Skip to content

Commit dc7ae9d

Browse files
PasinduYeshanPasinduYeshan
authored
Merge pull request #4437 from PasinduYeshan/fix/user-list-claim
Check claim storage location before listing users.
2 parents c5a3ce6 + 0269133 commit dc7ae9d

File tree

2 files changed

+162
-12
lines changed

2 files changed

+162
-12
lines changed

‎core/org.wso2.carbon.user.core/src/main/java/org/wso2/carbon/user/core/UserStoreConfigConstants.java‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -214,4 +214,10 @@ public class UserStoreConfigConstants {
214214
"skip multi-valued attribute separation";
215215
public static final String singleValuedAttributesDisplayName = "Single Valued Attributes";
216216

217+
// Property to force all claims to be stored in user store regardless of other configurations.
218+
public static final String STORE_IDENTITY_CLAIMS = "StoreIdentityClaims";
219+
public static final String STORE_IDENTITY_CLAIMS_DISPLAY_NAME = "Store Identity Claims";
220+
public static final String STORE_IDENTITY_CLAIMS_DESCRIPTION = "When enabled, all identity and user claims will " +
221+
"be stored in the user store manager regardless of other claim configurations";
222+
217223
}

‎core/org.wso2.carbon.user.core/src/main/java/org/wso2/carbon/user/core/common/AbstractUserStoreManager.java‎

Lines changed: 156 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -3172,6 +3172,22 @@ private List<String> doGetUserList(String claim, String claimValue, String profi
31723172
"matches");
31733173
}
31743174

3175+
try {
3176+
if (isIdentityStoreManagedClaim(claimManager.getClaim(claim), extractedDomain, userManager)) {
3177+
if (log.isDebugEnabled()) {
3178+
log.debug("The claim: " + claim + " is an identity store managed claim for the domain: "
3179+
+ extractedDomain + ". Hence returning empty user list.");
3180+
}
3181+
return Collections.emptyList();
3182+
}
3183+
} catch (org.wso2.carbon.user.api.UserStoreException e) {
3184+
handleGetUserListFailure(ErrorMessages.ERROR_CODE_ERROR_DURING_PRE_GET_USER_LIST.getCode(),
3185+
String.format(ErrorMessages.ERROR_CODE_ERROR_DURING_PRE_GET_USER_LIST.getMessage(),
3186+
e.getMessage()), claim, claimValue, profileName);
3187+
throw new UserStoreException(
3188+
"Error occurred while retrieving claim for claim URI: " + claim, e);
3189+
}
3190+
31753191
try {
31763192
property = claimManager.getAttributeName(extractedDomain, claim);
31773193
} catch (org.wso2.carbon.user.api.UserStoreException e) {
@@ -3250,6 +3266,20 @@ private List<String> doGetUserList(String claim, String claimValue, String profi
32503266

32513267
// For all the user stores append the domain name to the claim and pass it recursively (Including PRIMARY).
32523268
String domainName = ((AbstractUserStoreManager) userStoreManager).getMyDomainName();
3269+
3270+
try {
3271+
if (isIdentityStoreManagedClaim(claimManager.getClaim(claim), domainName, userStoreManager)) {
3272+
if (log.isDebugEnabled()) {
3273+
log.debug("The claim: " + claim + " is an identity store managed claim for the domain: "
3274+
+ domainName + ". Hence skipping the user store.");
3275+
}
3276+
continue;
3277+
}
3278+
} catch (org.wso2.carbon.user.api.UserStoreException e) {
3279+
log.error(String.format("Error occurred while retrieving claim for claim URI: %s for domain: %s.",
3280+
claim, domainName), e);
3281+
}
3282+
32533283
String claimValueWithDomain;
32543284
if (StringUtils.equalsIgnoreCase(domainName, UserCoreConstants.PRIMARY_DEFAULT_DOMAIN_NAME)) {
32553285
claimValueWithDomain = domainName + CarbonConstants.DOMAIN_SEPARATOR + claimValue;
@@ -3416,6 +3446,22 @@ private List<User> doGetUserListWithID(String claim, String claimValue, String p
34163446
+ "matches");
34173447
}
34183448

3449+
try {
3450+
if (isIdentityStoreManagedClaim(claimManager.getClaim(claim), extractedDomain, userManager)) {
3451+
if (log.isDebugEnabled()) {
3452+
log.debug("The claim: " + claim + " is an identity store managed claim for the domain: "
3453+
+ extractedDomain + ". Hence returning empty user list.");
3454+
}
3455+
return Collections.emptyList();
3456+
}
3457+
} catch (org.wso2.carbon.user.api.UserStoreException e) {
3458+
handleGetUserListFailureWithID(ErrorMessages.ERROR_CODE_ERROR_DURING_PRE_GET_USER_LIST.getCode(),
3459+
String.format(ErrorMessages.ERROR_CODE_ERROR_DURING_PRE_GET_USER_LIST.getMessage(),
3460+
e.getMessage()), claim, claimValue, profileName);
3461+
throw new UserStoreException(
3462+
"Error occurred while retrieving claim for claim URI: " + claim, e);
3463+
}
3464+
34193465
try {
34203466
property = claimManager.getAttributeName(extractedDomain, claim);
34213467
} catch (org.wso2.carbon.user.api.UserStoreException e) {
@@ -3496,6 +3542,20 @@ private List<User> doGetUserListWithID(String claim, String claimValue, String p
34963542

34973543
// For all the user stores append the domain name to the claim and pass it recursively (Including PRIMARY).
34983544
String domainName = ((AbstractUserStoreManager) userStoreManager).getMyDomainName();
3545+
3546+
try {
3547+
if (isIdentityStoreManagedClaim(claimManager.getClaim(claim), domainName, userStoreManager)) {
3548+
if (log.isDebugEnabled()) {
3549+
log.debug("The claim: " + claim + " is an identity store managed claim for the domain: "
3550+
+ domainName + ". Hence skipping the user store.");
3551+
}
3552+
continue;
3553+
}
3554+
} catch (org.wso2.carbon.user.api.UserStoreException e) {
3555+
log.error(String.format("Error occurred while retrieving claim for claim URI: %s for domain: %s.",
3556+
claim, domainName), e);
3557+
}
3558+
34993559
String claimValueWithDomain;
35003560
if (StringUtils.equalsIgnoreCase(domainName, UserCoreConstants.PRIMARY_DEFAULT_DOMAIN_NAME)) {
35013561
claimValueWithDomain = domainName + CarbonConstants.DOMAIN_SEPARATOR + claimValue;
@@ -3547,6 +3607,22 @@ private List<String> doGetUserList(String claim, String claimValue, String profi
35473607
"matches");
35483608
}
35493609

3610+
try {
3611+
if (isIdentityStoreManagedClaim(claimManager.getClaim(claim), extractedDomain, userManager)) {
3612+
if (log.isDebugEnabled()) {
3613+
log.debug("The claim: " + claim + " is an identity store managed claim for the domain: "
3614+
+ extractedDomain + ". Hence returning empty user list.");
3615+
}
3616+
return Collections.emptyList();
3617+
}
3618+
} catch (org.wso2.carbon.user.api.UserStoreException e) {
3619+
handleGetUserListFailure(ErrorMessages.ERROR_CODE_ERROR_DURING_PRE_GET_USER_LIST.getCode(),
3620+
String.format(ErrorMessages.ERROR_CODE_ERROR_DURING_PRE_GET_USER_LIST.getMessage(),
3621+
e.getMessage()), claim, claimValue, limit, offset, profileName);
3622+
throw new UserStoreException(
3623+
"Error occurred while retrieving claim for claim URI: " + claim, e);
3624+
}
3625+
35503626
try {
35513627
property = claimManager.getAttributeName(extractedDomain, claim);
35523628
} catch (org.wso2.carbon.user.api.UserStoreException e) {
@@ -3617,6 +3693,22 @@ private List<String> doGetUserList(String claim, String claimValue, String profi
36173693
// For all the user stores append the domain name to the claim and pass it recursively (Including PRIMARY).
36183694
String domainName = ((AbstractUserStoreManager) userStoreManager).getMyDomainName();
36193695

3696+
try {
3697+
if (isIdentityStoreManagedClaim(claimManager.getClaim(claim), domainName, userStoreManager)) {
3698+
if (log.isDebugEnabled()) {
3699+
log.debug("The claim: " + claim + " is an identity store managed claim for the domain: "
3700+
+ domainName + ". Hence skipping the user store.");
3701+
}
3702+
continue;
3703+
}
3704+
} catch (org.wso2.carbon.user.api.UserStoreException e) {
3705+
handleGetUserListFailure(ErrorMessages.ERROR_CODE_ERROR_DURING_PRE_GET_USER_LIST.getCode(),
3706+
String.format(ErrorMessages.ERROR_CODE_ERROR_DURING_PRE_GET_USER_LIST.getMessage(),
3707+
e.getMessage()), claim, claimValue, limit, offset, profileName);
3708+
throw new UserStoreException(
3709+
"Error occurred while retrieving claim for claim URI: " + claim, e);
3710+
}
3711+
36203712
try {
36213713
property = claimManager.getAttributeName(domainName, claim);
36223714
} catch (org.wso2.carbon.user.api.UserStoreException e) {
@@ -17367,7 +17459,7 @@ private void mapAttributesToLocalIdentityClaims(List<ExpressionCondition> expres
1736717459
}
1736817460

1736917461
// Check if the claim is an identity store managed claim and map the attribute name to claim URI.
17370-
if (isIdentityStoreManagedClaim(mappedClaim, userStoreDomain)) {
17462+
if (isIdentityStoreManagedClaim(mappedClaim.getClaim(), userStoreDomain, null)) {
1737117463
expressionCondition.setAttributeName(mappedClaim.getClaim().getClaimUri());
1737217464
if (log.isDebugEnabled()) {
1737317465
log.debug("Obtained the ClaimURI " + mappedClaim.getClaim().getClaimUri() +
@@ -17382,37 +17474,57 @@ private void mapAttributesToLocalIdentityClaims(List<ExpressionCondition> expres
1738217474
* Note: This only checks the `managedInUserStore` property of the claim and `excludedUserStores` property only.
1738317475
* This doesn't check if the identity store is a user-store based or if the given user store is configured
1738417476
* to store identity claims.
17385-
* @param mappedClaim
17386-
* @return
17477+
* @param localClaim Claim to be checked.
17478+
* @param userStoreDomain User store domain.
17479+
* @param userStoreManager User store manager to check the configuration. If null, uses the current user store manager.
17480+
* @return True if the claim is an identity store managed claim, false otherwise.
1738717481
*/
17388-
private boolean isIdentityStoreManagedClaim(org.wso2.carbon.user.api.ClaimMapping mappedClaim,
17389-
String userStoreDomain) {
17482+
private boolean isIdentityStoreManagedClaim(org.wso2.carbon.user.api.Claim localClaim, String userStoreDomain,
17483+
UserStoreManager userStoreManager) {
17484+
17485+
RealmConfiguration realmConfigToCheck = realmConfig;
17486+
if (userStoreManager instanceof AbstractUserStoreManager) {
17487+
realmConfigToCheck = ((AbstractUserStoreManager) userStoreManager).getRealmConfiguration();
17488+
}
1739017489

17391-
if (mappedClaim == null) {
17490+
// If StoreIdentityClaims property is enabled, all claims should be stored in user store.
17491+
// This overrides all other claim configurations.
17492+
if (Boolean.parseBoolean(
17493+
realmConfigToCheck.getUserStoreProperty(UserStoreConfigConstants.STORE_IDENTITY_CLAIMS))) {
17494+
if (log.isDebugEnabled()) {
17495+
log.debug("StoreIdentityClaims property is enabled for domain: " + userStoreDomain +
17496+
". All claims will be stored in user store.");
17497+
}
17498+
return false;
17499+
}
17500+
17501+
if (localClaim == null) {
1739217502
return false;
1739317503
}
1739417504

17395-
Boolean managedInUserStoreValue = mappedClaim.getClaim().isManagedInUserStore();
17505+
Boolean managedInUserStoreValue = localClaim.isManagedInUserStore();
1739617506
if (managedInUserStoreValue == null) {
1739717507
if (log.isDebugEnabled()) {
1739817508
log.debug("ManagedInUserStore property is not set for the claim: " +
17399-
mappedClaim.getClaim().getClaimUri() + ". Hence defaulting to claim type storage.");
17509+
localClaim.getClaimUri() + ". Hence defaulting to claim type storage.");
1740017510
}
17401-
return mappedClaim.getClaim().getClaimUri().contains(IDENTITY_CLAIM_URI);
17511+
return localClaim.getClaimUri().contains(IDENTITY_CLAIM_URI);
1740217512
}
1740317513
if (!managedInUserStoreValue) {
1740417514
if (log.isDebugEnabled()) {
17405-
log.debug("Claim: " + mappedClaim.getClaim().getClaimUri() +
17515+
log.debug("Claim: " + localClaim.getClaimUri() +
1740617516
" is an identity store managed claim as per the ManagedInUserStore property.");
1740717517
}
1740817518
return true;
1740917519
}
1741017520

17411-
Set<String> excludedUserStores = mappedClaim.getClaim().getExcludedUserStores();
17521+
Set<String> excludedUserStores = localClaim.getExcludedUserStores();
1741217522
if (CollectionUtils.isEmpty(excludedUserStores)) {
1741317523
return false;
1741417524
}
17415-
return excludedUserStores.contains(userStoreDomain);
17525+
17526+
return excludedUserStores.stream()
17527+
.anyMatch(excludedDomain -> excludedDomain.equalsIgnoreCase(userStoreDomain));
1741617528
}
1741717529

1741817530
/**
@@ -17474,6 +17586,22 @@ private List<User> doGetUserListWithID(String claim, String claimValue, String p
1747417586
+ "matches");
1747517587
}
1747617588

17589+
try {
17590+
if (isIdentityStoreManagedClaim(claimManager.getClaim(claim), extractedDomain, userManager)) {
17591+
if (log.isDebugEnabled()) {
17592+
log.debug("The claim: " + claim + " is an identity store managed claim for the domain: "
17593+
+ extractedDomain + ". Hence returning empty user list.");
17594+
}
17595+
return Collections.emptyList();
17596+
}
17597+
} catch (org.wso2.carbon.user.api.UserStoreException e) {
17598+
handleGetUserListFailure(ErrorMessages.ERROR_CODE_ERROR_DURING_PRE_GET_USER_LIST.getCode(),
17599+
String.format(ErrorMessages.ERROR_CODE_ERROR_DURING_PRE_GET_USER_LIST.getMessage(),
17600+
e.getMessage()), claim, claimValue, limit, offset, profileName);
17601+
throw new UserStoreException(
17602+
"Error occurred while retrieving claim for claim URI: " + claim, e);
17603+
}
17604+
1747717605
try {
1747817606
property = claimManager.getAttributeName(extractedDomain, claim);
1747917607
} catch (org.wso2.carbon.user.api.UserStoreException e) {
@@ -17543,6 +17671,22 @@ private List<User> doGetUserListWithID(String claim, String claimValue, String p
1754317671
// For all the user stores append the domain name to the claim and pass it recursively (Including PRIMARY).
1754417672
String domainName = ((AbstractUserStoreManager) userStoreManager).getMyDomainName();
1754517673

17674+
try {
17675+
if (isIdentityStoreManagedClaim(claimManager.getClaim(claim), domainName, userStoreManager)) {
17676+
if (log.isDebugEnabled()) {
17677+
log.debug("The claim: " + claim + " is an identity store managed claim for the domain: "
17678+
+ domainName + ". Hence skipping the user store.");
17679+
}
17680+
continue;
17681+
}
17682+
} catch (org.wso2.carbon.user.api.UserStoreException e) {
17683+
handleGetUserListFailure(ErrorMessages.ERROR_CODE_ERROR_DURING_PRE_GET_USER_LIST.getCode(),
17684+
String.format(ErrorMessages.ERROR_CODE_ERROR_DURING_PRE_GET_USER_LIST.getMessage(),
17685+
e.getMessage()), claim, claimValue, limit, offset, profileName);
17686+
throw new UserStoreException(
17687+
"Error occurred while retrieving claim for claim URI: " + claim, e);
17688+
}
17689+
1754617690
try {
1754717691
property = claimManager.getAttributeName(domainName, claim);
1754817692
} catch (org.wso2.carbon.user.api.UserStoreException e) {

0 commit comments

Comments
 (0)