You are viewing a plain text version of this content. The canonical link for it is here.
Posted to oak-commits@jackrabbit.apache.org by an...@apache.org on 2023/01/11 12:19:18 UTC
[jackrabbit-oak] branch OAK-10061 created (now 1684f2b9ec)
This is an automated email from the ASF dual-hosted git repository.
angela pushed a change to branch OAK-10061
in repository https://gitbox.apache.org/repos/asf/jackrabbit-oak.git
at 1684f2b9ec OAK-10061 : WARN when for an external group a local group with the same name is already present
This branch includes the following new commits:
new 1684f2b9ec OAK-10061 : WARN when for an external group a local group with the same name is already present
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
[jackrabbit-oak] 01/01: OAK-10061 : WARN when for an external group a local group with the same name is already present
Posted by an...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
angela pushed a commit to branch OAK-10061
in repository https://gitbox.apache.org/repos/asf/jackrabbit-oak.git
commit 1684f2b9ec6f1acdbcf5bee9ab90a9e70c50aae6
Author: angela <an...@adobe.com>
AuthorDate: Wed Jan 11 13:18:58 2023 +0100
OAK-10061 : WARN when for an external group a local group with the same name is already present
---
.../external/basic/DefaultSyncContext.java | 16 +++++++++++++++-
.../authentication/external/basic/package-info.java | 2 +-
.../authentication/external/impl/DynamicSyncContext.java | 3 ++-
3 files changed, 18 insertions(+), 3 deletions(-)
diff --git a/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/basic/DefaultSyncContext.java b/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/basic/DefaultSyncContext.java
index 073efb4fab..bf4ba40c04 100644
--- a/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/basic/DefaultSyncContext.java
+++ b/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/basic/DefaultSyncContext.java
@@ -229,6 +229,7 @@ public class DefaultSyncContext implements SyncContext {
ExternalIdentityRef ref = identity.getExternalId();
if (!isSameIDP(ref)) {
// create result in accordance with sync(String) where status is FOREIGN
+ warnForeign(identity);
boolean isGroup = (identity instanceof ExternalGroup);
return new DefaultSyncResultImpl(new DefaultSyncedIdentity(identity.getId(), ref, isGroup, -1), SyncResult.Status.FOREIGN);
}
@@ -286,6 +287,7 @@ public class DefaultSyncContext implements SyncContext {
// check if we need to deal with this authorizable
ExternalIdentityRef ref = getIdentityRef(auth);
if (ref == null || !isSameIDP(ref)) {
+ warnForeignExisting(auth, auth.isGroup());
return new DefaultSyncResultImpl(new DefaultSyncedIdentity(id, ref, auth.isGroup(), -1), SyncResult.Status.FOREIGN);
}
@@ -428,6 +430,7 @@ public class DefaultSyncContext implements SyncContext {
protected DefaultSyncResultImpl syncUser(@NotNull ExternalUser external, @NotNull User user) throws RepositoryException {
// make also sure the local user to be synced belongs to the same IDP. Note: 'external' has been verified before.
if (!isSameIDP(user)) {
+ warnForeignExisting(user, false);
return new DefaultSyncResultImpl(new DefaultSyncedIdentity(external.getId(), external.getExternalId(), false, -1), SyncResult.Status.FOREIGN);
}
@@ -457,6 +460,7 @@ public class DefaultSyncContext implements SyncContext {
protected DefaultSyncResultImpl syncGroup(@NotNull ExternalGroup external, @NotNull Group group) throws RepositoryException {
// make also sure the local user to be synced belongs to the same IDP. Note: 'external' has been verified before.
if (!isSameIDP(group)) {
+ warnForeignExisting(group, true);
return new DefaultSyncResultImpl(new DefaultSyncedIdentity(external.getId(), external.getExternalId(), false, -1), SyncResult.Status.FOREIGN);
}
@@ -554,7 +558,7 @@ public class DefaultSyncContext implements SyncContext {
} else if (a.isGroup() && isSameIDP(a)) {
grp = (Group) a;
} else {
- log.warn("Existing authorizable '{}' is not a group from this IDP '{}'.", extGroup.getId(), idp.getName());
+ warnForeignExisting(a, true);
continue;
}
log.debug("- user manager returned '{}'", grp.getID());
@@ -773,6 +777,16 @@ public class DefaultSyncContext implements SyncContext {
return idp.getName().equals(ref.getProviderName());
}
+ protected void warnForeign(@NotNull ExternalIdentity externalIdentity) {
+ log.warn("Cannot sync externally identity '{}' due to IDP mismatch; expected IDP '{}'.", externalIdentity.getId(), idp.getName());
+ }
+
+ protected void warnForeignExisting(@NotNull Authorizable existing, boolean expectGroup) throws RepositoryException {
+ String typeName = (existing.isGroup()) ? "group" : "user";
+ String expectedType = (expectGroup) ? "group" : "user";
+ log.warn("Cannot sync external identity: Existing {} with id '{}' and principal name '{}' is not a {} defined by IDP '{}'.", typeName, existing.getID(), existing.getPrincipal().getName(), expectedType, idp.getName());
+ }
+
private static String authType(@NotNull Authorizable a) {
return a.isGroup() ? "group" : "user";
}
diff --git a/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/basic/package-info.java b/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/basic/package-info.java
index abb95360ee..21e8576349 100644
--- a/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/basic/package-info.java
+++ b/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/basic/package-info.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-@Version("1.7.0")
+@Version("1.8.0")
package org.apache.jackrabbit.oak.spi.security.authentication.external.basic;
import org.osgi.annotation.versioning.Version;
diff --git a/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/DynamicSyncContext.java b/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/DynamicSyncContext.java
index 14614ef41e..6662b86d30 100644
--- a/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/DynamicSyncContext.java
+++ b/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/DynamicSyncContext.java
@@ -104,6 +104,7 @@ public class DynamicSyncContext extends DefaultSyncContext {
ExternalIdentityRef ref = identity.getExternalId();
if (!isSameIDP(ref)) {
// create result in accordance with sync(String) where status is FOREIGN
+ warnForeign(identity);
return new DefaultSyncResultImpl(new DefaultSyncedIdentity(identity.getId(), ref, true, -1), SyncResult.Status.FOREIGN);
}
return sync((ExternalGroup) identity, ref);
@@ -286,7 +287,7 @@ public class DynamicSyncContext extends DefaultSyncContext {
// there exists a group with the same id or principal name but it doesn't belong to the same IDP
// in consistency with DefaultSyncContext don't sync this very membership into the repository
// and log a warning about the collision instead.
- log.warn("Existing group with id '{}' and principal name '{}' is not defined by IDP '{}'.", authorizable.getID(), authorizable.getPrincipal().getName(), idp.getName());
+ warnForeignExisting(authorizable, true);
return true;
} else if (!principalName.equals(authorizable.getPrincipal().getName())) {
// there exists a group with matching ID but principal-mismatch, don't sync this very membership into the