Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

INDIGO IAM v1.10.3 release #899

Open
wants to merge 22 commits into
base: master
Choose a base branch
from
Open

INDIGO IAM v1.10.3 release #899

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
22 commits
Select commit Hold shift + click to select a range
3fdc770
Bump version to 1.10.3
rmiccoli Nov 18, 2024
99fc6fa
Handle HEAD requests
rmiccoli Nov 13, 2024
f15ef57
Update matchingPolicy
garaimanoj Oct 22, 2024
5acde91
Redirect to login page when signing AUP
federicaagostini Nov 14, 2024
e2588ce
Bump mitreid version to 1.3.7.cnaf-20241119
rmiccoli Nov 19, 2024
d93535f
Fix tests
rmiccoli Nov 19, 2024
af34308
Add confirmation before rotate client secret
SteDev2 Nov 20, 2024
6bbaccd
Grant admin scopes to admin-approved clients only
rmiccoli Jul 18, 2024
4026957
Fix account mapping
rmiccoli Nov 22, 2024
f628b97
Add POST endpoint for registration requests confirmation (#881)
enricovianello Nov 22, 2024
8836869
Fix CERN lifecycle handler (#871)
enricovianello Nov 22, 2024
9955809
Cosmetic fixes before 1.10.3 release (#882)
enricovianello Nov 26, 2024
442b58e
Exclude IAM optional groups from VOMS AC (#894)
rmiccoli Dec 16, 2024
b55eb54
Fix CERN lifecycle logic (#896)
enricovianello Dec 17, 2024
1ca2b20
Find account by certificate sub and iss in VOMS AA (#897)
rmiccoli Dec 17, 2024
42386e2
Avoid NullPointerException
enricovianello Dec 18, 2024
5312234
Fix code smells
rmiccoli Dec 19, 2024
59725c7
Remove Institute label
enricovianello Dec 19, 2024
8f068aa
Log lifecycle handlers start and end with INFO level
enricovianello Dec 19, 2024
284fbeb
Fix lifecycle management
enricovianello Dec 20, 2024
8b01a8f
Fix AuthZ on endpoints that requires identity
enricovianello Dec 20, 2024
430d36f
Fix sonar issues
enricovianello Dec 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Avoid NullPointerException
  • Loading branch information
@enricovianello
enricovianello committed Dec 18, 2024
commit 42386e293dda31b933849c60d9bc03835a9d737c
29 changes: 14 additions & 15 deletions ...ogin-service/src/main/java/it/infn/mw/iam/core/lifecycle/cern/CernHrLifecycleHandler.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,7 @@ public class CernHrLifecycleHandler implements Runnable, SchedulingConfigurer {
public static final Logger LOG = LoggerFactory.getLogger(CernHrLifecycleHandler.class);

public enum CernStatus {
IGNORED, ERROR, NOT_FOUND, NOT_MEMBER, OK
IGNORED, ERROR, EXPIRED, VO_MEMBER
}

private final CernProperties cernProperties;
Expand All @@ -100,7 +100,6 @@ public void handleAccount(String cernPersonId, String experiment, IamAccount a)
deleteDeprecatedLabels(a);

if (CernHrLifecycleUtils.isAccountIgnored(a)) {
LOG.debug("Ignoring account '{}'", a.getUsername());
setCernStatusLabel(a, CernStatus.IGNORED, IGNORE_MESSAGE);
return;
}
Expand All @@ -114,9 +113,8 @@ public void handleAccount(String cernPersonId, String experiment, IamAccount a)
return;
}
if (voPerson.isEmpty()) {
LOG.debug("No record found for person id {}", cernPersonId);
setCernStatusLabel(a, CernStatus.NOT_FOUND, format(NO_PERSON_FOUND_MESSAGE, cernPersonId));
expireIfActiveAndValid(a);
expireIfActiveAndMember(a);
setCernStatusLabel(a, CernStatus.EXPIRED, format(NO_PERSON_FOUND_MESSAGE, cernPersonId));
return;
}

Expand All @@ -126,22 +124,27 @@ public void handleAccount(String cernPersonId, String experiment, IamAccount a)
.getMostRecentMembership(voPerson.get().getParticipations(), experiment);

if (ep.isEmpty()) {
LOG.warn("No membership to '{}' found for person id {}", experiment, cernPersonId);
setCernStatusLabel(a, CernStatus.NOT_MEMBER, format(NO_PARTICIPATION_MESSAGE, experiment));
expireIfActiveAndValid(a);
expireIfActiveAndMember(a);
setCernStatusLabel(a, CernStatus.EXPIRED, format(NO_PARTICIPATION_MESSAGE, experiment));
return;
}

syncInstitute(a, ep.get().getInstitute());
syncAccountEndTime(a, ep.get().getEndDate());
setCernStatusLabel(a, CernStatus.OK, format(SYNCHRONIZED_MESSAGE));
setCernStatusLabel(a, CernStatus.VO_MEMBER, format(SYNCHRONIZED_MESSAGE));

if (CernHrLifecycleUtils.isActiveMembership(a.getEndTime()) && !a.isActive()
&& accountWasSuspendedByIamLifecycleJob(a)) {
restoreAccount(a);
}
}

private void expireIfActiveAndMember(IamAccount a) {
if (CernHrLifecycleUtils.isActiveMembership(a.getEndTime()) && a.isActive()) {
expireAccount(a);
}
}

@Override
public void run() {

Expand Down Expand Up @@ -252,11 +255,7 @@ private void syncAccountEndTime(IamAccount a, Date endDate) {
}
}

private void expireIfActiveAndValid(IamAccount a) {
Date currentDate = new Date();
if (a.isActive() && a.getEndTime().after(currentDate)) {
LOG.warn("User {} has a valid membership but cannot be found on HR db", a.getUsername());
accountService.setAccountEndTime(a, currentDate);
}
private void expireAccount(IamAccount a) {
accountService.setAccountEndTime(a, new Date());
}
}
4 changes: 2 additions & 2 deletions ...rc/test/java/it/infn/mw/iam/test/lifecycle/cern/CernAccountLifecycleDisableUserTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,7 +162,7 @@ public void testCernPersonIdNotFoundMeansUserEndTimeIsResetToCurrentDate() {
testAccount.getLabelByPrefixAndName(LABEL_CERN_PREFIX, LABEL_MESSAGE);

assertThat(statusLabel.isPresent(), is(true));
assertThat(statusLabel.get().getValue(), is(CernHrLifecycleHandler.CernStatus.NOT_FOUND.name()));
assertThat(statusLabel.get().getValue(), is(CernHrLifecycleHandler.CernStatus.EXPIRED.name()));

assertThat(timestampLabel.isPresent(), is(false));

Expand Down Expand Up @@ -208,7 +208,7 @@ public void testNoParticipationIsFoundMeansUserEndTimeIsResetToCurrentDate() {

assertThat(statusLabel.isPresent(), is(true));
assertThat(statusLabel.get().getValue(),
is(CernHrLifecycleHandler.CernStatus.NOT_MEMBER.name()));
is(CernHrLifecycleHandler.CernStatus.EXPIRED.name()));

assertThat(timestampLabel.isPresent(), is(false));

Expand Down
24 changes: 12 additions & 12 deletions ...n-service/src/test/java/it/infn/mw/iam/test/lifecycle/cern/CernAccountLifecycleTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -174,7 +174,7 @@ public void testUserSuspensionWorksAfterCernHrEndTimeUpdate() {
Optional<IamLabel> cernStatusLabel =
testAccount.getLabelByPrefixAndName(LABEL_CERN_PREFIX, LABEL_STATUS);
assertThat(cernStatusLabel.isPresent(), is(true));
assertThat(cernStatusLabel.get().getValue(), is(CernStatus.OK.name()));
assertThat(cernStatusLabel.get().getValue(), is(CernStatus.VO_MEMBER.name()));

Optional<IamLabel> cernMessageLabel =
testAccount.getLabelByPrefixAndName(LABEL_CERN_PREFIX, LABEL_MESSAGE);
Expand All @@ -193,7 +193,7 @@ public void testUserSuspensionWorksAfterCernHrEndTimeUpdate() {

cernStatusLabel = testAccount.getLabelByPrefixAndName(LABEL_CERN_PREFIX, LABEL_STATUS);
assertThat(cernStatusLabel.isPresent(), is(true));
assertThat(cernStatusLabel.get().getValue(), is(CernStatus.OK.name()));
assertThat(cernStatusLabel.get().getValue(), is(CernStatus.VO_MEMBER.name()));

cernMessageLabel = testAccount.getLabelByPrefixAndName(LABEL_CERN_PREFIX, LABEL_MESSAGE);
assertThat(cernMessageLabel.isPresent(), is(true));
Expand Down Expand Up @@ -225,7 +225,7 @@ public void testUserRemovalWorksAfterCernHrEndTimeUpdate() {
Optional<IamLabel> cernStatusLabel =
testAccount.getLabelByPrefixAndName(LABEL_CERN_PREFIX, LABEL_STATUS);
assertThat(cernStatusLabel.isPresent(), is(true));
assertThat(cernStatusLabel.get().getValue(), is(CernStatus.OK.name()));
assertThat(cernStatusLabel.get().getValue(), is(CernStatus.VO_MEMBER.name()));

Optional<IamLabel> cernMessageLabel =
testAccount.getLabelByPrefixAndName(LABEL_CERN_PREFIX, LABEL_MESSAGE);
Expand Down Expand Up @@ -266,7 +266,7 @@ public void testLifecycleWorksForValidAccounts() {
Optional<IamLabel> cernStatusLabel =
testAccount.getLabelByPrefixAndName(LABEL_CERN_PREFIX, LABEL_STATUS);
assertThat(cernStatusLabel.isPresent(), is(true));
assertThat(cernStatusLabel.get().getValue(), is(CernStatus.OK.name()));
assertThat(cernStatusLabel.get().getValue(), is(CernStatus.VO_MEMBER.name()));

Optional<IamLabel> cernMessageLabel =
testAccount.getLabelByPrefixAndName(LABEL_CERN_PREFIX, LABEL_MESSAGE);
Expand Down Expand Up @@ -316,7 +316,7 @@ public void testLifecycleWorksForAccountsWithOneValidParticipationAndOneExpired(
Optional<IamLabel> cernStatusLabel =
testAccount.getLabelByPrefixAndName(LABEL_CERN_PREFIX, LABEL_STATUS);
assertThat(cernStatusLabel.isPresent(), is(true));
assertThat(cernStatusLabel.get().getValue(), is(CernStatus.OK.name()));
assertThat(cernStatusLabel.get().getValue(), is(CernStatus.VO_MEMBER.name()));

Optional<IamLabel> cernMessageLabel =
testAccount.getLabelByPrefixAndName(LABEL_CERN_PREFIX, LABEL_MESSAGE);
Expand Down Expand Up @@ -354,7 +354,7 @@ public void testLifecycleWorksForAccountsWithOneUnlimitedParticipationAndOneExpi
Optional<IamLabel> cernStatusLabel =
testAccount.getLabelByPrefixAndName(LABEL_CERN_PREFIX, LABEL_STATUS);
assertThat(cernStatusLabel.isPresent(), is(true));
assertThat(cernStatusLabel.get().getValue(), is(CernStatus.OK.name()));
assertThat(cernStatusLabel.get().getValue(), is(CernStatus.VO_MEMBER.name()));

Optional<IamLabel> cernMessageLabel =
testAccount.getLabelByPrefixAndName(LABEL_CERN_PREFIX, LABEL_MESSAGE);
Expand Down Expand Up @@ -391,7 +391,7 @@ public void testLifecycleWhenVOPersonEndDateIsNull() {
Optional<IamLabel> cernStatusLabel =
testAccount.getLabelByPrefixAndName(LABEL_CERN_PREFIX, LABEL_STATUS);
assertThat(cernStatusLabel.isPresent(), is(true));
assertThat(cernStatusLabel.get().getValue(), is(CernStatus.OK.name()));
assertThat(cernStatusLabel.get().getValue(), is(CernStatus.VO_MEMBER.name()));

Optional<IamLabel> cernMessageLabel =
testAccount.getLabelByPrefixAndName(LABEL_CERN_PREFIX, LABEL_MESSAGE);
Expand Down Expand Up @@ -432,7 +432,7 @@ public void testRestoreLifecycleWorks() {
Optional<IamLabel> iamStatusLabel = testAccount.getLabelByName(LIFECYCLE_STATUS_LABEL);

assertThat(cernStatusLabel.isPresent(), is(true));
assertThat(cernStatusLabel.get().getValue(), is(CernStatus.OK.name()));
assertThat(cernStatusLabel.get().getValue(), is(CernStatus.VO_MEMBER.name()));

assertThat(cernMessageLabel.isPresent(), is(true));
assertThat(cernMessageLabel.get().getValue(), is(format(SYNCHRONIZED_MESSAGE)));
Expand Down Expand Up @@ -488,7 +488,7 @@ public void testApiReturnsNullVoPersonIsHandled() {

assertThat(statusLabel.isPresent(), is(true));
assertThat(statusLabel.get().getValue(),
is(CernHrLifecycleHandler.CernStatus.NOT_FOUND.name()));
is(CernHrLifecycleHandler.CernStatus.EXPIRED.name()));

assertThat(timestampLabel.isPresent(), is(false));

Expand Down Expand Up @@ -517,7 +517,7 @@ public void testApiReturnsVoPersonWithNoParticipationsIsHandled() {

assertThat(statusLabel.isPresent(), is(true));
assertThat(statusLabel.get().getValue(),
is(CernHrLifecycleHandler.CernStatus.NOT_MEMBER.name()));
is(CernHrLifecycleHandler.CernStatus.EXPIRED.name()));

assertThat(timestampLabel.isPresent(), is(false));

Expand Down Expand Up @@ -545,7 +545,7 @@ public void testLifecycleNotRestoreAccountsSuspendedByAdmins() {
Optional<IamLabel> statusLabel =
testAccount.getLabelByPrefixAndName(LABEL_CERN_PREFIX, LABEL_STATUS);
assertThat(statusLabel.isPresent(), is(true));
assertThat(statusLabel.get().getValue(), is(CernStatus.OK.name()));
assertThat(statusLabel.get().getValue(), is(CernStatus.VO_MEMBER.name()));

Optional<IamLabel> timestampLabel =
testAccount.getLabelByPrefixAndName(LABEL_CERN_PREFIX, LABEL_TIMESTAMP);
Expand Down Expand Up @@ -607,7 +607,7 @@ public void testPaginationWorks() {
account.getLabelByPrefixAndName(LABEL_CERN_PREFIX, LABEL_TIMESTAMP);

assertThat(statusLabel.isPresent(), is(true));
assertThat(statusLabel.get().getValue(), is(CernStatus.OK.name()));
assertThat(statusLabel.get().getValue(), is(CernStatus.VO_MEMBER.name()));

assertThat(timestampLabel.isPresent(), is(false));
}
Expand Down
Loading