public Subject updateSubject(Subject whoami, Subject subjectToModify, String newPassword) {
// let a user change his own details
Set<Permission> globalPermissions = authorizationManager.getExplicitGlobalPermissions(whoami);
boolean isSecurityManager = globalPermissions.contains(Permission.MANAGE_SECURITY);
if (!whoami.equals(subjectToModify) && !isSecurityManager) {
throw new PermissionException("You [" + whoami.getName() + "] do not have permission to update user ["
+ subjectToModify.getName() + "].");
}
boolean subjectToModifyIsSystemSuperuser = authorizationManager.isSystemSuperuser(subjectToModify);
if (!subjectToModify.getFactive() && subjectToModifyIsSystemSuperuser) {
throw new PermissionException("You cannot disable the system user [" + subjectToModify.getName() + "].");
}
Subject attachedSubject = getSubjectById(subjectToModify.getId());
if (attachedSubject == null) {
throw new IllegalArgumentException("No user exists with id [" + subjectToModify.getId() + "].");
}
if (!attachedSubject.getName().equals(subjectToModify.getName())) {
throw new IllegalArgumentException("You cannot change a user's username.");
}
Set<Role> newRoles = subjectToModify.getRoles();
if (newRoles != null) {
Set<Role> currentRoles = new HashSet<Role>(roleManager.findRolesBySubject(subjectToModify.getId(),
PageControl.getUnlimitedInstance()));
boolean rolesChanged = !(newRoles.containsAll(currentRoles) && currentRoles.containsAll(newRoles));
if (rolesChanged) {
int[] newRoleIds = new int[newRoles.size()];
int i = 0;
for (Role role : newRoles) {
newRoleIds[i++] = role.getId();
}
roleManager.setAssignedSubjectRoles(whoami, subjectToModify.getId(), newRoleIds);
}
}
boolean ldapRolesModified = false;
Set<Role> newLdapRoles = subjectToModify.getLdapRoles();
if (newLdapRoles == null) {
newLdapRoles = Collections.emptySet();
}
if (newLdapRoles != null) {
RoleCriteria subjectLdapRolesCriteria = new RoleCriteria();
subjectLdapRolesCriteria.addFilterLdapSubjectId(subjectToModify.getId());
subjectLdapRolesCriteria.clearPaging();//disable paging as the code assumes all the results will be returned.
PageList<Role> currentLdapRoles = roleManager.findRolesByCriteria(whoami, subjectLdapRolesCriteria);
ldapRolesModified = !(currentLdapRoles.containsAll(newLdapRoles) && newLdapRoles
.containsAll(currentLdapRoles));
}
boolean isUserWithPrincipal = isUserWithPrincipal(subjectToModify.getName());
if (ldapRolesModified) {
if (!isSecurityManager) {
throw new PermissionException("You cannot change the LDAP roles assigned to ["
+ subjectToModify.getName() + "] - only a user with the MANAGE_SECURITY permission can do so.");
} else if (isUserWithPrincipal) {
throw new PermissionException("You cannot set LDAP roles on non-LDAP user ["
+ subjectToModify.getName() + "].");
}
// TODO: Update LDAP roles.
}