This is an automated email from the ASF dual-hosted git repository.
ilgrosso pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/syncope.git
The following commit(s) were added to refs/heads/master by this push:
new a17530d572 Requiring more Entitlements to check for Connectors and /
or Resources
a17530d572 is described below
commit a17530d5720404268e51d6e184c1d09130b96eb4
Author: Francesco Chicchiriccò <[email protected]>
AuthorDate: Tue Jul 14 10:54:45 2026 +0200
Requiring more Entitlements to check for Connectors and / or Resources
---
.../wizards/resources/ConnectorDetailsPanel.java | 14 +++++---------
.../wizards/resources/ConnectorWizardBuilder.java | 5 ++---
.../org/apache/syncope/core/logic/ConnectorLogic.java | 4 +++-
.../org/apache/syncope/core/logic/ResourceLogic.java | 4 +++-
.../workflow/java/DefaultUserWorkflowAdapter.java | 19 +++++++++++++------
5 files changed, 26 insertions(+), 20 deletions(-)
diff --git
a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel.java
b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel.java
index 90274ea233..b93fd2ab03 100644
---
a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel.java
+++
b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel.java
@@ -21,7 +21,6 @@ package org.apache.syncope.client.console.wizards.resources;
import java.util.Iterator;
import java.util.List;
import java.util.Optional;
-import java.util.stream.Collectors;
import org.apache.commons.lang3.tuple.Pair;
import org.apache.syncope.client.console.SyncopeWebApplication;
import org.apache.syncope.client.console.commons.RealmsUtils;
@@ -91,8 +90,7 @@ public class ConnectorDetailsPanel extends WizardStep {
"bundleName",
new PropertyModel<>(connInstanceTO, "bundleName"), false);
bundleName.setEnabled(connInstanceTO.getKey() == null ||
connInstanceTO.isErrored());
-
bundleName.setChoices(bundles.stream().map(ConnIdBundle::getBundleName).
- distinct().sorted().collect(Collectors.toList()));
+
bundleName.setChoices(bundles.stream().map(ConnIdBundle::getBundleName).distinct().sorted().toList());
bundleName.getField().setOutputMarkupId(true);
add(bundleName.addRequiredLabel().setOutputMarkupId(true));
@@ -123,7 +121,7 @@ public class ConnectorDetailsPanel extends WizardStep {
List<Pair<String, String>> connectors = bundles.stream().
filter(bundle ->
bundle.getBundleName().equals(connInstanceTO.getBundleName())).
map(bundle -> Pair.of(bundle.getConnectorName(),
bundle.getVersion())).
- toList();
+ toList();
if (connectors.size() == 1) {
Pair<String, String> entry = connectors.getFirst();
@@ -135,11 +133,9 @@ public class ConnectorDetailsPanel extends WizardStep {
version.getField().setModelObject(entry.getRight());
version.setChoices(List.of(entry.getRight()));
} else {
- connectorName.setChoices(connectors.stream().
-
map(Pair::getLeft).distinct().sorted().collect(Collectors.toList()));
+
connectorName.setChoices(connectors.stream().map(Pair::getLeft).distinct().sorted().toList());
- List<String> versions = connectors.stream().
-
map(Pair::getRight).distinct().sorted().collect(Collectors.toList());
+ List<String> versions =
connectors.stream().map(Pair::getRight).distinct().sorted().toList();
version.setChoices(versions);
if (versions.size() == 1) {
@@ -165,7 +161,7 @@ public class ConnectorDetailsPanel extends WizardStep {
List<String> versions = bundles.stream().
filter(bundle ->
bundle.getBundleName().equals(connInstanceTO.getBundleName())
&&
bundle.getConnectorName().equals(connInstanceTO.getConnectorName())).
-
map(ConnIdBundle::getVersion).collect(Collectors.toList());
+ map(ConnIdBundle::getVersion).toList();
if (versions.size() == 1) {
connInstanceTO.setVersion(versions.getFirst());
version.getField().setModelObject(versions.getFirst());
diff --git
a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ConnectorWizardBuilder.java
b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ConnectorWizardBuilder.java
index 7ecef67106..ab627674a4 100644
---
a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ConnectorWizardBuilder.java
+++
b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ConnectorWizardBuilder.java
@@ -21,7 +21,6 @@ package org.apache.syncope.client.console.wizards.resources;
import java.io.Serializable;
import java.net.URI;
import java.util.List;
-import java.util.stream.Collectors;
import org.apache.commons.lang3.tuple.Pair;
import org.apache.syncope.client.console.rest.ConnectorRestClient;
import org.apache.syncope.client.console.topology.TopologyNode;
@@ -53,7 +52,7 @@ public class ConnectorWizardBuilder extends
AbstractResourceWizardBuilder<ConnIn
super(defaultItem, pageRef);
this.bundles = connectorRestClient.getAllBundles().stream().
- filter(object ->
object.getLocation().equals(defaultItem.getLocation())).collect(Collectors.toList());
+ filter(object ->
object.getLocation().equals(defaultItem.getLocation())).toList();
this.connectorRestClient = connectorRestClient;
}
@@ -68,7 +67,7 @@ public class ConnectorWizardBuilder extends
AbstractResourceWizardBuilder<ConnIn
@Override
protected Pair<Boolean, String> check(final AjaxRequestTarget
target) {
ConnInstanceTO connInstanceTO =
ConnInstanceTO.class.cast(modelObject);
- ConnIdBundle bundleTO =
ConnectorWizardBuilder.getBundle(connInstanceTO, bundles);
+ ConnIdBundle bundleTO = getBundle(connInstanceTO, bundles);
connInstanceTO.setConnectorName(bundleTO.getConnectorName());
connInstanceTO.setBundleName(bundleTO.getBundleName());
diff --git
a/core/idm/logic/src/main/java/org/apache/syncope/core/logic/ConnectorLogic.java
b/core/idm/logic/src/main/java/org/apache/syncope/core/logic/ConnectorLogic.java
index 2ebca8fc6c..229919f07f 100644
---
a/core/idm/logic/src/main/java/org/apache/syncope/core/logic/ConnectorLogic.java
+++
b/core/idm/logic/src/main/java/org/apache/syncope/core/logic/ConnectorLogic.java
@@ -240,7 +240,9 @@ public class ConnectorLogic extends
AbstractTransactionalLogic<ConnInstanceTO> {
}).toList();
}
- @PreAuthorize("hasRole('" + IdMEntitlement.CONNECTOR_READ + "')")
+ @PreAuthorize("hasRole('" + IdMEntitlement.CONNECTOR_READ + "') "
+ + "and (hasRole('" + IdMEntitlement.CONNECTOR_CREATE + "') "
+ + "or hasRole('" + IdMEntitlement.CONNECTOR_UPDATE + "'))")
@Transactional(readOnly = true)
public void check(final ConnInstanceTO connInstanceTO) {
if (connInstanceTO.getAdminRealm() == null) {
diff --git
a/core/idm/logic/src/main/java/org/apache/syncope/core/logic/ResourceLogic.java
b/core/idm/logic/src/main/java/org/apache/syncope/core/logic/ResourceLogic.java
index 0bcc4ff406..9346f71f6d 100644
---
a/core/idm/logic/src/main/java/org/apache/syncope/core/logic/ResourceLogic.java
+++
b/core/idm/logic/src/main/java/org/apache/syncope/core/logic/ResourceLogic.java
@@ -421,7 +421,9 @@ public class ResourceLogic extends
AbstractTransactionalLogic<ResourceTO> {
return Pair.of(searchResult, connObjects);
}
- @PreAuthorize("hasRole('" + IdMEntitlement.CONNECTOR_READ + "')")
+ @PreAuthorize("hasRole('" + IdMEntitlement.CONNECTOR_READ + "') "
+ + "and (hasRole('" + IdMEntitlement.CONNECTOR_CREATE + "') "
+ + "or hasRole('" + IdMEntitlement.CONNECTOR_UPDATE + "'))")
@Transactional(readOnly = true)
public void check(final ResourceTO resourceTO) {
ConnInstance connInstance =
connInstanceDAO.findById(resourceTO.getConnector()).
diff --git
a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java
b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java
index 3083fb5423..45878dcdea 100644
---
a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java
+++
b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java
@@ -18,6 +18,7 @@
*/
package org.apache.syncope.core.workflow.java;
+import java.util.Optional;
import org.apache.commons.lang3.tuple.Pair;
import org.apache.syncope.common.keymaster.client.api.ConfParamOps;
import org.apache.syncope.common.keymaster.client.api.StandardConfParams;
@@ -80,11 +81,17 @@ public class DefaultUserWorkflowAdapter extends
AbstractUserWorkflowAdapter {
this.notificationManager = notificationManager;
}
- protected void throwApprovalRequired(final String executor, final boolean
condition) {
- if (!securityProperties.getAdminUser().equals(executor)
+ protected void throwApprovalRequired(final String key, final boolean
condition, final String executor) {
+ if (securityProperties.getAdminUser().equals(executor)) {
+ return;
+ }
+
+ boolean isSelf = securityProperties.getAnonymousUser().equals(executor)
+ ||
Optional.ofNullable(key).flatMap(userDAO::findUsername).map(executor::equals).orElse(false);
+ if (isSelf
+ && condition
&& confParamOps.get(
- AuthContextUtils.getDomain(),
"default.workflow.requires.approval", true, boolean.class)
- && condition) {
+ AuthContextUtils.getDomain(),
"default.workflow.requires.approval", true, boolean.class)) {
throw new WorkflowException(new
UnsupportedOperationException("This operation requires approval"));
}
@@ -98,7 +105,7 @@ public class DefaultUserWorkflowAdapter extends
AbstractUserWorkflowAdapter {
final String creator,
final String context) {
- throwApprovalRequired(creator, userCR.requiresApproval());
+ throwApprovalRequired(null, userCR.requiresApproval(), creator);
User user = entityFactory.newEntity(User.class);
dataBinder.create(user, userCR);
@@ -160,7 +167,7 @@ public class DefaultUserWorkflowAdapter extends
AbstractUserWorkflowAdapter {
protected UserWorkflowResult<Pair<UserUR, Boolean>> doUpdate(
final User user, final UserUR userUR, final String updater, final
String context) {
- throwApprovalRequired(updater, userUR.requiresApproval());
+ throwApprovalRequired(userUR.getKey(), userUR.requiresApproval(),
updater);
UserWorkflowResult.PropagationInfo propInfo = dataBinder.update(user,
userUR);
