Requiring more Entitlements to check for Connectors and / or Resources

Author: ilgrosso

client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel.java

@@ -21,7 +21,6 @@
 import java.util.Iterator;
 import java.util.List;
 import java.util.Optional;
-import java.util.stream.Collectors;
 import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.client.console.SyncopeWebApplication;
 import org.apache.syncope.client.console.commons.RealmsUtils;
@@ -91,8 +90,7 @@ protected Iterator<String> getChoices(final String input) {
                 "bundleName",
                 new PropertyModel<>(connInstanceTO, "bundleName"), false);
         bundleName.setEnabled(connInstanceTO.getKey() == null || connInstanceTO.isErrored());
-        bundleName.setChoices(bundles.stream().map(ConnIdBundle::getBundleName).
-                distinct().sorted().collect(Collectors.toList()));
+        bundleName.setChoices(bundles.stream().map(ConnIdBundle::getBundleName).distinct().sorted().toList());
         bundleName.getField().setOutputMarkupId(true);
         add(bundleName.addRequiredLabel().setOutputMarkupId(true));
 
@@ -123,7 +121,7 @@ protected void onUpdate(final AjaxRequestTarget target) {
                 List<Pair<String, String>> connectors = bundles.stream().
                         filter(bundle -> bundle.getBundleName().equals(connInstanceTO.getBundleName())).
                         map(bundle -> Pair.of(bundle.getConnectorName(), bundle.getVersion())).
-                    toList();
+                        toList();
                 if (connectors.size() == 1) {
                     Pair<String, String> entry = connectors.getFirst();
 
@@ -135,11 +133,9 @@ protected void onUpdate(final AjaxRequestTarget target) {
                     version.getField().setModelObject(entry.getRight());
                     version.setChoices(List.of(entry.getRight()));
                 } else {
-                    connectorName.setChoices(connectors.stream().
-                            map(Pair::getLeft).distinct().sorted().collect(Collectors.toList()));
+                    connectorName.setChoices(connectors.stream().map(Pair::getLeft).distinct().sorted().toList());
 
-                    List<String> versions = connectors.stream().
-                            map(Pair::getRight).distinct().sorted().collect(Collectors.toList());
+                    List<String> versions = connectors.stream().map(Pair::getRight).distinct().sorted().toList();
                     version.setChoices(versions);
 
                     if (versions.size() == 1) {
@@ -165,7 +161,7 @@ protected void onUpdate(final AjaxRequestTarget target) {
                 List<String> versions = bundles.stream().
                         filter(bundle -> bundle.getBundleName().equals(connInstanceTO.getBundleName())
                         && bundle.getConnectorName().equals(connInstanceTO.getConnectorName())).
-                        map(ConnIdBundle::getVersion).collect(Collectors.toList());
+                        map(ConnIdBundle::getVersion).toList();
                 if (versions.size() == 1) {
                     connInstanceTO.setVersion(versions.getFirst());
                     version.getField().setModelObject(versions.getFirst());

client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ConnectorWizardBuilder.java

@@ -21,7 +21,6 @@
 import java.io.Serializable;
 import java.net.URI;
 import java.util.List;
-import java.util.stream.Collectors;
 import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.client.console.rest.ConnectorRestClient;
 import org.apache.syncope.client.console.topology.TopologyNode;
@@ -53,7 +52,7 @@ public ConnectorWizardBuilder(
         super(defaultItem, pageRef);
 
         this.bundles = connectorRestClient.getAllBundles().stream().
-                filter(object -> object.getLocation().equals(defaultItem.getLocation())).collect(Collectors.toList());
+                filter(object -> object.getLocation().equals(defaultItem.getLocation())).toList();
         this.connectorRestClient = connectorRestClient;
     }
 
@@ -68,7 +67,7 @@ protected WizardModel buildModelSteps(final Serializable modelObject, final Wiza
             @Override
             protected Pair<Boolean, String> check(final AjaxRequestTarget target) {
                 ConnInstanceTO connInstanceTO = ConnInstanceTO.class.cast(modelObject);
-                ConnIdBundle bundleTO = ConnectorWizardBuilder.getBundle(connInstanceTO, bundles);
+                ConnIdBundle bundleTO = getBundle(connInstanceTO, bundles);
 
                 connInstanceTO.setConnectorName(bundleTO.getConnectorName());
                 connInstanceTO.setBundleName(bundleTO.getBundleName());

core/idm/logic/src/main/java/org/apache/syncope/core/logic/ConnectorLogic.java

@@ -239,7 +239,9 @@ public List<ConnIdObjectClass> buildObjectClassInfo(
         }).toList();
     }
 
-    @PreAuthorize("hasRole('" + IdMEntitlement.CONNECTOR_READ + "')")
+    @PreAuthorize("hasRole('" + IdMEntitlement.CONNECTOR_READ + "') "
+            + "and (hasRole('" + IdMEntitlement.CONNECTOR_CREATE + "') "
+            + "or hasRole('" + IdMEntitlement.CONNECTOR_UPDATE + "'))")
     @Transactional(readOnly = true)
     public void check(final ConnInstanceTO connInstanceTO) {
         if (connInstanceTO.getAdminRealm() == null) {

core/idm/logic/src/main/java/org/apache/syncope/core/logic/ResourceLogic.java

@@ -427,7 +427,9 @@ public void handleResult(final SearchResult sr) {
         return Pair.of(searchResult, connObjects);
     }
 
-    @PreAuthorize("hasRole('" + IdMEntitlement.CONNECTOR_READ + "')")
+    @PreAuthorize("hasRole('" + IdMEntitlement.CONNECTOR_READ + "') "
+            + "and (hasRole('" + IdMEntitlement.CONNECTOR_CREATE + "') "
+            + "or hasRole('" + IdMEntitlement.CONNECTOR_UPDATE + "'))")
     @Transactional(readOnly = true)
     public void check(final ResourceTO resourceTO) {
         ConnInstance connInstance = connInstanceDAO.findById(resourceTO.getConnector()).

core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java

@@ -18,6 +18,7 @@
  */
 package org.apache.syncope.core.workflow.java;
 
+import java.util.Optional;
 import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.keymaster.client.api.ConfParamOps;
 import org.apache.syncope.common.lib.request.PasswordPatch;
@@ -79,11 +80,17 @@ public DefaultUserWorkflowAdapter(
         this.notificationManager = notificationManager;
     }
 
-    protected void throwApprovalRequired(final String executor, final boolean condition) {
-        if (!securityProperties.getAdminUser().equals(executor)
+    protected void throwApprovalRequired(final String key, final boolean condition, final String executor) {
+        if (securityProperties.getAdminUser().equals(executor)) {
+            return;
+        }
+
+        boolean isSelf = securityProperties.getAnonymousUser().equals(executor)
+                || Optional.ofNullable(key).flatMap(userDAO::findUsername).map(executor::equals).orElse(false);
+        if (isSelf
+                && condition
                 && confParamOps.get(
-                        AuthContextUtils.getDomain(), "default.workflow.requires.approval", true, boolean.class)
-                && condition) {
+                        AuthContextUtils.getDomain(), "default.workflow.requires.approval", true, boolean.class)) {
 
             throw new WorkflowException(new UnsupportedOperationException("This operation requires approval"));
         }
@@ -97,7 +104,7 @@ protected UserWorkflowResult<Pair<String, Boolean>> doCreate(
             final String creator,
             final String context) {
 
-        throwApprovalRequired(creator, userCR.requiresApproval());
+        throwApprovalRequired(null, userCR.requiresApproval(), creator);
 
         User user = entityFactory.newEntity(User.class);
         dataBinder.create(user, userCR);
@@ -159,7 +166,7 @@ protected UserWorkflowResult<String> doActivate(
     protected UserWorkflowResult<Pair<UserUR, Boolean>> doUpdate(
             final User user, final UserUR userUR, final String updater, final String context) {
 
-        throwApprovalRequired(updater, userUR.requiresApproval());
+        throwApprovalRequired(userUR.getKey(), userUR.requiresApproval(), updater);
 
         UserWorkflowResult.PropagationInfo propInfo = dataBinder.update(user, userUR);
 

pom.xml

@@ -432,7 +432,7 @@ under the License.
     <connid.ldup.version>0.1.0</connid.ldup.version>
 
     <cxf.version>4.1.7</cxf.version>
-    <bouncycastle.version>1.84</bouncycastle.version>
+    <bouncycastle.version>1.85</bouncycastle.version>
     <nimbus-jose-jwt.version>10.9.1</nimbus-jose-jwt.version>
 
     <spring-framework.version>6.2.19</spring-framework.version>