Examples with IdentityProvisioningException org.wso2.carbon.identity.provisioning.IdentityProvisioningException used on opensource projects

Example 1 with IdentityProvisioningException

use of org.wso2.carbon.identity.provisioning.IdentityProvisioningException in project carbon-identity-framework by wso2.

the class OutboundProvisioningManager method provision.

/**
 * Outbound provisioning method.
 *
 * @param provisioningEntity        Provisioning entity.
 * @param serviceProviderIdentifier Identifier of the service provider.
 * @param inboundClaimDialect       Inbound claim dialect.
 * @param spTenantDomainName        Tenant domain of the service provider.
 * @param jitProvisioning           Is JIT provisioning enabled.
 * @throws IdentityProvisioningException if error occurred while user provisioning.
 */
public void provision(ProvisioningEntity provisioningEntity, String serviceProviderIdentifier, String inboundClaimDialect, String spTenantDomainName, boolean jitProvisioning) throws IdentityProvisioningException {
    try {
        if (provisioningEntity.getEntityName() == null) {
            setProvisioningEntityName(provisioningEntity);
        }
        // get details about the service provider.any in-bound provisioning request via
        // the SOAP based API (or the management console) - or SCIM API with HTTP Basic
        // Authentication is considered as coming from the local service provider.
        ServiceProvider serviceProvider = ApplicationManagementService.getInstance().getServiceProvider(serviceProviderIdentifier, spTenantDomainName);
        if (serviceProvider == null) {
            throw new IdentityProvisioningException("Invalid service provider name : " + serviceProviderIdentifier);
        }
        String provisioningEntityTenantDomainName = spTenantDomainName;
        if (serviceProvider.isSaasApp() && isUserTenantBasedOutboundProvisioningEnabled()) {
            provisioningEntityTenantDomainName = CarbonContext.getThreadLocalCarbonContext().getTenantDomain();
        }
        ClaimMapping[] spClaimMappings = null;
        // if we know the serviceProviderClaimDialect - we do not need to find it again.
        if (inboundClaimDialect == null && serviceProvider.getClaimConfig() != null) {
            spClaimMappings = serviceProvider.getClaimConfig().getClaimMappings();
        }
        // get all the provisioning connectors associated with local service provider for
        // out-bound provisioning.
        // TODO: stop loading connectors all the time.
        Map<String, RuntimeProvisioningConfig> connectors = getOutboundProvisioningConnectors(serviceProvider, spTenantDomainName);
        ProvisioningEntity outboundProEntity;
        ExecutorService executors = null;
        if (MapUtils.isNotEmpty(connectors)) {
            executors = Executors.newFixedThreadPool(connectors.size());
        }
        for (Iterator<Entry<String, RuntimeProvisioningConfig>> iterator = connectors.entrySet().iterator(); iterator.hasNext(); ) {
            Entry<String, RuntimeProvisioningConfig> entry = iterator.next();
            Entry<String, AbstractOutboundProvisioningConnector> connectorEntry = entry.getValue().getProvisioningConnectorEntry();
            AbstractOutboundProvisioningConnector connector = connectorEntry.getValue();
            String connectorType = connectorEntry.getKey();
            String idPName = entry.getKey();
            IdentityProvider provisioningIdp = IdentityProviderManager.getInstance().getIdPByName(idPName, spTenantDomainName);
            if (provisioningIdp == null) {
                // by its name.
                throw new IdentityProvisioningException("Invalid identity provider name : " + idPName);
            }
            String outboundClaimDialect = connector.getClaimDialectUri();
            if (outboundClaimDialect == null && (provisioningIdp.getClaimConfig() == null || provisioningIdp.getClaimConfig().isLocalClaimDialect())) {
                outboundClaimDialect = IdentityProvisioningConstants.WSO2_CARBON_DIALECT;
            }
            ClaimMapping[] idpClaimMappings = null;
            if (provisioningIdp.getClaimConfig() != null) {
                idpClaimMappings = provisioningIdp.getClaimConfig().getClaimMappings();
            }
            // TODO: this should happen asynchronously in a different thread.
            // create a new provisioning entity object for each provisioning identity
            // provider.
            Map<ClaimMapping, List<String>> mapppedClaims;
            // get mapped claims.
            mapppedClaims = getMappedClaims(inboundClaimDialect, outboundClaimDialect, provisioningEntity, spClaimMappings, idpClaimMappings, spTenantDomainName);
            if (provisioningIdp.getPermissionAndRoleConfig() != null) {
                // update with mapped user groups.
                updateProvisioningUserWithMappedRoles(provisioningEntity, provisioningIdp.getPermissionAndRoleConfig().getRoleMappings());
            }
            // check whether we already have the provisioned identifier - if
            // so set it.
            ProvisionedIdentifier provisionedIdentifier;
            provisionedIdentifier = getProvisionedEntityIdentifier(idPName, connectorType, provisioningEntity, spTenantDomainName);
            ProvisioningOperation provisioningOp = provisioningEntity.getOperation();
            if (ProvisioningOperation.DELETE.equals(provisioningOp) && (provisionedIdentifier == null || provisionedIdentifier.getIdentifier() == null)) {
                // send outbound delete request. Skip the flow
                return;
            }
            if (provisionedIdentifier == null || provisionedIdentifier.getIdentifier() == null) {
                provisioningOp = ProvisioningOperation.POST;
            }
            String[] provisionByRoleList = new String[0];
            if (provisioningIdp.getProvisioningRole() != null) {
                provisionByRoleList = provisioningIdp.getProvisioningRole().trim().split("\\s*,[,\\s]*");
            }
            if (provisioningEntity.getEntityType() == ProvisioningEntityType.GROUP && Arrays.asList(provisionByRoleList).contains(provisioningEntity.getEntityName())) {
                Map<ClaimMapping, List<String>> attributes = provisioningEntity.getAttributes();
                List<String> newUsersList = attributes.get(ClaimMapping.build(IdentityProvisioningConstants.NEW_USER_CLAIM_URI, null, null, false));
                List<String> deletedUsersList = attributes.get(ClaimMapping.build(IdentityProvisioningConstants.DELETED_USER_CLAIM_URI, null, null, false));
                Map<ClaimMapping, List<String>> mappedUserClaims;
                ProvisionedIdentifier provisionedUserIdentifier;
                for (String user : newUsersList) {
                    ProvisioningEntity inboundProvisioningEntity = getInboundProvisioningEntity(provisioningEntity, provisioningEntityTenantDomainName, ProvisioningOperation.POST, user);
                    provisionedUserIdentifier = getProvisionedEntityIdentifier(idPName, connectorType, inboundProvisioningEntity, spTenantDomainName);
                    if (provisionedUserIdentifier != null && provisionedUserIdentifier.getIdentifier() != null) {
                        continue;
                    }
                    mappedUserClaims = getMappedClaims(inboundClaimDialect, outboundClaimDialect, inboundProvisioningEntity, spClaimMappings, idpClaimMappings, spTenantDomainName);
                    outboundProEntity = new ProvisioningEntity(ProvisioningEntityType.USER, user, ProvisioningOperation.POST, mappedUserClaims);
                    Callable<Boolean> proThread = new ProvisioningThread(outboundProEntity, spTenantDomainName, provisioningEntityTenantDomainName, connector, connectorType, idPName, dao);
                    outboundProEntity.setIdentifier(provisionedIdentifier);
                    outboundProEntity.setJitProvisioning(jitProvisioning);
                    boolean isBlocking = entry.getValue().isBlocking();
                    executeOutboundProvisioning(provisioningEntity, executors, connectorType, idPName, proThread, isBlocking);
                }
                for (String user : deletedUsersList) {
                    ProvisioningEntity inboundProvisioningEntity = getInboundProvisioningEntity(provisioningEntity, provisioningEntityTenantDomainName, ProvisioningOperation.DELETE, user);
                    provisionedUserIdentifier = getProvisionedEntityIdentifier(idPName, connectorType, inboundProvisioningEntity, spTenantDomainName);
                    if (provisionedUserIdentifier != null && provisionedUserIdentifier.getIdentifier() != null) {
                        mappedUserClaims = getMappedClaims(inboundClaimDialect, outboundClaimDialect, inboundProvisioningEntity, spClaimMappings, idpClaimMappings, spTenantDomainName);
                        outboundProEntity = new ProvisioningEntity(ProvisioningEntityType.USER, user, ProvisioningOperation.DELETE, mappedUserClaims);
                        Callable<Boolean> proThread = new ProvisioningThread(outboundProEntity, spTenantDomainName, provisioningEntityTenantDomainName, connector, connectorType, idPName, dao);
                        outboundProEntity.setIdentifier(provisionedUserIdentifier);
                        outboundProEntity.setJitProvisioning(jitProvisioning);
                        boolean isBlocking = entry.getValue().isBlocking();
                        executeOutboundProvisioning(provisioningEntity, executors, connectorType, idPName, proThread, isBlocking);
                    }
                }
            } else {
                if (!canUserBeProvisioned(provisioningEntity, provisionByRoleList, provisioningEntityTenantDomainName)) {
                    if (!canUserBeDeProvisioned(provisionedIdentifier)) {
                        continue;
                    } else {
                        // This is used when user removed from the provisioning role
                        provisioningOp = ProvisioningOperation.DELETE;
                    }
                }
                if (!skipOutBoundProvisioning(provisioningOp, provisioningEntity, inboundClaimDialect)) {
                    outboundProEntity = new ProvisioningEntity(provisioningEntity.getEntityType(), provisioningEntity.getEntityName(), provisioningOp, mapppedClaims);
                    Callable<Boolean> proThread = new ProvisioningThread(outboundProEntity, spTenantDomainName, provisioningEntityTenantDomainName, connector, connectorType, idPName, dao);
                    outboundProEntity.setIdentifier(provisionedIdentifier);
                    outboundProEntity.setJitProvisioning(jitProvisioning);
                    boolean isAllowed = true;
                    boolean isBlocking = entry.getValue().isBlocking();
                    boolean isPolicyEnabled = entry.getValue().isPolicyEnabled();
                    if (isPolicyEnabled) {
                        isAllowed = XACMLBasedRuleHandler.getInstance().isAllowedToProvision(spTenantDomainName, provisioningEntity, serviceProvider, idPName, connectorType);
                    }
                    if (isAllowed) {
                        executeOutboundProvisioning(provisioningEntity, executors, connectorType, idPName, proThread, isBlocking);
                    }
                }
            }
        }
        if (executors != null) {
            executors.shutdown();
        }
    } catch (CarbonException | IdentityApplicationManagementException | IdentityProviderManagementException | UserStoreException e) {
        throw new IdentityProvisioningException("Error occurred while checking for user " + "provisioning", e);
    }
}

Example 2 with IdentityProvisioningException

use of org.wso2.carbon.identity.provisioning.IdentityProvisioningException in project carbon-identity-framework by wso2.

the class AbstractProvisioningConnectorFactory method getConnector.

/**
 * @param identityProviderName
 * @param provisoningProperties
 * @param tenantDomain
 * @return
 * @throws IdentityProvisioningException
 */
public AbstractOutboundProvisioningConnector getConnector(String identityProviderName, Property[] provisoningProperties, String tenantDomain) throws IdentityProvisioningException {
    ProvisioningConnectorCacheKey cacheKey = new ProvisioningConnectorCacheKey(identityProviderName);
    ProvisioningConnectorCacheEntry entry = ProvisioningConnectorCache.getInstance().getValueFromCache(cacheKey, tenantDomain);
    if (entry != null) {
        if (log.isDebugEnabled()) {
            log.debug("Provisioning cache HIT for " + identityProviderName + " of " + tenantDomain);
        }
        return entry.getProvisioningConnector();
    }
    AbstractOutboundProvisioningConnector connector;
    Property idpName = new Property();
    idpName.setName("identityProviderName");
    idpName.setValue(identityProviderName);
    List<Property> provisioningPropertiesList = new ArrayList<>(Arrays.asList(provisoningProperties));
    provisioningPropertiesList.add(idpName);
    Property[] provisioningProperties = new Property[provisioningPropertiesList.size()];
    provisioningProperties = provisioningPropertiesList.toArray(provisioningProperties);
    connector = buildConnector(provisioningProperties);
    entry = new ProvisioningConnectorCacheEntry();
    entry.setProvisioningConnector(connector);
    ProvisioningConnectorCache.getInstance().addToCache(cacheKey, entry, tenantDomain);
    return connector;
}

Example 3 with IdentityProvisioningException

use of org.wso2.carbon.identity.provisioning.IdentityProvisioningException in project carbon-identity-framework by wso2.

the class OutboundProvisioningManager method getOutboundProvisioningConnectors.

/**
 * TODO: Need to cache the output from this method.
 *
 * @return
 * @throws UserStoreException
 */
private Map<String, RuntimeProvisioningConfig> getOutboundProvisioningConnectors(ServiceProvider serviceProvider, String tenantDomain) throws IdentityProvisioningException {
    Map<String, RuntimeProvisioningConfig> connectors = new HashMap<>();
    ServiceProviderProvisioningConnectorCacheKey key;
    ServiceProviderProvisioningConnectorCacheEntry entry;
    // Reading from the cache.
    if (serviceProvider != null && tenantDomain != null) {
        key = new ServiceProviderProvisioningConnectorCacheKey(serviceProvider.getApplicationName());
        entry = ServiceProviderProvisioningConnectorCache.getInstance().getValueFromCache(key, tenantDomain);
        // cache hit
        if (entry != null) {
            if (log.isDebugEnabled()) {
                log.debug("Provisioning cache HIT for " + serviceProvider + " of " + tenantDomain);
            }
            return entry.getConnectors();
        }
    } else {
        throw new IdentityProvisioningException("Error reading service provider from cache.");
    }
    // NOW build the Map
    // a list of registered provisioning connector factories.
    Map<String, AbstractProvisioningConnectorFactory> registeredConnectorFactories = IdentityProvisionServiceComponent.getConnectorFactories();
    // get all registered list of out-bound provisioning connectors registered for the local
    // service provider.
    OutboundProvisioningConfig outboundProvisioningConfiguration = serviceProvider.getOutboundProvisioningConfig();
    if (outboundProvisioningConfiguration == null) {
        if (log.isDebugEnabled()) {
            log.debug("No outbound provisioning configuration defined for local service provider.");
        }
        // empty list.
        return new HashMap<String, RuntimeProvisioningConfig>();
    }
    // get the list of registered provisioning identity providers in out-bound provisioning
    // configuration.
    IdentityProvider[] provisionningIdPList = outboundProvisioningConfiguration.getProvisioningIdentityProviders();
    if (provisionningIdPList != null && provisionningIdPList.length > 0) {
        for (IdentityProvider fIdP : provisionningIdPList) {
            try {
                AbstractOutboundProvisioningConnector connector;
                ProvisioningConnectorConfig defaultConnector = fIdP.getDefaultProvisioningConnectorConfig();
                if (defaultConnector != null) {
                    // if no default provisioning connector defined for this identity provider,
                    // we can safely ignore it - need not to worry about provisioning.
                    String connectorType = fIdP.getDefaultProvisioningConnectorConfig().getName();
                    boolean enableJitProvisioning = false;
                    if (fIdP.getJustInTimeProvisioningConfig() != null && fIdP.getJustInTimeProvisioningConfig().isProvisioningEnabled()) {
                        enableJitProvisioning = true;
                    }
                    connector = getOutboundProvisioningConnector(fIdP, registeredConnectorFactories, tenantDomain, enableJitProvisioning);
                    // configuration of the local service provider.
                    if (connector != null) {
                        RuntimeProvisioningConfig proConfig = new RuntimeProvisioningConfig();
                        proConfig.setProvisioningConnectorEntry(new SimpleEntry<>(connectorType, connector));
                        proConfig.setBlocking(defaultConnector.isBlocking());
                        proConfig.setPolicyEnabled(defaultConnector.isRulesEnabled());
                        connectors.put(fIdP.getIdentityProviderName(), proConfig);
                    }
                }
            } catch (IdentityProviderManagementException e) {
                throw new IdentityProvisioningException("Error while retrieving idp configuration for " + fIdP.getIdentityProviderName(), e);
            }
        }
    }
    entry = new ServiceProviderProvisioningConnectorCacheEntry();
    entry.setConnectors(connectors);
    ServiceProviderProvisioningConnectorCache.getInstance().addToCache(key, entry, tenantDomain);
    if (log.isDebugEnabled()) {
        log.debug("Entry added successfully ");
    }
    return connectors;
}

Example 4 with IdentityProvisioningException

use of org.wso2.carbon.identity.provisioning.IdentityProvisioningException in project carbon-identity-framework by wso2.

the class ProvisioningIdentityProviderMgtListener method destroyConnector.

/**
 * @param identityProviderName
 * @param tenantDomain
 * @throws IdentityProvisioningException
 */
public void destroyConnector(String identityProviderName, String tenantDomain) throws IdentityProvisioningException {
    ProvisioningConnectorCacheKey cacheKey = new ProvisioningConnectorCacheKey(identityProviderName);
    ProvisioningConnectorCacheEntry entry = ProvisioningConnectorCache.getInstance().getValueFromCache(cacheKey, tenantDomain);
    if (entry != null) {
        ProvisioningConnectorCache.getInstance().clearCacheEntry(cacheKey, tenantDomain);
        if (log.isDebugEnabled()) {
            log.debug("Provisioning cached entry removed for idp " + identityProviderName);
        }
    } else {
        if (log.isDebugEnabled()) {
            log.debug("Provisioning cached entry not found for idp " + identityProviderName);
        }
    }
    int tenantId;
    try {
        RealmService realmService = ProvisioningServiceDataHolder.getInstance().getRealmService();
        tenantId = realmService.getTenantManager().getTenantId(tenantDomain);
    } catch (UserStoreException e) {
        throw new IdentityProvisioningException("Error occurred while retrieving tenant id from tenant domain", e);
    }
    try {
        List<String> serviceProviders = provisioningManagementDAO.getSPNamesOfProvisioningConnectorsByIDP(identityProviderName, tenantId);
        for (String serviceProvider : serviceProviders) {
            ServiceProviderProvisioningConnectorCacheKey key = new ServiceProviderProvisioningConnectorCacheKey(serviceProvider);
            ServiceProviderProvisioningConnectorCacheEntry cacheEntry = ServiceProviderProvisioningConnectorCache.getInstance().getValueFromCache(key, tenantDomain);
            if (cacheEntry != null) {
                ServiceProviderProvisioningConnectorCache.getInstance().clearCacheEntry(key, tenantDomain);
                if (log.isDebugEnabled()) {
                    log.debug("Service Provider '" + serviceProvider + "' Provisioning cached entry removed for idp " + identityProviderName);
                }
            } else {
                if (log.isDebugEnabled()) {
                    log.debug("Service Provider '" + serviceProvider + "' Provisioning cached entry not found for idp " + identityProviderName);
                }
            }
        }
    } catch (IdentityApplicationManagementException e) {
        throw new IdentityProvisioningException("Error occurred while removing cache entry from the " + "service provider provisioning connector cache", e);
    }
}

Example 5 with IdentityProvisioningException

use of org.wso2.carbon.identity.provisioning.IdentityProvisioningException in project carbon-identity-framework by wso2.

the class XACMLBasedRuleHandler method evaluateXACMLResponse.

private boolean evaluateXACMLResponse(String xacmlResponse) throws IdentityProvisioningException {
    try {
        DocumentBuilderFactory documentBuilderFactory = IdentityUtil.getSecuredDocumentBuilderFactory();
        DocumentBuilder db = documentBuilderFactory.newDocumentBuilder();
        InputSource is = new InputSource();
        is.setCharacterStream(new StringReader(xacmlResponse));
        Document doc = db.parse(is);
        String decision = "";
        NodeList decisionNode = doc.getDocumentElement().getElementsByTagName(ProvisioningRuleConstanats.XACML_RESPONSE_DECISION_NODE);
        if (decisionNode != null && decisionNode.item(0) != null) {
            decision = decisionNode.item(0).getTextContent();
        }
        if (decision.equalsIgnoreCase(EntitlementPolicyConstants.RULE_EFFECT_PERMIT) || decision.equalsIgnoreCase(EntitlementPolicyConstants.RULE_EFFECT_NOT_APPLICABLE)) {
            return true;
        }
    } catch (ParserConfigurationException | SAXException | IOException e) {
        throw new IdentityProvisioningException("Exception occurred while xacmlResponse processing", e);
    }
    return false;
}