//check whether everyone role is trying to be deleted,
if (deletedRoles != null) {
Arrays.sort(deletedRoles);
if (Arrays.binarySearch(deletedRoles, realmConfig.getEveryOneRoleName()) > -1) {
log.error("An attempt to remove " + userName + " user from Everyone role ");
throw new UserStoreException("Everyone role is not updatable");
}
}
// check whether admin role is trying to be deleted from admin user.
if (deletedRoles != null) {
Arrays.sort(deletedRoles);
if (realmConfig.getAdminUserName().equals(userName)
&& Arrays.binarySearch(deletedRoles, realmConfig.getAdminRoleName()) > -1) {
log.error("An attempt to remove Admin user from Admin role ");
throw new UserStoreException("Cannot remove Admin user from Admin role");
}
}
//get the DN of the user entry
String userNameDN = this.getNameInSpaceForUserName(userName);
String membershipAttribute = realmConfig.getUserStoreProperty(
LDAPConstants.MEMBERSHIP_ATTRIBUTE);
/*check deleted roles and delete member entries from relevant groups.*/
String errorMessage = null;
String searchFilter = realmConfig.getUserStoreProperty(LDAPConstants.ROLE_NAME_FILTER);
String roleSearchFilter = null;
DirContext mainDirContext = this.connectionSource.getContext();
try {
if (deletedRoles.length != 0) {
//perform validation for empty role occurrences before updating in LDAP
for (String deletedRole : deletedRoles) {
roleSearchFilter = searchFilter.replace("?", deletedRole);
String[] returningAttributes = new String[]{membershipAttribute};
NamingEnumeration<SearchResult> groupResults = searchInGroupBase(
roleSearchFilter, returningAttributes, SearchControls.SUBTREE_SCOPE,
mainDirContext);
SearchResult resultedGroup = null;
if (groupResults.hasMore()) {
resultedGroup = groupResults.next();
}
if ((isOnlyUserInRole(userNameDN, resultedGroup)) &&
(!EMPTY_ROLES_ALLOWED)) {
errorMessage = userName + " is the only user in the role: "
+ deletedRole + ". Hence can not delete user from role.";
logger.error(errorMessage);
throw new UserStoreException(errorMessage);
}
JNDIUtil.closeNamingEnumeration(groupResults);
}
//if empty role violation does not happen, continue updating the LDAP.
for (String deletedRole : deletedRoles) {
if (isExistingRole(deletedRole)) {
roleSearchFilter = searchFilter.replace("?", deletedRole);
String[] returningAttributes = new String[]{membershipAttribute};
NamingEnumeration<SearchResult> groupResults = searchInGroupBase(
roleSearchFilter, returningAttributes,
SearchControls.SUBTREE_SCOPE, mainDirContext);
SearchResult resultedGroup = null;
String groupDN = null;
if (groupResults.hasMore()) {
resultedGroup = groupResults.next();
groupDN = resultedGroup.getName();
}
this.modifyUserInRole(userNameDN, groupDN, DirContext.REMOVE_ATTRIBUTE);
JNDIUtil.closeNamingEnumeration(groupResults);
} else {
errorMessage = "The role: " + deletedRole + " does not exist.";
logger.error(errorMessage);
throw new UserStoreException(errorMessage);
}
}
}
if (newRoles.length != 0) {
for (String newRole : newRoles) {
if (isExistingRole(newRole)) {
roleSearchFilter = searchFilter.replace("?", newRole);
String[] returningAttributes = new String[]{membershipAttribute};
NamingEnumeration<SearchResult> groupResults = searchInGroupBase(
roleSearchFilter, returningAttributes,
SearchControls.SUBTREE_SCOPE, mainDirContext);
SearchResult resultedGroup = null;
//assume only one group with given group name
String groupDN = null;
if (groupResults.hasMore()) {
resultedGroup = groupResults.next();
groupDN = resultedGroup.getName();
}
if (!isUserInRole(userNameDN, resultedGroup)) {
modifyUserInRole(userNameDN, groupDN, DirContext.ADD_ATTRIBUTE);
} else {
errorMessage = "User: " + userName +
" already belongs to role: " + groupDN;
logger.error(errorMessage);
throw new UserStoreException(errorMessage);
}
JNDIUtil.closeNamingEnumeration(groupResults);
} else {
errorMessage = "The role: " + newRole + " does not exist.";
logger.error(errorMessage);
throw new UserStoreException(errorMessage);
}
}
}
} catch (NamingException e) {
errorMessage = "Error occurred while modifying the role list of user: " + userName;
logger.error(errorMessage);
throw new UserStoreException(errorMessage);
} finally {
JNDIUtil.closeContext(mainDirContext);
}
}