You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@syncope.apache.org by il...@apache.org on 2018/07/24 08:06:04 UTC

[2/3] syncope git commit: Extensive usage of SyncopeConstants.ROOT_REALM + review group search only when entitlement is owned

Extensive usage of SyncopeConstants.ROOT_REALM + review group search only when entitlement is owned


Project: http://git-wip-us.apache.org/repos/asf/syncope/repo
Commit: http://git-wip-us.apache.org/repos/asf/syncope/commit/c98b3e72
Tree: http://git-wip-us.apache.org/repos/asf/syncope/tree/c98b3e72
Diff: http://git-wip-us.apache.org/repos/asf/syncope/diff/c98b3e72

Branch: refs/heads/master
Commit: c98b3e723f164114d242e2182119857c7ae7c9f3
Parents: ae5a7ff
Author: Francesco Chicchiriccò <il...@apache.org>
Authored: Tue Jul 24 09:47:28 2018 +0200
Committer: Francesco Chicchiriccò <il...@apache.org>
Committed: Tue Jul 24 09:47:41 2018 +0200

----------------------------------------------------------------------
 .../console/panels/GroupDirectoryPanel.java     | 10 ++---
 .../console/panels/RoleDirectoryPanel.java      | 17 ++++----
 .../panels/search/AbstractSearchPanel.java      | 19 ++++-----
 .../panels/search/AnyObjectSearchPanel.java     | 14 ++-----
 .../panels/search/SearchClausePanel.java        | 13 +++---
 .../console/panels/search/UserSearchPanel.java  |  1 -
 .../client/console/rest/GroupRestClient.java    | 32 ++------------
 .../client/console/wizards/any/Groups.java      | 44 +++++++++-----------
 8 files changed, 55 insertions(+), 95 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/syncope/blob/c98b3e72/client/console/src/main/java/org/apache/syncope/client/console/panels/GroupDirectoryPanel.java
----------------------------------------------------------------------
diff --git a/client/console/src/main/java/org/apache/syncope/client/console/panels/GroupDirectoryPanel.java b/client/console/src/main/java/org/apache/syncope/client/console/panels/GroupDirectoryPanel.java
index 6bef561..59c4901 100644
--- a/client/console/src/main/java/org/apache/syncope/client/console/panels/GroupDirectoryPanel.java
+++ b/client/console/src/main/java/org/apache/syncope/client/console/panels/GroupDirectoryPanel.java
@@ -95,10 +95,10 @@ public class GroupDirectoryPanel extends AnyDirectoryPanel<GroupTO, GroupRestCli
             protected Serializable onApplyInternal(
                     final GroupTO groupTO, final String type, final AjaxRequestTarget target) {
 
-                final AnyTypeRestClient typeRestClient = new AnyTypeRestClient();
-                final AnyTypeClassRestClient classRestClient = new AnyTypeClassRestClient();
+                AnyTypeRestClient typeRestClient = new AnyTypeRestClient();
+                AnyTypeClassRestClient classRestClient = new AnyTypeClassRestClient();
 
-                final AnyTypeTO anyTypeTO = typeRestClient.read(type);
+                AnyTypeTO anyTypeTO = typeRestClient.read(type);
 
                 ModalPanel panel = new AnyPanel(BaseModal.CONTENT_ID, anyTypeTO, null, null, false, pageRef) {
 
@@ -116,7 +116,7 @@ public class GroupDirectoryPanel extends AnyDirectoryPanel<GroupTO, GroupRestCli
 
                             panel = new UserDirectoryPanel.Builder(
                                     classRestClient.list(anyTypeTO.getClasses()), anyTypeTO.getKey(), pageRef).
-                                    setRealm("/").
+                                    setRealm(SyncopeConstants.ROOT_REALM).
                                     setFiltered(true).
                                     setFiql(query).
                                     disableCheckBoxes().
@@ -136,7 +136,7 @@ public class GroupDirectoryPanel extends AnyDirectoryPanel<GroupTO, GroupRestCli
 
                             panel = new AnyObjectDirectoryPanel.Builder(
                                     classRestClient.list(anyTypeTO.getClasses()), anyTypeTO.getKey(), pageRef).
-                                    setRealm("/").
+                                    setRealm(SyncopeConstants.ROOT_REALM).
                                     setFiltered(true).
                                     setFiql(query).
                                     disableCheckBoxes().

http://git-wip-us.apache.org/repos/asf/syncope/blob/c98b3e72/client/console/src/main/java/org/apache/syncope/client/console/panels/RoleDirectoryPanel.java
----------------------------------------------------------------------
diff --git a/client/console/src/main/java/org/apache/syncope/client/console/panels/RoleDirectoryPanel.java b/client/console/src/main/java/org/apache/syncope/client/console/panels/RoleDirectoryPanel.java
index 1301f0d..ed17bc3 100644
--- a/client/console/src/main/java/org/apache/syncope/client/console/panels/RoleDirectoryPanel.java
+++ b/client/console/src/main/java/org/apache/syncope/client/console/panels/RoleDirectoryPanel.java
@@ -47,6 +47,7 @@ import org.apache.syncope.client.console.wizards.WizardMgtPanel;
 import org.apache.syncope.client.console.wizards.role.RoleWrapper;
 import org.apache.syncope.client.lib.SyncopeClient;
 import org.apache.syncope.common.lib.SyncopeClientException;
+import org.apache.syncope.common.lib.SyncopeConstants;
 import org.apache.syncope.common.lib.to.AnyTypeTO;
 import org.apache.syncope.common.lib.to.RoleTO;
 import org.apache.syncope.common.lib.to.UserTO;
@@ -145,7 +146,7 @@ public class RoleDirectoryPanel extends DirectoryPanel<RoleTO, RoleWrapper, Role
 
             @Override
             public void onClick(final AjaxRequestTarget target, final RoleTO ignore) {
-                final RoleTO clone = SerializationUtils.clone(model.getObject());
+                RoleTO clone = SerializationUtils.clone(model.getObject());
                 clone.setKey(null);
                 send(RoleDirectoryPanel.this, Broadcast.EXACT,
                         new AjaxWizard.NewItemActionEvent<>(new RoleWrapper(clone), target));
@@ -158,14 +159,14 @@ public class RoleDirectoryPanel extends DirectoryPanel<RoleTO, RoleWrapper, Role
 
             @Override
             public void onClick(final AjaxRequestTarget target, final RoleTO ignore) {
-                final String query = SyncopeClient.getUserSearchConditionBuilder().and(
+                String query = SyncopeClient.getUserSearchConditionBuilder().and(
                         SyncopeClient.getUserSearchConditionBuilder().inRoles(model.getObject().getKey()),
                         SyncopeClient.getUserSearchConditionBuilder().is("key").notNullValue()).query();
 
-                final AnyTypeRestClient typeRestClient = new AnyTypeRestClient();
-                final AnyTypeClassRestClient classRestClient = new AnyTypeClassRestClient();
+                AnyTypeRestClient typeRestClient = new AnyTypeRestClient();
+                AnyTypeClassRestClient classRestClient = new AnyTypeClassRestClient();
 
-                final AnyTypeTO anyTypeTO = typeRestClient.read(AnyTypeKind.USER.name());
+                AnyTypeTO anyTypeTO = typeRestClient.read(AnyTypeKind.USER.name());
 
                 ModalPanel panel = new AnyPanel(BaseModal.CONTENT_ID, anyTypeTO, null, null, false, pageRef) {
 
@@ -173,9 +174,9 @@ public class RoleDirectoryPanel extends DirectoryPanel<RoleTO, RoleWrapper, Role
 
                     @Override
                     protected Panel getDirectoryPanel(final String id) {
-                        final Panel panel = new UserDirectoryPanel.Builder(
+                        Panel panel = new UserDirectoryPanel.Builder(
                                 classRestClient.list(anyTypeTO.getClasses()), anyTypeTO.getKey(), pageRef).
-                                setRealm("/").
+                                setRealm(SyncopeConstants.ROOT_REALM).
                                 setFiltered(true).
                                 setFiql(query).
                                 disableCheckBoxes().
@@ -208,7 +209,7 @@ public class RoleDirectoryPanel extends DirectoryPanel<RoleTO, RoleWrapper, Role
 
             @Override
             public void onClick(final AjaxRequestTarget target, final RoleTO ignore) {
-                final ConsoleLayoutInfo info = new ConsoleLayoutInfo(model.getObject().getKey());
+                ConsoleLayoutInfo info = new ConsoleLayoutInfo(model.getObject().getKey());
                 info.setContent(restClient.readConsoleLayoutInfo(model.getObject().getKey()));
 
                 utilityModal.header(new ResourceModel("console.layout.info", "JSON Content"));

http://git-wip-us.apache.org/repos/asf/syncope/blob/c98b3e72/client/console/src/main/java/org/apache/syncope/client/console/panels/search/AbstractSearchPanel.java
----------------------------------------------------------------------
diff --git a/client/console/src/main/java/org/apache/syncope/client/console/panels/search/AbstractSearchPanel.java b/client/console/src/main/java/org/apache/syncope/client/console/panels/search/AbstractSearchPanel.java
index 9103ba6..6094143 100644
--- a/client/console/src/main/java/org/apache/syncope/client/console/panels/search/AbstractSearchPanel.java
+++ b/client/console/src/main/java/org/apache/syncope/client/console/panels/search/AbstractSearchPanel.java
@@ -24,18 +24,20 @@ import java.util.Map;
 import java.util.function.Function;
 import java.util.stream.Collectors;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.syncope.client.console.SyncopeConsoleSession;
 import org.apache.syncope.client.console.rest.AnyTypeRestClient;
 import org.apache.syncope.client.console.rest.GroupRestClient;
 import org.apache.syncope.client.console.rest.ResourceRestClient;
 import org.apache.syncope.client.console.rest.SchemaRestClient;
 import org.apache.syncope.client.console.wicket.markup.html.form.MultiFieldPanel;
+import org.apache.syncope.common.lib.SyncopeConstants;
 import org.apache.syncope.common.lib.search.SearchableFields;
 import org.apache.syncope.common.lib.to.EntityTO;
 import org.apache.syncope.common.lib.to.PlainSchemaTO;
 import org.apache.syncope.common.lib.types.AnyTypeKind;
 import org.apache.syncope.common.lib.types.SchemaType;
+import org.apache.syncope.common.lib.types.StandardEntitlement;
 import org.apache.wicket.event.IEventSink;
-import org.apache.wicket.extensions.markup.html.repeater.util.SortParam;
 import org.apache.wicket.markup.html.WebMarkupContainer;
 import org.apache.wicket.markup.html.panel.Panel;
 import org.apache.wicket.model.IModel;
@@ -128,11 +130,9 @@ public abstract class AbstractSearchPanel extends Panel {
         super(id);
         populate();
         Pair<IModel<Map<String, String>>, Integer> groupInfo =
-                Pair.of(groupNames, groupRestClient.search("/",
-                        null,
-                        1,
-                        1,
-                        new SortParam<>("name", true)).getTotalCount());
+                SyncopeConsoleSession.get().owns(StandardEntitlement.GROUP_SEARCH)
+                ? Pair.of(groupNames, groupRestClient.count(SyncopeConstants.ROOT_REALM, null, null))
+                : Pair.of(groupNames, 0);
 
         this.model = builder.model;
         this.typeKind = kind;
@@ -185,10 +185,9 @@ public abstract class AbstractSearchPanel extends Panel {
 
             @Override
             protected Map<String, PlainSchemaTO> load() {
-                final List<PlainSchemaTO> schemas = schemaRestClient.<PlainSchemaTO>getSchemas(
-                        SchemaType.PLAIN, null, anyTypeRestClient.read(type).getClasses().toArray(new String[] {}));
-
-                return schemas.stream().collect(Collectors.toMap(schema -> schema.getKey(), Function.identity()));
+                return schemaRestClient.<PlainSchemaTO>getSchemas(
+                        SchemaType.PLAIN, null, anyTypeRestClient.read(type).getClasses().toArray(new String[] {})).
+                        stream().collect(Collectors.toMap(schema -> schema.getKey(), Function.identity()));
             }
         };
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/c98b3e72/client/console/src/main/java/org/apache/syncope/client/console/panels/search/AnyObjectSearchPanel.java
----------------------------------------------------------------------
diff --git a/client/console/src/main/java/org/apache/syncope/client/console/panels/search/AnyObjectSearchPanel.java b/client/console/src/main/java/org/apache/syncope/client/console/panels/search/AnyObjectSearchPanel.java
index 0a94110..75c03ac 100644
--- a/client/console/src/main/java/org/apache/syncope/client/console/panels/search/AnyObjectSearchPanel.java
+++ b/client/console/src/main/java/org/apache/syncope/client/console/panels/search/AnyObjectSearchPanel.java
@@ -19,9 +19,10 @@
 package org.apache.syncope.client.console.panels.search;
 
 import java.util.ArrayList;
-import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.stream.Collectors;
+import org.apache.syncope.common.lib.SyncopeConstants;
 import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.common.lib.types.AnyTypeKind;
 import org.apache.wicket.extensions.markup.html.repeater.util.SortParam;
@@ -79,19 +80,12 @@ public class AnyObjectSearchPanel extends AbstractSearchPanel {
 
             @Override
             protected Map<String, String> load() {
-                List<GroupTO> res = groupRestClient.search("/",
+                return groupRestClient.search(SyncopeConstants.ROOT_REALM,
                         null,
                         1,
                         MAX_GROUP_LIST_CARDINALITY,
                         new SortParam<>("name", true),
-                        null);
-
-                final Map<String, String> result = new HashMap<>(res.size());
-                for (GroupTO group : res) {
-                    result.put(group.getKey(), group.getName());
-                }
-
-                return result;
+                        null).stream().collect(Collectors.toMap(GroupTO::getKey, GroupTO::getName));
             }
         };
     }

http://git-wip-us.apache.org/repos/asf/syncope/blob/c98b3e72/client/console/src/main/java/org/apache/syncope/client/console/panels/search/SearchClausePanel.java
----------------------------------------------------------------------
diff --git a/client/console/src/main/java/org/apache/syncope/client/console/panels/search/SearchClausePanel.java b/client/console/src/main/java/org/apache/syncope/client/console/panels/search/SearchClausePanel.java
index 0156619..69e6e1c 100644
--- a/client/console/src/main/java/org/apache/syncope/client/console/panels/search/SearchClausePanel.java
+++ b/client/console/src/main/java/org/apache/syncope/client/console/panels/search/SearchClausePanel.java
@@ -41,6 +41,7 @@ import org.apache.syncope.client.console.wicket.markup.html.form.AjaxDropDownCho
 import org.apache.syncope.client.console.wicket.markup.html.form.AjaxTextFieldPanel;
 import org.apache.syncope.client.console.wicket.markup.html.form.FieldPanel;
 import org.apache.syncope.client.lib.SyncopeClient;
+import org.apache.syncope.common.lib.SyncopeConstants;
 import org.apache.syncope.common.lib.to.GroupTO;
 import org.apache.syncope.common.lib.to.PlainSchemaTO;
 import org.apache.syncope.common.lib.to.RelationshipTypeTO;
@@ -397,8 +398,7 @@ public class SearchClausePanel extends FieldPanel<SearchClause> {
                 if (field.getModel().getObject().getType() == Type.GROUP_MEMBERSHIP) {
                     String[] inputAsArray = property.getField().getInputAsArray();
 
-                    if (StringUtils.isBlank(property.getField().getInput())
-                            || inputAsArray.length == 0) {
+                    if (StringUtils.isBlank(property.getField().getInput()) || inputAsArray.length == 0) {
                         property.setChoices(properties.getObject());
                     } else {
                         String inputValue = (inputAsArray.length > 1 && inputAsArray[1] != null)
@@ -412,18 +412,15 @@ public class SearchClausePanel extends FieldPanel<SearchClause> {
                                 ? inputValue : "*" + inputValue + "*");
 
                         if (groupInfo.getRight() > AnyObjectSearchPanel.MAX_GROUP_LIST_CARDINALITY) {
-                            List<GroupTO> filteredGroups = groupRestClient.search("/",
+                            property.setChoices(groupRestClient.search(
+                                    SyncopeConstants.ROOT_REALM,
                                     SyncopeClient.getGroupSearchConditionBuilder().
                                             is("name").equalToIgnoreCase(inputValue).
                                             query(),
                                     1,
                                     AnyObjectSearchPanel.MAX_GROUP_LIST_CARDINALITY,
                                     new SortParam<>("name", true),
-                                    null);
-                            List<String> names = filteredGroups.stream().
-                                    map(GroupTO::getName).collect(Collectors.toList());
-                            Collections.sort(names);
-                            property.setChoices(names);
+                                    null).stream().map(GroupTO::getName).collect(Collectors.toList()));
                         }
                     }
                 }

http://git-wip-us.apache.org/repos/asf/syncope/blob/c98b3e72/client/console/src/main/java/org/apache/syncope/client/console/panels/search/UserSearchPanel.java
----------------------------------------------------------------------
diff --git a/client/console/src/main/java/org/apache/syncope/client/console/panels/search/UserSearchPanel.java b/client/console/src/main/java/org/apache/syncope/client/console/panels/search/UserSearchPanel.java
index 7dd81b3..9de89ef 100644
--- a/client/console/src/main/java/org/apache/syncope/client/console/panels/search/UserSearchPanel.java
+++ b/client/console/src/main/java/org/apache/syncope/client/console/panels/search/UserSearchPanel.java
@@ -92,5 +92,4 @@ public final class UserSearchPanel extends AnyObjectSearchPanel {
         result.add(SearchClause.Type.RELATIONSHIP);
         return result;
     }
-
 }

http://git-wip-us.apache.org/repos/asf/syncope/blob/c98b3e72/client/console/src/main/java/org/apache/syncope/client/console/rest/GroupRestClient.java
----------------------------------------------------------------------
diff --git a/client/console/src/main/java/org/apache/syncope/client/console/rest/GroupRestClient.java b/client/console/src/main/java/org/apache/syncope/client/console/rest/GroupRestClient.java
index 9ecd9ca..e5d642b 100644
--- a/client/console/src/main/java/org/apache/syncope/client/console/rest/GroupRestClient.java
+++ b/client/console/src/main/java/org/apache/syncope/client/console/rest/GroupRestClient.java
@@ -18,13 +18,11 @@
  */
 package org.apache.syncope.client.console.rest;
 
-import java.util.ArrayList;
 import java.util.List;
 import javax.ws.rs.core.GenericType;
 import javax.ws.rs.core.Response;
 import org.apache.syncope.common.lib.patch.GroupPatch;
 import org.apache.syncope.common.lib.to.GroupTO;
-import org.apache.syncope.common.lib.to.PagedResult;
 import org.apache.syncope.common.lib.to.ProvisioningResult;
 import org.apache.syncope.common.lib.types.BulkMembersActionType;
 import org.apache.syncope.common.rest.api.beans.AnyQuery;
@@ -77,33 +75,9 @@ public class GroupRestClient extends AbstractAnyRestClient<GroupTO> {
             final SortParam<String> sort,
             final String type) {
 
-        List<GroupTO> result = new ArrayList<>();
-        PagedResult<GroupTO> res;
-        do {
-            res = getService(GroupService.class).
-                    search(new AnyQuery.Builder().realm(realm).fiql(fiql).page(page).size(size).
-                            orderBy(toOrderBy(sort)).details(false).build());
-            result.addAll(res.getResult());
-        } while (page == -1 && size == -1 && res.getNext() != null);
-
-        return result;
-    }
-
-    public PagedResult<GroupTO> search(
-            final String realm,
-            final String fiql,
-            final int page,
-            final int size,
-            final SortParam<String> sort) {
-
-        PagedResult<GroupTO> res;
-        do {
-            res = getService(GroupService.class).
-                    search(new AnyQuery.Builder().realm(realm).fiql(fiql).page(page).size(size).
-                            orderBy(toOrderBy(sort)).details(false).build());
-        } while (page == -1 && size == -1 && res.getNext() != null);
-
-        return res;
+        return getService(GroupService.class).
+                search(new AnyQuery.Builder().realm(realm).fiql(fiql).page(page).size(size).
+                        orderBy(toOrderBy(sort)).details(false).build()).getResult();
     }
 
     public void bulkMembersAction(final String key, final BulkMembersActionType actionType) {

http://git-wip-us.apache.org/repos/asf/syncope/blob/c98b3e72/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/Groups.java
----------------------------------------------------------------------
diff --git a/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/Groups.java b/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/Groups.java
index eb99715..29e4111 100644
--- a/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/Groups.java
+++ b/client/console/src/main/java/org/apache/syncope/client/console/wizards/any/Groups.java
@@ -22,16 +22,19 @@ import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.function.Function;
 import java.util.stream.Collectors;
 import org.apache.commons.collections4.ListUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.cxf.jaxrs.ext.search.client.CompleteCondition;
 import org.apache.syncope.client.console.SyncopeConsoleApplication;
+import org.apache.syncope.client.console.SyncopeConsoleSession;
 import org.apache.syncope.client.console.rest.DynRealmRestClient;
 import org.apache.syncope.client.console.rest.GroupRestClient;
 import org.apache.syncope.client.console.wicket.ajax.markup.html.LabelInfo;
 import org.apache.syncope.client.console.wicket.markup.html.form.AjaxPalettePanel;
 import org.apache.syncope.client.lib.SyncopeClient;
+import org.apache.syncope.common.lib.SyncopeConstants;
 import org.apache.syncope.common.lib.search.GroupFiqlSearchConditionBuilder;
 import org.apache.syncope.common.lib.to.AnyTO;
 import org.apache.syncope.common.lib.to.DynRealmTO;
@@ -44,6 +47,7 @@ import org.apache.wicket.markup.html.form.IChoiceRenderer;
 import org.apache.wicket.model.IModel;
 import org.apache.wicket.model.util.ListModel;
 import org.apache.syncope.common.lib.to.GroupableRelatableTO;
+import org.apache.syncope.common.lib.types.StandardEntitlement;
 import org.apache.wicket.authroles.authorization.strategies.role.metadata.ActionPermissions;
 import org.apache.wicket.authroles.authorization.strategies.role.metadata.MetaDataRoleAuthorizationStrategy;
 import org.apache.wicket.extensions.wizard.WizardModel.ICondition;
@@ -246,23 +250,20 @@ public class Groups extends WizardStep implements ICondition {
             // this is to be sure to have group names (required to see membership details in approval page)
             GroupFiqlSearchConditionBuilder searchConditionBuilder = SyncopeClient.getGroupSearchConditionBuilder();
 
-            List<CompleteCondition> conditions = new ArrayList<>();
-            GroupableRelatableTO.class.cast(anyTO).getMemberships().forEach(membershipTO -> {
-                conditions.add(searchConditionBuilder.is("key").equalTo(membershipTO.getGroupKey()).wrap());
-            });
+            List<CompleteCondition> conditions = GroupableRelatableTO.class.cast(anyTO).getMemberships().
+                    stream().map(membership
+                            -> searchConditionBuilder.is("key").equalTo(membership.getGroupKey()).wrap()).
+                    collect(Collectors.toList());
 
             Map<String, GroupTO> assignedGroups = new HashMap<>();
             if (!conditions.isEmpty()) {
-                groupRestClient.search(
+                assignedGroups.putAll(groupRestClient.search(
                         realm,
                         searchConditionBuilder.isAssignable().and().or(conditions).query(),
                         -1,
                         -1,
                         new SortParam<>("name", true),
-                        null).
-                        forEach(group -> {
-                            assignedGroups.put(group.getKey(), group);
-                        });
+                        null).stream().collect(Collectors.toMap(GroupTO::getKey, Function.identity())));
             }
 
             // set group names in membership TOs and remove membership not assignable
@@ -290,26 +291,21 @@ public class Groups extends WizardStep implements ICondition {
         private void reloadDynMemberships() {
             GroupFiqlSearchConditionBuilder searchConditionBuilder = SyncopeClient.getGroupSearchConditionBuilder();
 
-            ArrayList<CompleteCondition> conditions = new ArrayList<>();
-            GroupableRelatableTO.class.cast(anyTO).getDynMemberships().forEach(membership -> {
-                conditions.add(searchConditionBuilder.is("key").equalTo(membership.getGroupKey()).wrap());
-            });
+            List<CompleteCondition> conditions = GroupableRelatableTO.class.cast(anyTO).getDynMemberships().
+                    stream().map(membership
+                            -> searchConditionBuilder.is("key").equalTo(membership.getGroupKey()).wrap()).
+                    collect(Collectors.toList());
 
-            Map<String, GroupTO> assignedGroups = new HashMap<>();
-            if (!conditions.isEmpty()) {
-                groupRestClient.search(
-                        "/",
+            dynMemberships = new ArrayList<>();
+            if (SyncopeConsoleSession.get().owns(StandardEntitlement.GROUP_SEARCH) && !conditions.isEmpty()) {
+                dynMemberships.addAll(groupRestClient.search(
+                        SyncopeConstants.ROOT_REALM,
                         searchConditionBuilder.or(conditions).query(),
                         -1,
                         -1,
                         new SortParam<>("name", true),
-                        null).
-                        forEach(group -> {
-                            assignedGroups.put(group.getKey(), group);
-                        });
+                        null).stream().map(GroupTO::getName).collect(Collectors.toList()));
             }
-
-            dynMemberships = assignedGroups.values().stream().map(GroupTO::getName).collect(Collectors.toList());
         }
 
         /**
@@ -320,7 +316,7 @@ public class Groups extends WizardStep implements ICondition {
 
             if (Groups.this.templateMode) {
                 reload = realm == null;
-                realm = "/";
+                realm = SyncopeConstants.ROOT_REALM;
             } else {
                 reload = !Groups.this.anyTO.getRealm().equalsIgnoreCase(realm);
                 realm = Groups.this.anyTO.getRealm();