Skip to content

Commit 8a3e5b2

Browse files
ilgrossoilgrosso
committed
Ensuring permissions during Realm update
1 parent 2161ac0 commit 8a3e5b2

20 files changed

Lines changed: 139 additions & 96 deletions

‎core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/RealmLogic.java‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -143,7 +143,7 @@ public Page<RealmTO> search(
143143
getOrDefault(IdRepoEntitlement.REALM_SEARCH, Set.of());
144144
List<RealmTO> result = realmSearchDAO.search(baseRealms, effectiveCond, pageable).stream().
145145
map(realm -> binder.getRealmTO(
146-
realm, RealmUtils.SubtreePredicate.of(authorizations).test(realm.getFullPath()))).
146+
realm, RealmUtils.SubtreePredicate.of(authorizations).test(realm.getFullPath()))).
147147
sorted(Comparator.comparing(RealmTO::getFullPath)).
148148
toList();
149149

@@ -204,6 +204,9 @@ public ProvisioningResult<RealmTO> update(final RealmTO realmTO) {
204204
PropagationByResource<String> propByRes = binder.update(realm, realmTO);
205205
realm = realmDAO.save(realm);
206206

207+
// ensure that requester's administration rights are still valid
208+
securityChecks(AuthContextUtils.getAuthorizations().get(IdRepoEntitlement.REALM_UPDATE), realm.getFullPath());
209+
207210
List<PropagationTaskInfo> taskInfos = propagationManager.setAttributeDeltas(
208211
propagationManager.createTasks(realm, propByRes, null),
209212
beforeAttrs);

‎fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -232,6 +232,8 @@ public void initialize(final ConfigurableApplicationContext ctx) {
232232

233233
protected static final String ADMIN_PWD = "password";
234234

235+
protected static final String DEFAULT_PASSWORD = "password123";
236+
235237
protected static final String ADDRESS = "http://localhost:9080/syncope/rest";
236238

237239
protected static final String BUILD_TOOLS_ADDRESS = "http://localhost:9080/syncope-fit-build-tools/cxf";

‎fit/core-reference/src/test/java/org/apache/syncope/fit/core/AuthenticationITCase.java‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -125,7 +125,7 @@ public void userSchemaAuthorization() {
125125
assertNotNull(schemaTO);
126126

127127
// 4. read the schema created above (as user) - success
128-
SchemaService schemaService2 = CLIENT_FACTORY.create(userTO.getUsername(), "password123").
128+
SchemaService schemaService2 = CLIENT_FACTORY.create(userTO.getUsername(), DEFAULT_PASSWORD).
129129
getService(SchemaService.class);
130130
schemaTO = schemaService2.read(SchemaType.PLAIN, schemaName);
131131
assertNotNull(schemaTO);
@@ -149,7 +149,7 @@ public void userRead() {
149149
UserTO userTO = createUser(userCR).getEntity();
150150
assertNotNull(userTO);
151151

152-
UserService userService2 = CLIENT_FACTORY.create(userTO.getUsername(), "password123").
152+
UserService userService2 = CLIENT_FACTORY.create(userTO.getUsername(), DEFAULT_PASSWORD).
153153
getService(UserService.class);
154154

155155
UserTO readUserTO = userService2.read("1417acbe-cbf6-4277-9372-e75e04f97000");
@@ -176,7 +176,7 @@ public void userSearch() {
176176

177177
// 1. user assigned to role 1, with search entitlement on realms /odd and /even: won't find anything with
178178
// root realm
179-
UserService userService2 = CLIENT_FACTORY.create(userTO.getUsername(), "password123").
179+
UserService userService2 = CLIENT_FACTORY.create(userTO.getUsername(), DEFAULT_PASSWORD).
180180
getService(UserService.class);
181181

182182
if (IS_EXT_SEARCH_ENABLED) {
@@ -233,7 +233,7 @@ public void delegatedUserCRUD() {
233233

234234
// 3. instantiate a delegate user service client, for further operations
235235
UserService delegatedUserService =
236-
CLIENT_FACTORY.create(delegatedAdmin.getUsername(), "password123").getService(UserService.class);
236+
CLIENT_FACTORY.create(delegatedAdmin.getUsername(), DEFAULT_PASSWORD).getService(UserService.class);
237237

238238
// 4. as delegated, create user under realm / -> fail
239239
UserCR userCR = UserITCase.getUniqueSample("delegated@syncope.apache.org");
@@ -307,7 +307,7 @@ public void checkFailedLogins() {
307307
assertNotNull(userTO);
308308
String userKey = userTO.getKey();
309309

310-
UserService userService2 = CLIENT_FACTORY.create(userTO.getUsername(), "password123").
310+
UserService userService2 = CLIENT_FACTORY.create(userTO.getUsername(), DEFAULT_PASSWORD).
311311
getService(UserService.class);
312312
assertEquals(0, userService2.read(userKey).getFailedLogins());
313313

@@ -326,7 +326,7 @@ public void checkFailedLogins() {
326326
}
327327
assertEquals(2, USER_SERVICE.read(userKey).getFailedLogins());
328328

329-
UserService userService4 = CLIENT_FACTORY.create(userTO.getUsername(), "password123").
329+
UserService userService4 = CLIENT_FACTORY.create(userTO.getUsername(), DEFAULT_PASSWORD).
330330
getService(UserService.class);
331331
assertEquals(0, userService4.read(userKey).getFailedLogins());
332332
}
@@ -380,7 +380,7 @@ public void checkUserSuspension() {
380380

381381
// Access with correct credentials should fail as user is suspended
382382
try {
383-
CLIENT_FACTORY.create(userTO.getUsername(), "password123");
383+
CLIENT_FACTORY.create(userTO.getUsername(), DEFAULT_PASSWORD);
384384
fail("This should not happen");
385385
} catch (NotAuthorizedException e) {
386386
assertNotNull(e);
@@ -392,7 +392,7 @@ public void checkUserSuspension() {
392392
assertNotNull(userTO);
393393
assertEquals("active", userTO.getStatus());
394394

395-
SyncopeClient goodPwdClient = CLIENT_FACTORY.create(userTO.getUsername(), "password123");
395+
SyncopeClient goodPwdClient = CLIENT_FACTORY.create(userTO.getUsername(), DEFAULT_PASSWORD);
396396
assertEquals(0, goodPwdClient.self().user().getFailedLogins().intValue());
397397
}
398398

@@ -579,7 +579,7 @@ public void issueSYNCOPE434() {
579579

580580
// 2. try to authenticate: fail
581581
try {
582-
CLIENT_FACTORY.create(userTO.getUsername(), "password123").self();
582+
CLIENT_FACTORY.create(userTO.getUsername(), DEFAULT_PASSWORD).self();
583583
fail("This should not happen");
584584
} catch (NotAuthorizedException e) {
585585
assertNotNull(e);
@@ -596,7 +596,7 @@ public void issueSYNCOPE434() {
596596
assertEquals("active", userTO.getStatus());
597597

598598
// 4. try to authenticate again: success
599-
SyncopeClient.Self self = CLIENT_FACTORY.create(userTO.getUsername(), "password123").self();
599+
SyncopeClient.Self self = CLIENT_FACTORY.create(userTO.getUsername(), DEFAULT_PASSWORD).self();
600600
assertNotNull(self);
601601
assertNotNull(self.entitlements());
602602
assertEquals(List.of(), self.delegations());
@@ -608,7 +608,7 @@ public void issueSYNCOPE164() throws Exception {
608608
// 1. create user with db resource
609609
UserCR userCR = UserITCase.getUniqueSample("syncope164@syncope.apache.org");
610610
userCR.setRealm("/even/two");
611-
userCR.setPassword("password123");
611+
userCR.setPassword(DEFAULT_PASSWORD);
612612
userCR.getResources().add(RESOURCE_NAME_TESTDB);
613613
UserTO user = createUser(userCR).getEntity();
614614
assertNotNull(user);
@@ -629,10 +629,12 @@ public void issueSYNCOPE164() throws Exception {
629629
JdbcTemplate jdbcTemplate = new JdbcTemplate(testDataSource);
630630
String value = queryForObject(jdbcTemplate, MAX_WAIT_SECONDS,
631631
"SELECT PASSWORD FROM test WHERE ID=?", String.class, user.getUsername());
632-
assertEquals(encryptorManager.getInstance().encode("password123", CipherAlgorithm.SHA1), value.toUpperCase());
632+
assertEquals(
633+
encryptorManager.getInstance().encode(DEFAULT_PASSWORD, CipherAlgorithm.SHA1),
634+
value.toUpperCase());
633635

634636
// 5. successfully authenticate with old (on db resource) and new (on internal storage) password values
635-
SyncopeClient.Self self = CLIENT_FACTORY.create(user.getUsername(), "password123").self();
637+
SyncopeClient.Self self = CLIENT_FACTORY.create(user.getUsername(), DEFAULT_PASSWORD).self();
636638
assertNotNull(self);
637639
self = CLIENT_FACTORY.create(user.getUsername(), "password234").self();
638640
assertNotNull(self);

‎fit/core-reference/src/test/java/org/apache/syncope/fit/core/DelegationITCase.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -155,7 +155,7 @@ public void crudAsUser() {
155155
delegation.setDelegated(delegated.getKey());
156156
delegation.setStart(OffsetDateTime.now());
157157

158-
DelegationService uds = CLIENT_FACTORY.create(delegating.getUsername(), "password123").
158+
DelegationService uds = CLIENT_FACTORY.create(delegating.getUsername(), DEFAULT_PASSWORD).
159159
getService(DelegationService.class);
160160

161161
// delegating user is not requesting user -> FAIL

‎fit/core-reference/src/test/java/org/apache/syncope/fit/core/ExceptionMapperITCase.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ public void uniqueSchemaConstraint() {
7979
userTO1.getAuxClasses().add(typeClass.getKey());
8080
String userId1 = getUUIDString() + "issue654_1@syncope.apache.org";
8181
userTO1.setUsername(userId1);
82-
userTO1.setPassword("password123");
82+
userTO1.setPassword(DEFAULT_PASSWORD);
8383

8484
userTO1.getPlainAttrs().add(attr("userId", userId1));
8585
userTO1.getPlainAttrs().add(attr("fullname", userId1));
@@ -94,7 +94,7 @@ public void uniqueSchemaConstraint() {
9494
userTO2.getAuxClasses().add(typeClass.getKey());
9595
String userId2 = getUUIDString() + "issue654_2@syncope.apache.org";
9696
userTO2.setUsername(userId2);
97-
userTO2.setPassword("password123");
97+
userTO2.setPassword(DEFAULT_PASSWORD);
9898

9999
userTO2.getPlainAttrs().add(attr("userId", userId2));
100100
userTO2.getPlainAttrs().add(attr("fullname", userId2));
@@ -140,7 +140,7 @@ public void headersMultiValue() {
140140
userCR.setRealm(SyncopeConstants.ROOT_REALM);
141141
String userId = getUUIDString() + "issue654@syncope.apache.org";
142142
userCR.setUsername(userId);
143-
userCR.setPassword("password123");
143+
userCR.setPassword(DEFAULT_PASSWORD);
144144

145145
userCR.getPlainAttrs().add(attr("userId", "issue654"));
146146
userCR.getPlainAttrs().add(attr("fullname", userId));

‎fit/core-reference/src/test/java/org/apache/syncope/fit/core/JWTITCase.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -494,7 +494,7 @@ public void issueSYNCOPE1420() throws ParseException {
494494

495495
// login, get JWT with expiration
496496
SyncopeClient.JwtInfo jwtInfo =
497-
CLIENT_FACTORY.create(user.getUsername(), "password123").jwtInfo().orElseThrow();
497+
CLIENT_FACTORY.create(user.getUsername(), DEFAULT_PASSWORD).jwtInfo().orElseThrow();
498498

499499
Date expiration = SignedJWT.parse(jwtInfo.value()).getJWTClaimsSet().getExpirationTime();
500500
assertNotNull(expiration);
@@ -512,7 +512,7 @@ public void issueSYNCOPE1420() throws ParseException {
512512

513513
// login again, get new JWT
514514
// (even if ExpiredAccessTokenCleanup did not run yet, as it is scheduled every 5 minutes)
515-
String newJWT = CLIENT_FACTORY.create(user.getUsername(), "password123").jwtInfo().orElseThrow().value();
515+
String newJWT = CLIENT_FACTORY.create(user.getUsername(), DEFAULT_PASSWORD).jwtInfo().orElseThrow().value();
516516
assertNotEquals(jwtInfo.value(), newJWT);
517517
} finally {
518518
confParamOps.set(SyncopeConstants.MASTER_DOMAIN, "jwt.lifetime.minutes", orig);

‎fit/core-reference/src/test/java/org/apache/syncope/fit/core/KeymasterITCase.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -267,7 +267,7 @@ public void domainCRUD() throws Exception {
267267

268268
Response response = USER_SERVICE.create(
269269
new UserCR.Builder(SyncopeConstants.ROOT_REALM, "monteverdi").
270-
password("password123").
270+
password(DEFAULT_PASSWORD).
271271
plainAttr(attr("email", "monteverdi@syncope.apache.org")).
272272
build());
273273
assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatus());

‎fit/core-reference/src/test/java/org/apache/syncope/fit/core/LinkedAccountITCase.java‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -183,7 +183,7 @@ public void createWithoutLinkedAccountThenAdd() {
183183

184184
LinkedAccountTO account = new LinkedAccountTO.Builder(RESOURCE_NAME_LDAP, connObjectKeyValue).build();
185185
account.getPlainAttrs().add(attr("surname", "LINKED_SURNAME"));
186-
account.setPassword("Password123");
186+
account.setPassword(DEFAULT_PASSWORD);
187187
userUR.getLinkedAccounts().add(new LinkedAccountUR.Builder().linkedAccountTO(account).build());
188188

189189
user = updateUser(userUR).getEntity();
@@ -233,7 +233,7 @@ public void createWithoutLinkedAccountThenAddAndUpdatePassword() {
233233
assertNull(user.getLinkedAccounts().getFirst().getPassword());
234234

235235
// 4. update linked account with adding a password
236-
account.setPassword("Password123");
236+
account.setPassword(DEFAULT_PASSWORD);
237237
userUR = new UserUR();
238238
userUR.setKey(user.getKey());
239239
userUR.getLinkedAccounts().add(new LinkedAccountUR.Builder().linkedAccountTO(account).build());
@@ -255,7 +255,7 @@ public void createWithoutLinkedAccountThenAddAndUpdatePassword() {
255255
forEach(task -> TASK_SERVICE.delete(TaskType.PROPAGATION, task.getKey()));
256256

257257
// set a correct password
258-
account.setPassword("Password123");
258+
account.setPassword(DEFAULT_PASSWORD);
259259
user = updateUser(userUR).getEntity();
260260
assertNotNull(user.getLinkedAccounts().getFirst().getPassword());
261261

@@ -479,7 +479,7 @@ public void pull() {
479479

480480
ObjectNode user = JSON_MAPPER.createObjectNode();
481481
user.put("username", "linkedaccount1");
482-
user.put("password", "Password123");
482+
user.put("password", DEFAULT_PASSWORD);
483483
user.put("firstName", "Pasquale");
484484
user.put("surname", "Vivaldi");
485485
user.put("email", "vivaldi@syncope.org");
@@ -491,7 +491,7 @@ public void pull() {
491491

492492
user = JSON_MAPPER.createObjectNode();
493493
user.put("username", "vivaldi");
494-
user.put("password", "Password123");
494+
user.put("password", DEFAULT_PASSWORD);
495495
user.put("firstName", "Giovannino");
496496
user.put("surname", "Vivaldi");
497497
user.put("email", "vivaldi@syncope.org");
@@ -503,7 +503,7 @@ public void pull() {
503503

504504
user = JSON_MAPPER.createObjectNode();
505505
user.put("username", "not.vivaldi");
506-
user.put("password", "Password123");
506+
user.put("password", DEFAULT_PASSWORD);
507507
user.put("email", "not.vivaldi@syncope.org");
508508

509509
response = webClient.post(user.toString());

‎fit/core-reference/src/test/java/org/apache/syncope/fit/core/MacroTaskITCase.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -265,7 +265,7 @@ public void cantExecute() {
265265

266266
// 3. attempt to run the macro task -> fail
267267
TaskService taskService = CLIENT_FACTORY.create(
268-
userTO.getUsername(), "password123").getService(TaskService.class);
268+
userTO.getUsername(), DEFAULT_PASSWORD).getService(TaskService.class);
269269
try {
270270
taskService.execute(new ExecSpecs.Builder().key(MACRO_TASK_KEY).build());
271271
fail();

‎fit/core-reference/src/test/java/org/apache/syncope/fit/core/PullTaskITCase.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -264,7 +264,7 @@ public void fromCSV() throws Exception {
264264
// -----------------------------
265265
UserCR inUserRC = new UserCR();
266266
inUserRC.setRealm(SyncopeConstants.ROOT_REALM);
267-
inUserRC.setPassword("password123");
267+
inUserRC.setPassword(DEFAULT_PASSWORD);
268268
String userName = "test9";
269269
inUserRC.setUsername(userName);
270270
inUserRC.getPlainAttrs().add(attr("firstname", "nome9"));
@@ -1029,7 +1029,7 @@ public void issueSYNCOPE68() {
10291029
//-----------------------------
10301030
UserCR userCR = new UserCR();
10311031
userCR.setRealm(SyncopeConstants.ROOT_REALM);
1032-
userCR.setPassword("password123");
1032+
userCR.setPassword(DEFAULT_PASSWORD);
10331033
userCR.setUsername("testuser2");
10341034

10351035
userCR.getPlainAttrs().add(attr("firstname", "testuser2"));

0 commit comments

Comments
 (0)