You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@syncope.apache.org by il...@apache.org on 2014/11/03 19:35:39 UTC

[1/8] git commit: [SYNCOPE-599] Enhancements to console's authorization parsing

Repository: syncope
Updated Branches:
  refs/heads/1_1_X 79ef5134a -> 05d2985a4
  refs/heads/1_2_X 70b53404a -> f1607400c
  refs/heads/master ae52953b0 -> 31f82867a


[SYNCOPE-599] Enhancements to console's authorization parsing


Project: http://git-wip-us.apache.org/repos/asf/syncope/repo
Commit: http://git-wip-us.apache.org/repos/asf/syncope/commit/05d2985a
Tree: http://git-wip-us.apache.org/repos/asf/syncope/tree/05d2985a
Diff: http://git-wip-us.apache.org/repos/asf/syncope/diff/05d2985a

Branch: refs/heads/1_1_X
Commit: 05d2985a47cb2104a6b43d553b4707209c261f94
Parents: 79ef513
Author: Francesco Chicchiriccò <il...@apache.org>
Authored: Mon Nov 3 19:19:21 2014 +0100
Committer: Francesco Chicchiriccò <il...@apache.org>
Committed: Mon Nov 3 19:19:21 2014 +0100

----------------------------------------------------------------------
 .../syncope/console/SyncopeApplication.java     |  10 +-
 .../syncope/console/commons/XMLRolesReader.java | 104 +++++++++++--------
 .../pages/AbstractSchedTaskModalPage.java       |   4 +-
 .../console/pages/ApprovalModalPage.java        |   4 +-
 .../syncope/console/pages/Configuration.java    |  16 +--
 .../console/pages/ConfigurationModalPage.java   |   4 +-
 .../console/pages/ConnectorModalPage.java       |   4 +-
 .../console/pages/DerivedSchemaModalPage.java   |   4 +-
 .../console/pages/EditUserModalPage.java        |   2 +-
 .../console/pages/NotificationModalPage.java    |   4 +-
 .../syncope/console/pages/ReportModalPage.java  |   4 +-
 .../apache/syncope/console/pages/Reports.java   |  14 +--
 .../console/pages/ResourceModalPage.java        |   2 +-
 .../apache/syncope/console/pages/Resources.java |  13 ++-
 .../syncope/console/pages/RoleModalPage.java    |   2 +-
 .../apache/syncope/console/pages/Schema.java    |   6 +-
 .../syncope/console/pages/SchemaModalPage.java  |   4 +-
 .../syncope/console/pages/StatusModalPage.java  |   2 +-
 .../org/apache/syncope/console/pages/Todo.java  |   8 +-
 .../syncope/console/pages/UserModalPage.java    |   4 +-
 .../org/apache/syncope/console/pages/Users.java |   2 +-
 .../console/pages/VirtualSchemaModalPage.java   |   4 +-
 .../console/pages/panels/PoliciesPanel.java     |   2 +-
 .../syncope/console/pages/panels/RolePanel.java |   2 +-
 .../console/pages/panels/RoleSummaryPanel.java  |   2 +-
 .../console/pages/panels/RoleTabPanel.java      |   8 +-
 .../console/pages/panels/SchedTasks.java        |   2 +-
 .../syncope/console/pages/panels/SyncTasks.java |   2 +-
 .../markup/html/form/ActionLinksPanel.java      |   4 +-
 .../wicket/markup/html/tree/TreeRolePanel.java  |   2 +-
 .../src/main/resources/applicationContext.xml   |   8 +-
 31 files changed, 133 insertions(+), 120 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/SyncopeApplication.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/SyncopeApplication.java b/console/src/main/java/org/apache/syncope/console/SyncopeApplication.java
index 9803650..0fbe521 100644
--- a/console/src/main/java/org/apache/syncope/console/SyncopeApplication.java
+++ b/console/src/main/java/org/apache/syncope/console/SyncopeApplication.java
@@ -120,7 +120,7 @@ public class SyncopeApplication
                 : "") + "schema" + Constants.PNG_EXT)));
 
         BookmarkablePageLink<Void> usersLink = new BookmarkablePageLink<Void>("users", Users.class);
-        String allowedUsersRoles = xmlRolesReader.getAllAllowedRoles("Users", "list");
+        String allowedUsersRoles = xmlRolesReader.getEntitlement("Users", "list");
         MetaDataRoleAuthorizationStrategy.authorize(usersLink, WebPage.ENABLE, allowedUsersRoles);
         page.add(usersLink);
         usersLink.add(new Image("usersIcon", new ContextRelativeResource(IMG_PREFIX + (notsel
@@ -142,7 +142,7 @@ public class SyncopeApplication
                 : "") + "resources" + Constants.PNG_EXT)));
 
         BookmarkablePageLink<Void> todoLink = new BookmarkablePageLink<Void>("todo", Todo.class);
-        MetaDataRoleAuthorizationStrategy.authorize(todoLink, WebPage.ENABLE, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(todoLink, WebPage.ENABLE, xmlRolesReader.getEntitlement(
                 "Approval", "list"));
         page.add(todoLink);
         todoLink.add(new Image("todoIcon", new ContextRelativeResource(IMG_PREFIX + (notsel
@@ -150,7 +150,7 @@ public class SyncopeApplication
                 : "") + "todo" + Constants.PNG_EXT)));
 
         BookmarkablePageLink<Void> reportLink = new BookmarkablePageLink<Void>("reports", Reports.class);
-        String allowedReportRoles = xmlRolesReader.getAllAllowedRoles("Reports", "list");
+        String allowedReportRoles = xmlRolesReader.getEntitlement("Reports", "list");
         MetaDataRoleAuthorizationStrategy.authorize(reportLink, WebPage.ENABLE, allowedReportRoles);
         page.add(reportLink);
         reportLink.add(new Image("reportsIcon", new ContextRelativeResource(IMG_PREFIX + (notsel
@@ -159,7 +159,7 @@ public class SyncopeApplication
 
         BookmarkablePageLink<Void> configurationLink = new BookmarkablePageLink<Void>("configuration",
                 Configuration.class);
-        String allowedConfigurationRoles = xmlRolesReader.getAllAllowedRoles("Configuration", "list");
+        String allowedConfigurationRoles = xmlRolesReader.getEntitlement("Configuration", "list");
         MetaDataRoleAuthorizationStrategy.authorize(configurationLink, WebPage.ENABLE, allowedConfigurationRoles);
         page.add(configurationLink);
         configurationLink.add(new Image("configurationIcon", new ContextRelativeResource(IMG_PREFIX + (notsel
@@ -167,7 +167,7 @@ public class SyncopeApplication
                 : "") + "configuration" + Constants.PNG_EXT)));
 
         BookmarkablePageLink<Void> taskLink = new BookmarkablePageLink<Void>("tasks", Tasks.class);
-        String allowedTasksRoles = xmlRolesReader.getAllAllowedRoles("Tasks", "list");
+        String allowedTasksRoles = xmlRolesReader.getEntitlement("Tasks", "list");
         MetaDataRoleAuthorizationStrategy.authorize(taskLink, WebPage.ENABLE, allowedTasksRoles);
         page.add(taskLink);
         taskLink.add(new Image("tasksIcon", new ContextRelativeResource(IMG_PREFIX + (notsel

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/commons/XMLRolesReader.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/commons/XMLRolesReader.java b/console/src/main/java/org/apache/syncope/console/commons/XMLRolesReader.java
index c031975..69cf4ec 100644
--- a/console/src/main/java/org/apache/syncope/console/commons/XMLRolesReader.java
+++ b/console/src/main/java/org/apache/syncope/console/commons/XMLRolesReader.java
@@ -18,17 +18,17 @@
  */
 package org.apache.syncope.console.commons;
 
+import java.util.HashMap;
+import java.util.Map;
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
-import javax.xml.xpath.XPath;
-import javax.xml.xpath.XPathConstants;
-import javax.xml.xpath.XPathExpression;
-import javax.xml.xpath.XPathExpressionException;
-import javax.xml.xpath.XPathFactory;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.commons.lang3.tuple.ImmutablePair;
+import org.apache.commons.lang3.tuple.Pair;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
-import org.springframework.beans.factory.annotation.Autowired;
 import org.w3c.dom.Document;
+import org.w3c.dom.Node;
 import org.w3c.dom.NodeList;
 
 /**
@@ -41,62 +41,78 @@ public class XMLRolesReader {
      */
     private static final Logger LOG = LoggerFactory.getLogger(XMLRolesReader.class);
 
-    @Autowired
     private String authorizations;
 
-    private Document doc;
+    private Map<Pair<String, String>, String> authMap;
+
+    public void setAuthorizations(final String authorizations) {
+        this.authorizations = authorizations;
+    }
+
+    private void init() {
+        authMap = new HashMap<Pair<String, String>, String>();
 
-    public void init() {
         DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
         dbf.setNamespaceAware(true);
         try {
             DocumentBuilder db = dbf.newDocumentBuilder();
-            doc = db.parse(getClass().getResource("/" + authorizations).openStream());
+            Document doc = db.parse(getClass().getResource("/" + authorizations).openStream());
             doc.getDocumentElement().normalize();
+
+            Node authNode = null;
+            NodeList root = doc.getChildNodes();
+            for (int i = 0; i < root.getLength() && authNode == null; i++) {
+                if ("auth".equals(root.item(i).getNodeName())) {
+                    authNode = root.item(i);
+                }
+            }
+            if (authNode == null) {
+                throw new IllegalArgumentException("Could not find root <auth> node");
+            }
+
+            NodeList pages = authNode.getChildNodes();
+            for (int i = 0; i < pages.getLength(); i++) {
+                if ("page".equals(pages.item(i).getNodeName())) {
+                    String page = pages.item(i).getAttributes().getNamedItem("id").getTextContent();
+
+                    NodeList actions = pages.item(i).getChildNodes();
+                    for (int j = 0; j < actions.getLength(); j++) {
+                        if ("action".equals(actions.item(j).getNodeName())) {
+                            String action = actions.item(j).getAttributes().getNamedItem("id").getTextContent();
+
+                            NodeList entitlements = actions.item(j).getChildNodes();
+                            for (int k = 0; k < entitlements.getLength(); k++) {
+                                if ("entitlement".equals(entitlements.item(k).getNodeName())) {
+                                    String entitlement = entitlements.item(k).getTextContent();
+                                    authMap.put(new ImmutablePair<String, String>(page, action), entitlement);
+                                }
+                            }
+                        }
+                    }
+                }
+            }
         } catch (Exception e) {
             LOG.error("While initializing parsing of {}", authorizations, e);
-            doc = null;
         }
     }
 
     /**
-     * Get all roles allowed for specific page and action requested.
+     * Get entitlement required for page / action.
      *
-     * @param pageId
-     * @param actionId
-     * @return roles list comma separated
+     * @param pageId page
+     * @param actionId action
+     * @return entitlement required
      */
-    public String getAllAllowedRoles(final String pageId, final String actionId) {
-
-        if (doc == null) {
-            init();
-        }
-        if (doc == null) {
-            return "";
-        }
-
-        final StringBuilder roles = new StringBuilder();
-        try {
-            XPathFactory factory = XPathFactory.newInstance();
-            XPath xpath = factory.newXPath();
-            XPathExpression expr = xpath.compile("//page[@id='" + pageId + "']/" + "action[@id='" + actionId + "']/"
-                    + "entitlement/text()");
-            Object result = expr.evaluate(doc, XPathConstants.NODESET);
-
-            NodeList nodes = (NodeList) result;
-
-            for (int i = 0; i < nodes.getLength(); i++) {
-                if (i > 0) {
-                    roles.append(",");
-                }
-                roles.append(nodes.item(i).getNodeValue());
+    public String getEntitlement(final String pageId, final String actionId) {
+        synchronized (this) {
+            if (authMap == null) {
+                init();
             }
-        } catch (XPathExpressionException e) {
-            LOG.error("While parsing authorizations file", e);
         }
 
-        LOG.debug("Authorizations found: {}", roles);
-
-        return roles.toString();
+        Pair<String, String> key = new ImmutablePair<String, String>(pageId, actionId);
+        return authMap.containsKey(key)
+                ? authMap.get(key)
+                : StringUtils.EMPTY;
     }
 }

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/AbstractSchedTaskModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/AbstractSchedTaskModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/AbstractSchedTaskModalPage.java
index 4d899e3..8bd02b9 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/AbstractSchedTaskModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/AbstractSchedTaskModalPage.java
@@ -129,10 +129,10 @@ public abstract class AbstractSchedTaskModalPage extends TaskModalPage {
         cancel.setDefaultFormProcessing(false);
 
         if (taskTO.getId() > 0) {
-            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER, xmlRolesReader.getAllAllowedRoles(TASKS,
+            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER, xmlRolesReader.getEntitlement(TASKS,
                     "update"));
         } else {
-            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER, xmlRolesReader.getAllAllowedRoles(TASKS,
+            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER, xmlRolesReader.getEntitlement(TASKS,
                     "create"));
         }
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/ApprovalModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/ApprovalModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/ApprovalModalPage.java
index 8c69ca9..fae7b42 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/ApprovalModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/ApprovalModalPage.java
@@ -188,7 +188,7 @@ public class ApprovalModalPage extends BaseModalPage {
                     }
                 };
         MetaDataRoleAuthorizationStrategy.authorize(userDetails, ENABLE,
-                xmlRolesReader.getAllAllowedRoles("Users", "read"));
+                xmlRolesReader.getEntitlement("Users", "read"));
 
         final AjaxButton submit = new IndicatingAjaxButton(APPLY, new Model<String>(getString(SUBMIT))) {
 
@@ -267,7 +267,7 @@ public class ApprovalModalPage extends BaseModalPage {
         form.add(submit);
         form.add(cancel);
 
-        MetaDataRoleAuthorizationStrategy.authorize(form, ENABLE, xmlRolesReader.getAllAllowedRoles("Approval",
+        MetaDataRoleAuthorizationStrategy.authorize(form, ENABLE, xmlRolesReader.getEntitlement("Approval",
                 SUBMIT));
 
         editUserWin = new ModalWindow("editUserWin");

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/Configuration.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/Configuration.java b/console/src/main/java/org/apache/syncope/console/pages/Configuration.java
index 403c948..9e4c0fc 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/Configuration.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/Configuration.java
@@ -178,13 +178,13 @@ public class Configuration extends BasePage {
             }
         };
 
-        MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, xmlRolesReader.getAllAllowedRoles("Configuration",
+        MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, xmlRolesReader.getEntitlement("Configuration",
                 "workflowDefUpdate"));
         wfForm.add(submit);
 
         workflowDefContainer.add(wfForm);
 
-        MetaDataRoleAuthorizationStrategy.authorize(workflowDefContainer, ENABLE, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(workflowDefContainer, ENABLE, xmlRolesReader.getEntitlement(
                 "Configuration", "workflowDefRead"));
         add(workflowDefContainer);
 
@@ -195,7 +195,7 @@ public class Configuration extends BasePage {
         coreLoggerContainer.add(coreLoggerList);
         coreLoggerContainer.setOutputMarkupId(true);
 
-        MetaDataRoleAuthorizationStrategy.authorize(coreLoggerContainer, ENABLE, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(coreLoggerContainer, ENABLE, xmlRolesReader.getEntitlement(
                 "Configuration", "logList"));
         add(coreLoggerContainer);
 
@@ -206,7 +206,7 @@ public class Configuration extends BasePage {
         consoleLoggerContainer.add(consoleLoggerList);
         consoleLoggerContainer.setOutputMarkupId(true);
 
-        MetaDataRoleAuthorizationStrategy.authorize(consoleLoggerContainer, ENABLE, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(consoleLoggerContainer, ENABLE, xmlRolesReader.getEntitlement(
                 "Configuration", "logList"));
         add(consoleLoggerContainer);
     }
@@ -327,7 +327,7 @@ public class Configuration extends BasePage {
             }
         };
 
-        MetaDataRoleAuthorizationStrategy.authorize(createConfigurationLink, ENABLE, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(createConfigurationLink, ENABLE, xmlRolesReader.getEntitlement(
                 "Configuration", "create"));
         add(createConfigurationLink);
 
@@ -351,7 +351,7 @@ public class Configuration extends BasePage {
             }
         };
 
-        MetaDataRoleAuthorizationStrategy.authorize(dbExportLink, ENABLE, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(dbExportLink, ENABLE, xmlRolesReader.getEntitlement(
                 "Configuration", "read"));
         add(dbExportLink);
 
@@ -502,7 +502,7 @@ public class Configuration extends BasePage {
             }
         };
 
-        MetaDataRoleAuthorizationStrategy.authorize(createNotificationLink, ENABLE, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(createNotificationLink, ENABLE, xmlRolesReader.getEntitlement(
                 "Notification", "create"));
         add(createNotificationLink);
 
@@ -673,7 +673,7 @@ public class Configuration extends BasePage {
                 }
             });
 
-            MetaDataRoleAuthorizationStrategy.authorize(level, ENABLE, xmlRolesReader.getAllAllowedRoles(
+            MetaDataRoleAuthorizationStrategy.authorize(level, ENABLE, xmlRolesReader.getEntitlement(
                     "Configuration", "logSetLevel"));
 
             item.add(level);

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/ConfigurationModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/ConfigurationModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/ConfigurationModalPage.java
index 5af5b16..d61fa38 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/ConfigurationModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/ConfigurationModalPage.java
@@ -121,8 +121,8 @@ public class ConfigurationModalPage extends BaseModalPage {
         form.add(cancel);
 
         String allowedRoles = createFlag
-                ? xmlRolesReader.getAllAllowedRoles("Configuration", "create")
-                : xmlRolesReader.getAllAllowedRoles("Configuration", "update");
+                ? xmlRolesReader.getEntitlement("Configuration", "create")
+                : xmlRolesReader.getEntitlement("Configuration", "update");
 
         MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, allowedRoles);
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/ConnectorModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/ConnectorModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/ConnectorModalPage.java
index ae28729..94027e1 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/ConnectorModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/ConnectorModalPage.java
@@ -437,8 +437,8 @@ public class ConnectorModalPage extends BaseModalPage {
             }
         };
         String roles = connInstanceTO.getId() == 0
-                ? xmlRolesReader.getAllAllowedRoles("Connectors", "create")
-                : xmlRolesReader.getAllAllowedRoles("Connectors", "update");
+                ? xmlRolesReader.getEntitlement("Connectors", "create")
+                : xmlRolesReader.getEntitlement("Connectors", "update");
         MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, roles);
         connectorForm.add(submit);
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/DerivedSchemaModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/DerivedSchemaModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/DerivedSchemaModalPage.java
index 5c51154..edda895 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/DerivedSchemaModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/DerivedSchemaModalPage.java
@@ -125,8 +125,8 @@ public class DerivedSchemaModalPage extends AbstractSchemaModalPage {
                 false);
 
         String allowedRoles = createFlag
-                ? xmlRolesReader.getAllAllowedRoles("Schema", "create")
-                : xmlRolesReader.getAllAllowedRoles("Schema", "update");
+                ? xmlRolesReader.getEntitlement("Schema", "create")
+                : xmlRolesReader.getEntitlement("Schema", "update");
 
         MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, allowedRoles);
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/EditUserModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/EditUserModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/EditUserModalPage.java
index a3a6d45..9132dda 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/EditUserModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/EditUserModalPage.java
@@ -63,7 +63,7 @@ public class EditUserModalPage extends UserModalPage {
             statusPanel = new StatusPanel("statuspanel", userTO, new ArrayList<StatusBean>(), getPageReference());
             statusPanel.setOutputMarkupId(true);
             MetaDataRoleAuthorizationStrategy.authorize(
-                    statusPanel, RENDER, xmlRolesReader.getAllAllowedRoles("Resources", "getConnectorObject"));
+                    statusPanel, RENDER, xmlRolesReader.getEntitlement("Resources", "getConnectorObject"));
             form.addOrReplace(statusPanel);
 
             form.addOrReplace(new AccountInformationPanel("accountinformation", userTO));

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/NotificationModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/NotificationModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/NotificationModalPage.java
index 09d0136..dc043b8 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/NotificationModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/NotificationModalPage.java
@@ -270,8 +270,8 @@ class NotificationModalPage extends BaseModalPage {
         cancel.setDefaultFormProcessing(false);
 
         String allowedRoles = createFlag
-                ? xmlRolesReader.getAllAllowedRoles("Notification", "create")
-                : xmlRolesReader.getAllAllowedRoles("Notification", "update");
+                ? xmlRolesReader.getEntitlement("Notification", "create")
+                : xmlRolesReader.getEntitlement("Notification", "update");
         MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, allowedRoles);
 
         form.add(submit);

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/ReportModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/ReportModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/ReportModalPage.java
index 548de35..d76400b 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/ReportModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/ReportModalPage.java
@@ -161,10 +161,10 @@ public class ReportModalPage extends BaseModalPage {
                 };
 
         if (reportTO.getId() > 0) {
-            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER, xmlRolesReader.getAllAllowedRoles("Reports",
+            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER, xmlRolesReader.getEntitlement("Reports",
                     "update"));
         } else {
-            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER, xmlRolesReader.getAllAllowedRoles("Reports",
+            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER, xmlRolesReader.getEntitlement("Reports",
                     "create"));
         }
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/Reports.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/Reports.java b/console/src/main/java/org/apache/syncope/console/pages/Reports.java
index f0e0647..789e37e 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/Reports.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/Reports.java
@@ -110,7 +110,7 @@ public class Reports extends BasePage {
         reportContainer = new WebMarkupContainer("reportContainer");
         setWindowClosedCallback(window, reportContainer);
 
-        MetaDataRoleAuthorizationStrategy.authorize(reportContainer, RENDER, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(reportContainer, RENDER, xmlRolesReader.getEntitlement(
                 "Reports", "list"));
 
         paginatorRows = prefMan.getPaginatorRows(getRequest(), Constants.PREF_REPORT_PAGINATOR_ROWS);
@@ -223,7 +223,7 @@ public class Reports extends BasePage {
 
         Form paginatorForm = new Form("paginatorForm");
 
-        MetaDataRoleAuthorizationStrategy.authorize(paginatorForm, RENDER, xmlRolesReader.getAllAllowedRoles("Reports",
+        MetaDataRoleAuthorizationStrategy.authorize(paginatorForm, RENDER, xmlRolesReader.getEntitlement("Reports",
                 "list"));
 
         final DropDownChoice rowsChooser = new DropDownChoice("rowsChooser", new PropertyModel(this, "paginatorRows"),
@@ -266,7 +266,7 @@ public class Reports extends BasePage {
             }
         };
 
-        MetaDataRoleAuthorizationStrategy.authorize(createLink, RENDER, xmlRolesReader.getAllAllowedRoles("Reports",
+        MetaDataRoleAuthorizationStrategy.authorize(createLink, RENDER, xmlRolesReader.getEntitlement("Reports",
                 "create"));
 
         add(createLink);
@@ -279,7 +279,7 @@ public class Reports extends BasePage {
         add(auditContainer);
 
         MetaDataRoleAuthorizationStrategy.authorize(
-                auditContainer, RENDER, xmlRolesReader.getAllAllowedRoles("Audit", "list"));
+                auditContainer, RENDER, xmlRolesReader.getEntitlement("Audit", "list"));
 
         final Form form = new Form("auditForm");
         auditContainer.add(form);
@@ -306,15 +306,15 @@ public class Reports extends BasePage {
                     @Override
                     protected String[] getListRoles() {
                         return new String[] {
-                            xmlRolesReader.getAllAllowedRoles("Audit", "list")
+                            xmlRolesReader.getEntitlement("Audit", "list")
                         };
                     }
 
                     @Override
                     protected String[] getChangeRoles() {
                         return new String[] {
-                            xmlRolesReader.getAllAllowedRoles("Audit", "enable"),
-                            xmlRolesReader.getAllAllowedRoles("Audit", "disable")
+                            xmlRolesReader.getEntitlement("Audit", "enable"),
+                            xmlRolesReader.getEntitlement("Audit", "disable")
                         };
                     }
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/ResourceModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/ResourceModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/ResourceModalPage.java
index 51e1da3..ea58648 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/ResourceModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/ResourceModalPage.java
@@ -173,7 +173,7 @@ public class ResourceModalPage extends BaseModalPage {
 
         add(form);
 
-        MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, xmlRolesReader.getAllAllowedRoles("Resources",
+        MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, xmlRolesReader.getEntitlement("Resources",
                 createFlag
                 ? "create"
                 : "update"));

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/Resources.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/Resources.java b/console/src/main/java/org/apache/syncope/console/pages/Resources.java
index 7d11d0b..89aa1ba 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/Resources.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/Resources.java
@@ -139,7 +139,7 @@ public class Resources extends BasePage {
                 attributes.getAjaxCallListeners().add(ajaxCallListener);
             }
         };
-        MetaDataRoleAuthorizationStrategy.authorize(reloadLink, ENABLE, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(reloadLink, ENABLE, xmlRolesReader.getEntitlement(
                 "Connectors", "reload"));
         add(reloadLink);
 
@@ -195,8 +195,7 @@ public class Resources extends BasePage {
 
                         cellItem.add(editConnPanel);
 
-                        MetaDataRoleAuthorizationStrategy.authorize(editConnPanel, ENABLE, xmlRolesReader.
-                                getAllAllowedRoles(
+                        MetaDataRoleAuthorizationStrategy.authorize(editConnPanel, ENABLE, xmlRolesReader.getEntitlement(
                                         "Connectors", "read"));
                     }
                 });
@@ -341,7 +340,7 @@ public class Resources extends BasePage {
                     }
                 };
 
-        MetaDataRoleAuthorizationStrategy.authorize(createResourceLink, ENABLE, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(createResourceLink, ENABLE, xmlRolesReader.getEntitlement(
                 "Resources", "create"));
 
         add(createResourceLink);
@@ -459,7 +458,7 @@ public class Resources extends BasePage {
         connectorContainer.add(table);
         connectorContainer.setOutputMarkupId(true);
 
-        MetaDataRoleAuthorizationStrategy.authorize(connectorContainer, RENDER, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(connectorContainer, RENDER, xmlRolesReader.getEntitlement(
                 "Connectors", "list"));
 
         add(connectorContainer);
@@ -499,14 +498,14 @@ public class Resources extends BasePage {
             }
         };
 
-        MetaDataRoleAuthorizationStrategy.authorize(createConnectorLink, ENABLE, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(createConnectorLink, ENABLE, xmlRolesReader.getEntitlement(
                 "Connectors", "create"));
 
         add(createConnectorLink);
 
         Form paginatorForm = new Form("connectorPaginatorForm");
 
-        MetaDataRoleAuthorizationStrategy.authorize(paginatorForm, RENDER, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(paginatorForm, RENDER, xmlRolesReader.getEntitlement(
                 "Connectors", "list"));
 
         final DropDownChoice rowsChooser = new DropDownChoice("rowsChooser", new PropertyModel(this,

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/RoleModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/RoleModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/RoleModalPage.java
index cf16c8c..2495421 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/RoleModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/RoleModalPage.java
@@ -136,7 +136,7 @@ public class RoleModalPage extends BaseModalPage {
 
         cancel.setDefaultFormProcessing(false);
 
-        MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, xmlRolesReader.getAllAllowedRoles("Roles",
+        MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, xmlRolesReader.getEntitlement("Roles",
                 createFlag
                 ? "create"
                 : "update"));

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/Schema.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/Schema.java b/console/src/main/java/org/apache/syncope/console/pages/Schema.java
index 88c3ace..d66d6e2 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/Schema.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/Schema.java
@@ -136,11 +136,11 @@ public class Schema extends BasePage {
     @SpringBean
     private PreferenceManager prefMan;
 
-    private final String allowedCreateRoles = xmlRolesReader.getAllAllowedRoles("Schema", "create");
+    private final String allowedCreateRoles = xmlRolesReader.getEntitlement("Schema", "create");
 
-    private final String allowedReadRoles = xmlRolesReader.getAllAllowedRoles("Schema", "read");
+    private final String allowedReadRoles = xmlRolesReader.getEntitlement("Schema", "read");
 
-    private final String allowedDeleteRoles = xmlRolesReader.getAllAllowedRoles("Schema", "delete");
+    private final String allowedDeleteRoles = xmlRolesReader.getEntitlement("Schema", "delete");
 
     public Schema() {
         super();

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/SchemaModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/SchemaModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/SchemaModalPage.java
index 05bd8c1..aedba1d 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/SchemaModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/SchemaModalPage.java
@@ -276,8 +276,8 @@ public class SchemaModalPage extends AbstractSchemaModalPage {
         cancel.setDefaultFormProcessing(false);
 
         String allowedRoles = createFlag
-                ? xmlRolesReader.getAllAllowedRoles("Schema", "create")
-                : xmlRolesReader.getAllAllowedRoles("Schema", "update");
+                ? xmlRolesReader.getEntitlement("Schema", "create")
+                : xmlRolesReader.getEntitlement("Schema", "update");
 
         MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, allowedRoles);
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/StatusModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/StatusModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/StatusModalPage.java
index 6040f70..c2fcf5c 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/StatusModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/StatusModalPage.java
@@ -50,7 +50,7 @@ public class StatusModalPage extends BaseModalPage {
 
         final StatusPanel statusPanel = new StatusPanel("statuspanel", attributable, statuses, null);
         MetaDataRoleAuthorizationStrategy.authorize(
-                statusPanel, RENDER, xmlRolesReader.getAllAllowedRoles("Resources", "getConnectorObject"));
+                statusPanel, RENDER, xmlRolesReader.getEntitlement("Resources", "getConnectorObject"));
         form.add(statusPanel);
 
         final AjaxButton disable;

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/Todo.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/Todo.java b/console/src/main/java/org/apache/syncope/console/pages/Todo.java
index bb0ddbd..06dd6f0 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/Todo.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/Todo.java
@@ -105,7 +105,7 @@ public class Todo extends BasePage {
     private void setupApproval() {
         approvalContainer = new WebMarkupContainer("approvalContainer");
 
-        MetaDataRoleAuthorizationStrategy.authorize(approvalContainer, RENDER, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(approvalContainer, RENDER, xmlRolesReader.getEntitlement(
                 "Approval", "list"));
 
         approvalPaginatorRows = prefMan.getPaginatorRows(getRequest(), Constants.PREF_APPROVAL_PAGINATOR_ROWS);
@@ -186,7 +186,7 @@ public class Todo extends BasePage {
 
         Form approvalPaginatorForm = new Form("approvalPaginatorForm");
 
-        MetaDataRoleAuthorizationStrategy.authorize(approvalPaginatorForm, RENDER, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(approvalPaginatorForm, RENDER, xmlRolesReader.getEntitlement(
                 "Approval", "list"));
 
         final DropDownChoice rowsChooser = new DropDownChoice("rowsChooser", new PropertyModel(this,
@@ -220,7 +220,7 @@ public class Todo extends BasePage {
     private void setupUserRequest() {
         userRequestContainer = new WebMarkupContainer("userRequestContainer");
 
-        MetaDataRoleAuthorizationStrategy.authorize(userRequestContainer, RENDER, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(userRequestContainer, RENDER, xmlRolesReader.getEntitlement(
                 "UserRequest", "list"));
 
         userRequestPaginatorRows = prefMan.getPaginatorRows(getRequest(), Constants.PREF_USER_REQUEST_PAGINATOR_ROWS);
@@ -326,7 +326,7 @@ public class Todo extends BasePage {
 
         Form userRequestPaginatorForm = new Form("userRequestPaginatorForm");
 
-        MetaDataRoleAuthorizationStrategy.authorize(userRequestPaginatorForm, RENDER, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(userRequestPaginatorForm, RENDER, xmlRolesReader.getEntitlement(
                 "UserRequest", "list"));
 
         final DropDownChoice rowsChooser = new DropDownChoice("rowsChooser", new PropertyModel(this,

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/UserModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/UserModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/UserModalPage.java
index 2ecaa45..4087266 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/UserModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/UserModalPage.java
@@ -149,8 +149,8 @@ public abstract class UserModalPage extends BaseModalPage {
 
         if (mode == Mode.ADMIN) {
             String allowedRoles = userTO.getId() == 0
-                    ? xmlRolesReader.getAllAllowedRoles("Users", "create")
-                    : xmlRolesReader.getAllAllowedRoles("Users", "update");
+                    ? xmlRolesReader.getEntitlement("Users", "create")
+                    : xmlRolesReader.getEntitlement("Users", "update");
             MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER, allowedRoles);
         }
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/Users.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/Users.java b/console/src/main/java/org/apache/syncope/console/pages/Users.java
index 43af342..4a208de 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/Users.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/Users.java
@@ -92,7 +92,7 @@ public class Users extends BasePage {
             }
         };
         MetaDataRoleAuthorizationStrategy.authorize(
-                createLink, ENABLE, xmlRolesReader.getAllAllowedRoles("Users", "create"));
+                createLink, ENABLE, xmlRolesReader.getEntitlement("Users", "create"));
         add(createLink);
 
         setWindowClosedReloadCallback(editModalWin);

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/VirtualSchemaModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/VirtualSchemaModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/VirtualSchemaModalPage.java
index 63b3a10..a4ab941 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/VirtualSchemaModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/VirtualSchemaModalPage.java
@@ -111,8 +111,8 @@ public class VirtualSchemaModalPage extends AbstractSchemaModalPage {
         cancel.setDefaultFormProcessing(false);
 
         String allowedRoles = createFlag
-                ? xmlRolesReader.getAllAllowedRoles("Schema", "create")
-                : xmlRolesReader.getAllAllowedRoles("Schema", "update");
+                ? xmlRolesReader.getEntitlement("Schema", "create")
+                : xmlRolesReader.getEntitlement("Schema", "update");
 
         MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, allowedRoles);
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/panels/PoliciesPanel.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/panels/PoliciesPanel.java b/console/src/main/java/org/apache/syncope/console/pages/panels/PoliciesPanel.java
index ffacdbc..b6f7196 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/panels/PoliciesPanel.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/panels/PoliciesPanel.java
@@ -223,7 +223,7 @@ public class PoliciesPanel extends Panel {
 
         add(createButton);
 
-        MetaDataRoleAuthorizationStrategy.authorize(createButton, ENABLE, xmlRolesReader.getAllAllowedRoles("Policies",
+        MetaDataRoleAuthorizationStrategy.authorize(createButton, ENABLE, xmlRolesReader.getEntitlement("Policies",
                 "create"));
 
         final Form paginatorForm = new Form("PaginatorForm");

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/panels/RolePanel.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/panels/RolePanel.java b/console/src/main/java/org/apache/syncope/console/pages/panels/RolePanel.java
index a3596ea..0b2d623 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/panels/RolePanel.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/panels/RolePanel.java
@@ -107,7 +107,7 @@ public class RolePanel extends Panel {
                     "statuspanel", builder.roleTO, new ArrayList<StatusBean>(), builder.pageReference);
             statusPanel.setOutputMarkupId(true);
             MetaDataRoleAuthorizationStrategy.authorize(
-                    statusPanel, RENDER, xmlRolesReader.getAllAllowedRoles("Resources", "getConnectorObject"));
+                    statusPanel, RENDER, xmlRolesReader.getEntitlement("Resources", "getConnectorObject"));
             this.add(statusPanel);
         }
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/panels/RoleSummaryPanel.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/panels/RoleSummaryPanel.java b/console/src/main/java/org/apache/syncope/console/pages/panels/RoleSummaryPanel.java
index a482224..f468586 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/panels/RoleSummaryPanel.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/panels/RoleSummaryPanel.java
@@ -138,7 +138,7 @@ public class RoleSummaryPanel extends Panel {
 
                         builder.window.show(target);
                     }
-                }, ActionLink.ActionType.CREATE, xmlRolesReader.getAllAllowedRoles("Roles", "create"));
+                }, ActionLink.ActionType.CREATE, xmlRolesReader.getEntitlement("Roles", "create"));
             } else {
                 RoleTabPanel roleTabPanel =
                         new RoleTabPanel("nodeViewPanel", selectedNode, builder.window, builder.callerPageRef);

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/panels/RoleTabPanel.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/panels/RoleTabPanel.java b/console/src/main/java/org/apache/syncope/console/pages/panels/RoleTabPanel.java
index 6eab419..9debde4 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/panels/RoleTabPanel.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/panels/RoleTabPanel.java
@@ -91,7 +91,7 @@ public class RoleTabPanel extends Panel {
 
                 window.show(target);
             }
-        }, ActionLink.ActionType.CREATE, xmlRolesReader.getAllAllowedRoles("Roles", "create"));
+        }, ActionLink.ActionType.CREATE, xmlRolesReader.getEntitlement("Roles", "create"));
         links.addWithRoles(new ActionLink() {
 
             private static final long serialVersionUID = -3722207913631435501L;
@@ -110,7 +110,7 @@ public class RoleTabPanel extends Panel {
 
                 window.show(target);
             }
-        }, ActionLink.ActionType.SEARCH, xmlRolesReader.getAllAllowedRoles("Roles", "update"));
+        }, ActionLink.ActionType.SEARCH, xmlRolesReader.getEntitlement("Roles", "update"));
         links.addWithRoles(new ActionLink() {
 
             private static final long serialVersionUID = -3722207913631435501L;
@@ -131,7 +131,7 @@ public class RoleTabPanel extends Panel {
 
                 window.show(target);
             }
-        }, ActionLink.ActionType.EDIT, xmlRolesReader.getAllAllowedRoles("Roles", "update"));
+        }, ActionLink.ActionType.EDIT, xmlRolesReader.getEntitlement("Roles", "update"));
         links.addWithRoles(new ActionLink() {
 
             private static final long serialVersionUID = -3722207913631435501L;
@@ -159,7 +159,7 @@ public class RoleTabPanel extends Panel {
                     target.add(((Roles) pageRef.getPage()).getFeedbackPanel());
                 }
             }
-        }, ActionLink.ActionType.DELETE, xmlRolesReader.getAllAllowedRoles("Roles", "delete"));
+        }, ActionLink.ActionType.DELETE, xmlRolesReader.getEntitlement("Roles", "delete"));
 
         final Form form = new Form("roleForm");
         form.setModel(new CompoundPropertyModel(selectedNode));

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/panels/SchedTasks.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/panels/SchedTasks.java b/console/src/main/java/org/apache/syncope/console/pages/panels/SchedTasks.java
index 0911bcc..07aa090 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/panels/SchedTasks.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/panels/SchedTasks.java
@@ -142,7 +142,7 @@ public class SchedTasks extends AbstractTasks {
         };
 
         MetaDataRoleAuthorizationStrategy.authorize(
-                createLink, RENDER, xmlRolesReader.getAllAllowedRoles(TASKS, "create"));
+                createLink, RENDER, xmlRolesReader.getEntitlement(TASKS, "create"));
 
         add(createLink);
     }

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/panels/SyncTasks.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/panels/SyncTasks.java b/console/src/main/java/org/apache/syncope/console/pages/panels/SyncTasks.java
index 17609fc..46b8fc9 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/panels/SyncTasks.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/panels/SyncTasks.java
@@ -145,7 +145,7 @@ public class SyncTasks extends AbstractTasks {
         };
 
         MetaDataRoleAuthorizationStrategy.authorize(
-                createLink, RENDER, xmlRolesReader.getAllAllowedRoles(TASKS, "create"));
+                createLink, RENDER, xmlRolesReader.getEntitlement(TASKS, "create"));
 
         add(createLink);
     }

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/wicket/markup/html/form/ActionLinksPanel.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/wicket/markup/html/form/ActionLinksPanel.java b/console/src/main/java/org/apache/syncope/console/wicket/markup/html/form/ActionLinksPanel.java
index a4f9610..e854de1 100644
--- a/console/src/main/java/org/apache/syncope/console/wicket/markup/html/form/ActionLinksPanel.java
+++ b/console/src/main/java/org/apache/syncope/console/wicket/markup/html/form/ActionLinksPanel.java
@@ -70,7 +70,7 @@ public class ActionLinksPanel extends Panel {
     public void add(
             final ActionLink link, final ActionLink.ActionType type, final String pageId, final String actionId) {
 
-        addWithRoles(link, type, xmlRolesReader.getAllAllowedRoles(pageId, actionId), true);
+        addWithRoles(link, type, xmlRolesReader.getEntitlement(pageId, actionId), true);
     }
 
     public void add(
@@ -82,7 +82,7 @@ public class ActionLinksPanel extends Panel {
     public void add(
             final ActionLink link, final ActionLink.ActionType type, final String pageId, final boolean enabled) {
 
-        addWithRoles(link, type, xmlRolesReader.getAllAllowedRoles(pageId, type.getActionId()), enabled);
+        addWithRoles(link, type, xmlRolesReader.getEntitlement(pageId, type.getActionId()), enabled);
     }
 
     public void addWithRoles(

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/wicket/markup/html/tree/TreeRolePanel.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/wicket/markup/html/tree/TreeRolePanel.java b/console/src/main/java/org/apache/syncope/console/wicket/markup/html/tree/TreeRolePanel.java
index 830e31a..d860880 100644
--- a/console/src/main/java/org/apache/syncope/console/wicket/markup/html/tree/TreeRolePanel.java
+++ b/console/src/main/java/org/apache/syncope/console/wicket/markup/html/tree/TreeRolePanel.java
@@ -104,7 +104,7 @@ public class TreeRolePanel extends Panel {
 
         DefaultMutableTreeNodeExpansion.get().expandAll();
 
-        MetaDataRoleAuthorizationStrategy.authorize(tree, ENABLE, xmlRolesReader.getAllAllowedRoles("Roles", "read"));
+        MetaDataRoleAuthorizationStrategy.authorize(tree, ENABLE, xmlRolesReader.getEntitlement("Roles", "read"));
 
         treeContainer.addOrReplace(tree);
     }

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/resources/applicationContext.xml
----------------------------------------------------------------------
diff --git a/console/src/main/resources/applicationContext.xml b/console/src/main/resources/applicationContext.xml
index be37d23..b58640b 100644
--- a/console/src/main/resources/applicationContext.xml
+++ b/console/src/main/resources/applicationContext.xml
@@ -63,10 +63,6 @@ under the License.
     <constructor-arg value="${licenseUrl}"/>
   </bean>
 
-  <bean id="authorizations" class="java.lang.String">
-    <constructor-arg value="authorizations.xml"/>
-  </bean>
-
   <bean id="syncopeApplication" class="org.apache.syncope.console.SyncopeApplication"/>
 
   <bean id="jacksonObjectMapper" class="org.codehaus.jackson.map.ObjectMapper"/>
@@ -133,7 +129,9 @@ under the License.
 
   <bean id="preferenceManager" class="org.apache.syncope.console.commons.PreferenceManager"/>
 
-  <bean id="xmlRolesReader" class="org.apache.syncope.console.commons.XMLRolesReader"/>
+  <bean id="xmlRolesReader" class="org.apache.syncope.console.commons.XMLRolesReader" scope="singleton">
+    <property name="authorizations" value="authorizations.xml"/>
+  </bean>
 
   <bean id="roleTreeBuilder" class="org.apache.syncope.console.commons.RoleTreeBuilder"/>
 


[5/8] git commit: [SYNCOPE-599] Merge from 1_1_X

Posted by il...@apache.org.
[SYNCOPE-599] Merge from 1_1_X


Project: http://git-wip-us.apache.org/repos/asf/syncope/repo
Commit: http://git-wip-us.apache.org/repos/asf/syncope/commit/f1607400
Tree: http://git-wip-us.apache.org/repos/asf/syncope/tree/f1607400
Diff: http://git-wip-us.apache.org/repos/asf/syncope/diff/f1607400

Branch: refs/heads/master
Commit: f1607400c4556a0d5581c37ac73a3401c3770311
Parents: 70b5340 05d2985
Author: Francesco Chicchiriccò <il...@apache.org>
Authored: Mon Nov 3 19:35:10 2014 +0100
Committer: Francesco Chicchiriccò <il...@apache.org>
Committed: Mon Nov 3 19:35:10 2014 +0100

----------------------------------------------------------------------
 .../syncope/console/SyncopeApplication.java     | 16 ++--
 .../syncope/console/commons/XMLRolesReader.java | 97 ++++++++++++--------
 .../pages/AbstractSchedTaskModalPage.java       |  4 +-
 .../console/pages/ApprovalModalPage.java        |  4 +-
 .../syncope/console/pages/ConfModalPage.java    |  6 +-
 .../syncope/console/pages/Configuration.java    | 25 +++--
 .../console/pages/ConnectorModalPage.java       |  4 +-
 .../console/pages/DerSchemaModalPage.java       |  4 +-
 .../console/pages/EditUserModalPage.java        |  2 +-
 .../console/pages/NotificationModalPage.java    |  4 +-
 .../syncope/console/pages/ReportModalPage.java  |  4 +-
 .../apache/syncope/console/pages/Reports.java   | 20 ++--
 .../console/pages/ResourceModalPage.java        |  6 +-
 .../apache/syncope/console/pages/Resources.java | 13 ++-
 .../syncope/console/pages/RoleModalPage.java    |  2 +-
 .../apache/syncope/console/pages/Schema.java    |  6 +-
 .../syncope/console/pages/SchemaModalPage.java  |  4 +-
 .../pages/SecurityQuestionModalPage.java        |  4 +-
 .../org/apache/syncope/console/pages/Todo.java  |  6 +-
 .../syncope/console/pages/UserModalPage.java    |  4 +-
 .../org/apache/syncope/console/pages/Users.java |  2 +-
 .../console/pages/VirSchemaModalPage.java       |  4 +-
 .../console/pages/XMLEditorPopupPage.java       |  6 +-
 .../pages/panels/AbstractSyncTasksPanel.java    |  2 +-
 .../console/pages/panels/PoliciesPanel.java     |  4 +-
 .../syncope/console/pages/panels/RolePanel.java |  2 +-
 .../console/pages/panels/RoleSummaryPanel.java  |  2 +-
 .../console/pages/panels/RoleTabPanel.java      |  8 +-
 .../console/pages/panels/SchedTasks.java        |  2 +-
 .../markup/html/form/ActionLinksPanel.java      |  4 +-
 .../wicket/markup/html/tree/TreeRolePanel.java  |  2 +-
 console/src/main/resources/consoleContext.xml   |  2 +-
 32 files changed, 147 insertions(+), 128 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/SyncopeApplication.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/SyncopeApplication.java
index f19bdac,0fbe521..c06831b
--- a/console/src/main/java/org/apache/syncope/console/SyncopeApplication.java
+++ b/console/src/main/java/org/apache/syncope/console/SyncopeApplication.java
@@@ -159,66 -112,63 +159,66 @@@ public class SyncopeApplicatio
          };
          page.add(infoLink);
  
 -        BookmarkablePageLink<Void> schemaLink = new BookmarkablePageLink<Void>("schema", Schema.class);
 -        MetaDataRoleAuthorizationStrategy.authorizeAll(schemaLink, WebPage.ENABLE);
 +        BookmarkablePageLink<Page> schemaLink = new BookmarkablePageLink<Page>("schema", Schema.class);
 +        MetaDataRoleAuthorizationStrategy.authorize(
-                 schemaLink, WebPage.ENABLE, xmlRolesReader.getAllAllowedRoles("Schema", "list"));
++                schemaLink, WebPage.ENABLE, xmlRolesReader.getEntitlement("Schema", "list"));
          page.add(schemaLink);
          schemaLink.add(new Image("schemaIcon", new ContextRelativeResource(IMG_PREFIX + (notsel
                  ? IMG_NOTSEL
                  : "") + "schema" + Constants.PNG_EXT)));
  
 -        BookmarkablePageLink<Void> usersLink = new BookmarkablePageLink<Void>("users", Users.class);
 -        String allowedUsersRoles = xmlRolesReader.getEntitlement("Users", "list");
 -        MetaDataRoleAuthorizationStrategy.authorize(usersLink, WebPage.ENABLE, allowedUsersRoles);
 +        BookmarkablePageLink<Page> usersLink = new BookmarkablePageLink<Page>("users", Users.class);
 +        MetaDataRoleAuthorizationStrategy.authorize(
-                 usersLink, WebPage.ENABLE, xmlRolesReader.getAllAllowedRoles("Users", "list"));
++                usersLink, WebPage.ENABLE, xmlRolesReader.getEntitlement("Users", "list"));
          page.add(usersLink);
          usersLink.add(new Image("usersIcon", new ContextRelativeResource(IMG_PREFIX + (notsel
                  ? IMG_NOTSEL
                  : "") + "users" + Constants.PNG_EXT)));
  
 -        BookmarkablePageLink<Void> rolesLink = new BookmarkablePageLink<Void>("roles", Roles.class);
 -        MetaDataRoleAuthorizationStrategy.authorizeAll(rolesLink, WebPage.ENABLE);
 +        BookmarkablePageLink<Page> rolesLink = new BookmarkablePageLink<Page>("roles", Roles.class);
 +        MetaDataRoleAuthorizationStrategy.authorize(
-                 rolesLink, WebPage.ENABLE, xmlRolesReader.getAllAllowedRoles("Roles", "list"));
++                rolesLink, WebPage.ENABLE, xmlRolesReader.getEntitlement("Roles", "list"));
          page.add(rolesLink);
          rolesLink.add(new Image("rolesIcon", new ContextRelativeResource(IMG_PREFIX + (notsel
                  ? IMG_NOTSEL
                  : "") + "roles" + Constants.PNG_EXT)));
  
 -        BookmarkablePageLink<Void> resourcesLink = new BookmarkablePageLink<Void>("resources", Resources.class);
 -        MetaDataRoleAuthorizationStrategy.authorizeAll(resourcesLink, WebPage.ENABLE);
 +        BookmarkablePageLink<Page> resourcesLink = new BookmarkablePageLink<Page>("resources", Resources.class);
 +        MetaDataRoleAuthorizationStrategy.authorize(
-                 resourcesLink, WebPage.ENABLE, xmlRolesReader.getAllAllowedRoles("Resources", "list"));
++                resourcesLink, WebPage.ENABLE, xmlRolesReader.getEntitlement("Resources", "list"));
          page.add(resourcesLink);
          resourcesLink.add(new Image("resourcesIcon", new ContextRelativeResource(IMG_PREFIX + (notsel
                  ? IMG_NOTSEL
                  : "") + "resources" + Constants.PNG_EXT)));
  
 -        BookmarkablePageLink<Void> todoLink = new BookmarkablePageLink<Void>("todo", Todo.class);
 -        MetaDataRoleAuthorizationStrategy.authorize(todoLink, WebPage.ENABLE, xmlRolesReader.getEntitlement(
 -                "Approval", "list"));
 +        BookmarkablePageLink<Page> todoLink = new BookmarkablePageLink<Page>("todo", Todo.class);
 +        MetaDataRoleAuthorizationStrategy.authorize(
-                 todoLink, WebPage.ENABLE, xmlRolesReader.getAllAllowedRoles("Approval", "list"));
++                todoLink, WebPage.ENABLE, xmlRolesReader.getEntitlement("Approval", "list"));
          page.add(todoLink);
          todoLink.add(new Image("todoIcon", new ContextRelativeResource(IMG_PREFIX + (notsel
                  ? IMG_NOTSEL
                  : "") + "todo" + Constants.PNG_EXT)));
  
 -        BookmarkablePageLink<Void> reportLink = new BookmarkablePageLink<Void>("reports", Reports.class);
 -        String allowedReportRoles = xmlRolesReader.getEntitlement("Reports", "list");
 -        MetaDataRoleAuthorizationStrategy.authorize(reportLink, WebPage.ENABLE, allowedReportRoles);
 +        BookmarkablePageLink<Page> reportLink = new BookmarkablePageLink<Page>("reports", Reports.class);
 +        MetaDataRoleAuthorizationStrategy.authorize(
-                 reportLink, WebPage.ENABLE, xmlRolesReader.getAllAllowedRoles("Reports", "list"));
++                reportLink, WebPage.ENABLE, xmlRolesReader.getEntitlement("Reports", "list"));
          page.add(reportLink);
          reportLink.add(new Image("reportsIcon", new ContextRelativeResource(IMG_PREFIX + (notsel
                  ? IMG_NOTSEL
                  : "") + "reports" + Constants.PNG_EXT)));
  
 -        BookmarkablePageLink<Void> configurationLink = new BookmarkablePageLink<Void>("configuration",
 +        BookmarkablePageLink<Page> configurationLink = new BookmarkablePageLink<Page>("configuration",
                  Configuration.class);
 -        String allowedConfigurationRoles = xmlRolesReader.getEntitlement("Configuration", "list");
 -        MetaDataRoleAuthorizationStrategy.authorize(configurationLink, WebPage.ENABLE, allowedConfigurationRoles);
 +        MetaDataRoleAuthorizationStrategy.authorize(
-                 configurationLink, WebPage.ENABLE, xmlRolesReader.getAllAllowedRoles("Configuration", "list"));
++                configurationLink, WebPage.ENABLE, xmlRolesReader.getEntitlement("Configuration", "list"));
          page.add(configurationLink);
          configurationLink.add(new Image("configurationIcon", new ContextRelativeResource(IMG_PREFIX + (notsel
                  ? IMG_NOTSEL
                  : "") + "configuration" + Constants.PNG_EXT)));
  
 -        BookmarkablePageLink<Void> taskLink = new BookmarkablePageLink<Void>("tasks", Tasks.class);
 -        String allowedTasksRoles = xmlRolesReader.getEntitlement("Tasks", "list");
 -        MetaDataRoleAuthorizationStrategy.authorize(taskLink, WebPage.ENABLE, allowedTasksRoles);
 +        BookmarkablePageLink<Page> taskLink = new BookmarkablePageLink<Page>("tasks", Tasks.class);
 +        MetaDataRoleAuthorizationStrategy.authorize(
-                 taskLink, WebPage.ENABLE, xmlRolesReader.getAllAllowedRoles("Tasks", "list"));
++                taskLink, WebPage.ENABLE, xmlRolesReader.getEntitlement("Tasks", "list"));
          page.add(taskLink);
          taskLink.add(new Image("tasksIcon", new ContextRelativeResource(IMG_PREFIX + (notsel
                  ? IMG_NOTSEL

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/AbstractSchedTaskModalPage.java
----------------------------------------------------------------------

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/ApprovalModalPage.java
----------------------------------------------------------------------

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/ConfModalPage.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/ConfModalPage.java
index fe72f87,0000000..99fcac6
mode 100644,000000..100644
--- a/console/src/main/java/org/apache/syncope/console/pages/ConfModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/ConfModalPage.java
@@@ -1,111 -1,0 +1,111 @@@
 +/*
 + * Licensed to the Apache Software Foundation (ASF) under one
 + * or more contributor license agreements.  See the NOTICE file
 + * distributed with this work for additional information
 + * regarding copyright ownership.  The ASF licenses this file
 + * to you under the Apache License, Version 2.0 (the
 + * "License"); you may not use this file except in compliance
 + * with the License.  You may obtain a copy of the License at
 + *
 + *   http://www.apache.org/licenses/LICENSE-2.0
 + *
 + * Unless required by applicable law or agreed to in writing,
 + * software distributed under the License is distributed on an
 + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 + * KIND, either express or implied.  See the License for the
 + * specific language governing permissions and limitations
 + * under the License.
 + */
 +package org.apache.syncope.console.pages;
 +
 +import java.util.Collections;
 +import org.apache.commons.lang3.StringUtils;
 +import org.apache.syncope.common.to.AttributeTO;
 +import org.apache.syncope.common.to.ConfTO;
 +import org.apache.syncope.console.commons.Constants;
 +import org.apache.syncope.console.commons.Mode;
 +import org.apache.syncope.console.pages.panels.AttributesPanel;
 +import org.apache.wicket.PageReference;
 +import org.apache.wicket.ajax.AjaxRequestTarget;
 +import org.apache.wicket.ajax.markup.html.form.AjaxButton;
 +import org.apache.wicket.authroles.authorization.strategies.role.metadata.MetaDataRoleAuthorizationStrategy;
 +import org.apache.wicket.extensions.ajax.markup.html.IndicatingAjaxButton;
 +import org.apache.wicket.extensions.ajax.markup.html.modal.ModalWindow;
 +import org.apache.wicket.markup.html.WebMarkupContainer;
 +import org.apache.wicket.markup.html.form.Form;
 +import org.apache.wicket.model.CompoundPropertyModel;
 +import org.apache.wicket.model.ResourceModel;
 +
 +public class ConfModalPage extends BaseModalPage {
 +
 +    private static final long serialVersionUID = 3524777398688399977L;
 +
 +    public ConfModalPage(final PageReference pageRef, final ModalWindow window, final WebMarkupContainer parameters) {
 +        super();
 +
 +        MetaDataRoleAuthorizationStrategy.authorize(
-                 parameters, ENABLE, xmlRolesReader.getAllAllowedRoles("Configuration", "list"));
++                parameters, ENABLE, xmlRolesReader.getEntitlement("Configuration", "list"));
 +        final ConfTO conf = confRestClient.list();
 +
 +        final Form<ConfTO> form = new Form<ConfTO>("confForm");
 +        form.setModel(new CompoundPropertyModel<ConfTO>(conf));
 +
 +        form.add(new AttributesPanel("paramAttrs", conf, form, Mode.ADMIN));
 +
 +        final AjaxButton submit = new IndicatingAjaxButton(SUBMIT, new ResourceModel(SUBMIT)) {
 +
 +            private static final long serialVersionUID = -958724007591692537L;
 +
 +            @Override
 +            protected void onSubmit(final AjaxRequestTarget target, final Form<?> form) {
 +                final ConfTO updatedConf = (ConfTO) form.getModelObject();
 +
 +                try {
 +                    for (AttributeTO attr : updatedConf.getAttrs()) {
 +                        if (attr.getValues().isEmpty()
 +                                || attr.getValues().equals(Collections.singletonList(StringUtils.EMPTY))) {
 +
 +                            confRestClient.delete(attr.getSchema());
 +                        } else {
 +                            confRestClient.set(attr);
 +                        }
 +                    }
 +
 +                    if (pageRef.getPage() instanceof BasePage) {
 +                        ((BasePage) pageRef.getPage()).setModalResult(true);
 +                    }
 +
 +                    window.close(target);
 +                } catch (Exception e) {
 +                    error(getString(Constants.ERROR) + ": " + e.getMessage());
 +                    feedbackPanel.refresh(target);
 +                }
 +            }
 +
 +            @Override
 +            protected void onError(final AjaxRequestTarget target, final Form<?> form) {
 +                feedbackPanel.refresh(target);
 +            }
 +        };
 +        MetaDataRoleAuthorizationStrategy.authorize(
-                 submit, ENABLE, xmlRolesReader.getAllAllowedRoles("Configuration", "set"));
++                submit, ENABLE, xmlRolesReader.getEntitlement("Configuration", "set"));
 +        MetaDataRoleAuthorizationStrategy.authorize(
-                 submit, ENABLE, xmlRolesReader.getAllAllowedRoles("Configuration", "delete"));
++                submit, ENABLE, xmlRolesReader.getEntitlement("Configuration", "delete"));
 +        form.add(submit);
 +        form.setDefaultButton(submit);
 +
 +        final AjaxButton cancel = new IndicatingAjaxButton(CANCEL, new ResourceModel(CANCEL)) {
 +
 +            private static final long serialVersionUID = -958724007591692537L;
 +
 +            @Override
 +            protected void onSubmit(final AjaxRequestTarget target, final Form<?> form) {
 +                window.close(target);
 +            }
 +        };
 +        cancel.setDefaultFormProcessing(false);
 +        form.add(cancel);
 +
 +        add(form);
 +    }
 +}

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/Configuration.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/Configuration.java
index 4851117,9e4c0fc..b2e5c07
--- a/console/src/main/java/org/apache/syncope/console/pages/Configuration.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/Configuration.java
@@@ -25,19 -26,13 +25,17 @@@ import java.util.Arrays
  import java.util.Collections;
  import java.util.Iterator;
  import java.util.List;
 -import org.apache.syncope.common.to.ConfigurationTO;
 +import org.apache.logging.log4j.LogManager;
 +import org.apache.logging.log4j.core.LoggerContext;
 +import org.apache.logging.log4j.core.config.LoggerConfig;
 +import org.apache.syncope.common.SyncopeClientException;
 +import org.apache.syncope.common.SyncopeConstants;
- import org.apache.syncope.common.to.AttributeTO;
- import org.apache.syncope.common.to.ConfTO;
  import org.apache.syncope.common.to.LoggerTO;
  import org.apache.syncope.common.to.NotificationTO;
 -import org.apache.syncope.common.to.WorkflowDefinitionTO;
 +import org.apache.syncope.common.to.SecurityQuestionTO;
 +import org.apache.syncope.console.commons.AttrLayoutType;
 +import org.apache.syncope.common.types.LoggerLevel;
  import org.apache.syncope.common.types.PolicyType;
 -import org.apache.syncope.common.types.SyncopeLoggerLevel;
 -import org.apache.syncope.common.validation.SyncopeClientCompositeErrorException;
  import org.apache.syncope.console.commons.Constants;
  import org.apache.syncope.console.commons.HttpResourceStream;
  import org.apache.syncope.console.commons.PreferenceManager;
@@@ -154,92 -142,50 +152,91 @@@ public class Configuration extends Base
          add(new PoliciesPanel("syncPoliciesPanel", getPageReference(), PolicyType.SYNC));
  
          add(createNotificationWin = new ModalWindow("createNotificationWin"));
 +        createNotificationWin.setCssClassName(ModalWindow.CSS_CLASS_GRAY);
 +        createNotificationWin.setInitialHeight(NOTIFICATION_WIN_HEIGHT);
 +        createNotificationWin.setInitialWidth(NOTIFICATION_WIN_WIDTH);
 +        createNotificationWin.setCookieName("create-notification-modal");
          add(editNotificationWin = new ModalWindow("editNotificationWin"));
 +        editNotificationWin.setCssClassName(ModalWindow.CSS_CLASS_GRAY);
 +        editNotificationWin.setInitialHeight(NOTIFICATION_WIN_HEIGHT);
 +        editNotificationWin.setInitialWidth(NOTIFICATION_WIN_WIDTH);
 +        editNotificationWin.setCookieName("edit-notification-modal");
          setupNotification();
  
 +        add(createSecurityQuestionWin = new ModalWindow("createSecurityQuestionWin"));
 +        createSecurityQuestionWin.setCssClassName(ModalWindow.CSS_CLASS_GRAY);
 +        createSecurityQuestionWin.setInitialHeight(SECURITY_QUESTION_WIN_HEIGHT);
 +        createSecurityQuestionWin.setInitialWidth(SECURITY_QUESTION_WIN_WIDTH);
 +        createSecurityQuestionWin.setCookieName("create-security-question-modal");
 +        add(editSecurityQuestionWin = new ModalWindow("editSecurityQuestionWin"));
 +        editSecurityQuestionWin.setCssClassName(ModalWindow.CSS_CLASS_GRAY);
 +        editSecurityQuestionWin.setInitialHeight(SECURITY_QUESTION_WIN_HEIGHT);
 +        editSecurityQuestionWin.setInitialWidth(SECURITY_QUESTION_WIN_WIDTH);
 +        editSecurityQuestionWin.setCookieName("edit-security-question-modal");
 +        setupSecurityQuestion();
 +
          // Workflow definition stuff
 -        final WorkflowDefinitionTO workflowDef = wfRestClient.getDefinition();
 +        WebMarkupContainer noActivitiEnabledForUsers = new WebMarkupContainer("noActivitiEnabledForUsers");
 +        noActivitiEnabledForUsers.setOutputMarkupPlaceholderTag(true);
 +        add(noActivitiEnabledForUsers);
  
          WebMarkupContainer workflowDefContainer = new WebMarkupContainer("workflowDefContainer");
 +        workflowDefContainer.setOutputMarkupPlaceholderTag(true);
  
 -        Form wfForm = new Form("workflowDefForm", new CompoundPropertyModel(workflowDef));
 +        if (wfRestClient.isActivitiEnabledForUsers()) {
 +            noActivitiEnabledForUsers.setVisible(false);
 +        } else {
 +            workflowDefContainer.setVisible(false);
 +        }
  
 -        TextArea<WorkflowDefinitionTO> workflowDefArea = new TextArea<WorkflowDefinitionTO>("workflowDefArea",
 -                new PropertyModel<WorkflowDefinitionTO>(workflowDef, "xmlDefinition"));
 -        wfForm.add(workflowDefArea);
 +        BookmarkablePageLink<Void> activitiModeler =
 +                new BookmarkablePageLink<Void>("activitiModeler", ActivitiModelerPopupPage.class);
 +        activitiModeler.setPopupSettings(new VeilPopupSettings().setHeight(600).setWidth(800));
 +        MetaDataRoleAuthorizationStrategy.authorize(activitiModeler, ENABLE,
-                 xmlRolesReader.getAllAllowedRoles("Configuration", "workflowDefRead"));
++                xmlRolesReader.getEntitlement("Configuration", "workflowDefRead"));
 +        workflowDefContainer.add(activitiModeler);
 +        // Check if Activiti Modeler directory is found
 +        boolean activitiModelerEnabled = false;
 +        try {
 +            String activitiModelerDirectory = WebApplicationContextUtils.getWebApplicationContext(
 +                    WebApplication.get().getServletContext()).getBean("activitiModelerDirectory", String.class);
 +            File baseDir = new File(activitiModelerDirectory);
 +            activitiModelerEnabled = baseDir.exists() && baseDir.canRead() && baseDir.isDirectory();
 +        } catch (Exception e) {
 +            LOG.error("Could not check for Activiti Modeler directory", e);
 +        }
 +        activitiModeler.setEnabled(activitiModelerEnabled);
  
 -        AjaxButton submit =
 -                new ClearIndicatingAjaxButton(APPLY, new Model<String>(getString(SUBMIT)), getPageReference()) {
 +        BookmarkablePageLink<Void> xmlEditor =
 +                new BookmarkablePageLink<Void>("xmlEditor", XMLEditorPopupPage.class);
 +        xmlEditor.setPopupSettings(new VeilPopupSettings().setHeight(480).setWidth(800));
 +        MetaDataRoleAuthorizationStrategy.authorize(xmlEditor, ENABLE,
-                 xmlRolesReader.getAllAllowedRoles("Configuration", "workflowDefRead"));
++                xmlRolesReader.getEntitlement("Configuration", "workflowDefRead"));
 +        workflowDefContainer.add(xmlEditor);
  
 -            private static final long serialVersionUID = -958724007591692537L;
 +        Image workflowDefDiagram = new Image("workflowDefDiagram", new Model()) {
  
 -            @Override
 -            protected void onSubmitInternal(final AjaxRequestTarget target, final Form<?> form) {
 -                try {
 -                    wfRestClient.updateDefinition(workflowDef);
 -                    info(getString(Constants.OPERATION_SUCCEEDED));
 -                } catch (SyncopeClientCompositeErrorException scee) {
 -                    error(getString(Constants.ERROR) + ":" + scee.getMessage());
 -                }
 -                target.add(feedbackPanel);
 -            }
 +            private static final long serialVersionUID = -8457850449086490660L;
  
              @Override
 -            protected void onError(final AjaxRequestTarget target, final Form<?> form) {
 -                target.add(feedbackPanel);
 -            }
 -        };
 +            protected IResource getImageResource() {
 +                return new DynamicImageResource() {
  
 -        MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, xmlRolesReader.getEntitlement("Configuration",
 -                "workflowDefUpdate"));
 -        wfForm.add(submit);
 +                    private static final long serialVersionUID = 923201517955737928L;
  
 -        workflowDefContainer.add(wfForm);
 +                    @Override
 +                    protected byte[] getImageData(final IResource.Attributes attributes) {
 +                        return wfRestClient.isActivitiEnabledForUsers()
 +                                ? wfRestClient.getDiagram()
 +                                : new byte[0];
 +                    }
 +                };
 +            }
- 
 +        };
 +        workflowDefContainer.add(workflowDefDiagram);
  
 -        MetaDataRoleAuthorizationStrategy.authorize(workflowDefContainer, ENABLE, xmlRolesReader.getEntitlement(
 -                "Configuration", "workflowDefRead"));
 +        MetaDataRoleAuthorizationStrategy.authorize(workflowDefContainer, ENABLE,
-                 xmlRolesReader.getAllAllowedRoles("Configuration", "workflowDefRead"));
++                xmlRolesReader.getEntitlement("Configuration", "workflowDefRead"));
          add(workflowDefContainer);
  
          // Logger stuff
@@@ -260,27 -206,106 +257,27 @@@
          consoleLoggerContainer.add(consoleLoggerList);
          consoleLoggerContainer.setOutputMarkupId(true);
  
-         MetaDataRoleAuthorizationStrategy.authorize(consoleLoggerContainer, ENABLE, xmlRolesReader.getAllAllowedRoles(
+         MetaDataRoleAuthorizationStrategy.authorize(consoleLoggerContainer, ENABLE, xmlRolesReader.getEntitlement(
                  "Configuration", "logList"));
          add(consoleLoggerContainer);
 +
 +        add(new LayoutsPanel("adminUserLayoutPanel", AttrLayoutType.ADMIN_USER, feedbackPanel));
 +        add(new LayoutsPanel("selfUserLayoutPanel", AttrLayoutType.SELF_USER, feedbackPanel));
 +        add(new LayoutsPanel("adminRoleLayoutPanel", AttrLayoutType.ADMIN_ROLE, feedbackPanel));
 +        add(new LayoutsPanel("selfRoleLayoutPanel", AttrLayoutType.SELF_ROLE, feedbackPanel));
 +        add(new LayoutsPanel("adminMembershipLayoutPanel", AttrLayoutType.ADMIN_MEMBERSHIP, feedbackPanel));
 +        add(new LayoutsPanel("selfMembershipLayoutPanel", AttrLayoutType.SELF_MEMBERSHIP, feedbackPanel));
      }
  
 +    @SuppressWarnings({ "unchecked", "rawtypes" })
      private void setupSyncopeConf() {
 -        confPaginatorRows = prefMan.getPaginatorRows(getRequest(), Constants.PREF_CONFIGURATION_PAGINATOR_ROWS);
 -
 -        final List<IColumn<ConfigurationTO, String>> confColumns = new ArrayList<IColumn<ConfigurationTO, String>>();
 -        confColumns.add(new PropertyColumn<ConfigurationTO, String>(new ResourceModel("key"), "key", "key"));
 -        confColumns.add(new PropertyColumn<ConfigurationTO, String>(new ResourceModel("value"), "value", "value"));
 -
 -        confColumns.add(new AbstractColumn<ConfigurationTO, String>(new ResourceModel("actions", "")) {
 -
 -            private static final long serialVersionUID = 2054811145491901166L;
 +        final WebMarkupContainer parameters = new WebMarkupContainer("parameters");
 +        parameters.setOutputMarkupId(true);
 +        add(parameters);
  
 -            @Override
 -            public String getCssClass() {
 -                return "action";
 -            }
 -
 -            @Override
 -            public void populateItem(final Item<ICellPopulator<ConfigurationTO>> cellItem, final String componentId,
 -                    final IModel<ConfigurationTO> model) {
 -
 -                final ConfigurationTO configurationTO = model.getObject();
 +        setWindowClosedCallback(syncopeConfWin, parameters);
  
 -                final ActionLinksPanel panel = new ActionLinksPanel(componentId, model, getPageReference());
 -
 -                panel.add(new ActionLink() {
 -
 -                    private static final long serialVersionUID = -3722207913631435501L;
 -
 -                    @Override
 -                    public void onClick(final AjaxRequestTarget target) {
 -
 -                        editConfigWin.setPageCreator(new ModalWindow.PageCreator() {
 -
 -                            private static final long serialVersionUID = -7834632442532690940L;
 -
 -                            @Override
 -                            public Page createPage() {
 -                                return new ConfigurationModalPage(Configuration.this.getPageReference(), editConfigWin,
 -                                        configurationTO, false);
 -                            }
 -                        });
 -
 -                        editConfigWin.show(target);
 -                    }
 -                }, ActionLink.ActionType.EDIT, "Configuration");
 -
 -                panel.add(new ActionLink() {
 -
 -                    private static final long serialVersionUID = -3722207913631435501L;
 -
 -                    @Override
 -                    public void onClick(final AjaxRequestTarget target) {
 -                        try {
 -                            confRestClient.deleteConfiguration(configurationTO.getKey());
 -                        } catch (SyncopeClientCompositeErrorException e) {
 -                            LOG.error("While deleting a conf key", e);
 -                            error(e.getMessage());
 -                            return;
 -                        }
 -
 -                        info(getString(Constants.OPERATION_SUCCEEDED));
 -                        target.add(feedbackPanel);
 -
 -                        target.add(confContainer);
 -                    }
 -                }, ActionLink.ActionType.DELETE, "Configuration");
 -
 -                cellItem.add(panel);
 -            }
 -        });
 -
 -        final AjaxFallbackDefaultDataTable<ConfigurationTO, String> confTable =
 -                new AjaxFallbackDefaultDataTable<ConfigurationTO, String>(
 -                "syncopeconf", confColumns, new SyncopeConfProvider(), confPaginatorRows);
 -
 -        confContainer = new WebMarkupContainer("confContainer");
 -        confContainer.add(confTable);
 -        confContainer.setOutputMarkupId(true);
 -
 -        add(confContainer);
 -
 -        createConfigWin.setCssClassName(ModalWindow.CSS_CLASS_GRAY);
 -        createConfigWin.setInitialHeight(CONFIG_WIN_HEIGHT);
 -        createConfigWin.setInitialWidth(CONFIG_WIN_WIDTH);
 -        createConfigWin.setCookieName("create-configuration-modal");
 -
 -        editConfigWin.setCssClassName(ModalWindow.CSS_CLASS_GRAY);
 -        editConfigWin.setInitialHeight(CONFIG_WIN_HEIGHT);
 -        editConfigWin.setInitialWidth(CONFIG_WIN_WIDTH);
 -        editConfigWin.setCookieName("edit-configuration-modal");
 -
 -        setWindowClosedCallback(createConfigWin, confContainer);
 -        setWindowClosedCallback(editConfigWin, confContainer);
 -
 -        AjaxLink createConfigurationLink = new AjaxLink("createConfigurationLink") {
 +        AjaxLink<Void> confLink = new IndicatingAjaxLink<Void>("confLink") {
  
              private static final long serialVersionUID = -7978723352517770644L;
  
@@@ -320,9 -350,32 +317,9 @@@
                  }
              }
          };
-         MetaDataRoleAuthorizationStrategy.authorize(dbExportLink, ENABLE, xmlRolesReader.getAllAllowedRoles(
-                 "Configuration", "export"));
 -
 -        MetaDataRoleAuthorizationStrategy.authorize(dbExportLink, ENABLE, xmlRolesReader.getEntitlement(
 -                "Configuration", "read"));
++        MetaDataRoleAuthorizationStrategy.authorize(
++                dbExportLink, ENABLE, xmlRolesReader.getEntitlement("Configuration", "export"));
          add(dbExportLink);
 -
 -        Form confPaginatorForm = new Form("confPaginatorForm");
 -
 -        final DropDownChoice rowsChooser = new DropDownChoice("rowsChooser", new PropertyModel(this,
 -                "confPaginatorRows"), prefMan.getPaginatorChoices());
 -
 -        rowsChooser.add(new AjaxFormComponentUpdatingBehavior(Constants.ON_CHANGE) {
 -
 -            private static final long serialVersionUID = -1107858522700306810L;
 -
 -            @Override
 -            protected void onUpdate(final AjaxRequestTarget target) {
 -                prefMan.set(getRequest(), getResponse(), Constants.PREF_CONFIGURATION_PAGINATOR_ROWS, String.valueOf(
 -                        confPaginatorRows));
 -                confTable.setItemsPerPage(confPaginatorRows);
 -
 -                target.add(confContainer);
 -            }
 -        });
 -
 -        confPaginatorForm.add(rowsChooser);
 -        add(confPaginatorForm);
      }
  
      private void setupNotification() {
@@@ -467,117 -529,7 +464,117 @@@
          add(notificationPaginatorForm);
      }
  
 -    private class SyncopeConfProvider extends SortableDataProvider<ConfigurationTO, String> {
 +    private void setupSecurityQuestion() {
 +        final List<IColumn<SecurityQuestionTO, String>> securityQuestionCols =
 +                new ArrayList<IColumn<SecurityQuestionTO, String>>();
 +        securityQuestionCols.add(new PropertyColumn<SecurityQuestionTO, String>(
 +                new ResourceModel("id"), "id", "id"));
 +        securityQuestionCols.add(new PropertyColumn<SecurityQuestionTO, String>(
 +                new ResourceModel("content"), "content", "content"));
 +
 +        securityQuestionCols.add(new AbstractColumn<SecurityQuestionTO, String>(new ResourceModel("actions", "")) {
 +
 +            private static final long serialVersionUID = 2054811145491901166L;
 +
 +            @Override
 +            public String getCssClass() {
 +                return "action";
 +            }
 +
 +            @Override
 +            public void populateItem(final Item<ICellPopulator<SecurityQuestionTO>> cellItem, final String componentId,
 +                    final IModel<SecurityQuestionTO> model) {
 +
 +                final SecurityQuestionTO securityQuestionTO = model.getObject();
 +
 +                final ActionLinksPanel panel = new ActionLinksPanel(componentId, model, getPageReference());
 +
 +                panel.add(new ActionLink() {
 +
 +                    private static final long serialVersionUID = -3722207913631435501L;
 +
 +                    @Override
 +                    public void onClick(final AjaxRequestTarget target) {
 +                        editSecurityQuestionWin.setPageCreator(new ModalWindow.PageCreator() {
 +
 +                            private static final long serialVersionUID = -7834632442532690940L;
 +
 +                            @Override
 +                            public Page createPage() {
 +                                return new SecurityQuestionModalPage(Configuration.this.getPageReference(),
 +                                        editSecurityQuestionWin, securityQuestionTO, false);
 +                            }
 +                        });
 +
 +                        editSecurityQuestionWin.show(target);
 +                    }
 +                }, ActionLink.ActionType.EDIT, "SecurityQuestion");
 +
 +                panel.add(new ActionLink() {
 +
 +                    private static final long serialVersionUID = -3722207913631435501L;
 +
 +                    @Override
 +                    public void onClick(final AjaxRequestTarget target) {
 +                        try {
 +                            securityQuestionRestClient.delete(securityQuestionTO.getId());
 +                        } catch (SyncopeClientException e) {
 +                            LOG.error("While deleting a security question", e);
 +                            error(e.getMessage());
 +                            return;
 +                        }
 +
 +                        info(getString(Constants.OPERATION_SUCCEEDED));
 +                        feedbackPanel.refresh(target);
 +                        target.add(securityQuestionContainer);
 +                    }
 +                }, ActionLink.ActionType.DELETE, "SecurityQuestion");
 +
 +                cellItem.add(panel);
 +            }
 +        });
 +
 +        final AjaxFallbackDefaultDataTable<SecurityQuestionTO, String> securityQuestionTable =
 +                new AjaxFallbackDefaultDataTable<SecurityQuestionTO, String>("securityQuestionTable",
 +                        securityQuestionCols, new SecurityQuestionProvider(), 50);
 +
 +        securityQuestionContainer = new WebMarkupContainer("securityQuestionContainer");
 +        securityQuestionContainer.add(securityQuestionTable);
 +        securityQuestionContainer.setOutputMarkupId(true);
 +
 +        add(securityQuestionContainer);
 +
 +        setWindowClosedCallback(createSecurityQuestionWin, securityQuestionContainer);
 +        setWindowClosedCallback(editSecurityQuestionWin, securityQuestionContainer);
 +
 +        AjaxLink<Void> createSecurityQuestionLink = new AjaxLink<Void>("createSecurityQuestionLink") {
 +
 +            private static final long serialVersionUID = -7978723352517770644L;
 +
 +            @Override
 +            public void onClick(final AjaxRequestTarget target) {
 +
 +                createSecurityQuestionWin.setPageCreator(new ModalWindow.PageCreator() {
 +
 +                    private static final long serialVersionUID = -7834632442532690940L;
 +
 +                    @Override
 +                    public Page createPage() {
 +                        return new SecurityQuestionModalPage(Configuration.this.getPageReference(),
 +                                createSecurityQuestionWin, new SecurityQuestionTO(), true);
 +                    }
 +                });
 +
 +                createSecurityQuestionWin.show(target);
 +            }
 +        };
 +
-         MetaDataRoleAuthorizationStrategy.authorize(createSecurityQuestionLink, ENABLE, xmlRolesReader.
-                 getAllAllowedRoles("SecurityQuestion", "create"));
++        MetaDataRoleAuthorizationStrategy.authorize(
++                createSecurityQuestionLink, ENABLE, xmlRolesReader.getEntitlement("SecurityQuestion", "create"));
 +        add(createSecurityQuestionLink);
 +    }
 +
 +    private class NotificationProvider extends SortableDataProvider<NotificationTO, String> {
  
          private static final long serialVersionUID = -276043813563988590L;
  

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/ConnectorModalPage.java
----------------------------------------------------------------------

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/DerSchemaModalPage.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/DerSchemaModalPage.java
index 31f8dfd,0000000..80a1b6c
mode 100644,000000..100644
--- a/console/src/main/java/org/apache/syncope/console/pages/DerSchemaModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/DerSchemaModalPage.java
@@@ -1,140 -1,0 +1,140 @@@
 +/*
 + * Licensed to the Apache Software Foundation (ASF) under one
 + * or more contributor license agreements.  See the NOTICE file
 + * distributed with this work for additional information
 + * regarding copyright ownership.  The ASF licenses this file
 + * to you under the Apache License, Version 2.0 (the
 + * "License"); you may not use this file except in compliance
 + * with the License.  You may obtain a copy of the License at
 + *
 + *   http://www.apache.org/licenses/LICENSE-2.0
 + *
 + * Unless required by applicable law or agreed to in writing,
 + * software distributed under the License is distributed on an
 + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 + * KIND, either express or implied.  See the License for the
 + * specific language governing permissions and limitations
 + * under the License.
 + */
 +package org.apache.syncope.console.pages;
 +
 +import org.apache.syncope.common.to.DerSchemaTO;
 +import org.apache.syncope.common.types.AttributableType;
 +import org.apache.syncope.common.SyncopeClientException;
 +import org.apache.syncope.console.commons.Constants;
 +import org.apache.syncope.console.commons.JexlHelpUtil;
 +import org.apache.syncope.console.wicket.markup.html.form.AjaxTextFieldPanel;
 +import org.apache.wicket.PageReference;
 +import org.apache.wicket.ajax.AjaxRequestTarget;
 +import org.apache.wicket.ajax.markup.html.AjaxLink;
 +import org.apache.wicket.ajax.markup.html.form.AjaxButton;
 +import org.apache.wicket.authroles.authorization.strategies.role.metadata.MetaDataRoleAuthorizationStrategy;
 +import org.apache.wicket.extensions.ajax.markup.html.IndicatingAjaxButton;
 +import org.apache.wicket.extensions.ajax.markup.html.modal.ModalWindow;
 +import org.apache.wicket.markup.html.WebMarkupContainer;
 +import org.apache.wicket.markup.html.form.Form;
 +import org.apache.wicket.model.CompoundPropertyModel;
 +import org.apache.wicket.model.PropertyModel;
 +import org.apache.wicket.model.ResourceModel;
 +
 +/**
 + * Modal window with Schema form.
 + */
 +public class DerSchemaModalPage extends AbstractSchemaModalPage<DerSchemaTO> {
 +
 +    private static final long serialVersionUID = 6668789770131753386L;
 +
 +    public DerSchemaModalPage(final AttributableType kind) {
 +        super(kind);
 +    }
 +
 +    @Override
 +    public void setSchemaModalPage(final PageReference pageRef, final ModalWindow window,
 +            DerSchemaTO schema, final boolean createFlag) {
 +
 +        if (schema == null) {
 +            schema = new DerSchemaTO();
 +        }
 +
 +        final Form<DerSchemaTO> schemaForm = new Form<DerSchemaTO>(FORM);
 +
 +        schemaForm.setModel(new CompoundPropertyModel<DerSchemaTO>(schema));
 +
 +        final AjaxTextFieldPanel name = new AjaxTextFieldPanel("name", getString("name"), new PropertyModel<String>(
 +                schema, "name"));
 +        name.addRequiredLabel();
 +
 +        final AjaxTextFieldPanel expression = new AjaxTextFieldPanel("expression", getString("expression"),
 +                new PropertyModel<String>(schema, "expression"));
 +        expression.addRequiredLabel();
 +
 +        final WebMarkupContainer jexlHelp = JexlHelpUtil.getJexlHelpWebContainer("jexlHelp");
 +
 +        final AjaxLink<Void> questionMarkJexlHelp = JexlHelpUtil.getAjaxLink(jexlHelp, "questionMarkJexlHelp");
 +        schemaForm.add(questionMarkJexlHelp);
 +        questionMarkJexlHelp.add(jexlHelp);
 +
 +        name.setEnabled(createFlag);
 +
 +        final AjaxButton submit = new IndicatingAjaxButton(APPLY, new ResourceModel(SUBMIT)) {
 +
 +            private static final long serialVersionUID = -958724007591692537L;
 +
 +            @Override
 +            protected void onSubmit(final AjaxRequestTarget target, final Form form) {
 +                DerSchemaTO schemaTO = (DerSchemaTO) form.getDefaultModelObject();
 +
 +                try {
 +                    if (createFlag) {
 +                        schemaRestClient.createDerSchema(kind, schemaTO);
 +                    } else {
 +                        schemaRestClient.updateDerSchema(kind, schemaTO);
 +                    }
 +
 +                    if (pageRef.getPage() instanceof BasePage) {
 +                        ((BasePage) pageRef.getPage()).setModalResult(true);
 +                    }
 +
 +                    window.close(target);
 +                } catch (SyncopeClientException e) {
 +                    error(getString(Constants.ERROR) + ": " + e.getMessage());
 +                    feedbackPanel.refresh(target);
 +                }
 +            }
 +
 +            @Override
 +            protected void onError(final AjaxRequestTarget target, final Form<?> form) {
 +                feedbackPanel.refresh(target);
 +            }
 +        };
 +
 +        final AjaxButton cancel = new IndicatingAjaxButton(CANCEL, new ResourceModel(CANCEL)) {
 +
 +            private static final long serialVersionUID = -958724007591692537L;
 +
 +            @Override
 +            protected void onSubmit(final AjaxRequestTarget target, final Form<?> form) {
 +                window.close(target);
 +            }
 +        };
 +
 +        cancel.setDefaultFormProcessing(
 +                false);
 +
 +        String allowedRoles = createFlag
-                 ? xmlRolesReader.getAllAllowedRoles("Schema", "create")
-                 : xmlRolesReader.getAllAllowedRoles("Schema", "update");
++                ? xmlRolesReader.getEntitlement("Schema", "create")
++                : xmlRolesReader.getEntitlement("Schema", "update");
 +
 +        MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, allowedRoles);
 +
 +        schemaForm.add(name);
 +
 +        schemaForm.add(expression);
 +
 +        schemaForm.add(submit);
 +
 +        schemaForm.add(cancel);
 +
 +        add(schemaForm);
 +    }
 +}

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/EditUserModalPage.java
----------------------------------------------------------------------

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/NotificationModalPage.java
----------------------------------------------------------------------

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/ReportModalPage.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/ReportModalPage.java
index d751ff8,d76400b..ea73e9e
--- a/console/src/main/java/org/apache/syncope/console/pages/ReportModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/ReportModalPage.java
@@@ -158,11 -161,11 +158,11 @@@ public class ReportModalPage extends Ba
                  };
  
          if (reportTO.getId() > 0) {
 -            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER, xmlRolesReader.getEntitlement("Reports",
 -                    "update"));
 +            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER,
-                     xmlRolesReader.getAllAllowedRoles("Reports", "update"));
++                    xmlRolesReader.getEntitlement("Reports", "update"));
          } else {
 -            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER, xmlRolesReader.getEntitlement("Reports",
 -                    "create"));
 +            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER,
-                     xmlRolesReader.getAllAllowedRoles("Reports", "create"));
++                    xmlRolesReader.getEntitlement("Reports", "create"));
          }
  
          form.add(submit);

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/Reports.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/Reports.java
index b47e434,789e37e..3f09762
--- a/console/src/main/java/org/apache/syncope/console/pages/Reports.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/Reports.java
@@@ -109,8 -110,8 +109,8 @@@ public class Reports extends BasePage 
          reportContainer = new WebMarkupContainer("reportContainer");
          setWindowClosedCallback(window, reportContainer);
  
 -        MetaDataRoleAuthorizationStrategy.authorize(reportContainer, RENDER, xmlRolesReader.getEntitlement(
 -                "Reports", "list"));
 +        MetaDataRoleAuthorizationStrategy.authorize(reportContainer, RENDER,
-                 xmlRolesReader.getAllAllowedRoles("Reports", "list"));
++                xmlRolesReader.getEntitlement("Reports", "list"));
  
          paginatorRows = prefMan.getPaginatorRows(getRequest(), Constants.PREF_REPORT_PAGINATOR_ROWS);
  
@@@ -222,13 -221,11 +222,13 @@@
  
          add(reportContainer);
  
 +        @SuppressWarnings("rawtypes")
          Form paginatorForm = new Form("paginatorForm");
  
 -        MetaDataRoleAuthorizationStrategy.authorize(paginatorForm, RENDER, xmlRolesReader.getEntitlement("Reports",
 -                "list"));
 +        MetaDataRoleAuthorizationStrategy.authorize(paginatorForm, RENDER,
-                 xmlRolesReader.getAllAllowedRoles("Reports", "list"));
++                xmlRolesReader.getEntitlement("Reports", "list"));
  
 +        @SuppressWarnings({ "unchecked", "rawtypes" })
          final DropDownChoice rowsChooser = new DropDownChoice("rowsChooser", new PropertyModel(this, "paginatorRows"),
                  prefMan.getPaginatorChoices());
  
@@@ -338,7 -335,7 +338,7 @@@
                                              eventCategory.getKey().getCategory(),
                                              eventCategory.getKey().getSubcategory(),
                                              CollectionUtils.isEmpty(eventCategory.getKey().getEvents())
--                                            ? null : eventCategory.getKey().getEvents().iterator().next(),
++                                                    ? null : eventCategory.getKey().getEvents().iterator().next(),
                                              eventCategory.getValue());
  
                                      loggerRestClient.disableAudit(auditLoggerName);
@@@ -356,7 -353,7 +356,7 @@@
                                              eventCategory.getKey().getCategory(),
                                              eventCategory.getKey().getSubcategory(),
                                              CollectionUtils.isEmpty(eventCategory.getKey().getEvents())
--                                            ? null : eventCategory.getKey().getEvents().iterator().next(),
++                                                    ? null : eventCategory.getKey().getEvents().iterator().next(),
                                              eventCategory.getValue());
  
                                      loggerRestClient.enableAudit(auditLoggerName);
@@@ -384,10 -381,7 +384,10 @@@
  
          @Override
          public Iterator<ReportTO> iterator(final long first, final long count) {
 -            final List<ReportTO> list = reportRestClient.list(((int) first / paginatorRows) + 1, paginatorRows);
 +            final int page = ((int) first / paginatorRows);
-             
++
 +            final List<ReportTO> list =
 +                    reportRestClient.list((page < 0 ? 0 : page) + 1, paginatorRows, getSort());
              Collections.sort(list, comparator);
              return list.iterator();
          }

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/ResourceModalPage.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/ResourceModalPage.java
index 5768d71,ea58648..1c93fd1
--- a/console/src/main/java/org/apache/syncope/console/pages/ResourceModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/ResourceModalPage.java
@@@ -81,12 -77,9 +81,12 @@@ public class ResourceModalPage extends 
          //--------------------------------
  
          //--------------------------------
 -        // Resource mapping panel
 +        // Resource connector configuration panel
          //--------------------------------
 -        form.add(new ResourceConnConfPanel("connconf", resourceTO, createFlag));
 +        ResourceConnConfPanel resourceConnConfPanel = new ResourceConnConfPanel("connconf", resourceTO, createFlag);
-         MetaDataRoleAuthorizationStrategy.authorize(resourceConnConfPanel, ENABLE,
-                 xmlRolesReader.getAllAllowedRoles("Connectors", "read"));
++        MetaDataRoleAuthorizationStrategy.authorize(
++                resourceConnConfPanel, ENABLE, xmlRolesReader.getEntitlement("Connectors", "read"));
 +        form.add(resourceConnConfPanel);
          //--------------------------------
  
          //--------------------------------
@@@ -180,10 -173,10 +180,10 @@@
  
          add(form);
  
-         MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, xmlRolesReader.getAllAllowedRoles("Resources",
+         MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, xmlRolesReader.getEntitlement("Resources",
                  createFlag
 -                ? "create"
 -                : "update"));
 +                        ? "create"
 +                        : "update"));
      }
  
      /**

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/Resources.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/Resources.java
index 12f0f80,89aa1ba..f1bd39b
--- a/console/src/main/java/org/apache/syncope/console/pages/Resources.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/Resources.java
@@@ -573,45 -476,40 +572,45 @@@ public class Resources extends BasePag
          editConnectorWin.setInitialWidth(WIN_WIDTH);
          editConnectorWin.setCookieName("edit-conn-modal");
  
 -        AjaxLink createConnectorLink = new ClearIndicatingAjaxLink("createConnectorLink", getPageReference()) {
 +        AjaxLink<Void> createConnectorLink =
 +                new ClearIndicatingAjaxLink<Void>("createConnectorLink", getPageReference()) {
  
 -            private static final long serialVersionUID = -7978723352517770644L;
 +                    private static final long serialVersionUID = -7978723352517770644L;
  
 -            @Override
 -            protected void onClickInternal(final AjaxRequestTarget target) {
 -                createConnectorWin.setPageCreator(new ModalWindow.PageCreator() {
 +                    @Override
 +                    protected void onClickInternal(final AjaxRequestTarget target) {
 +                        createConnectorWin.setPageCreator(new ModalWindow.PageCreator() {
  
 -                    private static final long serialVersionUID = -7834632442532690940L;
 +                            private static final long serialVersionUID = -7834632442532690940L;
  
 -                    @Override
 -                    public Page createPage() {
 -                        ConnectorModalPage form = new ConnectorModalPage(Resources.this.getPageReference(),
 -                                editConnectorWin, new ConnInstanceTO());
 -                        return form;
 -                    }
 -                });
 +                            @Override
 +                            public Page createPage() {
 +                                ConnectorModalPage form = new ConnectorModalPage(Resources.this.getPageReference(),
 +                                        editConnectorWin, new ConnInstanceTO());
 +                                return form;
 +                            }
 +                        });
  
 -                createConnectorWin.show(target);
 -            }
 -        };
 +                        createConnectorWin.show(target);
 +                    }
 +                };
  
-         MetaDataRoleAuthorizationStrategy.authorize(createConnectorLink, ENABLE, xmlRolesReader.getAllAllowedRoles(
+         MetaDataRoleAuthorizationStrategy.authorize(createConnectorLink, ENABLE, xmlRolesReader.getEntitlement(
                  "Connectors", "create"));
  
          add(createConnectorLink);
  
 +        @SuppressWarnings("rawtypes")
          Form paginatorForm = new Form("connectorPaginatorForm");
  
-         MetaDataRoleAuthorizationStrategy.authorize(paginatorForm, RENDER, xmlRolesReader.getAllAllowedRoles(
+         MetaDataRoleAuthorizationStrategy.authorize(paginatorForm, RENDER, xmlRolesReader.getEntitlement(
                  "Connectors", "list"));
  
 -        final DropDownChoice rowsChooser = new DropDownChoice("rowsChooser", new PropertyModel(this,
 -                "connectorPaginatorRows"), prefMan.getPaginatorChoices());
 +        final DropDownChoice<Integer> rowsChooser = new DropDownChoice<Integer>(
 +                "rowsChooser",
 +                new PropertyModel<Integer>(this,
 +                        "connectorPaginatorRows"),
 +                prefMan.getPaginatorChoices());
  
          rowsChooser.add(new AjaxFormComponentUpdatingBehavior(Constants.ON_CHANGE) {
  

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/RoleModalPage.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/RoleModalPage.java
index 095399b,2495421..7ef25a6
--- a/console/src/main/java/org/apache/syncope/console/pages/RoleModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/RoleModalPage.java
@@@ -122,13 -133,18 +122,13 @@@ public class RoleModalPage extends Base
                  closeAction(target, form);
              }
          };
 -
          cancel.setDefaultFormProcessing(false);
 +        form.add(cancel);
  
-         MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, xmlRolesReader.getAllAllowedRoles("Roles",
+         MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, xmlRolesReader.getEntitlement("Roles",
                  createFlag
 -                ? "create"
 -                : "update"));
 -
 -        form.add(submit);
 -        form.setDefaultButton(submit);
 -
 -        form.add(cancel);
 +                        ? "create"
 +                        : "update"));
  
          add(form);
      }

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/Schema.java
----------------------------------------------------------------------

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/SchemaModalPage.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/SchemaModalPage.java
index 4ab30e2,aedba1d..1e634f0
--- a/console/src/main/java/org/apache/syncope/console/pages/SchemaModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/SchemaModalPage.java
@@@ -286,12 -272,12 +286,12 @@@ public class SchemaModalPage extends Ab
                  window.close(target);
              }
          };
 -
          cancel.setDefaultFormProcessing(false);
 +        schemaForm.add(cancel);
  
          String allowedRoles = createFlag
-                 ? xmlRolesReader.getAllAllowedRoles("Schema", "create")
-                 : xmlRolesReader.getAllAllowedRoles("Schema", "update");
+                 ? xmlRolesReader.getEntitlement("Schema", "create")
+                 : xmlRolesReader.getEntitlement("Schema", "update");
  
          MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, allowedRoles);
  

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/SecurityQuestionModalPage.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/SecurityQuestionModalPage.java
index 743bcf2,0000000..c9cd4c7
mode 100644,000000..100644
--- a/console/src/main/java/org/apache/syncope/console/pages/SecurityQuestionModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/SecurityQuestionModalPage.java
@@@ -1,113 -1,0 +1,113 @@@
 +/*
 + * Licensed to the Apache Software Foundation (ASF) under one
 + * or more contributor license agreements.  See the NOTICE file
 + * distributed with this work for additional information
 + * regarding copyright ownership.  The ASF licenses this file
 + * to you under the Apache License, Version 2.0 (the
 + * "License"); you may not use this file except in compliance
 + * with the License.  You may obtain a copy of the License at
 + *
 + *   http://www.apache.org/licenses/LICENSE-2.0
 + *
 + * Unless required by applicable law or agreed to in writing,
 + * software distributed under the License is distributed on an
 + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 + * KIND, either express or implied.  See the License for the
 + * specific language governing permissions and limitations
 + * under the License.
 + */
 +package org.apache.syncope.console.pages;
 +
 +import static org.apache.syncope.console.pages.AbstractBasePage.FORM;
 +
 +import org.apache.syncope.common.SyncopeClientException;
 +import org.apache.syncope.common.to.SecurityQuestionTO;
 +import org.apache.syncope.console.commons.Constants;
 +import org.apache.syncope.console.rest.SecurityQuestionRestClient;
 +import org.apache.syncope.console.wicket.markup.html.form.AjaxTextFieldPanel;
 +import org.apache.wicket.PageReference;
 +import org.apache.wicket.ajax.AjaxRequestTarget;
 +import org.apache.wicket.ajax.markup.html.form.AjaxButton;
 +import org.apache.wicket.authroles.authorization.strategies.role.metadata.MetaDataRoleAuthorizationStrategy;
 +import org.apache.wicket.extensions.ajax.markup.html.IndicatingAjaxButton;
 +import org.apache.wicket.extensions.ajax.markup.html.modal.ModalWindow;
 +import org.apache.wicket.markup.html.form.Form;
 +import org.apache.wicket.model.CompoundPropertyModel;
 +import org.apache.wicket.model.Model;
 +import org.apache.wicket.model.PropertyModel;
 +import org.apache.wicket.model.ResourceModel;
 +import org.apache.wicket.spring.injection.annot.SpringBean;
 +
 +class SecurityQuestionModalPage extends BaseModalPage {
 +
 +    private static final long serialVersionUID = -6709838862698327502L;
 +
 +    @SpringBean
 +    private SecurityQuestionRestClient restClient;
 +
 +    public SecurityQuestionModalPage(final PageReference pageRef, final ModalWindow window,
 +            final SecurityQuestionTO securityQuestionTO, final boolean createFlag) {
 +
 +        final Form<SecurityQuestionTO> form =
 +                new Form<SecurityQuestionTO>(FORM, new CompoundPropertyModel<SecurityQuestionTO>(securityQuestionTO));
 +
 +        final AjaxTextFieldPanel contentFieldPanel =
 +                new AjaxTextFieldPanel("content", "content", new PropertyModel<String>(securityQuestionTO, "content"));
 +        contentFieldPanel.setRequired(true);
 +        form.add(contentFieldPanel);
 +
 +        AjaxButton submit = new IndicatingAjaxButton(APPLY, new Model<String>(getString(SUBMIT))) {
 +
 +            private static final long serialVersionUID = -958724007591692537L;
 +
 +            @Override
 +            protected void onSubmit(final AjaxRequestTarget target, final Form<?> form) {
 +                try {
 +                    if (createFlag) {
 +                        restClient.create(securityQuestionTO);
 +                    } else {
 +                        restClient.update(securityQuestionTO);
 +                    }
 +                    info(getString(Constants.OPERATION_SUCCEEDED));
 +
 +                    Configuration callerPage = (Configuration) pageRef.getPage();
 +                    callerPage.setModalResult(true);
 +
 +                    window.close(target);
 +                } catch (SyncopeClientException scee) {
 +                    error(getString(Constants.ERROR) + ": " + scee.getMessage());
 +                    feedbackPanel.refresh(target);
 +                }
 +            }
 +
 +            @Override
 +            protected void onError(final AjaxRequestTarget target, final Form<?> form) {
 +                feedbackPanel.refresh(target);
 +            }
 +        };
 +
 +        final AjaxButton cancel = new IndicatingAjaxButton(CANCEL, new ResourceModel(CANCEL)) {
 +
 +            private static final long serialVersionUID = -958724007591692537L;
 +
 +            @Override
 +            protected void onSubmit(final AjaxRequestTarget target, final Form<?> form) {
 +                window.close(target);
 +            }
 +        };
 +
 +        cancel.setDefaultFormProcessing(false);
 +
 +        String allowedRoles = createFlag
-                 ? xmlRolesReader.getAllAllowedRoles("SecurityQuestion", "create")
-                 : xmlRolesReader.getAllAllowedRoles("SecurityQuestion", "update");
++                ? xmlRolesReader.getEntitlement("SecurityQuestion", "create")
++                : xmlRolesReader.getEntitlement("SecurityQuestion", "update");
 +        MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, allowedRoles);
 +
 +        form.add(submit);
 +        form.setDefaultButton(submit);
 +
 +        form.add(cancel);
 +
 +        add(form);
 +    }
 +}

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/Todo.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/Todo.java
index cf57664,06dd6f0..6ddbed9
--- a/console/src/main/java/org/apache/syncope/console/pages/Todo.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/Todo.java
@@@ -78,27 -95,28 +78,27 @@@ public class Todo extends BasePage 
      public Todo(final PageParameters parameters) {
          super(parameters);
  
 -        add(editApprovalWin = new ModalWindow("editApprovalWin"));
 -        add(editUserRequestWin = new ModalWindow("editUserRequestWin"));
 +        add(window = new ModalWindow("editApprovalWin"));
  
 -        setupApproval();
 -        setupUserRequest();
 -    }
 -
 -    private void setupApproval() {
 -        approvalContainer = new WebMarkupContainer("approvalContainer");
 +        container = new WebMarkupContainer("approvalContainer");
  
-         MetaDataRoleAuthorizationStrategy.authorize(container, RENDER,
-                 xmlRolesReader.getAllAllowedRoles("Approval", "list"));
 -        MetaDataRoleAuthorizationStrategy.authorize(approvalContainer, RENDER, xmlRolesReader.getEntitlement(
 -                "Approval", "list"));
++        MetaDataRoleAuthorizationStrategy.authorize(
++                container, RENDER, xmlRolesReader.getEntitlement("Approval", "list"));
  
 -        approvalPaginatorRows = prefMan.getPaginatorRows(getRequest(), Constants.PREF_APPROVAL_PAGINATOR_ROWS);
 +        paginatorRows = prefMan.getPaginatorRows(getRequest(), Constants.PREF_TODO_PAGINATOR_ROWS);
  
 -        List<IColumn> columns = new ArrayList<IColumn>();
 -        columns.add(new PropertyColumn(new ResourceModel("taskId"), "taskId", "taskId"));
 -        columns.add(new PropertyColumn(new ResourceModel("key"), "key", "key"));
 -        columns.add(new PropertyColumn(new ResourceModel("description"), "description", "description"));
 -        columns.add(new DatePropertyColumn(new ResourceModel("createTime"), "createTime", "createTime"));
 -        columns.add(new DatePropertyColumn(new ResourceModel("dueDate"), "dueDate", "dueDate"));
 -        columns.add(new PropertyColumn(new ResourceModel("owner"), "owner", "owner"));
 +        List<IColumn<WorkflowFormTO, String>> columns = new ArrayList<IColumn<WorkflowFormTO, String>>();
 +        columns.add(new PropertyColumn<WorkflowFormTO, String>(
 +                new ResourceModel("taskId"), "taskId", "taskId"));
 +        columns.add(new PropertyColumn<WorkflowFormTO, String>(
 +                new ResourceModel("key"), "key", "key"));
 +        columns.add(new PropertyColumn<WorkflowFormTO, String>(
 +                new ResourceModel("description"), "description", "description"));
 +        columns.add(new DatePropertyColumn<WorkflowFormTO>(
 +                new ResourceModel("createTime"), "createTime", "createTime"));
 +        columns.add(new DatePropertyColumn<WorkflowFormTO>(
 +                new ResourceModel("dueDate"), "dueDate", "dueDate"));
 +        columns.add(new PropertyColumn<WorkflowFormTO, String>(new ResourceModel("owner"), "owner", "owner"));
          columns.add(new AbstractColumn<WorkflowFormTO, String>(new ResourceModel("actions", "")) {
  
              private static final long serialVersionUID = 2054811145491901166L;
@@@ -158,23 -176,21 +158,23 @@@
              }
          });
  
 -        final AjaxFallbackDefaultDataTable approvalTable = new AjaxFallbackDefaultDataTable("approvalTable", columns,
 -                new ApprovalProvider(), approvalPaginatorRows);
 +        final AjaxFallbackDefaultDataTable<WorkflowFormTO, String> approvalTable =
 +                new AjaxFallbackDefaultDataTable<WorkflowFormTO, String>(
 +                        "approvalTable", columns, new ApprovalProvider(), paginatorRows);
 +        container.add(approvalTable);
  
 -        approvalContainer.add(approvalTable);
 -        approvalContainer.setOutputMarkupId(true);
 +        container.setOutputMarkupId(true);
 +        add(container);
  
 -        add(approvalContainer);
 +        @SuppressWarnings("rawtypes")
 +        Form approvalPaginatorForm = new Form("paginatorForm");
  
 -        Form approvalPaginatorForm = new Form("approvalPaginatorForm");
 +        MetaDataRoleAuthorizationStrategy.authorize(approvalPaginatorForm, RENDER,
-                 xmlRolesReader.getAllAllowedRoles("Approval", "list"));
++                xmlRolesReader.getEntitlement("Approval", "list"));
  
 -        MetaDataRoleAuthorizationStrategy.authorize(approvalPaginatorForm, RENDER, xmlRolesReader.getEntitlement(
 -                "Approval", "list"));
 -
 -        final DropDownChoice rowsChooser = new DropDownChoice("rowsChooser", new PropertyModel(this,
 -                "approvalPaginatorRows"), prefMan.getPaginatorChoices());
 +        @SuppressWarnings({ "unchecked", "rawtypes" })
 +        final DropDownChoice rowsChooser = new DropDownChoice("rowsChooser",
 +                new PropertyModel(this, "paginatorRows"), prefMan.getPaginatorChoices());
  
          rowsChooser.add(new AjaxFormComponentUpdatingBehavior(Constants.ON_CHANGE) {
  

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/UserModalPage.java
----------------------------------------------------------------------

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/Users.java
----------------------------------------------------------------------

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/VirSchemaModalPage.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/VirSchemaModalPage.java
index 5eb48fe,0000000..9ca0c42
mode 100644,000000..100644
--- a/console/src/main/java/org/apache/syncope/console/pages/VirSchemaModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/VirSchemaModalPage.java
@@@ -1,126 -1,0 +1,126 @@@
 +/*
 + * Licensed to the Apache Software Foundation (ASF) under one
 + * or more contributor license agreements.  See the NOTICE file
 + * distributed with this work for additional information
 + * regarding copyright ownership.  The ASF licenses this file
 + * to you under the Apache License, Version 2.0 (the
 + * "License"); you may not use this file except in compliance
 + * with the License.  You may obtain a copy of the License at
 + *
 + *   http://www.apache.org/licenses/LICENSE-2.0
 + *
 + * Unless required by applicable law or agreed to in writing,
 + * software distributed under the License is distributed on an
 + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 + * KIND, either express or implied.  See the License for the
 + * specific language governing permissions and limitations
 + * under the License.
 + */
 +package org.apache.syncope.console.pages;
 +
 +import org.apache.syncope.common.to.VirSchemaTO;
 +import org.apache.syncope.common.types.AttributableType;
 +import org.apache.syncope.common.SyncopeClientException;
 +import org.apache.syncope.console.commons.Constants;
 +import org.apache.syncope.console.wicket.markup.html.form.AjaxCheckBoxPanel;
 +import org.apache.syncope.console.wicket.markup.html.form.AjaxTextFieldPanel;
 +import org.apache.wicket.PageReference;
 +import org.apache.wicket.ajax.AjaxRequestTarget;
 +import org.apache.wicket.ajax.markup.html.form.AjaxButton;
 +import org.apache.wicket.authroles.authorization.strategies.role.metadata.MetaDataRoleAuthorizationStrategy;
 +import org.apache.wicket.extensions.ajax.markup.html.IndicatingAjaxButton;
 +import org.apache.wicket.extensions.ajax.markup.html.modal.ModalWindow;
 +import org.apache.wicket.markup.html.form.Form;
 +import org.apache.wicket.model.CompoundPropertyModel;
 +import org.apache.wicket.model.PropertyModel;
 +import org.apache.wicket.model.ResourceModel;
 +
 +/**
 + * Modal window with Schema form.
 + */
 +public class VirSchemaModalPage extends AbstractSchemaModalPage<VirSchemaTO> {
 +
 +    private static final long serialVersionUID = 5979623248182851337L;
 +
 +    public VirSchemaModalPage(final AttributableType kind) {
 +        super(kind);
 +    }
 +
 +    @Override
 +    public void setSchemaModalPage(final PageReference pageRef, final ModalWindow window,
 +            VirSchemaTO schema, final boolean createFlag) {
 +
 +        if (schema == null) {
 +            schema = new VirSchemaTO();
 +        }
 +
 +        final Form<VirSchemaTO> schemaForm = new Form<VirSchemaTO>(FORM);
 +
 +        schemaForm.setModel(new CompoundPropertyModel<VirSchemaTO>(schema));
 +
 +        final AjaxTextFieldPanel name = new AjaxTextFieldPanel("name", getString("name"), new PropertyModel<String>(
 +                schema, "name"));
 +        name.addRequiredLabel();
 +
 +        name.setEnabled(createFlag);
 +
 +        final AjaxCheckBoxPanel readonly = new AjaxCheckBoxPanel("readonly", getString("readonly"),
 +                new PropertyModel<Boolean>(schema, "readonly"));
 +
 +        final AjaxButton submit = new IndicatingAjaxButton(APPLY, new ResourceModel(SUBMIT)) {
 +
 +            private static final long serialVersionUID = -958724007591692537L;
 +
 +            @Override
 +            protected void onSubmit(final AjaxRequestTarget target, final Form<?> form) {
 +                VirSchemaTO schemaTO = (VirSchemaTO) form.getDefaultModelObject();
 +                try {
 +                    if (createFlag) {
 +                        schemaRestClient.createVirSchema(kind, schemaTO);
 +                    } else {
 +                        schemaRestClient.updateVirSchema(kind, schemaTO);
 +                    }
 +                    if (pageRef.getPage() instanceof BasePage) {
 +                        ((BasePage) pageRef.getPage()).setModalResult(true);
 +                    }
 +
 +                    window.close(target);
 +                } catch (SyncopeClientException e) {
 +                    error(getString(Constants.ERROR) + ": " + e.getMessage());
 +                    feedbackPanel.refresh(target);
 +                }
 +            }
 +
 +            @Override
 +            protected void onError(final AjaxRequestTarget target, final Form<?> form) {
 +                feedbackPanel.refresh(target);
 +            }
 +        };
 +
 +        final AjaxButton cancel = new IndicatingAjaxButton(CANCEL, new ResourceModel(CANCEL)) {
 +
 +            private static final long serialVersionUID = -958724007591692537L;
 +
 +            @Override
 +            protected void onSubmit(final AjaxRequestTarget target, final Form<?> form) {
 +                window.close(target);
 +            }
 +        };
 +
 +        cancel.setDefaultFormProcessing(false);
 +
 +        String allowedRoles = createFlag
-                 ? xmlRolesReader.getAllAllowedRoles("Schema", "create")
-                 : xmlRolesReader.getAllAllowedRoles("Schema", "update");
++                ? xmlRolesReader.getEntitlement("Schema", "create")
++                : xmlRolesReader.getEntitlement("Schema", "update");
 +
 +        MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, allowedRoles);
 +
 +        schemaForm.add(name);
 +        schemaForm.add(readonly);
 +
 +        schemaForm.add(submit);
 +        schemaForm.add(cancel);
 +
 +        add(schemaForm);
 +    }
 +}

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/XMLEditorPopupPage.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/XMLEditorPopupPage.java
index 6ebd083,0000000..c17351c
mode 100644,000000..100644
--- a/console/src/main/java/org/apache/syncope/console/pages/XMLEditorPopupPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/XMLEditorPopupPage.java
@@@ -1,90 -1,0 +1,90 @@@
 +/*
 + * Licensed to the Apache Software Foundation (ASF) under one
 + * or more contributor license agreements.  See the NOTICE file
 + * distributed with this work for additional information
 + * regarding copyright ownership.  The ASF licenses this file
 + * to you under the Apache License, Version 2.0 (the
 + * "License"); you may not use this file except in compliance
 + * with the License.  You may obtain a copy of the License at
 + *
 + *   http://www.apache.org/licenses/LICENSE-2.0
 + *
 + * Unless required by applicable law or agreed to in writing,
 + * software distributed under the License is distributed on an
 + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 + * KIND, either express or implied.  See the License for the
 + * specific language governing permissions and limitations
 + * under the License.
 + */
 +package org.apache.syncope.console.pages;
 +
 +import java.io.IOException;
 +import javax.ws.rs.core.MediaType;
 +import org.apache.commons.lang3.StringUtils;
 +import org.apache.syncope.common.SyncopeClientException;
 +import org.apache.syncope.console.commons.Constants;
 +import org.apache.syncope.console.rest.WorkflowRestClient;
 +import org.apache.syncope.console.wicket.ajax.markup.html.ClearIndicatingAjaxButton;
 +import org.apache.wicket.ajax.AjaxRequestTarget;
 +import org.apache.wicket.ajax.markup.html.form.AjaxButton;
 +import org.apache.wicket.authroles.authorization.strategies.role.metadata.MetaDataRoleAuthorizationStrategy;
 +import org.apache.wicket.markup.html.form.Button;
 +import org.apache.wicket.markup.html.form.Form;
 +import org.apache.wicket.markup.html.form.TextArea;
 +import org.apache.wicket.model.Model;
 +import org.apache.wicket.spring.injection.annot.SpringBean;
 +import org.apache.wicket.util.io.IOUtils;
 +
 +public class XMLEditorPopupPage extends BasePopupPage {
 +
 +    private static final long serialVersionUID = 5816041644635271734L;
 +
 +    @SpringBean
 +    private WorkflowRestClient wfRestClient;
 +
 +    public XMLEditorPopupPage() {
 +        Form wfForm = new Form("workflowDefForm");
 +
 +        String definition;
 +        try {
 +            definition = IOUtils.toString(wfRestClient.getDefinition(MediaType.APPLICATION_XML_TYPE));
 +        } catch (IOException e) {
 +            LOG.error("Could not get workflow definition", e);
 +            definition = StringUtils.EMPTY;
 +        }
 +        final TextArea<String> workflowDefArea = new TextArea<String>("workflowDefArea", new Model<String>(definition));
 +        wfForm.add(workflowDefArea);
 +
 +        AjaxButton submit =
-                  new ClearIndicatingAjaxButton(APPLY, new Model<String>(getString(SUBMIT)), getPageReference()) {
++                new ClearIndicatingAjaxButton(APPLY, new Model<String>(getString(SUBMIT)), getPageReference()) {
 +
 +                    private static final long serialVersionUID = -958724007591692537L;
 +
 +                    @Override
 +                    protected void onSubmitInternal(final AjaxRequestTarget target, final Form<?> form) {
 +                        try {
 +                            wfRestClient.updateDefinition(
 +                                    MediaType.APPLICATION_XML_TYPE, workflowDefArea.getModelObject());
 +                            info(getString(Constants.OPERATION_SUCCEEDED));
 +                        } catch (SyncopeClientException scee) {
 +                            error(getString(Constants.ERROR) + ": " + scee.getMessage());
 +                        }
 +                        feedbackPanel.refresh(target);
 +                    }
 +
 +                    @Override
 +                    protected void onError(final AjaxRequestTarget target, final Form<?> form) {
 +                        feedbackPanel.refresh(target);
 +                    }
 +                };
 +
 +        final Button close = new Button("closePage", new Model<String>(getString(CANCEL)));
 +
-         MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE,
-                 xmlRolesReader.getAllAllowedRoles("Configuration", "workflowDefUpdate"));
++        MetaDataRoleAuthorizationStrategy.authorize(
++                submit, ENABLE, xmlRolesReader.getEntitlement("Configuration", "workflowDefUpdate"));
 +        wfForm.add(submit);
 +        wfForm.add(close);
 +        this.add(wfForm);
 +    }
 +
 +}

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/panels/AbstractSyncTasksPanel.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/panels/AbstractSyncTasksPanel.java
index 7d653c0,0000000..e422305
mode 100644,000000..100644
--- a/console/src/main/java/org/apache/syncope/console/pages/panels/AbstractSyncTasksPanel.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/panels/AbstractSyncTasksPanel.java
@@@ -1,159 -1,0 +1,159 @@@
 +/*
 + * Licensed to the Apache Software Foundation (ASF) under one
 + * or more contributor license agreements.  See the NOTICE file
 + * distributed with this work for additional information
 + * regarding copyright ownership.  The ASF licenses this file
 + * to you under the Apache License, Version 2.0 (the
 + * "License"); you may not use this file except in compliance
 + * with the License.  You may obtain a copy of the License at
 + *
 + *   http://www.apache.org/licenses/LICENSE-2.0
 + *
 + * Unless required by applicable law or agreed to in writing,
 + * software distributed under the License is distributed on an
 + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 + * KIND, either express or implied.  See the License for the
 + * specific language governing permissions and limitations
 + * under the License.
 + */
 +package org.apache.syncope.console.pages.panels;
 +
 +import java.util.List;
 +import org.apache.syncope.common.to.AbstractTaskTO;
 +import org.apache.syncope.common.to.AbstractSyncTaskTO;
 +import org.apache.syncope.common.to.PushTaskTO;
 +import org.apache.syncope.common.to.SyncTaskTO;
 +import org.apache.syncope.console.commons.Constants;
 +import org.apache.syncope.console.pages.PushTaskModalPage;
 +import org.apache.syncope.console.pages.SyncTaskModalPage;
 +import org.apache.syncope.console.pages.Tasks;
 +import org.apache.syncope.console.pages.Tasks.TasksProvider;
 +import org.apache.syncope.console.wicket.ajax.markup.html.ClearIndicatingAjaxLink;
 +import org.apache.wicket.Page;
 +import org.apache.wicket.PageReference;
 +import org.apache.wicket.ajax.AjaxRequestTarget;
 +import org.apache.wicket.ajax.form.AjaxFormComponentUpdatingBehavior;
 +import org.apache.wicket.ajax.markup.html.AjaxLink;
 +import org.apache.wicket.authroles.authorization.strategies.role.metadata.MetaDataRoleAuthorizationStrategy;
 +import org.apache.wicket.event.IEvent;
 +import org.apache.wicket.extensions.ajax.markup.html.modal.ModalWindow;
 +import org.apache.wicket.extensions.markup.html.repeater.data.table.IColumn;
 +import org.apache.wicket.markup.html.WebMarkupContainer;
 +import org.apache.wicket.markup.html.form.DropDownChoice;
 +import org.apache.wicket.markup.html.form.Form;
 +import org.apache.wicket.model.PropertyModel;
 +import org.apache.wicket.request.http.WebResponse;
 +
 +public abstract class AbstractSyncTasksPanel<T extends AbstractSyncTaskTO> extends AbstractTasks {
 +
 +    private static final long serialVersionUID = -8674781241465369244L;
 +
 +    private int paginatorRows;
 +
 +    protected WebMarkupContainer container;
 +
 +    protected ModalWindow window;
 +
 +    protected AjaxDataTablePanel<AbstractTaskTO, String> table;
 +
 +    private final Class<T> reference;
 +
 +    public AbstractSyncTasksPanel(final String id, final PageReference pageRef, final Class<T> reference) {
 +        super(id, pageRef);
 +
 +        this.reference = reference;
 +
 +        container = new WebMarkupContainer("container");
 +        container.setOutputMarkupId(true);
 +        add(container);
 +
 +        window = new ModalWindow("taskWin");
 +        window.setCssClassName(ModalWindow.CSS_CLASS_GRAY);
 +        window.setInitialHeight(WIN_HEIGHT);
 +        window.setInitialWidth(WIN_WIDTH);
 +        window.setCookieName(VIEW_TASK_WIN_COOKIE_NAME);
 +        add(window);
 +
 +        ((Tasks) pageRef.getPage()).setWindowClosedCallback(window, container);
 +
 +        paginatorRows = prefMan.getPaginatorRows(getWebRequest(), Constants.PREF_SYNC_TASKS_PAGINATOR_ROWS);
 +    }
 +
 +    @Override
 +    public void onEvent(final IEvent<?> event) {
 +        if (event.getPayload() instanceof AbstractSearchResultPanel.EventDataWrapper) {
 +            ((AbstractSearchResultPanel.EventDataWrapper) event.getPayload()).getTarget().add(container);
 +        }
 +    }
 +
 +    protected void initTasksTable() {
 +
 +        table = Tasks.updateTaskTable(
 +                getColumns(),
 +                new TasksProvider<T>(restClient, paginatorRows, getId(), this.reference),
 +                container,
 +                0,
 +                this.pageRef,
 +                restClient);
 +
 +        Form paginatorForm = new Form("PaginatorForm");
 +
 +        @SuppressWarnings({ "unchecked", "rawtypes" })
 +        final DropDownChoice rowsChooser = new DropDownChoice("rowsChooser", new PropertyModel(this, "paginatorRows"),
 +                prefMan.getPaginatorChoices());
 +
 +        rowsChooser.add(new AjaxFormComponentUpdatingBehavior(Constants.ON_CHANGE) {
 +
 +            private static final long serialVersionUID = -1107858522700306810L;
 +
 +            @Override
 +            protected void onUpdate(final AjaxRequestTarget target) {
 +                prefMan.set(getWebRequest(), (WebResponse) getResponse(), Constants.PREF_SYNC_TASKS_PAGINATOR_ROWS,
 +                        String.valueOf(paginatorRows));
 +
 +                table = Tasks.updateTaskTable(
 +                        getColumns(),
 +                        new TasksProvider<T>(restClient, paginatorRows, getId(), reference),
 +                        container,
 +                        table == null ? 0 : (int) table.getCurrentPage(),
 +                        pageRef,
 +                        restClient);
 +
 +                target.add(container);
 +            }
 +        });
 +
 +        paginatorForm.add(rowsChooser);
 +        container.add(paginatorForm);
 +
 +        // create new task
 +        AjaxLink<Void> createLink = new ClearIndicatingAjaxLink<Void>("createLink", pageRef) {
 +
 +            private static final long serialVersionUID = -7978723352517770644L;
 +
 +            @Override
 +            protected void onClickInternal(final AjaxRequestTarget target) {
 +                window.setPageCreator(new ModalWindow.PageCreator() {
 +
 +                    private static final long serialVersionUID = -7834632442532690940L;
 +
 +                    @Override
 +                    public Page createPage() {
 +                        return reference.equals(SyncTaskTO.class) ? new SyncTaskModalPage(window, new SyncTaskTO(),
 +                                pageRef) : new PushTaskModalPage(window, new PushTaskTO(), pageRef);
 +                    }
 +                });
 +
 +                window.show(target);
 +            }
 +        };
 +
 +        MetaDataRoleAuthorizationStrategy.authorize(
-                 createLink, RENDER, xmlRolesReader.getAllAllowedRoles(TASKS, "create"));
++                createLink, RENDER, xmlRolesReader.getEntitlement(TASKS, "create"));
 +
 +        add(createLink);
 +
 +    }
 +
 +    protected abstract List<IColumn<AbstractTaskTO, String>> getColumns();
 +}

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/panels/PoliciesPanel.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/panels/PoliciesPanel.java
index 553e534,b6f7196..0e94209
--- a/console/src/main/java/org/apache/syncope/console/pages/panels/PoliciesPanel.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/panels/PoliciesPanel.java
@@@ -229,13 -223,11 +229,13 @@@ public class PoliciesPanel extends Pane
  
          add(createButton);
  
-         MetaDataRoleAuthorizationStrategy.authorize(createButton, ENABLE,
-                 xmlRolesReader.getAllAllowedRoles("Policies", "create"));
 -        MetaDataRoleAuthorizationStrategy.authorize(createButton, ENABLE, xmlRolesReader.getEntitlement("Policies",
 -                "create"));
++        MetaDataRoleAuthorizationStrategy.authorize(
++                createButton, ENABLE, xmlRolesReader.getEntitlement("Policies", "create"));
  
 +        @SuppressWarnings("rawtypes")
          final Form paginatorForm = new Form("PaginatorForm");
  
 +        @SuppressWarnings({ "unchecked", "rawtypes" })
          final DropDownChoice rowsChooser = new DropDownChoice("rowsChooser", new PropertyModel(this, "paginatorRows"),
                  prefMan.getPaginatorChoices());
  

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/panels/RolePanel.java
----------------------------------------------------------------------


[2/8] git commit: [SYNCOPE-599] Enhancements to console's authorization parsing

Posted by il...@apache.org.
[SYNCOPE-599] Enhancements to console's authorization parsing


Project: http://git-wip-us.apache.org/repos/asf/syncope/repo
Commit: http://git-wip-us.apache.org/repos/asf/syncope/commit/05d2985a
Tree: http://git-wip-us.apache.org/repos/asf/syncope/tree/05d2985a
Diff: http://git-wip-us.apache.org/repos/asf/syncope/diff/05d2985a

Branch: refs/heads/1_2_X
Commit: 05d2985a47cb2104a6b43d553b4707209c261f94
Parents: 79ef513
Author: Francesco Chicchiriccò <il...@apache.org>
Authored: Mon Nov 3 19:19:21 2014 +0100
Committer: Francesco Chicchiriccò <il...@apache.org>
Committed: Mon Nov 3 19:19:21 2014 +0100

----------------------------------------------------------------------
 .../syncope/console/SyncopeApplication.java     |  10 +-
 .../syncope/console/commons/XMLRolesReader.java | 104 +++++++++++--------
 .../pages/AbstractSchedTaskModalPage.java       |   4 +-
 .../console/pages/ApprovalModalPage.java        |   4 +-
 .../syncope/console/pages/Configuration.java    |  16 +--
 .../console/pages/ConfigurationModalPage.java   |   4 +-
 .../console/pages/ConnectorModalPage.java       |   4 +-
 .../console/pages/DerivedSchemaModalPage.java   |   4 +-
 .../console/pages/EditUserModalPage.java        |   2 +-
 .../console/pages/NotificationModalPage.java    |   4 +-
 .../syncope/console/pages/ReportModalPage.java  |   4 +-
 .../apache/syncope/console/pages/Reports.java   |  14 +--
 .../console/pages/ResourceModalPage.java        |   2 +-
 .../apache/syncope/console/pages/Resources.java |  13 ++-
 .../syncope/console/pages/RoleModalPage.java    |   2 +-
 .../apache/syncope/console/pages/Schema.java    |   6 +-
 .../syncope/console/pages/SchemaModalPage.java  |   4 +-
 .../syncope/console/pages/StatusModalPage.java  |   2 +-
 .../org/apache/syncope/console/pages/Todo.java  |   8 +-
 .../syncope/console/pages/UserModalPage.java    |   4 +-
 .../org/apache/syncope/console/pages/Users.java |   2 +-
 .../console/pages/VirtualSchemaModalPage.java   |   4 +-
 .../console/pages/panels/PoliciesPanel.java     |   2 +-
 .../syncope/console/pages/panels/RolePanel.java |   2 +-
 .../console/pages/panels/RoleSummaryPanel.java  |   2 +-
 .../console/pages/panels/RoleTabPanel.java      |   8 +-
 .../console/pages/panels/SchedTasks.java        |   2 +-
 .../syncope/console/pages/panels/SyncTasks.java |   2 +-
 .../markup/html/form/ActionLinksPanel.java      |   4 +-
 .../wicket/markup/html/tree/TreeRolePanel.java  |   2 +-
 .../src/main/resources/applicationContext.xml   |   8 +-
 31 files changed, 133 insertions(+), 120 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/SyncopeApplication.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/SyncopeApplication.java b/console/src/main/java/org/apache/syncope/console/SyncopeApplication.java
index 9803650..0fbe521 100644
--- a/console/src/main/java/org/apache/syncope/console/SyncopeApplication.java
+++ b/console/src/main/java/org/apache/syncope/console/SyncopeApplication.java
@@ -120,7 +120,7 @@ public class SyncopeApplication
                 : "") + "schema" + Constants.PNG_EXT)));
 
         BookmarkablePageLink<Void> usersLink = new BookmarkablePageLink<Void>("users", Users.class);
-        String allowedUsersRoles = xmlRolesReader.getAllAllowedRoles("Users", "list");
+        String allowedUsersRoles = xmlRolesReader.getEntitlement("Users", "list");
         MetaDataRoleAuthorizationStrategy.authorize(usersLink, WebPage.ENABLE, allowedUsersRoles);
         page.add(usersLink);
         usersLink.add(new Image("usersIcon", new ContextRelativeResource(IMG_PREFIX + (notsel
@@ -142,7 +142,7 @@ public class SyncopeApplication
                 : "") + "resources" + Constants.PNG_EXT)));
 
         BookmarkablePageLink<Void> todoLink = new BookmarkablePageLink<Void>("todo", Todo.class);
-        MetaDataRoleAuthorizationStrategy.authorize(todoLink, WebPage.ENABLE, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(todoLink, WebPage.ENABLE, xmlRolesReader.getEntitlement(
                 "Approval", "list"));
         page.add(todoLink);
         todoLink.add(new Image("todoIcon", new ContextRelativeResource(IMG_PREFIX + (notsel
@@ -150,7 +150,7 @@ public class SyncopeApplication
                 : "") + "todo" + Constants.PNG_EXT)));
 
         BookmarkablePageLink<Void> reportLink = new BookmarkablePageLink<Void>("reports", Reports.class);
-        String allowedReportRoles = xmlRolesReader.getAllAllowedRoles("Reports", "list");
+        String allowedReportRoles = xmlRolesReader.getEntitlement("Reports", "list");
         MetaDataRoleAuthorizationStrategy.authorize(reportLink, WebPage.ENABLE, allowedReportRoles);
         page.add(reportLink);
         reportLink.add(new Image("reportsIcon", new ContextRelativeResource(IMG_PREFIX + (notsel
@@ -159,7 +159,7 @@ public class SyncopeApplication
 
         BookmarkablePageLink<Void> configurationLink = new BookmarkablePageLink<Void>("configuration",
                 Configuration.class);
-        String allowedConfigurationRoles = xmlRolesReader.getAllAllowedRoles("Configuration", "list");
+        String allowedConfigurationRoles = xmlRolesReader.getEntitlement("Configuration", "list");
         MetaDataRoleAuthorizationStrategy.authorize(configurationLink, WebPage.ENABLE, allowedConfigurationRoles);
         page.add(configurationLink);
         configurationLink.add(new Image("configurationIcon", new ContextRelativeResource(IMG_PREFIX + (notsel
@@ -167,7 +167,7 @@ public class SyncopeApplication
                 : "") + "configuration" + Constants.PNG_EXT)));
 
         BookmarkablePageLink<Void> taskLink = new BookmarkablePageLink<Void>("tasks", Tasks.class);
-        String allowedTasksRoles = xmlRolesReader.getAllAllowedRoles("Tasks", "list");
+        String allowedTasksRoles = xmlRolesReader.getEntitlement("Tasks", "list");
         MetaDataRoleAuthorizationStrategy.authorize(taskLink, WebPage.ENABLE, allowedTasksRoles);
         page.add(taskLink);
         taskLink.add(new Image("tasksIcon", new ContextRelativeResource(IMG_PREFIX + (notsel

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/commons/XMLRolesReader.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/commons/XMLRolesReader.java b/console/src/main/java/org/apache/syncope/console/commons/XMLRolesReader.java
index c031975..69cf4ec 100644
--- a/console/src/main/java/org/apache/syncope/console/commons/XMLRolesReader.java
+++ b/console/src/main/java/org/apache/syncope/console/commons/XMLRolesReader.java
@@ -18,17 +18,17 @@
  */
 package org.apache.syncope.console.commons;
 
+import java.util.HashMap;
+import java.util.Map;
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
-import javax.xml.xpath.XPath;
-import javax.xml.xpath.XPathConstants;
-import javax.xml.xpath.XPathExpression;
-import javax.xml.xpath.XPathExpressionException;
-import javax.xml.xpath.XPathFactory;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.commons.lang3.tuple.ImmutablePair;
+import org.apache.commons.lang3.tuple.Pair;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
-import org.springframework.beans.factory.annotation.Autowired;
 import org.w3c.dom.Document;
+import org.w3c.dom.Node;
 import org.w3c.dom.NodeList;
 
 /**
@@ -41,62 +41,78 @@ public class XMLRolesReader {
      */
     private static final Logger LOG = LoggerFactory.getLogger(XMLRolesReader.class);
 
-    @Autowired
     private String authorizations;
 
-    private Document doc;
+    private Map<Pair<String, String>, String> authMap;
+
+    public void setAuthorizations(final String authorizations) {
+        this.authorizations = authorizations;
+    }
+
+    private void init() {
+        authMap = new HashMap<Pair<String, String>, String>();
 
-    public void init() {
         DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
         dbf.setNamespaceAware(true);
         try {
             DocumentBuilder db = dbf.newDocumentBuilder();
-            doc = db.parse(getClass().getResource("/" + authorizations).openStream());
+            Document doc = db.parse(getClass().getResource("/" + authorizations).openStream());
             doc.getDocumentElement().normalize();
+
+            Node authNode = null;
+            NodeList root = doc.getChildNodes();
+            for (int i = 0; i < root.getLength() && authNode == null; i++) {
+                if ("auth".equals(root.item(i).getNodeName())) {
+                    authNode = root.item(i);
+                }
+            }
+            if (authNode == null) {
+                throw new IllegalArgumentException("Could not find root <auth> node");
+            }
+
+            NodeList pages = authNode.getChildNodes();
+            for (int i = 0; i < pages.getLength(); i++) {
+                if ("page".equals(pages.item(i).getNodeName())) {
+                    String page = pages.item(i).getAttributes().getNamedItem("id").getTextContent();
+
+                    NodeList actions = pages.item(i).getChildNodes();
+                    for (int j = 0; j < actions.getLength(); j++) {
+                        if ("action".equals(actions.item(j).getNodeName())) {
+                            String action = actions.item(j).getAttributes().getNamedItem("id").getTextContent();
+
+                            NodeList entitlements = actions.item(j).getChildNodes();
+                            for (int k = 0; k < entitlements.getLength(); k++) {
+                                if ("entitlement".equals(entitlements.item(k).getNodeName())) {
+                                    String entitlement = entitlements.item(k).getTextContent();
+                                    authMap.put(new ImmutablePair<String, String>(page, action), entitlement);
+                                }
+                            }
+                        }
+                    }
+                }
+            }
         } catch (Exception e) {
             LOG.error("While initializing parsing of {}", authorizations, e);
-            doc = null;
         }
     }
 
     /**
-     * Get all roles allowed for specific page and action requested.
+     * Get entitlement required for page / action.
      *
-     * @param pageId
-     * @param actionId
-     * @return roles list comma separated
+     * @param pageId page
+     * @param actionId action
+     * @return entitlement required
      */
-    public String getAllAllowedRoles(final String pageId, final String actionId) {
-
-        if (doc == null) {
-            init();
-        }
-        if (doc == null) {
-            return "";
-        }
-
-        final StringBuilder roles = new StringBuilder();
-        try {
-            XPathFactory factory = XPathFactory.newInstance();
-            XPath xpath = factory.newXPath();
-            XPathExpression expr = xpath.compile("//page[@id='" + pageId + "']/" + "action[@id='" + actionId + "']/"
-                    + "entitlement/text()");
-            Object result = expr.evaluate(doc, XPathConstants.NODESET);
-
-            NodeList nodes = (NodeList) result;
-
-            for (int i = 0; i < nodes.getLength(); i++) {
-                if (i > 0) {
-                    roles.append(",");
-                }
-                roles.append(nodes.item(i).getNodeValue());
+    public String getEntitlement(final String pageId, final String actionId) {
+        synchronized (this) {
+            if (authMap == null) {
+                init();
             }
-        } catch (XPathExpressionException e) {
-            LOG.error("While parsing authorizations file", e);
         }
 
-        LOG.debug("Authorizations found: {}", roles);
-
-        return roles.toString();
+        Pair<String, String> key = new ImmutablePair<String, String>(pageId, actionId);
+        return authMap.containsKey(key)
+                ? authMap.get(key)
+                : StringUtils.EMPTY;
     }
 }

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/AbstractSchedTaskModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/AbstractSchedTaskModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/AbstractSchedTaskModalPage.java
index 4d899e3..8bd02b9 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/AbstractSchedTaskModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/AbstractSchedTaskModalPage.java
@@ -129,10 +129,10 @@ public abstract class AbstractSchedTaskModalPage extends TaskModalPage {
         cancel.setDefaultFormProcessing(false);
 
         if (taskTO.getId() > 0) {
-            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER, xmlRolesReader.getAllAllowedRoles(TASKS,
+            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER, xmlRolesReader.getEntitlement(TASKS,
                     "update"));
         } else {
-            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER, xmlRolesReader.getAllAllowedRoles(TASKS,
+            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER, xmlRolesReader.getEntitlement(TASKS,
                     "create"));
         }
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/ApprovalModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/ApprovalModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/ApprovalModalPage.java
index 8c69ca9..fae7b42 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/ApprovalModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/ApprovalModalPage.java
@@ -188,7 +188,7 @@ public class ApprovalModalPage extends BaseModalPage {
                     }
                 };
         MetaDataRoleAuthorizationStrategy.authorize(userDetails, ENABLE,
-                xmlRolesReader.getAllAllowedRoles("Users", "read"));
+                xmlRolesReader.getEntitlement("Users", "read"));
 
         final AjaxButton submit = new IndicatingAjaxButton(APPLY, new Model<String>(getString(SUBMIT))) {
 
@@ -267,7 +267,7 @@ public class ApprovalModalPage extends BaseModalPage {
         form.add(submit);
         form.add(cancel);
 
-        MetaDataRoleAuthorizationStrategy.authorize(form, ENABLE, xmlRolesReader.getAllAllowedRoles("Approval",
+        MetaDataRoleAuthorizationStrategy.authorize(form, ENABLE, xmlRolesReader.getEntitlement("Approval",
                 SUBMIT));
 
         editUserWin = new ModalWindow("editUserWin");

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/Configuration.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/Configuration.java b/console/src/main/java/org/apache/syncope/console/pages/Configuration.java
index 403c948..9e4c0fc 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/Configuration.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/Configuration.java
@@ -178,13 +178,13 @@ public class Configuration extends BasePage {
             }
         };
 
-        MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, xmlRolesReader.getAllAllowedRoles("Configuration",
+        MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, xmlRolesReader.getEntitlement("Configuration",
                 "workflowDefUpdate"));
         wfForm.add(submit);
 
         workflowDefContainer.add(wfForm);
 
-        MetaDataRoleAuthorizationStrategy.authorize(workflowDefContainer, ENABLE, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(workflowDefContainer, ENABLE, xmlRolesReader.getEntitlement(
                 "Configuration", "workflowDefRead"));
         add(workflowDefContainer);
 
@@ -195,7 +195,7 @@ public class Configuration extends BasePage {
         coreLoggerContainer.add(coreLoggerList);
         coreLoggerContainer.setOutputMarkupId(true);
 
-        MetaDataRoleAuthorizationStrategy.authorize(coreLoggerContainer, ENABLE, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(coreLoggerContainer, ENABLE, xmlRolesReader.getEntitlement(
                 "Configuration", "logList"));
         add(coreLoggerContainer);
 
@@ -206,7 +206,7 @@ public class Configuration extends BasePage {
         consoleLoggerContainer.add(consoleLoggerList);
         consoleLoggerContainer.setOutputMarkupId(true);
 
-        MetaDataRoleAuthorizationStrategy.authorize(consoleLoggerContainer, ENABLE, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(consoleLoggerContainer, ENABLE, xmlRolesReader.getEntitlement(
                 "Configuration", "logList"));
         add(consoleLoggerContainer);
     }
@@ -327,7 +327,7 @@ public class Configuration extends BasePage {
             }
         };
 
-        MetaDataRoleAuthorizationStrategy.authorize(createConfigurationLink, ENABLE, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(createConfigurationLink, ENABLE, xmlRolesReader.getEntitlement(
                 "Configuration", "create"));
         add(createConfigurationLink);
 
@@ -351,7 +351,7 @@ public class Configuration extends BasePage {
             }
         };
 
-        MetaDataRoleAuthorizationStrategy.authorize(dbExportLink, ENABLE, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(dbExportLink, ENABLE, xmlRolesReader.getEntitlement(
                 "Configuration", "read"));
         add(dbExportLink);
 
@@ -502,7 +502,7 @@ public class Configuration extends BasePage {
             }
         };
 
-        MetaDataRoleAuthorizationStrategy.authorize(createNotificationLink, ENABLE, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(createNotificationLink, ENABLE, xmlRolesReader.getEntitlement(
                 "Notification", "create"));
         add(createNotificationLink);
 
@@ -673,7 +673,7 @@ public class Configuration extends BasePage {
                 }
             });
 
-            MetaDataRoleAuthorizationStrategy.authorize(level, ENABLE, xmlRolesReader.getAllAllowedRoles(
+            MetaDataRoleAuthorizationStrategy.authorize(level, ENABLE, xmlRolesReader.getEntitlement(
                     "Configuration", "logSetLevel"));
 
             item.add(level);

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/ConfigurationModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/ConfigurationModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/ConfigurationModalPage.java
index 5af5b16..d61fa38 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/ConfigurationModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/ConfigurationModalPage.java
@@ -121,8 +121,8 @@ public class ConfigurationModalPage extends BaseModalPage {
         form.add(cancel);
 
         String allowedRoles = createFlag
-                ? xmlRolesReader.getAllAllowedRoles("Configuration", "create")
-                : xmlRolesReader.getAllAllowedRoles("Configuration", "update");
+                ? xmlRolesReader.getEntitlement("Configuration", "create")
+                : xmlRolesReader.getEntitlement("Configuration", "update");
 
         MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, allowedRoles);
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/ConnectorModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/ConnectorModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/ConnectorModalPage.java
index ae28729..94027e1 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/ConnectorModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/ConnectorModalPage.java
@@ -437,8 +437,8 @@ public class ConnectorModalPage extends BaseModalPage {
             }
         };
         String roles = connInstanceTO.getId() == 0
-                ? xmlRolesReader.getAllAllowedRoles("Connectors", "create")
-                : xmlRolesReader.getAllAllowedRoles("Connectors", "update");
+                ? xmlRolesReader.getEntitlement("Connectors", "create")
+                : xmlRolesReader.getEntitlement("Connectors", "update");
         MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, roles);
         connectorForm.add(submit);
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/DerivedSchemaModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/DerivedSchemaModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/DerivedSchemaModalPage.java
index 5c51154..edda895 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/DerivedSchemaModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/DerivedSchemaModalPage.java
@@ -125,8 +125,8 @@ public class DerivedSchemaModalPage extends AbstractSchemaModalPage {
                 false);
 
         String allowedRoles = createFlag
-                ? xmlRolesReader.getAllAllowedRoles("Schema", "create")
-                : xmlRolesReader.getAllAllowedRoles("Schema", "update");
+                ? xmlRolesReader.getEntitlement("Schema", "create")
+                : xmlRolesReader.getEntitlement("Schema", "update");
 
         MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, allowedRoles);
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/EditUserModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/EditUserModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/EditUserModalPage.java
index a3a6d45..9132dda 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/EditUserModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/EditUserModalPage.java
@@ -63,7 +63,7 @@ public class EditUserModalPage extends UserModalPage {
             statusPanel = new StatusPanel("statuspanel", userTO, new ArrayList<StatusBean>(), getPageReference());
             statusPanel.setOutputMarkupId(true);
             MetaDataRoleAuthorizationStrategy.authorize(
-                    statusPanel, RENDER, xmlRolesReader.getAllAllowedRoles("Resources", "getConnectorObject"));
+                    statusPanel, RENDER, xmlRolesReader.getEntitlement("Resources", "getConnectorObject"));
             form.addOrReplace(statusPanel);
 
             form.addOrReplace(new AccountInformationPanel("accountinformation", userTO));

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/NotificationModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/NotificationModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/NotificationModalPage.java
index 09d0136..dc043b8 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/NotificationModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/NotificationModalPage.java
@@ -270,8 +270,8 @@ class NotificationModalPage extends BaseModalPage {
         cancel.setDefaultFormProcessing(false);
 
         String allowedRoles = createFlag
-                ? xmlRolesReader.getAllAllowedRoles("Notification", "create")
-                : xmlRolesReader.getAllAllowedRoles("Notification", "update");
+                ? xmlRolesReader.getEntitlement("Notification", "create")
+                : xmlRolesReader.getEntitlement("Notification", "update");
         MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, allowedRoles);
 
         form.add(submit);

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/ReportModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/ReportModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/ReportModalPage.java
index 548de35..d76400b 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/ReportModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/ReportModalPage.java
@@ -161,10 +161,10 @@ public class ReportModalPage extends BaseModalPage {
                 };
 
         if (reportTO.getId() > 0) {
-            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER, xmlRolesReader.getAllAllowedRoles("Reports",
+            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER, xmlRolesReader.getEntitlement("Reports",
                     "update"));
         } else {
-            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER, xmlRolesReader.getAllAllowedRoles("Reports",
+            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER, xmlRolesReader.getEntitlement("Reports",
                     "create"));
         }
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/Reports.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/Reports.java b/console/src/main/java/org/apache/syncope/console/pages/Reports.java
index f0e0647..789e37e 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/Reports.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/Reports.java
@@ -110,7 +110,7 @@ public class Reports extends BasePage {
         reportContainer = new WebMarkupContainer("reportContainer");
         setWindowClosedCallback(window, reportContainer);
 
-        MetaDataRoleAuthorizationStrategy.authorize(reportContainer, RENDER, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(reportContainer, RENDER, xmlRolesReader.getEntitlement(
                 "Reports", "list"));
 
         paginatorRows = prefMan.getPaginatorRows(getRequest(), Constants.PREF_REPORT_PAGINATOR_ROWS);
@@ -223,7 +223,7 @@ public class Reports extends BasePage {
 
         Form paginatorForm = new Form("paginatorForm");
 
-        MetaDataRoleAuthorizationStrategy.authorize(paginatorForm, RENDER, xmlRolesReader.getAllAllowedRoles("Reports",
+        MetaDataRoleAuthorizationStrategy.authorize(paginatorForm, RENDER, xmlRolesReader.getEntitlement("Reports",
                 "list"));
 
         final DropDownChoice rowsChooser = new DropDownChoice("rowsChooser", new PropertyModel(this, "paginatorRows"),
@@ -266,7 +266,7 @@ public class Reports extends BasePage {
             }
         };
 
-        MetaDataRoleAuthorizationStrategy.authorize(createLink, RENDER, xmlRolesReader.getAllAllowedRoles("Reports",
+        MetaDataRoleAuthorizationStrategy.authorize(createLink, RENDER, xmlRolesReader.getEntitlement("Reports",
                 "create"));
 
         add(createLink);
@@ -279,7 +279,7 @@ public class Reports extends BasePage {
         add(auditContainer);
 
         MetaDataRoleAuthorizationStrategy.authorize(
-                auditContainer, RENDER, xmlRolesReader.getAllAllowedRoles("Audit", "list"));
+                auditContainer, RENDER, xmlRolesReader.getEntitlement("Audit", "list"));
 
         final Form form = new Form("auditForm");
         auditContainer.add(form);
@@ -306,15 +306,15 @@ public class Reports extends BasePage {
                     @Override
                     protected String[] getListRoles() {
                         return new String[] {
-                            xmlRolesReader.getAllAllowedRoles("Audit", "list")
+                            xmlRolesReader.getEntitlement("Audit", "list")
                         };
                     }
 
                     @Override
                     protected String[] getChangeRoles() {
                         return new String[] {
-                            xmlRolesReader.getAllAllowedRoles("Audit", "enable"),
-                            xmlRolesReader.getAllAllowedRoles("Audit", "disable")
+                            xmlRolesReader.getEntitlement("Audit", "enable"),
+                            xmlRolesReader.getEntitlement("Audit", "disable")
                         };
                     }
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/ResourceModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/ResourceModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/ResourceModalPage.java
index 51e1da3..ea58648 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/ResourceModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/ResourceModalPage.java
@@ -173,7 +173,7 @@ public class ResourceModalPage extends BaseModalPage {
 
         add(form);
 
-        MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, xmlRolesReader.getAllAllowedRoles("Resources",
+        MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, xmlRolesReader.getEntitlement("Resources",
                 createFlag
                 ? "create"
                 : "update"));

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/Resources.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/Resources.java b/console/src/main/java/org/apache/syncope/console/pages/Resources.java
index 7d11d0b..89aa1ba 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/Resources.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/Resources.java
@@ -139,7 +139,7 @@ public class Resources extends BasePage {
                 attributes.getAjaxCallListeners().add(ajaxCallListener);
             }
         };
-        MetaDataRoleAuthorizationStrategy.authorize(reloadLink, ENABLE, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(reloadLink, ENABLE, xmlRolesReader.getEntitlement(
                 "Connectors", "reload"));
         add(reloadLink);
 
@@ -195,8 +195,7 @@ public class Resources extends BasePage {
 
                         cellItem.add(editConnPanel);
 
-                        MetaDataRoleAuthorizationStrategy.authorize(editConnPanel, ENABLE, xmlRolesReader.
-                                getAllAllowedRoles(
+                        MetaDataRoleAuthorizationStrategy.authorize(editConnPanel, ENABLE, xmlRolesReader.getEntitlement(
                                         "Connectors", "read"));
                     }
                 });
@@ -341,7 +340,7 @@ public class Resources extends BasePage {
                     }
                 };
 
-        MetaDataRoleAuthorizationStrategy.authorize(createResourceLink, ENABLE, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(createResourceLink, ENABLE, xmlRolesReader.getEntitlement(
                 "Resources", "create"));
 
         add(createResourceLink);
@@ -459,7 +458,7 @@ public class Resources extends BasePage {
         connectorContainer.add(table);
         connectorContainer.setOutputMarkupId(true);
 
-        MetaDataRoleAuthorizationStrategy.authorize(connectorContainer, RENDER, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(connectorContainer, RENDER, xmlRolesReader.getEntitlement(
                 "Connectors", "list"));
 
         add(connectorContainer);
@@ -499,14 +498,14 @@ public class Resources extends BasePage {
             }
         };
 
-        MetaDataRoleAuthorizationStrategy.authorize(createConnectorLink, ENABLE, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(createConnectorLink, ENABLE, xmlRolesReader.getEntitlement(
                 "Connectors", "create"));
 
         add(createConnectorLink);
 
         Form paginatorForm = new Form("connectorPaginatorForm");
 
-        MetaDataRoleAuthorizationStrategy.authorize(paginatorForm, RENDER, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(paginatorForm, RENDER, xmlRolesReader.getEntitlement(
                 "Connectors", "list"));
 
         final DropDownChoice rowsChooser = new DropDownChoice("rowsChooser", new PropertyModel(this,

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/RoleModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/RoleModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/RoleModalPage.java
index cf16c8c..2495421 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/RoleModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/RoleModalPage.java
@@ -136,7 +136,7 @@ public class RoleModalPage extends BaseModalPage {
 
         cancel.setDefaultFormProcessing(false);
 
-        MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, xmlRolesReader.getAllAllowedRoles("Roles",
+        MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, xmlRolesReader.getEntitlement("Roles",
                 createFlag
                 ? "create"
                 : "update"));

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/Schema.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/Schema.java b/console/src/main/java/org/apache/syncope/console/pages/Schema.java
index 88c3ace..d66d6e2 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/Schema.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/Schema.java
@@ -136,11 +136,11 @@ public class Schema extends BasePage {
     @SpringBean
     private PreferenceManager prefMan;
 
-    private final String allowedCreateRoles = xmlRolesReader.getAllAllowedRoles("Schema", "create");
+    private final String allowedCreateRoles = xmlRolesReader.getEntitlement("Schema", "create");
 
-    private final String allowedReadRoles = xmlRolesReader.getAllAllowedRoles("Schema", "read");
+    private final String allowedReadRoles = xmlRolesReader.getEntitlement("Schema", "read");
 
-    private final String allowedDeleteRoles = xmlRolesReader.getAllAllowedRoles("Schema", "delete");
+    private final String allowedDeleteRoles = xmlRolesReader.getEntitlement("Schema", "delete");
 
     public Schema() {
         super();

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/SchemaModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/SchemaModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/SchemaModalPage.java
index 05bd8c1..aedba1d 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/SchemaModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/SchemaModalPage.java
@@ -276,8 +276,8 @@ public class SchemaModalPage extends AbstractSchemaModalPage {
         cancel.setDefaultFormProcessing(false);
 
         String allowedRoles = createFlag
-                ? xmlRolesReader.getAllAllowedRoles("Schema", "create")
-                : xmlRolesReader.getAllAllowedRoles("Schema", "update");
+                ? xmlRolesReader.getEntitlement("Schema", "create")
+                : xmlRolesReader.getEntitlement("Schema", "update");
 
         MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, allowedRoles);
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/StatusModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/StatusModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/StatusModalPage.java
index 6040f70..c2fcf5c 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/StatusModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/StatusModalPage.java
@@ -50,7 +50,7 @@ public class StatusModalPage extends BaseModalPage {
 
         final StatusPanel statusPanel = new StatusPanel("statuspanel", attributable, statuses, null);
         MetaDataRoleAuthorizationStrategy.authorize(
-                statusPanel, RENDER, xmlRolesReader.getAllAllowedRoles("Resources", "getConnectorObject"));
+                statusPanel, RENDER, xmlRolesReader.getEntitlement("Resources", "getConnectorObject"));
         form.add(statusPanel);
 
         final AjaxButton disable;

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/Todo.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/Todo.java b/console/src/main/java/org/apache/syncope/console/pages/Todo.java
index bb0ddbd..06dd6f0 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/Todo.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/Todo.java
@@ -105,7 +105,7 @@ public class Todo extends BasePage {
     private void setupApproval() {
         approvalContainer = new WebMarkupContainer("approvalContainer");
 
-        MetaDataRoleAuthorizationStrategy.authorize(approvalContainer, RENDER, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(approvalContainer, RENDER, xmlRolesReader.getEntitlement(
                 "Approval", "list"));
 
         approvalPaginatorRows = prefMan.getPaginatorRows(getRequest(), Constants.PREF_APPROVAL_PAGINATOR_ROWS);
@@ -186,7 +186,7 @@ public class Todo extends BasePage {
 
         Form approvalPaginatorForm = new Form("approvalPaginatorForm");
 
-        MetaDataRoleAuthorizationStrategy.authorize(approvalPaginatorForm, RENDER, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(approvalPaginatorForm, RENDER, xmlRolesReader.getEntitlement(
                 "Approval", "list"));
 
         final DropDownChoice rowsChooser = new DropDownChoice("rowsChooser", new PropertyModel(this,
@@ -220,7 +220,7 @@ public class Todo extends BasePage {
     private void setupUserRequest() {
         userRequestContainer = new WebMarkupContainer("userRequestContainer");
 
-        MetaDataRoleAuthorizationStrategy.authorize(userRequestContainer, RENDER, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(userRequestContainer, RENDER, xmlRolesReader.getEntitlement(
                 "UserRequest", "list"));
 
         userRequestPaginatorRows = prefMan.getPaginatorRows(getRequest(), Constants.PREF_USER_REQUEST_PAGINATOR_ROWS);
@@ -326,7 +326,7 @@ public class Todo extends BasePage {
 
         Form userRequestPaginatorForm = new Form("userRequestPaginatorForm");
 
-        MetaDataRoleAuthorizationStrategy.authorize(userRequestPaginatorForm, RENDER, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(userRequestPaginatorForm, RENDER, xmlRolesReader.getEntitlement(
                 "UserRequest", "list"));
 
         final DropDownChoice rowsChooser = new DropDownChoice("rowsChooser", new PropertyModel(this,

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/UserModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/UserModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/UserModalPage.java
index 2ecaa45..4087266 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/UserModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/UserModalPage.java
@@ -149,8 +149,8 @@ public abstract class UserModalPage extends BaseModalPage {
 
         if (mode == Mode.ADMIN) {
             String allowedRoles = userTO.getId() == 0
-                    ? xmlRolesReader.getAllAllowedRoles("Users", "create")
-                    : xmlRolesReader.getAllAllowedRoles("Users", "update");
+                    ? xmlRolesReader.getEntitlement("Users", "create")
+                    : xmlRolesReader.getEntitlement("Users", "update");
             MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER, allowedRoles);
         }
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/Users.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/Users.java b/console/src/main/java/org/apache/syncope/console/pages/Users.java
index 43af342..4a208de 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/Users.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/Users.java
@@ -92,7 +92,7 @@ public class Users extends BasePage {
             }
         };
         MetaDataRoleAuthorizationStrategy.authorize(
-                createLink, ENABLE, xmlRolesReader.getAllAllowedRoles("Users", "create"));
+                createLink, ENABLE, xmlRolesReader.getEntitlement("Users", "create"));
         add(createLink);
 
         setWindowClosedReloadCallback(editModalWin);

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/VirtualSchemaModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/VirtualSchemaModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/VirtualSchemaModalPage.java
index 63b3a10..a4ab941 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/VirtualSchemaModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/VirtualSchemaModalPage.java
@@ -111,8 +111,8 @@ public class VirtualSchemaModalPage extends AbstractSchemaModalPage {
         cancel.setDefaultFormProcessing(false);
 
         String allowedRoles = createFlag
-                ? xmlRolesReader.getAllAllowedRoles("Schema", "create")
-                : xmlRolesReader.getAllAllowedRoles("Schema", "update");
+                ? xmlRolesReader.getEntitlement("Schema", "create")
+                : xmlRolesReader.getEntitlement("Schema", "update");
 
         MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, allowedRoles);
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/panels/PoliciesPanel.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/panels/PoliciesPanel.java b/console/src/main/java/org/apache/syncope/console/pages/panels/PoliciesPanel.java
index ffacdbc..b6f7196 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/panels/PoliciesPanel.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/panels/PoliciesPanel.java
@@ -223,7 +223,7 @@ public class PoliciesPanel extends Panel {
 
         add(createButton);
 
-        MetaDataRoleAuthorizationStrategy.authorize(createButton, ENABLE, xmlRolesReader.getAllAllowedRoles("Policies",
+        MetaDataRoleAuthorizationStrategy.authorize(createButton, ENABLE, xmlRolesReader.getEntitlement("Policies",
                 "create"));
 
         final Form paginatorForm = new Form("PaginatorForm");

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/panels/RolePanel.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/panels/RolePanel.java b/console/src/main/java/org/apache/syncope/console/pages/panels/RolePanel.java
index a3596ea..0b2d623 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/panels/RolePanel.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/panels/RolePanel.java
@@ -107,7 +107,7 @@ public class RolePanel extends Panel {
                     "statuspanel", builder.roleTO, new ArrayList<StatusBean>(), builder.pageReference);
             statusPanel.setOutputMarkupId(true);
             MetaDataRoleAuthorizationStrategy.authorize(
-                    statusPanel, RENDER, xmlRolesReader.getAllAllowedRoles("Resources", "getConnectorObject"));
+                    statusPanel, RENDER, xmlRolesReader.getEntitlement("Resources", "getConnectorObject"));
             this.add(statusPanel);
         }
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/panels/RoleSummaryPanel.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/panels/RoleSummaryPanel.java b/console/src/main/java/org/apache/syncope/console/pages/panels/RoleSummaryPanel.java
index a482224..f468586 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/panels/RoleSummaryPanel.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/panels/RoleSummaryPanel.java
@@ -138,7 +138,7 @@ public class RoleSummaryPanel extends Panel {
 
                         builder.window.show(target);
                     }
-                }, ActionLink.ActionType.CREATE, xmlRolesReader.getAllAllowedRoles("Roles", "create"));
+                }, ActionLink.ActionType.CREATE, xmlRolesReader.getEntitlement("Roles", "create"));
             } else {
                 RoleTabPanel roleTabPanel =
                         new RoleTabPanel("nodeViewPanel", selectedNode, builder.window, builder.callerPageRef);

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/panels/RoleTabPanel.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/panels/RoleTabPanel.java b/console/src/main/java/org/apache/syncope/console/pages/panels/RoleTabPanel.java
index 6eab419..9debde4 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/panels/RoleTabPanel.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/panels/RoleTabPanel.java
@@ -91,7 +91,7 @@ public class RoleTabPanel extends Panel {
 
                 window.show(target);
             }
-        }, ActionLink.ActionType.CREATE, xmlRolesReader.getAllAllowedRoles("Roles", "create"));
+        }, ActionLink.ActionType.CREATE, xmlRolesReader.getEntitlement("Roles", "create"));
         links.addWithRoles(new ActionLink() {
 
             private static final long serialVersionUID = -3722207913631435501L;
@@ -110,7 +110,7 @@ public class RoleTabPanel extends Panel {
 
                 window.show(target);
             }
-        }, ActionLink.ActionType.SEARCH, xmlRolesReader.getAllAllowedRoles("Roles", "update"));
+        }, ActionLink.ActionType.SEARCH, xmlRolesReader.getEntitlement("Roles", "update"));
         links.addWithRoles(new ActionLink() {
 
             private static final long serialVersionUID = -3722207913631435501L;
@@ -131,7 +131,7 @@ public class RoleTabPanel extends Panel {
 
                 window.show(target);
             }
-        }, ActionLink.ActionType.EDIT, xmlRolesReader.getAllAllowedRoles("Roles", "update"));
+        }, ActionLink.ActionType.EDIT, xmlRolesReader.getEntitlement("Roles", "update"));
         links.addWithRoles(new ActionLink() {
 
             private static final long serialVersionUID = -3722207913631435501L;
@@ -159,7 +159,7 @@ public class RoleTabPanel extends Panel {
                     target.add(((Roles) pageRef.getPage()).getFeedbackPanel());
                 }
             }
-        }, ActionLink.ActionType.DELETE, xmlRolesReader.getAllAllowedRoles("Roles", "delete"));
+        }, ActionLink.ActionType.DELETE, xmlRolesReader.getEntitlement("Roles", "delete"));
 
         final Form form = new Form("roleForm");
         form.setModel(new CompoundPropertyModel(selectedNode));

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/panels/SchedTasks.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/panels/SchedTasks.java b/console/src/main/java/org/apache/syncope/console/pages/panels/SchedTasks.java
index 0911bcc..07aa090 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/panels/SchedTasks.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/panels/SchedTasks.java
@@ -142,7 +142,7 @@ public class SchedTasks extends AbstractTasks {
         };
 
         MetaDataRoleAuthorizationStrategy.authorize(
-                createLink, RENDER, xmlRolesReader.getAllAllowedRoles(TASKS, "create"));
+                createLink, RENDER, xmlRolesReader.getEntitlement(TASKS, "create"));
 
         add(createLink);
     }

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/panels/SyncTasks.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/panels/SyncTasks.java b/console/src/main/java/org/apache/syncope/console/pages/panels/SyncTasks.java
index 17609fc..46b8fc9 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/panels/SyncTasks.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/panels/SyncTasks.java
@@ -145,7 +145,7 @@ public class SyncTasks extends AbstractTasks {
         };
 
         MetaDataRoleAuthorizationStrategy.authorize(
-                createLink, RENDER, xmlRolesReader.getAllAllowedRoles(TASKS, "create"));
+                createLink, RENDER, xmlRolesReader.getEntitlement(TASKS, "create"));
 
         add(createLink);
     }

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/wicket/markup/html/form/ActionLinksPanel.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/wicket/markup/html/form/ActionLinksPanel.java b/console/src/main/java/org/apache/syncope/console/wicket/markup/html/form/ActionLinksPanel.java
index a4f9610..e854de1 100644
--- a/console/src/main/java/org/apache/syncope/console/wicket/markup/html/form/ActionLinksPanel.java
+++ b/console/src/main/java/org/apache/syncope/console/wicket/markup/html/form/ActionLinksPanel.java
@@ -70,7 +70,7 @@ public class ActionLinksPanel extends Panel {
     public void add(
             final ActionLink link, final ActionLink.ActionType type, final String pageId, final String actionId) {
 
-        addWithRoles(link, type, xmlRolesReader.getAllAllowedRoles(pageId, actionId), true);
+        addWithRoles(link, type, xmlRolesReader.getEntitlement(pageId, actionId), true);
     }
 
     public void add(
@@ -82,7 +82,7 @@ public class ActionLinksPanel extends Panel {
     public void add(
             final ActionLink link, final ActionLink.ActionType type, final String pageId, final boolean enabled) {
 
-        addWithRoles(link, type, xmlRolesReader.getAllAllowedRoles(pageId, type.getActionId()), enabled);
+        addWithRoles(link, type, xmlRolesReader.getEntitlement(pageId, type.getActionId()), enabled);
     }
 
     public void addWithRoles(

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/wicket/markup/html/tree/TreeRolePanel.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/wicket/markup/html/tree/TreeRolePanel.java b/console/src/main/java/org/apache/syncope/console/wicket/markup/html/tree/TreeRolePanel.java
index 830e31a..d860880 100644
--- a/console/src/main/java/org/apache/syncope/console/wicket/markup/html/tree/TreeRolePanel.java
+++ b/console/src/main/java/org/apache/syncope/console/wicket/markup/html/tree/TreeRolePanel.java
@@ -104,7 +104,7 @@ public class TreeRolePanel extends Panel {
 
         DefaultMutableTreeNodeExpansion.get().expandAll();
 
-        MetaDataRoleAuthorizationStrategy.authorize(tree, ENABLE, xmlRolesReader.getAllAllowedRoles("Roles", "read"));
+        MetaDataRoleAuthorizationStrategy.authorize(tree, ENABLE, xmlRolesReader.getEntitlement("Roles", "read"));
 
         treeContainer.addOrReplace(tree);
     }

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/resources/applicationContext.xml
----------------------------------------------------------------------
diff --git a/console/src/main/resources/applicationContext.xml b/console/src/main/resources/applicationContext.xml
index be37d23..b58640b 100644
--- a/console/src/main/resources/applicationContext.xml
+++ b/console/src/main/resources/applicationContext.xml
@@ -63,10 +63,6 @@ under the License.
     <constructor-arg value="${licenseUrl}"/>
   </bean>
 
-  <bean id="authorizations" class="java.lang.String">
-    <constructor-arg value="authorizations.xml"/>
-  </bean>
-
   <bean id="syncopeApplication" class="org.apache.syncope.console.SyncopeApplication"/>
 
   <bean id="jacksonObjectMapper" class="org.codehaus.jackson.map.ObjectMapper"/>
@@ -133,7 +129,9 @@ under the License.
 
   <bean id="preferenceManager" class="org.apache.syncope.console.commons.PreferenceManager"/>
 
-  <bean id="xmlRolesReader" class="org.apache.syncope.console.commons.XMLRolesReader"/>
+  <bean id="xmlRolesReader" class="org.apache.syncope.console.commons.XMLRolesReader" scope="singleton">
+    <property name="authorizations" value="authorizations.xml"/>
+  </bean>
 
   <bean id="roleTreeBuilder" class="org.apache.syncope.console.commons.RoleTreeBuilder"/>
 


[4/8] [SYNCOPE-599] Merge from 1_1_X

Posted by il...@apache.org.
http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/panels/RoleSummaryPanel.java
----------------------------------------------------------------------

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/panels/RoleTabPanel.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/panels/RoleTabPanel.java
index 0cce34a,9debde4..10d739c
--- a/console/src/main/java/org/apache/syncope/console/pages/panels/RoleTabPanel.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/panels/RoleTabPanel.java
@@@ -109,7 -110,7 +109,7 @@@ public class RoleTabPanel extends Pane
  
                  window.show(target);
              }
-         }, ActionLink.ActionType.MANAGE_RESOURCES, xmlRolesReader.getAllAllowedRoles("Roles", "update"));
 -        }, ActionLink.ActionType.SEARCH, xmlRolesReader.getEntitlement("Roles", "update"));
++        }, ActionLink.ActionType.MANAGE_RESOURCES, xmlRolesReader.getEntitlement("Roles", "update"));
          links.addWithRoles(new ActionLink() {
  
              private static final long serialVersionUID = -3722207913631435501L;
@@@ -152,12 -154,12 +152,12 @@@
                      });
  
                      window.show(target);
 -                } catch (SyncopeClientCompositeErrorException scce) {
 -                    error(getString(Constants.OPERATION_ERROR) + ": " + scce.getMessage());
 -                    target.add(((Roles) pageRef.getPage()).getFeedbackPanel());
 +                } catch (SyncopeClientException e) {
 +                    error(getString(Constants.OPERATION_ERROR) + ": " + e.getMessage());
 +                    ((Roles) pageRef.getPage()).getFeedbackPanel().refresh(target);
                  }
              }
-         }, ActionLink.ActionType.DELETE, xmlRolesReader.getAllAllowedRoles("Roles", "delete"));
+         }, ActionLink.ActionType.DELETE, xmlRolesReader.getEntitlement("Roles", "delete"));
  
          final Form form = new Form("roleForm");
          form.setModel(new CompoundPropertyModel(selectedNode));

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/panels/SchedTasks.java
----------------------------------------------------------------------

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/wicket/markup/html/form/ActionLinksPanel.java
----------------------------------------------------------------------

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/resources/consoleContext.xml
----------------------------------------------------------------------
diff --cc console/src/main/resources/consoleContext.xml
index ded9983,0000000..91c884b
mode 100644,000000..100644
--- a/console/src/main/resources/consoleContext.xml
+++ b/console/src/main/resources/consoleContext.xml
@@@ -1,82 -1,0 +1,82 @@@
 +<?xml version="1.0" encoding="UTF-8"?>
 +<!--
 +Licensed to the Apache Software Foundation (ASF) under one
 +or more contributor license agreements.  See the NOTICE file
 +distributed with this work for additional information
 +regarding copyright ownership.  The ASF licenses this file
 +to you under the Apache License, Version 2.0 (the
 +"License"); you may not use this file except in compliance
 +with the License.  You may obtain a copy of the License at
 +
 +  http://www.apache.org/licenses/LICENSE-2.0
 +
 +Unless required by applicable law or agreed to in writing,
 +software distributed under the License is distributed on an
 +"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 +KIND, either express or implied.  See the License for the
 +specific language governing permissions and limitations
 +under the License.
 +-->
 +<beans xmlns="http://www.springframework.org/schema/beans"
 +       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 +       xmlns:context="http://www.springframework.org/schema/context"
 +       xmlns:cxf="http://cxf.apache.org/core"
 +       xsi:schemaLocation="http://www.springframework.org/schema/beans
 +                           http://www.springframework.org/schema/beans/spring-beans.xsd
 +                           http://www.springframework.org/schema/context
 +                           http://www.springframework.org/schema/context/spring-context.xsd
 +                           http://cxf.apache.org/core 
 +                           http://cxf.apache.org/schemas/core.xsd">
 +
 +  <context:component-scan base-package="org.apache.syncope.console.rest"/>
 +  <context:component-scan base-package="org.apache.syncope.console.init"/>
 +  <context:component-scan base-package="org.apache.syncope.console.preview"/>
 +
 +  <bean id="confDirectoryPropertyConfigurer" class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
 +    <property name="order" value="1"/>
 +    <property name="location" value="file:${conf.directory}/console.properties"/>
 +    <property name="ignoreResourceNotFound" value="true"/>
 +    <property name="ignoreUnresolvablePlaceholders" value="true"/>
 +  </bean>
 +  <bean id="classpathPropertyConfigurer" class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
 +    <property name="location" value="classpath:console.properties"/>
 +  </bean>
 +
 +  <bean id="version" class="java.lang.String">
 +    <constructor-arg value="${syncope.version}"/>
 +  </bean>
 +
 +  <bean id="site" class="java.lang.String">
 +    <constructor-arg value="${project.parent.url}"/>
 +  </bean>
 +  
 +  <bean id="license" class="java.lang.String">
 +    <constructor-arg value="${licenseUrl}"/>
 +  </bean>
 +  
 +  <bean id="anonymousUser" class="java.lang.String">
 +    <constructor-arg value="${anonymousUser}"/>
 +  </bean>
 +  <bean id="anonymousKey" class="java.lang.String">
 +    <constructor-arg value="${anonymousKey}"/>
 +  </bean>
 +
 +  <bean id="activitiModelerDirectory" class="java.lang.String">
 +    <constructor-arg value="${activitiModelerDirectory}"/>
 +  </bean>
 +
 +  <bean id="syncopeApplication" class="org.apache.syncope.console.SyncopeApplication"/>
 +
 +  <bean id="preferenceManager" class="org.apache.syncope.console.commons.PreferenceManager"/>
 +
-   <bean id="xmlRolesReader" class="org.apache.syncope.console.commons.XMLRolesReader">
++  <bean id="xmlRolesReader" class="org.apache.syncope.console.commons.XMLRolesReader" scope="singleton">
 +    <property name="authorizations" value="authorizations.xml"/>
 +  </bean>
 +
 +  <bean id="roleTreeBuilder" class="org.apache.syncope.console.commons.RoleTreeBuilder"/>
 +
 +  <bean id="syncopeClientFactory" class="org.apache.syncope.client.SyncopeClientFactoryBean">
 +    <property name="address" value="${scheme}://${host}:${port}/${rootPath}"/>
 +  </bean>
 +
 +</beans>


[8/8] git commit: Merge branch '1_2_X'

Posted by il...@apache.org.
Merge branch '1_2_X'


Project: http://git-wip-us.apache.org/repos/asf/syncope/repo
Commit: http://git-wip-us.apache.org/repos/asf/syncope/commit/31f82867
Tree: http://git-wip-us.apache.org/repos/asf/syncope/tree/31f82867
Diff: http://git-wip-us.apache.org/repos/asf/syncope/diff/31f82867

Branch: refs/heads/master
Commit: 31f82867ad8c771cc6e9ebed242ad5494964eb00
Parents: ae52953 f160740
Author: Francesco Chicchiriccò <il...@apache.org>
Authored: Mon Nov 3 19:35:24 2014 +0100
Committer: Francesco Chicchiriccò <il...@apache.org>
Committed: Mon Nov 3 19:35:24 2014 +0100

----------------------------------------------------------------------
 .../syncope/console/SyncopeApplication.java     | 16 ++--
 .../syncope/console/commons/XMLRolesReader.java | 97 ++++++++++++--------
 .../pages/AbstractSchedTaskModalPage.java       |  4 +-
 .../console/pages/ApprovalModalPage.java        |  4 +-
 .../syncope/console/pages/ConfModalPage.java    |  6 +-
 .../syncope/console/pages/Configuration.java    | 25 +++--
 .../console/pages/ConnectorModalPage.java       |  4 +-
 .../console/pages/DerSchemaModalPage.java       |  4 +-
 .../console/pages/EditUserModalPage.java        |  2 +-
 .../console/pages/NotificationModalPage.java    |  4 +-
 .../syncope/console/pages/ReportModalPage.java  |  4 +-
 .../apache/syncope/console/pages/Reports.java   | 20 ++--
 .../console/pages/ResourceModalPage.java        |  6 +-
 .../apache/syncope/console/pages/Resources.java | 13 ++-
 .../syncope/console/pages/RoleModalPage.java    |  2 +-
 .../apache/syncope/console/pages/Schema.java    |  6 +-
 .../syncope/console/pages/SchemaModalPage.java  |  4 +-
 .../pages/SecurityQuestionModalPage.java        |  4 +-
 .../org/apache/syncope/console/pages/Todo.java  |  6 +-
 .../syncope/console/pages/UserModalPage.java    |  4 +-
 .../org/apache/syncope/console/pages/Users.java |  2 +-
 .../console/pages/VirSchemaModalPage.java       |  4 +-
 .../console/pages/XMLEditorPopupPage.java       |  6 +-
 .../pages/panels/AbstractSyncTasksPanel.java    |  2 +-
 .../console/pages/panels/PoliciesPanel.java     |  4 +-
 .../syncope/console/pages/panels/RolePanel.java |  2 +-
 .../console/pages/panels/RoleSummaryPanel.java  |  2 +-
 .../console/pages/panels/RoleTabPanel.java      |  8 +-
 .../console/pages/panels/SchedTasks.java        |  2 +-
 .../markup/html/form/ActionLinksPanel.java      |  4 +-
 .../wicket/markup/html/tree/TreeRolePanel.java  |  2 +-
 console/src/main/resources/consoleContext.xml   |  2 +-
 32 files changed, 147 insertions(+), 128 deletions(-)
----------------------------------------------------------------------



[3/8] git commit: [SYNCOPE-599] Enhancements to console's authorization parsing

Posted by il...@apache.org.
[SYNCOPE-599] Enhancements to console's authorization parsing


Project: http://git-wip-us.apache.org/repos/asf/syncope/repo
Commit: http://git-wip-us.apache.org/repos/asf/syncope/commit/05d2985a
Tree: http://git-wip-us.apache.org/repos/asf/syncope/tree/05d2985a
Diff: http://git-wip-us.apache.org/repos/asf/syncope/diff/05d2985a

Branch: refs/heads/master
Commit: 05d2985a47cb2104a6b43d553b4707209c261f94
Parents: 79ef513
Author: Francesco Chicchiriccò <il...@apache.org>
Authored: Mon Nov 3 19:19:21 2014 +0100
Committer: Francesco Chicchiriccò <il...@apache.org>
Committed: Mon Nov 3 19:19:21 2014 +0100

----------------------------------------------------------------------
 .../syncope/console/SyncopeApplication.java     |  10 +-
 .../syncope/console/commons/XMLRolesReader.java | 104 +++++++++++--------
 .../pages/AbstractSchedTaskModalPage.java       |   4 +-
 .../console/pages/ApprovalModalPage.java        |   4 +-
 .../syncope/console/pages/Configuration.java    |  16 +--
 .../console/pages/ConfigurationModalPage.java   |   4 +-
 .../console/pages/ConnectorModalPage.java       |   4 +-
 .../console/pages/DerivedSchemaModalPage.java   |   4 +-
 .../console/pages/EditUserModalPage.java        |   2 +-
 .../console/pages/NotificationModalPage.java    |   4 +-
 .../syncope/console/pages/ReportModalPage.java  |   4 +-
 .../apache/syncope/console/pages/Reports.java   |  14 +--
 .../console/pages/ResourceModalPage.java        |   2 +-
 .../apache/syncope/console/pages/Resources.java |  13 ++-
 .../syncope/console/pages/RoleModalPage.java    |   2 +-
 .../apache/syncope/console/pages/Schema.java    |   6 +-
 .../syncope/console/pages/SchemaModalPage.java  |   4 +-
 .../syncope/console/pages/StatusModalPage.java  |   2 +-
 .../org/apache/syncope/console/pages/Todo.java  |   8 +-
 .../syncope/console/pages/UserModalPage.java    |   4 +-
 .../org/apache/syncope/console/pages/Users.java |   2 +-
 .../console/pages/VirtualSchemaModalPage.java   |   4 +-
 .../console/pages/panels/PoliciesPanel.java     |   2 +-
 .../syncope/console/pages/panels/RolePanel.java |   2 +-
 .../console/pages/panels/RoleSummaryPanel.java  |   2 +-
 .../console/pages/panels/RoleTabPanel.java      |   8 +-
 .../console/pages/panels/SchedTasks.java        |   2 +-
 .../syncope/console/pages/panels/SyncTasks.java |   2 +-
 .../markup/html/form/ActionLinksPanel.java      |   4 +-
 .../wicket/markup/html/tree/TreeRolePanel.java  |   2 +-
 .../src/main/resources/applicationContext.xml   |   8 +-
 31 files changed, 133 insertions(+), 120 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/SyncopeApplication.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/SyncopeApplication.java b/console/src/main/java/org/apache/syncope/console/SyncopeApplication.java
index 9803650..0fbe521 100644
--- a/console/src/main/java/org/apache/syncope/console/SyncopeApplication.java
+++ b/console/src/main/java/org/apache/syncope/console/SyncopeApplication.java
@@ -120,7 +120,7 @@ public class SyncopeApplication
                 : "") + "schema" + Constants.PNG_EXT)));
 
         BookmarkablePageLink<Void> usersLink = new BookmarkablePageLink<Void>("users", Users.class);
-        String allowedUsersRoles = xmlRolesReader.getAllAllowedRoles("Users", "list");
+        String allowedUsersRoles = xmlRolesReader.getEntitlement("Users", "list");
         MetaDataRoleAuthorizationStrategy.authorize(usersLink, WebPage.ENABLE, allowedUsersRoles);
         page.add(usersLink);
         usersLink.add(new Image("usersIcon", new ContextRelativeResource(IMG_PREFIX + (notsel
@@ -142,7 +142,7 @@ public class SyncopeApplication
                 : "") + "resources" + Constants.PNG_EXT)));
 
         BookmarkablePageLink<Void> todoLink = new BookmarkablePageLink<Void>("todo", Todo.class);
-        MetaDataRoleAuthorizationStrategy.authorize(todoLink, WebPage.ENABLE, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(todoLink, WebPage.ENABLE, xmlRolesReader.getEntitlement(
                 "Approval", "list"));
         page.add(todoLink);
         todoLink.add(new Image("todoIcon", new ContextRelativeResource(IMG_PREFIX + (notsel
@@ -150,7 +150,7 @@ public class SyncopeApplication
                 : "") + "todo" + Constants.PNG_EXT)));
 
         BookmarkablePageLink<Void> reportLink = new BookmarkablePageLink<Void>("reports", Reports.class);
-        String allowedReportRoles = xmlRolesReader.getAllAllowedRoles("Reports", "list");
+        String allowedReportRoles = xmlRolesReader.getEntitlement("Reports", "list");
         MetaDataRoleAuthorizationStrategy.authorize(reportLink, WebPage.ENABLE, allowedReportRoles);
         page.add(reportLink);
         reportLink.add(new Image("reportsIcon", new ContextRelativeResource(IMG_PREFIX + (notsel
@@ -159,7 +159,7 @@ public class SyncopeApplication
 
         BookmarkablePageLink<Void> configurationLink = new BookmarkablePageLink<Void>("configuration",
                 Configuration.class);
-        String allowedConfigurationRoles = xmlRolesReader.getAllAllowedRoles("Configuration", "list");
+        String allowedConfigurationRoles = xmlRolesReader.getEntitlement("Configuration", "list");
         MetaDataRoleAuthorizationStrategy.authorize(configurationLink, WebPage.ENABLE, allowedConfigurationRoles);
         page.add(configurationLink);
         configurationLink.add(new Image("configurationIcon", new ContextRelativeResource(IMG_PREFIX + (notsel
@@ -167,7 +167,7 @@ public class SyncopeApplication
                 : "") + "configuration" + Constants.PNG_EXT)));
 
         BookmarkablePageLink<Void> taskLink = new BookmarkablePageLink<Void>("tasks", Tasks.class);
-        String allowedTasksRoles = xmlRolesReader.getAllAllowedRoles("Tasks", "list");
+        String allowedTasksRoles = xmlRolesReader.getEntitlement("Tasks", "list");
         MetaDataRoleAuthorizationStrategy.authorize(taskLink, WebPage.ENABLE, allowedTasksRoles);
         page.add(taskLink);
         taskLink.add(new Image("tasksIcon", new ContextRelativeResource(IMG_PREFIX + (notsel

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/commons/XMLRolesReader.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/commons/XMLRolesReader.java b/console/src/main/java/org/apache/syncope/console/commons/XMLRolesReader.java
index c031975..69cf4ec 100644
--- a/console/src/main/java/org/apache/syncope/console/commons/XMLRolesReader.java
+++ b/console/src/main/java/org/apache/syncope/console/commons/XMLRolesReader.java
@@ -18,17 +18,17 @@
  */
 package org.apache.syncope.console.commons;
 
+import java.util.HashMap;
+import java.util.Map;
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
-import javax.xml.xpath.XPath;
-import javax.xml.xpath.XPathConstants;
-import javax.xml.xpath.XPathExpression;
-import javax.xml.xpath.XPathExpressionException;
-import javax.xml.xpath.XPathFactory;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.commons.lang3.tuple.ImmutablePair;
+import org.apache.commons.lang3.tuple.Pair;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
-import org.springframework.beans.factory.annotation.Autowired;
 import org.w3c.dom.Document;
+import org.w3c.dom.Node;
 import org.w3c.dom.NodeList;
 
 /**
@@ -41,62 +41,78 @@ public class XMLRolesReader {
      */
     private static final Logger LOG = LoggerFactory.getLogger(XMLRolesReader.class);
 
-    @Autowired
     private String authorizations;
 
-    private Document doc;
+    private Map<Pair<String, String>, String> authMap;
+
+    public void setAuthorizations(final String authorizations) {
+        this.authorizations = authorizations;
+    }
+
+    private void init() {
+        authMap = new HashMap<Pair<String, String>, String>();
 
-    public void init() {
         DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
         dbf.setNamespaceAware(true);
         try {
             DocumentBuilder db = dbf.newDocumentBuilder();
-            doc = db.parse(getClass().getResource("/" + authorizations).openStream());
+            Document doc = db.parse(getClass().getResource("/" + authorizations).openStream());
             doc.getDocumentElement().normalize();
+
+            Node authNode = null;
+            NodeList root = doc.getChildNodes();
+            for (int i = 0; i < root.getLength() && authNode == null; i++) {
+                if ("auth".equals(root.item(i).getNodeName())) {
+                    authNode = root.item(i);
+                }
+            }
+            if (authNode == null) {
+                throw new IllegalArgumentException("Could not find root <auth> node");
+            }
+
+            NodeList pages = authNode.getChildNodes();
+            for (int i = 0; i < pages.getLength(); i++) {
+                if ("page".equals(pages.item(i).getNodeName())) {
+                    String page = pages.item(i).getAttributes().getNamedItem("id").getTextContent();
+
+                    NodeList actions = pages.item(i).getChildNodes();
+                    for (int j = 0; j < actions.getLength(); j++) {
+                        if ("action".equals(actions.item(j).getNodeName())) {
+                            String action = actions.item(j).getAttributes().getNamedItem("id").getTextContent();
+
+                            NodeList entitlements = actions.item(j).getChildNodes();
+                            for (int k = 0; k < entitlements.getLength(); k++) {
+                                if ("entitlement".equals(entitlements.item(k).getNodeName())) {
+                                    String entitlement = entitlements.item(k).getTextContent();
+                                    authMap.put(new ImmutablePair<String, String>(page, action), entitlement);
+                                }
+                            }
+                        }
+                    }
+                }
+            }
         } catch (Exception e) {
             LOG.error("While initializing parsing of {}", authorizations, e);
-            doc = null;
         }
     }
 
     /**
-     * Get all roles allowed for specific page and action requested.
+     * Get entitlement required for page / action.
      *
-     * @param pageId
-     * @param actionId
-     * @return roles list comma separated
+     * @param pageId page
+     * @param actionId action
+     * @return entitlement required
      */
-    public String getAllAllowedRoles(final String pageId, final String actionId) {
-
-        if (doc == null) {
-            init();
-        }
-        if (doc == null) {
-            return "";
-        }
-
-        final StringBuilder roles = new StringBuilder();
-        try {
-            XPathFactory factory = XPathFactory.newInstance();
-            XPath xpath = factory.newXPath();
-            XPathExpression expr = xpath.compile("//page[@id='" + pageId + "']/" + "action[@id='" + actionId + "']/"
-                    + "entitlement/text()");
-            Object result = expr.evaluate(doc, XPathConstants.NODESET);
-
-            NodeList nodes = (NodeList) result;
-
-            for (int i = 0; i < nodes.getLength(); i++) {
-                if (i > 0) {
-                    roles.append(",");
-                }
-                roles.append(nodes.item(i).getNodeValue());
+    public String getEntitlement(final String pageId, final String actionId) {
+        synchronized (this) {
+            if (authMap == null) {
+                init();
             }
-        } catch (XPathExpressionException e) {
-            LOG.error("While parsing authorizations file", e);
         }
 
-        LOG.debug("Authorizations found: {}", roles);
-
-        return roles.toString();
+        Pair<String, String> key = new ImmutablePair<String, String>(pageId, actionId);
+        return authMap.containsKey(key)
+                ? authMap.get(key)
+                : StringUtils.EMPTY;
     }
 }

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/AbstractSchedTaskModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/AbstractSchedTaskModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/AbstractSchedTaskModalPage.java
index 4d899e3..8bd02b9 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/AbstractSchedTaskModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/AbstractSchedTaskModalPage.java
@@ -129,10 +129,10 @@ public abstract class AbstractSchedTaskModalPage extends TaskModalPage {
         cancel.setDefaultFormProcessing(false);
 
         if (taskTO.getId() > 0) {
-            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER, xmlRolesReader.getAllAllowedRoles(TASKS,
+            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER, xmlRolesReader.getEntitlement(TASKS,
                     "update"));
         } else {
-            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER, xmlRolesReader.getAllAllowedRoles(TASKS,
+            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER, xmlRolesReader.getEntitlement(TASKS,
                     "create"));
         }
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/ApprovalModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/ApprovalModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/ApprovalModalPage.java
index 8c69ca9..fae7b42 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/ApprovalModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/ApprovalModalPage.java
@@ -188,7 +188,7 @@ public class ApprovalModalPage extends BaseModalPage {
                     }
                 };
         MetaDataRoleAuthorizationStrategy.authorize(userDetails, ENABLE,
-                xmlRolesReader.getAllAllowedRoles("Users", "read"));
+                xmlRolesReader.getEntitlement("Users", "read"));
 
         final AjaxButton submit = new IndicatingAjaxButton(APPLY, new Model<String>(getString(SUBMIT))) {
 
@@ -267,7 +267,7 @@ public class ApprovalModalPage extends BaseModalPage {
         form.add(submit);
         form.add(cancel);
 
-        MetaDataRoleAuthorizationStrategy.authorize(form, ENABLE, xmlRolesReader.getAllAllowedRoles("Approval",
+        MetaDataRoleAuthorizationStrategy.authorize(form, ENABLE, xmlRolesReader.getEntitlement("Approval",
                 SUBMIT));
 
         editUserWin = new ModalWindow("editUserWin");

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/Configuration.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/Configuration.java b/console/src/main/java/org/apache/syncope/console/pages/Configuration.java
index 403c948..9e4c0fc 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/Configuration.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/Configuration.java
@@ -178,13 +178,13 @@ public class Configuration extends BasePage {
             }
         };
 
-        MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, xmlRolesReader.getAllAllowedRoles("Configuration",
+        MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, xmlRolesReader.getEntitlement("Configuration",
                 "workflowDefUpdate"));
         wfForm.add(submit);
 
         workflowDefContainer.add(wfForm);
 
-        MetaDataRoleAuthorizationStrategy.authorize(workflowDefContainer, ENABLE, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(workflowDefContainer, ENABLE, xmlRolesReader.getEntitlement(
                 "Configuration", "workflowDefRead"));
         add(workflowDefContainer);
 
@@ -195,7 +195,7 @@ public class Configuration extends BasePage {
         coreLoggerContainer.add(coreLoggerList);
         coreLoggerContainer.setOutputMarkupId(true);
 
-        MetaDataRoleAuthorizationStrategy.authorize(coreLoggerContainer, ENABLE, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(coreLoggerContainer, ENABLE, xmlRolesReader.getEntitlement(
                 "Configuration", "logList"));
         add(coreLoggerContainer);
 
@@ -206,7 +206,7 @@ public class Configuration extends BasePage {
         consoleLoggerContainer.add(consoleLoggerList);
         consoleLoggerContainer.setOutputMarkupId(true);
 
-        MetaDataRoleAuthorizationStrategy.authorize(consoleLoggerContainer, ENABLE, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(consoleLoggerContainer, ENABLE, xmlRolesReader.getEntitlement(
                 "Configuration", "logList"));
         add(consoleLoggerContainer);
     }
@@ -327,7 +327,7 @@ public class Configuration extends BasePage {
             }
         };
 
-        MetaDataRoleAuthorizationStrategy.authorize(createConfigurationLink, ENABLE, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(createConfigurationLink, ENABLE, xmlRolesReader.getEntitlement(
                 "Configuration", "create"));
         add(createConfigurationLink);
 
@@ -351,7 +351,7 @@ public class Configuration extends BasePage {
             }
         };
 
-        MetaDataRoleAuthorizationStrategy.authorize(dbExportLink, ENABLE, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(dbExportLink, ENABLE, xmlRolesReader.getEntitlement(
                 "Configuration", "read"));
         add(dbExportLink);
 
@@ -502,7 +502,7 @@ public class Configuration extends BasePage {
             }
         };
 
-        MetaDataRoleAuthorizationStrategy.authorize(createNotificationLink, ENABLE, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(createNotificationLink, ENABLE, xmlRolesReader.getEntitlement(
                 "Notification", "create"));
         add(createNotificationLink);
 
@@ -673,7 +673,7 @@ public class Configuration extends BasePage {
                 }
             });
 
-            MetaDataRoleAuthorizationStrategy.authorize(level, ENABLE, xmlRolesReader.getAllAllowedRoles(
+            MetaDataRoleAuthorizationStrategy.authorize(level, ENABLE, xmlRolesReader.getEntitlement(
                     "Configuration", "logSetLevel"));
 
             item.add(level);

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/ConfigurationModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/ConfigurationModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/ConfigurationModalPage.java
index 5af5b16..d61fa38 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/ConfigurationModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/ConfigurationModalPage.java
@@ -121,8 +121,8 @@ public class ConfigurationModalPage extends BaseModalPage {
         form.add(cancel);
 
         String allowedRoles = createFlag
-                ? xmlRolesReader.getAllAllowedRoles("Configuration", "create")
-                : xmlRolesReader.getAllAllowedRoles("Configuration", "update");
+                ? xmlRolesReader.getEntitlement("Configuration", "create")
+                : xmlRolesReader.getEntitlement("Configuration", "update");
 
         MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, allowedRoles);
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/ConnectorModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/ConnectorModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/ConnectorModalPage.java
index ae28729..94027e1 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/ConnectorModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/ConnectorModalPage.java
@@ -437,8 +437,8 @@ public class ConnectorModalPage extends BaseModalPage {
             }
         };
         String roles = connInstanceTO.getId() == 0
-                ? xmlRolesReader.getAllAllowedRoles("Connectors", "create")
-                : xmlRolesReader.getAllAllowedRoles("Connectors", "update");
+                ? xmlRolesReader.getEntitlement("Connectors", "create")
+                : xmlRolesReader.getEntitlement("Connectors", "update");
         MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, roles);
         connectorForm.add(submit);
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/DerivedSchemaModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/DerivedSchemaModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/DerivedSchemaModalPage.java
index 5c51154..edda895 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/DerivedSchemaModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/DerivedSchemaModalPage.java
@@ -125,8 +125,8 @@ public class DerivedSchemaModalPage extends AbstractSchemaModalPage {
                 false);
 
         String allowedRoles = createFlag
-                ? xmlRolesReader.getAllAllowedRoles("Schema", "create")
-                : xmlRolesReader.getAllAllowedRoles("Schema", "update");
+                ? xmlRolesReader.getEntitlement("Schema", "create")
+                : xmlRolesReader.getEntitlement("Schema", "update");
 
         MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, allowedRoles);
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/EditUserModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/EditUserModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/EditUserModalPage.java
index a3a6d45..9132dda 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/EditUserModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/EditUserModalPage.java
@@ -63,7 +63,7 @@ public class EditUserModalPage extends UserModalPage {
             statusPanel = new StatusPanel("statuspanel", userTO, new ArrayList<StatusBean>(), getPageReference());
             statusPanel.setOutputMarkupId(true);
             MetaDataRoleAuthorizationStrategy.authorize(
-                    statusPanel, RENDER, xmlRolesReader.getAllAllowedRoles("Resources", "getConnectorObject"));
+                    statusPanel, RENDER, xmlRolesReader.getEntitlement("Resources", "getConnectorObject"));
             form.addOrReplace(statusPanel);
 
             form.addOrReplace(new AccountInformationPanel("accountinformation", userTO));

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/NotificationModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/NotificationModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/NotificationModalPage.java
index 09d0136..dc043b8 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/NotificationModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/NotificationModalPage.java
@@ -270,8 +270,8 @@ class NotificationModalPage extends BaseModalPage {
         cancel.setDefaultFormProcessing(false);
 
         String allowedRoles = createFlag
-                ? xmlRolesReader.getAllAllowedRoles("Notification", "create")
-                : xmlRolesReader.getAllAllowedRoles("Notification", "update");
+                ? xmlRolesReader.getEntitlement("Notification", "create")
+                : xmlRolesReader.getEntitlement("Notification", "update");
         MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, allowedRoles);
 
         form.add(submit);

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/ReportModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/ReportModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/ReportModalPage.java
index 548de35..d76400b 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/ReportModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/ReportModalPage.java
@@ -161,10 +161,10 @@ public class ReportModalPage extends BaseModalPage {
                 };
 
         if (reportTO.getId() > 0) {
-            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER, xmlRolesReader.getAllAllowedRoles("Reports",
+            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER, xmlRolesReader.getEntitlement("Reports",
                     "update"));
         } else {
-            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER, xmlRolesReader.getAllAllowedRoles("Reports",
+            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER, xmlRolesReader.getEntitlement("Reports",
                     "create"));
         }
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/Reports.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/Reports.java b/console/src/main/java/org/apache/syncope/console/pages/Reports.java
index f0e0647..789e37e 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/Reports.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/Reports.java
@@ -110,7 +110,7 @@ public class Reports extends BasePage {
         reportContainer = new WebMarkupContainer("reportContainer");
         setWindowClosedCallback(window, reportContainer);
 
-        MetaDataRoleAuthorizationStrategy.authorize(reportContainer, RENDER, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(reportContainer, RENDER, xmlRolesReader.getEntitlement(
                 "Reports", "list"));
 
         paginatorRows = prefMan.getPaginatorRows(getRequest(), Constants.PREF_REPORT_PAGINATOR_ROWS);
@@ -223,7 +223,7 @@ public class Reports extends BasePage {
 
         Form paginatorForm = new Form("paginatorForm");
 
-        MetaDataRoleAuthorizationStrategy.authorize(paginatorForm, RENDER, xmlRolesReader.getAllAllowedRoles("Reports",
+        MetaDataRoleAuthorizationStrategy.authorize(paginatorForm, RENDER, xmlRolesReader.getEntitlement("Reports",
                 "list"));
 
         final DropDownChoice rowsChooser = new DropDownChoice("rowsChooser", new PropertyModel(this, "paginatorRows"),
@@ -266,7 +266,7 @@ public class Reports extends BasePage {
             }
         };
 
-        MetaDataRoleAuthorizationStrategy.authorize(createLink, RENDER, xmlRolesReader.getAllAllowedRoles("Reports",
+        MetaDataRoleAuthorizationStrategy.authorize(createLink, RENDER, xmlRolesReader.getEntitlement("Reports",
                 "create"));
 
         add(createLink);
@@ -279,7 +279,7 @@ public class Reports extends BasePage {
         add(auditContainer);
 
         MetaDataRoleAuthorizationStrategy.authorize(
-                auditContainer, RENDER, xmlRolesReader.getAllAllowedRoles("Audit", "list"));
+                auditContainer, RENDER, xmlRolesReader.getEntitlement("Audit", "list"));
 
         final Form form = new Form("auditForm");
         auditContainer.add(form);
@@ -306,15 +306,15 @@ public class Reports extends BasePage {
                     @Override
                     protected String[] getListRoles() {
                         return new String[] {
-                            xmlRolesReader.getAllAllowedRoles("Audit", "list")
+                            xmlRolesReader.getEntitlement("Audit", "list")
                         };
                     }
 
                     @Override
                     protected String[] getChangeRoles() {
                         return new String[] {
-                            xmlRolesReader.getAllAllowedRoles("Audit", "enable"),
-                            xmlRolesReader.getAllAllowedRoles("Audit", "disable")
+                            xmlRolesReader.getEntitlement("Audit", "enable"),
+                            xmlRolesReader.getEntitlement("Audit", "disable")
                         };
                     }
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/ResourceModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/ResourceModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/ResourceModalPage.java
index 51e1da3..ea58648 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/ResourceModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/ResourceModalPage.java
@@ -173,7 +173,7 @@ public class ResourceModalPage extends BaseModalPage {
 
         add(form);
 
-        MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, xmlRolesReader.getAllAllowedRoles("Resources",
+        MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, xmlRolesReader.getEntitlement("Resources",
                 createFlag
                 ? "create"
                 : "update"));

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/Resources.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/Resources.java b/console/src/main/java/org/apache/syncope/console/pages/Resources.java
index 7d11d0b..89aa1ba 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/Resources.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/Resources.java
@@ -139,7 +139,7 @@ public class Resources extends BasePage {
                 attributes.getAjaxCallListeners().add(ajaxCallListener);
             }
         };
-        MetaDataRoleAuthorizationStrategy.authorize(reloadLink, ENABLE, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(reloadLink, ENABLE, xmlRolesReader.getEntitlement(
                 "Connectors", "reload"));
         add(reloadLink);
 
@@ -195,8 +195,7 @@ public class Resources extends BasePage {
 
                         cellItem.add(editConnPanel);
 
-                        MetaDataRoleAuthorizationStrategy.authorize(editConnPanel, ENABLE, xmlRolesReader.
-                                getAllAllowedRoles(
+                        MetaDataRoleAuthorizationStrategy.authorize(editConnPanel, ENABLE, xmlRolesReader.getEntitlement(
                                         "Connectors", "read"));
                     }
                 });
@@ -341,7 +340,7 @@ public class Resources extends BasePage {
                     }
                 };
 
-        MetaDataRoleAuthorizationStrategy.authorize(createResourceLink, ENABLE, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(createResourceLink, ENABLE, xmlRolesReader.getEntitlement(
                 "Resources", "create"));
 
         add(createResourceLink);
@@ -459,7 +458,7 @@ public class Resources extends BasePage {
         connectorContainer.add(table);
         connectorContainer.setOutputMarkupId(true);
 
-        MetaDataRoleAuthorizationStrategy.authorize(connectorContainer, RENDER, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(connectorContainer, RENDER, xmlRolesReader.getEntitlement(
                 "Connectors", "list"));
 
         add(connectorContainer);
@@ -499,14 +498,14 @@ public class Resources extends BasePage {
             }
         };
 
-        MetaDataRoleAuthorizationStrategy.authorize(createConnectorLink, ENABLE, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(createConnectorLink, ENABLE, xmlRolesReader.getEntitlement(
                 "Connectors", "create"));
 
         add(createConnectorLink);
 
         Form paginatorForm = new Form("connectorPaginatorForm");
 
-        MetaDataRoleAuthorizationStrategy.authorize(paginatorForm, RENDER, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(paginatorForm, RENDER, xmlRolesReader.getEntitlement(
                 "Connectors", "list"));
 
         final DropDownChoice rowsChooser = new DropDownChoice("rowsChooser", new PropertyModel(this,

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/RoleModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/RoleModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/RoleModalPage.java
index cf16c8c..2495421 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/RoleModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/RoleModalPage.java
@@ -136,7 +136,7 @@ public class RoleModalPage extends BaseModalPage {
 
         cancel.setDefaultFormProcessing(false);
 
-        MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, xmlRolesReader.getAllAllowedRoles("Roles",
+        MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, xmlRolesReader.getEntitlement("Roles",
                 createFlag
                 ? "create"
                 : "update"));

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/Schema.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/Schema.java b/console/src/main/java/org/apache/syncope/console/pages/Schema.java
index 88c3ace..d66d6e2 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/Schema.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/Schema.java
@@ -136,11 +136,11 @@ public class Schema extends BasePage {
     @SpringBean
     private PreferenceManager prefMan;
 
-    private final String allowedCreateRoles = xmlRolesReader.getAllAllowedRoles("Schema", "create");
+    private final String allowedCreateRoles = xmlRolesReader.getEntitlement("Schema", "create");
 
-    private final String allowedReadRoles = xmlRolesReader.getAllAllowedRoles("Schema", "read");
+    private final String allowedReadRoles = xmlRolesReader.getEntitlement("Schema", "read");
 
-    private final String allowedDeleteRoles = xmlRolesReader.getAllAllowedRoles("Schema", "delete");
+    private final String allowedDeleteRoles = xmlRolesReader.getEntitlement("Schema", "delete");
 
     public Schema() {
         super();

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/SchemaModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/SchemaModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/SchemaModalPage.java
index 05bd8c1..aedba1d 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/SchemaModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/SchemaModalPage.java
@@ -276,8 +276,8 @@ public class SchemaModalPage extends AbstractSchemaModalPage {
         cancel.setDefaultFormProcessing(false);
 
         String allowedRoles = createFlag
-                ? xmlRolesReader.getAllAllowedRoles("Schema", "create")
-                : xmlRolesReader.getAllAllowedRoles("Schema", "update");
+                ? xmlRolesReader.getEntitlement("Schema", "create")
+                : xmlRolesReader.getEntitlement("Schema", "update");
 
         MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, allowedRoles);
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/StatusModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/StatusModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/StatusModalPage.java
index 6040f70..c2fcf5c 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/StatusModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/StatusModalPage.java
@@ -50,7 +50,7 @@ public class StatusModalPage extends BaseModalPage {
 
         final StatusPanel statusPanel = new StatusPanel("statuspanel", attributable, statuses, null);
         MetaDataRoleAuthorizationStrategy.authorize(
-                statusPanel, RENDER, xmlRolesReader.getAllAllowedRoles("Resources", "getConnectorObject"));
+                statusPanel, RENDER, xmlRolesReader.getEntitlement("Resources", "getConnectorObject"));
         form.add(statusPanel);
 
         final AjaxButton disable;

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/Todo.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/Todo.java b/console/src/main/java/org/apache/syncope/console/pages/Todo.java
index bb0ddbd..06dd6f0 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/Todo.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/Todo.java
@@ -105,7 +105,7 @@ public class Todo extends BasePage {
     private void setupApproval() {
         approvalContainer = new WebMarkupContainer("approvalContainer");
 
-        MetaDataRoleAuthorizationStrategy.authorize(approvalContainer, RENDER, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(approvalContainer, RENDER, xmlRolesReader.getEntitlement(
                 "Approval", "list"));
 
         approvalPaginatorRows = prefMan.getPaginatorRows(getRequest(), Constants.PREF_APPROVAL_PAGINATOR_ROWS);
@@ -186,7 +186,7 @@ public class Todo extends BasePage {
 
         Form approvalPaginatorForm = new Form("approvalPaginatorForm");
 
-        MetaDataRoleAuthorizationStrategy.authorize(approvalPaginatorForm, RENDER, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(approvalPaginatorForm, RENDER, xmlRolesReader.getEntitlement(
                 "Approval", "list"));
 
         final DropDownChoice rowsChooser = new DropDownChoice("rowsChooser", new PropertyModel(this,
@@ -220,7 +220,7 @@ public class Todo extends BasePage {
     private void setupUserRequest() {
         userRequestContainer = new WebMarkupContainer("userRequestContainer");
 
-        MetaDataRoleAuthorizationStrategy.authorize(userRequestContainer, RENDER, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(userRequestContainer, RENDER, xmlRolesReader.getEntitlement(
                 "UserRequest", "list"));
 
         userRequestPaginatorRows = prefMan.getPaginatorRows(getRequest(), Constants.PREF_USER_REQUEST_PAGINATOR_ROWS);
@@ -326,7 +326,7 @@ public class Todo extends BasePage {
 
         Form userRequestPaginatorForm = new Form("userRequestPaginatorForm");
 
-        MetaDataRoleAuthorizationStrategy.authorize(userRequestPaginatorForm, RENDER, xmlRolesReader.getAllAllowedRoles(
+        MetaDataRoleAuthorizationStrategy.authorize(userRequestPaginatorForm, RENDER, xmlRolesReader.getEntitlement(
                 "UserRequest", "list"));
 
         final DropDownChoice rowsChooser = new DropDownChoice("rowsChooser", new PropertyModel(this,

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/UserModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/UserModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/UserModalPage.java
index 2ecaa45..4087266 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/UserModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/UserModalPage.java
@@ -149,8 +149,8 @@ public abstract class UserModalPage extends BaseModalPage {
 
         if (mode == Mode.ADMIN) {
             String allowedRoles = userTO.getId() == 0
-                    ? xmlRolesReader.getAllAllowedRoles("Users", "create")
-                    : xmlRolesReader.getAllAllowedRoles("Users", "update");
+                    ? xmlRolesReader.getEntitlement("Users", "create")
+                    : xmlRolesReader.getEntitlement("Users", "update");
             MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER, allowedRoles);
         }
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/Users.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/Users.java b/console/src/main/java/org/apache/syncope/console/pages/Users.java
index 43af342..4a208de 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/Users.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/Users.java
@@ -92,7 +92,7 @@ public class Users extends BasePage {
             }
         };
         MetaDataRoleAuthorizationStrategy.authorize(
-                createLink, ENABLE, xmlRolesReader.getAllAllowedRoles("Users", "create"));
+                createLink, ENABLE, xmlRolesReader.getEntitlement("Users", "create"));
         add(createLink);
 
         setWindowClosedReloadCallback(editModalWin);

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/VirtualSchemaModalPage.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/VirtualSchemaModalPage.java b/console/src/main/java/org/apache/syncope/console/pages/VirtualSchemaModalPage.java
index 63b3a10..a4ab941 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/VirtualSchemaModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/VirtualSchemaModalPage.java
@@ -111,8 +111,8 @@ public class VirtualSchemaModalPage extends AbstractSchemaModalPage {
         cancel.setDefaultFormProcessing(false);
 
         String allowedRoles = createFlag
-                ? xmlRolesReader.getAllAllowedRoles("Schema", "create")
-                : xmlRolesReader.getAllAllowedRoles("Schema", "update");
+                ? xmlRolesReader.getEntitlement("Schema", "create")
+                : xmlRolesReader.getEntitlement("Schema", "update");
 
         MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, allowedRoles);
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/panels/PoliciesPanel.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/panels/PoliciesPanel.java b/console/src/main/java/org/apache/syncope/console/pages/panels/PoliciesPanel.java
index ffacdbc..b6f7196 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/panels/PoliciesPanel.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/panels/PoliciesPanel.java
@@ -223,7 +223,7 @@ public class PoliciesPanel extends Panel {
 
         add(createButton);
 
-        MetaDataRoleAuthorizationStrategy.authorize(createButton, ENABLE, xmlRolesReader.getAllAllowedRoles("Policies",
+        MetaDataRoleAuthorizationStrategy.authorize(createButton, ENABLE, xmlRolesReader.getEntitlement("Policies",
                 "create"));
 
         final Form paginatorForm = new Form("PaginatorForm");

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/panels/RolePanel.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/panels/RolePanel.java b/console/src/main/java/org/apache/syncope/console/pages/panels/RolePanel.java
index a3596ea..0b2d623 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/panels/RolePanel.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/panels/RolePanel.java
@@ -107,7 +107,7 @@ public class RolePanel extends Panel {
                     "statuspanel", builder.roleTO, new ArrayList<StatusBean>(), builder.pageReference);
             statusPanel.setOutputMarkupId(true);
             MetaDataRoleAuthorizationStrategy.authorize(
-                    statusPanel, RENDER, xmlRolesReader.getAllAllowedRoles("Resources", "getConnectorObject"));
+                    statusPanel, RENDER, xmlRolesReader.getEntitlement("Resources", "getConnectorObject"));
             this.add(statusPanel);
         }
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/panels/RoleSummaryPanel.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/panels/RoleSummaryPanel.java b/console/src/main/java/org/apache/syncope/console/pages/panels/RoleSummaryPanel.java
index a482224..f468586 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/panels/RoleSummaryPanel.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/panels/RoleSummaryPanel.java
@@ -138,7 +138,7 @@ public class RoleSummaryPanel extends Panel {
 
                         builder.window.show(target);
                     }
-                }, ActionLink.ActionType.CREATE, xmlRolesReader.getAllAllowedRoles("Roles", "create"));
+                }, ActionLink.ActionType.CREATE, xmlRolesReader.getEntitlement("Roles", "create"));
             } else {
                 RoleTabPanel roleTabPanel =
                         new RoleTabPanel("nodeViewPanel", selectedNode, builder.window, builder.callerPageRef);

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/panels/RoleTabPanel.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/panels/RoleTabPanel.java b/console/src/main/java/org/apache/syncope/console/pages/panels/RoleTabPanel.java
index 6eab419..9debde4 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/panels/RoleTabPanel.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/panels/RoleTabPanel.java
@@ -91,7 +91,7 @@ public class RoleTabPanel extends Panel {
 
                 window.show(target);
             }
-        }, ActionLink.ActionType.CREATE, xmlRolesReader.getAllAllowedRoles("Roles", "create"));
+        }, ActionLink.ActionType.CREATE, xmlRolesReader.getEntitlement("Roles", "create"));
         links.addWithRoles(new ActionLink() {
 
             private static final long serialVersionUID = -3722207913631435501L;
@@ -110,7 +110,7 @@ public class RoleTabPanel extends Panel {
 
                 window.show(target);
             }
-        }, ActionLink.ActionType.SEARCH, xmlRolesReader.getAllAllowedRoles("Roles", "update"));
+        }, ActionLink.ActionType.SEARCH, xmlRolesReader.getEntitlement("Roles", "update"));
         links.addWithRoles(new ActionLink() {
 
             private static final long serialVersionUID = -3722207913631435501L;
@@ -131,7 +131,7 @@ public class RoleTabPanel extends Panel {
 
                 window.show(target);
             }
-        }, ActionLink.ActionType.EDIT, xmlRolesReader.getAllAllowedRoles("Roles", "update"));
+        }, ActionLink.ActionType.EDIT, xmlRolesReader.getEntitlement("Roles", "update"));
         links.addWithRoles(new ActionLink() {
 
             private static final long serialVersionUID = -3722207913631435501L;
@@ -159,7 +159,7 @@ public class RoleTabPanel extends Panel {
                     target.add(((Roles) pageRef.getPage()).getFeedbackPanel());
                 }
             }
-        }, ActionLink.ActionType.DELETE, xmlRolesReader.getAllAllowedRoles("Roles", "delete"));
+        }, ActionLink.ActionType.DELETE, xmlRolesReader.getEntitlement("Roles", "delete"));
 
         final Form form = new Form("roleForm");
         form.setModel(new CompoundPropertyModel(selectedNode));

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/panels/SchedTasks.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/panels/SchedTasks.java b/console/src/main/java/org/apache/syncope/console/pages/panels/SchedTasks.java
index 0911bcc..07aa090 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/panels/SchedTasks.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/panels/SchedTasks.java
@@ -142,7 +142,7 @@ public class SchedTasks extends AbstractTasks {
         };
 
         MetaDataRoleAuthorizationStrategy.authorize(
-                createLink, RENDER, xmlRolesReader.getAllAllowedRoles(TASKS, "create"));
+                createLink, RENDER, xmlRolesReader.getEntitlement(TASKS, "create"));
 
         add(createLink);
     }

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/pages/panels/SyncTasks.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/pages/panels/SyncTasks.java b/console/src/main/java/org/apache/syncope/console/pages/panels/SyncTasks.java
index 17609fc..46b8fc9 100644
--- a/console/src/main/java/org/apache/syncope/console/pages/panels/SyncTasks.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/panels/SyncTasks.java
@@ -145,7 +145,7 @@ public class SyncTasks extends AbstractTasks {
         };
 
         MetaDataRoleAuthorizationStrategy.authorize(
-                createLink, RENDER, xmlRolesReader.getAllAllowedRoles(TASKS, "create"));
+                createLink, RENDER, xmlRolesReader.getEntitlement(TASKS, "create"));
 
         add(createLink);
     }

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/wicket/markup/html/form/ActionLinksPanel.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/wicket/markup/html/form/ActionLinksPanel.java b/console/src/main/java/org/apache/syncope/console/wicket/markup/html/form/ActionLinksPanel.java
index a4f9610..e854de1 100644
--- a/console/src/main/java/org/apache/syncope/console/wicket/markup/html/form/ActionLinksPanel.java
+++ b/console/src/main/java/org/apache/syncope/console/wicket/markup/html/form/ActionLinksPanel.java
@@ -70,7 +70,7 @@ public class ActionLinksPanel extends Panel {
     public void add(
             final ActionLink link, final ActionLink.ActionType type, final String pageId, final String actionId) {
 
-        addWithRoles(link, type, xmlRolesReader.getAllAllowedRoles(pageId, actionId), true);
+        addWithRoles(link, type, xmlRolesReader.getEntitlement(pageId, actionId), true);
     }
 
     public void add(
@@ -82,7 +82,7 @@ public class ActionLinksPanel extends Panel {
     public void add(
             final ActionLink link, final ActionLink.ActionType type, final String pageId, final boolean enabled) {
 
-        addWithRoles(link, type, xmlRolesReader.getAllAllowedRoles(pageId, type.getActionId()), enabled);
+        addWithRoles(link, type, xmlRolesReader.getEntitlement(pageId, type.getActionId()), enabled);
     }
 
     public void addWithRoles(

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/java/org/apache/syncope/console/wicket/markup/html/tree/TreeRolePanel.java
----------------------------------------------------------------------
diff --git a/console/src/main/java/org/apache/syncope/console/wicket/markup/html/tree/TreeRolePanel.java b/console/src/main/java/org/apache/syncope/console/wicket/markup/html/tree/TreeRolePanel.java
index 830e31a..d860880 100644
--- a/console/src/main/java/org/apache/syncope/console/wicket/markup/html/tree/TreeRolePanel.java
+++ b/console/src/main/java/org/apache/syncope/console/wicket/markup/html/tree/TreeRolePanel.java
@@ -104,7 +104,7 @@ public class TreeRolePanel extends Panel {
 
         DefaultMutableTreeNodeExpansion.get().expandAll();
 
-        MetaDataRoleAuthorizationStrategy.authorize(tree, ENABLE, xmlRolesReader.getAllAllowedRoles("Roles", "read"));
+        MetaDataRoleAuthorizationStrategy.authorize(tree, ENABLE, xmlRolesReader.getEntitlement("Roles", "read"));
 
         treeContainer.addOrReplace(tree);
     }

http://git-wip-us.apache.org/repos/asf/syncope/blob/05d2985a/console/src/main/resources/applicationContext.xml
----------------------------------------------------------------------
diff --git a/console/src/main/resources/applicationContext.xml b/console/src/main/resources/applicationContext.xml
index be37d23..b58640b 100644
--- a/console/src/main/resources/applicationContext.xml
+++ b/console/src/main/resources/applicationContext.xml
@@ -63,10 +63,6 @@ under the License.
     <constructor-arg value="${licenseUrl}"/>
   </bean>
 
-  <bean id="authorizations" class="java.lang.String">
-    <constructor-arg value="authorizations.xml"/>
-  </bean>
-
   <bean id="syncopeApplication" class="org.apache.syncope.console.SyncopeApplication"/>
 
   <bean id="jacksonObjectMapper" class="org.codehaus.jackson.map.ObjectMapper"/>
@@ -133,7 +129,9 @@ under the License.
 
   <bean id="preferenceManager" class="org.apache.syncope.console.commons.PreferenceManager"/>
 
-  <bean id="xmlRolesReader" class="org.apache.syncope.console.commons.XMLRolesReader"/>
+  <bean id="xmlRolesReader" class="org.apache.syncope.console.commons.XMLRolesReader" scope="singleton">
+    <property name="authorizations" value="authorizations.xml"/>
+  </bean>
 
   <bean id="roleTreeBuilder" class="org.apache.syncope.console.commons.RoleTreeBuilder"/>
 


[6/8] [SYNCOPE-599] Merge from 1_1_X

Posted by il...@apache.org.
http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/panels/RoleSummaryPanel.java
----------------------------------------------------------------------

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/panels/RoleTabPanel.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/panels/RoleTabPanel.java
index 0cce34a,9debde4..10d739c
--- a/console/src/main/java/org/apache/syncope/console/pages/panels/RoleTabPanel.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/panels/RoleTabPanel.java
@@@ -109,7 -110,7 +109,7 @@@ public class RoleTabPanel extends Pane
  
                  window.show(target);
              }
-         }, ActionLink.ActionType.MANAGE_RESOURCES, xmlRolesReader.getAllAllowedRoles("Roles", "update"));
 -        }, ActionLink.ActionType.SEARCH, xmlRolesReader.getEntitlement("Roles", "update"));
++        }, ActionLink.ActionType.MANAGE_RESOURCES, xmlRolesReader.getEntitlement("Roles", "update"));
          links.addWithRoles(new ActionLink() {
  
              private static final long serialVersionUID = -3722207913631435501L;
@@@ -152,12 -154,12 +152,12 @@@
                      });
  
                      window.show(target);
 -                } catch (SyncopeClientCompositeErrorException scce) {
 -                    error(getString(Constants.OPERATION_ERROR) + ": " + scce.getMessage());
 -                    target.add(((Roles) pageRef.getPage()).getFeedbackPanel());
 +                } catch (SyncopeClientException e) {
 +                    error(getString(Constants.OPERATION_ERROR) + ": " + e.getMessage());
 +                    ((Roles) pageRef.getPage()).getFeedbackPanel().refresh(target);
                  }
              }
-         }, ActionLink.ActionType.DELETE, xmlRolesReader.getAllAllowedRoles("Roles", "delete"));
+         }, ActionLink.ActionType.DELETE, xmlRolesReader.getEntitlement("Roles", "delete"));
  
          final Form form = new Form("roleForm");
          form.setModel(new CompoundPropertyModel(selectedNode));

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/panels/SchedTasks.java
----------------------------------------------------------------------

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/wicket/markup/html/form/ActionLinksPanel.java
----------------------------------------------------------------------

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/resources/consoleContext.xml
----------------------------------------------------------------------
diff --cc console/src/main/resources/consoleContext.xml
index ded9983,0000000..91c884b
mode 100644,000000..100644
--- a/console/src/main/resources/consoleContext.xml
+++ b/console/src/main/resources/consoleContext.xml
@@@ -1,82 -1,0 +1,82 @@@
 +<?xml version="1.0" encoding="UTF-8"?>
 +<!--
 +Licensed to the Apache Software Foundation (ASF) under one
 +or more contributor license agreements.  See the NOTICE file
 +distributed with this work for additional information
 +regarding copyright ownership.  The ASF licenses this file
 +to you under the Apache License, Version 2.0 (the
 +"License"); you may not use this file except in compliance
 +with the License.  You may obtain a copy of the License at
 +
 +  http://www.apache.org/licenses/LICENSE-2.0
 +
 +Unless required by applicable law or agreed to in writing,
 +software distributed under the License is distributed on an
 +"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 +KIND, either express or implied.  See the License for the
 +specific language governing permissions and limitations
 +under the License.
 +-->
 +<beans xmlns="http://www.springframework.org/schema/beans"
 +       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 +       xmlns:context="http://www.springframework.org/schema/context"
 +       xmlns:cxf="http://cxf.apache.org/core"
 +       xsi:schemaLocation="http://www.springframework.org/schema/beans
 +                           http://www.springframework.org/schema/beans/spring-beans.xsd
 +                           http://www.springframework.org/schema/context
 +                           http://www.springframework.org/schema/context/spring-context.xsd
 +                           http://cxf.apache.org/core 
 +                           http://cxf.apache.org/schemas/core.xsd">
 +
 +  <context:component-scan base-package="org.apache.syncope.console.rest"/>
 +  <context:component-scan base-package="org.apache.syncope.console.init"/>
 +  <context:component-scan base-package="org.apache.syncope.console.preview"/>
 +
 +  <bean id="confDirectoryPropertyConfigurer" class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
 +    <property name="order" value="1"/>
 +    <property name="location" value="file:${conf.directory}/console.properties"/>
 +    <property name="ignoreResourceNotFound" value="true"/>
 +    <property name="ignoreUnresolvablePlaceholders" value="true"/>
 +  </bean>
 +  <bean id="classpathPropertyConfigurer" class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
 +    <property name="location" value="classpath:console.properties"/>
 +  </bean>
 +
 +  <bean id="version" class="java.lang.String">
 +    <constructor-arg value="${syncope.version}"/>
 +  </bean>
 +
 +  <bean id="site" class="java.lang.String">
 +    <constructor-arg value="${project.parent.url}"/>
 +  </bean>
 +  
 +  <bean id="license" class="java.lang.String">
 +    <constructor-arg value="${licenseUrl}"/>
 +  </bean>
 +  
 +  <bean id="anonymousUser" class="java.lang.String">
 +    <constructor-arg value="${anonymousUser}"/>
 +  </bean>
 +  <bean id="anonymousKey" class="java.lang.String">
 +    <constructor-arg value="${anonymousKey}"/>
 +  </bean>
 +
 +  <bean id="activitiModelerDirectory" class="java.lang.String">
 +    <constructor-arg value="${activitiModelerDirectory}"/>
 +  </bean>
 +
 +  <bean id="syncopeApplication" class="org.apache.syncope.console.SyncopeApplication"/>
 +
 +  <bean id="preferenceManager" class="org.apache.syncope.console.commons.PreferenceManager"/>
 +
-   <bean id="xmlRolesReader" class="org.apache.syncope.console.commons.XMLRolesReader">
++  <bean id="xmlRolesReader" class="org.apache.syncope.console.commons.XMLRolesReader" scope="singleton">
 +    <property name="authorizations" value="authorizations.xml"/>
 +  </bean>
 +
 +  <bean id="roleTreeBuilder" class="org.apache.syncope.console.commons.RoleTreeBuilder"/>
 +
 +  <bean id="syncopeClientFactory" class="org.apache.syncope.client.SyncopeClientFactoryBean">
 +    <property name="address" value="${scheme}://${host}:${port}/${rootPath}"/>
 +  </bean>
 +
 +</beans>


[7/8] git commit: [SYNCOPE-599] Merge from 1_1_X

Posted by il...@apache.org.
[SYNCOPE-599] Merge from 1_1_X


Project: http://git-wip-us.apache.org/repos/asf/syncope/repo
Commit: http://git-wip-us.apache.org/repos/asf/syncope/commit/f1607400
Tree: http://git-wip-us.apache.org/repos/asf/syncope/tree/f1607400
Diff: http://git-wip-us.apache.org/repos/asf/syncope/diff/f1607400

Branch: refs/heads/1_2_X
Commit: f1607400c4556a0d5581c37ac73a3401c3770311
Parents: 70b5340 05d2985
Author: Francesco Chicchiriccò <il...@apache.org>
Authored: Mon Nov 3 19:35:10 2014 +0100
Committer: Francesco Chicchiriccò <il...@apache.org>
Committed: Mon Nov 3 19:35:10 2014 +0100

----------------------------------------------------------------------
 .../syncope/console/SyncopeApplication.java     | 16 ++--
 .../syncope/console/commons/XMLRolesReader.java | 97 ++++++++++++--------
 .../pages/AbstractSchedTaskModalPage.java       |  4 +-
 .../console/pages/ApprovalModalPage.java        |  4 +-
 .../syncope/console/pages/ConfModalPage.java    |  6 +-
 .../syncope/console/pages/Configuration.java    | 25 +++--
 .../console/pages/ConnectorModalPage.java       |  4 +-
 .../console/pages/DerSchemaModalPage.java       |  4 +-
 .../console/pages/EditUserModalPage.java        |  2 +-
 .../console/pages/NotificationModalPage.java    |  4 +-
 .../syncope/console/pages/ReportModalPage.java  |  4 +-
 .../apache/syncope/console/pages/Reports.java   | 20 ++--
 .../console/pages/ResourceModalPage.java        |  6 +-
 .../apache/syncope/console/pages/Resources.java | 13 ++-
 .../syncope/console/pages/RoleModalPage.java    |  2 +-
 .../apache/syncope/console/pages/Schema.java    |  6 +-
 .../syncope/console/pages/SchemaModalPage.java  |  4 +-
 .../pages/SecurityQuestionModalPage.java        |  4 +-
 .../org/apache/syncope/console/pages/Todo.java  |  6 +-
 .../syncope/console/pages/UserModalPage.java    |  4 +-
 .../org/apache/syncope/console/pages/Users.java |  2 +-
 .../console/pages/VirSchemaModalPage.java       |  4 +-
 .../console/pages/XMLEditorPopupPage.java       |  6 +-
 .../pages/panels/AbstractSyncTasksPanel.java    |  2 +-
 .../console/pages/panels/PoliciesPanel.java     |  4 +-
 .../syncope/console/pages/panels/RolePanel.java |  2 +-
 .../console/pages/panels/RoleSummaryPanel.java  |  2 +-
 .../console/pages/panels/RoleTabPanel.java      |  8 +-
 .../console/pages/panels/SchedTasks.java        |  2 +-
 .../markup/html/form/ActionLinksPanel.java      |  4 +-
 .../wicket/markup/html/tree/TreeRolePanel.java  |  2 +-
 console/src/main/resources/consoleContext.xml   |  2 +-
 32 files changed, 147 insertions(+), 128 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/SyncopeApplication.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/SyncopeApplication.java
index f19bdac,0fbe521..c06831b
--- a/console/src/main/java/org/apache/syncope/console/SyncopeApplication.java
+++ b/console/src/main/java/org/apache/syncope/console/SyncopeApplication.java
@@@ -159,66 -112,63 +159,66 @@@ public class SyncopeApplicatio
          };
          page.add(infoLink);
  
 -        BookmarkablePageLink<Void> schemaLink = new BookmarkablePageLink<Void>("schema", Schema.class);
 -        MetaDataRoleAuthorizationStrategy.authorizeAll(schemaLink, WebPage.ENABLE);
 +        BookmarkablePageLink<Page> schemaLink = new BookmarkablePageLink<Page>("schema", Schema.class);
 +        MetaDataRoleAuthorizationStrategy.authorize(
-                 schemaLink, WebPage.ENABLE, xmlRolesReader.getAllAllowedRoles("Schema", "list"));
++                schemaLink, WebPage.ENABLE, xmlRolesReader.getEntitlement("Schema", "list"));
          page.add(schemaLink);
          schemaLink.add(new Image("schemaIcon", new ContextRelativeResource(IMG_PREFIX + (notsel
                  ? IMG_NOTSEL
                  : "") + "schema" + Constants.PNG_EXT)));
  
 -        BookmarkablePageLink<Void> usersLink = new BookmarkablePageLink<Void>("users", Users.class);
 -        String allowedUsersRoles = xmlRolesReader.getEntitlement("Users", "list");
 -        MetaDataRoleAuthorizationStrategy.authorize(usersLink, WebPage.ENABLE, allowedUsersRoles);
 +        BookmarkablePageLink<Page> usersLink = new BookmarkablePageLink<Page>("users", Users.class);
 +        MetaDataRoleAuthorizationStrategy.authorize(
-                 usersLink, WebPage.ENABLE, xmlRolesReader.getAllAllowedRoles("Users", "list"));
++                usersLink, WebPage.ENABLE, xmlRolesReader.getEntitlement("Users", "list"));
          page.add(usersLink);
          usersLink.add(new Image("usersIcon", new ContextRelativeResource(IMG_PREFIX + (notsel
                  ? IMG_NOTSEL
                  : "") + "users" + Constants.PNG_EXT)));
  
 -        BookmarkablePageLink<Void> rolesLink = new BookmarkablePageLink<Void>("roles", Roles.class);
 -        MetaDataRoleAuthorizationStrategy.authorizeAll(rolesLink, WebPage.ENABLE);
 +        BookmarkablePageLink<Page> rolesLink = new BookmarkablePageLink<Page>("roles", Roles.class);
 +        MetaDataRoleAuthorizationStrategy.authorize(
-                 rolesLink, WebPage.ENABLE, xmlRolesReader.getAllAllowedRoles("Roles", "list"));
++                rolesLink, WebPage.ENABLE, xmlRolesReader.getEntitlement("Roles", "list"));
          page.add(rolesLink);
          rolesLink.add(new Image("rolesIcon", new ContextRelativeResource(IMG_PREFIX + (notsel
                  ? IMG_NOTSEL
                  : "") + "roles" + Constants.PNG_EXT)));
  
 -        BookmarkablePageLink<Void> resourcesLink = new BookmarkablePageLink<Void>("resources", Resources.class);
 -        MetaDataRoleAuthorizationStrategy.authorizeAll(resourcesLink, WebPage.ENABLE);
 +        BookmarkablePageLink<Page> resourcesLink = new BookmarkablePageLink<Page>("resources", Resources.class);
 +        MetaDataRoleAuthorizationStrategy.authorize(
-                 resourcesLink, WebPage.ENABLE, xmlRolesReader.getAllAllowedRoles("Resources", "list"));
++                resourcesLink, WebPage.ENABLE, xmlRolesReader.getEntitlement("Resources", "list"));
          page.add(resourcesLink);
          resourcesLink.add(new Image("resourcesIcon", new ContextRelativeResource(IMG_PREFIX + (notsel
                  ? IMG_NOTSEL
                  : "") + "resources" + Constants.PNG_EXT)));
  
 -        BookmarkablePageLink<Void> todoLink = new BookmarkablePageLink<Void>("todo", Todo.class);
 -        MetaDataRoleAuthorizationStrategy.authorize(todoLink, WebPage.ENABLE, xmlRolesReader.getEntitlement(
 -                "Approval", "list"));
 +        BookmarkablePageLink<Page> todoLink = new BookmarkablePageLink<Page>("todo", Todo.class);
 +        MetaDataRoleAuthorizationStrategy.authorize(
-                 todoLink, WebPage.ENABLE, xmlRolesReader.getAllAllowedRoles("Approval", "list"));
++                todoLink, WebPage.ENABLE, xmlRolesReader.getEntitlement("Approval", "list"));
          page.add(todoLink);
          todoLink.add(new Image("todoIcon", new ContextRelativeResource(IMG_PREFIX + (notsel
                  ? IMG_NOTSEL
                  : "") + "todo" + Constants.PNG_EXT)));
  
 -        BookmarkablePageLink<Void> reportLink = new BookmarkablePageLink<Void>("reports", Reports.class);
 -        String allowedReportRoles = xmlRolesReader.getEntitlement("Reports", "list");
 -        MetaDataRoleAuthorizationStrategy.authorize(reportLink, WebPage.ENABLE, allowedReportRoles);
 +        BookmarkablePageLink<Page> reportLink = new BookmarkablePageLink<Page>("reports", Reports.class);
 +        MetaDataRoleAuthorizationStrategy.authorize(
-                 reportLink, WebPage.ENABLE, xmlRolesReader.getAllAllowedRoles("Reports", "list"));
++                reportLink, WebPage.ENABLE, xmlRolesReader.getEntitlement("Reports", "list"));
          page.add(reportLink);
          reportLink.add(new Image("reportsIcon", new ContextRelativeResource(IMG_PREFIX + (notsel
                  ? IMG_NOTSEL
                  : "") + "reports" + Constants.PNG_EXT)));
  
 -        BookmarkablePageLink<Void> configurationLink = new BookmarkablePageLink<Void>("configuration",
 +        BookmarkablePageLink<Page> configurationLink = new BookmarkablePageLink<Page>("configuration",
                  Configuration.class);
 -        String allowedConfigurationRoles = xmlRolesReader.getEntitlement("Configuration", "list");
 -        MetaDataRoleAuthorizationStrategy.authorize(configurationLink, WebPage.ENABLE, allowedConfigurationRoles);
 +        MetaDataRoleAuthorizationStrategy.authorize(
-                 configurationLink, WebPage.ENABLE, xmlRolesReader.getAllAllowedRoles("Configuration", "list"));
++                configurationLink, WebPage.ENABLE, xmlRolesReader.getEntitlement("Configuration", "list"));
          page.add(configurationLink);
          configurationLink.add(new Image("configurationIcon", new ContextRelativeResource(IMG_PREFIX + (notsel
                  ? IMG_NOTSEL
                  : "") + "configuration" + Constants.PNG_EXT)));
  
 -        BookmarkablePageLink<Void> taskLink = new BookmarkablePageLink<Void>("tasks", Tasks.class);
 -        String allowedTasksRoles = xmlRolesReader.getEntitlement("Tasks", "list");
 -        MetaDataRoleAuthorizationStrategy.authorize(taskLink, WebPage.ENABLE, allowedTasksRoles);
 +        BookmarkablePageLink<Page> taskLink = new BookmarkablePageLink<Page>("tasks", Tasks.class);
 +        MetaDataRoleAuthorizationStrategy.authorize(
-                 taskLink, WebPage.ENABLE, xmlRolesReader.getAllAllowedRoles("Tasks", "list"));
++                taskLink, WebPage.ENABLE, xmlRolesReader.getEntitlement("Tasks", "list"));
          page.add(taskLink);
          taskLink.add(new Image("tasksIcon", new ContextRelativeResource(IMG_PREFIX + (notsel
                  ? IMG_NOTSEL

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/AbstractSchedTaskModalPage.java
----------------------------------------------------------------------

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/ApprovalModalPage.java
----------------------------------------------------------------------

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/ConfModalPage.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/ConfModalPage.java
index fe72f87,0000000..99fcac6
mode 100644,000000..100644
--- a/console/src/main/java/org/apache/syncope/console/pages/ConfModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/ConfModalPage.java
@@@ -1,111 -1,0 +1,111 @@@
 +/*
 + * Licensed to the Apache Software Foundation (ASF) under one
 + * or more contributor license agreements.  See the NOTICE file
 + * distributed with this work for additional information
 + * regarding copyright ownership.  The ASF licenses this file
 + * to you under the Apache License, Version 2.0 (the
 + * "License"); you may not use this file except in compliance
 + * with the License.  You may obtain a copy of the License at
 + *
 + *   http://www.apache.org/licenses/LICENSE-2.0
 + *
 + * Unless required by applicable law or agreed to in writing,
 + * software distributed under the License is distributed on an
 + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 + * KIND, either express or implied.  See the License for the
 + * specific language governing permissions and limitations
 + * under the License.
 + */
 +package org.apache.syncope.console.pages;
 +
 +import java.util.Collections;
 +import org.apache.commons.lang3.StringUtils;
 +import org.apache.syncope.common.to.AttributeTO;
 +import org.apache.syncope.common.to.ConfTO;
 +import org.apache.syncope.console.commons.Constants;
 +import org.apache.syncope.console.commons.Mode;
 +import org.apache.syncope.console.pages.panels.AttributesPanel;
 +import org.apache.wicket.PageReference;
 +import org.apache.wicket.ajax.AjaxRequestTarget;
 +import org.apache.wicket.ajax.markup.html.form.AjaxButton;
 +import org.apache.wicket.authroles.authorization.strategies.role.metadata.MetaDataRoleAuthorizationStrategy;
 +import org.apache.wicket.extensions.ajax.markup.html.IndicatingAjaxButton;
 +import org.apache.wicket.extensions.ajax.markup.html.modal.ModalWindow;
 +import org.apache.wicket.markup.html.WebMarkupContainer;
 +import org.apache.wicket.markup.html.form.Form;
 +import org.apache.wicket.model.CompoundPropertyModel;
 +import org.apache.wicket.model.ResourceModel;
 +
 +public class ConfModalPage extends BaseModalPage {
 +
 +    private static final long serialVersionUID = 3524777398688399977L;
 +
 +    public ConfModalPage(final PageReference pageRef, final ModalWindow window, final WebMarkupContainer parameters) {
 +        super();
 +
 +        MetaDataRoleAuthorizationStrategy.authorize(
-                 parameters, ENABLE, xmlRolesReader.getAllAllowedRoles("Configuration", "list"));
++                parameters, ENABLE, xmlRolesReader.getEntitlement("Configuration", "list"));
 +        final ConfTO conf = confRestClient.list();
 +
 +        final Form<ConfTO> form = new Form<ConfTO>("confForm");
 +        form.setModel(new CompoundPropertyModel<ConfTO>(conf));
 +
 +        form.add(new AttributesPanel("paramAttrs", conf, form, Mode.ADMIN));
 +
 +        final AjaxButton submit = new IndicatingAjaxButton(SUBMIT, new ResourceModel(SUBMIT)) {
 +
 +            private static final long serialVersionUID = -958724007591692537L;
 +
 +            @Override
 +            protected void onSubmit(final AjaxRequestTarget target, final Form<?> form) {
 +                final ConfTO updatedConf = (ConfTO) form.getModelObject();
 +
 +                try {
 +                    for (AttributeTO attr : updatedConf.getAttrs()) {
 +                        if (attr.getValues().isEmpty()
 +                                || attr.getValues().equals(Collections.singletonList(StringUtils.EMPTY))) {
 +
 +                            confRestClient.delete(attr.getSchema());
 +                        } else {
 +                            confRestClient.set(attr);
 +                        }
 +                    }
 +
 +                    if (pageRef.getPage() instanceof BasePage) {
 +                        ((BasePage) pageRef.getPage()).setModalResult(true);
 +                    }
 +
 +                    window.close(target);
 +                } catch (Exception e) {
 +                    error(getString(Constants.ERROR) + ": " + e.getMessage());
 +                    feedbackPanel.refresh(target);
 +                }
 +            }
 +
 +            @Override
 +            protected void onError(final AjaxRequestTarget target, final Form<?> form) {
 +                feedbackPanel.refresh(target);
 +            }
 +        };
 +        MetaDataRoleAuthorizationStrategy.authorize(
-                 submit, ENABLE, xmlRolesReader.getAllAllowedRoles("Configuration", "set"));
++                submit, ENABLE, xmlRolesReader.getEntitlement("Configuration", "set"));
 +        MetaDataRoleAuthorizationStrategy.authorize(
-                 submit, ENABLE, xmlRolesReader.getAllAllowedRoles("Configuration", "delete"));
++                submit, ENABLE, xmlRolesReader.getEntitlement("Configuration", "delete"));
 +        form.add(submit);
 +        form.setDefaultButton(submit);
 +
 +        final AjaxButton cancel = new IndicatingAjaxButton(CANCEL, new ResourceModel(CANCEL)) {
 +
 +            private static final long serialVersionUID = -958724007591692537L;
 +
 +            @Override
 +            protected void onSubmit(final AjaxRequestTarget target, final Form<?> form) {
 +                window.close(target);
 +            }
 +        };
 +        cancel.setDefaultFormProcessing(false);
 +        form.add(cancel);
 +
 +        add(form);
 +    }
 +}

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/Configuration.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/Configuration.java
index 4851117,9e4c0fc..b2e5c07
--- a/console/src/main/java/org/apache/syncope/console/pages/Configuration.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/Configuration.java
@@@ -25,19 -26,13 +25,17 @@@ import java.util.Arrays
  import java.util.Collections;
  import java.util.Iterator;
  import java.util.List;
 -import org.apache.syncope.common.to.ConfigurationTO;
 +import org.apache.logging.log4j.LogManager;
 +import org.apache.logging.log4j.core.LoggerContext;
 +import org.apache.logging.log4j.core.config.LoggerConfig;
 +import org.apache.syncope.common.SyncopeClientException;
 +import org.apache.syncope.common.SyncopeConstants;
- import org.apache.syncope.common.to.AttributeTO;
- import org.apache.syncope.common.to.ConfTO;
  import org.apache.syncope.common.to.LoggerTO;
  import org.apache.syncope.common.to.NotificationTO;
 -import org.apache.syncope.common.to.WorkflowDefinitionTO;
 +import org.apache.syncope.common.to.SecurityQuestionTO;
 +import org.apache.syncope.console.commons.AttrLayoutType;
 +import org.apache.syncope.common.types.LoggerLevel;
  import org.apache.syncope.common.types.PolicyType;
 -import org.apache.syncope.common.types.SyncopeLoggerLevel;
 -import org.apache.syncope.common.validation.SyncopeClientCompositeErrorException;
  import org.apache.syncope.console.commons.Constants;
  import org.apache.syncope.console.commons.HttpResourceStream;
  import org.apache.syncope.console.commons.PreferenceManager;
@@@ -154,92 -142,50 +152,91 @@@ public class Configuration extends Base
          add(new PoliciesPanel("syncPoliciesPanel", getPageReference(), PolicyType.SYNC));
  
          add(createNotificationWin = new ModalWindow("createNotificationWin"));
 +        createNotificationWin.setCssClassName(ModalWindow.CSS_CLASS_GRAY);
 +        createNotificationWin.setInitialHeight(NOTIFICATION_WIN_HEIGHT);
 +        createNotificationWin.setInitialWidth(NOTIFICATION_WIN_WIDTH);
 +        createNotificationWin.setCookieName("create-notification-modal");
          add(editNotificationWin = new ModalWindow("editNotificationWin"));
 +        editNotificationWin.setCssClassName(ModalWindow.CSS_CLASS_GRAY);
 +        editNotificationWin.setInitialHeight(NOTIFICATION_WIN_HEIGHT);
 +        editNotificationWin.setInitialWidth(NOTIFICATION_WIN_WIDTH);
 +        editNotificationWin.setCookieName("edit-notification-modal");
          setupNotification();
  
 +        add(createSecurityQuestionWin = new ModalWindow("createSecurityQuestionWin"));
 +        createSecurityQuestionWin.setCssClassName(ModalWindow.CSS_CLASS_GRAY);
 +        createSecurityQuestionWin.setInitialHeight(SECURITY_QUESTION_WIN_HEIGHT);
 +        createSecurityQuestionWin.setInitialWidth(SECURITY_QUESTION_WIN_WIDTH);
 +        createSecurityQuestionWin.setCookieName("create-security-question-modal");
 +        add(editSecurityQuestionWin = new ModalWindow("editSecurityQuestionWin"));
 +        editSecurityQuestionWin.setCssClassName(ModalWindow.CSS_CLASS_GRAY);
 +        editSecurityQuestionWin.setInitialHeight(SECURITY_QUESTION_WIN_HEIGHT);
 +        editSecurityQuestionWin.setInitialWidth(SECURITY_QUESTION_WIN_WIDTH);
 +        editSecurityQuestionWin.setCookieName("edit-security-question-modal");
 +        setupSecurityQuestion();
 +
          // Workflow definition stuff
 -        final WorkflowDefinitionTO workflowDef = wfRestClient.getDefinition();
 +        WebMarkupContainer noActivitiEnabledForUsers = new WebMarkupContainer("noActivitiEnabledForUsers");
 +        noActivitiEnabledForUsers.setOutputMarkupPlaceholderTag(true);
 +        add(noActivitiEnabledForUsers);
  
          WebMarkupContainer workflowDefContainer = new WebMarkupContainer("workflowDefContainer");
 +        workflowDefContainer.setOutputMarkupPlaceholderTag(true);
  
 -        Form wfForm = new Form("workflowDefForm", new CompoundPropertyModel(workflowDef));
 +        if (wfRestClient.isActivitiEnabledForUsers()) {
 +            noActivitiEnabledForUsers.setVisible(false);
 +        } else {
 +            workflowDefContainer.setVisible(false);
 +        }
  
 -        TextArea<WorkflowDefinitionTO> workflowDefArea = new TextArea<WorkflowDefinitionTO>("workflowDefArea",
 -                new PropertyModel<WorkflowDefinitionTO>(workflowDef, "xmlDefinition"));
 -        wfForm.add(workflowDefArea);
 +        BookmarkablePageLink<Void> activitiModeler =
 +                new BookmarkablePageLink<Void>("activitiModeler", ActivitiModelerPopupPage.class);
 +        activitiModeler.setPopupSettings(new VeilPopupSettings().setHeight(600).setWidth(800));
 +        MetaDataRoleAuthorizationStrategy.authorize(activitiModeler, ENABLE,
-                 xmlRolesReader.getAllAllowedRoles("Configuration", "workflowDefRead"));
++                xmlRolesReader.getEntitlement("Configuration", "workflowDefRead"));
 +        workflowDefContainer.add(activitiModeler);
 +        // Check if Activiti Modeler directory is found
 +        boolean activitiModelerEnabled = false;
 +        try {
 +            String activitiModelerDirectory = WebApplicationContextUtils.getWebApplicationContext(
 +                    WebApplication.get().getServletContext()).getBean("activitiModelerDirectory", String.class);
 +            File baseDir = new File(activitiModelerDirectory);
 +            activitiModelerEnabled = baseDir.exists() && baseDir.canRead() && baseDir.isDirectory();
 +        } catch (Exception e) {
 +            LOG.error("Could not check for Activiti Modeler directory", e);
 +        }
 +        activitiModeler.setEnabled(activitiModelerEnabled);
  
 -        AjaxButton submit =
 -                new ClearIndicatingAjaxButton(APPLY, new Model<String>(getString(SUBMIT)), getPageReference()) {
 +        BookmarkablePageLink<Void> xmlEditor =
 +                new BookmarkablePageLink<Void>("xmlEditor", XMLEditorPopupPage.class);
 +        xmlEditor.setPopupSettings(new VeilPopupSettings().setHeight(480).setWidth(800));
 +        MetaDataRoleAuthorizationStrategy.authorize(xmlEditor, ENABLE,
-                 xmlRolesReader.getAllAllowedRoles("Configuration", "workflowDefRead"));
++                xmlRolesReader.getEntitlement("Configuration", "workflowDefRead"));
 +        workflowDefContainer.add(xmlEditor);
  
 -            private static final long serialVersionUID = -958724007591692537L;
 +        Image workflowDefDiagram = new Image("workflowDefDiagram", new Model()) {
  
 -            @Override
 -            protected void onSubmitInternal(final AjaxRequestTarget target, final Form<?> form) {
 -                try {
 -                    wfRestClient.updateDefinition(workflowDef);
 -                    info(getString(Constants.OPERATION_SUCCEEDED));
 -                } catch (SyncopeClientCompositeErrorException scee) {
 -                    error(getString(Constants.ERROR) + ":" + scee.getMessage());
 -                }
 -                target.add(feedbackPanel);
 -            }
 +            private static final long serialVersionUID = -8457850449086490660L;
  
              @Override
 -            protected void onError(final AjaxRequestTarget target, final Form<?> form) {
 -                target.add(feedbackPanel);
 -            }
 -        };
 +            protected IResource getImageResource() {
 +                return new DynamicImageResource() {
  
 -        MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, xmlRolesReader.getEntitlement("Configuration",
 -                "workflowDefUpdate"));
 -        wfForm.add(submit);
 +                    private static final long serialVersionUID = 923201517955737928L;
  
 -        workflowDefContainer.add(wfForm);
 +                    @Override
 +                    protected byte[] getImageData(final IResource.Attributes attributes) {
 +                        return wfRestClient.isActivitiEnabledForUsers()
 +                                ? wfRestClient.getDiagram()
 +                                : new byte[0];
 +                    }
 +                };
 +            }
- 
 +        };
 +        workflowDefContainer.add(workflowDefDiagram);
  
 -        MetaDataRoleAuthorizationStrategy.authorize(workflowDefContainer, ENABLE, xmlRolesReader.getEntitlement(
 -                "Configuration", "workflowDefRead"));
 +        MetaDataRoleAuthorizationStrategy.authorize(workflowDefContainer, ENABLE,
-                 xmlRolesReader.getAllAllowedRoles("Configuration", "workflowDefRead"));
++                xmlRolesReader.getEntitlement("Configuration", "workflowDefRead"));
          add(workflowDefContainer);
  
          // Logger stuff
@@@ -260,27 -206,106 +257,27 @@@
          consoleLoggerContainer.add(consoleLoggerList);
          consoleLoggerContainer.setOutputMarkupId(true);
  
-         MetaDataRoleAuthorizationStrategy.authorize(consoleLoggerContainer, ENABLE, xmlRolesReader.getAllAllowedRoles(
+         MetaDataRoleAuthorizationStrategy.authorize(consoleLoggerContainer, ENABLE, xmlRolesReader.getEntitlement(
                  "Configuration", "logList"));
          add(consoleLoggerContainer);
 +
 +        add(new LayoutsPanel("adminUserLayoutPanel", AttrLayoutType.ADMIN_USER, feedbackPanel));
 +        add(new LayoutsPanel("selfUserLayoutPanel", AttrLayoutType.SELF_USER, feedbackPanel));
 +        add(new LayoutsPanel("adminRoleLayoutPanel", AttrLayoutType.ADMIN_ROLE, feedbackPanel));
 +        add(new LayoutsPanel("selfRoleLayoutPanel", AttrLayoutType.SELF_ROLE, feedbackPanel));
 +        add(new LayoutsPanel("adminMembershipLayoutPanel", AttrLayoutType.ADMIN_MEMBERSHIP, feedbackPanel));
 +        add(new LayoutsPanel("selfMembershipLayoutPanel", AttrLayoutType.SELF_MEMBERSHIP, feedbackPanel));
      }
  
 +    @SuppressWarnings({ "unchecked", "rawtypes" })
      private void setupSyncopeConf() {
 -        confPaginatorRows = prefMan.getPaginatorRows(getRequest(), Constants.PREF_CONFIGURATION_PAGINATOR_ROWS);
 -
 -        final List<IColumn<ConfigurationTO, String>> confColumns = new ArrayList<IColumn<ConfigurationTO, String>>();
 -        confColumns.add(new PropertyColumn<ConfigurationTO, String>(new ResourceModel("key"), "key", "key"));
 -        confColumns.add(new PropertyColumn<ConfigurationTO, String>(new ResourceModel("value"), "value", "value"));
 -
 -        confColumns.add(new AbstractColumn<ConfigurationTO, String>(new ResourceModel("actions", "")) {
 -
 -            private static final long serialVersionUID = 2054811145491901166L;
 +        final WebMarkupContainer parameters = new WebMarkupContainer("parameters");
 +        parameters.setOutputMarkupId(true);
 +        add(parameters);
  
 -            @Override
 -            public String getCssClass() {
 -                return "action";
 -            }
 -
 -            @Override
 -            public void populateItem(final Item<ICellPopulator<ConfigurationTO>> cellItem, final String componentId,
 -                    final IModel<ConfigurationTO> model) {
 -
 -                final ConfigurationTO configurationTO = model.getObject();
 +        setWindowClosedCallback(syncopeConfWin, parameters);
  
 -                final ActionLinksPanel panel = new ActionLinksPanel(componentId, model, getPageReference());
 -
 -                panel.add(new ActionLink() {
 -
 -                    private static final long serialVersionUID = -3722207913631435501L;
 -
 -                    @Override
 -                    public void onClick(final AjaxRequestTarget target) {
 -
 -                        editConfigWin.setPageCreator(new ModalWindow.PageCreator() {
 -
 -                            private static final long serialVersionUID = -7834632442532690940L;
 -
 -                            @Override
 -                            public Page createPage() {
 -                                return new ConfigurationModalPage(Configuration.this.getPageReference(), editConfigWin,
 -                                        configurationTO, false);
 -                            }
 -                        });
 -
 -                        editConfigWin.show(target);
 -                    }
 -                }, ActionLink.ActionType.EDIT, "Configuration");
 -
 -                panel.add(new ActionLink() {
 -
 -                    private static final long serialVersionUID = -3722207913631435501L;
 -
 -                    @Override
 -                    public void onClick(final AjaxRequestTarget target) {
 -                        try {
 -                            confRestClient.deleteConfiguration(configurationTO.getKey());
 -                        } catch (SyncopeClientCompositeErrorException e) {
 -                            LOG.error("While deleting a conf key", e);
 -                            error(e.getMessage());
 -                            return;
 -                        }
 -
 -                        info(getString(Constants.OPERATION_SUCCEEDED));
 -                        target.add(feedbackPanel);
 -
 -                        target.add(confContainer);
 -                    }
 -                }, ActionLink.ActionType.DELETE, "Configuration");
 -
 -                cellItem.add(panel);
 -            }
 -        });
 -
 -        final AjaxFallbackDefaultDataTable<ConfigurationTO, String> confTable =
 -                new AjaxFallbackDefaultDataTable<ConfigurationTO, String>(
 -                "syncopeconf", confColumns, new SyncopeConfProvider(), confPaginatorRows);
 -
 -        confContainer = new WebMarkupContainer("confContainer");
 -        confContainer.add(confTable);
 -        confContainer.setOutputMarkupId(true);
 -
 -        add(confContainer);
 -
 -        createConfigWin.setCssClassName(ModalWindow.CSS_CLASS_GRAY);
 -        createConfigWin.setInitialHeight(CONFIG_WIN_HEIGHT);
 -        createConfigWin.setInitialWidth(CONFIG_WIN_WIDTH);
 -        createConfigWin.setCookieName("create-configuration-modal");
 -
 -        editConfigWin.setCssClassName(ModalWindow.CSS_CLASS_GRAY);
 -        editConfigWin.setInitialHeight(CONFIG_WIN_HEIGHT);
 -        editConfigWin.setInitialWidth(CONFIG_WIN_WIDTH);
 -        editConfigWin.setCookieName("edit-configuration-modal");
 -
 -        setWindowClosedCallback(createConfigWin, confContainer);
 -        setWindowClosedCallback(editConfigWin, confContainer);
 -
 -        AjaxLink createConfigurationLink = new AjaxLink("createConfigurationLink") {
 +        AjaxLink<Void> confLink = new IndicatingAjaxLink<Void>("confLink") {
  
              private static final long serialVersionUID = -7978723352517770644L;
  
@@@ -320,9 -350,32 +317,9 @@@
                  }
              }
          };
-         MetaDataRoleAuthorizationStrategy.authorize(dbExportLink, ENABLE, xmlRolesReader.getAllAllowedRoles(
-                 "Configuration", "export"));
 -
 -        MetaDataRoleAuthorizationStrategy.authorize(dbExportLink, ENABLE, xmlRolesReader.getEntitlement(
 -                "Configuration", "read"));
++        MetaDataRoleAuthorizationStrategy.authorize(
++                dbExportLink, ENABLE, xmlRolesReader.getEntitlement("Configuration", "export"));
          add(dbExportLink);
 -
 -        Form confPaginatorForm = new Form("confPaginatorForm");
 -
 -        final DropDownChoice rowsChooser = new DropDownChoice("rowsChooser", new PropertyModel(this,
 -                "confPaginatorRows"), prefMan.getPaginatorChoices());
 -
 -        rowsChooser.add(new AjaxFormComponentUpdatingBehavior(Constants.ON_CHANGE) {
 -
 -            private static final long serialVersionUID = -1107858522700306810L;
 -
 -            @Override
 -            protected void onUpdate(final AjaxRequestTarget target) {
 -                prefMan.set(getRequest(), getResponse(), Constants.PREF_CONFIGURATION_PAGINATOR_ROWS, String.valueOf(
 -                        confPaginatorRows));
 -                confTable.setItemsPerPage(confPaginatorRows);
 -
 -                target.add(confContainer);
 -            }
 -        });
 -
 -        confPaginatorForm.add(rowsChooser);
 -        add(confPaginatorForm);
      }
  
      private void setupNotification() {
@@@ -467,117 -529,7 +464,117 @@@
          add(notificationPaginatorForm);
      }
  
 -    private class SyncopeConfProvider extends SortableDataProvider<ConfigurationTO, String> {
 +    private void setupSecurityQuestion() {
 +        final List<IColumn<SecurityQuestionTO, String>> securityQuestionCols =
 +                new ArrayList<IColumn<SecurityQuestionTO, String>>();
 +        securityQuestionCols.add(new PropertyColumn<SecurityQuestionTO, String>(
 +                new ResourceModel("id"), "id", "id"));
 +        securityQuestionCols.add(new PropertyColumn<SecurityQuestionTO, String>(
 +                new ResourceModel("content"), "content", "content"));
 +
 +        securityQuestionCols.add(new AbstractColumn<SecurityQuestionTO, String>(new ResourceModel("actions", "")) {
 +
 +            private static final long serialVersionUID = 2054811145491901166L;
 +
 +            @Override
 +            public String getCssClass() {
 +                return "action";
 +            }
 +
 +            @Override
 +            public void populateItem(final Item<ICellPopulator<SecurityQuestionTO>> cellItem, final String componentId,
 +                    final IModel<SecurityQuestionTO> model) {
 +
 +                final SecurityQuestionTO securityQuestionTO = model.getObject();
 +
 +                final ActionLinksPanel panel = new ActionLinksPanel(componentId, model, getPageReference());
 +
 +                panel.add(new ActionLink() {
 +
 +                    private static final long serialVersionUID = -3722207913631435501L;
 +
 +                    @Override
 +                    public void onClick(final AjaxRequestTarget target) {
 +                        editSecurityQuestionWin.setPageCreator(new ModalWindow.PageCreator() {
 +
 +                            private static final long serialVersionUID = -7834632442532690940L;
 +
 +                            @Override
 +                            public Page createPage() {
 +                                return new SecurityQuestionModalPage(Configuration.this.getPageReference(),
 +                                        editSecurityQuestionWin, securityQuestionTO, false);
 +                            }
 +                        });
 +
 +                        editSecurityQuestionWin.show(target);
 +                    }
 +                }, ActionLink.ActionType.EDIT, "SecurityQuestion");
 +
 +                panel.add(new ActionLink() {
 +
 +                    private static final long serialVersionUID = -3722207913631435501L;
 +
 +                    @Override
 +                    public void onClick(final AjaxRequestTarget target) {
 +                        try {
 +                            securityQuestionRestClient.delete(securityQuestionTO.getId());
 +                        } catch (SyncopeClientException e) {
 +                            LOG.error("While deleting a security question", e);
 +                            error(e.getMessage());
 +                            return;
 +                        }
 +
 +                        info(getString(Constants.OPERATION_SUCCEEDED));
 +                        feedbackPanel.refresh(target);
 +                        target.add(securityQuestionContainer);
 +                    }
 +                }, ActionLink.ActionType.DELETE, "SecurityQuestion");
 +
 +                cellItem.add(panel);
 +            }
 +        });
 +
 +        final AjaxFallbackDefaultDataTable<SecurityQuestionTO, String> securityQuestionTable =
 +                new AjaxFallbackDefaultDataTable<SecurityQuestionTO, String>("securityQuestionTable",
 +                        securityQuestionCols, new SecurityQuestionProvider(), 50);
 +
 +        securityQuestionContainer = new WebMarkupContainer("securityQuestionContainer");
 +        securityQuestionContainer.add(securityQuestionTable);
 +        securityQuestionContainer.setOutputMarkupId(true);
 +
 +        add(securityQuestionContainer);
 +
 +        setWindowClosedCallback(createSecurityQuestionWin, securityQuestionContainer);
 +        setWindowClosedCallback(editSecurityQuestionWin, securityQuestionContainer);
 +
 +        AjaxLink<Void> createSecurityQuestionLink = new AjaxLink<Void>("createSecurityQuestionLink") {
 +
 +            private static final long serialVersionUID = -7978723352517770644L;
 +
 +            @Override
 +            public void onClick(final AjaxRequestTarget target) {
 +
 +                createSecurityQuestionWin.setPageCreator(new ModalWindow.PageCreator() {
 +
 +                    private static final long serialVersionUID = -7834632442532690940L;
 +
 +                    @Override
 +                    public Page createPage() {
 +                        return new SecurityQuestionModalPage(Configuration.this.getPageReference(),
 +                                createSecurityQuestionWin, new SecurityQuestionTO(), true);
 +                    }
 +                });
 +
 +                createSecurityQuestionWin.show(target);
 +            }
 +        };
 +
-         MetaDataRoleAuthorizationStrategy.authorize(createSecurityQuestionLink, ENABLE, xmlRolesReader.
-                 getAllAllowedRoles("SecurityQuestion", "create"));
++        MetaDataRoleAuthorizationStrategy.authorize(
++                createSecurityQuestionLink, ENABLE, xmlRolesReader.getEntitlement("SecurityQuestion", "create"));
 +        add(createSecurityQuestionLink);
 +    }
 +
 +    private class NotificationProvider extends SortableDataProvider<NotificationTO, String> {
  
          private static final long serialVersionUID = -276043813563988590L;
  

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/ConnectorModalPage.java
----------------------------------------------------------------------

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/DerSchemaModalPage.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/DerSchemaModalPage.java
index 31f8dfd,0000000..80a1b6c
mode 100644,000000..100644
--- a/console/src/main/java/org/apache/syncope/console/pages/DerSchemaModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/DerSchemaModalPage.java
@@@ -1,140 -1,0 +1,140 @@@
 +/*
 + * Licensed to the Apache Software Foundation (ASF) under one
 + * or more contributor license agreements.  See the NOTICE file
 + * distributed with this work for additional information
 + * regarding copyright ownership.  The ASF licenses this file
 + * to you under the Apache License, Version 2.0 (the
 + * "License"); you may not use this file except in compliance
 + * with the License.  You may obtain a copy of the License at
 + *
 + *   http://www.apache.org/licenses/LICENSE-2.0
 + *
 + * Unless required by applicable law or agreed to in writing,
 + * software distributed under the License is distributed on an
 + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 + * KIND, either express or implied.  See the License for the
 + * specific language governing permissions and limitations
 + * under the License.
 + */
 +package org.apache.syncope.console.pages;
 +
 +import org.apache.syncope.common.to.DerSchemaTO;
 +import org.apache.syncope.common.types.AttributableType;
 +import org.apache.syncope.common.SyncopeClientException;
 +import org.apache.syncope.console.commons.Constants;
 +import org.apache.syncope.console.commons.JexlHelpUtil;
 +import org.apache.syncope.console.wicket.markup.html.form.AjaxTextFieldPanel;
 +import org.apache.wicket.PageReference;
 +import org.apache.wicket.ajax.AjaxRequestTarget;
 +import org.apache.wicket.ajax.markup.html.AjaxLink;
 +import org.apache.wicket.ajax.markup.html.form.AjaxButton;
 +import org.apache.wicket.authroles.authorization.strategies.role.metadata.MetaDataRoleAuthorizationStrategy;
 +import org.apache.wicket.extensions.ajax.markup.html.IndicatingAjaxButton;
 +import org.apache.wicket.extensions.ajax.markup.html.modal.ModalWindow;
 +import org.apache.wicket.markup.html.WebMarkupContainer;
 +import org.apache.wicket.markup.html.form.Form;
 +import org.apache.wicket.model.CompoundPropertyModel;
 +import org.apache.wicket.model.PropertyModel;
 +import org.apache.wicket.model.ResourceModel;
 +
 +/**
 + * Modal window with Schema form.
 + */
 +public class DerSchemaModalPage extends AbstractSchemaModalPage<DerSchemaTO> {
 +
 +    private static final long serialVersionUID = 6668789770131753386L;
 +
 +    public DerSchemaModalPage(final AttributableType kind) {
 +        super(kind);
 +    }
 +
 +    @Override
 +    public void setSchemaModalPage(final PageReference pageRef, final ModalWindow window,
 +            DerSchemaTO schema, final boolean createFlag) {
 +
 +        if (schema == null) {
 +            schema = new DerSchemaTO();
 +        }
 +
 +        final Form<DerSchemaTO> schemaForm = new Form<DerSchemaTO>(FORM);
 +
 +        schemaForm.setModel(new CompoundPropertyModel<DerSchemaTO>(schema));
 +
 +        final AjaxTextFieldPanel name = new AjaxTextFieldPanel("name", getString("name"), new PropertyModel<String>(
 +                schema, "name"));
 +        name.addRequiredLabel();
 +
 +        final AjaxTextFieldPanel expression = new AjaxTextFieldPanel("expression", getString("expression"),
 +                new PropertyModel<String>(schema, "expression"));
 +        expression.addRequiredLabel();
 +
 +        final WebMarkupContainer jexlHelp = JexlHelpUtil.getJexlHelpWebContainer("jexlHelp");
 +
 +        final AjaxLink<Void> questionMarkJexlHelp = JexlHelpUtil.getAjaxLink(jexlHelp, "questionMarkJexlHelp");
 +        schemaForm.add(questionMarkJexlHelp);
 +        questionMarkJexlHelp.add(jexlHelp);
 +
 +        name.setEnabled(createFlag);
 +
 +        final AjaxButton submit = new IndicatingAjaxButton(APPLY, new ResourceModel(SUBMIT)) {
 +
 +            private static final long serialVersionUID = -958724007591692537L;
 +
 +            @Override
 +            protected void onSubmit(final AjaxRequestTarget target, final Form form) {
 +                DerSchemaTO schemaTO = (DerSchemaTO) form.getDefaultModelObject();
 +
 +                try {
 +                    if (createFlag) {
 +                        schemaRestClient.createDerSchema(kind, schemaTO);
 +                    } else {
 +                        schemaRestClient.updateDerSchema(kind, schemaTO);
 +                    }
 +
 +                    if (pageRef.getPage() instanceof BasePage) {
 +                        ((BasePage) pageRef.getPage()).setModalResult(true);
 +                    }
 +
 +                    window.close(target);
 +                } catch (SyncopeClientException e) {
 +                    error(getString(Constants.ERROR) + ": " + e.getMessage());
 +                    feedbackPanel.refresh(target);
 +                }
 +            }
 +
 +            @Override
 +            protected void onError(final AjaxRequestTarget target, final Form<?> form) {
 +                feedbackPanel.refresh(target);
 +            }
 +        };
 +
 +        final AjaxButton cancel = new IndicatingAjaxButton(CANCEL, new ResourceModel(CANCEL)) {
 +
 +            private static final long serialVersionUID = -958724007591692537L;
 +
 +            @Override
 +            protected void onSubmit(final AjaxRequestTarget target, final Form<?> form) {
 +                window.close(target);
 +            }
 +        };
 +
 +        cancel.setDefaultFormProcessing(
 +                false);
 +
 +        String allowedRoles = createFlag
-                 ? xmlRolesReader.getAllAllowedRoles("Schema", "create")
-                 : xmlRolesReader.getAllAllowedRoles("Schema", "update");
++                ? xmlRolesReader.getEntitlement("Schema", "create")
++                : xmlRolesReader.getEntitlement("Schema", "update");
 +
 +        MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, allowedRoles);
 +
 +        schemaForm.add(name);
 +
 +        schemaForm.add(expression);
 +
 +        schemaForm.add(submit);
 +
 +        schemaForm.add(cancel);
 +
 +        add(schemaForm);
 +    }
 +}

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/EditUserModalPage.java
----------------------------------------------------------------------

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/NotificationModalPage.java
----------------------------------------------------------------------

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/ReportModalPage.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/ReportModalPage.java
index d751ff8,d76400b..ea73e9e
--- a/console/src/main/java/org/apache/syncope/console/pages/ReportModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/ReportModalPage.java
@@@ -158,11 -161,11 +158,11 @@@ public class ReportModalPage extends Ba
                  };
  
          if (reportTO.getId() > 0) {
 -            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER, xmlRolesReader.getEntitlement("Reports",
 -                    "update"));
 +            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER,
-                     xmlRolesReader.getAllAllowedRoles("Reports", "update"));
++                    xmlRolesReader.getEntitlement("Reports", "update"));
          } else {
 -            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER, xmlRolesReader.getEntitlement("Reports",
 -                    "create"));
 +            MetaDataRoleAuthorizationStrategy.authorize(submit, RENDER,
-                     xmlRolesReader.getAllAllowedRoles("Reports", "create"));
++                    xmlRolesReader.getEntitlement("Reports", "create"));
          }
  
          form.add(submit);

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/Reports.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/Reports.java
index b47e434,789e37e..3f09762
--- a/console/src/main/java/org/apache/syncope/console/pages/Reports.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/Reports.java
@@@ -109,8 -110,8 +109,8 @@@ public class Reports extends BasePage 
          reportContainer = new WebMarkupContainer("reportContainer");
          setWindowClosedCallback(window, reportContainer);
  
 -        MetaDataRoleAuthorizationStrategy.authorize(reportContainer, RENDER, xmlRolesReader.getEntitlement(
 -                "Reports", "list"));
 +        MetaDataRoleAuthorizationStrategy.authorize(reportContainer, RENDER,
-                 xmlRolesReader.getAllAllowedRoles("Reports", "list"));
++                xmlRolesReader.getEntitlement("Reports", "list"));
  
          paginatorRows = prefMan.getPaginatorRows(getRequest(), Constants.PREF_REPORT_PAGINATOR_ROWS);
  
@@@ -222,13 -221,11 +222,13 @@@
  
          add(reportContainer);
  
 +        @SuppressWarnings("rawtypes")
          Form paginatorForm = new Form("paginatorForm");
  
 -        MetaDataRoleAuthorizationStrategy.authorize(paginatorForm, RENDER, xmlRolesReader.getEntitlement("Reports",
 -                "list"));
 +        MetaDataRoleAuthorizationStrategy.authorize(paginatorForm, RENDER,
-                 xmlRolesReader.getAllAllowedRoles("Reports", "list"));
++                xmlRolesReader.getEntitlement("Reports", "list"));
  
 +        @SuppressWarnings({ "unchecked", "rawtypes" })
          final DropDownChoice rowsChooser = new DropDownChoice("rowsChooser", new PropertyModel(this, "paginatorRows"),
                  prefMan.getPaginatorChoices());
  
@@@ -338,7 -335,7 +338,7 @@@
                                              eventCategory.getKey().getCategory(),
                                              eventCategory.getKey().getSubcategory(),
                                              CollectionUtils.isEmpty(eventCategory.getKey().getEvents())
--                                            ? null : eventCategory.getKey().getEvents().iterator().next(),
++                                                    ? null : eventCategory.getKey().getEvents().iterator().next(),
                                              eventCategory.getValue());
  
                                      loggerRestClient.disableAudit(auditLoggerName);
@@@ -356,7 -353,7 +356,7 @@@
                                              eventCategory.getKey().getCategory(),
                                              eventCategory.getKey().getSubcategory(),
                                              CollectionUtils.isEmpty(eventCategory.getKey().getEvents())
--                                            ? null : eventCategory.getKey().getEvents().iterator().next(),
++                                                    ? null : eventCategory.getKey().getEvents().iterator().next(),
                                              eventCategory.getValue());
  
                                      loggerRestClient.enableAudit(auditLoggerName);
@@@ -384,10 -381,7 +384,10 @@@
  
          @Override
          public Iterator<ReportTO> iterator(final long first, final long count) {
 -            final List<ReportTO> list = reportRestClient.list(((int) first / paginatorRows) + 1, paginatorRows);
 +            final int page = ((int) first / paginatorRows);
-             
++
 +            final List<ReportTO> list =
 +                    reportRestClient.list((page < 0 ? 0 : page) + 1, paginatorRows, getSort());
              Collections.sort(list, comparator);
              return list.iterator();
          }

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/ResourceModalPage.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/ResourceModalPage.java
index 5768d71,ea58648..1c93fd1
--- a/console/src/main/java/org/apache/syncope/console/pages/ResourceModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/ResourceModalPage.java
@@@ -81,12 -77,9 +81,12 @@@ public class ResourceModalPage extends 
          //--------------------------------
  
          //--------------------------------
 -        // Resource mapping panel
 +        // Resource connector configuration panel
          //--------------------------------
 -        form.add(new ResourceConnConfPanel("connconf", resourceTO, createFlag));
 +        ResourceConnConfPanel resourceConnConfPanel = new ResourceConnConfPanel("connconf", resourceTO, createFlag);
-         MetaDataRoleAuthorizationStrategy.authorize(resourceConnConfPanel, ENABLE,
-                 xmlRolesReader.getAllAllowedRoles("Connectors", "read"));
++        MetaDataRoleAuthorizationStrategy.authorize(
++                resourceConnConfPanel, ENABLE, xmlRolesReader.getEntitlement("Connectors", "read"));
 +        form.add(resourceConnConfPanel);
          //--------------------------------
  
          //--------------------------------
@@@ -180,10 -173,10 +180,10 @@@
  
          add(form);
  
-         MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, xmlRolesReader.getAllAllowedRoles("Resources",
+         MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, xmlRolesReader.getEntitlement("Resources",
                  createFlag
 -                ? "create"
 -                : "update"));
 +                        ? "create"
 +                        : "update"));
      }
  
      /**

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/Resources.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/Resources.java
index 12f0f80,89aa1ba..f1bd39b
--- a/console/src/main/java/org/apache/syncope/console/pages/Resources.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/Resources.java
@@@ -573,45 -476,40 +572,45 @@@ public class Resources extends BasePag
          editConnectorWin.setInitialWidth(WIN_WIDTH);
          editConnectorWin.setCookieName("edit-conn-modal");
  
 -        AjaxLink createConnectorLink = new ClearIndicatingAjaxLink("createConnectorLink", getPageReference()) {
 +        AjaxLink<Void> createConnectorLink =
 +                new ClearIndicatingAjaxLink<Void>("createConnectorLink", getPageReference()) {
  
 -            private static final long serialVersionUID = -7978723352517770644L;
 +                    private static final long serialVersionUID = -7978723352517770644L;
  
 -            @Override
 -            protected void onClickInternal(final AjaxRequestTarget target) {
 -                createConnectorWin.setPageCreator(new ModalWindow.PageCreator() {
 +                    @Override
 +                    protected void onClickInternal(final AjaxRequestTarget target) {
 +                        createConnectorWin.setPageCreator(new ModalWindow.PageCreator() {
  
 -                    private static final long serialVersionUID = -7834632442532690940L;
 +                            private static final long serialVersionUID = -7834632442532690940L;
  
 -                    @Override
 -                    public Page createPage() {
 -                        ConnectorModalPage form = new ConnectorModalPage(Resources.this.getPageReference(),
 -                                editConnectorWin, new ConnInstanceTO());
 -                        return form;
 -                    }
 -                });
 +                            @Override
 +                            public Page createPage() {
 +                                ConnectorModalPage form = new ConnectorModalPage(Resources.this.getPageReference(),
 +                                        editConnectorWin, new ConnInstanceTO());
 +                                return form;
 +                            }
 +                        });
  
 -                createConnectorWin.show(target);
 -            }
 -        };
 +                        createConnectorWin.show(target);
 +                    }
 +                };
  
-         MetaDataRoleAuthorizationStrategy.authorize(createConnectorLink, ENABLE, xmlRolesReader.getAllAllowedRoles(
+         MetaDataRoleAuthorizationStrategy.authorize(createConnectorLink, ENABLE, xmlRolesReader.getEntitlement(
                  "Connectors", "create"));
  
          add(createConnectorLink);
  
 +        @SuppressWarnings("rawtypes")
          Form paginatorForm = new Form("connectorPaginatorForm");
  
-         MetaDataRoleAuthorizationStrategy.authorize(paginatorForm, RENDER, xmlRolesReader.getAllAllowedRoles(
+         MetaDataRoleAuthorizationStrategy.authorize(paginatorForm, RENDER, xmlRolesReader.getEntitlement(
                  "Connectors", "list"));
  
 -        final DropDownChoice rowsChooser = new DropDownChoice("rowsChooser", new PropertyModel(this,
 -                "connectorPaginatorRows"), prefMan.getPaginatorChoices());
 +        final DropDownChoice<Integer> rowsChooser = new DropDownChoice<Integer>(
 +                "rowsChooser",
 +                new PropertyModel<Integer>(this,
 +                        "connectorPaginatorRows"),
 +                prefMan.getPaginatorChoices());
  
          rowsChooser.add(new AjaxFormComponentUpdatingBehavior(Constants.ON_CHANGE) {
  

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/RoleModalPage.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/RoleModalPage.java
index 095399b,2495421..7ef25a6
--- a/console/src/main/java/org/apache/syncope/console/pages/RoleModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/RoleModalPage.java
@@@ -122,13 -133,18 +122,13 @@@ public class RoleModalPage extends Base
                  closeAction(target, form);
              }
          };
 -
          cancel.setDefaultFormProcessing(false);
 +        form.add(cancel);
  
-         MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, xmlRolesReader.getAllAllowedRoles("Roles",
+         MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, xmlRolesReader.getEntitlement("Roles",
                  createFlag
 -                ? "create"
 -                : "update"));
 -
 -        form.add(submit);
 -        form.setDefaultButton(submit);
 -
 -        form.add(cancel);
 +                        ? "create"
 +                        : "update"));
  
          add(form);
      }

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/Schema.java
----------------------------------------------------------------------

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/SchemaModalPage.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/SchemaModalPage.java
index 4ab30e2,aedba1d..1e634f0
--- a/console/src/main/java/org/apache/syncope/console/pages/SchemaModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/SchemaModalPage.java
@@@ -286,12 -272,12 +286,12 @@@ public class SchemaModalPage extends Ab
                  window.close(target);
              }
          };
 -
          cancel.setDefaultFormProcessing(false);
 +        schemaForm.add(cancel);
  
          String allowedRoles = createFlag
-                 ? xmlRolesReader.getAllAllowedRoles("Schema", "create")
-                 : xmlRolesReader.getAllAllowedRoles("Schema", "update");
+                 ? xmlRolesReader.getEntitlement("Schema", "create")
+                 : xmlRolesReader.getEntitlement("Schema", "update");
  
          MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, allowedRoles);
  

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/SecurityQuestionModalPage.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/SecurityQuestionModalPage.java
index 743bcf2,0000000..c9cd4c7
mode 100644,000000..100644
--- a/console/src/main/java/org/apache/syncope/console/pages/SecurityQuestionModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/SecurityQuestionModalPage.java
@@@ -1,113 -1,0 +1,113 @@@
 +/*
 + * Licensed to the Apache Software Foundation (ASF) under one
 + * or more contributor license agreements.  See the NOTICE file
 + * distributed with this work for additional information
 + * regarding copyright ownership.  The ASF licenses this file
 + * to you under the Apache License, Version 2.0 (the
 + * "License"); you may not use this file except in compliance
 + * with the License.  You may obtain a copy of the License at
 + *
 + *   http://www.apache.org/licenses/LICENSE-2.0
 + *
 + * Unless required by applicable law or agreed to in writing,
 + * software distributed under the License is distributed on an
 + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 + * KIND, either express or implied.  See the License for the
 + * specific language governing permissions and limitations
 + * under the License.
 + */
 +package org.apache.syncope.console.pages;
 +
 +import static org.apache.syncope.console.pages.AbstractBasePage.FORM;
 +
 +import org.apache.syncope.common.SyncopeClientException;
 +import org.apache.syncope.common.to.SecurityQuestionTO;
 +import org.apache.syncope.console.commons.Constants;
 +import org.apache.syncope.console.rest.SecurityQuestionRestClient;
 +import org.apache.syncope.console.wicket.markup.html.form.AjaxTextFieldPanel;
 +import org.apache.wicket.PageReference;
 +import org.apache.wicket.ajax.AjaxRequestTarget;
 +import org.apache.wicket.ajax.markup.html.form.AjaxButton;
 +import org.apache.wicket.authroles.authorization.strategies.role.metadata.MetaDataRoleAuthorizationStrategy;
 +import org.apache.wicket.extensions.ajax.markup.html.IndicatingAjaxButton;
 +import org.apache.wicket.extensions.ajax.markup.html.modal.ModalWindow;
 +import org.apache.wicket.markup.html.form.Form;
 +import org.apache.wicket.model.CompoundPropertyModel;
 +import org.apache.wicket.model.Model;
 +import org.apache.wicket.model.PropertyModel;
 +import org.apache.wicket.model.ResourceModel;
 +import org.apache.wicket.spring.injection.annot.SpringBean;
 +
 +class SecurityQuestionModalPage extends BaseModalPage {
 +
 +    private static final long serialVersionUID = -6709838862698327502L;
 +
 +    @SpringBean
 +    private SecurityQuestionRestClient restClient;
 +
 +    public SecurityQuestionModalPage(final PageReference pageRef, final ModalWindow window,
 +            final SecurityQuestionTO securityQuestionTO, final boolean createFlag) {
 +
 +        final Form<SecurityQuestionTO> form =
 +                new Form<SecurityQuestionTO>(FORM, new CompoundPropertyModel<SecurityQuestionTO>(securityQuestionTO));
 +
 +        final AjaxTextFieldPanel contentFieldPanel =
 +                new AjaxTextFieldPanel("content", "content", new PropertyModel<String>(securityQuestionTO, "content"));
 +        contentFieldPanel.setRequired(true);
 +        form.add(contentFieldPanel);
 +
 +        AjaxButton submit = new IndicatingAjaxButton(APPLY, new Model<String>(getString(SUBMIT))) {
 +
 +            private static final long serialVersionUID = -958724007591692537L;
 +
 +            @Override
 +            protected void onSubmit(final AjaxRequestTarget target, final Form<?> form) {
 +                try {
 +                    if (createFlag) {
 +                        restClient.create(securityQuestionTO);
 +                    } else {
 +                        restClient.update(securityQuestionTO);
 +                    }
 +                    info(getString(Constants.OPERATION_SUCCEEDED));
 +
 +                    Configuration callerPage = (Configuration) pageRef.getPage();
 +                    callerPage.setModalResult(true);
 +
 +                    window.close(target);
 +                } catch (SyncopeClientException scee) {
 +                    error(getString(Constants.ERROR) + ": " + scee.getMessage());
 +                    feedbackPanel.refresh(target);
 +                }
 +            }
 +
 +            @Override
 +            protected void onError(final AjaxRequestTarget target, final Form<?> form) {
 +                feedbackPanel.refresh(target);
 +            }
 +        };
 +
 +        final AjaxButton cancel = new IndicatingAjaxButton(CANCEL, new ResourceModel(CANCEL)) {
 +
 +            private static final long serialVersionUID = -958724007591692537L;
 +
 +            @Override
 +            protected void onSubmit(final AjaxRequestTarget target, final Form<?> form) {
 +                window.close(target);
 +            }
 +        };
 +
 +        cancel.setDefaultFormProcessing(false);
 +
 +        String allowedRoles = createFlag
-                 ? xmlRolesReader.getAllAllowedRoles("SecurityQuestion", "create")
-                 : xmlRolesReader.getAllAllowedRoles("SecurityQuestion", "update");
++                ? xmlRolesReader.getEntitlement("SecurityQuestion", "create")
++                : xmlRolesReader.getEntitlement("SecurityQuestion", "update");
 +        MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, allowedRoles);
 +
 +        form.add(submit);
 +        form.setDefaultButton(submit);
 +
 +        form.add(cancel);
 +
 +        add(form);
 +    }
 +}

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/Todo.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/Todo.java
index cf57664,06dd6f0..6ddbed9
--- a/console/src/main/java/org/apache/syncope/console/pages/Todo.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/Todo.java
@@@ -78,27 -95,28 +78,27 @@@ public class Todo extends BasePage 
      public Todo(final PageParameters parameters) {
          super(parameters);
  
 -        add(editApprovalWin = new ModalWindow("editApprovalWin"));
 -        add(editUserRequestWin = new ModalWindow("editUserRequestWin"));
 +        add(window = new ModalWindow("editApprovalWin"));
  
 -        setupApproval();
 -        setupUserRequest();
 -    }
 -
 -    private void setupApproval() {
 -        approvalContainer = new WebMarkupContainer("approvalContainer");
 +        container = new WebMarkupContainer("approvalContainer");
  
-         MetaDataRoleAuthorizationStrategy.authorize(container, RENDER,
-                 xmlRolesReader.getAllAllowedRoles("Approval", "list"));
 -        MetaDataRoleAuthorizationStrategy.authorize(approvalContainer, RENDER, xmlRolesReader.getEntitlement(
 -                "Approval", "list"));
++        MetaDataRoleAuthorizationStrategy.authorize(
++                container, RENDER, xmlRolesReader.getEntitlement("Approval", "list"));
  
 -        approvalPaginatorRows = prefMan.getPaginatorRows(getRequest(), Constants.PREF_APPROVAL_PAGINATOR_ROWS);
 +        paginatorRows = prefMan.getPaginatorRows(getRequest(), Constants.PREF_TODO_PAGINATOR_ROWS);
  
 -        List<IColumn> columns = new ArrayList<IColumn>();
 -        columns.add(new PropertyColumn(new ResourceModel("taskId"), "taskId", "taskId"));
 -        columns.add(new PropertyColumn(new ResourceModel("key"), "key", "key"));
 -        columns.add(new PropertyColumn(new ResourceModel("description"), "description", "description"));
 -        columns.add(new DatePropertyColumn(new ResourceModel("createTime"), "createTime", "createTime"));
 -        columns.add(new DatePropertyColumn(new ResourceModel("dueDate"), "dueDate", "dueDate"));
 -        columns.add(new PropertyColumn(new ResourceModel("owner"), "owner", "owner"));
 +        List<IColumn<WorkflowFormTO, String>> columns = new ArrayList<IColumn<WorkflowFormTO, String>>();
 +        columns.add(new PropertyColumn<WorkflowFormTO, String>(
 +                new ResourceModel("taskId"), "taskId", "taskId"));
 +        columns.add(new PropertyColumn<WorkflowFormTO, String>(
 +                new ResourceModel("key"), "key", "key"));
 +        columns.add(new PropertyColumn<WorkflowFormTO, String>(
 +                new ResourceModel("description"), "description", "description"));
 +        columns.add(new DatePropertyColumn<WorkflowFormTO>(
 +                new ResourceModel("createTime"), "createTime", "createTime"));
 +        columns.add(new DatePropertyColumn<WorkflowFormTO>(
 +                new ResourceModel("dueDate"), "dueDate", "dueDate"));
 +        columns.add(new PropertyColumn<WorkflowFormTO, String>(new ResourceModel("owner"), "owner", "owner"));
          columns.add(new AbstractColumn<WorkflowFormTO, String>(new ResourceModel("actions", "")) {
  
              private static final long serialVersionUID = 2054811145491901166L;
@@@ -158,23 -176,21 +158,23 @@@
              }
          });
  
 -        final AjaxFallbackDefaultDataTable approvalTable = new AjaxFallbackDefaultDataTable("approvalTable", columns,
 -                new ApprovalProvider(), approvalPaginatorRows);
 +        final AjaxFallbackDefaultDataTable<WorkflowFormTO, String> approvalTable =
 +                new AjaxFallbackDefaultDataTable<WorkflowFormTO, String>(
 +                        "approvalTable", columns, new ApprovalProvider(), paginatorRows);
 +        container.add(approvalTable);
  
 -        approvalContainer.add(approvalTable);
 -        approvalContainer.setOutputMarkupId(true);
 +        container.setOutputMarkupId(true);
 +        add(container);
  
 -        add(approvalContainer);
 +        @SuppressWarnings("rawtypes")
 +        Form approvalPaginatorForm = new Form("paginatorForm");
  
 -        Form approvalPaginatorForm = new Form("approvalPaginatorForm");
 +        MetaDataRoleAuthorizationStrategy.authorize(approvalPaginatorForm, RENDER,
-                 xmlRolesReader.getAllAllowedRoles("Approval", "list"));
++                xmlRolesReader.getEntitlement("Approval", "list"));
  
 -        MetaDataRoleAuthorizationStrategy.authorize(approvalPaginatorForm, RENDER, xmlRolesReader.getEntitlement(
 -                "Approval", "list"));
 -
 -        final DropDownChoice rowsChooser = new DropDownChoice("rowsChooser", new PropertyModel(this,
 -                "approvalPaginatorRows"), prefMan.getPaginatorChoices());
 +        @SuppressWarnings({ "unchecked", "rawtypes" })
 +        final DropDownChoice rowsChooser = new DropDownChoice("rowsChooser",
 +                new PropertyModel(this, "paginatorRows"), prefMan.getPaginatorChoices());
  
          rowsChooser.add(new AjaxFormComponentUpdatingBehavior(Constants.ON_CHANGE) {
  

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/UserModalPage.java
----------------------------------------------------------------------

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/Users.java
----------------------------------------------------------------------

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/VirSchemaModalPage.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/VirSchemaModalPage.java
index 5eb48fe,0000000..9ca0c42
mode 100644,000000..100644
--- a/console/src/main/java/org/apache/syncope/console/pages/VirSchemaModalPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/VirSchemaModalPage.java
@@@ -1,126 -1,0 +1,126 @@@
 +/*
 + * Licensed to the Apache Software Foundation (ASF) under one
 + * or more contributor license agreements.  See the NOTICE file
 + * distributed with this work for additional information
 + * regarding copyright ownership.  The ASF licenses this file
 + * to you under the Apache License, Version 2.0 (the
 + * "License"); you may not use this file except in compliance
 + * with the License.  You may obtain a copy of the License at
 + *
 + *   http://www.apache.org/licenses/LICENSE-2.0
 + *
 + * Unless required by applicable law or agreed to in writing,
 + * software distributed under the License is distributed on an
 + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 + * KIND, either express or implied.  See the License for the
 + * specific language governing permissions and limitations
 + * under the License.
 + */
 +package org.apache.syncope.console.pages;
 +
 +import org.apache.syncope.common.to.VirSchemaTO;
 +import org.apache.syncope.common.types.AttributableType;
 +import org.apache.syncope.common.SyncopeClientException;
 +import org.apache.syncope.console.commons.Constants;
 +import org.apache.syncope.console.wicket.markup.html.form.AjaxCheckBoxPanel;
 +import org.apache.syncope.console.wicket.markup.html.form.AjaxTextFieldPanel;
 +import org.apache.wicket.PageReference;
 +import org.apache.wicket.ajax.AjaxRequestTarget;
 +import org.apache.wicket.ajax.markup.html.form.AjaxButton;
 +import org.apache.wicket.authroles.authorization.strategies.role.metadata.MetaDataRoleAuthorizationStrategy;
 +import org.apache.wicket.extensions.ajax.markup.html.IndicatingAjaxButton;
 +import org.apache.wicket.extensions.ajax.markup.html.modal.ModalWindow;
 +import org.apache.wicket.markup.html.form.Form;
 +import org.apache.wicket.model.CompoundPropertyModel;
 +import org.apache.wicket.model.PropertyModel;
 +import org.apache.wicket.model.ResourceModel;
 +
 +/**
 + * Modal window with Schema form.
 + */
 +public class VirSchemaModalPage extends AbstractSchemaModalPage<VirSchemaTO> {
 +
 +    private static final long serialVersionUID = 5979623248182851337L;
 +
 +    public VirSchemaModalPage(final AttributableType kind) {
 +        super(kind);
 +    }
 +
 +    @Override
 +    public void setSchemaModalPage(final PageReference pageRef, final ModalWindow window,
 +            VirSchemaTO schema, final boolean createFlag) {
 +
 +        if (schema == null) {
 +            schema = new VirSchemaTO();
 +        }
 +
 +        final Form<VirSchemaTO> schemaForm = new Form<VirSchemaTO>(FORM);
 +
 +        schemaForm.setModel(new CompoundPropertyModel<VirSchemaTO>(schema));
 +
 +        final AjaxTextFieldPanel name = new AjaxTextFieldPanel("name", getString("name"), new PropertyModel<String>(
 +                schema, "name"));
 +        name.addRequiredLabel();
 +
 +        name.setEnabled(createFlag);
 +
 +        final AjaxCheckBoxPanel readonly = new AjaxCheckBoxPanel("readonly", getString("readonly"),
 +                new PropertyModel<Boolean>(schema, "readonly"));
 +
 +        final AjaxButton submit = new IndicatingAjaxButton(APPLY, new ResourceModel(SUBMIT)) {
 +
 +            private static final long serialVersionUID = -958724007591692537L;
 +
 +            @Override
 +            protected void onSubmit(final AjaxRequestTarget target, final Form<?> form) {
 +                VirSchemaTO schemaTO = (VirSchemaTO) form.getDefaultModelObject();
 +                try {
 +                    if (createFlag) {
 +                        schemaRestClient.createVirSchema(kind, schemaTO);
 +                    } else {
 +                        schemaRestClient.updateVirSchema(kind, schemaTO);
 +                    }
 +                    if (pageRef.getPage() instanceof BasePage) {
 +                        ((BasePage) pageRef.getPage()).setModalResult(true);
 +                    }
 +
 +                    window.close(target);
 +                } catch (SyncopeClientException e) {
 +                    error(getString(Constants.ERROR) + ": " + e.getMessage());
 +                    feedbackPanel.refresh(target);
 +                }
 +            }
 +
 +            @Override
 +            protected void onError(final AjaxRequestTarget target, final Form<?> form) {
 +                feedbackPanel.refresh(target);
 +            }
 +        };
 +
 +        final AjaxButton cancel = new IndicatingAjaxButton(CANCEL, new ResourceModel(CANCEL)) {
 +
 +            private static final long serialVersionUID = -958724007591692537L;
 +
 +            @Override
 +            protected void onSubmit(final AjaxRequestTarget target, final Form<?> form) {
 +                window.close(target);
 +            }
 +        };
 +
 +        cancel.setDefaultFormProcessing(false);
 +
 +        String allowedRoles = createFlag
-                 ? xmlRolesReader.getAllAllowedRoles("Schema", "create")
-                 : xmlRolesReader.getAllAllowedRoles("Schema", "update");
++                ? xmlRolesReader.getEntitlement("Schema", "create")
++                : xmlRolesReader.getEntitlement("Schema", "update");
 +
 +        MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE, allowedRoles);
 +
 +        schemaForm.add(name);
 +        schemaForm.add(readonly);
 +
 +        schemaForm.add(submit);
 +        schemaForm.add(cancel);
 +
 +        add(schemaForm);
 +    }
 +}

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/XMLEditorPopupPage.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/XMLEditorPopupPage.java
index 6ebd083,0000000..c17351c
mode 100644,000000..100644
--- a/console/src/main/java/org/apache/syncope/console/pages/XMLEditorPopupPage.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/XMLEditorPopupPage.java
@@@ -1,90 -1,0 +1,90 @@@
 +/*
 + * Licensed to the Apache Software Foundation (ASF) under one
 + * or more contributor license agreements.  See the NOTICE file
 + * distributed with this work for additional information
 + * regarding copyright ownership.  The ASF licenses this file
 + * to you under the Apache License, Version 2.0 (the
 + * "License"); you may not use this file except in compliance
 + * with the License.  You may obtain a copy of the License at
 + *
 + *   http://www.apache.org/licenses/LICENSE-2.0
 + *
 + * Unless required by applicable law or agreed to in writing,
 + * software distributed under the License is distributed on an
 + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 + * KIND, either express or implied.  See the License for the
 + * specific language governing permissions and limitations
 + * under the License.
 + */
 +package org.apache.syncope.console.pages;
 +
 +import java.io.IOException;
 +import javax.ws.rs.core.MediaType;
 +import org.apache.commons.lang3.StringUtils;
 +import org.apache.syncope.common.SyncopeClientException;
 +import org.apache.syncope.console.commons.Constants;
 +import org.apache.syncope.console.rest.WorkflowRestClient;
 +import org.apache.syncope.console.wicket.ajax.markup.html.ClearIndicatingAjaxButton;
 +import org.apache.wicket.ajax.AjaxRequestTarget;
 +import org.apache.wicket.ajax.markup.html.form.AjaxButton;
 +import org.apache.wicket.authroles.authorization.strategies.role.metadata.MetaDataRoleAuthorizationStrategy;
 +import org.apache.wicket.markup.html.form.Button;
 +import org.apache.wicket.markup.html.form.Form;
 +import org.apache.wicket.markup.html.form.TextArea;
 +import org.apache.wicket.model.Model;
 +import org.apache.wicket.spring.injection.annot.SpringBean;
 +import org.apache.wicket.util.io.IOUtils;
 +
 +public class XMLEditorPopupPage extends BasePopupPage {
 +
 +    private static final long serialVersionUID = 5816041644635271734L;
 +
 +    @SpringBean
 +    private WorkflowRestClient wfRestClient;
 +
 +    public XMLEditorPopupPage() {
 +        Form wfForm = new Form("workflowDefForm");
 +
 +        String definition;
 +        try {
 +            definition = IOUtils.toString(wfRestClient.getDefinition(MediaType.APPLICATION_XML_TYPE));
 +        } catch (IOException e) {
 +            LOG.error("Could not get workflow definition", e);
 +            definition = StringUtils.EMPTY;
 +        }
 +        final TextArea<String> workflowDefArea = new TextArea<String>("workflowDefArea", new Model<String>(definition));
 +        wfForm.add(workflowDefArea);
 +
 +        AjaxButton submit =
-                  new ClearIndicatingAjaxButton(APPLY, new Model<String>(getString(SUBMIT)), getPageReference()) {
++                new ClearIndicatingAjaxButton(APPLY, new Model<String>(getString(SUBMIT)), getPageReference()) {
 +
 +                    private static final long serialVersionUID = -958724007591692537L;
 +
 +                    @Override
 +                    protected void onSubmitInternal(final AjaxRequestTarget target, final Form<?> form) {
 +                        try {
 +                            wfRestClient.updateDefinition(
 +                                    MediaType.APPLICATION_XML_TYPE, workflowDefArea.getModelObject());
 +                            info(getString(Constants.OPERATION_SUCCEEDED));
 +                        } catch (SyncopeClientException scee) {
 +                            error(getString(Constants.ERROR) + ": " + scee.getMessage());
 +                        }
 +                        feedbackPanel.refresh(target);
 +                    }
 +
 +                    @Override
 +                    protected void onError(final AjaxRequestTarget target, final Form<?> form) {
 +                        feedbackPanel.refresh(target);
 +                    }
 +                };
 +
 +        final Button close = new Button("closePage", new Model<String>(getString(CANCEL)));
 +
-         MetaDataRoleAuthorizationStrategy.authorize(submit, ENABLE,
-                 xmlRolesReader.getAllAllowedRoles("Configuration", "workflowDefUpdate"));
++        MetaDataRoleAuthorizationStrategy.authorize(
++                submit, ENABLE, xmlRolesReader.getEntitlement("Configuration", "workflowDefUpdate"));
 +        wfForm.add(submit);
 +        wfForm.add(close);
 +        this.add(wfForm);
 +    }
 +
 +}

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/panels/AbstractSyncTasksPanel.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/panels/AbstractSyncTasksPanel.java
index 7d653c0,0000000..e422305
mode 100644,000000..100644
--- a/console/src/main/java/org/apache/syncope/console/pages/panels/AbstractSyncTasksPanel.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/panels/AbstractSyncTasksPanel.java
@@@ -1,159 -1,0 +1,159 @@@
 +/*
 + * Licensed to the Apache Software Foundation (ASF) under one
 + * or more contributor license agreements.  See the NOTICE file
 + * distributed with this work for additional information
 + * regarding copyright ownership.  The ASF licenses this file
 + * to you under the Apache License, Version 2.0 (the
 + * "License"); you may not use this file except in compliance
 + * with the License.  You may obtain a copy of the License at
 + *
 + *   http://www.apache.org/licenses/LICENSE-2.0
 + *
 + * Unless required by applicable law or agreed to in writing,
 + * software distributed under the License is distributed on an
 + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 + * KIND, either express or implied.  See the License for the
 + * specific language governing permissions and limitations
 + * under the License.
 + */
 +package org.apache.syncope.console.pages.panels;
 +
 +import java.util.List;
 +import org.apache.syncope.common.to.AbstractTaskTO;
 +import org.apache.syncope.common.to.AbstractSyncTaskTO;
 +import org.apache.syncope.common.to.PushTaskTO;
 +import org.apache.syncope.common.to.SyncTaskTO;
 +import org.apache.syncope.console.commons.Constants;
 +import org.apache.syncope.console.pages.PushTaskModalPage;
 +import org.apache.syncope.console.pages.SyncTaskModalPage;
 +import org.apache.syncope.console.pages.Tasks;
 +import org.apache.syncope.console.pages.Tasks.TasksProvider;
 +import org.apache.syncope.console.wicket.ajax.markup.html.ClearIndicatingAjaxLink;
 +import org.apache.wicket.Page;
 +import org.apache.wicket.PageReference;
 +import org.apache.wicket.ajax.AjaxRequestTarget;
 +import org.apache.wicket.ajax.form.AjaxFormComponentUpdatingBehavior;
 +import org.apache.wicket.ajax.markup.html.AjaxLink;
 +import org.apache.wicket.authroles.authorization.strategies.role.metadata.MetaDataRoleAuthorizationStrategy;
 +import org.apache.wicket.event.IEvent;
 +import org.apache.wicket.extensions.ajax.markup.html.modal.ModalWindow;
 +import org.apache.wicket.extensions.markup.html.repeater.data.table.IColumn;
 +import org.apache.wicket.markup.html.WebMarkupContainer;
 +import org.apache.wicket.markup.html.form.DropDownChoice;
 +import org.apache.wicket.markup.html.form.Form;
 +import org.apache.wicket.model.PropertyModel;
 +import org.apache.wicket.request.http.WebResponse;
 +
 +public abstract class AbstractSyncTasksPanel<T extends AbstractSyncTaskTO> extends AbstractTasks {
 +
 +    private static final long serialVersionUID = -8674781241465369244L;
 +
 +    private int paginatorRows;
 +
 +    protected WebMarkupContainer container;
 +
 +    protected ModalWindow window;
 +
 +    protected AjaxDataTablePanel<AbstractTaskTO, String> table;
 +
 +    private final Class<T> reference;
 +
 +    public AbstractSyncTasksPanel(final String id, final PageReference pageRef, final Class<T> reference) {
 +        super(id, pageRef);
 +
 +        this.reference = reference;
 +
 +        container = new WebMarkupContainer("container");
 +        container.setOutputMarkupId(true);
 +        add(container);
 +
 +        window = new ModalWindow("taskWin");
 +        window.setCssClassName(ModalWindow.CSS_CLASS_GRAY);
 +        window.setInitialHeight(WIN_HEIGHT);
 +        window.setInitialWidth(WIN_WIDTH);
 +        window.setCookieName(VIEW_TASK_WIN_COOKIE_NAME);
 +        add(window);
 +
 +        ((Tasks) pageRef.getPage()).setWindowClosedCallback(window, container);
 +
 +        paginatorRows = prefMan.getPaginatorRows(getWebRequest(), Constants.PREF_SYNC_TASKS_PAGINATOR_ROWS);
 +    }
 +
 +    @Override
 +    public void onEvent(final IEvent<?> event) {
 +        if (event.getPayload() instanceof AbstractSearchResultPanel.EventDataWrapper) {
 +            ((AbstractSearchResultPanel.EventDataWrapper) event.getPayload()).getTarget().add(container);
 +        }
 +    }
 +
 +    protected void initTasksTable() {
 +
 +        table = Tasks.updateTaskTable(
 +                getColumns(),
 +                new TasksProvider<T>(restClient, paginatorRows, getId(), this.reference),
 +                container,
 +                0,
 +                this.pageRef,
 +                restClient);
 +
 +        Form paginatorForm = new Form("PaginatorForm");
 +
 +        @SuppressWarnings({ "unchecked", "rawtypes" })
 +        final DropDownChoice rowsChooser = new DropDownChoice("rowsChooser", new PropertyModel(this, "paginatorRows"),
 +                prefMan.getPaginatorChoices());
 +
 +        rowsChooser.add(new AjaxFormComponentUpdatingBehavior(Constants.ON_CHANGE) {
 +
 +            private static final long serialVersionUID = -1107858522700306810L;
 +
 +            @Override
 +            protected void onUpdate(final AjaxRequestTarget target) {
 +                prefMan.set(getWebRequest(), (WebResponse) getResponse(), Constants.PREF_SYNC_TASKS_PAGINATOR_ROWS,
 +                        String.valueOf(paginatorRows));
 +
 +                table = Tasks.updateTaskTable(
 +                        getColumns(),
 +                        new TasksProvider<T>(restClient, paginatorRows, getId(), reference),
 +                        container,
 +                        table == null ? 0 : (int) table.getCurrentPage(),
 +                        pageRef,
 +                        restClient);
 +
 +                target.add(container);
 +            }
 +        });
 +
 +        paginatorForm.add(rowsChooser);
 +        container.add(paginatorForm);
 +
 +        // create new task
 +        AjaxLink<Void> createLink = new ClearIndicatingAjaxLink<Void>("createLink", pageRef) {
 +
 +            private static final long serialVersionUID = -7978723352517770644L;
 +
 +            @Override
 +            protected void onClickInternal(final AjaxRequestTarget target) {
 +                window.setPageCreator(new ModalWindow.PageCreator() {
 +
 +                    private static final long serialVersionUID = -7834632442532690940L;
 +
 +                    @Override
 +                    public Page createPage() {
 +                        return reference.equals(SyncTaskTO.class) ? new SyncTaskModalPage(window, new SyncTaskTO(),
 +                                pageRef) : new PushTaskModalPage(window, new PushTaskTO(), pageRef);
 +                    }
 +                });
 +
 +                window.show(target);
 +            }
 +        };
 +
 +        MetaDataRoleAuthorizationStrategy.authorize(
-                 createLink, RENDER, xmlRolesReader.getAllAllowedRoles(TASKS, "create"));
++                createLink, RENDER, xmlRolesReader.getEntitlement(TASKS, "create"));
 +
 +        add(createLink);
 +
 +    }
 +
 +    protected abstract List<IColumn<AbstractTaskTO, String>> getColumns();
 +}

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/panels/PoliciesPanel.java
----------------------------------------------------------------------
diff --cc console/src/main/java/org/apache/syncope/console/pages/panels/PoliciesPanel.java
index 553e534,b6f7196..0e94209
--- a/console/src/main/java/org/apache/syncope/console/pages/panels/PoliciesPanel.java
+++ b/console/src/main/java/org/apache/syncope/console/pages/panels/PoliciesPanel.java
@@@ -229,13 -223,11 +229,13 @@@ public class PoliciesPanel extends Pane
  
          add(createButton);
  
-         MetaDataRoleAuthorizationStrategy.authorize(createButton, ENABLE,
-                 xmlRolesReader.getAllAllowedRoles("Policies", "create"));
 -        MetaDataRoleAuthorizationStrategy.authorize(createButton, ENABLE, xmlRolesReader.getEntitlement("Policies",
 -                "create"));
++        MetaDataRoleAuthorizationStrategy.authorize(
++                createButton, ENABLE, xmlRolesReader.getEntitlement("Policies", "create"));
  
 +        @SuppressWarnings("rawtypes")
          final Form paginatorForm = new Form("PaginatorForm");
  
 +        @SuppressWarnings({ "unchecked", "rawtypes" })
          final DropDownChoice rowsChooser = new DropDownChoice("rowsChooser", new PropertyModel(this, "paginatorRows"),
                  prefMan.getPaginatorChoices());
  

http://git-wip-us.apache.org/repos/asf/syncope/blob/f1607400/console/src/main/java/org/apache/syncope/console/pages/panels/RolePanel.java
----------------------------------------------------------------------