1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16 package org.kuali.rice.kim.document.rule;
17
18 import org.apache.commons.lang.StringUtils;
19 import org.kuali.rice.core.util.RiceKeyConstants;
20 import org.kuali.rice.kim.api.permission.Permission;
21 import org.kuali.rice.kim.api.responsibility.Responsibility;
22 import org.kuali.rice.kim.api.responsibility.ResponsibilityService;
23 import org.kuali.rice.kim.api.role.Role;
24 import org.kuali.rice.kim.api.role.RoleService;
25 import org.kuali.rice.kim.api.services.IdentityService;
26 import org.kuali.rice.kim.api.services.KimApiServiceLocator;
27 import org.kuali.rice.kim.api.type.KimType;
28 import org.kuali.rice.kim.api.type.KimTypeService;
29 import org.kuali.rice.kim.bo.types.dto.AttributeDefinitionMap;
30 import org.kuali.rice.kim.bo.ui.KimDocumentRoleMember;
31 import org.kuali.rice.kim.bo.ui.KimDocumentRolePermission;
32 import org.kuali.rice.kim.bo.ui.KimDocumentRoleQualifier;
33 import org.kuali.rice.kim.bo.ui.KimDocumentRoleResponsibility;
34 import org.kuali.rice.kim.bo.ui.KimDocumentRoleResponsibilityAction;
35 import org.kuali.rice.kim.bo.ui.RoleDocumentDelegationMember;
36 import org.kuali.rice.kim.bo.ui.RoleDocumentDelegationMemberQualifier;
37 import org.kuali.rice.kim.document.IdentityManagementRoleDocument;
38 import org.kuali.rice.kim.framework.role.RoleEbo;
39 import org.kuali.rice.kim.impl.responsibility.AddResponsibilityEvent;
40 import org.kuali.rice.kim.impl.responsibility.AddResponsibilityRule;
41 import org.kuali.rice.kim.impl.responsibility.KimDocumentResponsibilityRule;
42 import org.kuali.rice.kim.impl.responsibility.ResponsibilityBo;
43 import org.kuali.rice.kim.impl.responsibility.ResponsibilityInternalService;
44 import org.kuali.rice.kim.impl.role.RoleBo;
45 import org.kuali.rice.kim.impl.role.RoleServiceBase;
46 import org.kuali.rice.kim.impl.type.KimTypeLookupableHelperServiceImpl;
47 import org.kuali.rice.kim.rule.event.ui.AddDelegationEvent;
48 import org.kuali.rice.kim.rule.event.ui.AddDelegationMemberEvent;
49 import org.kuali.rice.kim.rule.event.ui.AddMemberEvent;
50 import org.kuali.rice.kim.rule.event.ui.AddPermissionEvent;
51 import org.kuali.rice.kim.rule.ui.AddDelegationMemberRule;
52 import org.kuali.rice.kim.rule.ui.AddDelegationRule;
53 import org.kuali.rice.kim.rule.ui.AddMemberRule;
54 import org.kuali.rice.kim.rule.ui.AddPermissionRule;
55 import org.kuali.rice.kim.rules.ui.KimDocumentMemberRule;
56 import org.kuali.rice.kim.rules.ui.KimDocumentPermissionRule;
57 import org.kuali.rice.kim.rules.ui.RoleDocumentDelegationMemberRule;
58 import org.kuali.rice.kim.rules.ui.RoleDocumentDelegationRule;
59 import org.kuali.rice.kim.service.KIMServiceLocatorWeb;
60 import org.kuali.rice.kim.util.KimConstants;
61 import org.kuali.rice.krad.datadictionary.AttributeDefinition;
62 import org.kuali.rice.krad.document.Document;
63 import org.kuali.rice.krad.rules.TransactionalDocumentRuleBase;
64 import org.kuali.rice.krad.service.BusinessObjectService;
65 import org.kuali.rice.krad.service.KRADServiceLocator;
66 import org.kuali.rice.krad.util.GlobalVariables;
67 import org.kuali.rice.krad.util.KRADConstants;
68 import org.kuali.rice.krad.util.MessageMap;
69
70 import java.sql.Timestamp;
71 import java.util.Collections;
72 import java.util.HashMap;
73 import java.util.HashSet;
74 import java.util.List;
75 import java.util.Map;
76 import java.util.Set;
77
78
79
80
81 public class IdentityManagementRoleDocumentRule extends TransactionalDocumentRuleBase implements AddPermissionRule, AddResponsibilityRule, AddMemberRule, AddDelegationRule, AddDelegationMemberRule {
82
83
84 public static final int PRIORITY_NUMBER_MIN_VALUE = 1;
85 public static final int PRIORITY_NUMBER_MAX_VALUE = 11;
86
87 protected AddResponsibilityRule addResponsibilityRule;
88 protected AddPermissionRule addPermissionRule;
89 protected AddMemberRule addMemberRule;
90 protected AddDelegationRule addDelegationRule;
91 protected AddDelegationMemberRule addDelegationMemberRule;
92 protected BusinessObjectService businessObjectService;
93 protected ResponsibilityService responsibilityService;
94 protected Class<? extends AddResponsibilityRule> addResponsibilityRuleClass = KimDocumentResponsibilityRule.class;
95 protected Class<? extends AddPermissionRule> addPermissionRuleClass = KimDocumentPermissionRule.class;
96 protected Class<? extends AddMemberRule> addMemberRuleClass = KimDocumentMemberRule.class;
97 protected Class<? extends AddDelegationRule> addDelegationRuleClass = RoleDocumentDelegationRule.class;
98 protected Class<? extends AddDelegationMemberRule> addDelegationMemberRuleClass = RoleDocumentDelegationMemberRule.class;
99
100 protected IdentityService identityService;
101 private static ResponsibilityInternalService responsibilityInternalService;
102
103 protected AttributeValidationHelper attributeValidationHelper = new AttributeValidationHelper();
104
105
106 protected ActiveRoleMemberHelper activeRoleMemberHelper = new ActiveRoleMemberHelper();
107
108 public IdentityService getIdentityService() {
109 if ( identityService == null) {
110 identityService = KimApiServiceLocator.getIdentityService();
111 }
112 return identityService;
113 }
114
115 @Override
116 protected boolean processCustomSaveDocumentBusinessRules(Document document) {
117 if (!(document instanceof IdentityManagementRoleDocument)) {
118 return false;
119 }
120
121 IdentityManagementRoleDocument roleDoc = (IdentityManagementRoleDocument)document;
122
123 boolean valid = true;
124 boolean validateRoleAssigneesAndDelegations = !KimTypeLookupableHelperServiceImpl
125 .hasDerivedRoleTypeService(roleDoc.getKimType());
126 GlobalVariables.getMessageMap().addToErrorPath(KRADConstants.DOCUMENT_PROPERTY_NAME);
127 valid &= validDuplicateRoleName(roleDoc);
128 valid &= validPermissions(roleDoc);
129 valid &= validResponsibilities(roleDoc);
130 getDictionaryValidationService().validateDocumentAndUpdatableReferencesRecursively(document, getMaxDictionaryValidationDepth(), true, false);
131 validateRoleAssigneesAndDelegations &= validAssignRole(roleDoc);
132 if(validateRoleAssigneesAndDelegations){
133
134
135
136
137
138 List<KimDocumentRoleMember> activeRoleMembers = activeRoleMemberHelper.getActiveRoleMembers(roleDoc.getMembers());
139 List<RoleDocumentDelegationMember> activeRoleDelegationMembers = activeRoleMemberHelper.getActiveDelegationRoleMembers(roleDoc.getDelegationMembers());
140
141 valid &= validateRoleQualifier(activeRoleMembers, roleDoc.getKimType());
142 valid &= validRoleMemberActiveDates(roleDoc.getMembers());
143 valid &= validateDelegationMemberRoleQualifier(activeRoleMembers, activeRoleDelegationMembers, roleDoc.getKimType());
144 valid &= validDelegationMemberActiveDates(roleDoc.getDelegationMembers());
145 valid &= validRoleMembersResponsibilityActions(roleDoc.getMembers());
146 }
147 valid &= validRoleResponsibilitiesActions(roleDoc.getResponsibilities());
148 GlobalVariables.getMessageMap().removeFromErrorPath(KRADConstants.DOCUMENT_PROPERTY_NAME);
149
150 return valid;
151 }
152
153 protected boolean validAssignRole(IdentityManagementRoleDocument document){
154 boolean rulePassed = true;
155 Map<String,String> additionalPermissionDetails = new HashMap<String,String>();
156 additionalPermissionDetails.put(KimConstants.AttributeConstants.NAMESPACE_CODE, document.getRoleNamespace());
157 additionalPermissionDetails.put(KimConstants.AttributeConstants.ROLE_NAME, document.getRoleName());
158 if((document.getMembers()!=null && document.getMembers().size()>0) ||
159 (document.getDelegationMembers()!=null && document.getDelegationMembers().size()>0)){
160 if(!getDocumentHelperService().getDocumentAuthorizer(document).isAuthorizedByTemplate(
161 document, KimConstants.NAMESPACE_CODE, KimConstants.PermissionTemplateNames.ASSIGN_ROLE,
162 GlobalVariables.getUserSession().getPrincipalId(), additionalPermissionDetails, null)){
163 rulePassed = false;
164 }
165 }
166 return rulePassed;
167 }
168
169 @SuppressWarnings("unchecked")
170 protected boolean validDuplicateRoleName(IdentityManagementRoleDocument roleDoc){
171 Role role = KimApiServiceLocator.getRoleService().getRoleByName(roleDoc.getRoleNamespace(), roleDoc.getRoleName());
172 boolean rulePassed = true;
173 if(role!=null){
174 if(role.getId().equals(roleDoc.getRoleId())) {
175 rulePassed = true;
176 }
177 else{
178 GlobalVariables.getMessageMap().putError("document.roleName",
179 RiceKeyConstants.ERROR_DUPLICATE_ENTRY, new String[] {"Role Name"});
180 rulePassed = false;
181 }
182 }
183 return rulePassed;
184 }
185
186 protected boolean validRoleMemberActiveDates(List<KimDocumentRoleMember> roleMembers) {
187 boolean valid = true;
188 int i = 0;
189 for(KimDocumentRoleMember roleMember: roleMembers) {
190 valid &= validateActiveDate("document.members["+i+"].activeToDate", roleMember.getActiveFromDate(), roleMember.getActiveToDate());
191 i++;
192 }
193 return valid;
194 }
195
196 protected boolean validDelegationMemberActiveDates(List<RoleDocumentDelegationMember> delegationMembers) {
197 boolean valid = true;
198 int i = 0;
199 for(RoleDocumentDelegationMember delegationMember: delegationMembers) {
200 valid &= validateActiveDate("document.delegationMembers[" + i + "].activeToDate",
201 delegationMember.getActiveFromDate(), delegationMember.getActiveToDate());
202 i++;
203 }
204 return valid;
205 }
206
207 protected boolean validPermissions(IdentityManagementRoleDocument document){
208 Permission kimPermissionInfo;
209 boolean valid = true;
210 int i = 0;
211 for(KimDocumentRolePermission permission: document.getPermissions()){
212 kimPermissionInfo = permission.getPermission();
213 if(!permission.isActive() && !hasPermissionToGrantPermission(permission.getPermission(), document)){
214 GlobalVariables.getMessageMap().putError("permissions["+i+"].active", RiceKeyConstants.ERROR_ASSIGN_PERMISSION,
215 new String[] {kimPermissionInfo.getNamespaceCode(), kimPermissionInfo.getTemplate().getName()});
216 valid = false;
217 }
218 i++;
219 }
220 return valid;
221 }
222
223 protected boolean validResponsibilities(IdentityManagementRoleDocument document){
224 ResponsibilityBo kimResponsibilityImpl;
225 boolean valid = true;
226 int i = 0;
227 for(KimDocumentRoleResponsibility responsibility: document.getResponsibilities()){
228 kimResponsibilityImpl = responsibility.getKimResponsibility();
229 if(!responsibility.isActive() && !hasPermissionToGrantResponsibility(ResponsibilityBo.to(responsibility.getKimResponsibility()), document)){
230 GlobalVariables.getMessageMap().putError("responsibilities["+i+"].active", RiceKeyConstants.ERROR_ASSIGN_RESPONSIBILITY,
231 new String[] {kimResponsibilityImpl.getNamespaceCode(), kimResponsibilityImpl.getTemplate().getName()});
232 valid = false;
233 }
234 i++;
235 }
236 return valid;
237 }
238
239 protected boolean validRoleResponsibilitiesActions(List<KimDocumentRoleResponsibility> roleResponsibilities){
240 int i = 0;
241 boolean rulePassed = true;
242 for(KimDocumentRoleResponsibility roleResponsibility: roleResponsibilities){
243 if(!getResponsibilityInternalService().areActionsAtAssignmentLevelById(roleResponsibility.getResponsibilityId())) {
244 validateRoleResponsibilityAction("document.responsibilities["+i+"].roleRspActions[0].priorityNumber", roleResponsibility.getRoleRspActions().get(0));
245 }
246 i++;
247 }
248 return rulePassed;
249 }
250
251 protected boolean validRoleMembersResponsibilityActions(List<KimDocumentRoleMember> roleMembers){
252 int i = 0;
253 int j;
254 boolean rulePassed = true;
255 for(KimDocumentRoleMember roleMember: roleMembers){
256 j = 0;
257 if(roleMember.getRoleRspActions()!=null && !roleMember.getRoleRspActions().isEmpty()){
258 for(KimDocumentRoleResponsibilityAction roleRspAction: roleMember.getRoleRspActions()){
259 validateRoleResponsibilityAction("document.members["+i+"].roleRspActions["+j+"].priorityNumber", roleRspAction);
260 j++;
261 }
262 }
263 i++;
264 }
265 return rulePassed;
266 }
267
268 protected boolean validateRoleResponsibilityAction(String errorPath, KimDocumentRoleResponsibilityAction roleRspAction){
269 boolean rulePassed = true;
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285 if(roleRspAction.getPriorityNumber()!=null &&
286 (roleRspAction.getPriorityNumber()<PRIORITY_NUMBER_MIN_VALUE
287 || roleRspAction.getPriorityNumber()>PRIORITY_NUMBER_MAX_VALUE)){
288 GlobalVariables.getMessageMap().putError(errorPath,
289 RiceKeyConstants.ERROR_PRIORITY_NUMBER_RANGE, new String[] {PRIORITY_NUMBER_MIN_VALUE+"", PRIORITY_NUMBER_MAX_VALUE+""});
290 rulePassed = false;
291 }
292
293 return rulePassed;
294 }
295
296 protected boolean validateRoleQualifier(List<KimDocumentRoleMember> roleMembers, KimType kimType){
297 Map<String, String> validationErrors = new HashMap<String, String>();
298
299 int memberCounter = 0;
300 int roleMemberCount = 0;
301 Map<String, String> errorsTemp;
302 Map<String, String> mapToValidate;
303 KimTypeService kimTypeService = KIMServiceLocatorWeb.getKimTypeService(kimType);
304 GlobalVariables.getMessageMap().removeFromErrorPath(KRADConstants.DOCUMENT_PROPERTY_NAME);
305 final AttributeDefinitionMap attributeDefinitions = kimTypeService.getAttributeDefinitions(kimType.getId());
306 final Set<String> uniqueAttributeNames = figureOutUniqueQualificationSet(roleMembers, attributeDefinitions);
307
308 for(KimDocumentRoleMember roleMember: roleMembers) {
309 errorsTemp = Collections.emptyMap();
310 mapToValidate = attributeValidationHelper.convertQualifiersToMap(roleMember.getQualifiers());
311 if(!roleMember.isRole()){
312 errorsTemp = kimTypeService.validateAttributes(kimType.getId(), mapToValidate);
313 validationErrors.putAll(
314 attributeValidationHelper.convertErrorsForMappedFields(
315 "document.members[" + memberCounter + "]", errorsTemp));
316 memberCounter++;
317 }
318 if (uniqueAttributeNames.size() > 0) {
319 validateUniquePersonRoleQualifiersUniqueForRoleMembership(roleMember, roleMemberCount, roleMembers, uniqueAttributeNames, validationErrors);
320 }
321
322 roleMemberCount += 1;
323 }
324
325 GlobalVariables.getMessageMap().addToErrorPath(KRADConstants.DOCUMENT_PROPERTY_NAME);
326
327 if (validationErrors.isEmpty()) {
328 return true;
329 }
330 attributeValidationHelper.moveValidationErrorsToErrorMap(validationErrors);
331 return false;
332 }
333
334
335
336
337
338
339
340
341 protected Set<String> figureOutUniqueQualificationSet(List<KimDocumentRoleMember> memberships, AttributeDefinitionMap attributeDefinitions) {
342 Set<String> uniqueAttributeIds = new HashSet<String>();
343
344 if (memberships != null && memberships.size() > 1) {
345 KimDocumentRoleMember membership = memberships.get(0);
346
347 for (KimDocumentRoleQualifier qualifier : membership.getQualifiers()) {
348 if (qualifier != null && qualifier.getKimAttribute() != null && !StringUtils.isBlank(qualifier.getKimAttribute().getAttributeName())) {
349 final AttributeDefinition relatedDefinition = attributeDefinitions.getByAttributeName(qualifier.getKimAttribute().getAttributeName());
350
351 if (relatedDefinition != null && relatedDefinition.getUnique() != null && relatedDefinition.getUnique().booleanValue()) {
352 uniqueAttributeIds.add(qualifier.getKimAttrDefnId());
353 }
354 }
355 }
356 }
357
358 return uniqueAttributeIds;
359 }
360
361
362
363
364
365
366
367
368
369 protected boolean validateUniquePersonRoleQualifiersUniqueForRoleMembership(KimDocumentRoleMember membershipToCheck, int membershipToCheckIndex, List<KimDocumentRoleMember> memberships, Set<String> uniqueQualifierIds, Map<String, String> validationErrors) {
370 boolean foundError = false;
371 int count = 0;
372
373 for (KimDocumentRoleMember membership : memberships) {
374 if (membershipToCheckIndex != count) {
375 if (sameMembership(membershipToCheck, membership)) {
376 if (sameUniqueMembershipQualifications(membershipToCheck, membership, uniqueQualifierIds)) {
377 foundError = true;
378
379 int qualifierCount = 0;
380
381 for (KimDocumentRoleQualifier qualifier : membership.getQualifiers()) {
382 if (qualifier != null && uniqueQualifierIds.contains(qualifier.getKimAttrDefnId())) {
383 validationErrors.put("document.members["+membershipToCheckIndex+"].qualifiers["+qualifierCount+"].attrVal", RiceKeyConstants.ERROR_DOCUMENT_IDENTITY_MANAGEMENT_PERSON_QUALIFIER_VALUE_NOT_UNIQUE+":"+qualifier.getKimAttribute().getAttributeName()+";"+qualifier.getAttrVal());
384 }
385 qualifierCount += 1;
386 }
387 }
388 }
389 }
390 count += 1;
391 }
392
393 return foundError;
394 }
395
396
397
398
399
400
401
402
403 protected boolean sameMembership(KimDocumentRoleMember membershipA, KimDocumentRoleMember membershipB) {
404 if (!StringUtils.isBlank(membershipA.getMemberTypeCode()) && !StringUtils.isBlank(membershipB.getMemberTypeCode()) && !StringUtils.isBlank(membershipA.getMemberId()) && !StringUtils.isBlank(membershipB.getMemberId())) {
405 return membershipA.getMemberTypeCode().equals(membershipB.getMemberTypeCode()) && membershipA.getMemberId().equals(membershipB.getMemberId());
406 }
407 return false;
408 }
409
410
411
412
413
414
415
416
417
418 protected boolean sameUniqueMembershipQualifications(KimDocumentRoleMember membershipA, KimDocumentRoleMember membershipB, Set<String> uniqueAttributeIds) {
419 boolean equalSoFar = true;
420 for (String kimAttributeDefinitionId : uniqueAttributeIds) {
421 final KimDocumentRoleQualifier qualifierA = membershipA.getQualifier(kimAttributeDefinitionId);
422 final KimDocumentRoleQualifier qualifierB = membershipB.getQualifier(kimAttributeDefinitionId);
423
424 if (qualifierA != null && qualifierB != null) {
425 equalSoFar &= (qualifierA.getAttrVal() == null && qualifierB.getAttrVal() == null) || (qualifierA.getAttrVal() == null || qualifierA.getAttrVal().equals(qualifierB.getAttrVal()));
426 }
427 }
428 return equalSoFar;
429 }
430
431 protected KimDocumentRoleMember getRoleMemberForDelegation(
432 List<KimDocumentRoleMember> roleMembers, RoleDocumentDelegationMember delegationMember){
433 if(roleMembers==null || delegationMember==null || delegationMember.getRoleMemberId()==null) { return null; }
434 for(KimDocumentRoleMember roleMember: roleMembers){
435 if(delegationMember.getRoleMemberId().equals(roleMember.getRoleMemberId())) {
436 return roleMember;
437 }
438 }
439 return null;
440 }
441
442 protected boolean validateDelegationMemberRoleQualifier(List<KimDocumentRoleMember> roleMembers,
443 List<RoleDocumentDelegationMember> delegationMembers, KimType kimType){
444 Map<String, String> validationErrors = new HashMap<String, String>();
445 boolean valid;
446 int memberCounter = 0;
447 Map<String, String> errorsTemp;
448 Map<String, String> mapToValidate;
449 KimTypeService kimTypeService = KIMServiceLocatorWeb.getKimTypeService(kimType);
450 GlobalVariables.getMessageMap().removeFromErrorPath(KRADConstants.DOCUMENT_PROPERTY_NAME);
451 KimDocumentRoleMember roleMember;
452 String errorPath;
453 final AttributeDefinitionMap attributeDefinitions = kimTypeService.getAttributeDefinitions(kimType.getId());
454 final Set<String> uniqueQualifierAttributes = figureOutUniqueQualificationSetForDelegation(delegationMembers, attributeDefinitions);
455
456 for(RoleDocumentDelegationMember delegationMember: delegationMembers) {
457 errorPath = "delegationMembers["+memberCounter+"]";
458 mapToValidate = attributeValidationHelper.convertQualifiersToMap(delegationMember.getQualifiers());
459 if(!delegationMember.isRole()){
460 errorsTemp = kimTypeService.validateAttributes(kimType.getId(), mapToValidate);
461 validationErrors.putAll(
462 attributeValidationHelper.convertErrorsForMappedFields(errorPath, errorsTemp));
463 }
464 roleMember = getRoleMemberForDelegation(roleMembers, delegationMember);
465 if(roleMember==null){
466 valid = false;
467 GlobalVariables.getMessageMap().putError("document.delegationMembers["+memberCounter+"]", RiceKeyConstants.ERROR_DELEGATE_ROLE_MEMBER_ASSOCIATION, new String[]{});
468 } else{
469 errorsTemp = kimTypeService.validateUnmodifiableAttributes(
470 kimType.getId(),
471 attributeValidationHelper.convertQualifiersToMap(roleMember.getQualifiers()),
472 mapToValidate);
473 validationErrors.putAll(
474 attributeValidationHelper.convertErrorsForMappedFields(errorPath, errorsTemp) );
475 }
476 if (uniqueQualifierAttributes.size() > 0) {
477 validateUniquePersonRoleQualifiersUniqueForRoleDelegation(delegationMember, memberCounter, delegationMembers, uniqueQualifierAttributes, validationErrors);
478 }
479 memberCounter++;
480 }
481 GlobalVariables.getMessageMap().addToErrorPath(KRADConstants.DOCUMENT_PROPERTY_NAME);
482 if (validationErrors.isEmpty()) {
483 valid = true;
484 } else {
485 attributeValidationHelper.moveValidationErrorsToErrorMap(validationErrors);
486 valid = false;
487 }
488 return valid;
489 }
490
491
492
493
494
495
496
497
498 protected Set<String> figureOutUniqueQualificationSetForDelegation(List<RoleDocumentDelegationMember> memberships, AttributeDefinitionMap attributeDefinitions) {
499 Set<String> uniqueAttributeIds = new HashSet<String>();
500
501 if (memberships != null && memberships.size() > 1) {
502 RoleDocumentDelegationMember membership = memberships.get(0);
503
504 for (RoleDocumentDelegationMemberQualifier qualifier : membership.getQualifiers()) {
505 if (qualifier != null && qualifier.getKimAttribute() != null && !StringUtils.isBlank(qualifier.getKimAttribute().getAttributeName())) {
506 final AttributeDefinition relatedDefinition = attributeDefinitions.getByAttributeName(qualifier.getKimAttribute().getAttributeName());
507
508 if (relatedDefinition.getUnique() != null && relatedDefinition.getUnique().booleanValue()) {
509 uniqueAttributeIds.add(qualifier.getKimAttrDefnId());
510 }
511 }
512 }
513 }
514
515 return uniqueAttributeIds;
516 }
517
518
519
520
521
522
523
524
525
526 protected boolean validateUniquePersonRoleQualifiersUniqueForRoleDelegation(RoleDocumentDelegationMember delegationMembershipToCheck, int membershipToCheckIndex, List<RoleDocumentDelegationMember> delegationMemberships, Set<String> uniqueQualifierIds, Map<String, String> validationErrors) {
527 boolean foundError = false;
528 int count = 0;
529
530 for (RoleDocumentDelegationMember delegationMembership : delegationMemberships) {
531 if (membershipToCheckIndex != count) {
532 if (sameDelegationMembership(delegationMembershipToCheck, delegationMembership)) {
533 if (sameUniqueDelegationMembershipQualifications(delegationMembershipToCheck, delegationMembership, uniqueQualifierIds)) {
534 foundError = true;
535
536 int qualifierCount = 0;
537
538 for (RoleDocumentDelegationMemberQualifier qualifier : delegationMembership.getQualifiers()) {
539 if (qualifier != null && uniqueQualifierIds.contains(qualifier.getKimAttrDefnId())) {
540 validationErrors.put("document.delegationMembers["+membershipToCheckIndex+"].qualifiers["+qualifierCount+"].attrVal", RiceKeyConstants.ERROR_DOCUMENT_IDENTITY_MANAGEMENT_PERSON_QUALIFIER_VALUE_NOT_UNIQUE+":"+qualifier.getKimAttribute().getAttributeName()+";"+qualifier.getAttrVal());
541 }
542 qualifierCount += 1;
543 }
544 }
545 }
546 }
547 count += 1;
548 }
549
550 return foundError;
551 }
552
553
554
555
556
557
558
559
560 protected boolean sameDelegationMembership(RoleDocumentDelegationMember membershipA, RoleDocumentDelegationMember membershipB) {
561 if (!StringUtils.isBlank(membershipA.getMemberTypeCode()) && !StringUtils.isBlank(membershipB.getMemberTypeCode()) && !StringUtils.isBlank(membershipA.getMemberId()) && !StringUtils.isBlank(membershipB.getMemberId())) {
562 return membershipA.getMemberTypeCode().equals(membershipB.getMemberTypeCode()) && membershipA.getMemberId().equals(membershipB.getMemberId());
563 }
564 return false;
565 }
566
567
568
569
570
571
572
573
574
575 protected boolean sameUniqueDelegationMembershipQualifications(RoleDocumentDelegationMember membershipA, RoleDocumentDelegationMember membershipB, Set<String> uniqueAttributeIds) {
576 boolean equalSoFar = true;
577 for (String kimAttributeDefinitionId : uniqueAttributeIds) {
578 final RoleDocumentDelegationMemberQualifier qualifierA = membershipA.getQualifier(kimAttributeDefinitionId);
579 final RoleDocumentDelegationMemberQualifier qualifierB = membershipB.getQualifier(kimAttributeDefinitionId);
580
581 if (qualifierA != null && qualifierB != null) {
582 equalSoFar &= (qualifierA.getAttrVal() == null && qualifierB.getAttrVal() == null) || (qualifierA.getAttrVal() == null || qualifierA.getAttrVal().equals(qualifierB.getAttrVal()));
583 }
584 }
585 return equalSoFar;
586 }
587
588 protected boolean validateActiveDate(String errorPath, Timestamp activeFromDate, Timestamp activeToDate) {
589
590 boolean valid = true;
591 if (activeFromDate != null && activeToDate !=null && activeToDate.before(activeFromDate)) {
592 MessageMap errorMap = GlobalVariables.getMessageMap();
593 errorMap.putError(errorPath, RiceKeyConstants.ERROR_ACTIVE_TO_DATE_BEFORE_FROM_DATE);
594 valid = false;
595
596 }
597 return valid;
598 }
599
600
601
602
603
604
605
606
607
608
609 protected boolean checkForCircularRoleMembership(AddMemberEvent addMemberEvent)
610 {
611 KimDocumentRoleMember newMember = addMemberEvent.getMember();
612 if (newMember == null || StringUtils.isBlank(newMember.getMemberId())){
613 MessageMap errorMap = GlobalVariables.getMessageMap();
614 errorMap.putError("member.memberId", RiceKeyConstants.ERROR_INVALID_ROLE, new String[] {""});
615 return false;
616 }
617 Set<String> roleMemberIds = null;
618
619
620 if (newMember.isRole()){
621
622 RoleService roleService = KimApiServiceLocator.getRoleService();
623 roleMemberIds = ((RoleServiceBase) roleService).getRoleTypeRoleMemberIds(newMember.getMemberId());
624
625
626 IdentityManagementRoleDocument document = (IdentityManagementRoleDocument)addMemberEvent.getDocument();
627 if (roleMemberIds.contains(document.getRoleId())){
628 MessageMap errorMap = GlobalVariables.getMessageMap();
629 errorMap.putError("member.memberId", RiceKeyConstants.ERROR_ASSIGN_ROLE_MEMBER_CIRCULAR, new String[] {newMember.getMemberId()});
630 return false;
631 }
632 }
633 return true;
634 }
635
636
637
638
639 public AddResponsibilityRule getAddResponsibilityRule() {
640 if(addResponsibilityRule == null){
641 try {
642 addResponsibilityRule = addResponsibilityRuleClass.newInstance();
643 } catch ( Exception ex ) {
644 throw new RuntimeException( "Unable to create AddResponsibilityRule instance using class: " + addResponsibilityRuleClass, ex );
645 }
646 }
647 return addResponsibilityRule;
648 }
649
650
651
652
653 public AddPermissionRule getAddPermissionRule() {
654 if(addPermissionRule == null){
655 try {
656 addPermissionRule = addPermissionRuleClass.newInstance();
657 } catch ( Exception ex ) {
658 throw new RuntimeException( "Unable to create AddPermissionRule instance using class: " + addPermissionRuleClass, ex );
659 }
660 }
661 return addPermissionRule;
662 }
663
664
665
666
667 public AddMemberRule getAddMemberRule() {
668 if(addMemberRule == null){
669 try {
670 addMemberRule = addMemberRuleClass.newInstance();
671 } catch ( Exception ex ) {
672 throw new RuntimeException( "Unable to create AddMemberRule instance using class: " + addMemberRuleClass, ex );
673 }
674 }
675 return addMemberRule;
676 }
677
678
679
680
681 public AddDelegationRule getAddDelegationRule() {
682 if(addDelegationRule == null){
683 try {
684 addDelegationRule = addDelegationRuleClass.newInstance();
685 } catch ( Exception ex ) {
686 throw new RuntimeException( "Unable to create AddDelegationRule instance using class: " + addDelegationRuleClass, ex );
687 }
688 }
689 return addDelegationRule;
690 }
691
692
693
694
695 public AddDelegationMemberRule getAddDelegationMemberRule() {
696 if(addDelegationMemberRule == null){
697 try {
698 addDelegationMemberRule = addDelegationMemberRuleClass.newInstance();
699 } catch ( Exception ex ) {
700 throw new RuntimeException( "Unable to create AddDelegationMemberRule instance using class: " + addDelegationMemberRuleClass, ex );
701 }
702 }
703 return addDelegationMemberRule;
704 }
705
706 public boolean processAddPermission(AddPermissionEvent addPermissionEvent) {
707 return getAddPermissionRule().processAddPermission(addPermissionEvent);
708 }
709
710 public boolean hasPermissionToGrantPermission(Permission kimPermissionInfo , IdentityManagementRoleDocument document){
711 return getAddPermissionRule().hasPermissionToGrantPermission(kimPermissionInfo, document);
712 }
713
714 public boolean processAddResponsibility(AddResponsibilityEvent addResponsibilityEvent) {
715 return getAddResponsibilityRule().processAddResponsibility(addResponsibilityEvent);
716 }
717
718 public boolean hasPermissionToGrantResponsibility(Responsibility kimResponsibilityInfo, IdentityManagementRoleDocument document) {
719 return getAddResponsibilityRule().hasPermissionToGrantResponsibility(kimResponsibilityInfo, document);
720 }
721
722 public boolean processAddMember(AddMemberEvent addMemberEvent) {
723 boolean success = new KimDocumentMemberRule().processAddMember(addMemberEvent);
724 success &= validateActiveDate("member.activeFromDate", addMemberEvent.getMember().getActiveFromDate(), addMemberEvent.getMember().getActiveToDate());
725 success &= checkForCircularRoleMembership(addMemberEvent);
726 return success;
727 }
728
729 public boolean processAddDelegation(AddDelegationEvent addDelegationEvent) {
730 return getAddDelegationRule().processAddDelegation(addDelegationEvent);
731 }
732
733 public boolean processAddDelegationMember(AddDelegationMemberEvent addDelegationMemberEvent) {
734 boolean success = new RoleDocumentDelegationMemberRule().processAddDelegationMember(addDelegationMemberEvent);
735 RoleDocumentDelegationMember roleDocumentDelegationMember = addDelegationMemberEvent.getDelegationMember();
736 success &= validateActiveDate("delegationMember.activeFromDate", roleDocumentDelegationMember.getActiveFromDate(), roleDocumentDelegationMember.getActiveToDate());
737 return success;
738 }
739
740 public ResponsibilityService getResponsibilityService() {
741 if(responsibilityService == null){
742 responsibilityService = KimApiServiceLocator.getResponsibilityService();
743 }
744 return responsibilityService;
745 }
746
747 public ResponsibilityInternalService getResponsibilityInternalService() {
748 if ( responsibilityInternalService == null ) {
749 responsibilityInternalService = org.kuali.rice.kim.impl.services.KIMServiceLocatorInternal.getResponsibilityInternalService();
750 }
751 return responsibilityInternalService;
752 }
753
754
755
756
757
758 public BusinessObjectService getBusinessObjectService() {
759 if(businessObjectService == null){
760 businessObjectService = KRADServiceLocator.getBusinessObjectService();
761 }
762 return businessObjectService;
763 }
764 }