-
Notifications
You must be signed in to change notification settings - Fork 66
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Introduce pre add user validations for email domain discovery feature
- Loading branch information
Showing
9 changed files
with
230 additions
and
2 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
28 changes: 28 additions & 0 deletions
28
.../org/wso2/carbon/identity/organization/discovery/service/constant/DiscoveryConstants.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| /* | ||
| * Copyright (c) 2023, WSO2 LLC. (http://www.wso2.com). | ||
| * | ||
| * WSO2 LLC. licenses this file to you under the Apache License, | ||
| * Version 2.0 (the "License"); you may not use this file except | ||
| * in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, | ||
| * software distributed under the License is distributed on an | ||
| * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | ||
| * KIND, either express or implied. See the License for the | ||
| * specific language governing permissions and limitations | ||
| * under the License. | ||
| */ | ||
|
|
||
| package org.wso2.carbon.identity.organization.discovery.service.constant; | ||
|
|
||
| /** | ||
| * This class holds the constants related to organization discovery service. | ||
| */ | ||
| public class DiscoveryConstants { | ||
|
|
||
| public static final String ENABLE_CONFIG = ".enable"; | ||
| public static final String PRE_ADD_USER_EMAIL_DOMAIN_VALIDATE = "PRE_ADD_USER_EMAIL_DOMAIN_VALIDATE"; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
152 changes: 152 additions & 0 deletions
152
...y/organization/discovery/service/listener/OrganizationDiscoveryUserOperationListener.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,152 @@ | ||
| /* | ||
| * Copyright (c) 2023, WSO2 LLC. (http://www.wso2.com). | ||
| * | ||
| * WSO2 LLC. licenses this file to you under the Apache License, | ||
| * Version 2.0 (the "License"); you may not use this file except | ||
| * in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, | ||
| * software distributed under the License is distributed on an | ||
| * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | ||
| * KIND, either express or implied. See the License for the | ||
| * specific language governing permissions and limitations | ||
| * under the License. | ||
| */ | ||
|
|
||
| package org.wso2.carbon.identity.organization.discovery.service.listener; | ||
|
|
||
| import org.apache.commons.lang.StringUtils; | ||
| import org.apache.commons.logging.Log; | ||
| import org.apache.commons.logging.LogFactory; | ||
| import org.wso2.carbon.context.PrivilegedCarbonContext; | ||
| import org.wso2.carbon.identity.core.AbstractIdentityUserOperationEventListener; | ||
| import org.wso2.carbon.identity.core.util.IdentityCoreConstants; | ||
| import org.wso2.carbon.identity.core.util.IdentityTenantUtil; | ||
| import org.wso2.carbon.identity.organization.config.service.OrganizationConfigManager; | ||
| import org.wso2.carbon.identity.organization.config.service.exception.OrganizationConfigException; | ||
| import org.wso2.carbon.identity.organization.config.service.model.ConfigProperty; | ||
| import org.wso2.carbon.identity.organization.config.service.model.DiscoveryConfig; | ||
| import org.wso2.carbon.identity.organization.discovery.service.AttributeBasedOrganizationDiscoveryHandler; | ||
| import org.wso2.carbon.identity.organization.discovery.service.OrganizationDiscoveryManager; | ||
| import org.wso2.carbon.identity.organization.discovery.service.OrganizationDiscoveryManagerImpl; | ||
| import org.wso2.carbon.identity.organization.discovery.service.internal.OrganizationDiscoveryServiceHolder; | ||
| import org.wso2.carbon.identity.organization.discovery.service.model.OrgDiscoveryAttribute; | ||
| import org.wso2.carbon.identity.organization.management.service.OrganizationManager; | ||
| import org.wso2.carbon.identity.organization.management.service.exception.OrganizationManagementException; | ||
| import org.wso2.carbon.identity.organization.management.service.util.OrganizationManagementUtil; | ||
| import org.wso2.carbon.user.core.UserStoreException; | ||
| import org.wso2.carbon.user.core.UserStoreManager; | ||
|
|
||
| import java.util.List; | ||
| import java.util.Map; | ||
|
|
||
| import static org.wso2.carbon.identity.organization.config.service.constant.OrganizationConfigConstants.ErrorMessages.ERROR_CODE_DISCOVERY_CONFIG_NOT_EXIST; | ||
| import static org.wso2.carbon.identity.organization.discovery.service.constant.DiscoveryConstants.ENABLE_CONFIG; | ||
| import static org.wso2.carbon.identity.organization.discovery.service.constant.DiscoveryConstants.PRE_ADD_USER_EMAIL_DOMAIN_VALIDATE; | ||
| import static org.wso2.carbon.identity.organization.management.service.constant.OrganizationManagementConstants.ErrorMessages.ERROR_CODE_EMAIL_DOMAIN_ASSOCIATED_WITH_DIFFERENT_ORGANIZATION; | ||
| import static org.wso2.carbon.identity.organization.management.service.constant.OrganizationManagementConstants.ErrorMessages.ERROR_CODE_EMAIL_DOMAIN_NOT_MAPPED_TO_ORGANIZATION; | ||
|
|
||
| /** | ||
| * This is to perform organization discovery related user operations. | ||
| */ | ||
| public class OrganizationDiscoveryUserOperationListener extends AbstractIdentityUserOperationEventListener { | ||
|
|
||
| private static final Log LOG = LogFactory.getLog(OrganizationDiscoveryUserOperationListener.class); | ||
| private final OrganizationDiscoveryManager organizationDiscoveryManager = new OrganizationDiscoveryManagerImpl(); | ||
|
|
||
| @Override | ||
| public int getExecutionOrderId() { | ||
|
|
||
| int orderId = getOrderId(); | ||
| if (orderId != IdentityCoreConstants.EVENT_LISTENER_ORDER_ID) { | ||
| return orderId; | ||
| } | ||
| return 114; | ||
| } | ||
|
|
||
| @Override | ||
| public boolean doPreAddUserWithID(String userName, Object credential, String[] roleList, Map<String, String> claims, | ||
| String profile, UserStoreManager userStoreManager) throws UserStoreException { | ||
|
|
||
| if (!isEnable()) { | ||
| return true; | ||
| } | ||
|
|
||
| try { | ||
| String tenantDomain = PrivilegedCarbonContext.getThreadLocalCarbonContext().getTenantDomain(); | ||
| if (!OrganizationManagementUtil.isOrganization(tenantDomain)) { | ||
| return true; | ||
| } | ||
| String organizationId = PrivilegedCarbonContext.getThreadLocalCarbonContext().getOrganizationId(); | ||
| if (StringUtils.isBlank(organizationId)) { | ||
| organizationId = getOrganizationManager().resolveOrganizationId(tenantDomain); | ||
| } | ||
| String primaryOrganizationId = getOrganizationManager().getPrimaryOrganizationId(organizationId); | ||
| int tenantId = IdentityTenantUtil.getTenantId(getOrganizationManager() | ||
| .resolveTenantDomain(primaryOrganizationId)); | ||
| DiscoveryConfig discoveryConfig = getOrganizationConfigManager() | ||
| .getDiscoveryConfigurationByTenantId(tenantId); | ||
| List<ConfigProperty> configProperties = discoveryConfig.getConfigProperties(); | ||
| Map<String, AttributeBasedOrganizationDiscoveryHandler> discoveryHandlers = | ||
| organizationDiscoveryManager.getAttributeBasedOrganizationDiscoveryHandlers(); | ||
| for (ConfigProperty configProperty : configProperties) { | ||
| String type = configProperty.getKey().split(ENABLE_CONFIG)[0]; | ||
| if (discoveryHandlers.get(type) != null && Boolean.parseBoolean(configProperty.getValue())) { | ||
| AttributeBasedOrganizationDiscoveryHandler handler = discoveryHandlers.get(type); | ||
| // Currently only email domain based organization discovery is supported. | ||
| if (handler.requiredEventValidations().contains(PRE_ADD_USER_EMAIL_DOMAIN_VALIDATE)) { | ||
| String domain = handler.extractAttributeValue(userName); | ||
| List<OrgDiscoveryAttribute> organizationDiscoveryAttributes = organizationDiscoveryManager | ||
| .getOrganizationDiscoveryAttributes(organizationId, false); | ||
| // If the organization doesn't have any email domains mapped, then we need to check if the | ||
| // email domain in the username is not mapped to any other organization . | ||
| if (organizationDiscoveryAttributes.isEmpty()) { | ||
| boolean domainAvailable = organizationDiscoveryManager.isDiscoveryAttributeValueAvailable | ||
| (primaryOrganizationId, handler.getType(), domain); | ||
| if (!domainAvailable) { | ||
| throw new UserStoreException( | ||
| ERROR_CODE_EMAIL_DOMAIN_ASSOCIATED_WITH_DIFFERENT_ORGANIZATION.getDescription(), | ||
| ERROR_CODE_EMAIL_DOMAIN_ASSOCIATED_WITH_DIFFERENT_ORGANIZATION.getCode()); | ||
| } | ||
| return true; | ||
| } else { | ||
| for (OrgDiscoveryAttribute attribute : organizationDiscoveryAttributes) { | ||
| List<String> organizationMappedEmailDomains = attribute.getValues(); | ||
| if (organizationMappedEmailDomains != null && | ||
| organizationMappedEmailDomains.contains(domain)) { | ||
| return true; | ||
| } | ||
| throw new UserStoreException( | ||
| ERROR_CODE_EMAIL_DOMAIN_NOT_MAPPED_TO_ORGANIZATION.getDescription(), | ||
| ERROR_CODE_EMAIL_DOMAIN_NOT_MAPPED_TO_ORGANIZATION.getCode()); | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } catch (OrganizationManagementException e) { | ||
| LOG.error("Error while creating user", e); | ||
| return false; | ||
| } catch (OrganizationConfigException e) { | ||
| if (ERROR_CODE_DISCOVERY_CONFIG_NOT_EXIST.getCode().equals(e.getErrorCode())) { | ||
| return true; | ||
| } | ||
| LOG.error("Error while creating user", e); | ||
| return false; | ||
| } | ||
| return true; | ||
| } | ||
|
|
||
| private OrganizationConfigManager getOrganizationConfigManager() { | ||
|
|
||
| return OrganizationDiscoveryServiceHolder.getInstance().getOrganizationConfigManager(); | ||
| } | ||
|
|
||
| private OrganizationManager getOrganizationManager() { | ||
|
|
||
| return OrganizationDiscoveryServiceHolder.getInstance().getOrganizationManager(); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters