Role based user provisioning improvements

components/provisioning/org.wso2.carbon.identity.provisioning/pom.xml

@@ -84,6 +84,14 @@
             <groupId>org.wso2.carbon.identity.framework</groupId>
             <artifactId>org.wso2.carbon.identity.base</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.wso2.carbon.identity.framework</groupId>
+            <artifactId>org.wso2.carbon.identity.role.v2.mgt.core</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.wso2.carbon.identity.framework</groupId>
+            <artifactId>org.wso2.carbon.identity.application.authentication.framework</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.wso2.balana</groupId>
             <artifactId>org.wso2.balana.utils</artifactId>
@@ -163,6 +171,10 @@
                             org.wso2.carbon.user.mgt.*;
                             version="${carbon.identity.package.import.version.range}",
                             org.json;version="${json.wso2.version.range}",
+                            org.wso2.carbon.identity.role.v2.mgt.core.*;
+                            version="${carbon.identity.package.import.version.range}",
+                            org.wso2.carbon.identity.application.authentication.framework.util;
+                            version="${carbon.identity.package.import.version.range}"
                         </Import-Package>
                         <Export-Package>
                             !org.wso2.carbon.identity.provisioning.internal,

components/provisioning/org.wso2.carbon.identity.provisioning/src/main/java/org/wso2/carbon/identity/provisioning/OutboundProvisioningManager.java

@@ -42,7 +42,11 @@
 import org.wso2.carbon.identity.provisioning.dao.CacheBackedProvisioningMgtDAO;
 import org.wso2.carbon.identity.provisioning.dao.ProvisioningManagementDAO;
 import org.wso2.carbon.identity.provisioning.internal.IdentityProvisionServiceComponent;
+import org.wso2.carbon.identity.provisioning.internal.ProvisioningServiceDataHolder;
 import org.wso2.carbon.identity.provisioning.rules.XACMLBasedRuleHandler;
+import org.wso2.carbon.identity.role.v2.mgt.core.RoleConstants;
+import org.wso2.carbon.identity.role.v2.mgt.core.exception.IdentityRoleManagementException;
+import org.wso2.carbon.identity.role.v2.mgt.core.model.RoleBasicInfo;
 import org.wso2.carbon.idp.mgt.IdentityProviderManagementException;
 import org.wso2.carbon.idp.mgt.IdentityProviderManager;
 import org.wso2.carbon.idp.mgt.util.IdPManagementUtil;
@@ -51,6 +55,7 @@
 import org.wso2.carbon.user.core.UserRealm;
 import org.wso2.carbon.user.core.UserStoreManager;
 import org.wso2.carbon.user.core.claim.Claim;
+import org.wso2.carbon.user.core.common.AbstractUserStoreManager;
 import org.wso2.carbon.user.core.service.RealmService;
 import org.wso2.carbon.user.core.util.UserCoreUtil;
 
@@ -65,6 +70,7 @@
 import java.util.concurrent.Callable;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
+import java.util.stream.Collectors;
 
 import static org.wso2.carbon.identity.application.mgt.ApplicationConstants.CONSOLE_APPLICATION_NAME;
 import static org.wso2.carbon.identity.application.mgt.ApplicationConstants.LOCAL_SP;
@@ -73,6 +79,7 @@
 import static org.wso2.carbon.identity.provisioning.IdentityProvisioningConstants.SELF_SIGNUP_ROLE;
 import static org.wso2.carbon.identity.provisioning.ProvisioningUtil.isApplicationBasedOutboundProvisioningEnabled;
 import static org.wso2.carbon.identity.provisioning.ProvisioningUtil.isUserTenantBasedOutboundProvisioningEnabled;
+import static org.wso2.carbon.identity.role.mgt.core.RoleConstants.INTERNAL_DOMAIN;
 
 /**
  *
@@ -494,9 +501,15 @@
                     List<String> newUsersList = attributes.get(ClaimMapping.build(
                             IdentityProvisioningConstants.NEW_USER_CLAIM_URI, null, null, false));
 
+                    if (newUsersList == null) {
+                        newUsersList = new ArrayList<>();
+                    }
                     List<String> deletedUsersList = attributes.get(ClaimMapping.build(
                             IdentityProvisioningConstants.DELETED_USER_CLAIM_URI, null, null, false));
 
+                    if (deletedUsersList == null) {
+                        deletedUsersList = new ArrayList<>();
+                    }
                     Map<ClaimMapping, List<String>> mappedUserClaims;
                     ProvisionedIdentifier provisionedUserIdentifier;
 
@@ -679,10 +692,10 @@
                     IdentityProvisioningConstants.USERNAME_CLAIM_URI, null, null, false),
                                    Arrays.asList(new String[]{userName}));
         }
-        List<String> roleListOfUser = getUserRoles(userName, tenantDomain);
-        if (roleListOfUser != null) {
+        List<String> groupListOfUser = getUserGroups(userName, tenantDomain);
+        if (groupListOfUser != null) {
             outboundAttributes.put(ClaimMapping.build(
-                    GROUP_CLAIM_URI, null, null, false), roleListOfUser);
+                    GROUP_CLAIM_URI, null, null, false), groupListOfUser);
         }
 
         String domainAwareName = userName;
@@ -873,14 +886,21 @@
             String userName = provisioningEntity.getEntityName();
             List<String> provisioningRoleList = Arrays.asList(provisionByRoleList);
 
+            /* Both user groups and roles are considered when deciding to outbound provisioning.
+               The roles have "Internal/" prefix compared to the groups. */
+            List<String> roleGroupListOfUser = new ArrayList<>();
+            List<String> groupListOfUser = getUserGroups(userName, tenantDomain);
+            // Only fetch directly assigned roles to the user.
             List<String> roleListOfUser = getUserRoles(userName, tenantDomain);
-            if (userHasProvisioningRoles(roleListOfUser, provisioningRoleList, userName)) {
+            roleGroupListOfUser.addAll(roleListOfUser);
+            roleGroupListOfUser.addAll(groupListOfUser);
+            if (userHasProvisioningRoles(roleGroupListOfUser, provisioningRoleList, userName)) {
                 return true;
             }
-            List<String> newRoleListOfUser = provisioningEntity.getAttributes().get(ClaimMapping.build
+            List<String> newGroupListOfUser = provisioningEntity.getAttributes().get(ClaimMapping.build
                         (GROUP_CLAIM_URI, null, null, false));
 
-            if (userHasProvisioningRoles(newRoleListOfUser, provisioningRoleList, userName)) {
+            if (userHasProvisioningRoles(newGroupListOfUser, provisioningRoleList, userName)) {
                 return true;
             }
         }
@@ -913,7 +933,7 @@
      * @throws CarbonException
      * @throws UserStoreException
      */
-    private List<String> getUserRoles(String userName, String tenantDomain) throws UserStoreException {
+    private List<String> getUserGroups(String userName, String tenantDomain) throws UserStoreException {
 
         RealmService realmService = IdentityProvisionServiceComponent.getRealmService();
         int tenantId = realmService.getTenantManager().getTenantId(tenantDomain);
@@ -922,7 +942,37 @@
 
         UserStoreManager userstore = realm.getUserStoreManager();
         String[] newRoles = userstore.getRoleListOfUser(userName);
-        return Arrays.asList(newRoles);
+        return Arrays.stream(newRoles).filter(role -> !role.startsWith(INTERNAL_DOMAIN)).collect(Collectors.toList());
+    }
+
+    private List<String> getUserRoles(String username, String tenantDomain) throws UserStoreException {
+
+        List<String> userRoleList = new ArrayList<>();
+        RealmService realmService = IdentityProvisionServiceComponent.getRealmService();
+        int tenantId = realmService.getTenantManager().getTenantId(tenantDomain);
+        UserRealm realm = (UserRealm) realmService.getTenantUserRealm(tenantId);
+        AbstractUserStoreManager userStoreManager = (AbstractUserStoreManager) realm.getUserStoreManager();
+        String userId = userStoreManager.getUserIDFromUserName(username);
+        if (userId == null) {
+            return userRoleList;
+        }
+        try {
+            List<String> userRoleIdList = ProvisioningServiceDataHolder.getInstance().getRoleManagementService()
+                    .getRoleIdListOfUser(userId, tenantDomain);
+            for (String roleId : userRoleIdList) {
+                RoleBasicInfo roleBasicInfo = ProvisioningServiceDataHolder.getInstance().getRoleManagementService()
+                        .getRoleBasicInfoById(roleId, tenantDomain);
+                // Only organization audience roles are supported for role based outbound provisioning.
+                if (!RoleConstants.ORGANIZATION.equals(roleBasicInfo.getAudience())) {
+                    continue;
+                }
+                userRoleList.add(roleBasicInfo.getName());
+            }
+        } catch (IdentityRoleManagementException e) {
+            throw new UserStoreException(e.getMessage(), e);
+        }
+        String internalRolePrefix = RoleConstants.INTERNAL_DOMAIN + UserCoreConstants.DOMAIN_SEPARATOR;
+        return userRoleList.stream().map(role -> internalRolePrefix + role).collect(Collectors.toList());
     }
 
     /**

components/provisioning/org.wso2.carbon.identity.provisioning/src/main/java/org/wso2/carbon/identity/provisioning/ProvisioningUtil.java

@@ -28,6 +28,7 @@
 import org.wso2.carbon.identity.application.common.model.ServiceProvider;
 import org.wso2.carbon.identity.application.common.model.OutboundProvisioningConfig;
 import org.wso2.carbon.identity.application.common.util.IdentityApplicationConstants;
+import org.wso2.carbon.identity.application.mgt.ApplicationConstants;
 import org.wso2.carbon.identity.application.mgt.ApplicationManagementService;
 import org.wso2.carbon.identity.claim.metadata.mgt.ClaimMetadataHandler;
 import org.wso2.carbon.identity.core.util.IdentityUtil;
@@ -560,6 +561,14 @@
     public static boolean isOutboundProvisioningEnabled(String serviceProviderIdentifier,
                                                         String tenantDomainName) throws IdentityApplicationManagementException {
 
+        /*
+            Outbound provisioning is enabled for organization by default. If application bound provisioning enabled,
+            each application should configure outbound provisioning.
+        */
+        if (!isApplicationBasedOutboundProvisioningEnabled()) {
+            return true;
+        }
+
         ServiceProvider serviceProvider = ApplicationManagementService.getInstance()
                 .getServiceProvider(serviceProviderIdentifier, tenantDomainName);
 
@@ -568,6 +577,11 @@
                     serviceProviderIdentifier);
         }
 
+        // The console app not required to enable outbound provisioning.
+        if (ApplicationConstants.CONSOLE_APPLICATION_NAME.equals(serviceProvider.getApplicationName())) {
+            return true;
+        }
+
         OutboundProvisioningConfig outboundProvisioningConfiguration = serviceProvider
                 .getOutboundProvisioningConfig();
 

components/provisioning/org.wso2.carbon.identity.provisioning/src/main/java/org/wso2/carbon/identity/provisioning/internal/IdentityProvisionServiceComponent.java

@@ -36,6 +36,9 @@
 import org.wso2.carbon.identity.provisioning.listener.ProvisioningApplicationMgtListener;
 import org.wso2.carbon.identity.provisioning.listener.ProvisioningErrorListener;
 import org.wso2.carbon.identity.provisioning.listener.ProvisioningIdentityProviderMgtListener;
+import org.wso2.carbon.identity.provisioning.listener.ProvisioningRoleMgtListener;
+import org.wso2.carbon.identity.role.v2.mgt.core.RoleManagementService;
+import org.wso2.carbon.identity.role.v2.mgt.core.listener.RoleManagementListener;
 import org.wso2.carbon.idp.mgt.listener.IdentityProviderMgtListener;
 import org.wso2.carbon.user.core.listener.UserManagementErrorEventListener;
 import org.wso2.carbon.user.core.listener.UserOperationEventListener;
@@ -88,7 +91,10 @@
     protected void activate(ComponentContext context) {
         try {
             ProvisioningServiceDataHolder.getInstance().setBundleContext(context.getBundleContext());
-            ProvisioningServiceDataHolder.getInstance().getBundleContext().registerService(UserOperationEventListener.class.getName(), new DefaultInboundUserProvisioningListener(), null);
+            DefaultInboundUserProvisioningListener provisioningListener = new DefaultInboundUserProvisioningListener();
+            ProvisioningServiceDataHolder.getInstance().setDefaultInboundUserProvisioningListener(provisioningListener);
+            ProvisioningServiceDataHolder.getInstance().getBundleContext()
+                    .registerService(UserOperationEventListener.class.getName(), provisioningListener, null);
             if (log.isDebugEnabled()) {
                 log.debug("Identity Provision Event listener registered successfully");
             }
@@ -103,6 +109,9 @@
             ProvisioningServiceDataHolder.getInstance().getBundleContext()
                     .registerService(UserManagementErrorEventListener.class.getName(), new ProvisioningErrorListener(),
                             null);
+            ProvisioningServiceDataHolder.getInstance().getBundleContext()
+                    .registerService(RoleManagementListener.class, new ProvisioningRoleMgtListener(), null);
+            log.debug("Provisioning role management listener registered successfully");
             if (log.isDebugEnabled()) {
                 log.debug("Identity provisioning error event listener registered successfully");
             }
@@ -207,5 +216,23 @@
         }
         ProvisioningServiceDataHolder.getInstance().setRolePermissionManagementService(null);
     }
+
+    @Reference(
+            name = "org.wso2.carbon.identity.role.v2.mgt.core.RoleManagementService",
+            service = org.wso2.carbon.identity.role.v2.mgt.core.RoleManagementService.class,
+            cardinality = ReferenceCardinality.MANDATORY,
+            policy = ReferencePolicy.DYNAMIC,
+            unbind = "unsetRoleManagementServiceV2")
+    protected void setRoleManagementServiceV2(RoleManagementService roleManagementService) {
+
+        ProvisioningServiceDataHolder.getInstance().setRoleManagementService(roleManagementService);
+        log.debug("RoleManagementService set in ProvisioningServiceDataHolder bundle.");
+    }
+
+    protected void unsetRoleManagementServiceV2(RoleManagementService roleManagementService) {
+
+        ProvisioningServiceDataHolder.getInstance().setRoleManagementService(null);
+        log.debug("RoleManagementService unset in ProvisioningServiceDataHolder bundle.");
+    }
 }
 

components/provisioning/org.wso2.carbon.identity.provisioning/src/main/java/org/wso2/carbon/identity/provisioning/internal/ProvisioningServiceDataHolder.java

@@ -21,6 +21,8 @@
 import org.osgi.framework.BundleContext;
 import org.wso2.carbon.identity.entitlement.EntitlementService;
 import org.wso2.carbon.identity.provisioning.AbstractProvisioningConnectorFactory;
+import org.wso2.carbon.identity.provisioning.listener.DefaultInboundUserProvisioningListener;
+import org.wso2.carbon.identity.role.v2.mgt.core.RoleManagementService;
 import org.wso2.carbon.user.core.service.RealmService;
 import org.wso2.carbon.user.mgt.RolePermissionManagementService;
 
@@ -35,6 +37,8 @@
     private EntitlementService entitlementService;
     private RolePermissionManagementService rolePermissionManagementService;
     private Map<String, AbstractProvisioningConnectorFactory> connectorFactories = new HashMap<String, AbstractProvisioningConnectorFactory>();
+    private DefaultInboundUserProvisioningListener defaultInboundUserProvisioningListener;
+    private RoleManagementService roleManagementService;
 
     private ProvisioningServiceDataHolder() {
     }
@@ -94,6 +98,27 @@
         }
         return rolePermissionManagementService;
     }
+
+    public DefaultInboundUserProvisioningListener getDefaultInboundUserProvisioningListener() {
+
+        return defaultInboundUserProvisioningListener;
+    }
+
+    public void setDefaultInboundUserProvisioningListener(
+            DefaultInboundUserProvisioningListener defaultInboundUserProvisioningListener) {
+
+        this.defaultInboundUserProvisioningListener = defaultInboundUserProvisioningListener;
+    }
+
+    public RoleManagementService getRoleManagementService() {
+
+        return roleManagementService;
+    }
+
+    public void setRoleManagementService(RoleManagementService roleManagementService) {
+
+        this.roleManagementService = roleManagementService;
+    }
 }
 
 

components/provisioning/org.wso2.carbon.identity.provisioning/src/main/java/org/wso2/carbon/identity/provisioning/listener/DefaultInboundUserProvisioningListener.java

@@ -39,6 +39,7 @@
 import org.wso2.carbon.identity.provisioning.ProvisioningEntityType;
 import org.wso2.carbon.identity.provisioning.ProvisioningOperation;
 import org.wso2.carbon.identity.provisioning.ProvisioningUtil;
+import org.wso2.carbon.identity.role.v2.mgt.core.util.RoleManagementUtils;
 import org.wso2.carbon.user.api.Permission;
 import org.wso2.carbon.user.core.UserStoreException;
 import org.wso2.carbon.user.core.UserStoreManager;
@@ -435,7 +436,11 @@
                 return true;
             }
 
-            String[] userList = userStoreManager.getUserListOfRole(roleName);
+            String[] userList = new String[0];
+            // Passing all user list of the role is not used, hence we can remove this logic if unnecessary.
+            if (!RoleManagementUtils.isHybridRole(roleName)) {
+                userList = userStoreManager.getUserListOfRole(roleName);
+            }
 
             Map<ClaimMapping, List<String>> outboundAttributes = new HashMap<>();