Examples with IdentityRoleManagementClientException org.wso2.carbon.identity.role.mgt.core.IdentityRoleManagementClientException used on opensource projects

Example 1 with IdentityRoleManagementClientException

use of org.wso2.carbon.identity.role.mgt.core.IdentityRoleManagementClientException in project carbon-identity-framework by wso2.

the class RoleDAOImpl method getGroupListOfRole.

@Override
public List<GroupBasicInfo> getGroupListOfRole(String roleID, String tenantDomain) throws IdentityRoleManagementException {
    if (!isExistingRoleID(roleID, tenantDomain)) {
        throw new IdentityRoleManagementClientException(ROLE_NOT_FOUND.getCode(), "Role id: " + roleID + " does not exist in the system.");
    }
    String roleName = getRoleNameByID(roleID, tenantDomain);
    int tenantId = IdentityTenantUtil.getTenantId(tenantDomain);
    List<GroupBasicInfo> groupList = new ArrayList<>();
    List<String> groupNames = new ArrayList<>();
    List<String> disabledDomainName = getDisabledDomainNames();
    String primaryDomainName = IdentityUtil.getPrimaryDomainName();
    if (primaryDomainName != null) {
        primaryDomainName = primaryDomainName.toUpperCase(Locale.ENGLISH);
    }
    try (Connection connection = IdentityDatabaseUtil.getUserDBConnection(false)) {
        try (NamedPreparedStatement statement = new NamedPreparedStatement(connection, GET_GROUP_LIST_OF_ROLE_SQL, RoleTableColumns.UM_ID)) {
            statement.setString(RoleTableColumns.UM_ROLE_NAME, roleName);
            statement.setInt(RoleTableColumns.UM_TENANT_ID, tenantId);
            try (ResultSet resultSet = statement.executeQuery()) {
                while (resultSet.next()) {
                    String name = resultSet.getString(1);
                    String domain = resultSet.getString(2);
                    if (!disabledDomainName.contains(domain)) {
                        if (!StringUtils.equals(primaryDomainName, domain)) {
                            name = UserCoreUtil.addDomainToName(name, domain);
                        } else {
                            name = primaryDomainName + UserCoreConstants.DOMAIN_SEPARATOR + name;
                        }
                        groupNames.add(name);
                    }
                }
            }
        }
    } catch (SQLException e) {
        String errorMessage = "Error while while getting the group list of role for role name: %s in the " + "tenantDomain: %s";
        throw new IdentityRoleManagementServerException(UNEXPECTED_SERVER_ERROR.getCode(), String.format(errorMessage, roleName, tenantDomain), e);
    }
    Map<String, String> groupNamesToIDs = getGroupIDsByNames(groupNames, tenantDomain);
    groupNamesToIDs.forEach((groupName, groupID) -> groupList.add(new GroupBasicInfo(groupID, groupName)));
    return groupList;
}

Example 2 with IdentityRoleManagementClientException

use of org.wso2.carbon.identity.role.mgt.core.IdentityRoleManagementClientException in project carbon-identity-framework by wso2.

the class RoleDAOImpl method validateUserRemovalFromRole.

private void validateUserRemovalFromRole(List<String> deletedUserNamesList, String roleName, String tenantDomain) throws IdentityRoleManagementException {
    if (!IdentityUtil.isSystemRolesEnabled() || deletedUserNamesList.isEmpty()) {
        return;
    }
    try {
        String username = CarbonContext.getThreadLocalCarbonContext().getUsername();
        UserRealm userRealm = CarbonContext.getThreadLocalCarbonContext().getUserRealm();
        String adminUserName = userRealm.getRealmConfiguration().getAdminUserName();
        org.wso2.carbon.user.core.UserStoreManager userStoreManager = (org.wso2.carbon.user.core.UserStoreManager) userRealm.getUserStoreManager();
        boolean isUseCaseSensitiveUsernameForCacheKeys = IdentityUtil.isUseCaseSensitiveUsernameForCacheKeys(userStoreManager);
        // Only the tenant owner can remove users from Administrator role.
        if (RoleConstants.ADMINISTRATOR.equalsIgnoreCase(roleName)) {
            if ((isUseCaseSensitiveUsernameForCacheKeys && !StringUtils.equals(username, adminUserName)) || (!isUseCaseSensitiveUsernameForCacheKeys && !StringUtils.equalsIgnoreCase(username, adminUserName))) {
                String errorMessage = "Invalid operation. Only the tenant owner can remove users from the role: %s";
                throw new IdentityRoleManagementClientException(OPERATION_FORBIDDEN.getCode(), String.format(errorMessage, RoleConstants.ADMINISTRATOR));
            } else {
                // Tenant owner cannot be removed from Administrator role.
                if (deletedUserNamesList.contains(adminUserName)) {
                    String errorMessage = "Invalid operation. Tenant owner cannot be removed from the role: %s";
                    throw new IdentityRoleManagementClientException(OPERATION_FORBIDDEN.getCode(), String.format(errorMessage, RoleConstants.ADMINISTRATOR));
                }
            }
        }
    } catch (UserStoreException e) {
        String errorMessage = "Error while validating user removal from the role: %s in the tenantDomain: %s";
        throw new IdentityRoleManagementServerException(UNEXPECTED_SERVER_ERROR.getCode(), String.format(errorMessage, roleName, tenantDomain), e);
    }
}

Example 3 with IdentityRoleManagementClientException

use of org.wso2.carbon.identity.role.mgt.core.IdentityRoleManagementClientException in project carbon-identity-framework by wso2.

the class RoleDAOImpl method updateUserListOfRole.

@Override
public RoleBasicInfo updateUserListOfRole(String roleID, List<String> newUserIDList, List<String> deletedUserIDList, String tenantDomain) throws IdentityRoleManagementException {
    if (!isExistingRoleID(roleID, tenantDomain)) {
        throw new IdentityRoleManagementClientException(ROLE_NOT_FOUND.getCode(), "Role id: " + roleID + " does not exist in the system.");
    }
    String roleName = getRoleNameByID(roleID, tenantDomain);
    if (CollectionUtils.isEmpty(newUserIDList) && CollectionUtils.isEmpty(deletedUserIDList)) {
        if (log.isDebugEnabled()) {
            log.debug("User lists are empty.");
        }
        return new RoleBasicInfo(roleID, roleName);
    }
    String primaryDomainName = IdentityUtil.getPrimaryDomainName();
    if (primaryDomainName != null) {
        primaryDomainName = primaryDomainName.toUpperCase(Locale.ENGLISH);
    }
    List<String> newUserNamesList = getUserNamesByIDs(newUserIDList, tenantDomain);
    List<String> deletedUserNamesList = getUserNamesByIDs(deletedUserIDList, tenantDomain);
    int tenantId = IdentityTenantUtil.getTenantId(tenantDomain);
    // Validate the user removal operation based on the default system roles.
    validateUserRemovalFromRole(deletedUserNamesList, roleName, tenantDomain);
    try (Connection connection = IdentityDatabaseUtil.getUserDBConnection(true)) {
        try {
            // Add new users to the role.
            String addUsersSQL = ADD_USER_TO_ROLE_SQL;
            String databaseProductName = connection.getMetaData().getDatabaseProductName();
            if (MICROSOFT.equals(databaseProductName)) {
                addUsersSQL = ADD_USER_TO_ROLE_SQL_MSSQL;
            }
            processBatchUpdateForUsers(roleName, newUserNamesList, tenantId, primaryDomainName, connection, addUsersSQL);
            // Delete existing users from the role.
            processBatchUpdateForUsers(roleName, deletedUserNamesList, tenantId, primaryDomainName, connection, REMOVE_USER_FROM_ROLE_SQL);
            IdentityDatabaseUtil.commitUserDBTransaction(connection);
        } catch (SQLException e) {
            IdentityDatabaseUtil.rollbackUserDBTransaction(connection);
            String errorMessage = "Error while updating users to the role: %s in the tenantDomain: %s";
            throw new IdentityRoleManagementServerException(UNEXPECTED_SERVER_ERROR.getCode(), String.format(errorMessage, roleName, tenantDomain), e);
        }
    } catch (SQLException e) {
        String errorMessage = "Error while updating users to the role: %s in the tenantDomain: %s";
        throw new IdentityRoleManagementServerException(UNEXPECTED_SERVER_ERROR.getCode(), String.format(errorMessage, roleName, tenantDomain), e);
    }
    if (CollectionUtils.isNotEmpty(deletedUserNamesList)) {
        for (String username : deletedUserNamesList) {
            clearUserRolesCache(username, tenantId);
        }
    }
    if (CollectionUtils.isNotEmpty(newUserNamesList)) {
        for (String username : newUserNamesList) {
            clearUserRolesCache(username, tenantId);
        }
    }
    return new RoleBasicInfo(roleID, roleName);
}

Example 4 with IdentityRoleManagementClientException

use of org.wso2.carbon.identity.role.mgt.core.IdentityRoleManagementClientException in project carbon-identity-framework by wso2.

the class RoleManagementServiceImpl method addRole.

@Override
public RoleBasicInfo addRole(String roleName, List<String> userList, List<String> groupList, List<String> permissions, String tenantDomain) throws IdentityRoleManagementException {
    /* Block the role names with the prefix 'system_' as it is used for the special roles created by the system in
        order to maintain the backward compatibility. */
    if (StringUtils.startsWithIgnoreCase(roleName, UserCoreConstants.INTERNAL_SYSTEM_ROLE_PREFIX)) {
        String errorMessage = String.format("Invalid role name: %s. Role names with the prefix: %s, is not allowed" + " to be created from externally in the system.", roleName, UserCoreConstants.INTERNAL_SYSTEM_ROLE_PREFIX);
        throw new IdentityRoleManagementClientException(INVALID_REQUEST.getCode(), errorMessage);
    }
    RoleManagementEventPublisherProxy roleManagementEventPublisherProxy = RoleManagementEventPublisherProxy.getInstance();
    roleManagementEventPublisherProxy.publishPreAddRole(roleName, userList, groupList, permissions, tenantDomain);
    RoleBasicInfo roleBasicInfo = roleDAO.addRole(roleName, userList, groupList, permissions, tenantDomain);
    roleManagementEventPublisherProxy.publishPostAddRole(roleName, userList, groupList, permissions, tenantDomain);
    if (log.isDebugEnabled()) {
        log.debug(String.format("%s add role of name : %s successfully.", getUser(tenantDomain), roleName));
    }
    audit.info(String.format(auditMessage, getUser(tenantDomain), "Add Role", roleName, getAuditData(tenantDomain), success));
    return roleBasicInfo;
}

Example 5 with IdentityRoleManagementClientException

use of org.wso2.carbon.identity.role.mgt.core.IdentityRoleManagementClientException in project carbon-identity-framework by wso2.

the class GroupDAOImpl method getGroupIDByName.

@Override
public String getGroupIDByName(String name, String tenantDomain) throws IdentityRoleManagementException {
    int tenantId = IdentityTenantUtil.getTenantId(tenantDomain);
    String groupID = null;
    try (Connection connection = IdentityDatabaseUtil.getDBConnection(false)) {
        try (NamedPreparedStatement statement = new NamedPreparedStatement(connection, GET_GROUP_ID_BY_NAME_SQL)) {
            statement.setInt(RoleConstants.RoleTableColumns.TENANT_ID, tenantId);
            statement.setString(RoleConstants.RoleTableColumns.ROLE_NAME, name);
            statement.setString(RoleConstants.RoleTableColumns.ATTR_NAME, RoleConstants.ID_URI);
            int count = 0;
            try (ResultSet resultSet = statement.executeQuery()) {
                while (resultSet.next()) {
                    // Handle multiple matching groups.
                    count++;
                    if (count > 1) {
                        String errorMessage = "Invalid scenario. Multiple groups found for the given group name: " + name + " " + "and tenantDomain: " + tenantDomain;
                        throw new IdentityRoleManagementClientException(INVALID_REQUEST.getCode(), errorMessage);
                    }
                    groupID = resultSet.getString(1);
                }
            }
        }
    } catch (SQLException e) {
        String errorMessage = "Error while resolving the group ID for the given group name: " + name + " and tenantDomain: " + tenantDomain;
        throw new IdentityRoleManagementServerException(UNEXPECTED_SERVER_ERROR.getCode(), errorMessage, e);
    }
    return groupID;
}