEach(delete -> {
groupDAO.find(delete).getResources().stream().filter(resource -> !propByRes.contains(resource.getKey())).forEach(resource -> {
propByRes.add(ResourceOperation.DELETE, resource.getKey());
});
});
dynGroupMembs.getLeft().stream().filter(group -> dynGroupMembs.getRight().contains(group)).forEach(update -> {
groupDAO.find(update).getResources().stream().filter(resource -> !propByRes.contains(resource.getKey())).forEach(resource -> {
propByRes.add(ResourceOperation.UPDATE, resource.getKey());
});
});
dynGroupMembs.getRight().stream().filter(group -> !dynGroupMembs.getLeft().contains(group)).forEach(create -> {
groupDAO.find(create).getResources().stream().filter(resource -> !propByRes.contains(resource.getKey())).forEach(resource -> {
propByRes.add(ResourceOperation.CREATE, resource.getKey());
});
});
// Throw composite exception if there is at least one element set in the composing exceptions
if (scce.hasExceptions()) {
throw scce;
}
return propByRes;
}
use of org.apache.syncope.core.persistence.api.entity.user.UMembership in project syncope by apache.
the class UserReportlet method doExtract.
private void doExtract(final ContentHandler handler, final List<User> users) throws SAXException {
AttributesImpl atts = new AttributesImpl();
for (User user : users) {
atts.clear();
for (Feature feature : conf.getFeatures()) {
String type = null;
String value = null;
switch(feature) {
case key:
type = ReportXMLConst.XSD_STRING;
value = user.getKey();
break;
case username:
type = ReportXMLConst.XSD_STRING;
value = user.getUsername();
break;
case workflowId:
type = ReportXMLConst.XSD_STRING;
value = user.getWorkflowId();
break;
case status:
type = ReportXMLConst.XSD_STRING;
value = user.getStatus();
break;
case creationDate:
type = ReportXMLConst.XSD_DATETIME;
value = user.getCreationDate() == null ? "" : FormatUtils.format(user.getCreationDate());
break;
case lastLoginDate:
type = ReportXMLConst.XSD_DATETIME;
value = user.getLastLoginDate() == null ? "" : FormatUtils.format(user.getLastLoginDate());
break;
case changePwdDate:
type = ReportXMLConst.XSD_DATETIME;
value = user.getChangePwdDate() == null ? "" : FormatUtils.format(user.getChangePwdDate());
break;
case passwordHistorySize:
type = ReportXMLConst.XSD_INT;
value = String.valueOf(user.getPasswordHistory().size());
break;
case failedLoginCount:
type = ReportXMLConst.XSD_INT;
value = String.valueOf(user.getFailedLogins());
break;
default:
}
if (type != null && value != null) {
atts.addAttribute("", "", feature.name(), type, value);
}
}
handler.startElement("", "", "user", atts);
// Using UserTO for attribute values, since the conversion logic of
// values to String is already encapsulated there
UserTO userTO = userDataBinder.getUserTO(user, true);
doExtractAttributes(handler, userTO, conf.getPlainAttrs(), conf.getDerAttrs(), conf.getVirAttrs());
if (conf.getFeatures().contains(Feature.relationships)) {
handler.startElement("", "", "relationships", null);
for (RelationshipTO rel : userTO.getRelationships()) {
atts.clear();
atts.addAttribute("", "", "anyObjectKey", ReportXMLConst.XSD_STRING, rel.getOtherEndKey());
handler.startElement("", "", "relationship", atts);
if (conf.getFeatures().contains(Feature.resources)) {
for (URelationship actualRel : user.getRelationships(rel.getOtherEndKey())) {
doExtractResources(handler, anyObjectDataBinder.getAnyObjectTO(actualRel.getRightEnd(), true));
}
}
handler.endElement("", "", "relationship");
}
handler.endElement("", "", "relationships");
}
if (conf.getFeatures().contains(Feature.memberships)) {
handler.startElement("", "", "memberships", null);
for (MembershipTO memb : userTO.getMemberships()) {
atts.clear();
atts.addAttribute("", "", "groupKey", ReportXMLConst.XSD_STRING, memb.getGroupKey());
atts.addAttribute("", "", "groupName", ReportXMLConst.XSD_STRING, memb.getGroupName());
handler.startElement("", "", "membership", atts);
if (conf.getFeatures().contains(Feature.resources)) {
UMembership actualMemb = user.getMembership(memb.getGroupKey()).orElse(null);
if (actualMemb == null) {
LOG.warn("Unexpected: cannot find membership for group {} for user {}", memb.getGroupKey(), user);
} else {
doExtractResources(handler, groupDataBinder.getGroupTO(actualMemb.getRightEnd(), true));
}
}
handler.endElement("", "", "membership");
}
handler.endElement("", "", "memberships");
}
if (conf.getFeatures().contains(Feature.resources)) {
doExtractResources(handler, userTO);
}
handler.endElement("", "", "user");
}
}
use of org.apache.syncope.core.persistence.api.entity.user.UMembership in project syncope by apache.
the class UserTest method membershipWithAttrs.
@Test
public void membershipWithAttrs() {
User user = userDAO.findByUsername("vivaldi");
assertNotNull(user);
assertTrue(user.getMemberships().isEmpty());
// add 'obscure' to user (no membership): works because 'obscure' is from 'other', default class for USER
UPlainAttr attr = entityFactory.newEntity(UPlainAttr.class);
attr.setOwner(user);
attr.setSchema(plainSchemaDAO.find("obscure"));
attr.add("testvalue", anyUtilsFactory.getInstance(AnyTypeKind.USER));
user.add(attr);
// add 'obscure' to user (via 'artDirector' membership): does not work because 'obscure' is from 'other'
// but 'artDirector' defines no type extension
UMembership membership = entityFactory.newEntity(UMembership.class);
membership.setLeftEnd(user);
membership.setRightEnd(groupDAO.findByName("artDirector"));
user.add(membership);
attr = entityFactory.newEntity(UPlainAttr.class);
attr.setOwner(user);
attr.setMembership(membership);
attr.setSchema(plainSchemaDAO.find("obscure"));
attr.add("testvalue2", anyUtilsFactory.getInstance(AnyTypeKind.USER));
user.add(attr);
try {
userDAO.save(user);
fail("This should not happen");
} catch (InvalidEntityException e) {
assertNotNull(e);
}
// replace 'artDirector' with 'additional', which defines type extension with class 'other' and 'csv':
// now it works
membership = user.getMembership(groupDAO.findByName("artDirector").getKey()).get();
user.remove(user.getPlainAttr("obscure", membership).get());
user.getMemberships().remove(membership);
membership.setLeftEnd(null);
membership = entityFactory.newEntity(UMembership.class);
membership.setLeftEnd(user);
membership.setRightEnd(groupDAO.findByName("additional"));
user.add(membership);
attr = entityFactory.newEntity(UPlainAttr.class);
attr.setOwner(user);
attr.setMembership(membership);
attr.setSchema(plainSchemaDAO.find("obscure"));
attr.add("testvalue2", anyUtilsFactory.getInstance(AnyTypeKind.USER));
user.add(attr);
userDAO.save(user);
userDAO.flush();
user = userDAO.findByUsername("vivaldi");
assertEquals(1, user.getMemberships().size());
final UMembership newM = user.getMembership(groupDAO.findByName("additional").getKey()).get();
assertEquals(1, user.getPlainAttrs(newM).size());
assertNull(user.getPlainAttr("obscure").get().getMembership());
assertEquals(2, user.getPlainAttrs("obscure").size());
assertTrue(user.getPlainAttrs("obscure").contains(user.getPlainAttr("obscure").get()));
assertTrue(user.getPlainAttrs("obscure").stream().anyMatch(plainAttr -> plainAttr.getMembership() == null));
assertTrue(user.getPlainAttrs("obscure").stream().anyMatch(plainAttr -> newM.equals(plainAttr.getMembership())));
}
use of org.apache.syncope.core.persistence.api.entity.user.UMembership in project syncope by apache.
the class GroupReportlet method doExtract.
private void doExtract(final ContentHandler handler, final List<Group> groups) throws SAXException {
AttributesImpl atts = new AttributesImpl();
for (Group group : groups) {
atts.clear();
for (Feature feature : conf.getFeatures()) {
String type = null;
String value = null;
switch(feature) {
case key:
type = ReportXMLConst.XSD_STRING;
value = group.getKey();
break;
case name:
type = ReportXMLConst.XSD_STRING;
value = String.valueOf(group.getName());
break;
case groupOwner:
type = ReportXMLConst.XSD_STRING;
value = group.getGroupOwner().getKey();
break;
case userOwner:
type = ReportXMLConst.XSD_STRING;
value = group.getUserOwner().getKey();
break;
default:
}
if (type != null && value != null) {
atts.addAttribute("", "", feature.name(), type, value);
}
}
handler.startElement("", "", "group", atts);
// Using GroupTO for attribute values, since the conversion logic of
// values to String is already encapsulated there
GroupTO groupTO = groupDataBinder.getGroupTO(group, true);
doExtractAttributes(handler, groupTO, conf.getPlainAttrs(), conf.getDerAttrs(), conf.getVirAttrs());
// to get resources associated to a group
if (conf.getFeatures().contains(Feature.resources)) {
doExtractResources(handler, groupTO);
}
// to get users asscoiated to a group is preferred GroupDAO to GroupTO
if (conf.getFeatures().contains(Feature.users)) {
handler.startElement("", "", "users", null);
for (UMembership memb : groupDAO.findUMemberships(group)) {
atts.clear();
atts.addAttribute("", "", "key", ReportXMLConst.XSD_STRING, memb.getLeftEnd().getKey());
atts.addAttribute("", "", "username", ReportXMLConst.XSD_STRING, String.valueOf(memb.getLeftEnd().getUsername()));
handler.startElement("", "", "user", atts);
handler.endElement("", "", "user");
}
handler.endElement("", "", "users");
}
handler.endElement("", "", "group");
}
}
Aggregations