This is an automated email from the ASF dual-hosted git repository.
ilgrosso pushed a commit to branch 4_0_X
in repository https://gitbox.apache.org/repos/asf/syncope.git
The following commit(s) were added to refs/heads/4_0_X by this push:
new 31b8b13b93 Requiring more Entitlements to check for Connectors and /
or Resources
31b8b13b93 is described below
commit 31b8b13b9361e4cdcc1b234756bcc3cddefe59cc
Author: Francesco Chicchiriccò <[email protected]>
AuthorDate: Tue Jul 14 10:54:45 2026 +0200
Requiring more Entitlements to check for Connectors and / or Resources
---
.../wizards/resources/ConnectorDetailsPanel.java | 14 +++++---------
.../wizards/resources/ConnectorWizardBuilder.java | 5 ++---
.../org/apache/syncope/core/logic/ConnectorLogic.java | 4 +++-
.../org/apache/syncope/core/logic/ResourceLogic.java | 4 +++-
.../workflow/java/DefaultUserWorkflowAdapter.java | 19 +++++++++++++------
pom.xml | 2 +-
6 files changed, 27 insertions(+), 21 deletions(-)
diff --git
a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel.java
b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel.java
index 90274ea233..b93fd2ab03 100644
---
a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel.java
+++
b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel.java
@@ -21,7 +21,6 @@ package org.apache.syncope.client.console.wizards.resources;
import java.util.Iterator;
import java.util.List;
import java.util.Optional;
-import java.util.stream.Collectors;
import org.apache.commons.lang3.tuple.Pair;
import org.apache.syncope.client.console.SyncopeWebApplication;
import org.apache.syncope.client.console.commons.RealmsUtils;
@@ -91,8 +90,7 @@ public class ConnectorDetailsPanel extends WizardStep {
"bundleName",
new PropertyModel<>(connInstanceTO, "bundleName"), false);
bundleName.setEnabled(connInstanceTO.getKey() == null ||
connInstanceTO.isErrored());
-
bundleName.setChoices(bundles.stream().map(ConnIdBundle::getBundleName).
- distinct().sorted().collect(Collectors.toList()));
+
bundleName.setChoices(bundles.stream().map(ConnIdBundle::getBundleName).distinct().sorted().toList());
bundleName.getField().setOutputMarkupId(true);
add(bundleName.addRequiredLabel().setOutputMarkupId(true));
@@ -123,7 +121,7 @@ public class ConnectorDetailsPanel extends WizardStep {
List<Pair<String, String>> connectors = bundles.stream().
filter(bundle ->
bundle.getBundleName().equals(connInstanceTO.getBundleName())).
map(bundle -> Pair.of(bundle.getConnectorName(),
bundle.getVersion())).
- toList();
+ toList();
if (connectors.size() == 1) {
Pair<String, String> entry = connectors.getFirst();
@@ -135,11 +133,9 @@ public class ConnectorDetailsPanel extends WizardStep {
version.getField().setModelObject(entry.getRight());
version.setChoices(List.of(entry.getRight()));
} else {
- connectorName.setChoices(connectors.stream().
-
map(Pair::getLeft).distinct().sorted().collect(Collectors.toList()));
+
connectorName.setChoices(connectors.stream().map(Pair::getLeft).distinct().sorted().toList());
- List<String> versions = connectors.stream().
-
map(Pair::getRight).distinct().sorted().collect(Collectors.toList());
+ List<String> versions =
connectors.stream().map(Pair::getRight).distinct().sorted().toList();
version.setChoices(versions);
if (versions.size() == 1) {
@@ -165,7 +161,7 @@ public class ConnectorDetailsPanel extends WizardStep {
List<String> versions = bundles.stream().
filter(bundle ->
bundle.getBundleName().equals(connInstanceTO.getBundleName())
&&
bundle.getConnectorName().equals(connInstanceTO.getConnectorName())).
-
map(ConnIdBundle::getVersion).collect(Collectors.toList());
+ map(ConnIdBundle::getVersion).toList();
if (versions.size() == 1) {
connInstanceTO.setVersion(versions.getFirst());
version.getField().setModelObject(versions.getFirst());
diff --git
a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ConnectorWizardBuilder.java
b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ConnectorWizardBuilder.java
index 7ecef67106..ab627674a4 100644
---
a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ConnectorWizardBuilder.java
+++
b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ConnectorWizardBuilder.java
@@ -21,7 +21,6 @@ package org.apache.syncope.client.console.wizards.resources;
import java.io.Serializable;
import java.net.URI;
import java.util.List;
-import java.util.stream.Collectors;
import org.apache.commons.lang3.tuple.Pair;
import org.apache.syncope.client.console.rest.ConnectorRestClient;
import org.apache.syncope.client.console.topology.TopologyNode;
@@ -53,7 +52,7 @@ public class ConnectorWizardBuilder extends
AbstractResourceWizardBuilder<ConnIn
super(defaultItem, pageRef);
this.bundles = connectorRestClient.getAllBundles().stream().
- filter(object ->
object.getLocation().equals(defaultItem.getLocation())).collect(Collectors.toList());
+ filter(object ->
object.getLocation().equals(defaultItem.getLocation())).toList();
this.connectorRestClient = connectorRestClient;
}
@@ -68,7 +67,7 @@ public class ConnectorWizardBuilder extends
AbstractResourceWizardBuilder<ConnIn
@Override
protected Pair<Boolean, String> check(final AjaxRequestTarget
target) {
ConnInstanceTO connInstanceTO =
ConnInstanceTO.class.cast(modelObject);
- ConnIdBundle bundleTO =
ConnectorWizardBuilder.getBundle(connInstanceTO, bundles);
+ ConnIdBundle bundleTO = getBundle(connInstanceTO, bundles);
connInstanceTO.setConnectorName(bundleTO.getConnectorName());
connInstanceTO.setBundleName(bundleTO.getBundleName());
diff --git
a/core/idm/logic/src/main/java/org/apache/syncope/core/logic/ConnectorLogic.java
b/core/idm/logic/src/main/java/org/apache/syncope/core/logic/ConnectorLogic.java
index b8cad8e358..97dce4454b 100644
---
a/core/idm/logic/src/main/java/org/apache/syncope/core/logic/ConnectorLogic.java
+++
b/core/idm/logic/src/main/java/org/apache/syncope/core/logic/ConnectorLogic.java
@@ -239,7 +239,9 @@ public class ConnectorLogic extends
AbstractTransactionalLogic<ConnInstanceTO> {
}).toList();
}
- @PreAuthorize("hasRole('" + IdMEntitlement.CONNECTOR_READ + "')")
+ @PreAuthorize("hasRole('" + IdMEntitlement.CONNECTOR_READ + "') "
+ + "and (hasRole('" + IdMEntitlement.CONNECTOR_CREATE + "') "
+ + "or hasRole('" + IdMEntitlement.CONNECTOR_UPDATE + "'))")
@Transactional(readOnly = true)
public void check(final ConnInstanceTO connInstanceTO) {
if (connInstanceTO.getAdminRealm() == null) {
diff --git
a/core/idm/logic/src/main/java/org/apache/syncope/core/logic/ResourceLogic.java
b/core/idm/logic/src/main/java/org/apache/syncope/core/logic/ResourceLogic.java
index c2c683b5ef..d0cc8b7fcf 100644
---
a/core/idm/logic/src/main/java/org/apache/syncope/core/logic/ResourceLogic.java
+++
b/core/idm/logic/src/main/java/org/apache/syncope/core/logic/ResourceLogic.java
@@ -427,7 +427,9 @@ public class ResourceLogic extends
AbstractTransactionalLogic<ResourceTO> {
return Pair.of(searchResult, connObjects);
}
- @PreAuthorize("hasRole('" + IdMEntitlement.CONNECTOR_READ + "')")
+ @PreAuthorize("hasRole('" + IdMEntitlement.CONNECTOR_READ + "') "
+ + "and (hasRole('" + IdMEntitlement.CONNECTOR_CREATE + "') "
+ + "or hasRole('" + IdMEntitlement.CONNECTOR_UPDATE + "'))")
@Transactional(readOnly = true)
public void check(final ResourceTO resourceTO) {
ConnInstance connInstance =
connInstanceDAO.findById(resourceTO.getConnector()).
diff --git
a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java
b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java
index 9b36a8021b..49656a9287 100644
---
a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java
+++
b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java
@@ -18,6 +18,7 @@
*/
package org.apache.syncope.core.workflow.java;
+import java.util.Optional;
import org.apache.commons.lang3.tuple.Pair;
import org.apache.syncope.common.keymaster.client.api.ConfParamOps;
import org.apache.syncope.common.lib.request.PasswordPatch;
@@ -79,11 +80,17 @@ public class DefaultUserWorkflowAdapter extends
AbstractUserWorkflowAdapter {
this.notificationManager = notificationManager;
}
- protected void throwApprovalRequired(final String executor, final boolean
condition) {
- if (!securityProperties.getAdminUser().equals(executor)
+ protected void throwApprovalRequired(final String key, final boolean
condition, final String executor) {
+ if (securityProperties.getAdminUser().equals(executor)) {
+ return;
+ }
+
+ boolean isSelf = securityProperties.getAnonymousUser().equals(executor)
+ ||
Optional.ofNullable(key).flatMap(userDAO::findUsername).map(executor::equals).orElse(false);
+ if (isSelf
+ && condition
&& confParamOps.get(
- AuthContextUtils.getDomain(),
"default.workflow.requires.approval", true, boolean.class)
- && condition) {
+ AuthContextUtils.getDomain(),
"default.workflow.requires.approval", true, boolean.class)) {
throw new WorkflowException(new
UnsupportedOperationException("This operation requires approval"));
}
@@ -97,7 +104,7 @@ public class DefaultUserWorkflowAdapter extends
AbstractUserWorkflowAdapter {
final String creator,
final String context) {
- throwApprovalRequired(creator, userCR.requiresApproval());
+ throwApprovalRequired(null, userCR.requiresApproval(), creator);
User user = entityFactory.newEntity(User.class);
dataBinder.create(user, userCR);
@@ -159,7 +166,7 @@ public class DefaultUserWorkflowAdapter extends
AbstractUserWorkflowAdapter {
protected UserWorkflowResult<Pair<UserUR, Boolean>> doUpdate(
final User user, final UserUR userUR, final String updater, final
String context) {
- throwApprovalRequired(updater, userUR.requiresApproval());
+ throwApprovalRequired(userUR.getKey(), userUR.requiresApproval(),
updater);
UserWorkflowResult.PropagationInfo propInfo = dataBinder.update(user,
userUR);
diff --git a/pom.xml b/pom.xml
index 42440adcd3..19ce77a904 100644
--- a/pom.xml
+++ b/pom.xml
@@ -432,7 +432,7 @@ under the License.
<connid.ldup.version>0.1.0</connid.ldup.version>
<cxf.version>4.1.7</cxf.version>
- <bouncycastle.version>1.84</bouncycastle.version>
+ <bouncycastle.version>1.85</bouncycastle.version>
<nimbus-jose-jwt.version>10.9.1</nimbus-jose-jwt.version>
<spring-framework.version>6.2.19</spring-framework.version>
