You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@syncope.apache.org by Jesse van Bekkum <be...@gmail.com> on 2013/04/22 21:40:40 UTC
How to provision a resource from the workflow
Hi
Quick question.
How can you provision a resource to a user from the workflow? I have a
workflow, and after creating a user with a rest call, I want, depending on
the path through the workflow, to automatically provision a resource.
I tried this in a workflow step:
ResourceDAO resourceDAO = CONTEXT.getBean(ResourceDAO.class);
ExternalResource idp = resourceDAO.find("IDP_RESOURCE");
SyncopeUser user = (SyncopeUser)
execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
user.addResource(idp);
But after creation the user had no resources. In the past (0.7) we have
used manual propagation, by retrieving the propagation handler from the
context and firing it, but that seems a bit inelegant to me.
What is the preferred solution to this (I think common) scenario?
Jesse van Bekkum
Re: How to provision a resource from the workflow
Posted by Jesse van Bekkum <be...@gmail.com>.
Thank you Fabio
Today I got around to implement it, and this method of activation works.
However, I still think that the clients should not be concerned with
exactly what resources someone is propagated to. It is the responsibility
of the IDM system to handle this, not of the client calling the activation
function.
Besides that I think it should be possible to propagate someone in the
workflow without any client actions.
I have spent quite some time trying to fix this, but I was unable to do it.
I still think that something went wrong in the optimalizations 1.1.X. If I
ever find a solution I'll post it.
Jesse
On Thu, May 30, 2013 at 3:21 PM, Fabio Martelli <fa...@gmail.com>wrote:
> Il 28/05/2013 11:17, Jesse van Bekkum ha scritto:
>
> Hi
>
> I looked in to it yesterday evening, and this is an example on how to
> reproduce this issue on a blank syncope installation.
>
> I did two things to the code. I added this class:
>
> public class Propagate extends AbstractActivitiDelegate {
>
> protected static final Logger LOG =
> LoggerFactory.getLogger(Propagate.class);
>
> @Override
> protected void doExecute(DelegateExecution execution) throws Exception
> {
> LOG.error("Provisioning");
> SyncopeUser user = (SyncopeUser)
> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
> UserMod userMod = (UserMod)
> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
> if (userMod == null) {
> userMod = new UserMod();
> if (user.getId() != null) {
> userMod.setId(user.getId());
> }
> }
>
> userMod.addResourceToBeAdded("resource-testdb");
> // update SyncopeUser
> PropagationByResource propByRes = dataBinder.update(user, userMod);
>
> // report updated user and propagation by resource as result
> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER,
> user);
>
> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
> propByRes);
> LOG.info("propByRes: {}", propByRes);
> }
> }
>
> I included this in the workflow, effectively adding a step between
> "removeToken" and activeGw:
>
> <sequenceFlow id="flow7" sourceRef="removeToken"
> targetRef="propagate"/>
>
> <serviceTask id="propagate" name="Propagate"
> activiti:class="nl.test.Propagate"/>
>
> <sequenceFlow id="propagate_active" sourceRef="propagate"
> targetRef="active"/>
>
> <userTask id="active" name="Active"/>
>
> <sequenceFlow id="flow8" sourceRef="active" targetRef="activeGw"/>
>
> Using the following steps, the issue can be reproduced:
>
>
> 1. Build syncope, and run mvn -P embedded from the console directory
> 2. Log in
> 3. Go to resources, click on H2 connector, in resource-testdb
> 4. Clear the Password Column field
> 5. Edit the resource
> 6. Uncheck the password checkbox, and change that field from
> userpassword to username in userschema
> 7. (This is to make provisioning without a clear text password easier)
> 8. Go to users, and manually assign a user to resource
> resource-testdb, and save
> 9. Go to http://localhost:9082/login.jsp<http://localhost:9082/login.jsp?jsessionid=11fb0d636138038dca849e1c9528986b> and
> log in with the password sa and the jdbc
> url jdbc:h2:tcp://localhost:9092/testdb
> 10. Look at the table TEST, and ensure that the user is provisioned.
> This makes sure that provisioning in general works
> 11. Now create a user in syncope
> 12. Enter a username, password, values for full name, surname and
> userid (email address)
> 13. Assign role 11, the type of user that has to be activated
> 14. Copy the token
> 15. Go to this url:
> http://localhost:9080/syncope/rest/user/activate/100.json?token=<<http://localhost:9080/syncope/rest/user/activate/100.json?token=22EP5fua8lqlXzHr0mKbgkZVoYziPzAmcrpqLeQZTq11oTqGqaeRbfcS8oMiOWdSjoTyJF6fzmc9u5jnBw9YTxi3KllytlCSiiK9AwytcsRxdBIQNh4jCILqhNPdjcMbpYG2U3BC9gDhSBQj54EWHl8hjCiyy3LHwaos0YiVjLoxIiVcGNFcuJx0dc9kMOQVN3BhqxMqlP4RrEPs30CoJNmOUwRi4f5KLyddu1bma74Wa1BAULSGH8ucbQYY1u1z>
> token>
>
> Hi Jesse, the problem is into the point 15.
> By calling "activate" service you will ask for an activation of user
> without propagation.
> To ask for a propagation a PropagationRequestTO should be sent.
>
> Please, take a look at UserController.activate() [1] and
> UserTestITCase.suspendReactivateOnResource() [2] methods .
>
> Best regards,
> F.
>
> [1]
> http://svn.apache.org/viewvc/syncope/tags/syncope-1.1.1/core/src/main/java/org/apache/syncope/core/rest/controller/UserController.java?view=markup
> [2]
> http://svn.apache.org/viewvc/syncope/tags/syncope-1.1.1/core/src/test/java/org/apache/syncope/core/rest/UserTestITCase.java?view=markup
>
>
>
> 1. In the response message, "resource-testdb" will be included in the
> resources field. The propagationTO field will be empty though.
> 2. Now look at core.log. The following will show up:
>
>
> - 10:30:10.190 ERROR nl.test.Propagate - Provisioning
> - 10:30:10.273 INFO nl.test.Propagate - propByRes: To be Created:
> [resource-testdb];
> - To be Updated: [];
> - To be Deleted: [];
> - Old account Ids: {}
>
>
> 1. This means that my class is executed, and a resource is added.
> 2. Now check the H2 database again. No user.
> 3. Go the the user in syncope: The resource is actually assigned to
> this user.
> 4. Now save the user in syncope. You get messages that the user has
> been propagated
> 5. Now go to H2 again, the user is provisioned.
>
> I looked at all the logs related to connectors, but I could not find
> obvious issues. If you have other suggestions on which log files to look
> at, I will do that.
>
> It seems to me that synope assigns the resource, but that the
> propagation step is not actually executed. When you save the user it sees
> that that's wrong, and propagates .
>
> If somebody can see what the issue is that would really help me
>
> Thanks
>
> Jesse
>
>
>
>
Re: How to provision a resource from the workflow
Posted by Fabio Martelli <fa...@gmail.com>.
Il 28/05/2013 11:17, Jesse van Bekkum ha scritto:
> Hi
>
> I looked in to it yesterday evening, and this is an example on how to
> reproduce this issue on a blank syncope installation.
>
> I did two things to the code. I added this class:
>
> public class Propagate extends AbstractActivitiDelegate {
>
> protected static final Logger LOG =
> LoggerFactory.getLogger(Propagate.class);
>
> @Override
> protected void doExecute(DelegateExecution execution) throws
> Exception {
> LOG.error("Provisioning");
> SyncopeUser user = (SyncopeUser)
> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
> UserMod userMod = (UserMod)
> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
> if (userMod == null) {
> userMod = new UserMod();
> if (user.getId() != null) {
> userMod.setId(user.getId());
> }
> }
>
> userMod.addResourceToBeAdded("resource-testdb");
> // update SyncopeUser
> PropagationByResource propByRes = dataBinder.update(user,
> userMod);
>
> // report updated user and propagation by resource as result
> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER, user);
> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
> propByRes);
> LOG.info("propByRes: {}", propByRes);
> }
> }
>
> I included this in the workflow, effectively adding a step between
> "removeToken" and activeGw:
>
> <sequenceFlow id="flow7" sourceRef="removeToken"
> targetRef="propagate"/>
>
> <serviceTask id="propagate" name="Propagate"
> activiti:class="nl.test.Propagate"/>
>
> <sequenceFlow id="propagate_active" sourceRef="propagate"
> targetRef="active"/>
>
> <userTask id="active" name="Active"/>
>
> <sequenceFlow id="flow8" sourceRef="active" targetRef="activeGw"/>
>
> Using the following steps, the issue can be reproduced:
>
> 1. Build syncope, and run mvn -P embedded from the console directory
> 2. Log in
> 3. Go to resources, click on H2 connector, in resource-testdb
> 4. Clear the Password Column field
> 5. Edit the resource
> 6. Uncheck the password checkbox, and change that field from
> userpassword to username in userschema
> 7. (This is to make provisioning without a clear text password easier)
> 8. Go to users, and manually assign a user to resource
> resource-testdb, and save
> 9. Go to http://localhost:9082/login.jsp
> <http://localhost:9082/login.jsp?jsessionid=11fb0d636138038dca849e1c9528986b> and
> log in with the password sa and the jdbc
> url jdbc:h2:tcp://localhost:9092/testdb
> 10. Look at the table TEST, and ensure that the user is provisioned.
> This makes sure that provisioning in general works
> 11. Now create a user in syncope
> 12. Enter a username, password, values for full name, surname and
> userid (email address)
> 13. Assign role 11, the type of user that has to be activated
> 14. Copy the token
> 15. Go to this
> url:http://localhost:9080/syncope/rest/user/activate/100.json?token=<
> <http://localhost:9080/syncope/rest/user/activate/100.json?token=22EP5fua8lqlXzHr0mKbgkZVoYziPzAmcrpqLeQZTq11oTqGqaeRbfcS8oMiOWdSjoTyJF6fzmc9u5jnBw9YTxi3KllytlCSiiK9AwytcsRxdBIQNh4jCILqhNPdjcMbpYG2U3BC9gDhSBQj54EWHl8hjCiyy3LHwaos0YiVjLoxIiVcGNFcuJx0dc9kMOQVN3BhqxMqlP4RrEPs30CoJNmOUwRi4f5KLyddu1bma74Wa1BAULSGH8ucbQYY1u1z>token>
>
Hi Jesse, the problem is into the point 15.
By calling "activate" service you will ask for an activation of user
without propagation.
To ask for a propagation a PropagationRequestTO should be sent.
Please, take a look at UserController.activate() [1] and
UserTestITCase.suspendReactivateOnResource() [2] methods .
Best regards,
F.
[1]
http://svn.apache.org/viewvc/syncope/tags/syncope-1.1.1/core/src/main/java/org/apache/syncope/core/rest/controller/UserController.java?view=markup
[2]
http://svn.apache.org/viewvc/syncope/tags/syncope-1.1.1/core/src/test/java/org/apache/syncope/core/rest/UserTestITCase.java?view=markup
> 1. In the response message, "resource-testdb" will be included in the
> resources field. The propagationTO field will be empty though.
> 2. Now look at core.log. The following will show up:
>
> * 10:30:10.190 ERROR nl.test.Propagate - Provisioning
> * 10:30:10.273 INFO nl.test.Propagate - propByRes: To be Created:
> [resource-testdb];
> * To be Updated: [];
> * To be Deleted: [];
> * Old account Ids: {}
>
> 1. This means that my class is executed, and a resource is added.
> 2. Now check the H2 database again. No user.
> 3. Go the the user in syncope: The resource is actually assigned to
> this user.
> 4. Now save the user in syncope. You get messages that the user has
> been propagated
> 5. Now go to H2 again, the user is provisioned.
>
> I looked at all the logs related to connectors, but I could not find
> obvious issues. If you have other suggestions on which log files to
> look at, I will do that.
>
> It seems to me that synope assigns the resource, but that the
> propagation step is not actually executed. When you save the user it
> sees that that's wrong, and propagates .
>
> If somebody can see what the issue is that would really help me
>
> Thanks
>
> Jesse
>
>
Re: How to provision a resource from the workflow
Posted by Jesse van Bekkum <be...@gmail.com>.
Hi
I looked in to it yesterday evening, and this is an example on how to
reproduce this issue on a blank syncope installation.
I did two things to the code. I added this class:
public class Propagate extends AbstractActivitiDelegate {
protected static final Logger LOG =
LoggerFactory.getLogger(Propagate.class);
@Override
protected void doExecute(DelegateExecution execution) throws Exception {
LOG.error("Provisioning");
SyncopeUser user = (SyncopeUser)
execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
UserMod userMod = (UserMod)
execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
if (userMod == null) {
userMod = new UserMod();
if (user.getId() != null) {
userMod.setId(user.getId());
}
}
userMod.addResourceToBeAdded("resource-testdb");
// update SyncopeUser
PropagationByResource propByRes = dataBinder.update(user, userMod);
// report updated user and propagation by resource as result
execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER,
user);
execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
propByRes);
LOG.info("propByRes: {}", propByRes);
}
}
I included this in the workflow, effectively adding a step between
"removeToken" and activeGw:
<sequenceFlow id="flow7" sourceRef="removeToken"
targetRef="propagate"/>
<serviceTask id="propagate" name="Propagate"
activiti:class="nl.test.Propagate"/>
<sequenceFlow id="propagate_active" sourceRef="propagate"
targetRef="active"/>
<userTask id="active" name="Active"/>
<sequenceFlow id="flow8" sourceRef="active" targetRef="activeGw"/>
Using the following steps, the issue can be reproduced:
1. Build syncope, and run mvn -P embedded from the console directory
2. Log in
3. Go to resources, click on H2 connector, in resource-testdb
4. Clear the Password Column field
5. Edit the resource
6. Uncheck the password checkbox, and change that field from
userpassword to username in userschema
7. (This is to make provisioning without a clear text password easier)
8. Go to users, and manually assign a user to resource resource-testdb,
and save
9. Go to http://localhost:9082/login.jsp<http://localhost:9082/login.jsp?jsessionid=11fb0d636138038dca849e1c9528986b>
and
log in with the password sa and the jdbc
url jdbc:h2:tcp://localhost:9092/testdb
10. Look at the table TEST, and ensure that the user is provisioned.
This makes sure that provisioning in general works
11. Now create a user in syncope
12. Enter a username, password, values for full name, surname and userid
(email address)
13. Assign role 11, the type of user that has to be activated
14. Copy the token
15. Go to this url:
http://localhost:9080/syncope/rest/user/activate/100.json?token=<<http://localhost:9080/syncope/rest/user/activate/100.json?token=22EP5fua8lqlXzHr0mKbgkZVoYziPzAmcrpqLeQZTq11oTqGqaeRbfcS8oMiOWdSjoTyJF6fzmc9u5jnBw9YTxi3KllytlCSiiK9AwytcsRxdBIQNh4jCILqhNPdjcMbpYG2U3BC9gDhSBQj54EWHl8hjCiyy3LHwaos0YiVjLoxIiVcGNFcuJx0dc9kMOQVN3BhqxMqlP4RrEPs30CoJNmOUwRi4f5KLyddu1bma74Wa1BAULSGH8ucbQYY1u1z>
token>
16. In the response message, "resource-testdb" will be included in the
resources field. The propagationTO field will be empty though.
17. Now look at core.log. The following will show up:
- 10:30:10.190 ERROR nl.test.Propagate - Provisioning
- 10:30:10.273 INFO nl.test.Propagate - propByRes: To be Created:
[resource-testdb];
- To be Updated: [];
- To be Deleted: [];
- Old account Ids: {}
1. This means that my class is executed, and a resource is added.
2. Now check the H2 database again. No user.
3. Go the the user in syncope: The resource is actually assigned to this
user.
4. Now save the user in syncope. You get messages that the user has been
propagated
5. Now go to H2 again, the user is provisioned.
I looked at all the logs related to connectors, but I could not find
obvious issues. If you have other suggestions on which log files to look
at, I will do that.
It seems to me that synope assigns the resource, but that the propagation
step is not actually executed. When you save the user it sees that that's
wrong, and propagates .
If somebody can see what the issue is that would really help me
Thanks
Jesse
On Mon, May 27, 2013 at 2:46 PM, Nik <ni...@usharesoft.com>wrote:
> Sorry - guys !
>
> Wrong thread - no intentional hi-jacking intended.
>
> Nik
>
> Hi Nik,
> please don't hijack other's threads.
>
> Regards.
>
> On 27/05/2013 14:09, Nik wrote:
>
> Hi Francesco,
>
> What I'm doing is out of the box per the wiki - no customizations, nothing!
>
> The customizations (basically an ldap resource connector) are applied to
> the sytem after
> I get the base system working per the wiki (that way I ensure it has
> nothing to do with me ;-) ).
>
> But my lack of knowledge of maven is what I think maybe happening here
> (again I just follow the wiki)
>
> I literally run the commands:
>
> [nik@anvil test]$ rm -rf ~/.m2 <--- just to be sure!
>
>
>
> [nik@anvil test]$ mvn -X archetype:generate
> -DarchetypeGroupId=org.apache.syncope
> -DarchetypeArtifactId=syncope-archetype -DarchetypeRepository=
> http://repository.apache.org/content/repositories/snapshots
> -DarchetypeVersion=1.2.0-SNAPSHOT
> :
> [DEBUG] Configuring mojo
> 'org.apache.maven.plugins:maven-archetype-plugin:2.2:generate' with basic
> configurator -->
> [DEBUG] (f) archetypeArtifactId = syncope-archetype
> [DEBUG] (f) archetypeCatalog = remote,local
> [DEBUG] (f) archetypeGroupId = org.apache.syncope
> [DEBUG] (f) archetypeRepository =
> http://repository.apache.org/content/repositories/snapshots
> [DEBUG] (f) archetypeVersion = 1.2.0-SNAPSHOT
> [DEBUG] (f) basedir = /home/nik/UShareSoft/WKS/syncopeOnGlassfish/test
> [DEBUG] (f) interactiveMode = true
> [DEBUG] (f) localRepository = id: local
> url: file:///home/nik/.m2/repository
> layout: none
>
> [DEBUG] (f) remoteArtifactRepositories = [ id: central
> url: http://repo.maven.apache.org/maven2
> layout: default
> snapshots: [enabled => false, update => daily]
> releases: [enabled => true, update => daily]
> ]
> [DEBUG] (f) session = org.apache.maven.execution.MavenSession@7815bc09
> [DEBUG] -- end configuration --
> [INFO] Generating project in Interactive mode
> [INFO] Archetype defined by properties
> :
> [DEBUG] Could not find metadata
> org.apache.syncope:syncope-archetype:1.2.0-SNAPSHOT/maven-metadata.xml in
> local (/home/nik/.m2/repository)
> [DEBUG] Using connector WagonRepositoryConnector with priority 0 for
> http://repository.apache.org/content/repositories/snapshots
> Downloading:
> http://repository.apache.org/content/repositories/snapshots/org/apache/syncope/syncope-archetype/1.2.0-SNAPSHOT/maven-metadata.xml
> :
>
> Please look at the attached log (look.gz) of the whole thing
>
> If you could please run the same command on your system (mvn -X) I will be
> happy to look at the output and work what the issue maybe.
>
> I suspect the trace around remoteArtifactRepositories is the problem but
> maybe it is ok:
>
> VIZ:
> :
> [DEBUG] (f) localRepository = id: local
> url: file:///home/nik/.m2/repository/
> layout: none
>
> [DEBUG] (f) remoteArtifactRepositories = [ id: central
> url: http://repo.maven.apache.org/maven2
> layout: default
>
> rgds,
> Nik
>
> On 27/05/2013 11:54, Jesse van Bekkum wrote:
>
> Could you have a look at this issue, or at least tell me what Log files to
> look at?
>
>
> I think that the easiest way to share and make reproducible your issue is
> for you to publish somewhere a minimal Syncope project including a single
> H2 or CSV resource and your workflow customizations + detail the steps to
> reproduce the problem.
>
> Once we got this someone can eventually spend his time on taking a look
> and possibly giving a helping hand.
>
> Using the method you described I just cannot provision (or deprovision)
> already existing users, and this is a serious issue for my project (and for
> syncope in general, what's an IDM product that cannot provision reliably?)
>
>
> Maybe it's not up to the IDM product, it's up to you ;-)
>
> The only way I can get it to work is to do a rest call from the
> workflow, but this is a hack, and unreliable
>
>
> Agree.
>
> Regards.
>
> On Tue, May 21, 2013 at 11:29 AM, Jesse van Bekkum <be...@gmail.com>wrote:
>
>> I am not trying an update to an external resource, I am trying a
>> provisioning, but not on the creation of a user, but at a later point.
>>
>> I cannot find anything in the logs, in the connid log this user simply
>> does not occur after activation. What logs would I have to look at?
>>
>> How does the console do it? The console is able to actually provision a
>> user, and then the PropagationTO fields will be filled. In my activation,
>> they are not.
>>
>> Jesse
>>
>>
>> On Wed, May 15, 2013 at 9:24 AM, Francesco Chicchiriccò <
>> ilgrosso@apache.org> wrote:
>>
>>> On 14/05/2013 15:14, Jesse van Bekkum wrote:
>>>
>>> Hi Francesco
>>>
>>> I have used the code above to provision a resource. On a user that has
>>> not been created yet (id = null) it works fine. However, on another user
>>> who already existed, it does not provision. When I do another update action
>>> on that user, even on a completely unrelated attribute, it triggers the
>>> provisioning.
>>>
>>> I think I did not see this behavior on 1.0.7, but I see it on 1.1.1.
>>> Any idea what the cause is?
>>>
>>>
>>> It might be related on some optimizations made in the provisioning
>>> layer: in 1.1.X an update is triggered towards an external resource only if
>>> one or more of the mapped attributes is different from what is actually
>>> read from the same resource. In this respect, this might not be a bug.
>>>
>>> I cannot tell you more, some additional investigation - with DEBUG
>>> logging - is required.
>>>
>>> Regards.
>>>
>>>
>>> I tried setting the usermod with the id of the existing user, but that
>>> did not work.
>>>
>>> Jesse
>>>
>>>
>>>
>>> On Tue, Apr 30, 2013 at 10:22 AM, Francesco Chicchiriccò <
>>> ilgrosso@apache.org> wrote:
>>>
>>>> On 30/04/2013 10:21, Jesse van Bekkum wrote:
>>>>
>>>> No, I was just reading the requirements. I will get to it, but I will
>>>> also need permission from Everett. The complete procedure will probably
>>>> take a while I see.
>>>>
>>>>
>>>> Ok, let's wait for that.
>>>>
>>>>
>>>> Regards.
>>>>
>>>> On Tue, Apr 30, 2013 at 10:15 AM, Francesco Chicchiriccò <
>>>> ilgrosso@apache.org> wrote:
>>>>
>>>>> On 30/04/2013 10:09, Jesse van Bekkum wrote:
>>>>>
>>>>> Hi Francisco
>>>>>
>>>>> Sounds like a fine idea. My username is Jesse van Bekkum. You can
>>>>> give me write access.
>>>>>
>>>>>
>>>>> We have to wait for your ICLA to be received and notified: have you
>>>>> already sent it?
>>>>>
>>>>> Regards.
>>>>>
>>>>>
>>>>> On Tue, Apr 30, 2013 at 8:52 AM, Francesco Chicchiriccò <
>>>>> ilgrosso@apache.org> wrote:
>>>>>
>>>>>> On 29/04/2013 15:42, Jesse van Bekkum wrote:
>>>>>>
>>>>>> Hi Francesco
>>>>>>
>>>>>> Thanks for your help. There was one small issue with your example,
>>>>>> since on user creation you do not have a usermod on the execution yet. But
>>>>>> that was easily fixed.
>>>>>>
>>>>>> I have used the following code and rule in my workflow to get this
>>>>>> working. Might I suggest that we use this in the standard deployment of
>>>>>> Syncope? I think that provisioning via the workflow is functionality that
>>>>>> should be included out of the box. The version I made is parameterized via
>>>>>> the workflow (description of usage is included) so it is not specific to my
>>>>>> project.
>>>>>>
>>>>>>
>>>>>> Jesse,
>>>>>> this sounds like a nice extension: why don't you report it in a wiki
>>>>>> page under [2]?
>>>>>>
>>>>>> You need to:
>>>>>> 1. complete and submit an ICLA [3]
>>>>>> 2. create a wiki user (if not already done) and tell me the username
>>>>>> so that I can grant you write access to the wiki
>>>>>>
>>>>>> WDYT?
>>>>>>
>>>>>> Regards.
>>>>>>
>>>>>>
>>>>>> import org.activiti.engine.delegate.DelegateExecution;
>>>>>> import org.activiti.engine.delegate.Expression;
>>>>>> import org.apache.syncope.client.mod.UserMod;
>>>>>> import org.apache.syncope.core.persistence.beans.user.SyncopeUser;
>>>>>> import org.apache.syncope.core.propagation.PropagationByResource;
>>>>>> import org.apache.syncope.core.workflow.ActivitiUserWorkflowAdapter;
>>>>>> import org.apache.syncope.core.workflow.WorkflowException;
>>>>>> import
>>>>>> org.apache.syncope.core.workflow.activiti.AbstractActivitiDelegate;
>>>>>> import org.slf4j.Logger;
>>>>>> import org.slf4j.LoggerFactory;
>>>>>>
>>>>>> /**
>>>>>> * This workflow service task allows to provision a resource to a
>>>>>> user from the workflow.
>>>>>> *
>>>>>> * Use the following code in the workflow:
>>>>>> *
>>>>>> * <serviceTask id="addResource" name="Add Resource"
>>>>>>
>>>>>> activiti:class="org.apache.syncope.core.workflow.activiti.ProvisionResources">
>>>>>> <extensionElements>
>>>>>> <activiti:field name="resource"
>>>>>> stringValue="%%YOUR_RESOURCE%%"/>
>>>>>> </extensionElements>
>>>>>> </serviceTask>
>>>>>> */
>>>>>> public class ProvisionResources extends AbstractActivitiDelegate {
>>>>>>
>>>>>> protected static final Logger LOG =
>>>>>> LoggerFactory.getLogger(ProvisionResources.class);
>>>>>>
>>>>>> private Expression resource;
>>>>>>
>>>>>> public void setResource(Expression resource) {
>>>>>> this.resource = resource;
>>>>>> }
>>>>>>
>>>>>> @Override
>>>>>> protected void doExecute(DelegateExecution execution) throws
>>>>>> Exception {
>>>>>> String resourceName = (String) resource.getValue(execution);
>>>>>>
>>>>>> if (resourceName == null || resourceName.isEmpty()) {
>>>>>> throw new WorkflowException(new
>>>>>> IllegalStateException("Please specify a resource"));
>>>>>> }
>>>>>>
>>>>>> SyncopeUser user = (SyncopeUser)
>>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>>>>> UserMod userMod = (UserMod)
>>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
>>>>>> if (userMod == null) {
>>>>>> userMod = new UserMod();
>>>>>> }
>>>>>>
>>>>>> userMod.addResourceToBeAdded(resourceName);
>>>>>>
>>>>>> // update SyncopeUser
>>>>>> PropagationByResource propByRes = dataBinder.update(user,
>>>>>> userMod);
>>>>>>
>>>>>> // report updated user and propagation by resource as result
>>>>>>
>>>>>> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER, user);
>>>>>>
>>>>>> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
>>>>>> propByRes);
>>>>>>
>>>>>> }
>>>>>> }
>>>>>>
>>>>>>
>>>>>> On Tue, Apr 23, 2013 at 10:38 AM, Francesco Chicchiriccò <
>>>>>> ilgrosso@apache.org> wrote:
>>>>>>
>>>>>>> On 22/04/2013 21:40, Jesse van Bekkum wrote:
>>>>>>>
>>>>>>> Hi
>>>>>>>
>>>>>>> Quick question.
>>>>>>>
>>>>>>> How can you provision a resource to a user from the workflow? I
>>>>>>> have a workflow, and after creating a user with a rest call, I want,
>>>>>>> depending on the path through the workflow, to automatically provision a
>>>>>>> resource.
>>>>>>>
>>>>>>> I tried this in a workflow step:
>>>>>>>
>>>>>>> ResourceDAO resourceDAO =
>>>>>>> CONTEXT.getBean(ResourceDAO.class);
>>>>>>> ExternalResource idp = resourceDAO.find("IDP_RESOURCE");
>>>>>>> SyncopeUser user = (SyncopeUser)
>>>>>>>
>>>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>>>>>> user.addResource(idp);
>>>>>>>
>>>>>>> But after creation the user had no resources. In the past (0.7) we
>>>>>>> have used manual propagation, by retrieving the propagation handler from
>>>>>>> the context and firing it, but that seems a bit inelegant to me.
>>>>>>>
>>>>>>> What is the preferred solution to this (I think common) scenario?
>>>>>>>
>>>>>>>
>>>>>>> Hi Jesse,
>>>>>>> please take a look at the Update task [1]: you could change the
>>>>>>> doExecute() method there to match the logic expressed above
>>>>>>>
>>>>>>>
>>>>>>> SyncopeUser user = (SyncopeUser)
>>>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>>>>>> UserMod userMod = (UserMod)
>>>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
>>>>>>>
>>>>>>> // YOUR step, e.g. add resource
>>>>>>> userMod.addResourceToBeAdded("IDP_RESOURCE");
>>>>>>>
>>>>>>> // update SyncopeUser
>>>>>>> PropagationByResource propByRes = dataBinder.update(user,
>>>>>>> userMod);
>>>>>>>
>>>>>>> // report updated user and propagation by resource as result
>>>>>>>
>>>>>>> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER, user);
>>>>>>>
>>>>>>> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
>>>>>>> propByRes);
>>>>>>>
>>>>>>> Please note the final statements execution.setVariable() - without
>>>>>>> these the changes are not propagated back to the flow.
>>>>>>>
>>>>>>> Regards.
>>>>>>>
>>>>>>> [1]
>>>>>>> https://svn.apache.org/repos/asf/syncope/branches/1_1_X/core/src/main/java/org/apache/syncope/core/workflow/user/activiti/task/Update.java
>>>>>>>
>>>>>> [2]
>>>>>> https://cwiki.apache.org/confluence/display/SYNCOPE/Extending+Syncope
>>>>>> [3] http://www.apache.org/dev/new-committers-guide.html#cla
>>>>>>
>>>>> --
> Francesco Chicchiriccò
>
> ASF Member, Apache Syncope PMC chair, Apache Cocoon PMC Memberhttp://people.apache.org/~ilgrosso/
>
>
>
>
> --
> Francesco Chicchiriccò
>
> ASF Member, Apache Syncope PMC chair, Apache Cocoon PMC Memberhttp://people.apache.org/~ilgrosso/
>
>
>
Re: How to provision a resource from the workflow
Posted by Nik <ni...@usharesoft.com>.
Sorry - guys !
Wrong thread - no intentional hi-jacking intended.
Nik
> Hi Nik,
> please don't hijack other's threads.
>
> Regards.
>
> On 27/05/2013 14:09, Nik wrote:
>> Hi Francesco,
>>
>> What I'm doing is out of the box per the wiki - no customizations,
>> nothing!
>>
>> The customizations (basically an ldap resource connector) are applied
>> to the sytem after
>> I get the base system working per the wiki (that way I ensure it has
>> nothing to do with me ;-) ).
>>
>> But my lack of knowledge of maven is what I think maybe happening
>> here (again I just follow the wiki)
>>
>> I literally run the commands:
>>
>> [nik@anvil test]$ rm -rf ~/.m2<--- just to be sure!
>>
>>
>>
>> [nik@anvil test]$ mvn -X archetype:generate
>> -DarchetypeGroupId=org.apache.syncope
>> -DarchetypeArtifactId=syncope-archetype
>> -DarchetypeRepository=http://repository.apache.org/content/repositories/snapshots
>> -DarchetypeVersion=1.2.0-SNAPSHOT
>> :
>> [DEBUG] Configuring mojo
>> 'org.apache.maven.plugins:maven-archetype-plugin:2.2:generate' with
>> basic configurator -->
>> [DEBUG] (f) archetypeArtifactId = syncope-archetype
>> [DEBUG] (f) archetypeCatalog = remote,local
>> [DEBUG] (f) archetypeGroupId = org.apache.syncope
>> [DEBUG] (f) archetypeRepository =
>> http://repository.apache.org/content/repositories/snapshots
>> [DEBUG] (f) archetypeVersion = 1.2.0-SNAPSHOT
>> [DEBUG] (f) basedir = /home/nik/UShareSoft/WKS/syncopeOnGlassfish/test
>> [DEBUG] (f) interactiveMode = true
>> [DEBUG] (f) localRepository = id: local
>> url: file:///home/nik/.m2/repository
>> layout: none
>>
>> [DEBUG] (f) remoteArtifactRepositories = [ id: central
>> url: http://repo.maven.apache.org/maven2
>> layout: default
>> snapshots: [enabled => false, update => daily]
>> releases: [enabled => true, update => daily]
>> ]
>> [DEBUG] (f) session = org.apache.maven.execution.MavenSession@7815bc09
>> [DEBUG] -- end configuration --
>> [INFO] Generating project in Interactive mode
>> [INFO] Archetype defined by properties
>> :
>> [DEBUG] Could not find metadata
>> org.apache.syncope:syncope-archetype:1.2.0-SNAPSHOT/maven-metadata.xml in
>> local (/home/nik/.m2/repository)
>> [DEBUG] Using connector WagonRepositoryConnector with priority 0 for
>> http://repository.apache.org/content/repositories/snapshots
>> Downloading:
>> http://repository.apache.org/content/repositories/snapshots/org/apache/syncope/syncope-archetype/1.2.0-SNAPSHOT/maven-metadata.xml
>> :
>>
>> Please look at the attached log (look.gz) of the whole thing
>>
>> If you could please run the same command on your system (mvn -X) I
>> will be happy to look at the output and work what the issue maybe.
>>
>> I suspect the trace around remoteArtifactRepositories is the problem
>> but maybe it is ok:
>>
>> VIZ:
>> :
>> [DEBUG] (f) localRepository = id: local
>> url: file:///home/nik/.m2/repository/
>> layout: none
>>
>> [DEBUG] (f) remoteArtifactRepositories = [ id: central
>> url: http://repo.maven.apache.org/maven2
>> layout: default
>>
>> rgds,
>> Nik
>>> On 27/05/2013 11:54, Jesse van Bekkum wrote:
>>>> Could you have a look at this issue, or at least tell me what Log
>>>> files to look at?
>>>
>>> I think that the easiest way to share and make reproducible your
>>> issue is for you to publish somewhere a minimal Syncope project
>>> including a single H2 or CSV resource and your workflow
>>> customizations + detail the steps to reproduce the problem.
>>>
>>> Once we got this someone can eventually spend his time on taking a
>>> look and possibly giving a helping hand.
>>>
>>>> Using the method you described I just cannot provision (or
>>>> deprovision) already existing users, and this is a serious issue
>>>> for my project (and for syncope in general, what's an IDM product
>>>> that cannot provision reliably?)
>>>
>>> Maybe it's not up to the IDM product, it's up to you ;-)
>>>
>>>> The only way I can get it to work is to do a rest call from the
>>>> workflow, but this is a hack, and unreliable
>>>
>>> Agree.
>>>
>>> Regards.
>>>
>>>> On Tue, May 21, 2013 at 11:29 AM, Jesse van Bekkum
>>>> <bekkum@gmail.com <ma...@gmail.com>> wrote:
>>>>
>>>> I am not trying an update to an external resource, I am trying
>>>> a provisioning, but not on the creation of a user, but at a
>>>> later point.
>>>>
>>>> I cannot find anything in the logs, in the connid log this user
>>>> simply does not occur after activation. What logs would I have
>>>> to look at?
>>>>
>>>> How does the console do it? The console is able to actually
>>>> provision a user, and then the PropagationTO fields will be
>>>> filled. In my activation, they are not.
>>>>
>>>> Jesse
>>>>
>>>>
>>>> On Wed, May 15, 2013 at 9:24 AM, Francesco Chicchiriccò
>>>> <ilgrosso@apache.org <ma...@apache.org>> wrote:
>>>>
>>>> On 14/05/2013 15:14, Jesse van Bekkum wrote:
>>>>> Hi Francesco
>>>>>
>>>>> I have used the code above to provision a resource. On a
>>>>> user that has not been created yet (id = null) it works
>>>>> fine. However, on another user who already existed, it
>>>>> does not provision. When I do another update action on
>>>>> that user, even on a completely unrelated attribute, it
>>>>> triggers the provisioning.
>>>>>
>>>>> I think I did not see this behavior on 1.0.7, but I see it
>>>>> on 1.1.1. Any idea what the cause is?
>>>>
>>>> It might be related on some optimizations made in the
>>>> provisioning layer: in 1.1.X an update is triggered towards
>>>> an external resource only if one or more of the mapped
>>>> attributes is different from what is actually read from the
>>>> same resource. In this respect, this might not be a bug.
>>>>
>>>> I cannot tell you more, some additional investigation -
>>>> with DEBUG logging - is required.
>>>>
>>>> Regards.
>>>>
>>>>
>>>>> I tried setting the usermod with the id of the existing
>>>>> user, but that did not work.
>>>>>
>>>>> Jesse
>>>>>
>>>>>
>>>>>
>>>>> On Tue, Apr 30, 2013 at 10:22 AM, Francesco Chicchiriccò
>>>>> <ilgrosso@apache.org <ma...@apache.org>> wrote:
>>>>>
>>>>> On 30/04/2013 10:21, Jesse van Bekkum wrote:
>>>>>> No, I was just reading the requirements. I will get
>>>>>> to it, but I will also need permission from Everett.
>>>>>> The complete procedure will probably take a while I see.
>>>>>
>>>>> Ok, let's wait for that.
>>>>>
>>>>>
>>>>> Regards.
>>>>>
>>>>>> On Tue, Apr 30, 2013 at 10:15 AM, Francesco
>>>>>> Chicchiriccò <ilgrosso@apache.org
>>>>>> <ma...@apache.org>> wrote:
>>>>>>
>>>>>> On 30/04/2013 10:09, Jesse van Bekkum wrote:
>>>>>>> Hi Francisco
>>>>>>>
>>>>>>> Sounds like a fine idea. My username is Jesse
>>>>>>> van Bekkum. You can give me write access.
>>>>>>
>>>>>> We have to wait for your ICLA to be received and
>>>>>> notified: have you already sent it?
>>>>>>
>>>>>> Regards.
>>>>>>
>>>>>>
>>>>>>> On Tue, Apr 30, 2013 at 8:52 AM, Francesco
>>>>>>> Chicchiriccò <ilgrosso@apache.org
>>>>>>> <ma...@apache.org>> wrote:
>>>>>>>
>>>>>>> On 29/04/2013 15:42, Jesse van Bekkum wrote:
>>>>>>>> Hi Francesco
>>>>>>>>
>>>>>>>> Thanks for your help. There was one small
>>>>>>>> issue with your example, since on user
>>>>>>>> creation you do not have a usermod on the
>>>>>>>> execution yet. But that was easily fixed.
>>>>>>>>
>>>>>>>> I have used the following code and rule in
>>>>>>>> my workflow to get this working. Might I
>>>>>>>> suggest that we use this in the standard
>>>>>>>> deployment of Syncope? I think that
>>>>>>>> provisioning via the workflow is
>>>>>>>> functionality that should be included out
>>>>>>>> of the box. The version I made is
>>>>>>>> parameterized via the workflow (description
>>>>>>>> of usage is included) so it is not specific
>>>>>>>> to my project.
>>>>>>>
>>>>>>> Jesse,
>>>>>>> this sounds like a nice extension: why don't
>>>>>>> you report it in a wiki page under [2]?
>>>>>>>
>>>>>>> You need to:
>>>>>>> 1. complete and submit an ICLA [3]
>>>>>>> 2. create a wiki user (if not already done)
>>>>>>> and tell me the username so that I can grant
>>>>>>> you write access to the wiki
>>>>>>>
>>>>>>> WDYT?
>>>>>>>
>>>>>>> Regards.
>>>>>>>
>>>>>>>
>>>>>>>> import
>>>>>>>> org.activiti.engine.delegate.DelegateExecution;
>>>>>>>> import org.activiti.engine.delegate.Expression;
>>>>>>>> import org.apache.syncope.client.mod.UserMod;
>>>>>>>> import
>>>>>>>> org.apache.syncope.core.persistence.beans.user.SyncopeUser;
>>>>>>>> import
>>>>>>>> org.apache.syncope.core.propagation.PropagationByResource;
>>>>>>>> import
>>>>>>>> org.apache.syncope.core.workflow.ActivitiUserWorkflowAdapter;
>>>>>>>> import
>>>>>>>> org.apache.syncope.core.workflow.WorkflowException;
>>>>>>>> import
>>>>>>>> org.apache.syncope.core.workflow.activiti.AbstractActivitiDelegate;
>>>>>>>> import org.slf4j.Logger;
>>>>>>>> import org.slf4j.LoggerFactory;
>>>>>>>>
>>>>>>>> /**
>>>>>>>> * This workflow service task allows to
>>>>>>>> provision a resource to a user from the
>>>>>>>> workflow.
>>>>>>>> *
>>>>>>>> * Use the following code in the workflow:
>>>>>>>> *
>>>>>>>> * <serviceTask id="addResource" name="Add
>>>>>>>> Resource"
>>>>>>>> activiti:class="org.apache.syncope.core.workflow.activiti.ProvisionResources">
>>>>>>>> <extensionElements>
>>>>>>>> <activiti:field name="resource"
>>>>>>>> stringValue="%%YOUR_RESOURCE%%"/>
>>>>>>>> </extensionElements>
>>>>>>>> </serviceTask>
>>>>>>>> */
>>>>>>>> public class ProvisionResources extends
>>>>>>>> AbstractActivitiDelegate {
>>>>>>>>
>>>>>>>> protected static final Logger LOG =
>>>>>>>> LoggerFactory.getLogger(ProvisionResources.class);
>>>>>>>>
>>>>>>>> private Expression resource;
>>>>>>>>
>>>>>>>> public void setResource(Expression resource) {
>>>>>>>> this.resource = resource;
>>>>>>>> }
>>>>>>>>
>>>>>>>> @Override
>>>>>>>> protected void doExecute(DelegateExecution
>>>>>>>> execution) throws Exception {
>>>>>>>> String resourceName = (String)
>>>>>>>> resource.getValue(execution);
>>>>>>>>
>>>>>>>> if (resourceName == null ||
>>>>>>>> resourceName.isEmpty()) {
>>>>>>>> throw new WorkflowException(new
>>>>>>>> IllegalStateException("Please specify a
>>>>>>>> resource"));
>>>>>>>> }
>>>>>>>>
>>>>>>>> SyncopeUser user = (SyncopeUser)
>>>>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>>>>>>> UserMod userMod = (UserMod)
>>>>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
>>>>>>>> if (userMod == null) {
>>>>>>>> userMod = new UserMod();
>>>>>>>> }
>>>>>>>>
>>>>>>>> userMod.addResourceToBeAdded(resourceName);
>>>>>>>>
>>>>>>>> // update SyncopeUser
>>>>>>>> PropagationByResource propByRes =
>>>>>>>> dataBinder.update(user, userMod);
>>>>>>>>
>>>>>>>> // report updated user and propagation by
>>>>>>>> resource as result
>>>>>>>> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER,
>>>>>>>> user);
>>>>>>>> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
>>>>>>>> propByRes);
>>>>>>>>
>>>>>>>> }
>>>>>>>> }
>>>>>>>>
>>>>>>>>
>>>>>>>> On Tue, Apr 23, 2013 at 10:38 AM, Francesco
>>>>>>>> Chicchiriccò <ilgrosso@apache.org
>>>>>>>> <ma...@apache.org>> wrote:
>>>>>>>>
>>>>>>>> On 22/04/2013 21:40, Jesse van Bekkum
>>>>>>>> wrote:
>>>>>>>>> Hi
>>>>>>>>>
>>>>>>>>> Quick question.
>>>>>>>>>
>>>>>>>>> How can you provision a resource to a
>>>>>>>>> user from the workflow? I have a
>>>>>>>>> workflow, and after creating a user
>>>>>>>>> with a rest call, I want, depending on
>>>>>>>>> the path through the workflow, to
>>>>>>>>> automatically provision a resource.
>>>>>>>>>
>>>>>>>>> I tried this in a workflow step:
>>>>>>>>>
>>>>>>>>> ResourceDAO resourceDAO =
>>>>>>>>> CONTEXT.getBean(ResourceDAO.class);
>>>>>>>>> ExternalResource idp =
>>>>>>>>> resourceDAO.find("IDP_RESOURCE");
>>>>>>>>> SyncopeUser user = (SyncopeUser)
>>>>>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>>>>>>>> user.addResource(idp);
>>>>>>>>>
>>>>>>>>> But after creation the user had no
>>>>>>>>> resources. In the past (0.7) we have
>>>>>>>>> used manual propagation, by retrieving
>>>>>>>>> the propagation handler from the
>>>>>>>>> context and firing it, but that seems
>>>>>>>>> a bit inelegant to me.
>>>>>>>>>
>>>>>>>>> What is the preferred solution to this
>>>>>>>>> (I think common) scenario?
>>>>>>>>
>>>>>>>> Hi Jesse,
>>>>>>>> please take a look at the Update task
>>>>>>>> [1]: you could change the doExecute()
>>>>>>>> method there to match the logic
>>>>>>>> expressed above
>>>>>>>>
>>>>>>>>
>>>>>>>> SyncopeUser user = (SyncopeUser)
>>>>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>>>>>>> UserMod userMod = (UserMod)
>>>>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
>>>>>>>>
>>>>>>>> // YOUR step, e.g. add resource
>>>>>>>> userMod.addResourceToBeAdded("IDP_RESOURCE");
>>>>>>>>
>>>>>>>> // update SyncopeUser
>>>>>>>> PropagationByResource propByRes =
>>>>>>>> dataBinder.update(user, userMod);
>>>>>>>>
>>>>>>>> // report updated user and
>>>>>>>> propagation by resource as result
>>>>>>>> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER,
>>>>>>>> user);
>>>>>>>> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
>>>>>>>> propByRes);
>>>>>>>>
>>>>>>>> Please note the final statements
>>>>>>>> execution.setVariable() - without these
>>>>>>>> the changes are not propagated back to
>>>>>>>> the flow.
>>>>>>>>
>>>>>>>> Regards.
>>>>>>>>
>>>>>>>> [1]
>>>>>>>> https://svn.apache.org/repos/asf/syncope/branches/1_1_X/core/src/main/java/org/apache/syncope/core/workflow/user/activiti/task/Update.java
>>>>>>>>
>>>>>>> [2]
>>>>>>> https://cwiki.apache.org/confluence/display/SYNCOPE/Extending+Syncope
>>>>>>> [3]
>>>>>>> http://www.apache.org/dev/new-committers-guide.html#cla
>>>>>>>
>>> --
>>> Francesco Chicchiriccò
>>>
>>> ASF Member, Apache Syncope PMC chair, Apache Cocoon PMC Member
>>> http://people.apache.org/~ilgrosso/
>>
>
>
> --
> Francesco Chicchiriccò
>
> ASF Member, Apache Syncope PMC chair, Apache Cocoon PMC Member
> http://people.apache.org/~ilgrosso/
Re: How to provision a resource from the workflow
Posted by Francesco Chicchiriccò <il...@apache.org>.
Hi Nik,
please don't hijack other's threads.
Regards.
On 27/05/2013 14:09, Nik wrote:
> Hi Francesco,
>
> What I'm doing is out of the box per the wiki - no customizations,
> nothing!
>
> The customizations (basically an ldap resource connector) are applied
> to the sytem after
> I get the base system working per the wiki (that way I ensure it has
> nothing to do with me ;-) ).
>
> But my lack of knowledge of maven is what I think maybe happening here
> (again I just follow the wiki)
>
> I literally run the commands:
>
> [nik@anvil test]$ rm -rf ~/.m2<--- just to be sure!
>
>
>
> [nik@anvil test]$ mvn -X archetype:generate
> -DarchetypeGroupId=org.apache.syncope
> -DarchetypeArtifactId=syncope-archetype
> -DarchetypeRepository=http://repository.apache.org/content/repositories/snapshots
> -DarchetypeVersion=1.2.0-SNAPSHOT
> :
> [DEBUG] Configuring mojo
> 'org.apache.maven.plugins:maven-archetype-plugin:2.2:generate' with
> basic configurator -->
> [DEBUG] (f) archetypeArtifactId = syncope-archetype
> [DEBUG] (f) archetypeCatalog = remote,local
> [DEBUG] (f) archetypeGroupId = org.apache.syncope
> [DEBUG] (f) archetypeRepository =
> http://repository.apache.org/content/repositories/snapshots
> [DEBUG] (f) archetypeVersion = 1.2.0-SNAPSHOT
> [DEBUG] (f) basedir = /home/nik/UShareSoft/WKS/syncopeOnGlassfish/test
> [DEBUG] (f) interactiveMode = true
> [DEBUG] (f) localRepository = id: local
> url: file:///home/nik/.m2/repository
> layout: none
>
> [DEBUG] (f) remoteArtifactRepositories = [ id: central
> url: http://repo.maven.apache.org/maven2
> layout: default
> snapshots: [enabled => false, update => daily]
> releases: [enabled => true, update => daily]
> ]
> [DEBUG] (f) session = org.apache.maven.execution.MavenSession@7815bc09
> [DEBUG] -- end configuration --
> [INFO] Generating project in Interactive mode
> [INFO] Archetype defined by properties
> :
> [DEBUG] Could not find metadata
> org.apache.syncope:syncope-archetype:1.2.0-SNAPSHOT/maven-metadata.xml
> in local (/home/nik/.m2/repository)
> [DEBUG] Using connector WagonRepositoryConnector with priority 0 for
> http://repository.apache.org/content/repositories/snapshots
> Downloading:
> http://repository.apache.org/content/repositories/snapshots/org/apache/syncope/syncope-archetype/1.2.0-SNAPSHOT/maven-metadata.xml
> :
>
> Please look at the attached log (look.gz) of the whole thing
>
> If you could please run the same command on your system (mvn -X) I
> will be happy to look at the output and work what the issue maybe.
>
> I suspect the trace around remoteArtifactRepositories is the problem
> but maybe it is ok:
>
> VIZ:
> :
> [DEBUG] (f) localRepository = id: local
> url: file:///home/nik/.m2/repository/
> layout: none
>
> [DEBUG] (f) remoteArtifactRepositories = [ id: central
> url: http://repo.maven.apache.org/maven2
> layout: default
>
> rgds,
> Nik
>> On 27/05/2013 11:54, Jesse van Bekkum wrote:
>>> Could you have a look at this issue, or at least tell me what Log
>>> files to look at?
>>
>> I think that the easiest way to share and make reproducible your
>> issue is for you to publish somewhere a minimal Syncope project
>> including a single H2 or CSV resource and your workflow
>> customizations + detail the steps to reproduce the problem.
>>
>> Once we got this someone can eventually spend his time on taking a
>> look and possibly giving a helping hand.
>>
>>> Using the method you described I just cannot provision (or
>>> deprovision) already existing users, and this is a serious issue for
>>> my project (and for syncope in general, what's an IDM product that
>>> cannot provision reliably?)
>>
>> Maybe it's not up to the IDM product, it's up to you ;-)
>>
>>> The only way I can get it to work is to do a rest call from the
>>> workflow, but this is a hack, and unreliable
>>
>> Agree.
>>
>> Regards.
>>
>>> On Tue, May 21, 2013 at 11:29 AM, Jesse van Bekkum <bekkum@gmail.com
>>> <ma...@gmail.com>> wrote:
>>>
>>> I am not trying an update to an external resource, I am trying a
>>> provisioning, but not on the creation of a user, but at a later
>>> point.
>>>
>>> I cannot find anything in the logs, in the connid log this user
>>> simply does not occur after activation. What logs would I have
>>> to look at?
>>>
>>> How does the console do it? The console is able to actually
>>> provision a user, and then the PropagationTO fields will be
>>> filled. In my activation, they are not.
>>>
>>> Jesse
>>>
>>>
>>> On Wed, May 15, 2013 at 9:24 AM, Francesco Chicchiriccò
>>> <ilgrosso@apache.org <ma...@apache.org>> wrote:
>>>
>>> On 14/05/2013 15:14, Jesse van Bekkum wrote:
>>>> Hi Francesco
>>>>
>>>> I have used the code above to provision a resource. On a
>>>> user that has not been created yet (id = null) it works
>>>> fine. However, on another user who already existed, it does
>>>> not provision. When I do another update action on that
>>>> user, even on a completely unrelated attribute, it triggers
>>>> the provisioning.
>>>>
>>>> I think I did not see this behavior on 1.0.7, but I see it
>>>> on 1.1.1. Any idea what the cause is?
>>>
>>> It might be related on some optimizations made in the
>>> provisioning layer: in 1.1.X an update is triggered towards
>>> an external resource only if one or more of the mapped
>>> attributes is different from what is actually read from the
>>> same resource. In this respect, this might not be a bug.
>>>
>>> I cannot tell you more, some additional investigation - with
>>> DEBUG logging - is required.
>>>
>>> Regards.
>>>
>>>
>>>> I tried setting the usermod with the id of the existing
>>>> user, but that did not work.
>>>>
>>>> Jesse
>>>>
>>>>
>>>>
>>>> On Tue, Apr 30, 2013 at 10:22 AM, Francesco Chicchiriccò
>>>> <ilgrosso@apache.org <ma...@apache.org>> wrote:
>>>>
>>>> On 30/04/2013 10:21, Jesse van Bekkum wrote:
>>>>> No, I was just reading the requirements. I will get to
>>>>> it, but I will also need permission from Everett. The
>>>>> complete procedure will probably take a while I see.
>>>>
>>>> Ok, let's wait for that.
>>>>
>>>>
>>>> Regards.
>>>>
>>>>> On Tue, Apr 30, 2013 at 10:15 AM, Francesco
>>>>> Chicchiriccò <ilgrosso@apache.org
>>>>> <ma...@apache.org>> wrote:
>>>>>
>>>>> On 30/04/2013 10:09, Jesse van Bekkum wrote:
>>>>>> Hi Francisco
>>>>>>
>>>>>> Sounds like a fine idea. My username is Jesse van
>>>>>> Bekkum. You can give me write access.
>>>>>
>>>>> We have to wait for your ICLA to be received and
>>>>> notified: have you already sent it?
>>>>>
>>>>> Regards.
>>>>>
>>>>>
>>>>>> On Tue, Apr 30, 2013 at 8:52 AM, Francesco
>>>>>> Chicchiriccò <ilgrosso@apache.org
>>>>>> <ma...@apache.org>> wrote:
>>>>>>
>>>>>> On 29/04/2013 15:42, Jesse van Bekkum wrote:
>>>>>>> Hi Francesco
>>>>>>>
>>>>>>> Thanks for your help. There was one small
>>>>>>> issue with your example, since on user
>>>>>>> creation you do not have a usermod on the
>>>>>>> execution yet. But that was easily fixed.
>>>>>>>
>>>>>>> I have used the following code and rule in
>>>>>>> my workflow to get this working. Might I
>>>>>>> suggest that we use this in the standard
>>>>>>> deployment of Syncope? I think that
>>>>>>> provisioning via the workflow is
>>>>>>> functionality that should be included out of
>>>>>>> the box. The version I made is parameterized
>>>>>>> via the workflow (description of usage is
>>>>>>> included) so it is not specific to my project.
>>>>>>
>>>>>> Jesse,
>>>>>> this sounds like a nice extension: why don't
>>>>>> you report it in a wiki page under [2]?
>>>>>>
>>>>>> You need to:
>>>>>> 1. complete and submit an ICLA [3]
>>>>>> 2. create a wiki user (if not already done)
>>>>>> and tell me the username so that I can grant
>>>>>> you write access to the wiki
>>>>>>
>>>>>> WDYT?
>>>>>>
>>>>>> Regards.
>>>>>>
>>>>>>
>>>>>>> import
>>>>>>> org.activiti.engine.delegate.DelegateExecution;
>>>>>>> import org.activiti.engine.delegate.Expression;
>>>>>>> import org.apache.syncope.client.mod.UserMod;
>>>>>>> import
>>>>>>> org.apache.syncope.core.persistence.beans.user.SyncopeUser;
>>>>>>> import
>>>>>>> org.apache.syncope.core.propagation.PropagationByResource;
>>>>>>> import
>>>>>>> org.apache.syncope.core.workflow.ActivitiUserWorkflowAdapter;
>>>>>>> import
>>>>>>> org.apache.syncope.core.workflow.WorkflowException;
>>>>>>> import
>>>>>>> org.apache.syncope.core.workflow.activiti.AbstractActivitiDelegate;
>>>>>>> import org.slf4j.Logger;
>>>>>>> import org.slf4j.LoggerFactory;
>>>>>>>
>>>>>>> /**
>>>>>>> * This workflow service task allows to
>>>>>>> provision a resource to a user from the
>>>>>>> workflow.
>>>>>>> *
>>>>>>> * Use the following code in the workflow:
>>>>>>> *
>>>>>>> * <serviceTask id="addResource" name="Add
>>>>>>> Resource"
>>>>>>> activiti:class="org.apache.syncope.core.workflow.activiti.ProvisionResources">
>>>>>>> <extensionElements>
>>>>>>> <activiti:field name="resource"
>>>>>>> stringValue="%%YOUR_RESOURCE%%"/>
>>>>>>> </extensionElements>
>>>>>>> </serviceTask>
>>>>>>> */
>>>>>>> public class ProvisionResources extends
>>>>>>> AbstractActivitiDelegate {
>>>>>>>
>>>>>>> protected static final Logger LOG =
>>>>>>> LoggerFactory.getLogger(ProvisionResources.class);
>>>>>>>
>>>>>>> private Expression resource;
>>>>>>>
>>>>>>> public void setResource(Expression resource) {
>>>>>>> this.resource = resource;
>>>>>>> }
>>>>>>>
>>>>>>> @Override
>>>>>>> protected void doExecute(DelegateExecution
>>>>>>> execution) throws Exception {
>>>>>>> String resourceName = (String)
>>>>>>> resource.getValue(execution);
>>>>>>>
>>>>>>> if (resourceName == null ||
>>>>>>> resourceName.isEmpty()) {
>>>>>>> throw new WorkflowException(new
>>>>>>> IllegalStateException("Please specify a
>>>>>>> resource"));
>>>>>>> }
>>>>>>>
>>>>>>> SyncopeUser user = (SyncopeUser)
>>>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>>>>>> UserMod userMod = (UserMod)
>>>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
>>>>>>> if (userMod == null) {
>>>>>>> userMod = new UserMod();
>>>>>>> }
>>>>>>>
>>>>>>> userMod.addResourceToBeAdded(resourceName);
>>>>>>>
>>>>>>> // update SyncopeUser
>>>>>>> PropagationByResource propByRes =
>>>>>>> dataBinder.update(user, userMod);
>>>>>>>
>>>>>>> // report updated user and propagation by
>>>>>>> resource as result
>>>>>>> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER,
>>>>>>> user);
>>>>>>> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
>>>>>>> propByRes);
>>>>>>>
>>>>>>> }
>>>>>>> }
>>>>>>>
>>>>>>>
>>>>>>> On Tue, Apr 23, 2013 at 10:38 AM, Francesco
>>>>>>> Chicchiriccò <ilgrosso@apache.org
>>>>>>> <ma...@apache.org>> wrote:
>>>>>>>
>>>>>>> On 22/04/2013 21:40, Jesse van Bekkum wrote:
>>>>>>>> Hi
>>>>>>>>
>>>>>>>> Quick question.
>>>>>>>>
>>>>>>>> How can you provision a resource to a
>>>>>>>> user from the workflow? I have a
>>>>>>>> workflow, and after creating a user
>>>>>>>> with a rest call, I want, depending on
>>>>>>>> the path through the workflow, to
>>>>>>>> automatically provision a resource.
>>>>>>>>
>>>>>>>> I tried this in a workflow step:
>>>>>>>>
>>>>>>>> ResourceDAO resourceDAO =
>>>>>>>> CONTEXT.getBean(ResourceDAO.class);
>>>>>>>> ExternalResource idp =
>>>>>>>> resourceDAO.find("IDP_RESOURCE");
>>>>>>>> SyncopeUser user = (SyncopeUser)
>>>>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>>>>>>> user.addResource(idp);
>>>>>>>>
>>>>>>>> But after creation the user had no
>>>>>>>> resources. In the past (0.7) we have
>>>>>>>> used manual propagation, by retrieving
>>>>>>>> the propagation handler from the
>>>>>>>> context and firing it, but that seems a
>>>>>>>> bit inelegant to me.
>>>>>>>>
>>>>>>>> What is the preferred solution to this
>>>>>>>> (I think common) scenario?
>>>>>>>
>>>>>>> Hi Jesse,
>>>>>>> please take a look at the Update task
>>>>>>> [1]: you could change the doExecute()
>>>>>>> method there to match the logic
>>>>>>> expressed above
>>>>>>>
>>>>>>>
>>>>>>> SyncopeUser user = (SyncopeUser)
>>>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>>>>>> UserMod userMod = (UserMod)
>>>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
>>>>>>>
>>>>>>> // YOUR step, e.g. add resource
>>>>>>> userMod.addResourceToBeAdded("IDP_RESOURCE");
>>>>>>>
>>>>>>> // update SyncopeUser
>>>>>>> PropagationByResource propByRes =
>>>>>>> dataBinder.update(user, userMod);
>>>>>>>
>>>>>>> // report updated user and
>>>>>>> propagation by resource as result
>>>>>>> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER,
>>>>>>> user);
>>>>>>> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
>>>>>>> propByRes);
>>>>>>>
>>>>>>> Please note the final statements
>>>>>>> execution.setVariable() - without these
>>>>>>> the changes are not propagated back to
>>>>>>> the flow.
>>>>>>>
>>>>>>> Regards.
>>>>>>>
>>>>>>> [1]
>>>>>>> https://svn.apache.org/repos/asf/syncope/branches/1_1_X/core/src/main/java/org/apache/syncope/core/workflow/user/activiti/task/Update.java
>>>>>>>
>>>>>> [2]
>>>>>> https://cwiki.apache.org/confluence/display/SYNCOPE/Extending+Syncope
>>>>>> [3]
>>>>>> http://www.apache.org/dev/new-committers-guide.html#cla
>>>>>>
>> --
>> Francesco Chicchiriccò
>>
>> ASF Member, Apache Syncope PMC chair, Apache Cocoon PMC Member
>> http://people.apache.org/~ilgrosso/
>
--
Francesco Chicchiriccò
ASF Member, Apache Syncope PMC chair, Apache Cocoon PMC Member
http://people.apache.org/~ilgrosso/
Re: How to provision a resource from the workflow
Posted by Nik <ni...@usharesoft.com>.
Hi Francesco,
What I'm doing is out of the box per the wiki - no customizations, nothing!
The customizations (basically an ldap resource connector) are applied to
the sytem after
I get the base system working per the wiki (that way I ensure it has
nothing to do with me ;-) ).
But my lack of knowledge of maven is what I think maybe happening here
(again I just follow the wiki)
I literally run the commands:
[nik@anvil test]$ rm -rf ~/.m2<--- just to be sure!
[nik@anvil test]$ mvn -X archetype:generate
-DarchetypeGroupId=org.apache.syncope
-DarchetypeArtifactId=syncope-archetype
-DarchetypeRepository=http://repository.apache.org/content/repositories/snapshots
-DarchetypeVersion=1.2.0-SNAPSHOT
:
[DEBUG] Configuring mojo
'org.apache.maven.plugins:maven-archetype-plugin:2.2:generate' with
basic configurator -->
[DEBUG] (f) archetypeArtifactId = syncope-archetype
[DEBUG] (f) archetypeCatalog = remote,local
[DEBUG] (f) archetypeGroupId = org.apache.syncope
[DEBUG] (f) archetypeRepository =
http://repository.apache.org/content/repositories/snapshots
[DEBUG] (f) archetypeVersion = 1.2.0-SNAPSHOT
[DEBUG] (f) basedir = /home/nik/UShareSoft/WKS/syncopeOnGlassfish/test
[DEBUG] (f) interactiveMode = true
[DEBUG] (f) localRepository = id: local
url: file:///home/nik/.m2/repository
layout: none
[DEBUG] (f) remoteArtifactRepositories = [ id: central
url: http://repo.maven.apache.org/maven2
layout: default
snapshots: [enabled => false, update => daily]
releases: [enabled => true, update => daily]
]
[DEBUG] (f) session = org.apache.maven.execution.MavenSession@7815bc09
[DEBUG] -- end configuration --
[INFO] Generating project in Interactive mode
[INFO] Archetype defined by properties
:
[DEBUG] Could not find metadata
org.apache.syncope:syncope-archetype:1.2.0-SNAPSHOT/maven-metadata.xml
in local (/home/nik/.m2/repository)
[DEBUG] Using connector WagonRepositoryConnector with priority 0 for
http://repository.apache.org/content/repositories/snapshots
Downloading:
http://repository.apache.org/content/repositories/snapshots/org/apache/syncope/syncope-archetype/1.2.0-SNAPSHOT/maven-metadata.xml
:
Please look at the attached log (look.gz) of the whole thing
If you could please run the same command on your system (mvn -X) I will
be happy to look at the output and work what the issue maybe.
I suspect the trace around remoteArtifactRepositories is the problem but
maybe it is ok:
VIZ:
:
[DEBUG] (f) localRepository = id: local
url: file:///home/nik/.m2/repository/
layout: none
[DEBUG] (f) remoteArtifactRepositories = [ id: central
url: http://repo.maven.apache.org/maven2
layout: default
rgds,
Nik
> On 27/05/2013 11:54, Jesse van Bekkum wrote:
>> Could you have a look at this issue, or at least tell me what Log
>> files to look at?
>
> I think that the easiest way to share and make reproducible your issue
> is for you to publish somewhere a minimal Syncope project including a
> single H2 or CSV resource and your workflow customizations + detail
> the steps to reproduce the problem.
>
> Once we got this someone can eventually spend his time on taking a
> look and possibly giving a helping hand.
>
>> Using the method you described I just cannot provision (or
>> deprovision) already existing users, and this is a serious issue for
>> my project (and for syncope in general, what's an IDM product that
>> cannot provision reliably?)
>
> Maybe it's not up to the IDM product, it's up to you ;-)
>
>> The only way I can get it to work is to do a rest call from the
>> workflow, but this is a hack, and unreliable
>
> Agree.
>
> Regards.
>
>> On Tue, May 21, 2013 at 11:29 AM, Jesse van Bekkum <bekkum@gmail.com
>> <ma...@gmail.com>> wrote:
>>
>> I am not trying an update to an external resource, I am trying a
>> provisioning, but not on the creation of a user, but at a later
>> point.
>>
>> I cannot find anything in the logs, in the connid log this user
>> simply does not occur after activation. What logs would I have to
>> look at?
>>
>> How does the console do it? The console is able to actually
>> provision a user, and then the PropagationTO fields will be
>> filled. In my activation, they are not.
>>
>> Jesse
>>
>>
>> On Wed, May 15, 2013 at 9:24 AM, Francesco Chicchiriccò
>> <ilgrosso@apache.org <ma...@apache.org>> wrote:
>>
>> On 14/05/2013 15:14, Jesse van Bekkum wrote:
>>> Hi Francesco
>>>
>>> I have used the code above to provision a resource. On a
>>> user that has not been created yet (id = null) it works
>>> fine. However, on another user who already existed, it does
>>> not provision. When I do another update action on that user,
>>> even on a completely unrelated attribute, it triggers the
>>> provisioning.
>>>
>>> I think I did not see this behavior on 1.0.7, but I see it
>>> on 1.1.1. Any idea what the cause is?
>>
>> It might be related on some optimizations made in the
>> provisioning layer: in 1.1.X an update is triggered towards
>> an external resource only if one or more of the mapped
>> attributes is different from what is actually read from the
>> same resource. In this respect, this might not be a bug.
>>
>> I cannot tell you more, some additional investigation - with
>> DEBUG logging - is required.
>>
>> Regards.
>>
>>
>>> I tried setting the usermod with the id of the existing
>>> user, but that did not work.
>>>
>>> Jesse
>>>
>>>
>>>
>>> On Tue, Apr 30, 2013 at 10:22 AM, Francesco Chicchiriccò
>>> <ilgrosso@apache.org <ma...@apache.org>> wrote:
>>>
>>> On 30/04/2013 10:21, Jesse van Bekkum wrote:
>>>> No, I was just reading the requirements. I will get to
>>>> it, but I will also need permission from Everett. The
>>>> complete procedure will probably take a while I see.
>>>
>>> Ok, let's wait for that.
>>>
>>>
>>> Regards.
>>>
>>>> On Tue, Apr 30, 2013 at 10:15 AM, Francesco
>>>> Chicchiriccò <ilgrosso@apache.org
>>>> <ma...@apache.org>> wrote:
>>>>
>>>> On 30/04/2013 10:09, Jesse van Bekkum wrote:
>>>>> Hi Francisco
>>>>>
>>>>> Sounds like a fine idea. My username is Jesse van
>>>>> Bekkum. You can give me write access.
>>>>
>>>> We have to wait for your ICLA to be received and
>>>> notified: have you already sent it?
>>>>
>>>> Regards.
>>>>
>>>>
>>>>> On Tue, Apr 30, 2013 at 8:52 AM, Francesco
>>>>> Chicchiriccò <ilgrosso@apache.org
>>>>> <ma...@apache.org>> wrote:
>>>>>
>>>>> On 29/04/2013 15:42, Jesse van Bekkum wrote:
>>>>>> Hi Francesco
>>>>>>
>>>>>> Thanks for your help. There was one small
>>>>>> issue with your example, since on user
>>>>>> creation you do not have a usermod on the
>>>>>> execution yet. But that was easily fixed.
>>>>>>
>>>>>> I have used the following code and rule in my
>>>>>> workflow to get this working. Might I suggest
>>>>>> that we use this in the standard deployment
>>>>>> of Syncope? I think that provisioning via the
>>>>>> workflow is functionality that should be
>>>>>> included out of the box. The version I made
>>>>>> is parameterized via the workflow
>>>>>> (description of usage is included) so it is
>>>>>> not specific to my project.
>>>>>
>>>>> Jesse,
>>>>> this sounds like a nice extension: why don't
>>>>> you report it in a wiki page under [2]?
>>>>>
>>>>> You need to:
>>>>> 1. complete and submit an ICLA [3]
>>>>> 2. create a wiki user (if not already done)
>>>>> and tell me the username so that I can grant
>>>>> you write access to the wiki
>>>>>
>>>>> WDYT?
>>>>>
>>>>> Regards.
>>>>>
>>>>>
>>>>>> import
>>>>>> org.activiti.engine.delegate.DelegateExecution;
>>>>>> import org.activiti.engine.delegate.Expression;
>>>>>> import org.apache.syncope.client.mod.UserMod;
>>>>>> import
>>>>>> org.apache.syncope.core.persistence.beans.user.SyncopeUser;
>>>>>> import
>>>>>> org.apache.syncope.core.propagation.PropagationByResource;
>>>>>> import
>>>>>> org.apache.syncope.core.workflow.ActivitiUserWorkflowAdapter;
>>>>>> import
>>>>>> org.apache.syncope.core.workflow.WorkflowException;
>>>>>> import
>>>>>> org.apache.syncope.core.workflow.activiti.AbstractActivitiDelegate;
>>>>>> import org.slf4j.Logger;
>>>>>> import org.slf4j.LoggerFactory;
>>>>>>
>>>>>> /**
>>>>>> * This workflow service task allows to
>>>>>> provision a resource to a user from the
>>>>>> workflow.
>>>>>> *
>>>>>> * Use the following code in the workflow:
>>>>>> *
>>>>>> * <serviceTask id="addResource" name="Add
>>>>>> Resource"
>>>>>> activiti:class="org.apache.syncope.core.workflow.activiti.ProvisionResources">
>>>>>> <extensionElements>
>>>>>> <activiti:field name="resource"
>>>>>> stringValue="%%YOUR_RESOURCE%%"/>
>>>>>> </extensionElements>
>>>>>> </serviceTask>
>>>>>> */
>>>>>> public class ProvisionResources extends
>>>>>> AbstractActivitiDelegate {
>>>>>>
>>>>>> protected static final Logger LOG =
>>>>>> LoggerFactory.getLogger(ProvisionResources.class);
>>>>>>
>>>>>> private Expression resource;
>>>>>>
>>>>>> public void setResource(Expression resource) {
>>>>>> this.resource = resource;
>>>>>> }
>>>>>>
>>>>>> @Override
>>>>>> protected void doExecute(DelegateExecution
>>>>>> execution) throws Exception {
>>>>>> String resourceName = (String)
>>>>>> resource.getValue(execution);
>>>>>>
>>>>>> if (resourceName == null ||
>>>>>> resourceName.isEmpty()) {
>>>>>> throw new WorkflowException(new
>>>>>> IllegalStateException("Please specify a
>>>>>> resource"));
>>>>>> }
>>>>>>
>>>>>> SyncopeUser user = (SyncopeUser)
>>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>>>>> UserMod userMod = (UserMod)
>>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
>>>>>> if (userMod == null) {
>>>>>> userMod = new UserMod();
>>>>>> }
>>>>>>
>>>>>> userMod.addResourceToBeAdded(resourceName);
>>>>>>
>>>>>> // update SyncopeUser
>>>>>> PropagationByResource propByRes =
>>>>>> dataBinder.update(user, userMod);
>>>>>>
>>>>>> // report updated user and propagation by
>>>>>> resource as result
>>>>>> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER,
>>>>>> user);
>>>>>> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
>>>>>> propByRes);
>>>>>>
>>>>>> }
>>>>>> }
>>>>>>
>>>>>>
>>>>>> On Tue, Apr 23, 2013 at 10:38 AM, Francesco
>>>>>> Chicchiriccò <ilgrosso@apache.org
>>>>>> <ma...@apache.org>> wrote:
>>>>>>
>>>>>> On 22/04/2013 21:40, Jesse van Bekkum wrote:
>>>>>>> Hi
>>>>>>>
>>>>>>> Quick question.
>>>>>>>
>>>>>>> How can you provision a resource to a
>>>>>>> user from the workflow? I have a
>>>>>>> workflow, and after creating a user with
>>>>>>> a rest call, I want, depending on the
>>>>>>> path through the workflow, to
>>>>>>> automatically provision a resource.
>>>>>>>
>>>>>>> I tried this in a workflow step:
>>>>>>>
>>>>>>> ResourceDAO resourceDAO =
>>>>>>> CONTEXT.getBean(ResourceDAO.class);
>>>>>>> ExternalResource idp =
>>>>>>> resourceDAO.find("IDP_RESOURCE");
>>>>>>> SyncopeUser user = (SyncopeUser)
>>>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>>>>>> user.addResource(idp);
>>>>>>>
>>>>>>> But after creation the user had no
>>>>>>> resources. In the past (0.7) we have
>>>>>>> used manual propagation, by retrieving
>>>>>>> the propagation handler from the context
>>>>>>> and firing it, but that seems a bit
>>>>>>> inelegant to me.
>>>>>>>
>>>>>>> What is the preferred solution to this
>>>>>>> (I think common) scenario?
>>>>>>
>>>>>> Hi Jesse,
>>>>>> please take a look at the Update task
>>>>>> [1]: you could change the doExecute()
>>>>>> method there to match the logic expressed
>>>>>> above
>>>>>>
>>>>>>
>>>>>> SyncopeUser user = (SyncopeUser)
>>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>>>>> UserMod userMod = (UserMod)
>>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
>>>>>>
>>>>>> // YOUR step, e.g. add resource
>>>>>> userMod.addResourceToBeAdded("IDP_RESOURCE");
>>>>>>
>>>>>> // update SyncopeUser
>>>>>> PropagationByResource propByRes =
>>>>>> dataBinder.update(user, userMod);
>>>>>>
>>>>>> // report updated user and
>>>>>> propagation by resource as result
>>>>>> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER,
>>>>>> user);
>>>>>> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
>>>>>> propByRes);
>>>>>>
>>>>>> Please note the final statements
>>>>>> execution.setVariable() - without these
>>>>>> the changes are not propagated back to
>>>>>> the flow.
>>>>>>
>>>>>> Regards.
>>>>>>
>>>>>> [1]
>>>>>> https://svn.apache.org/repos/asf/syncope/branches/1_1_X/core/src/main/java/org/apache/syncope/core/workflow/user/activiti/task/Update.java
>>>>>>
>>>>> [2]
>>>>> https://cwiki.apache.org/confluence/display/SYNCOPE/Extending+Syncope
>>>>> [3]
>>>>> http://www.apache.org/dev/new-committers-guide.html#cla
>>>>>
> --
> Francesco Chicchiriccò
>
> ASF Member, Apache Syncope PMC chair, Apache Cocoon PMC Member
> http://people.apache.org/~ilgrosso/
Re: How to provision a resource from the workflow
Posted by Francesco Chicchiriccò <il...@apache.org>.
On 27/05/2013 11:54, Jesse van Bekkum wrote:
> Could you have a look at this issue, or at least tell me what Log
> files to look at?
I think that the easiest way to share and make reproducible your issue
is for you to publish somewhere a minimal Syncope project including a
single H2 or CSV resource and your workflow customizations + detail the
steps to reproduce the problem.
Once we got this someone can eventually spend his time on taking a look
and possibly giving a helping hand.
> Using the method you described I just cannot provision (or
> deprovision) already existing users, and this is a serious issue for
> my project (and for syncope in general, what's an IDM product that
> cannot provision reliably?)
Maybe it's not up to the IDM product, it's up to you ;-)
> The only way I can get it to work is to do a rest call from the
> workflow, but this is a hack, and unreliable
Agree.
Regards.
> On Tue, May 21, 2013 at 11:29 AM, Jesse van Bekkum <bekkum@gmail.com
> <ma...@gmail.com>> wrote:
>
> I am not trying an update to an external resource, I am trying a
> provisioning, but not on the creation of a user, but at a later
> point.
>
> I cannot find anything in the logs, in the connid log this user
> simply does not occur after activation. What logs would I have to
> look at?
>
> How does the console do it? The console is able to actually
> provision a user, and then the PropagationTO fields will be
> filled. In my activation, they are not.
>
> Jesse
>
>
> On Wed, May 15, 2013 at 9:24 AM, Francesco Chicchiriccò
> <ilgrosso@apache.org <ma...@apache.org>> wrote:
>
> On 14/05/2013 15:14, Jesse van Bekkum wrote:
>> Hi Francesco
>>
>> I have used the code above to provision a resource. On a user
>> that has not been created yet (id = null) it works fine.
>> However, on another user who already existed, it does not
>> provision. When I do another update action on that user, even
>> on a completely unrelated attribute, it triggers the
>> provisioning.
>>
>> I think I did not see this behavior on 1.0.7, but I see it on
>> 1.1.1. Any idea what the cause is?
>
> It might be related on some optimizations made in the
> provisioning layer: in 1.1.X an update is triggered towards an
> external resource only if one or more of the mapped attributes
> is different from what is actually read from the same
> resource. In this respect, this might not be a bug.
>
> I cannot tell you more, some additional investigation - with
> DEBUG logging - is required.
>
> Regards.
>
>
>> I tried setting the usermod with the id of the existing user,
>> but that did not work.
>>
>> Jesse
>>
>>
>>
>> On Tue, Apr 30, 2013 at 10:22 AM, Francesco Chicchiriccò
>> <ilgrosso@apache.org <ma...@apache.org>> wrote:
>>
>> On 30/04/2013 10:21, Jesse van Bekkum wrote:
>>> No, I was just reading the requirements. I will get to
>>> it, but I will also need permission from Everett. The
>>> complete procedure will probably take a while I see.
>>
>> Ok, let's wait for that.
>>
>>
>> Regards.
>>
>>> On Tue, Apr 30, 2013 at 10:15 AM, Francesco Chicchiriccò
>>> <ilgrosso@apache.org <ma...@apache.org>> wrote:
>>>
>>> On 30/04/2013 10:09, Jesse van Bekkum wrote:
>>>> Hi Francisco
>>>>
>>>> Sounds like a fine idea. My username is Jesse van
>>>> Bekkum. You can give me write access.
>>>
>>> We have to wait for your ICLA to be received and
>>> notified: have you already sent it?
>>>
>>> Regards.
>>>
>>>
>>>> On Tue, Apr 30, 2013 at 8:52 AM, Francesco
>>>> Chicchiriccò <ilgrosso@apache.org
>>>> <ma...@apache.org>> wrote:
>>>>
>>>> On 29/04/2013 15:42, Jesse van Bekkum wrote:
>>>>> Hi Francesco
>>>>>
>>>>> Thanks for your help. There was one small
>>>>> issue with your example, since on user
>>>>> creation you do not have a usermod on the
>>>>> execution yet. But that was easily fixed.
>>>>>
>>>>> I have used the following code and rule in my
>>>>> workflow to get this working. Might I suggest
>>>>> that we use this in the standard deployment of
>>>>> Syncope? I think that provisioning via the
>>>>> workflow is functionality that should be
>>>>> included out of the box. The version I made is
>>>>> parameterized via the workflow (description of
>>>>> usage is included) so it is not specific to my
>>>>> project.
>>>>
>>>> Jesse,
>>>> this sounds like a nice extension: why don't
>>>> you report it in a wiki page under [2]?
>>>>
>>>> You need to:
>>>> 1. complete and submit an ICLA [3]
>>>> 2. create a wiki user (if not already done)
>>>> and tell me the username so that I can grant
>>>> you write access to the wiki
>>>>
>>>> WDYT?
>>>>
>>>> Regards.
>>>>
>>>>
>>>>> import
>>>>> org.activiti.engine.delegate.DelegateExecution;
>>>>> import org.activiti.engine.delegate.Expression;
>>>>> import org.apache.syncope.client.mod.UserMod;
>>>>> import
>>>>> org.apache.syncope.core.persistence.beans.user.SyncopeUser;
>>>>> import
>>>>> org.apache.syncope.core.propagation.PropagationByResource;
>>>>> import
>>>>> org.apache.syncope.core.workflow.ActivitiUserWorkflowAdapter;
>>>>> import
>>>>> org.apache.syncope.core.workflow.WorkflowException;
>>>>> import
>>>>> org.apache.syncope.core.workflow.activiti.AbstractActivitiDelegate;
>>>>> import org.slf4j.Logger;
>>>>> import org.slf4j.LoggerFactory;
>>>>>
>>>>> /**
>>>>> * This workflow service task allows to
>>>>> provision a resource to a user from the workflow.
>>>>> *
>>>>> * Use the following code in the workflow:
>>>>> *
>>>>> * <serviceTask id="addResource" name="Add
>>>>> Resource"
>>>>> activiti:class="org.apache.syncope.core.workflow.activiti.ProvisionResources">
>>>>> <extensionElements>
>>>>> <activiti:field name="resource"
>>>>> stringValue="%%YOUR_RESOURCE%%"/>
>>>>> </extensionElements>
>>>>> </serviceTask>
>>>>> */
>>>>> public class ProvisionResources extends
>>>>> AbstractActivitiDelegate {
>>>>>
>>>>> protected static final Logger LOG =
>>>>> LoggerFactory.getLogger(ProvisionResources.class);
>>>>>
>>>>> private Expression resource;
>>>>>
>>>>> public void setResource(Expression resource) {
>>>>> this.resource = resource;
>>>>> }
>>>>>
>>>>> @Override
>>>>> protected void doExecute(DelegateExecution
>>>>> execution) throws Exception {
>>>>> String resourceName = (String)
>>>>> resource.getValue(execution);
>>>>>
>>>>> if (resourceName == null ||
>>>>> resourceName.isEmpty()) {
>>>>> throw new WorkflowException(new
>>>>> IllegalStateException("Please specify a
>>>>> resource"));
>>>>> }
>>>>>
>>>>> SyncopeUser user = (SyncopeUser)
>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>>>> UserMod userMod = (UserMod)
>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
>>>>> if (userMod == null) {
>>>>> userMod = new UserMod();
>>>>> }
>>>>>
>>>>> userMod.addResourceToBeAdded(resourceName);
>>>>>
>>>>> // update SyncopeUser
>>>>> PropagationByResource propByRes =
>>>>> dataBinder.update(user, userMod);
>>>>>
>>>>> // report updated user and propagation by
>>>>> resource as result
>>>>> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER,
>>>>> user);
>>>>> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
>>>>> propByRes);
>>>>>
>>>>> }
>>>>> }
>>>>>
>>>>>
>>>>> On Tue, Apr 23, 2013 at 10:38 AM, Francesco
>>>>> Chicchiriccò <ilgrosso@apache.org
>>>>> <ma...@apache.org>> wrote:
>>>>>
>>>>> On 22/04/2013 21:40, Jesse van Bekkum wrote:
>>>>>> Hi
>>>>>>
>>>>>> Quick question.
>>>>>>
>>>>>> How can you provision a resource to a
>>>>>> user from the workflow? I have a
>>>>>> workflow, and after creating a user with
>>>>>> a rest call, I want, depending on the
>>>>>> path through the workflow, to
>>>>>> automatically provision a resource.
>>>>>>
>>>>>> I tried this in a workflow step:
>>>>>>
>>>>>> ResourceDAO resourceDAO =
>>>>>> CONTEXT.getBean(ResourceDAO.class);
>>>>>> ExternalResource idp =
>>>>>> resourceDAO.find("IDP_RESOURCE");
>>>>>> SyncopeUser user = (SyncopeUser)
>>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>>>>> user.addResource(idp);
>>>>>>
>>>>>> But after creation the user had no
>>>>>> resources. In the past (0.7) we have used
>>>>>> manual propagation, by retrieving the
>>>>>> propagation handler from the context and
>>>>>> firing it, but that seems a bit inelegant
>>>>>> to me.
>>>>>>
>>>>>> What is the preferred solution to this (I
>>>>>> think common) scenario?
>>>>>
>>>>> Hi Jesse,
>>>>> please take a look at the Update task [1]:
>>>>> you could change the doExecute() method
>>>>> there to match the logic expressed above
>>>>>
>>>>>
>>>>> SyncopeUser user = (SyncopeUser)
>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>>>> UserMod userMod = (UserMod)
>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
>>>>>
>>>>> // YOUR step, e.g. add resource
>>>>> userMod.addResourceToBeAdded("IDP_RESOURCE");
>>>>>
>>>>> // update SyncopeUser
>>>>> PropagationByResource propByRes =
>>>>> dataBinder.update(user, userMod);
>>>>>
>>>>> // report updated user and
>>>>> propagation by resource as result
>>>>> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER,
>>>>> user);
>>>>> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
>>>>> propByRes);
>>>>>
>>>>> Please note the final statements
>>>>> execution.setVariable() - without these
>>>>> the changes are not propagated back to the
>>>>> flow.
>>>>>
>>>>> Regards.
>>>>>
>>>>> [1]
>>>>> https://svn.apache.org/repos/asf/syncope/branches/1_1_X/core/src/main/java/org/apache/syncope/core/workflow/user/activiti/task/Update.java
>>>>>
>>>> [2]
>>>> https://cwiki.apache.org/confluence/display/SYNCOPE/Extending+Syncope
>>>> [3]
>>>> http://www.apache.org/dev/new-committers-guide.html#cla
>>>>
--
Francesco Chicchiriccò
ASF Member, Apache Syncope PMC chair, Apache Cocoon PMC Member
http://people.apache.org/~ilgrosso/
Re: How to provision a resource from the workflow
Posted by Jesse van Bekkum <be...@gmail.com>.
Could you have a look at this issue, or at least tell me what Log files to
look at?
Using the method you described I just cannot provision (or deprovision)
already existing users, and this is a serious issue for my project (and for
syncope in general, what's an IDM product that cannot provision reliably?)
The only way I can get it to work is to do a rest call from the workflow,
but this is a hack, and unreliable
Jesse
On Tue, May 21, 2013 at 11:29 AM, Jesse van Bekkum <be...@gmail.com> wrote:
> I am not trying an update to an external resource, I am trying a
> provisioning, but not on the creation of a user, but at a later point.
>
> I cannot find anything in the logs, in the connid log this user simply
> does not occur after activation. What logs would I have to look at?
>
> How does the console do it? The console is able to actually provision a
> user, and then the PropagationTO fields will be filled. In my activation,
> they are not.
>
> Jesse
>
>
> On Wed, May 15, 2013 at 9:24 AM, Francesco Chicchiriccò <
> ilgrosso@apache.org> wrote:
>
>> On 14/05/2013 15:14, Jesse van Bekkum wrote:
>>
>> Hi Francesco
>>
>> I have used the code above to provision a resource. On a user that has
>> not been created yet (id = null) it works fine. However, on another user
>> who already existed, it does not provision. When I do another update action
>> on that user, even on a completely unrelated attribute, it triggers the
>> provisioning.
>>
>> I think I did not see this behavior on 1.0.7, but I see it on 1.1.1.
>> Any idea what the cause is?
>>
>>
>> It might be related on some optimizations made in the provisioning layer:
>> in 1.1.X an update is triggered towards an external resource only if one or
>> more of the mapped attributes is different from what is actually read from
>> the same resource. In this respect, this might not be a bug.
>>
>> I cannot tell you more, some additional investigation - with DEBUG
>> logging - is required.
>>
>> Regards.
>>
>>
>> I tried setting the usermod with the id of the existing user, but that
>> did not work.
>>
>> Jesse
>>
>>
>>
>> On Tue, Apr 30, 2013 at 10:22 AM, Francesco Chicchiriccò <
>> ilgrosso@apache.org> wrote:
>>
>>> On 30/04/2013 10:21, Jesse van Bekkum wrote:
>>>
>>> No, I was just reading the requirements. I will get to it, but I will
>>> also need permission from Everett. The complete procedure will probably
>>> take a while I see.
>>>
>>>
>>> Ok, let's wait for that.
>>>
>>>
>>> Regards.
>>>
>>> On Tue, Apr 30, 2013 at 10:15 AM, Francesco Chicchiriccò <
>>> ilgrosso@apache.org> wrote:
>>>
>>>> On 30/04/2013 10:09, Jesse van Bekkum wrote:
>>>>
>>>> Hi Francisco
>>>>
>>>> Sounds like a fine idea. My username is Jesse van Bekkum. You can
>>>> give me write access.
>>>>
>>>>
>>>> We have to wait for your ICLA to be received and notified: have you
>>>> already sent it?
>>>>
>>>> Regards.
>>>>
>>>>
>>>> On Tue, Apr 30, 2013 at 8:52 AM, Francesco Chicchiriccò <
>>>> ilgrosso@apache.org> wrote:
>>>>
>>>>> On 29/04/2013 15:42, Jesse van Bekkum wrote:
>>>>>
>>>>> Hi Francesco
>>>>>
>>>>> Thanks for your help. There was one small issue with your example,
>>>>> since on user creation you do not have a usermod on the execution yet. But
>>>>> that was easily fixed.
>>>>>
>>>>> I have used the following code and rule in my workflow to get this
>>>>> working. Might I suggest that we use this in the standard deployment of
>>>>> Syncope? I think that provisioning via the workflow is functionality that
>>>>> should be included out of the box. The version I made is parameterized via
>>>>> the workflow (description of usage is included) so it is not specific to my
>>>>> project.
>>>>>
>>>>>
>>>>> Jesse,
>>>>> this sounds like a nice extension: why don't you report it in a wiki
>>>>> page under [2]?
>>>>>
>>>>> You need to:
>>>>> 1. complete and submit an ICLA [3]
>>>>> 2. create a wiki user (if not already done) and tell me the username
>>>>> so that I can grant you write access to the wiki
>>>>>
>>>>> WDYT?
>>>>>
>>>>> Regards.
>>>>>
>>>>>
>>>>> import org.activiti.engine.delegate.DelegateExecution;
>>>>> import org.activiti.engine.delegate.Expression;
>>>>> import org.apache.syncope.client.mod.UserMod;
>>>>> import org.apache.syncope.core.persistence.beans.user.SyncopeUser;
>>>>> import org.apache.syncope.core.propagation.PropagationByResource;
>>>>> import org.apache.syncope.core.workflow.ActivitiUserWorkflowAdapter;
>>>>> import org.apache.syncope.core.workflow.WorkflowException;
>>>>> import
>>>>> org.apache.syncope.core.workflow.activiti.AbstractActivitiDelegate;
>>>>> import org.slf4j.Logger;
>>>>> import org.slf4j.LoggerFactory;
>>>>>
>>>>> /**
>>>>> * This workflow service task allows to provision a resource to a user
>>>>> from the workflow.
>>>>> *
>>>>> * Use the following code in the workflow:
>>>>> *
>>>>> * <serviceTask id="addResource" name="Add Resource"
>>>>>
>>>>> activiti:class="org.apache.syncope.core.workflow.activiti.ProvisionResources">
>>>>> <extensionElements>
>>>>> <activiti:field name="resource"
>>>>> stringValue="%%YOUR_RESOURCE%%"/>
>>>>> </extensionElements>
>>>>> </serviceTask>
>>>>> */
>>>>> public class ProvisionResources extends AbstractActivitiDelegate {
>>>>>
>>>>> protected static final Logger LOG =
>>>>> LoggerFactory.getLogger(ProvisionResources.class);
>>>>>
>>>>> private Expression resource;
>>>>>
>>>>> public void setResource(Expression resource) {
>>>>> this.resource = resource;
>>>>> }
>>>>>
>>>>> @Override
>>>>> protected void doExecute(DelegateExecution execution) throws
>>>>> Exception {
>>>>> String resourceName = (String) resource.getValue(execution);
>>>>>
>>>>> if (resourceName == null || resourceName.isEmpty()) {
>>>>> throw new WorkflowException(new
>>>>> IllegalStateException("Please specify a resource"));
>>>>> }
>>>>>
>>>>> SyncopeUser user = (SyncopeUser)
>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>>>> UserMod userMod = (UserMod)
>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
>>>>> if (userMod == null) {
>>>>> userMod = new UserMod();
>>>>> }
>>>>>
>>>>> userMod.addResourceToBeAdded(resourceName);
>>>>>
>>>>> // update SyncopeUser
>>>>> PropagationByResource propByRes = dataBinder.update(user,
>>>>> userMod);
>>>>>
>>>>> // report updated user and propagation by resource as result
>>>>>
>>>>> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER, user);
>>>>>
>>>>> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
>>>>> propByRes);
>>>>>
>>>>> }
>>>>> }
>>>>>
>>>>>
>>>>> On Tue, Apr 23, 2013 at 10:38 AM, Francesco Chicchiriccò <
>>>>> ilgrosso@apache.org> wrote:
>>>>>
>>>>>> On 22/04/2013 21:40, Jesse van Bekkum wrote:
>>>>>>
>>>>>> Hi
>>>>>>
>>>>>> Quick question.
>>>>>>
>>>>>> How can you provision a resource to a user from the workflow? I
>>>>>> have a workflow, and after creating a user with a rest call, I want,
>>>>>> depending on the path through the workflow, to automatically provision a
>>>>>> resource.
>>>>>>
>>>>>> I tried this in a workflow step:
>>>>>>
>>>>>> ResourceDAO resourceDAO =
>>>>>> CONTEXT.getBean(ResourceDAO.class);
>>>>>> ExternalResource idp = resourceDAO.find("IDP_RESOURCE");
>>>>>> SyncopeUser user = (SyncopeUser)
>>>>>>
>>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>>>>> user.addResource(idp);
>>>>>>
>>>>>> But after creation the user had no resources. In the past (0.7) we
>>>>>> have used manual propagation, by retrieving the propagation handler from
>>>>>> the context and firing it, but that seems a bit inelegant to me.
>>>>>>
>>>>>> What is the preferred solution to this (I think common) scenario?
>>>>>>
>>>>>>
>>>>>> Hi Jesse,
>>>>>> please take a look at the Update task [1]: you could change the
>>>>>> doExecute() method there to match the logic expressed above
>>>>>>
>>>>>>
>>>>>> SyncopeUser user = (SyncopeUser)
>>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>>>>> UserMod userMod = (UserMod)
>>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
>>>>>>
>>>>>> // YOUR step, e.g. add resource
>>>>>> userMod.addResourceToBeAdded("IDP_RESOURCE");
>>>>>>
>>>>>> // update SyncopeUser
>>>>>> PropagationByResource propByRes = dataBinder.update(user,
>>>>>> userMod);
>>>>>>
>>>>>> // report updated user and propagation by resource as result
>>>>>>
>>>>>> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER, user);
>>>>>>
>>>>>> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
>>>>>> propByRes);
>>>>>>
>>>>>> Please note the final statements execution.setVariable() - without
>>>>>> these the changes are not propagated back to the flow.
>>>>>>
>>>>>> Regards.
>>>>>>
>>>>>> [1]
>>>>>> https://svn.apache.org/repos/asf/syncope/branches/1_1_X/core/src/main/java/org/apache/syncope/core/workflow/user/activiti/task/Update.java
>>>>>>
>>>>> [2]
>>>>> https://cwiki.apache.org/confluence/display/SYNCOPE/Extending+Syncope
>>>>> [3] http://www.apache.org/dev/new-committers-guide.html#cla
>>>>>
>>>> --
>> Francesco Chicchiriccò
>>
>> ASF Member, Apache Syncope PMC chair, Apache Cocoon PMC Memberhttp://people.apache.org/~ilgrosso/
>>
>>
>
Re: How to provision a resource from the workflow
Posted by Jesse van Bekkum <be...@gmail.com>.
I am not trying an update to an external resource, I am trying a
provisioning, but not on the creation of a user, but at a later point.
I cannot find anything in the logs, in the connid log this user simply does
not occur after activation. What logs would I have to look at?
How does the console do it? The console is able to actually provision a
user, and then the PropagationTO fields will be filled. In my activation,
they are not.
Jesse
On Wed, May 15, 2013 at 9:24 AM, Francesco Chicchiriccò <ilgrosso@apache.org
> wrote:
> On 14/05/2013 15:14, Jesse van Bekkum wrote:
>
> Hi Francesco
>
> I have used the code above to provision a resource. On a user that has
> not been created yet (id = null) it works fine. However, on another user
> who already existed, it does not provision. When I do another update action
> on that user, even on a completely unrelated attribute, it triggers the
> provisioning.
>
> I think I did not see this behavior on 1.0.7, but I see it on 1.1.1. Any
> idea what the cause is?
>
>
> It might be related on some optimizations made in the provisioning layer:
> in 1.1.X an update is triggered towards an external resource only if one or
> more of the mapped attributes is different from what is actually read from
> the same resource. In this respect, this might not be a bug.
>
> I cannot tell you more, some additional investigation - with DEBUG logging
> - is required.
>
> Regards.
>
>
> I tried setting the usermod with the id of the existing user, but that
> did not work.
>
> Jesse
>
>
>
> On Tue, Apr 30, 2013 at 10:22 AM, Francesco Chicchiriccò <
> ilgrosso@apache.org> wrote:
>
>> On 30/04/2013 10:21, Jesse van Bekkum wrote:
>>
>> No, I was just reading the requirements. I will get to it, but I will
>> also need permission from Everett. The complete procedure will probably
>> take a while I see.
>>
>>
>> Ok, let's wait for that.
>>
>>
>> Regards.
>>
>> On Tue, Apr 30, 2013 at 10:15 AM, Francesco Chicchiriccò <
>> ilgrosso@apache.org> wrote:
>>
>>> On 30/04/2013 10:09, Jesse van Bekkum wrote:
>>>
>>> Hi Francisco
>>>
>>> Sounds like a fine idea. My username is Jesse van Bekkum. You can give
>>> me write access.
>>>
>>>
>>> We have to wait for your ICLA to be received and notified: have you
>>> already sent it?
>>>
>>> Regards.
>>>
>>>
>>> On Tue, Apr 30, 2013 at 8:52 AM, Francesco Chicchiriccò <
>>> ilgrosso@apache.org> wrote:
>>>
>>>> On 29/04/2013 15:42, Jesse van Bekkum wrote:
>>>>
>>>> Hi Francesco
>>>>
>>>> Thanks for your help. There was one small issue with your example,
>>>> since on user creation you do not have a usermod on the execution yet. But
>>>> that was easily fixed.
>>>>
>>>> I have used the following code and rule in my workflow to get this
>>>> working. Might I suggest that we use this in the standard deployment of
>>>> Syncope? I think that provisioning via the workflow is functionality that
>>>> should be included out of the box. The version I made is parameterized via
>>>> the workflow (description of usage is included) so it is not specific to my
>>>> project.
>>>>
>>>>
>>>> Jesse,
>>>> this sounds like a nice extension: why don't you report it in a wiki
>>>> page under [2]?
>>>>
>>>> You need to:
>>>> 1. complete and submit an ICLA [3]
>>>> 2. create a wiki user (if not already done) and tell me the username
>>>> so that I can grant you write access to the wiki
>>>>
>>>> WDYT?
>>>>
>>>> Regards.
>>>>
>>>>
>>>> import org.activiti.engine.delegate.DelegateExecution;
>>>> import org.activiti.engine.delegate.Expression;
>>>> import org.apache.syncope.client.mod.UserMod;
>>>> import org.apache.syncope.core.persistence.beans.user.SyncopeUser;
>>>> import org.apache.syncope.core.propagation.PropagationByResource;
>>>> import org.apache.syncope.core.workflow.ActivitiUserWorkflowAdapter;
>>>> import org.apache.syncope.core.workflow.WorkflowException;
>>>> import
>>>> org.apache.syncope.core.workflow.activiti.AbstractActivitiDelegate;
>>>> import org.slf4j.Logger;
>>>> import org.slf4j.LoggerFactory;
>>>>
>>>> /**
>>>> * This workflow service task allows to provision a resource to a user
>>>> from the workflow.
>>>> *
>>>> * Use the following code in the workflow:
>>>> *
>>>> * <serviceTask id="addResource" name="Add Resource"
>>>>
>>>> activiti:class="org.apache.syncope.core.workflow.activiti.ProvisionResources">
>>>> <extensionElements>
>>>> <activiti:field name="resource"
>>>> stringValue="%%YOUR_RESOURCE%%"/>
>>>> </extensionElements>
>>>> </serviceTask>
>>>> */
>>>> public class ProvisionResources extends AbstractActivitiDelegate {
>>>>
>>>> protected static final Logger LOG =
>>>> LoggerFactory.getLogger(ProvisionResources.class);
>>>>
>>>> private Expression resource;
>>>>
>>>> public void setResource(Expression resource) {
>>>> this.resource = resource;
>>>> }
>>>>
>>>> @Override
>>>> protected void doExecute(DelegateExecution execution) throws
>>>> Exception {
>>>> String resourceName = (String) resource.getValue(execution);
>>>>
>>>> if (resourceName == null || resourceName.isEmpty()) {
>>>> throw new WorkflowException(new
>>>> IllegalStateException("Please specify a resource"));
>>>> }
>>>>
>>>> SyncopeUser user = (SyncopeUser)
>>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>>> UserMod userMod = (UserMod)
>>>> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
>>>> if (userMod == null) {
>>>> userMod = new UserMod();
>>>> }
>>>>
>>>> userMod.addResourceToBeAdded(resourceName);
>>>>
>>>> // update SyncopeUser
>>>> PropagationByResource propByRes = dataBinder.update(user,
>>>> userMod);
>>>>
>>>> // report updated user and propagation by resource as result
>>>> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER,
>>>> user);
>>>>
>>>> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
>>>> propByRes);
>>>>
>>>> }
>>>> }
>>>>
>>>>
>>>> On Tue, Apr 23, 2013 at 10:38 AM, Francesco Chicchiriccò <
>>>> ilgrosso@apache.org> wrote:
>>>>
>>>>> On 22/04/2013 21:40, Jesse van Bekkum wrote:
>>>>>
>>>>> Hi
>>>>>
>>>>> Quick question.
>>>>>
>>>>> How can you provision a resource to a user from the workflow? I have
>>>>> a workflow, and after creating a user with a rest call, I want, depending
>>>>> on the path through the workflow, to automatically provision a resource.
>>>>>
>>>>> I tried this in a workflow step:
>>>>>
>>>>> ResourceDAO resourceDAO = CONTEXT.getBean(ResourceDAO.class);
>>>>> ExternalResource idp = resourceDAO.find("IDP_RESOURCE");
>>>>> SyncopeUser user = (SyncopeUser)
>>>>>
>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>>>> user.addResource(idp);
>>>>>
>>>>> But after creation the user had no resources. In the past (0.7) we
>>>>> have used manual propagation, by retrieving the propagation handler from
>>>>> the context and firing it, but that seems a bit inelegant to me.
>>>>>
>>>>> What is the preferred solution to this (I think common) scenario?
>>>>>
>>>>>
>>>>> Hi Jesse,
>>>>> please take a look at the Update task [1]: you could change the
>>>>> doExecute() method there to match the logic expressed above
>>>>>
>>>>>
>>>>> SyncopeUser user = (SyncopeUser)
>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>>>> UserMod userMod = (UserMod)
>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
>>>>>
>>>>> // YOUR step, e.g. add resource
>>>>> userMod.addResourceToBeAdded("IDP_RESOURCE");
>>>>>
>>>>> // update SyncopeUser
>>>>> PropagationByResource propByRes = dataBinder.update(user,
>>>>> userMod);
>>>>>
>>>>> // report updated user and propagation by resource as result
>>>>>
>>>>> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER, user);
>>>>>
>>>>> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
>>>>> propByRes);
>>>>>
>>>>> Please note the final statements execution.setVariable() - without
>>>>> these the changes are not propagated back to the flow.
>>>>>
>>>>> Regards.
>>>>>
>>>>> [1]
>>>>> https://svn.apache.org/repos/asf/syncope/branches/1_1_X/core/src/main/java/org/apache/syncope/core/workflow/user/activiti/task/Update.java
>>>>>
>>>> [2]
>>>> https://cwiki.apache.org/confluence/display/SYNCOPE/Extending+Syncope
>>>> [3] http://www.apache.org/dev/new-committers-guide.html#cla
>>>>
>>> --
> Francesco Chicchiriccò
>
> ASF Member, Apache Syncope PMC chair, Apache Cocoon PMC Memberhttp://people.apache.org/~ilgrosso/
>
>
Re: How to provision a resource from the workflow
Posted by Francesco Chicchiriccò <il...@apache.org>.
On 14/05/2013 15:14, Jesse van Bekkum wrote:
> Hi Francesco
>
> I have used the code above to provision a resource. On a user that has
> not been created yet (id = null) it works fine. However, on another
> user who already existed, it does not provision. When I do another
> update action on that user, even on a completely unrelated attribute,
> it triggers the provisioning.
>
> I think I did not see this behavior on 1.0.7, but I see it on 1.1.1.
> Any idea what the cause is?
It might be related on some optimizations made in the provisioning
layer: in 1.1.X an update is triggered towards an external resource only
if one or more of the mapped attributes is different from what is
actually read from the same resource. In this respect, this might not be
a bug.
I cannot tell you more, some additional investigation - with DEBUG
logging - is required.
Regards.
> I tried setting the usermod with the id of the existing user, but that
> did not work.
>
> Jesse
>
>
>
> On Tue, Apr 30, 2013 at 10:22 AM, Francesco Chicchiriccò
> <ilgrosso@apache.org <ma...@apache.org>> wrote:
>
> On 30/04/2013 10:21, Jesse van Bekkum wrote:
>> No, I was just reading the requirements. I will get to it, but I
>> will also need permission from Everett. The complete procedure
>> will probably take a while I see.
>
> Ok, let's wait for that.
>
>
> Regards.
>
>> On Tue, Apr 30, 2013 at 10:15 AM, Francesco Chicchiriccò
>> <ilgrosso@apache.org <ma...@apache.org>> wrote:
>>
>> On 30/04/2013 10:09, Jesse van Bekkum wrote:
>>> Hi Francisco
>>>
>>> Sounds like a fine idea. My username is Jesse van Bekkum.
>>> You can give me write access.
>>
>> We have to wait for your ICLA to be received and notified:
>> have you already sent it?
>>
>> Regards.
>>
>>
>>> On Tue, Apr 30, 2013 at 8:52 AM, Francesco Chicchiriccò
>>> <ilgrosso@apache.org <ma...@apache.org>> wrote:
>>>
>>> On 29/04/2013 15:42, Jesse van Bekkum wrote:
>>>> Hi Francesco
>>>>
>>>> Thanks for your help. There was one small issue with
>>>> your example, since on user creation you do not have a
>>>> usermod on the execution yet. But that was easily fixed.
>>>>
>>>> I have used the following code and rule in my workflow
>>>> to get this working. Might I suggest that we use this
>>>> in the standard deployment of Syncope? I think that
>>>> provisioning via the workflow is functionality that
>>>> should be included out of the box. The version I made
>>>> is parameterized via the workflow (description of usage
>>>> is included) so it is not specific to my project.
>>>
>>> Jesse,
>>> this sounds like a nice extension: why don't you report
>>> it in a wiki page under [2]?
>>>
>>> You need to:
>>> 1. complete and submit an ICLA [3]
>>> 2. create a wiki user (if not already done) and tell me
>>> the username so that I can grant you write access to the
>>> wiki
>>>
>>> WDYT?
>>>
>>> Regards.
>>>
>>>
>>>> import org.activiti.engine.delegate.DelegateExecution;
>>>> import org.activiti.engine.delegate.Expression;
>>>> import org.apache.syncope.client.mod.UserMod;
>>>> import
>>>> org.apache.syncope.core.persistence.beans.user.SyncopeUser;
>>>> import
>>>> org.apache.syncope.core.propagation.PropagationByResource;
>>>> import
>>>> org.apache.syncope.core.workflow.ActivitiUserWorkflowAdapter;
>>>> import org.apache.syncope.core.workflow.WorkflowException;
>>>> import
>>>> org.apache.syncope.core.workflow.activiti.AbstractActivitiDelegate;
>>>> import org.slf4j.Logger;
>>>> import org.slf4j.LoggerFactory;
>>>>
>>>> /**
>>>> * This workflow service task allows to provision a
>>>> resource to a user from the workflow.
>>>> *
>>>> * Use the following code in the workflow:
>>>> *
>>>> * <serviceTask id="addResource" name="Add
>>>> Resource"
>>>>
>>>> activiti:class="org.apache.syncope.core.workflow.activiti.ProvisionResources">
>>>> <extensionElements>
>>>> <activiti:field name="resource"
>>>> stringValue="%%YOUR_RESOURCE%%"/>
>>>> </extensionElements>
>>>> </serviceTask>
>>>> */
>>>> public class ProvisionResources extends
>>>> AbstractActivitiDelegate {
>>>>
>>>> protected static final Logger LOG =
>>>> LoggerFactory.getLogger(ProvisionResources.class);
>>>>
>>>> private Expression resource;
>>>>
>>>> public void setResource(Expression resource) {
>>>> this.resource = resource;
>>>> }
>>>>
>>>> @Override
>>>> protected void doExecute(DelegateExecution
>>>> execution) throws Exception {
>>>> String resourceName = (String)
>>>> resource.getValue(execution);
>>>>
>>>> if (resourceName == null ||
>>>> resourceName.isEmpty()) {
>>>> throw new WorkflowException(new
>>>> IllegalStateException("Please specify a resource"));
>>>> }
>>>>
>>>> SyncopeUser user = (SyncopeUser)
>>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>>> UserMod userMod = (UserMod)
>>>> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
>>>> if (userMod == null) {
>>>> userMod = new UserMod();
>>>> }
>>>>
>>>> userMod.addResourceToBeAdded(resourceName);
>>>>
>>>> // update SyncopeUser
>>>> PropagationByResource propByRes =
>>>> dataBinder.update(user, userMod);
>>>>
>>>> // report updated user and propagation by
>>>> resource as result
>>>>
>>>> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER,
>>>> user);
>>>>
>>>> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
>>>> propByRes);
>>>>
>>>> }
>>>> }
>>>>
>>>>
>>>> On Tue, Apr 23, 2013 at 10:38 AM, Francesco
>>>> Chicchiriccò <ilgrosso@apache.org
>>>> <ma...@apache.org>> wrote:
>>>>
>>>> On 22/04/2013 21:40, Jesse van Bekkum wrote:
>>>>> Hi
>>>>>
>>>>> Quick question.
>>>>>
>>>>> How can you provision a resource to a user from
>>>>> the workflow? I have a workflow, and after
>>>>> creating a user with a rest call, I want,
>>>>> depending on the path through the workflow, to
>>>>> automatically provision a resource.
>>>>>
>>>>> I tried this in a workflow step:
>>>>>
>>>>> ResourceDAO resourceDAO =
>>>>> CONTEXT.getBean(ResourceDAO.class);
>>>>> ExternalResource idp =
>>>>> resourceDAO.find("IDP_RESOURCE");
>>>>> SyncopeUser user = (SyncopeUser)
>>>>>
>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>>>> user.addResource(idp);
>>>>>
>>>>> But after creation the user had no resources. In
>>>>> the past (0.7) we have used manual propagation, by
>>>>> retrieving the propagation handler from the
>>>>> context and firing it, but that seems a bit
>>>>> inelegant to me.
>>>>>
>>>>> What is the preferred solution to this (I think
>>>>> common) scenario?
>>>>
>>>> Hi Jesse,
>>>> please take a look at the Update task [1]: you
>>>> could change the doExecute() method there to match
>>>> the logic expressed above
>>>>
>>>>
>>>> SyncopeUser user = (SyncopeUser)
>>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>>> UserMod userMod = (UserMod)
>>>> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
>>>>
>>>> // YOUR step, e.g. add resource
>>>> userMod.addResourceToBeAdded("IDP_RESOURCE");
>>>>
>>>> // update SyncopeUser
>>>> PropagationByResource propByRes =
>>>> dataBinder.update(user, userMod);
>>>>
>>>> // report updated user and propagation by
>>>> resource as result
>>>>
>>>> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER,
>>>> user);
>>>>
>>>> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
>>>> propByRes);
>>>>
>>>> Please note the final statements
>>>> execution.setVariable() - without these the changes
>>>> are not propagated back to the flow.
>>>>
>>>> Regards.
>>>>
>>>> [1]
>>>> https://svn.apache.org/repos/asf/syncope/branches/1_1_X/core/src/main/java/org/apache/syncope/core/workflow/user/activiti/task/Update.java
>>>>
>>> [2]
>>> https://cwiki.apache.org/confluence/display/SYNCOPE/Extending+Syncope
>>> [3] http://www.apache.org/dev/new-committers-guide.html#cla
>>>
--
Francesco Chicchiriccò
ASF Member, Apache Syncope PMC chair, Apache Cocoon PMC Member
http://people.apache.org/~ilgrosso/
Re: How to provision a resource from the workflow
Posted by Jesse van Bekkum <be...@gmail.com>.
Hi Francesco
I have used the code above to provision a resource. On a user that has not
been created yet (id = null) it works fine. However, on another user who
already existed, it does not provision. When I do another update action on
that user, even on a completely unrelated attribute, it triggers the
provisioning.
I think I did not see this behavior on 1.0.7, but I see it on 1.1.1. Any
idea what the cause is?
I tried setting the usermod with the id of the existing user, but that did
not work.
Jesse
On Tue, Apr 30, 2013 at 10:22 AM, Francesco Chicchiriccò <
ilgrosso@apache.org> wrote:
> On 30/04/2013 10:21, Jesse van Bekkum wrote:
>
> No, I was just reading the requirements. I will get to it, but I will also
> need permission from Everett. The complete procedure will probably take a
> while I see.
>
>
> Ok, let's wait for that.
>
>
> Regards.
>
> On Tue, Apr 30, 2013 at 10:15 AM, Francesco Chicchiriccò <
> ilgrosso@apache.org> wrote:
>
>> On 30/04/2013 10:09, Jesse van Bekkum wrote:
>>
>> Hi Francisco
>>
>> Sounds like a fine idea. My username is Jesse van Bekkum. You can give
>> me write access.
>>
>>
>> We have to wait for your ICLA to be received and notified: have you
>> already sent it?
>>
>> Regards.
>>
>>
>> On Tue, Apr 30, 2013 at 8:52 AM, Francesco Chicchiriccò <
>> ilgrosso@apache.org> wrote:
>>
>>> On 29/04/2013 15:42, Jesse van Bekkum wrote:
>>>
>>> Hi Francesco
>>>
>>> Thanks for your help. There was one small issue with your example,
>>> since on user creation you do not have a usermod on the execution yet. But
>>> that was easily fixed.
>>>
>>> I have used the following code and rule in my workflow to get this
>>> working. Might I suggest that we use this in the standard deployment of
>>> Syncope? I think that provisioning via the workflow is functionality that
>>> should be included out of the box. The version I made is parameterized via
>>> the workflow (description of usage is included) so it is not specific to my
>>> project.
>>>
>>>
>>> Jesse,
>>> this sounds like a nice extension: why don't you report it in a wiki
>>> page under [2]?
>>>
>>> You need to:
>>> 1. complete and submit an ICLA [3]
>>> 2. create a wiki user (if not already done) and tell me the username so
>>> that I can grant you write access to the wiki
>>>
>>> WDYT?
>>>
>>> Regards.
>>>
>>>
>>> import org.activiti.engine.delegate.DelegateExecution;
>>> import org.activiti.engine.delegate.Expression;
>>> import org.apache.syncope.client.mod.UserMod;
>>> import org.apache.syncope.core.persistence.beans.user.SyncopeUser;
>>> import org.apache.syncope.core.propagation.PropagationByResource;
>>> import org.apache.syncope.core.workflow.ActivitiUserWorkflowAdapter;
>>> import org.apache.syncope.core.workflow.WorkflowException;
>>> import
>>> org.apache.syncope.core.workflow.activiti.AbstractActivitiDelegate;
>>> import org.slf4j.Logger;
>>> import org.slf4j.LoggerFactory;
>>>
>>> /**
>>> * This workflow service task allows to provision a resource to a user
>>> from the workflow.
>>> *
>>> * Use the following code in the workflow:
>>> *
>>> * <serviceTask id="addResource" name="Add Resource"
>>>
>>> activiti:class="org.apache.syncope.core.workflow.activiti.ProvisionResources">
>>> <extensionElements>
>>> <activiti:field name="resource"
>>> stringValue="%%YOUR_RESOURCE%%"/>
>>> </extensionElements>
>>> </serviceTask>
>>> */
>>> public class ProvisionResources extends AbstractActivitiDelegate {
>>>
>>> protected static final Logger LOG =
>>> LoggerFactory.getLogger(ProvisionResources.class);
>>>
>>> private Expression resource;
>>>
>>> public void setResource(Expression resource) {
>>> this.resource = resource;
>>> }
>>>
>>> @Override
>>> protected void doExecute(DelegateExecution execution) throws
>>> Exception {
>>> String resourceName = (String) resource.getValue(execution);
>>>
>>> if (resourceName == null || resourceName.isEmpty()) {
>>> throw new WorkflowException(new
>>> IllegalStateException("Please specify a resource"));
>>> }
>>>
>>> SyncopeUser user = (SyncopeUser)
>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>> UserMod userMod = (UserMod)
>>> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
>>> if (userMod == null) {
>>> userMod = new UserMod();
>>> }
>>>
>>> userMod.addResourceToBeAdded(resourceName);
>>>
>>> // update SyncopeUser
>>> PropagationByResource propByRes = dataBinder.update(user,
>>> userMod);
>>>
>>> // report updated user and propagation by resource as result
>>> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER,
>>> user);
>>>
>>> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
>>> propByRes);
>>>
>>> }
>>> }
>>>
>>>
>>> On Tue, Apr 23, 2013 at 10:38 AM, Francesco Chicchiriccò <
>>> ilgrosso@apache.org> wrote:
>>>
>>>> On 22/04/2013 21:40, Jesse van Bekkum wrote:
>>>>
>>>> Hi
>>>>
>>>> Quick question.
>>>>
>>>> How can you provision a resource to a user from the workflow? I have
>>>> a workflow, and after creating a user with a rest call, I want, depending
>>>> on the path through the workflow, to automatically provision a resource.
>>>>
>>>> I tried this in a workflow step:
>>>>
>>>> ResourceDAO resourceDAO = CONTEXT.getBean(ResourceDAO.class);
>>>> ExternalResource idp = resourceDAO.find("IDP_RESOURCE");
>>>> SyncopeUser user = (SyncopeUser)
>>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>>> user.addResource(idp);
>>>>
>>>> But after creation the user had no resources. In the past (0.7) we
>>>> have used manual propagation, by retrieving the propagation handler from
>>>> the context and firing it, but that seems a bit inelegant to me.
>>>>
>>>> What is the preferred solution to this (I think common) scenario?
>>>>
>>>>
>>>> Hi Jesse,
>>>> please take a look at the Update task [1]: you could change the
>>>> doExecute() method there to match the logic expressed above
>>>>
>>>>
>>>> SyncopeUser user = (SyncopeUser)
>>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>>> UserMod userMod = (UserMod)
>>>> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
>>>>
>>>> // YOUR step, e.g. add resource
>>>> userMod.addResourceToBeAdded("IDP_RESOURCE");
>>>>
>>>> // update SyncopeUser
>>>> PropagationByResource propByRes = dataBinder.update(user,
>>>> userMod);
>>>>
>>>> // report updated user and propagation by resource as result
>>>> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER,
>>>> user);
>>>>
>>>> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
>>>> propByRes);
>>>>
>>>> Please note the final statements execution.setVariable() - without
>>>> these the changes are not propagated back to the flow.
>>>>
>>>> Regards.
>>>>
>>>> [1]
>>>> https://svn.apache.org/repos/asf/syncope/branches/1_1_X/core/src/main/java/org/apache/syncope/core/workflow/user/activiti/task/Update.java
>>>>
>>> [2]
>>> https://cwiki.apache.org/confluence/display/SYNCOPE/Extending+Syncope
>>> [3] http://www.apache.org/dev/new-committers-guide.html#cla
>>>
>> --
> Francesco Chicchiriccò
>
> ASF Member, Apache Syncope PMC chair, Apache Cocoon PMC Memberhttp://people.apache.org/~ilgrosso/
>
>
Re: How to provision a resource from the workflow
Posted by Francesco Chicchiriccò <il...@apache.org>.
On 30/04/2013 10:21, Jesse van Bekkum wrote:
> No, I was just reading the requirements. I will get to it, but I will
> also need permission from Everett. The complete procedure will
> probably take a while I see.
Ok, let's wait for that.
Regards.
> On Tue, Apr 30, 2013 at 10:15 AM, Francesco Chicchiriccò
> <ilgrosso@apache.org <ma...@apache.org>> wrote:
>
> On 30/04/2013 10:09, Jesse van Bekkum wrote:
>> Hi Francisco
>>
>> Sounds like a fine idea. My username is Jesse van Bekkum. You can
>> give me write access.
>
> We have to wait for your ICLA to be received and notified: have
> you already sent it?
>
> Regards.
>
>
>> On Tue, Apr 30, 2013 at 8:52 AM, Francesco Chicchiriccò
>> <ilgrosso@apache.org <ma...@apache.org>> wrote:
>>
>> On 29/04/2013 15:42, Jesse van Bekkum wrote:
>>> Hi Francesco
>>>
>>> Thanks for your help. There was one small issue with your
>>> example, since on user creation you do not have a usermod on
>>> the execution yet. But that was easily fixed.
>>>
>>> I have used the following code and rule in my workflow to
>>> get this working. Might I suggest that we use this in the
>>> standard deployment of Syncope? I think that provisioning
>>> via the workflow is functionality that should be included
>>> out of the box. The version I made is parameterized via the
>>> workflow (description of usage is included) so it is not
>>> specific to my project.
>>
>> Jesse,
>> this sounds like a nice extension: why don't you report it in
>> a wiki page under [2]?
>>
>> You need to:
>> 1. complete and submit an ICLA [3]
>> 2. create a wiki user (if not already done) and tell me the
>> username so that I can grant you write access to the wiki
>>
>> WDYT?
>>
>> Regards.
>>
>>
>>> import org.activiti.engine.delegate.DelegateExecution;
>>> import org.activiti.engine.delegate.Expression;
>>> import org.apache.syncope.client.mod.UserMod;
>>> import
>>> org.apache.syncope.core.persistence.beans.user.SyncopeUser;
>>> import
>>> org.apache.syncope.core.propagation.PropagationByResource;
>>> import
>>> org.apache.syncope.core.workflow.ActivitiUserWorkflowAdapter;
>>> import org.apache.syncope.core.workflow.WorkflowException;
>>> import
>>> org.apache.syncope.core.workflow.activiti.AbstractActivitiDelegate;
>>> import org.slf4j.Logger;
>>> import org.slf4j.LoggerFactory;
>>>
>>> /**
>>> * This workflow service task allows to provision a resource
>>> to a user from the workflow.
>>> *
>>> * Use the following code in the workflow:
>>> *
>>> * <serviceTask id="addResource" name="Add Resource"
>>> activiti:class="org.apache.syncope.core.workflow.activiti.ProvisionResources">
>>> <extensionElements>
>>> <activiti:field name="resource"
>>> stringValue="%%YOUR_RESOURCE%%"/>
>>> </extensionElements>
>>> </serviceTask>
>>> */
>>> public class ProvisionResources extends
>>> AbstractActivitiDelegate {
>>>
>>> protected static final Logger LOG =
>>> LoggerFactory.getLogger(ProvisionResources.class);
>>>
>>> private Expression resource;
>>>
>>> public void setResource(Expression resource) {
>>> this.resource = resource;
>>> }
>>>
>>> @Override
>>> protected void doExecute(DelegateExecution execution)
>>> throws Exception {
>>> String resourceName = (String)
>>> resource.getValue(execution);
>>>
>>> if (resourceName == null || resourceName.isEmpty()) {
>>> throw new WorkflowException(new
>>> IllegalStateException("Please specify a resource"));
>>> }
>>>
>>> SyncopeUser user = (SyncopeUser)
>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>> UserMod userMod = (UserMod)
>>> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
>>> if (userMod == null) {
>>> userMod = new UserMod();
>>> }
>>>
>>> userMod.addResourceToBeAdded(resourceName);
>>>
>>> // update SyncopeUser
>>> PropagationByResource propByRes =
>>> dataBinder.update(user, userMod);
>>>
>>> // report updated user and propagation by resource
>>> as result
>>> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER,
>>> user);
>>> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
>>> propByRes);
>>>
>>> }
>>> }
>>>
>>>
>>> On Tue, Apr 23, 2013 at 10:38 AM, Francesco Chicchiriccò
>>> <ilgrosso@apache.org <ma...@apache.org>> wrote:
>>>
>>> On 22/04/2013 21:40, Jesse van Bekkum wrote:
>>>> Hi
>>>>
>>>> Quick question.
>>>>
>>>> How can you provision a resource to a user from the
>>>> workflow? I have a workflow, and after creating a user
>>>> with a rest call, I want, depending on the path through
>>>> the workflow, to automatically provision a resource.
>>>>
>>>> I tried this in a workflow step:
>>>>
>>>> ResourceDAO resourceDAO =
>>>> CONTEXT.getBean(ResourceDAO.class);
>>>> ExternalResource idp = resourceDAO.find("IDP_RESOURCE");
>>>> SyncopeUser user = (SyncopeUser)
>>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>>> user.addResource(idp);
>>>>
>>>> But after creation the user had no resources. In the
>>>> past (0.7) we have used manual propagation, by
>>>> retrieving the propagation handler from the context and
>>>> firing it, but that seems a bit inelegant to me.
>>>>
>>>> What is the preferred solution to this (I think common)
>>>> scenario?
>>>
>>> Hi Jesse,
>>> please take a look at the Update task [1]: you could
>>> change the doExecute() method there to match the logic
>>> expressed above
>>>
>>>
>>> SyncopeUser user = (SyncopeUser)
>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>> UserMod userMod = (UserMod)
>>> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
>>>
>>> // YOUR step, e.g. add resource
>>> userMod.addResourceToBeAdded("IDP_RESOURCE");
>>>
>>> // update SyncopeUser
>>> PropagationByResource propByRes =
>>> dataBinder.update(user, userMod);
>>>
>>> // report updated user and propagation by
>>> resource as result
>>> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER,
>>> user);
>>> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
>>> propByRes);
>>>
>>> Please note the final statements execution.setVariable()
>>> - without these the changes are not propagated back to
>>> the flow.
>>>
>>> Regards.
>>>
>>> [1]
>>> https://svn.apache.org/repos/asf/syncope/branches/1_1_X/core/src/main/java/org/apache/syncope/core/workflow/user/activiti/task/Update.java
>>>
>> [2]
>> https://cwiki.apache.org/confluence/display/SYNCOPE/Extending+Syncope
>> [3] http://www.apache.org/dev/new-committers-guide.html#cla
>>
--
Francesco Chicchiriccò
ASF Member, Apache Syncope PMC chair, Apache Cocoon PMC Member
http://people.apache.org/~ilgrosso/
Re: How to provision a resource from the workflow
Posted by Jesse van Bekkum <be...@gmail.com>.
No, I was just reading the requirements. I will get to it, but I will also
need permission from Everett. The complete procedure will probably take a
while I see.
Jesse
On Tue, Apr 30, 2013 at 10:15 AM, Francesco Chicchiriccò <
ilgrosso@apache.org> wrote:
> On 30/04/2013 10:09, Jesse van Bekkum wrote:
>
> Hi Francisco
>
> Sounds like a fine idea. My username is Jesse van Bekkum. You can give
> me write access.
>
>
> We have to wait for your ICLA to be received and notified: have you
> already sent it?
>
> Regards.
>
>
> On Tue, Apr 30, 2013 at 8:52 AM, Francesco Chicchiriccò <
> ilgrosso@apache.org> wrote:
>
>> On 29/04/2013 15:42, Jesse van Bekkum wrote:
>>
>> Hi Francesco
>>
>> Thanks for your help. There was one small issue with your example,
>> since on user creation you do not have a usermod on the execution yet. But
>> that was easily fixed.
>>
>> I have used the following code and rule in my workflow to get this
>> working. Might I suggest that we use this in the standard deployment of
>> Syncope? I think that provisioning via the workflow is functionality that
>> should be included out of the box. The version I made is parameterized via
>> the workflow (description of usage is included) so it is not specific to my
>> project.
>>
>>
>> Jesse,
>> this sounds like a nice extension: why don't you report it in a wiki page
>> under [2]?
>>
>> You need to:
>> 1. complete and submit an ICLA [3]
>> 2. create a wiki user (if not already done) and tell me the username so
>> that I can grant you write access to the wiki
>>
>> WDYT?
>>
>> Regards.
>>
>>
>> import org.activiti.engine.delegate.DelegateExecution;
>> import org.activiti.engine.delegate.Expression;
>> import org.apache.syncope.client.mod.UserMod;
>> import org.apache.syncope.core.persistence.beans.user.SyncopeUser;
>> import org.apache.syncope.core.propagation.PropagationByResource;
>> import org.apache.syncope.core.workflow.ActivitiUserWorkflowAdapter;
>> import org.apache.syncope.core.workflow.WorkflowException;
>> import org.apache.syncope.core.workflow.activiti.AbstractActivitiDelegate;
>> import org.slf4j.Logger;
>> import org.slf4j.LoggerFactory;
>>
>> /**
>> * This workflow service task allows to provision a resource to a user
>> from the workflow.
>> *
>> * Use the following code in the workflow:
>> *
>> * <serviceTask id="addResource" name="Add Resource"
>>
>> activiti:class="org.apache.syncope.core.workflow.activiti.ProvisionResources">
>> <extensionElements>
>> <activiti:field name="resource"
>> stringValue="%%YOUR_RESOURCE%%"/>
>> </extensionElements>
>> </serviceTask>
>> */
>> public class ProvisionResources extends AbstractActivitiDelegate {
>>
>> protected static final Logger LOG =
>> LoggerFactory.getLogger(ProvisionResources.class);
>>
>> private Expression resource;
>>
>> public void setResource(Expression resource) {
>> this.resource = resource;
>> }
>>
>> @Override
>> protected void doExecute(DelegateExecution execution) throws
>> Exception {
>> String resourceName = (String) resource.getValue(execution);
>>
>> if (resourceName == null || resourceName.isEmpty()) {
>> throw new WorkflowException(new IllegalStateException("Please
>> specify a resource"));
>> }
>>
>> SyncopeUser user = (SyncopeUser)
>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>> UserMod userMod = (UserMod)
>> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
>> if (userMod == null) {
>> userMod = new UserMod();
>> }
>>
>> userMod.addResourceToBeAdded(resourceName);
>>
>> // update SyncopeUser
>> PropagationByResource propByRes = dataBinder.update(user,
>> userMod);
>>
>> // report updated user and propagation by resource as result
>> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER,
>> user);
>>
>> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
>> propByRes);
>>
>> }
>> }
>>
>>
>> On Tue, Apr 23, 2013 at 10:38 AM, Francesco Chicchiriccò <
>> ilgrosso@apache.org> wrote:
>>
>>> On 22/04/2013 21:40, Jesse van Bekkum wrote:
>>>
>>> Hi
>>>
>>> Quick question.
>>>
>>> How can you provision a resource to a user from the workflow? I have a
>>> workflow, and after creating a user with a rest call, I want, depending on
>>> the path through the workflow, to automatically provision a resource.
>>>
>>> I tried this in a workflow step:
>>>
>>> ResourceDAO resourceDAO = CONTEXT.getBean(ResourceDAO.class);
>>> ExternalResource idp = resourceDAO.find("IDP_RESOURCE");
>>> SyncopeUser user = (SyncopeUser)
>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>> user.addResource(idp);
>>>
>>> But after creation the user had no resources. In the past (0.7) we
>>> have used manual propagation, by retrieving the propagation handler from
>>> the context and firing it, but that seems a bit inelegant to me.
>>>
>>> What is the preferred solution to this (I think common) scenario?
>>>
>>>
>>> Hi Jesse,
>>> please take a look at the Update task [1]: you could change the
>>> doExecute() method there to match the logic expressed above
>>>
>>>
>>> SyncopeUser user = (SyncopeUser)
>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>> UserMod userMod = (UserMod)
>>> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
>>>
>>> // YOUR step, e.g. add resource
>>> userMod.addResourceToBeAdded("IDP_RESOURCE");
>>>
>>> // update SyncopeUser
>>> PropagationByResource propByRes = dataBinder.update(user,
>>> userMod);
>>>
>>> // report updated user and propagation by resource as result
>>> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER,
>>> user);
>>>
>>> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
>>> propByRes);
>>>
>>> Please note the final statements execution.setVariable() - without these
>>> the changes are not propagated back to the flow.
>>>
>>> Regards.
>>>
>>> [1]
>>> https://svn.apache.org/repos/asf/syncope/branches/1_1_X/core/src/main/java/org/apache/syncope/core/workflow/user/activiti/task/Update.java
>>>
>> [2]
>> https://cwiki.apache.org/confluence/display/SYNCOPE/Extending+Syncope
>> [3] http://www.apache.org/dev/new-committers-guide.html#cla
>>
> --
> Francesco Chicchiriccò
>
> ASF Member, Apache Syncope PMC chair, Apache Cocoon PMC Memberhttp://people.apache.org/~ilgrosso/
>
>
Re: How to provision a resource from the workflow
Posted by Francesco Chicchiriccò <il...@apache.org>.
On 30/04/2013 10:09, Jesse van Bekkum wrote:
> Hi Francisco
>
> Sounds like a fine idea. My username is Jesse van Bekkum. You can give
> me write access.
We have to wait for your ICLA to be received and notified: have you
already sent it?
Regards.
> On Tue, Apr 30, 2013 at 8:52 AM, Francesco Chicchiriccò
> <ilgrosso@apache.org <ma...@apache.org>> wrote:
>
> On 29/04/2013 15:42, Jesse van Bekkum wrote:
>> Hi Francesco
>>
>> Thanks for your help. There was one small issue with your
>> example, since on user creation you do not have a usermod on the
>> execution yet. But that was easily fixed.
>>
>> I have used the following code and rule in my workflow to get
>> this working. Might I suggest that we use this in the standard
>> deployment of Syncope? I think that provisioning via the workflow
>> is functionality that should be included out of the box. The
>> version I made is parameterized via the workflow (description of
>> usage is included) so it is not specific to my project.
>
> Jesse,
> this sounds like a nice extension: why don't you report it in a
> wiki page under [2]?
>
> You need to:
> 1. complete and submit an ICLA [3]
> 2. create a wiki user (if not already done) and tell me the
> username so that I can grant you write access to the wiki
>
> WDYT?
>
> Regards.
>
>
>> import org.activiti.engine.delegate.DelegateExecution;
>> import org.activiti.engine.delegate.Expression;
>> import org.apache.syncope.client.mod.UserMod;
>> import org.apache.syncope.core.persistence.beans.user.SyncopeUser;
>> import org.apache.syncope.core.propagation.PropagationByResource;
>> import org.apache.syncope.core.workflow.ActivitiUserWorkflowAdapter;
>> import org.apache.syncope.core.workflow.WorkflowException;
>> import
>> org.apache.syncope.core.workflow.activiti.AbstractActivitiDelegate;
>> import org.slf4j.Logger;
>> import org.slf4j.LoggerFactory;
>>
>> /**
>> * This workflow service task allows to provision a resource to a
>> user from the workflow.
>> *
>> * Use the following code in the workflow:
>> *
>> * <serviceTask id="addResource" name="Add Resource"
>> activiti:class="org.apache.syncope.core.workflow.activiti.ProvisionResources">
>> <extensionElements>
>> <activiti:field name="resource"
>> stringValue="%%YOUR_RESOURCE%%"/>
>> </extensionElements>
>> </serviceTask>
>> */
>> public class ProvisionResources extends AbstractActivitiDelegate {
>>
>> protected static final Logger LOG =
>> LoggerFactory.getLogger(ProvisionResources.class);
>>
>> private Expression resource;
>>
>> public void setResource(Expression resource) {
>> this.resource = resource;
>> }
>>
>> @Override
>> protected void doExecute(DelegateExecution execution) throws
>> Exception {
>> String resourceName = (String) resource.getValue(execution);
>>
>> if (resourceName == null || resourceName.isEmpty()) {
>> throw new WorkflowException(new
>> IllegalStateException("Please specify a resource"));
>> }
>>
>> SyncopeUser user = (SyncopeUser)
>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>> UserMod userMod = (UserMod)
>> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
>> if (userMod == null) {
>> userMod = new UserMod();
>> }
>>
>> userMod.addResourceToBeAdded(resourceName);
>>
>> // update SyncopeUser
>> PropagationByResource propByRes = dataBinder.update(user,
>> userMod);
>>
>> // report updated user and propagation by resource as result
>> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER,
>> user);
>> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
>> propByRes);
>>
>> }
>> }
>>
>>
>> On Tue, Apr 23, 2013 at 10:38 AM, Francesco Chicchiriccò
>> <ilgrosso@apache.org <ma...@apache.org>> wrote:
>>
>> On 22/04/2013 21:40, Jesse van Bekkum wrote:
>>> Hi
>>>
>>> Quick question.
>>>
>>> How can you provision a resource to a user from the
>>> workflow? I have a workflow, and after creating a user with
>>> a rest call, I want, depending on the path through the
>>> workflow, to automatically provision a resource.
>>>
>>> I tried this in a workflow step:
>>>
>>> ResourceDAO resourceDAO =
>>> CONTEXT.getBean(ResourceDAO.class);
>>> ExternalResource idp = resourceDAO.find("IDP_RESOURCE");
>>> SyncopeUser user = (SyncopeUser)
>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>> user.addResource(idp);
>>>
>>> But after creation the user had no resources. In the past
>>> (0.7) we have used manual propagation, by retrieving the
>>> propagation handler from the context and firing it, but that
>>> seems a bit inelegant to me.
>>>
>>> What is the preferred solution to this (I think common)
>>> scenario?
>>
>> Hi Jesse,
>> please take a look at the Update task [1]: you could change
>> the doExecute() method there to match the logic expressed above
>>
>>
>> SyncopeUser user = (SyncopeUser)
>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>> UserMod userMod = (UserMod)
>> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
>>
>> // YOUR step, e.g. add resource
>> userMod.addResourceToBeAdded("IDP_RESOURCE");
>>
>> // update SyncopeUser
>> PropagationByResource propByRes =
>> dataBinder.update(user, userMod);
>>
>> // report updated user and propagation by resource as
>> result
>> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER,
>> user);
>> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
>> propByRes);
>>
>> Please note the final statements execution.setVariable() -
>> without these the changes are not propagated back to the flow.
>>
>> Regards.
>>
>> [1]
>> https://svn.apache.org/repos/asf/syncope/branches/1_1_X/core/src/main/java/org/apache/syncope/core/workflow/user/activiti/task/Update.java
>>
> [2]
> https://cwiki.apache.org/confluence/display/SYNCOPE/Extending+Syncope
> [3] http://www.apache.org/dev/new-committers-guide.html#cla
>
--
Francesco Chicchiriccò
ASF Member, Apache Syncope PMC chair, Apache Cocoon PMC Member
http://people.apache.org/~ilgrosso/
Re: How to provision a resource from the workflow
Posted by Jesse van Bekkum <be...@gmail.com>.
Hi Francisco
Sounds like a fine idea. My username is Jesse van Bekkum. You can give me
write access.
Jesse van Bekkum
On Tue, Apr 30, 2013 at 8:52 AM, Francesco Chicchiriccò <ilgrosso@apache.org
> wrote:
> On 29/04/2013 15:42, Jesse van Bekkum wrote:
>
> Hi Francesco
>
> Thanks for your help. There was one small issue with your example, since
> on user creation you do not have a usermod on the execution yet. But that
> was easily fixed.
>
> I have used the following code and rule in my workflow to get this
> working. Might I suggest that we use this in the standard deployment of
> Syncope? I think that provisioning via the workflow is functionality that
> should be included out of the box. The version I made is parameterized via
> the workflow (description of usage is included) so it is not specific to my
> project.
>
>
> Jesse,
> this sounds like a nice extension: why don't you report it in a wiki page
> under [2]?
>
> You need to:
> 1. complete and submit an ICLA [3]
> 2. create a wiki user (if not already done) and tell me the username so
> that I can grant you write access to the wiki
>
> WDYT?
>
> Regards.
>
>
> import org.activiti.engine.delegate.DelegateExecution;
> import org.activiti.engine.delegate.Expression;
> import org.apache.syncope.client.mod.UserMod;
> import org.apache.syncope.core.persistence.beans.user.SyncopeUser;
> import org.apache.syncope.core.propagation.PropagationByResource;
> import org.apache.syncope.core.workflow.ActivitiUserWorkflowAdapter;
> import org.apache.syncope.core.workflow.WorkflowException;
> import org.apache.syncope.core.workflow.activiti.AbstractActivitiDelegate;
> import org.slf4j.Logger;
> import org.slf4j.LoggerFactory;
>
> /**
> * This workflow service task allows to provision a resource to a user
> from the workflow.
> *
> * Use the following code in the workflow:
> *
> * <serviceTask id="addResource" name="Add Resource"
>
> activiti:class="org.apache.syncope.core.workflow.activiti.ProvisionResources">
> <extensionElements>
> <activiti:field name="resource"
> stringValue="%%YOUR_RESOURCE%%"/>
> </extensionElements>
> </serviceTask>
> */
> public class ProvisionResources extends AbstractActivitiDelegate {
>
> protected static final Logger LOG =
> LoggerFactory.getLogger(ProvisionResources.class);
>
> private Expression resource;
>
> public void setResource(Expression resource) {
> this.resource = resource;
> }
>
> @Override
> protected void doExecute(DelegateExecution execution) throws Exception
> {
> String resourceName = (String) resource.getValue(execution);
>
> if (resourceName == null || resourceName.isEmpty()) {
> throw new WorkflowException(new IllegalStateException("Please
> specify a resource"));
> }
>
> SyncopeUser user = (SyncopeUser)
> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
> UserMod userMod = (UserMod)
> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
> if (userMod == null) {
> userMod = new UserMod();
> }
>
> userMod.addResourceToBeAdded(resourceName);
>
> // update SyncopeUser
> PropagationByResource propByRes = dataBinder.update(user, userMod);
>
> // report updated user and propagation by resource as result
> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER,
> user);
>
> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
> propByRes);
>
> }
> }
>
>
> On Tue, Apr 23, 2013 at 10:38 AM, Francesco Chicchiriccò <
> ilgrosso@apache.org> wrote:
>
>> On 22/04/2013 21:40, Jesse van Bekkum wrote:
>>
>> Hi
>>
>> Quick question.
>>
>> How can you provision a resource to a user from the workflow? I have a
>> workflow, and after creating a user with a rest call, I want, depending on
>> the path through the workflow, to automatically provision a resource.
>>
>> I tried this in a workflow step:
>>
>> ResourceDAO resourceDAO = CONTEXT.getBean(ResourceDAO.class);
>> ExternalResource idp = resourceDAO.find("IDP_RESOURCE");
>> SyncopeUser user = (SyncopeUser)
>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>> user.addResource(idp);
>>
>> But after creation the user had no resources. In the past (0.7) we have
>> used manual propagation, by retrieving the propagation handler from the
>> context and firing it, but that seems a bit inelegant to me.
>>
>> What is the preferred solution to this (I think common) scenario?
>>
>>
>> Hi Jesse,
>> please take a look at the Update task [1]: you could change the
>> doExecute() method there to match the logic expressed above
>>
>>
>> SyncopeUser user = (SyncopeUser)
>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>> UserMod userMod = (UserMod)
>> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
>>
>> // YOUR step, e.g. add resource
>> userMod.addResourceToBeAdded("IDP_RESOURCE");
>>
>> // update SyncopeUser
>> PropagationByResource propByRes = dataBinder.update(user,
>> userMod);
>>
>> // report updated user and propagation by resource as result
>> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER,
>> user);
>>
>> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
>> propByRes);
>>
>> Please note the final statements execution.setVariable() - without these
>> the changes are not propagated back to the flow.
>>
>> Regards.
>>
>> [1]
>> https://svn.apache.org/repos/asf/syncope/branches/1_1_X/core/src/main/java/org/apache/syncope/core/workflow/user/activiti/task/Update.java
>>
> [2]
> https://cwiki.apache.org/confluence/display/SYNCOPE/Extending+Syncope
> [3] http://www.apache.org/dev/new-committers-guide.html#cla
>
> --
> Francesco Chicchiriccò
>
> ASF Member, Apache Syncope PMC chair, Apache Cocoon PMC Memberhttp://people.apache.org/~ilgrosso/
>
>
Re: How to provision a resource from the workflow
Posted by Francesco Chicchiriccò <il...@apache.org>.
On 29/04/2013 15:42, Jesse van Bekkum wrote:
> Hi Francesco
>
> Thanks for your help. There was one small issue with your example,
> since on user creation you do not have a usermod on the execution yet.
> But that was easily fixed.
>
> I have used the following code and rule in my workflow to get this
> working. Might I suggest that we use this in the standard deployment
> of Syncope? I think that provisioning via the workflow is
> functionality that should be included out of the box. The version I
> made is parameterized via the workflow (description of usage is
> included) so it is not specific to my project.
Jesse,
this sounds like a nice extension: why don't you report it in a wiki
page under [2]?
You need to:
1. complete and submit an ICLA [3]
2. create a wiki user (if not already done) and tell me the username
so that I can grant you write access to the wiki
WDYT?
Regards.
> import org.activiti.engine.delegate.DelegateExecution;
> import org.activiti.engine.delegate.Expression;
> import org.apache.syncope.client.mod.UserMod;
> import org.apache.syncope.core.persistence.beans.user.SyncopeUser;
> import org.apache.syncope.core.propagation.PropagationByResource;
> import org.apache.syncope.core.workflow.ActivitiUserWorkflowAdapter;
> import org.apache.syncope.core.workflow.WorkflowException;
> import org.apache.syncope.core.workflow.activiti.AbstractActivitiDelegate;
> import org.slf4j.Logger;
> import org.slf4j.LoggerFactory;
>
> /**
> * This workflow service task allows to provision a resource to a user
> from the workflow.
> *
> * Use the following code in the workflow:
> *
> * <serviceTask id="addResource" name="Add Resource"
> activiti:class="org.apache.syncope.core.workflow.activiti.ProvisionResources">
> <extensionElements>
> <activiti:field name="resource"
> stringValue="%%YOUR_RESOURCE%%"/>
> </extensionElements>
> </serviceTask>
> */
> public class ProvisionResources extends AbstractActivitiDelegate {
>
> protected static final Logger LOG =
> LoggerFactory.getLogger(ProvisionResources.class);
>
> private Expression resource;
>
> public void setResource(Expression resource) {
> this.resource = resource;
> }
>
> @Override
> protected void doExecute(DelegateExecution execution) throws
> Exception {
> String resourceName = (String) resource.getValue(execution);
>
> if (resourceName == null || resourceName.isEmpty()) {
> throw new WorkflowException(new
> IllegalStateException("Please specify a resource"));
> }
>
> SyncopeUser user = (SyncopeUser)
> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
> UserMod userMod = (UserMod)
> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
> if (userMod == null) {
> userMod = new UserMod();
> }
>
> userMod.addResourceToBeAdded(resourceName);
>
> // update SyncopeUser
> PropagationByResource propByRes = dataBinder.update(user,
> userMod);
>
> // report updated user and propagation by resource as result
> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER, user);
> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
> propByRes);
>
> }
> }
>
>
> On Tue, Apr 23, 2013 at 10:38 AM, Francesco Chicchiriccò
> <ilgrosso@apache.org <ma...@apache.org>> wrote:
>
> On 22/04/2013 21:40, Jesse van Bekkum wrote:
>> Hi
>>
>> Quick question.
>>
>> How can you provision a resource to a user from the workflow? I
>> have a workflow, and after creating a user with a rest call, I
>> want, depending on the path through the workflow, to
>> automatically provision a resource.
>>
>> I tried this in a workflow step:
>>
>> ResourceDAO resourceDAO = CONTEXT.getBean(ResourceDAO.class);
>> ExternalResource idp = resourceDAO.find("IDP_RESOURCE");
>> SyncopeUser user = (SyncopeUser)
>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>> user.addResource(idp);
>>
>> But after creation the user had no resources. In the past (0.7)
>> we have used manual propagation, by retrieving the propagation
>> handler from the context and firing it, but that seems a bit
>> inelegant to me.
>>
>> What is the preferred solution to this (I think common) scenario?
>
> Hi Jesse,
> please take a look at the Update task [1]: you could change the
> doExecute() method there to match the logic expressed above
>
>
> SyncopeUser user = (SyncopeUser)
> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
> UserMod userMod = (UserMod)
> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
>
> // YOUR step, e.g. add resource
> userMod.addResourceToBeAdded("IDP_RESOURCE");
>
> // update SyncopeUser
> PropagationByResource propByRes = dataBinder.update(user,
> userMod);
>
> // report updated user and propagation by resource as result
> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER, user);
> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE, propByRes);
>
> Please note the final statements execution.setVariable() - without
> these the changes are not propagated back to the flow.
>
> Regards.
>
> [1]
> https://svn.apache.org/repos/asf/syncope/branches/1_1_X/core/src/main/java/org/apache/syncope/core/workflow/user/activiti/task/Update.java
>
[2] https://cwiki.apache.org/confluence/display/SYNCOPE/Extending+Syncope
[3] http://www.apache.org/dev/new-committers-guide.html#cla
--
Francesco Chicchiriccò
ASF Member, Apache Syncope PMC chair, Apache Cocoon PMC Member
http://people.apache.org/~ilgrosso/
Re: How to provision a resource from the workflow
Posted by Jesse van Bekkum <be...@gmail.com>.
Hi Francesco
Thanks for your help. There was one small issue with your example, since on
user creation you do not have a usermod on the execution yet. But that was
easily fixed.
I have used the following code and rule in my workflow to get this working.
Might I suggest that we use this in the standard deployment of Syncope? I
think that provisioning via the workflow is functionality that should be
included out of the box. The version I made is parameterized via the
workflow (description of usage is included) so it is not specific to my
project.
import org.activiti.engine.delegate.DelegateExecution;
import org.activiti.engine.delegate.Expression;
import org.apache.syncope.client.mod.UserMod;
import org.apache.syncope.core.persistence.beans.user.SyncopeUser;
import org.apache.syncope.core.propagation.PropagationByResource;
import org.apache.syncope.core.workflow.ActivitiUserWorkflowAdapter;
import org.apache.syncope.core.workflow.WorkflowException;
import org.apache.syncope.core.workflow.activiti.AbstractActivitiDelegate;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
/**
* This workflow service task allows to provision a resource to a user from
the workflow.
*
* Use the following code in the workflow:
*
* <serviceTask id="addResource" name="Add Resource"
activiti:class="org.apache.syncope.core.workflow.activiti.ProvisionResources">
<extensionElements>
<activiti:field name="resource"
stringValue="%%YOUR_RESOURCE%%"/>
</extensionElements>
</serviceTask>
*/
public class ProvisionResources extends AbstractActivitiDelegate {
protected static final Logger LOG =
LoggerFactory.getLogger(ProvisionResources.class);
private Expression resource;
public void setResource(Expression resource) {
this.resource = resource;
}
@Override
protected void doExecute(DelegateExecution execution) throws Exception {
String resourceName = (String) resource.getValue(execution);
if (resourceName == null || resourceName.isEmpty()) {
throw new WorkflowException(new IllegalStateException("Please
specify a resource"));
}
SyncopeUser user = (SyncopeUser)
execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
UserMod userMod = (UserMod)
execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
if (userMod == null) {
userMod = new UserMod();
}
userMod.addResourceToBeAdded(resourceName);
// update SyncopeUser
PropagationByResource propByRes = dataBinder.update(user, userMod);
// report updated user and propagation by resource as result
execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER,
user);
execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
propByRes);
}
}
On Tue, Apr 23, 2013 at 10:38 AM, Francesco Chicchiriccò <
ilgrosso@apache.org> wrote:
> On 22/04/2013 21:40, Jesse van Bekkum wrote:
>
> Hi
>
> Quick question.
>
> How can you provision a resource to a user from the workflow? I have a
> workflow, and after creating a user with a rest call, I want, depending on
> the path through the workflow, to automatically provision a resource.
>
> I tried this in a workflow step:
>
> ResourceDAO resourceDAO = CONTEXT.getBean(ResourceDAO.class);
> ExternalResource idp = resourceDAO.find("IDP_RESOURCE");
> SyncopeUser user = (SyncopeUser)
> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
> user.addResource(idp);
>
> But after creation the user had no resources. In the past (0.7) we have
> used manual propagation, by retrieving the propagation handler from the
> context and firing it, but that seems a bit inelegant to me.
>
> What is the preferred solution to this (I think common) scenario?
>
>
> Hi Jesse,
> please take a look at the Update task [1]: you could change the
> doExecute() method there to match the logic expressed above
>
>
> SyncopeUser user = (SyncopeUser)
> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
> UserMod userMod = (UserMod)
> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
>
> // YOUR step, e.g. add resource
> userMod.addResourceToBeAdded("IDP_RESOURCE");
>
> // update SyncopeUser
> PropagationByResource propByRes = dataBinder.update(user, userMod);
>
> // report updated user and propagation by resource as result
> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER,
> user);
>
> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
> propByRes);
>
> Please note the final statements execution.setVariable() - without these
> the changes are not propagated back to the flow.
>
> Regards.
>
> [1]
> https://svn.apache.org/repos/asf/syncope/branches/1_1_X/core/src/main/java/org/apache/syncope/core/workflow/user/activiti/task/Update.java
>
> --
> Francesco Chicchiriccò
>
> ASF Member, Apache Syncope PMC chair, Apache Cocoon PMC Memberhttp://people.apache.org/~ilgrosso/
>
>
Re: How to provision a resource from the workflow
Posted by Francesco Chicchiriccò <il...@apache.org>.
On 22/04/2013 21:40, Jesse van Bekkum wrote:
> Hi
>
> Quick question.
>
> How can you provision a resource to a user from the workflow? I have a
> workflow, and after creating a user with a rest call, I want,
> depending on the path through the workflow, to automatically provision
> a resource.
>
> I tried this in a workflow step:
>
> ResourceDAO resourceDAO = CONTEXT.getBean(ResourceDAO.class);
> ExternalResource idp = resourceDAO.find("IDP_RESOURCE");
> SyncopeUser user = (SyncopeUser)
> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
> user.addResource(idp);
>
> But after creation the user had no resources. In the past (0.7) we
> have used manual propagation, by retrieving the propagation handler
> from the context and firing it, but that seems a bit inelegant to me.
>
> What is the preferred solution to this (I think common) scenario?
Hi Jesse,
please take a look at the Update task [1]: you could change the
doExecute() method there to match the logic expressed above
SyncopeUser user = (SyncopeUser)
execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
UserMod userMod = (UserMod)
execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
// YOUR step, e.g. add resource
userMod.addResourceToBeAdded("IDP_RESOURCE");
// update SyncopeUser
PropagationByResource propByRes = dataBinder.update(user, userMod);
// report updated user and propagation by resource as result
execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER, user);
execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
propByRes);
Please note the final statements execution.setVariable() - without these
the changes are not propagated back to the flow.
Regards.
[1]
https://svn.apache.org/repos/asf/syncope/branches/1_1_X/core/src/main/java/org/apache/syncope/core/workflow/user/activiti/task/Update.java
--
Francesco Chicchiriccò
ASF Member, Apache Syncope PMC chair, Apache Cocoon PMC Member
http://people.apache.org/~ilgrosso/