Fixes #21867: Validate groups and principals after considering all inputs (#22101)

Author: h2002044

appserver/connectors/admin/src/main/java/org/glassfish/connectors/admin/cli/UpdateConnectorSecurityMap.java

@@ -212,22 +212,6 @@ public void execute(AdminCommandContext context) {
         final List<String> existingPrincipals = new ArrayList(map.getPrincipal());
         final List<String> existingUserGroups = new ArrayList(map.getUserGroup());
 
-         if (existingPrincipals.isEmpty() && addPrincipals != null) {
-            report.setMessage(localStrings.getLocalString("update.connector.security.map." +
-                    "addPrincipalToExistingUserGroupsWorkSecurityMap",
-                    "Failed to add principals to a security map with user groups."));
-            report.setActionExitCode(ActionReport.ExitCode.FAILURE);
-            return;
-        }
-
-        if (existingUserGroups.isEmpty() && addUserGroups != null) {
-            report.setMessage(localStrings.getLocalString("update.connector.security.map." +
-                    "addUserGroupsToExistingPrincipalsWorkSecurityMap",
-                    "Failed to add user groups to a security map with principals."));
-            report.setActionExitCode(ActionReport.ExitCode.FAILURE);
-            return;
-        }
-
         //check if there is any invalid principal in removePrincipals.
         if (removePrincipals != null) {
             boolean principalExists = true;
@@ -270,7 +254,7 @@ public void execute(AdminCommandContext context) {
 
         //FIX : Bug 4914883.
         //The user should not delete all principals and usergroups in the map.
-        // Atleast one principal or usergroup must exists.
+        // Atleast one principal or usergroup must exist.
 
         if (addPrincipals == null && addUserGroups == null) {
             boolean principalsEmpty = false;
@@ -344,6 +328,11 @@ public void execute(AdminCommandContext context) {
             }
         }
 
+        //ensure that only user-groups or only principals exist in the security map after considering add/remove user-groups/principals option in
+        //the update-connector-security-map command.
+        if (!hasOnlyPrincipalsOrOnlyUserGroups(report, existingPrincipals, existingUserGroups))
+            return;
+
         BackendPrincipal backendPrincipal = map.getBackendPrincipal();
 
         try {
@@ -391,5 +380,35 @@ public Object run(ConfigBeanProxy... params) throws PropertyVetoException, Trans
             report.setActionExitCode(ActionReport.ExitCode.FAILURE);
             report.setFailureCause(tfe);
         }        
-    }   
+    }
+
+    /**
+     * A security map can have either a set of principals or a set of user-groups
+     * but not a mix of both.
+     * Validation to check whether only principals are present in the security map
+     * or only user-groups are present in the security map.
+     * @param report ActionReport
+     * @param existingPrincipals principals
+     * @param existingUserGroups user-groups
+     * @return boolean true - if it is a homogeneous security map, false otherwise.
+     */
+    private boolean hasOnlyPrincipalsOrOnlyUserGroups(ActionReport report,
+        List<String> existingPrincipals, List<String> existingUserGroups) {
+        if (existingPrincipals.isEmpty() && addPrincipals != null) {
+           report.setMessage(localStrings.getLocalString("update.connector.security.map." +
+                   "addPrincipalToExistingUserGroupsWorkSecurityMap",
+                   "Failed to add principals to a security map with user groups."));
+           report.setActionExitCode(ActionReport.ExitCode.FAILURE);
+            return false;
+       }
+
+        if (existingUserGroups.isEmpty() && addUserGroups != null) {
+            report.setMessage(localStrings.getLocalString("update.connector.security.map." +
+                    "addUserGroupsToExistingPrincipalsWorkSecurityMap",
+                    "Failed to add user groups to a security map with principals."));
+            report.setActionExitCode(ActionReport.ExitCode.FAILURE);
+            return false;
+        }
+        return true;
+    }
 }