Examples with SecurityGroup org.olat.basesecurity.SecurityGroup used on opensource projects

Example 1 with SecurityGroup

use of org.olat.basesecurity.SecurityGroup in project OpenOLAT by OpenOLAT.

the class UserBulkChangeManager method changeSelectedIdentities.

public void changeSelectedIdentities(List<Identity> selIdentities, Map<String, String> attributeChangeMap, Map<String, String> roleChangeMap, List<String> notUpdatedIdentities, boolean isAdministrativeUser, List<Long> ownGroups, List<Long> partGroups, Translator trans, Identity addingIdentity) {
    Translator transWithFallback = userManager.getPropertyHandlerTranslator(trans);
    String usageIdentifyer = UserBulkChangeStep00.class.getCanonicalName();
    notUpdatedIdentities.clear();
    List<Identity> changedIdentities = new ArrayList<>();
    List<UserPropertyHandler> userPropertyHandlers = userManager.getUserPropertyHandlersFor(usageIdentifyer, isAdministrativeUser);
    String[] securityGroups = { Constants.GROUP_USERMANAGERS, Constants.GROUP_GROUPMANAGERS, Constants.GROUP_AUTHORS, Constants.GROUP_ADMIN, Constants.GROUP_POOL_MANAGER, Constants.GROUP_INST_ORES_MANAGER };
    // loop over users to be edited:
    for (Identity identity : selIdentities) {
        // reload identity from cache, to prevent stale object
        identity = securityManager.loadIdentityByKey(identity.getKey());
        User user = identity.getUser();
        String oldEmail = user.getEmail();
        String errorDesc = "";
        boolean updateError = false;
        // change pwd
        if (attributeChangeMap.containsKey(PWD_IDENTIFYER)) {
            String newPwd = attributeChangeMap.get(PWD_IDENTIFYER);
            if (StringHelper.containsNonWhitespace(newPwd)) {
                if (!userManager.syntaxCheckOlatPassword(newPwd)) {
                    errorDesc = transWithFallback.translate("error.password");
                    updateError = true;
                }
            } else {
                newPwd = null;
            }
            olatAuthManager.changePasswordAsAdmin(identity, newPwd);
        }
        // set language
        String userLanguage = user.getPreferences().getLanguage();
        if (attributeChangeMap.containsKey(LANG_IDENTIFYER)) {
            String inputLanguage = attributeChangeMap.get(LANG_IDENTIFYER);
            if (!userLanguage.equals(inputLanguage)) {
                Preferences preferences = user.getPreferences();
                preferences.setLanguage(inputLanguage);
                user.setPreferences(preferences);
            }
        }
        Context vcContext = new VelocityContext();
        // set all properties as context
        setUserContext(identity, vcContext);
        // org.olat.admin.user.bulkChange.UserBulkChangeStep00
        for (int k = 0; k < userPropertyHandlers.size(); k++) {
            UserPropertyHandler propHandler = userPropertyHandlers.get(k);
            String propertyName = propHandler.getName();
            String userValue = identity.getUser().getProperty(propertyName, null);
            String inputFieldValue = "";
            if (attributeChangeMap.containsKey(propertyName)) {
                inputFieldValue = attributeChangeMap.get(propertyName);
                inputFieldValue = inputFieldValue.replace("$", "$!");
                String evaluatedInputFieldValue = evaluateValueWithUserContext(inputFieldValue, vcContext);
                // validate evaluated property-value
                ValidationError validationError = new ValidationError();
                // do validation checks with users current locale!
                Locale locale = transWithFallback.getLocale();
                if (!propHandler.isValidValue(identity.getUser(), evaluatedInputFieldValue, validationError, locale)) {
                    errorDesc = transWithFallback.translate(validationError.getErrorKey(), validationError.getArgs()) + " (" + evaluatedInputFieldValue + ")";
                    updateError = true;
                    break;
                }
                if (!evaluatedInputFieldValue.equals(userValue)) {
                    String stringValue = propHandler.getStringValue(evaluatedInputFieldValue, locale);
                    propHandler.setUserProperty(user, stringValue);
                }
            }
        }
        // loop over securityGroups defined above
        for (String securityGroup : securityGroups) {
            SecurityGroup secGroup = securityManager.findSecurityGroupByName(securityGroup);
            Boolean isInGroup = securityManager.isIdentityInSecurityGroup(identity, secGroup);
            String thisRoleAction = "";
            if (roleChangeMap.containsKey(securityGroup)) {
                thisRoleAction = roleChangeMap.get(securityGroup);
                // user not anymore in security group, remove him
                if (isInGroup && thisRoleAction.equals("remove")) {
                    securityManager.removeIdentityFromSecurityGroup(identity, secGroup);
                    log.audit("User::" + addingIdentity.getName() + " removed system role::" + securityGroup + " from user::" + identity.getName(), null);
                }
                // user not yet in security group, add him
                if (!isInGroup && thisRoleAction.equals("add")) {
                    securityManager.addIdentityToSecurityGroup(identity, secGroup);
                    log.audit("User::" + addingIdentity.getName() + " added system role::" + securityGroup + " to user::" + identity.getName(), null);
                }
            }
        }
        // set status
        if (roleChangeMap.containsKey("Status")) {
            Integer status = Integer.parseInt(roleChangeMap.get("Status"));
            int oldStatus = identity.getStatus();
            String oldStatusText = (oldStatus == Identity.STATUS_PERMANENT ? "permanent" : (oldStatus == Identity.STATUS_ACTIV ? "active" : (oldStatus == Identity.STATUS_LOGIN_DENIED ? "login_denied" : (oldStatus == Identity.STATUS_DELETED ? "deleted" : "unknown"))));
            String newStatusText = (status == Identity.STATUS_PERMANENT ? "permanent" : (status == Identity.STATUS_ACTIV ? "active" : (status == Identity.STATUS_LOGIN_DENIED ? "login_denied" : (status == Identity.STATUS_DELETED ? "deleted" : "unknown"))));
            if (oldStatus != status && status == Identity.STATUS_LOGIN_DENIED && Boolean.parseBoolean(roleChangeMap.get("sendLoginDeniedEmail"))) {
                sendLoginDeniedEmail(identity);
            }
            identity = securityManager.saveIdentityStatus(identity, status);
            log.audit("User::" + addingIdentity.getName() + " changed accout status for user::" + identity.getName() + " from::" + oldStatusText + " to::" + newStatusText, null);
        }
        // persist changes:
        if (updateError) {
            String errorOutput = identity.getName() + ": " + errorDesc;
            log.debug("error during bulkChange of users, following user could not be updated: " + errorOutput);
            notUpdatedIdentities.add(errorOutput);
        } else {
            userManager.updateUserFromIdentity(identity);
            securityManager.deleteInvalidAuthenticationsByEmail(oldEmail);
            changedIdentities.add(identity);
            log.audit("User::" + addingIdentity.getName() + " successfully changed account data for user::" + identity.getName() + " in bulk change", null);
        }
        // commit changes for this user
        dbInstance.commit();
    }
    // FXOLAT-101: add identity to new groups:
    if (ownGroups.size() != 0 || partGroups.size() != 0) {
        List<BusinessGroupMembershipChange> changes = new ArrayList<BusinessGroupMembershipChange>();
        for (Identity selIdentity : selIdentities) {
            if (ownGroups != null && !ownGroups.isEmpty()) {
                for (Long tutorGroupKey : ownGroups) {
                    BusinessGroupMembershipChange change = new BusinessGroupMembershipChange(selIdentity, tutorGroupKey);
                    change.setTutor(Boolean.TRUE);
                    changes.add(change);
                }
            }
            if (partGroups != null && !partGroups.isEmpty()) {
                for (Long partGroupKey : partGroups) {
                    BusinessGroupMembershipChange change = new BusinessGroupMembershipChange(selIdentity, partGroupKey);
                    change.setParticipant(Boolean.TRUE);
                    changes.add(change);
                }
            }
        }
        MailPackage mailing = new MailPackage();
        businessGroupService.updateMemberships(addingIdentity, changes, mailing);
        dbInstance.commit();
    }
}

Example 2 with SecurityGroup

use of org.olat.basesecurity.SecurityGroup in project OpenOLAT by OpenOLAT.

the class UserDeletionManager method deleteIdentity.

/**
 * Delete all user-data in registered deleteable resources.
 * @param identity
 * @return true
 */
public void deleteIdentity(Identity identity) {
    logInfo("Start deleteIdentity for identity=" + identity);
    String newName = getBackupStringWithDate(identity.getName());
    logInfo("Start Deleting user=" + identity);
    File archiveFilePath = getArchivFilePath(identity);
    Map<String, UserDataDeletable> userDataDeletableResourcesMap = CoreSpringFactory.getBeansOfType(UserDataDeletable.class);
    List<UserDataDeletable> userDataDeletableResources = new ArrayList<>(userDataDeletableResourcesMap.values());
    Collections.sort(userDataDeletableResources, new UserDataDeletableComparator());
    for (UserDataDeletable element : userDataDeletableResources) {
        logInfo("UserDataDeletable-Loop element=" + element);
        element.deleteUserData(identity, newName, archiveFilePath);
    }
    // Delete all authentications for certain identity
    List<Authentication> authentications = securityManager.getAuthentications(identity);
    for (Authentication auth : authentications) {
        logInfo("deleteAuthentication auth=" + auth);
        securityManager.deleteAuthentication(auth);
        logDebug("Delete auth=" + auth + "  of identity=" + identity);
    }
    // remove identity from its security groups
    List<SecurityGroup> securityGroups = securityManager.getSecurityGroupsForIdentity(identity);
    for (SecurityGroup secGroup : securityGroups) {
        securityManager.removeIdentityFromSecurityGroup(identity, secGroup);
        logInfo("Removing user=" + identity + " from security group=" + secGroup.toString());
    }
    // remove identity from groups
    groupDao.removeMemberships(identity);
    String key = identity.getUser().getProperty("emchangeKey", null);
    TemporaryKey tempKey = registrationManager.loadTemporaryKeyByRegistrationKey(key);
    if (tempKey != null) {
        registrationManager.deleteTemporaryKey(tempKey);
    }
    identity = securityManager.loadIdentityByKey(identity.getKey());
    // keep login-name only -> change email
    User persistedUser = identity.getUser();
    List<UserPropertyHandler> userPropertyHandlers = UserManager.getInstance().getAllUserPropertyHandlers();
    for (UserPropertyHandler userPropertyHandler : userPropertyHandlers) {
        String actualProperty = userPropertyHandler.getName();
        if (userPropertyHandler.isDeletable() && !(keepUserEmailAfterDeletion && UserConstants.EMAIL.equals(actualProperty))) {
            persistedUser.setProperty(actualProperty, null);
        }
        if ((!keepUserEmailAfterDeletion && UserConstants.EMAIL.equals(actualProperty))) {
            String oldEmail = userPropertyHandler.getUserProperty(persistedUser, null);
            String newEmail = "";
            if (StringHelper.containsNonWhitespace(oldEmail)) {
                newEmail = getBackupStringWithDate(oldEmail);
            }
            logInfo("Update user-property user=" + persistedUser);
            userPropertyHandler.setUserProperty(persistedUser, newEmail);
        }
    }
    UserManager.getInstance().updateUserFromIdentity(identity);
    logInfo("deleteUserProperties user=" + persistedUser);
    dbInstance.commit();
    identity = securityManager.loadIdentityByKey(identity.getKey());
    // keep email only -> change login-name
    if (!keepUserEmailAfterDeletion) {
        identity = securityManager.saveIdentityName(identity, newName, null);
    }
    // keep everything, change identity.status to deleted
    logInfo("Change stater identity=" + identity);
    identity = securityManager.saveIdentityStatus(identity, Identity.STATUS_DELETED);
    LifeCycleManager.createInstanceFor(identity).deleteTimestampFor(SEND_DELETE_EMAIL_ACTION);
    LifeCycleManager.createInstanceFor(identity).markTimestampFor(USER_DELETED_ACTION, createLifeCycleLogDataFor(identity));
    logAudit("User-Deletion: Delete all userdata for identity=" + identity);
}

Example 3 with SecurityGroup

use of org.olat.basesecurity.SecurityGroup in project OpenOLAT by OpenOLAT.

the class UserAdminController method allowedToManageUser.

/**
 * Check if user allowed to modify this identity. Only modification of user
 * that have lower rights is allowed. No one exept admins can manage usermanager
 * and admins
 * @param ureq
 * @param identity
 * @return boolean
 */
private boolean allowedToManageUser(UserRequest ureq, Identity identity) {
    // prevent editing of users that are in frentix-superadmin group (except "frentix" wants to change own profile)
    Identity editor = ureq.getUserSession().getIdentity();
    SecurityGroup frentixSuperAdminGroup = securityManager.findSecurityGroupByName("fxadmins");
    if (securityManager.isIdentityInSecurityGroup(identity, frentixSuperAdminGroup)) {
        if (editor.equals(identity) || securityManager.isIdentityInSecurityGroup(editor, frentixSuperAdminGroup)) {
            return true;
        }
        return false;
    }
    if (isOlatAdmin) {
        return true;
    }
    // only admins can administrate admin and usermanager users
    boolean isAdmin = securityManager.isIdentityPermittedOnResourceable(identity, Constants.PERMISSION_HASROLE, Constants.ORESOURCE_ADMIN);
    boolean isUserManager = securityManager.isIdentityPermittedOnResourceable(identity, Constants.PERMISSION_HASROLE, Constants.ORESOURCE_USERMANAGER);
    if (isAdmin || isUserManager) {
        return false;
    }
    // if user is author ony allowed to edit if configured
    boolean isAuthor = securityManager.isIdentityPermittedOnResourceable(identity, Constants.PERMISSION_HASROLE, Constants.ORESOURCE_AUTHOR);
    Boolean canManageAuthor = BaseSecurityModule.USERMANAGER_CAN_MANAGE_AUTHORS;
    if (isAuthor && !canManageAuthor.booleanValue()) {
        return false;
    }
    // if user is groupmanager ony allowed to edit if configured
    boolean isGroupManager = securityManager.isIdentityPermittedOnResourceable(identity, Constants.PERMISSION_HASROLE, Constants.ORESOURCE_GROUPMANAGER);
    Boolean canManageGroupmanager = BaseSecurityModule.USERMANAGER_CAN_MANAGE_GROUPMANAGERS;
    if (isGroupManager && !canManageGroupmanager.booleanValue()) {
        return false;
    }
    // if user is guest ony allowed to edit if configured
    boolean isGuestOnly = securityManager.isIdentityPermittedOnResourceable(identity, Constants.PERMISSION_HASROLE, Constants.ORESOURCE_GUESTONLY);
    Boolean canManageGuest = BaseSecurityModule.USERMANAGER_CAN_MANAGE_GUESTS;
    if (isGuestOnly && !canManageGuest.booleanValue()) {
        return false;
    }
    // passed all tests, current user is allowed to edit given identity
    return true;
}

Example 4 with SecurityGroup

use of org.olat.basesecurity.SecurityGroup in project OpenOLAT by OpenOLAT.

the class SystemRolesAndRightsController method saveFormData.

/**
 * Persist form data in database. User needs to logout / login to activate changes. A bit tricky here
 * is that only form elements should be gettet that the user is allowed to manipulate. See also the
 * comments in SystemRolesAndRightsForm.
 * @param myIdentity
 * @param form
 */
private void saveFormData(UserRequest ureq, Identity myIdentity, SystemRolesAndRightsForm form) {
    UserSession usess = ureq.getUserSession();
    boolean iAmOlatAdmin = usess.getRoles().isOLATAdmin();
    boolean iAmUserManager = usess.getRoles().isUserManager();
    // 1) general user type - anonymous or user
    // anonymous users
    boolean isAnonymous = false;
    Boolean canGuestsByConfig = BaseSecurityModule.USERMANAGER_CAN_MANAGE_GUESTS;
    if (canGuestsByConfig.booleanValue() || iAmOlatAdmin) {
        SecurityGroup anonymousGroup = securityManager.findSecurityGroupByName(Constants.GROUP_ANONYMOUS);
        boolean hasBeenAnonymous = securityManager.isIdentityInSecurityGroup(myIdentity, anonymousGroup);
        isAnonymous = form.isAnonymous();
        updateSecurityGroup(myIdentity, securityManager, anonymousGroup, hasBeenAnonymous, isAnonymous, Constants.GROUP_ANONYMOUS);
        // system users - oposite of anonymous users
        SecurityGroup usersGroup = securityManager.findSecurityGroupByName(Constants.GROUP_OLATUSERS);
        boolean hasBeenUser = securityManager.isIdentityInSecurityGroup(myIdentity, usersGroup);
        boolean isUser = !form.isAnonymous();
        updateSecurityGroup(myIdentity, securityManager, usersGroup, hasBeenUser, isUser, Constants.GROUP_OLATUSERS);
    }
    // 2) system roles
    // group manager
    Boolean canGroupmanagerByConfig = BaseSecurityModule.USERMANAGER_CAN_MANAGE_GROUPMANAGERS;
    if (canGroupmanagerByConfig.booleanValue() || iAmOlatAdmin) {
        SecurityGroup groupManagerGroup = securityManager.findSecurityGroupByName(Constants.GROUP_GROUPMANAGERS);
        boolean hasBeenGroupManager = securityManager.isIdentityInSecurityGroup(myIdentity, groupManagerGroup);
        boolean isGroupManager = form.isGroupmanager();
        updateSecurityGroup(myIdentity, securityManager, groupManagerGroup, hasBeenGroupManager, isGroupManager, Constants.GROUP_GROUPMANAGERS);
    }
    // pool manager
    Boolean canPoolmanagerByConfig = BaseSecurityModule.USERMANAGER_CAN_MANAGE_POOLMANAGERS;
    if (canPoolmanagerByConfig.booleanValue() || iAmOlatAdmin) {
        SecurityGroup poolManagerGroup = securityManager.findSecurityGroupByName(Constants.GROUP_POOL_MANAGER);
        boolean hasBeenPoolManager = securityManager.isIdentityInSecurityGroup(myIdentity, poolManagerGroup);
        boolean isPoolManager = form.isPoolmanager();
        updateSecurityGroup(myIdentity, securityManager, poolManagerGroup, hasBeenPoolManager, isPoolManager, Constants.GROUP_AUTHORS);
    }
    // author
    Boolean canAuthorByConfig = BaseSecurityModule.USERMANAGER_CAN_MANAGE_AUTHORS;
    if (canAuthorByConfig.booleanValue() || iAmOlatAdmin) {
        SecurityGroup authorGroup = securityManager.findSecurityGroupByName(Constants.GROUP_AUTHORS);
        boolean hasBeenAuthor = securityManager.isIdentityInSecurityGroup(myIdentity, authorGroup);
        boolean isAuthor = form.isAuthor() || form.isInstitutionalResourceManager();
        updateSecurityGroup(myIdentity, securityManager, authorGroup, hasBeenAuthor, isAuthor, Constants.GROUP_AUTHORS);
    }
    // user manager, only allowed by admin
    if (iAmOlatAdmin) {
        SecurityGroup userManagerGroup = securityManager.findSecurityGroupByName(Constants.GROUP_USERMANAGERS);
        boolean hasBeenUserManager = securityManager.isIdentityInSecurityGroup(myIdentity, userManagerGroup);
        boolean isUserManager = form.isUsermanager();
        updateSecurityGroup(myIdentity, securityManager, userManagerGroup, hasBeenUserManager, isUserManager, Constants.GROUP_USERMANAGERS);
    }
    // institutional resource manager, only allowed by admin
    if (iAmUserManager || iAmOlatAdmin) {
        SecurityGroup institutionalResourceManagerGroup = securityManager.findSecurityGroupByName(Constants.GROUP_INST_ORES_MANAGER);
        boolean hasBeenInstitutionalResourceManager = securityManager.isIdentityInSecurityGroup(myIdentity, institutionalResourceManagerGroup);
        boolean isInstitutionalResourceManager = form.isInstitutionalResourceManager();
        updateSecurityGroup(myIdentity, securityManager, institutionalResourceManagerGroup, hasBeenInstitutionalResourceManager, isInstitutionalResourceManager, Constants.GROUP_INST_ORES_MANAGER);
    }
    // system administrator, only allowed by admin
    if (iAmOlatAdmin) {
        SecurityGroup adminGroup = securityManager.findSecurityGroupByName(Constants.GROUP_ADMIN);
        boolean hasBeenAdmin = securityManager.isIdentityInSecurityGroup(myIdentity, adminGroup);
        boolean isAdmin = form.isAdmin();
        updateSecurityGroup(myIdentity, securityManager, adminGroup, hasBeenAdmin, isAdmin, Constants.GROUP_ADMIN);
    }
    Boolean canManageStatus = BaseSecurityModule.USERMANAGER_CAN_MANAGE_STATUS;
    if ((iAmOlatAdmin || canManageStatus.booleanValue()) && !myIdentity.getStatus().equals(form.getStatus())) {
        int oldStatus = myIdentity.getStatus();
        String oldStatusText = (oldStatus == Identity.STATUS_PERMANENT ? "permanent" : (oldStatus == Identity.STATUS_ACTIV ? "active" : (oldStatus == Identity.STATUS_LOGIN_DENIED ? "login_denied" : (oldStatus == Identity.STATUS_DELETED ? "deleted" : "unknown"))));
        int newStatus = form.getStatus();
        String newStatusText = (newStatus == Identity.STATUS_PERMANENT ? "permanent" : (newStatus == Identity.STATUS_ACTIV ? "active" : (newStatus == Identity.STATUS_LOGIN_DENIED ? "login_denied" : (newStatus == Identity.STATUS_DELETED ? "deleted" : "unknown"))));
        if (oldStatus != newStatus && newStatus == Identity.STATUS_LOGIN_DENIED && form.getSendLoginDeniedEmail()) {
            userBulkChangeManager.sendLoginDeniedEmail(myIdentity);
        }
        identity = securityManager.saveIdentityStatus(myIdentity, newStatus);
        logAudit("User::" + getIdentity().getName() + " changed accout status for user::" + myIdentity.getName() + " from::" + oldStatusText + " to::" + newStatusText, null);
    }
}

Example 5 with SecurityGroup

use of org.olat.basesecurity.SecurityGroup in project OpenOLAT by OpenOLAT.

the class InvitationEmailController method validateFormLogic.

@Override
protected boolean validateFormLogic(UserRequest ureq) {
    boolean allOk = true;
    if (mailEl != null) {
        String mail = mailEl.getValue();
        if (StringHelper.containsNonWhitespace(mail)) {
            if (MailHelper.isValidEmailAddress(mail)) {
                SecurityGroup allUsers = securityManager.findSecurityGroupByName(Constants.GROUP_OLATUSERS);
                List<Identity> shareWithIdentities = userManager.findIdentitiesByEmail(Collections.singletonList(mail));
                if (isAtLeastOneInSecurityGroup(shareWithIdentities, allUsers)) {
                    mailEl.setErrorKey("map.share.with.mail.error.olatUser", new String[] { mail });
                    allOk &= false;
                }
            } else {
                mailEl.setErrorKey("error.mail.invalid", null);
                allOk &= false;
            }
        } else {
            mailEl.setErrorKey("form.legende.mandatory", null);
            allOk &= false;
        }
    }
    return allOk & super.validateFormLogic(ureq);
}