You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@syncope.apache.org by il...@apache.org on 2015/04/21 11:34:08 UTC

[39/57] syncope git commit: [SYNCOPE-119] New security model implemented

http://git-wip-us.apache.org/repos/asf/syncope/blob/65d652af/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/sync/UserSyncResultHandlerImpl.java
----------------------------------------------------------------------
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/sync/UserSyncResultHandlerImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/sync/UserSyncResultHandlerImpl.java
index 0f0d785..4a19ed7 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/sync/UserSyncResultHandlerImpl.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/sync/UserSyncResultHandlerImpl.java
@@ -27,7 +27,7 @@ import org.apache.syncope.common.lib.to.AbstractSubjectTO;
 import org.apache.syncope.common.lib.to.PropagationStatus;
 import org.apache.syncope.common.lib.to.UserTO;
 import org.apache.syncope.common.lib.types.AttributableType;
-import org.apache.syncope.core.persistence.api.entity.AttributableUtil;
+import org.apache.syncope.core.persistence.api.entity.AttributableUtils;
 import org.apache.syncope.core.provisioning.api.sync.ProvisioningResult;
 import org.apache.syncope.core.provisioning.api.sync.UserSyncResultHandler;
 import org.identityconnectors.framework.common.objects.SyncDelta;
@@ -35,8 +35,8 @@ import org.identityconnectors.framework.common.objects.SyncDelta;
 public class UserSyncResultHandlerImpl extends AbstractSyncResultHandler implements UserSyncResultHandler {
 
     @Override
-    protected AttributableUtil getAttributableUtil() {
-        return attrUtilFactory.getInstance(AttributableType.USER);
+    protected AttributableUtils getAttributableUtils() {
+        return attrUtilsFactory.getInstance(AttributableType.USER);
     }
 
     @Override
@@ -47,7 +47,7 @@ public class UserSyncResultHandlerImpl extends AbstractSyncResultHandler impleme
     @Override
     protected AbstractSubjectTO getSubjectTO(final long key) {
         try {
-            return userTransfer.getUserTO(key);
+            return userDataBinder.getUserTO(key);
         } catch (Exception e) {
             LOG.warn("Error retrieving user {}", key, e);
             return null;
@@ -58,12 +58,11 @@ public class UserSyncResultHandlerImpl extends AbstractSyncResultHandler impleme
     protected AbstractSubjectMod getSubjectMod(
             final AbstractSubjectTO subjectTO, final SyncDelta delta) {
 
-        return connObjectUtil.getAttributableMod(
-                subjectTO.getKey(),
+        return connObjectUtils.getAttributableMod(subjectTO.getKey(),
                 delta.getObject(),
                 subjectTO,
                 profile.getTask(),
-                getAttributableUtil());
+                getAttributableUtils());
     }
 
     @Override
@@ -76,11 +75,9 @@ public class UserSyncResultHandlerImpl extends AbstractSyncResultHandler impleme
         Map.Entry<Long, List<PropagationStatus>> created = userProvisioningManager.create(userTO, true, true, enabled,
                 Collections.singleton(profile.getTask().getResource().getKey()));
 
-        userTO = userTransfer.getUserTO(created.getKey());
-
         result.setId(created.getKey());
 
-        return userTO;
+        return userDataBinder.getUserTO(created.getKey());
     }
 
     @Override
@@ -98,7 +95,7 @@ public class UserSyncResultHandlerImpl extends AbstractSyncResultHandler impleme
             userMod.getResourcesToAdd().add(profile.getTask().getResource().getKey());
         }
 
-        return userTransfer.getUserTO(uwfAdapter.update(userMod).getResult().getKey().getKey());
+        return userDataBinder.getUserTO(uwfAdapter.update(userMod).getResult().getKey().getKey());
     }
 
     @Override
@@ -114,7 +111,7 @@ public class UserSyncResultHandlerImpl extends AbstractSyncResultHandler impleme
         Map.Entry<Long, List<PropagationStatus>> updated = userProvisioningManager.update(userMod, before.getKey(),
                 result, enabled, Collections.singleton(profile.getTask().getResource().getKey()));
 
-        return userTransfer.getUserTO(updated.getKey());
+        return userDataBinder.getUserTO(updated.getKey());
     }
 
     @Override
@@ -123,7 +120,8 @@ public class UserSyncResultHandlerImpl extends AbstractSyncResultHandler impleme
             final boolean unlink) {
 
         taskExecutor.execute(
-                propagationManager.getUserDeleteTaskIds(key, profile.getTask().getResource().getKey()));
+                propagationManager.getUserDeleteTasks(
+                        key, Collections.singleton(profile.getTask().getResource().getKey())));
 
         if (unlink) {
             final UserMod userMod = new UserMod();

http://git-wip-us.apache.org/repos/asf/syncope/blob/65d652af/core/provisioning-java/src/main/resources/provisioning.properties
----------------------------------------------------------------------
diff --git a/core/provisioning-java/src/main/resources/provisioning.properties b/core/provisioning-java/src/main/resources/provisioning.properties
index 4b87d44..9c0abff 100644
--- a/core/provisioning-java/src/main/resources/provisioning.properties
+++ b/core/provisioning-java/src/main/resources/provisioning.properties
@@ -16,3 +16,4 @@
 # under the License.
 userProvisioningManager=org.apache.syncope.core.provisioning.java.DefaultUserProvisioningManager
 groupProvisioningManager=org.apache.syncope.core.provisioning.java.DefaultGroupProvisioningManager
+virAttrCache=org.apache.syncope.core.provisioning.java.cache.MemoryVirAttrCache

http://git-wip-us.apache.org/repos/asf/syncope/blob/65d652af/core/provisioning-java/src/main/resources/provisioningContext.xml
----------------------------------------------------------------------
diff --git a/core/provisioning-java/src/main/resources/provisioningContext.xml b/core/provisioning-java/src/main/resources/provisioningContext.xml
index f7d9d4e..9b50b7d 100644
--- a/core/provisioning-java/src/main/resources/provisioningContext.xml
+++ b/core/provisioning-java/src/main/resources/provisioningContext.xml
@@ -84,7 +84,7 @@ under the License.
   <context:component-scan base-package="org.apache.syncope.core.misc"/>  
   <context:component-scan base-package="org.apache.syncope.core.provisioning.java"/>
 
-  <bean id="virAttrCache" class="org.apache.syncope.core.provisioning.java.cache.MemoryVirAttrCache" scope="singleton">
+  <bean id="virAttrCache" class="${virAttrCache}" scope="singleton">
     <constructor-arg value="60"/>
     <constructor-arg value="5000"/>
   </bean>

http://git-wip-us.apache.org/repos/asf/syncope/blob/65d652af/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/RestServiceExceptionMapper.java
----------------------------------------------------------------------
diff --git a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/RestServiceExceptionMapper.java b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/RestServiceExceptionMapper.java
index f2a41d5..ab71890 100644
--- a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/RestServiceExceptionMapper.java
+++ b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/RestServiceExceptionMapper.java
@@ -42,7 +42,7 @@ import org.apache.syncope.common.lib.to.ErrorTO;
 import org.apache.syncope.common.lib.types.ClientExceptionType;
 import org.apache.syncope.common.lib.types.EntityViolationType;
 import org.apache.syncope.common.rest.api.RESTHeaders;
-import org.apache.syncope.core.misc.security.UnauthorizedGroupException;
+import org.apache.syncope.core.misc.security.UnauthorizedException;
 import org.apache.syncope.core.persistence.api.attrvalue.validation.InvalidEntityException;
 import org.apache.syncope.core.persistence.api.attrvalue.validation.ParsingValidationException;
 import org.apache.syncope.core.persistence.api.dao.DuplicateException;
@@ -50,6 +50,7 @@ import org.apache.syncope.core.persistence.api.dao.MalformedPathException;
 import org.apache.syncope.core.persistence.api.dao.NotFoundException;
 import org.apache.syncope.core.workflow.api.WorkflowException;
 import org.identityconnectors.framework.common.exceptions.ConfigurationException;
+import org.identityconnectors.framework.common.exceptions.ConnectorException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.dao.DataIntegrityViolationException;
@@ -89,12 +90,14 @@ public class RestServiceExceptionMapper implements ExceptionMapper<Exception>, R
         } else if (ex instanceof AccessDeniedException) {
             builder = Response.status(Response.Status.UNAUTHORIZED).
                     header(HttpHeaders.WWW_AUTHENTICATE, BASIC_REALM_UNAUTHORIZED);
-        } else if (ex instanceof UnauthorizedGroupException) {
-            builder = builder(ClientExceptionType.UnauthorizedGroup, getExMessage(ex));
+        } else if (ex instanceof UnauthorizedException) {
+            builder = builder(ClientExceptionType.Unauthorized, getExMessage(ex));
         } else if (ex instanceof EntityExistsException || ex instanceof DuplicateException) {
             builder = builder(ClientExceptionType.EntityExists, getExMessage(ex));
         } else if (ex instanceof DataIntegrityViolationException) {
             builder = builder(ClientExceptionType.DataIntegrityViolation, getExMessage(ex));
+        } else if (ex instanceof ConnectorException) {
+            builder = builder(ClientExceptionType.ConnectorException, getExMessage(ex));            
         } else {
             builder = processNotFoundExceptions(ex);
             if (builder == null) {

http://git-wip-us.apache.org/repos/asf/syncope/blob/65d652af/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AbstractServiceImpl.java
----------------------------------------------------------------------
diff --git a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AbstractServiceImpl.java b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AbstractServiceImpl.java
index f6fb69a..dc3a1ec 100644
--- a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AbstractServiceImpl.java
+++ b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AbstractServiceImpl.java
@@ -83,10 +83,8 @@ abstract class AbstractServiceImpl implements JAXRSService {
      * @return response to successful <tt>create</tt> request
      */
     protected Response createResponse(final Object id, final Object entity) {
-        URI location = uriInfo.getAbsolutePathBuilder().path(String.valueOf(id)).build();
-
         Response.ResponseBuilder builder = Response.
-                created(location).
+                created(uriInfo.getAbsolutePathBuilder().path(String.valueOf(id)).build()).
                 header(RESTHeaders.RESOURCE_ID, id);
 
         switch (getPreference()) {

http://git-wip-us.apache.org/repos/asf/syncope/blob/65d652af/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/ConnectorServiceImpl.java
----------------------------------------------------------------------
diff --git a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/ConnectorServiceImpl.java b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/ConnectorServiceImpl.java
index 1ba5674..618b245 100644
--- a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/ConnectorServiceImpl.java
+++ b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/ConnectorServiceImpl.java
@@ -22,6 +22,8 @@ import java.net.URI;
 import java.util.ArrayList;
 import java.util.List;
 import javax.ws.rs.core.Response;
+import org.apache.commons.collections4.CollectionUtils;
+import org.apache.commons.collections4.Transformer;
 import org.apache.syncope.common.lib.to.BulkAction;
 import org.apache.syncope.common.lib.to.BulkActionResult;
 import org.apache.syncope.common.lib.to.ConnBundleTO;
@@ -71,14 +73,16 @@ public class ConnectorServiceImpl extends AbstractServiceImpl implements Connect
 
         connInstanceTO.setKey(connInstanceKey);
 
-        List<String> schemaNames = logic.getSchemaNames(connInstanceTO, includeSpecial);
-        List<PlainSchemaTO> result = new ArrayList<>(schemaNames.size());
-        for (String name : schemaNames) {
-            PlainSchemaTO schemaTO = new PlainSchemaTO();
-            schemaTO.setKey(name);
-            result.add(schemaTO);
-        }
-        return result;
+        return CollectionUtils.collect(logic.getSchemaNames(connInstanceTO, includeSpecial),
+                new Transformer<String, PlainSchemaTO>() {
+
+                    @Override
+                    public PlainSchemaTO transform(final String name) {
+                        PlainSchemaTO schemaTO = new PlainSchemaTO();
+                        schemaTO.setKey(name);
+                        return schemaTO;
+                    }
+                }, new ArrayList<PlainSchemaTO>());
     }
 
     @Override
@@ -128,6 +132,19 @@ public class ConnectorServiceImpl extends AbstractServiceImpl implements Connect
 
     @Override
     public BulkActionResult bulk(final BulkAction bulkAction) {
-        return logic.bulk(bulkAction);
+        BulkActionResult result = new BulkActionResult();
+
+        if (bulkAction.getOperation() == BulkAction.Type.DELETE) {
+            for (String id : bulkAction.getTargets()) {
+                try {
+                    result.add(logic.delete(Long.valueOf(id)).getKey(), BulkActionResult.Status.SUCCESS);
+                } catch (Exception e) {
+                    LOG.error("Error performing delete for connector {}", id, e);
+                    result.add(id, BulkActionResult.Status.FAILURE);
+                }
+            }
+        }
+
+        return result;
     }
 }

http://git-wip-us.apache.org/repos/asf/syncope/blob/65d652af/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/EntitlementServiceImpl.java
----------------------------------------------------------------------
diff --git a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/EntitlementServiceImpl.java b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/EntitlementServiceImpl.java
deleted file mode 100644
index 8d2b2a4..0000000
--- a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/EntitlementServiceImpl.java
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.syncope.core.rest.cxf.service;
-
-import java.util.List;
-import org.apache.syncope.common.lib.wrap.EntitlementTO;
-import org.apache.syncope.common.rest.api.CollectionWrapper;
-import org.apache.syncope.common.rest.api.service.EntitlementService;
-import org.apache.syncope.core.logic.EntitlementLogic;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.stereotype.Service;
-
-@Service
-public class EntitlementServiceImpl extends AbstractServiceImpl implements EntitlementService {
-
-    @Autowired
-    private EntitlementLogic logic;
-
-    @Override
-    public List<EntitlementTO> getAllEntitlements() {
-        return CollectionWrapper.wrap(logic.getAll(), EntitlementTO.class);
-    }
-
-    @Override
-    public List<EntitlementTO> getOwnEntitlements() {
-        return CollectionWrapper.wrap(logic.getOwn(), EntitlementTO.class);
-    }
-}

http://git-wip-us.apache.org/repos/asf/syncope/blob/65d652af/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/GroupServiceImpl.java
----------------------------------------------------------------------
diff --git a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/GroupServiceImpl.java b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/GroupServiceImpl.java
index 5c334a9..5efee1e 100644
--- a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/GroupServiceImpl.java
+++ b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/GroupServiceImpl.java
@@ -20,6 +20,10 @@ package org.apache.syncope.core.rest.cxf.service;
 
 import java.util.List;
 import javax.ws.rs.core.Response;
+import org.apache.commons.collections4.CollectionUtils;
+import org.apache.commons.collections4.Transformer;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.syncope.common.lib.SyncopeConstants;
 import org.apache.syncope.common.lib.mod.GroupMod;
 import org.apache.syncope.common.lib.to.BulkAction;
 import org.apache.syncope.common.lib.to.BulkActionResult;
@@ -44,11 +48,6 @@ public class GroupServiceImpl extends AbstractServiceImpl implements GroupServic
     private GroupLogic logic;
 
     @Override
-    public List<GroupTO> children(final Long groupKey) {
-        return logic.children(groupKey);
-    }
-
-    @Override
     public Response create(final GroupTO groupTO) {
         GroupTO created = logic.create(groupTO);
         return createResponse(created.getKey(), created);
@@ -65,29 +64,36 @@ public class GroupServiceImpl extends AbstractServiceImpl implements GroupServic
     }
 
     @Override
-    public PagedResult<GroupTO> list() {
-        return list(DEFAULT_PARAM_PAGE_VALUE, DEFAULT_PARAM_SIZE_VALUE, null);
+    public PagedResult<GroupTO> list(final List<String> realms) {
+        return list(realms, DEFAULT_PARAM_PAGE_VALUE, DEFAULT_PARAM_SIZE_VALUE, null);
     }
 
     @Override
-    public PagedResult<GroupTO> list(final String orderBy) {
-        return list(DEFAULT_PARAM_PAGE_VALUE, DEFAULT_PARAM_SIZE_VALUE, orderBy);
+    public PagedResult<GroupTO> list(final List<String> realms, final String orderBy) {
+        return list(realms, DEFAULT_PARAM_PAGE_VALUE, DEFAULT_PARAM_SIZE_VALUE, orderBy);
     }
 
     @Override
-    public PagedResult<GroupTO> list(final Integer page, final Integer size) {
-        return list(page, size, null);
+    public PagedResult<GroupTO> list(final List<String> realms, final Integer page, final Integer size) {
+        return list(realms, page, size, null);
     }
 
     @Override
-    public PagedResult<GroupTO> list(final Integer page, final Integer size, final String orderBy) {
-        List<OrderByClause> orderByClauses = getOrderByClauses(orderBy);
-        return buildPagedResult(logic.list(page, size, orderByClauses), page, size, logic.count());
-    }
+    public PagedResult<GroupTO> list(
+            final List<String> realms, final Integer page, final Integer size, final String orderBy) {
 
-    @Override
-    public GroupTO parent(final Long groupKey) {
-        return logic.parent(groupKey);
+        CollectionUtils.transform(realms, new Transformer<String, String>() {
+
+            @Override
+            public String transform(final String input) {
+                return StringUtils.prependIfMissing(input, SyncopeConstants.ROOT_REALM);
+            }
+        });
+
+        List<OrderByClause> orderByClauses = getOrderByClauses(orderBy);
+        return buildPagedResult(
+                logic.list(page, size, orderByClauses, realms), page, size,
+                logic.count(realms));
     }
 
     @Override
@@ -96,31 +102,44 @@ public class GroupServiceImpl extends AbstractServiceImpl implements GroupServic
     }
 
     @Override
-    public PagedResult<GroupTO> search(final String fiql) {
-        return search(fiql, DEFAULT_PARAM_PAGE_VALUE, DEFAULT_PARAM_SIZE_VALUE, null);
+    public PagedResult<GroupTO> search(final List<String> realms, final String fiql) {
+        return search(realms, fiql, DEFAULT_PARAM_PAGE_VALUE, DEFAULT_PARAM_SIZE_VALUE, null);
     }
 
     @Override
-    public PagedResult<GroupTO> search(final String fiql, final String orderBy) {
-        return search(fiql, DEFAULT_PARAM_PAGE_VALUE, DEFAULT_PARAM_SIZE_VALUE, orderBy);
+    public PagedResult<GroupTO> search(final List<String> realms, final String fiql, final String orderBy) {
+        return search(realms, fiql, DEFAULT_PARAM_PAGE_VALUE, DEFAULT_PARAM_SIZE_VALUE, orderBy);
     }
 
     @Override
-    public PagedResult<GroupTO> search(final String fiql, final Integer page, final Integer size) {
-        return search(fiql, page, size, null);
+    public PagedResult<GroupTO> search(
+            final List<String> realms, final String fiql, final Integer page, final Integer size) {
+
+        return search(realms, fiql, page, size, null);
     }
 
     @Override
-    public PagedResult<GroupTO> search(final String fiql, final Integer page, final Integer size, final String orderBy) {
+    public PagedResult<GroupTO> search(final List<String> realms, final String fiql,
+            final Integer page, final Integer size, final String orderBy) {
+
+        CollectionUtils.transform(realms, new Transformer<String, String>() {
+
+            @Override
+            public String transform(final String input) {
+                return StringUtils.prependIfMissing(input, SyncopeConstants.ROOT_REALM);
+            }
+        });
+
         SearchCond cond = getSearchCond(fiql);
         List<OrderByClause> orderByClauses = getOrderByClauses(orderBy);
         return buildPagedResult(
-                logic.search(cond, page, size, orderByClauses), page, size, logic.searchCount(cond));
+                logic.search(cond, page, size, orderByClauses, realms), page, size,
+                logic.searchCount(cond, realms));
     }
 
     @Override
-    public GroupTO readSelf(final Long groupKey) {
-        return logic.readSelf(groupKey);
+    public List<GroupTO> own() {
+        return logic.own();
     }
 
     @Override
@@ -222,6 +241,21 @@ public class GroupServiceImpl extends AbstractServiceImpl implements GroupServic
 
     @Override
     public BulkActionResult bulk(final BulkAction bulkAction) {
-        return logic.bulk(bulkAction);
+        BulkActionResult result = new BulkActionResult();
+
+        if (bulkAction.getOperation() == BulkAction.Type.DELETE) {
+            for (String groupKey : bulkAction.getTargets()) {
+                try {
+                    result.add(logic.delete(Long.valueOf(groupKey)).getKey(), BulkActionResult.Status.SUCCESS);
+                } catch (Exception e) {
+                    LOG.error("Error performing delete for group {}", groupKey, e);
+                    result.add(groupKey, BulkActionResult.Status.FAILURE);
+                }
+            }
+        } else {
+            LOG.warn("Unsupported bulk action: {}", bulkAction.getOperation());
+        }
+
+        return result;
     }
 }

http://git-wip-us.apache.org/repos/asf/syncope/blob/65d652af/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/PolicyServiceImpl.java
----------------------------------------------------------------------
diff --git a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/PolicyServiceImpl.java b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/PolicyServiceImpl.java
index ac4df8a..1558120 100644
--- a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/PolicyServiceImpl.java
+++ b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/PolicyServiceImpl.java
@@ -20,7 +20,6 @@ package org.apache.syncope.core.rest.cxf.service;
 
 import java.net.URI;
 import java.util.List;
-import javax.ws.rs.BadRequestException;
 import javax.ws.rs.core.Response;
 import org.apache.syncope.common.lib.to.AbstractPolicyTO;
 import org.apache.syncope.common.lib.to.AccountPolicyTO;
@@ -41,7 +40,7 @@ public class PolicyServiceImpl extends AbstractServiceImpl implements PolicyServ
 
     @Override
     public <T extends AbstractPolicyTO> Response create(final T policyTO) {
-        AbstractPolicyTO policy = logic.create(policyTO);
+        T policy = logic.create(policyTO);
         URI location = uriInfo.getAbsolutePathBuilder().path(String.valueOf(policy.getKey())).build();
         return Response.created(location).
                 header(RESTHeaders.RESOURCE_ID, policy.getKey()).
@@ -63,51 +62,20 @@ public class PolicyServiceImpl extends AbstractServiceImpl implements PolicyServ
         return logic.read(policyKey);
     }
 
-    @SuppressWarnings("unchecked")
-    @Override
-    public <T extends AbstractPolicyTO> T readGlobal(final PolicyType type) {
-        T result = null;
-
-        switch (type) {
-            case ACCOUNT:
-            case GLOBAL_ACCOUNT:
-                result = (T) logic.getGlobalAccountPolicy();
-                break;
-
-            case PASSWORD:
-            case GLOBAL_PASSWORD:
-                result = (T) logic.getGlobalPasswordPolicy();
-                break;
-
-            case SYNC:
-            case GLOBAL_SYNC:
-                result = (T) logic.getGlobalSyncPolicy();
-                break;
-
-            default:
-                throw new BadRequestException();
-        }
-
-        return result;
-    }
-
     @Override
     public <T extends AbstractPolicyTO> void update(final Long policyKey, final T policyTO) {
         policyTO.setKey(policyKey);
 
         switch (policyTO.getType()) {
             case ACCOUNT:
-            case GLOBAL_ACCOUNT:
                 logic.update((AccountPolicyTO) policyTO);
                 break;
 
             case PASSWORD:
-            case GLOBAL_PASSWORD:
                 logic.update((PasswordPolicyTO) policyTO);
                 break;
 
             case SYNC:
-            case GLOBAL_SYNC:
                 logic.update((SyncPolicyTO) policyTO);
                 break;
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/65d652af/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/RealmServiceImpl.java
----------------------------------------------------------------------
diff --git a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/RealmServiceImpl.java b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/RealmServiceImpl.java
index 79f506c..aba5295 100644
--- a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/RealmServiceImpl.java
+++ b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/RealmServiceImpl.java
@@ -22,6 +22,7 @@ import java.net.URI;
 import java.util.List;
 import javax.ws.rs.core.Response;
 import org.apache.commons.lang3.StringUtils;
+import org.apache.syncope.common.lib.SyncopeConstants;
 import org.apache.syncope.common.lib.to.RealmTO;
 import org.apache.syncope.common.rest.api.RESTHeaders;
 import org.apache.syncope.common.rest.api.service.RealmService;
@@ -42,12 +43,12 @@ public class RealmServiceImpl extends AbstractServiceImpl implements RealmServic
 
     @Override
     public List<RealmTO> list(final String fullPath) {
-        return logic.list(StringUtils.prependIfMissing(fullPath, "/"));
+        return logic.list(StringUtils.prependIfMissing(fullPath, SyncopeConstants.ROOT_REALM));
     }
 
     @Override
     public Response create(final String parentPath, final RealmTO realmTO) {
-        RealmTO created = logic.create(StringUtils.prependIfMissing(parentPath, "/"), realmTO);
+        RealmTO created = logic.create(StringUtils.prependIfMissing(parentPath, SyncopeConstants.ROOT_REALM), realmTO);
         URI location = uriInfo.getAbsolutePathBuilder().path(created.getName()).build();
         return Response.created(location).
                 header(RESTHeaders.RESOURCE_ID, created.getFullPath()).
@@ -56,13 +57,13 @@ public class RealmServiceImpl extends AbstractServiceImpl implements RealmServic
 
     @Override
     public void update(final String fullPath, final RealmTO realmTO) {
-        realmTO.setFullPath(StringUtils.prependIfMissing(fullPath, "/"));
+        realmTO.setFullPath(StringUtils.prependIfMissing(fullPath, SyncopeConstants.ROOT_REALM));
         logic.update(realmTO);
     }
 
     @Override
     public void delete(final String fullPath) {
-        logic.delete(StringUtils.prependIfMissing(fullPath, "/"));
+        logic.delete(StringUtils.prependIfMissing(fullPath, SyncopeConstants.ROOT_REALM));
     }
 
 }

http://git-wip-us.apache.org/repos/asf/syncope/blob/65d652af/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/ResourceServiceImpl.java
----------------------------------------------------------------------
diff --git a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/ResourceServiceImpl.java b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/ResourceServiceImpl.java
index 63bb632..dfc4391 100644
--- a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/ResourceServiceImpl.java
+++ b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/ResourceServiceImpl.java
@@ -93,11 +93,6 @@ public class ResourceServiceImpl extends AbstractServiceImpl implements Resource
     }
 
     @Override
-    public BulkActionResult bulk(final BulkAction bulkAction) {
-        return logic.bulk(bulkAction);
-    }
-
-    @Override
     public BulkActionResult bulkDeassociation(final String resourceKey, final SubjectType subjectType,
             final ResourceDeassociationActionType type, final List<SubjectKey> subjectKeys) {
 
@@ -136,4 +131,21 @@ public class ResourceServiceImpl extends AbstractServiceImpl implements Resource
         return res;
     }
 
+    @Override
+    public BulkActionResult bulk(final BulkAction bulkAction) {
+        BulkActionResult result = new BulkActionResult();
+
+        if (bulkAction.getOperation() == BulkAction.Type.DELETE) {
+            for (String name : bulkAction.getTargets()) {
+                try {
+                    result.add(logic.delete(name).getKey(), BulkActionResult.Status.SUCCESS);
+                } catch (Exception e) {
+                    LOG.error("Error performing delete for resource {}", name, e);
+                    result.add(name, BulkActionResult.Status.FAILURE);
+                }
+            }
+        }
+
+        return result;
+    }
 }

http://git-wip-us.apache.org/repos/asf/syncope/blob/65d652af/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/TaskServiceImpl.java
----------------------------------------------------------------------
diff --git a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/TaskServiceImpl.java b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/TaskServiceImpl.java
index 3867a25..ce1a394 100644
--- a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/TaskServiceImpl.java
+++ b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/TaskServiceImpl.java
@@ -134,6 +134,47 @@ public class TaskServiceImpl extends AbstractServiceImpl implements TaskService
 
     @Override
     public BulkActionResult bulk(final BulkAction bulkAction) {
-        return logic.bulk(bulkAction);
+        BulkActionResult result = new BulkActionResult();
+
+        switch (bulkAction.getOperation()) {
+            case DELETE:
+                for (String taskKey : bulkAction.getTargets()) {
+                    try {
+                        result.add(logic.delete(Long.valueOf(taskKey)).getKey(), BulkActionResult.Status.SUCCESS);
+                    } catch (Exception e) {
+                        LOG.error("Error performing delete for task {}", taskKey, e);
+                        result.add(taskKey, BulkActionResult.Status.FAILURE);
+                    }
+                }
+                break;
+
+            case DRYRUN:
+                for (String taskKey : bulkAction.getTargets()) {
+                    try {
+                        logic.execute(Long.valueOf(taskKey), true);
+                        result.add(taskKey, BulkActionResult.Status.SUCCESS);
+                    } catch (Exception e) {
+                        LOG.error("Error performing dryrun for task {}", taskKey, e);
+                        result.add(taskKey, BulkActionResult.Status.FAILURE);
+                    }
+                }
+                break;
+
+            case EXECUTE:
+                for (String taskKey : bulkAction.getTargets()) {
+                    try {
+                        logic.execute(Long.valueOf(taskKey), false);
+                        result.add(taskKey, BulkActionResult.Status.SUCCESS);
+                    } catch (Exception e) {
+                        LOG.error("Error performing execute for task {}", taskKey, e);
+                        result.add(taskKey, BulkActionResult.Status.FAILURE);
+                    }
+                }
+                break;
+
+            default:
+        }
+
+        return result;
     }
 }

http://git-wip-us.apache.org/repos/asf/syncope/blob/65d652af/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserSelfServiceImpl.java
----------------------------------------------------------------------
diff --git a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserSelfServiceImpl.java b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserSelfServiceImpl.java
index f48ec4c..d15c236 100644
--- a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserSelfServiceImpl.java
+++ b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserSelfServiceImpl.java
@@ -19,10 +19,12 @@
 package org.apache.syncope.core.rest.cxf.service;
 
 import javax.ws.rs.core.Response;
+import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.lib.SyncopeClientException;
 import org.apache.syncope.common.lib.mod.UserMod;
 import org.apache.syncope.common.lib.to.UserTO;
 import org.apache.syncope.common.lib.types.ClientExceptionType;
+import org.apache.syncope.common.rest.api.RESTHeaders;
 import org.apache.syncope.common.rest.api.service.UserSelfService;
 import org.apache.syncope.core.logic.SyncopeLogic;
 import org.apache.syncope.core.logic.UserLogic;
@@ -51,8 +53,13 @@ public class UserSelfServiceImpl extends AbstractServiceImpl implements UserSelf
     }
 
     @Override
-    public UserTO read() {
-        return logic.readSelf();
+    public Response read() {
+        Pair<String, UserTO> self = logic.readSelf();
+        return Response.ok().
+                header(RESTHeaders.RESOURCE_ID, self.getValue().getKey()).
+                header(RESTHeaders.OWNED_ENTITLEMENTS, self.getKey()).
+                entity(self.getValue()).
+                build();
     }
 
     @Override

http://git-wip-us.apache.org/repos/asf/syncope/blob/65d652af/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserServiceImpl.java
----------------------------------------------------------------------
diff --git a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserServiceImpl.java b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserServiceImpl.java
index 82cecfc..320a37c 100644
--- a/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserServiceImpl.java
+++ b/core/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserServiceImpl.java
@@ -21,6 +21,10 @@ package org.apache.syncope.core.rest.cxf.service;
 import java.util.List;
 import javax.ws.rs.core.HttpHeaders;
 import javax.ws.rs.core.Response;
+import org.apache.commons.collections4.CollectionUtils;
+import org.apache.commons.collections4.Transformer;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.syncope.common.lib.SyncopeConstants;
 import org.apache.syncope.common.lib.mod.ResourceAssociationMod;
 import org.apache.syncope.common.lib.mod.StatusMod;
 import org.apache.syncope.common.lib.mod.UserMod;
@@ -78,24 +82,36 @@ public class UserServiceImpl extends AbstractServiceImpl implements UserService
     }
 
     @Override
-    public PagedResult<UserTO> list() {
-        return list(DEFAULT_PARAM_PAGE_VALUE, DEFAULT_PARAM_SIZE_VALUE, null);
+    public PagedResult<UserTO> list(final List<String> realms) {
+        return list(realms, DEFAULT_PARAM_PAGE_VALUE, DEFAULT_PARAM_SIZE_VALUE, null);
     }
 
     @Override
-    public PagedResult<UserTO> list(final String orderBy) {
-        return list(DEFAULT_PARAM_PAGE_VALUE, DEFAULT_PARAM_SIZE_VALUE, orderBy);
+    public PagedResult<UserTO> list(final List<String> realms, final String orderBy) {
+        return list(realms, DEFAULT_PARAM_PAGE_VALUE, DEFAULT_PARAM_SIZE_VALUE, orderBy);
     }
 
     @Override
-    public PagedResult<UserTO> list(final Integer page, final Integer size) {
-        return list(page, size, null);
+    public PagedResult<UserTO> list(final List<String> realms, final Integer page, final Integer size) {
+        return list(realms, page, size, null);
     }
 
     @Override
-    public PagedResult<UserTO> list(final Integer page, final Integer size, final String orderBy) {
+    public PagedResult<UserTO> list(
+            final List<String> realms, final Integer page, final Integer size, final String orderBy) {
+
+        CollectionUtils.transform(realms, new Transformer<String, String>() {
+
+            @Override
+            public String transform(final String input) {
+                return StringUtils.prependIfMissing(input, SyncopeConstants.ROOT_REALM);
+            }
+        });
+
         List<OrderByClause> orderByClauses = getOrderByClauses(orderBy);
-        return buildPagedResult(logic.list(page, size, orderByClauses), page, size, logic.count());
+        return buildPagedResult(
+                logic.list(page, size, orderByClauses, realms), page, size,
+                logic.count(realms));
     }
 
     @Override
@@ -104,26 +120,39 @@ public class UserServiceImpl extends AbstractServiceImpl implements UserService
     }
 
     @Override
-    public PagedResult<UserTO> search(final String fiql) {
-        return search(fiql, DEFAULT_PARAM_PAGE_VALUE, DEFAULT_PARAM_SIZE_VALUE, null);
+    public PagedResult<UserTO> search(final List<String> realms, final String fiql) {
+        return search(realms, fiql, DEFAULT_PARAM_PAGE_VALUE, DEFAULT_PARAM_SIZE_VALUE, null);
     }
 
     @Override
-    public PagedResult<UserTO> search(final String fiql, final String orderBy) {
-        return search(fiql, DEFAULT_PARAM_PAGE_VALUE, DEFAULT_PARAM_SIZE_VALUE, orderBy);
+    public PagedResult<UserTO> search(final List<String> realms, final String fiql, final String orderBy) {
+        return search(realms, fiql, DEFAULT_PARAM_PAGE_VALUE, DEFAULT_PARAM_SIZE_VALUE, orderBy);
     }
 
     @Override
-    public PagedResult<UserTO> search(final String fiql, final Integer page, final Integer size) {
-        return search(fiql, page, size, null);
+    public PagedResult<UserTO> search(
+            final List<String> realms, final String fiql, final Integer page, final Integer size) {
+
+        return search(realms, fiql, page, size, null);
     }
 
     @Override
-    public PagedResult<UserTO> search(final String fiql, final Integer page, final Integer size, final String orderBy) {
+    public PagedResult<UserTO> search(final List<String> realms, final String fiql,
+            final Integer page, final Integer size, final String orderBy) {
+
+        CollectionUtils.transform(realms, new Transformer<String, String>() {
+
+            @Override
+            public String transform(final String input) {
+                return StringUtils.prependIfMissing(input, SyncopeConstants.ROOT_REALM);
+            }
+        });
+
         SearchCond cond = getSearchCond(fiql);
         List<OrderByClause> orderByClauses = getOrderByClauses(orderBy);
         return buildPagedResult(
-                logic.search(cond, page, size, orderByClauses), page, size, logic.searchCount(cond));
+                logic.search(cond, page, size, orderByClauses, realms), page, size,
+                logic.searchCount(cond, realms));
     }
 
     @Override
@@ -246,6 +275,51 @@ public class UserServiceImpl extends AbstractServiceImpl implements UserService
 
     @Override
     public BulkActionResult bulk(final BulkAction bulkAction) {
-        return logic.bulk(bulkAction);
+        BulkActionResult result = new BulkActionResult();
+
+        switch (bulkAction.getOperation()) {
+            case DELETE:
+                for (String key : bulkAction.getTargets()) {
+                    try {
+                        result.add(logic.delete(Long.valueOf(key)).getKey(), BulkActionResult.Status.SUCCESS);
+                    } catch (Exception e) {
+                        LOG.error("Error performing delete for user {}", key, e);
+                        result.add(key, BulkActionResult.Status.FAILURE);
+                    }
+                }
+                break;
+
+            case SUSPEND:
+                for (String key : bulkAction.getTargets()) {
+                    StatusMod statusMod = new StatusMod();
+                    statusMod.setKey(Long.valueOf(key));
+                    statusMod.setType(StatusMod.ModType.SUSPEND);
+                    try {
+                        result.add(logic.status(statusMod).getKey(), BulkActionResult.Status.SUCCESS);
+                    } catch (Exception e) {
+                        LOG.error("Error performing suspend for user {}", key, e);
+                        result.add(key, BulkActionResult.Status.FAILURE);
+                    }
+                }
+                break;
+
+            case REACTIVATE:
+                for (String key : bulkAction.getTargets()) {
+                    StatusMod statusMod = new StatusMod();
+                    statusMod.setKey(Long.valueOf(key));
+                    statusMod.setType(StatusMod.ModType.REACTIVATE);
+                    try {
+                        result.add(logic.status(statusMod).getKey(), BulkActionResult.Status.SUCCESS);
+                    } catch (Exception e) {
+                        LOG.error("Error performing reactivate for user {}", key, e);
+                        result.add(key, BulkActionResult.Status.FAILURE);
+                    }
+                }
+                break;
+
+            default:
+        }
+
+        return result;
     }
 }

http://git-wip-us.apache.org/repos/asf/syncope/blob/65d652af/core/workflow-activiti/src/main/java/org/apache/syncope/core/workflow/activiti/ActivitiUserWorkflowAdapter.java
----------------------------------------------------------------------
diff --git a/core/workflow-activiti/src/main/java/org/apache/syncope/core/workflow/activiti/ActivitiUserWorkflowAdapter.java b/core/workflow-activiti/src/main/java/org/apache/syncope/core/workflow/activiti/ActivitiUserWorkflowAdapter.java
index 3db5052..a9e2276 100644
--- a/core/workflow-activiti/src/main/java/org/apache/syncope/core/workflow/activiti/ActivitiUserWorkflowAdapter.java
+++ b/core/workflow-activiti/src/main/java/org/apache/syncope/core/workflow/activiti/ActivitiUserWorkflowAdapter.java
@@ -24,7 +24,6 @@ import com.fasterxml.jackson.databind.node.ObjectNode;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
-import java.util.AbstractMap.SimpleEntry;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.HashMap;
@@ -58,6 +57,8 @@ import org.activiti.engine.runtime.ProcessInstance;
 import org.activiti.engine.task.Task;
 import org.apache.commons.io.IOUtils;
 import org.apache.commons.lang3.StringUtils;
+import org.apache.commons.lang3.tuple.ImmutablePair;
+import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.lib.SyncopeClientException;
 import org.apache.syncope.common.lib.mod.StatusMod;
 import org.apache.syncope.common.lib.mod.UserMod;
@@ -67,8 +68,8 @@ import org.apache.syncope.common.lib.to.WorkflowFormTO;
 import org.apache.syncope.common.lib.types.PropagationByResource;
 import org.apache.syncope.common.lib.types.ResourceOperation;
 import org.apache.syncope.common.lib.types.WorkflowFormPropertyType;
-import org.apache.syncope.core.misc.security.AuthContextUtil;
-import org.apache.syncope.core.misc.security.UnauthorizedGroupException;
+import org.apache.syncope.core.misc.security.AuthContextUtils;
+import org.apache.syncope.core.misc.security.UnauthorizedException;
 import org.apache.syncope.core.misc.spring.BeanUtils;
 import org.apache.syncope.core.persistence.api.attrvalue.validation.InvalidEntityException;
 import org.apache.syncope.core.persistence.api.attrvalue.validation.ParsingValidationException;
@@ -241,25 +242,25 @@ public class ActivitiUserWorkflowAdapter extends AbstractUserWorkflowAdapter {
     }
 
     @Override
-    public WorkflowResult<Map.Entry<Long, Boolean>> create(final UserTO userTO, final boolean disablePwdPolicyCheck,
+    public WorkflowResult<Pair<Long, Boolean>> create(final UserTO userTO, final boolean disablePwdPolicyCheck,
             final boolean storePassword) throws WorkflowException {
 
         return create(userTO, disablePwdPolicyCheck, null, storePassword);
     }
 
     @Override
-    public WorkflowResult<Map.Entry<Long, Boolean>> create(UserTO userTO, boolean storePassword) throws
-            UnauthorizedGroupException, WorkflowException {
+    public WorkflowResult<Pair<Long, Boolean>> create(UserTO userTO, boolean storePassword) throws
+            UnauthorizedException, WorkflowException {
 
         return create(userTO, false, storePassword);
     }
 
     @Override
-    public WorkflowResult<Map.Entry<Long, Boolean>> create(final UserTO userTO, final boolean disablePwdPolicyCheck,
+    public WorkflowResult<Pair<Long, Boolean>> create(final UserTO userTO, final boolean disablePwdPolicyCheck,
             final Boolean enabled, final boolean storePassword) throws WorkflowException {
 
         final Map<String, Object> variables = new HashMap<>();
-        variables.put(WF_EXECUTOR, AuthContextUtil.getAuthenticatedUsername());
+        variables.put(WF_EXECUTOR, AuthContextUtils.getAuthenticatedUsername());
         variables.put(USER_TO, userTO);
         variables.put(ENABLED, enabled);
         variables.put(STORE_PASSWORD, storePassword);
@@ -299,8 +300,8 @@ public class ActivitiUserWorkflowAdapter extends AbstractUserWorkflowAdapter {
 
         saveForFormSubmit(user, userTO.getPassword(), propByRes);
 
-        return new WorkflowResult<Map.Entry<Long, Boolean>>(
-                new SimpleEntry<>(user.getKey(), propagateEnable), propByRes, getPerformedTasks(user));
+        return new WorkflowResult<Pair<Long, Boolean>>(
+                new ImmutablePair<>(user.getKey(), propagateEnable), propByRes, getPerformedTasks(user));
     }
 
     private Set<String> doExecuteTask(final User user, final String task,
@@ -309,7 +310,7 @@ public class ActivitiUserWorkflowAdapter extends AbstractUserWorkflowAdapter {
         Set<String> preTasks = getPerformedTasks(user);
 
         final Map<String, Object> variables = new HashMap<>();
-        variables.put(WF_EXECUTOR, AuthContextUtil.getAuthenticatedUsername());
+        variables.put(WF_EXECUTOR, AuthContextUtils.getAuthenticatedUsername());
         variables.put(TASK, task);
 
         // using BeanUtils to access all user's properties and trigger lazy loading - we are about to
@@ -355,7 +356,7 @@ public class ActivitiUserWorkflowAdapter extends AbstractUserWorkflowAdapter {
     }
 
     @Override
-    protected WorkflowResult<Map.Entry<UserMod, Boolean>> doUpdate(final User user, final UserMod userMod)
+    protected WorkflowResult<Pair<UserMod, Boolean>> doUpdate(final User user, final UserMod userMod)
             throws WorkflowException {
 
         Set<String> tasks = doExecuteTask(user, "update", Collections.singletonMap(USER_MOD, (Object) userMod));
@@ -370,8 +371,8 @@ public class ActivitiUserWorkflowAdapter extends AbstractUserWorkflowAdapter {
 
         Boolean propagateEnable = runtimeService.getVariable(user.getWorkflowId(), PROPAGATE_ENABLE, Boolean.class);
 
-        return new WorkflowResult<Map.Entry<UserMod, Boolean>>(
-                new SimpleEntry<>(userMod, propagateEnable), propByRes, tasks);
+        return new WorkflowResult<Pair<UserMod, Boolean>>(
+                new ImmutablePair<>(userMod, propagateEnable), propByRes, tasks);
     }
 
     @Override
@@ -445,7 +446,7 @@ public class ActivitiUserWorkflowAdapter extends AbstractUserWorkflowAdapter {
 
     @Override
     public WorkflowResult<Long> execute(final UserTO userTO, final String taskId)
-            throws UnauthorizedGroupException, WorkflowException {
+            throws UnauthorizedException, WorkflowException {
 
         User user = userDAO.authFetch(userTO.getKey());
 
@@ -694,7 +695,7 @@ public class ActivitiUserWorkflowAdapter extends AbstractUserWorkflowAdapter {
     public List<WorkflowFormTO> getForms() {
         List<WorkflowFormTO> forms = new ArrayList<>();
 
-        final String authUser = AuthContextUtil.getAuthenticatedUsername();
+        final String authUser = AuthContextUtils.getAuthenticatedUsername();
         if (adminUser.equals(authUser)) {
             forms.addAll(getForms(taskService.createTaskQuery().
                     taskVariableValueEquals(TASK_IS_FORM, Boolean.TRUE)));
@@ -782,7 +783,7 @@ public class ActivitiUserWorkflowAdapter extends AbstractUserWorkflowAdapter {
         return result;
     }
 
-    private Map.Entry<Task, TaskFormData> checkTask(final String taskId, final String authUser) {
+    private Pair<Task, TaskFormData> checkTask(final String taskId, final String authUser) {
         Task task;
         try {
             task = taskService.createTaskQuery().taskId(taskId).singleResult();
@@ -804,7 +805,7 @@ public class ActivitiUserWorkflowAdapter extends AbstractUserWorkflowAdapter {
             }
         }
 
-        return new SimpleEntry<>(task, formData);
+        return new ImmutablePair<>(task, formData);
     }
 
     @Transactional
@@ -812,8 +813,8 @@ public class ActivitiUserWorkflowAdapter extends AbstractUserWorkflowAdapter {
     public WorkflowFormTO claimForm(final String taskId)
             throws WorkflowException {
 
-        final String authUser = AuthContextUtil.getAuthenticatedUsername();
-        Map.Entry<Task, TaskFormData> checked = checkTask(taskId, authUser);
+        final String authUser = AuthContextUtils.getAuthenticatedUsername();
+        Pair<Task, TaskFormData> checked = checkTask(taskId, authUser);
 
         if (!adminUser.equals(authUser)) {
             List<Task> tasksForUser = taskService.createTaskQuery().taskId(taskId).taskCandidateUser(authUser).list();
@@ -839,8 +840,8 @@ public class ActivitiUserWorkflowAdapter extends AbstractUserWorkflowAdapter {
     public WorkflowResult<UserMod> submitForm(final WorkflowFormTO form)
             throws WorkflowException {
 
-        final String authUser = AuthContextUtil.getAuthenticatedUsername();
-        Map.Entry<Task, TaskFormData> checked = checkTask(form.getTaskId(), authUser);
+        final String authUser = AuthContextUtils.getAuthenticatedUsername();
+        Pair<Task, TaskFormData> checked = checkTask(form.getTaskId(), authUser);
 
         if (!checked.getKey().getOwner().equals(authUser)) {
             throw new WorkflowException(new IllegalArgumentException("Task " + form.getTaskId() + " assigned to "
@@ -886,8 +887,8 @@ public class ActivitiUserWorkflowAdapter extends AbstractUserWorkflowAdapter {
             userMod = new UserMod();
             userMod.setKey(updated.getKey());
             userMod.setPassword(clearPassword);
-            
-          if (propByRes != null) {
+
+            if (propByRes != null) {
                 final StatusMod st = new StatusMod();
                 userMod.setPwdPropRequest(st);
                 st.setOnSyncope(true);

http://git-wip-us.apache.org/repos/asf/syncope/blob/65d652af/core/workflow-activiti/src/main/java/org/apache/syncope/core/workflow/activiti/SyncopeGroupQueryImpl.java
----------------------------------------------------------------------
diff --git a/core/workflow-activiti/src/main/java/org/apache/syncope/core/workflow/activiti/SyncopeGroupQueryImpl.java b/core/workflow-activiti/src/main/java/org/apache/syncope/core/workflow/activiti/SyncopeGroupQueryImpl.java
index 1ec4b54..b78575c 100644
--- a/core/workflow-activiti/src/main/java/org/apache/syncope/core/workflow/activiti/SyncopeGroupQueryImpl.java
+++ b/core/workflow-activiti/src/main/java/org/apache/syncope/core/workflow/activiti/SyncopeGroupQueryImpl.java
@@ -26,6 +26,9 @@ import org.activiti.engine.ActivitiException;
 import org.activiti.engine.identity.Group;
 import org.activiti.engine.identity.GroupQuery;
 import org.activiti.engine.impl.persistence.entity.GroupEntity;
+import org.apache.commons.collections4.CollectionUtils;
+import org.apache.commons.collections4.Transformer;
+import org.apache.syncope.common.lib.SyncopeConstants;
 import org.apache.syncope.core.persistence.api.dao.GroupDAO;
 
 public class SyncopeGroupQueryImpl implements GroupQuery {
@@ -99,7 +102,7 @@ public class SyncopeGroupQueryImpl implements GroupQuery {
         return new GroupEntity(group.getKey().toString());
     }
 
-    private void execute() {
+    private void execute(final int page, final int itemsPerPage) {
         if (groupId != null) {
             org.apache.syncope.core.persistence.api.entity.group.Group syncopeGroup = groupDAO.find(groupId);
             if (syncopeGroup == null) {
@@ -109,17 +112,24 @@ public class SyncopeGroupQueryImpl implements GroupQuery {
             }
         }
         if (result == null) {
-            result = new ArrayList<>();
-            for ( org.apache.syncope.core.persistence.api.entity.group.Group syncopeGroup : groupDAO.findAll()) {
-                result.add(fromSyncopeGroup(syncopeGroup));
-            }
+            result = CollectionUtils.collect(
+                    groupDAO.findAll(SyncopeConstants.FULL_ADMIN_REALMS, page, itemsPerPage),
+                    new Transformer<org.apache.syncope.core.persistence.api.entity.group.Group, Group>() {
+
+                        @Override
+                        public Group transform(final org.apache.syncope.core.persistence.api.entity.group.Group user) {
+                            return fromSyncopeGroup(user);
+                        }
+
+                    },
+                    new ArrayList<Group>());
         }
     }
 
     @Override
     public long count() {
         if (result == null) {
-            execute();
+            execute(-1, -1);
         }
         return result.size();
     }
@@ -127,7 +137,7 @@ public class SyncopeGroupQueryImpl implements GroupQuery {
     @Override
     public Group singleResult() {
         if (result == null) {
-            execute();
+            execute(-1, -1);
         }
         if (result.isEmpty()) {
             throw new ActivitiException("Empty result");
@@ -139,7 +149,7 @@ public class SyncopeGroupQueryImpl implements GroupQuery {
     @Override
     public List<Group> list() {
         if (result == null) {
-            execute();
+            execute(-1, -1);
         }
         return result;
     }

http://git-wip-us.apache.org/repos/asf/syncope/blob/65d652af/core/workflow-activiti/src/main/java/org/apache/syncope/core/workflow/activiti/SyncopeUserManager.java
----------------------------------------------------------------------
diff --git a/core/workflow-activiti/src/main/java/org/apache/syncope/core/workflow/activiti/SyncopeUserManager.java b/core/workflow-activiti/src/main/java/org/apache/syncope/core/workflow/activiti/SyncopeUserManager.java
index 7112967..72be4e3 100644
--- a/core/workflow-activiti/src/main/java/org/apache/syncope/core/workflow/activiti/SyncopeUserManager.java
+++ b/core/workflow-activiti/src/main/java/org/apache/syncope/core/workflow/activiti/SyncopeUserManager.java
@@ -32,7 +32,6 @@ import org.activiti.engine.impl.persistence.entity.GroupEntity;
 import org.activiti.engine.impl.persistence.entity.IdentityInfoEntity;
 import org.activiti.engine.impl.persistence.entity.UserEntity;
 import org.activiti.engine.impl.persistence.entity.UserIdentityManager;
-import org.apache.syncope.core.persistence.api.dao.EntitlementDAO;
 import org.apache.syncope.core.persistence.api.dao.GroupDAO;
 import org.apache.syncope.core.persistence.api.dao.UserDAO;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -45,9 +44,6 @@ public class SyncopeUserManager implements UserIdentityManager, SyncopeSession {
     @Autowired
     private GroupDAO groupDAO;
 
-    @Autowired
-    private EntitlementDAO entitlementDAO;
-
     @Override
     public Class<?> getType() {
         return UserIdentityManager.class;
@@ -65,7 +61,7 @@ public class SyncopeUserManager implements UserIdentityManager, SyncopeSession {
 
     @Override
     public UserQuery createNewUserQuery() {
-        return new SyncopeUserQueryImpl(userDAO, groupDAO, entitlementDAO);
+        return new SyncopeUserQueryImpl(userDAO, groupDAO);
     }
 
     @Override

http://git-wip-us.apache.org/repos/asf/syncope/blob/65d652af/core/workflow-activiti/src/main/java/org/apache/syncope/core/workflow/activiti/SyncopeUserQueryImpl.java
----------------------------------------------------------------------
diff --git a/core/workflow-activiti/src/main/java/org/apache/syncope/core/workflow/activiti/SyncopeUserQueryImpl.java b/core/workflow-activiti/src/main/java/org/apache/syncope/core/workflow/activiti/SyncopeUserQueryImpl.java
index 43b0306..2f46cbd 100644
--- a/core/workflow-activiti/src/main/java/org/apache/syncope/core/workflow/activiti/SyncopeUserQueryImpl.java
+++ b/core/workflow-activiti/src/main/java/org/apache/syncope/core/workflow/activiti/SyncopeUserQueryImpl.java
@@ -25,8 +25,9 @@ import org.activiti.engine.ActivitiException;
 import org.activiti.engine.identity.User;
 import org.activiti.engine.identity.UserQuery;
 import org.activiti.engine.impl.persistence.entity.UserEntity;
-import org.apache.syncope.core.persistence.api.GroupEntitlementUtil;
-import org.apache.syncope.core.persistence.api.dao.EntitlementDAO;
+import org.apache.commons.collections4.CollectionUtils;
+import org.apache.commons.collections4.Transformer;
+import org.apache.syncope.common.lib.SyncopeConstants;
 import org.apache.syncope.core.persistence.api.dao.GroupDAO;
 import org.apache.syncope.core.persistence.api.dao.UserDAO;
 import org.apache.syncope.core.persistence.api.entity.membership.Membership;
@@ -38,18 +39,15 @@ public class SyncopeUserQueryImpl implements UserQuery {
 
     private GroupDAO groupDAO;
 
-    private EntitlementDAO entitlementDAO;
-
     private String username;
 
     private Long memberOf;
 
     private List<User> result;
 
-    public SyncopeUserQueryImpl(final UserDAO userDAO, final GroupDAO groupDAO, final EntitlementDAO entitlementDAO) {
+    public SyncopeUserQueryImpl(final UserDAO userDAO, final GroupDAO groupDAO) {
         this.userDAO = userDAO;
         this.groupDAO = groupDAO;
-        this.entitlementDAO = entitlementDAO;
     }
 
     @Override
@@ -165,13 +163,17 @@ public class SyncopeUserQueryImpl implements UserQuery {
         }
         // THIS CAN BE *VERY* DANGEROUS
         if (result == null) {
-            result = new ArrayList<>();
+            result = CollectionUtils.collect(
+                    userDAO.findAll(SyncopeConstants.FULL_ADMIN_REALMS, page, itemsPerPage),
+                    new Transformer<org.apache.syncope.core.persistence.api.entity.user.User, User>() {
 
-            List<org.apache.syncope.core.persistence.api.entity.user.User> users =
-                    userDAO.findAll(GroupEntitlementUtil.getGroupKeys(entitlementDAO.findAll()), page, itemsPerPage);
-            for (org.apache.syncope.core.persistence.api.entity.user.User user : users) {
-                result.add(fromSyncopeUser(user));
-            }
+                        @Override
+                        public User transform(final org.apache.syncope.core.persistence.api.entity.user.User user) {
+                            return fromSyncopeUser(user);
+                        }
+
+                    },
+                    new ArrayList<User>());
         }
     }
 

http://git-wip-us.apache.org/repos/asf/syncope/blob/65d652af/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/UserWorkflowAdapter.java
----------------------------------------------------------------------
diff --git a/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/UserWorkflowAdapter.java b/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/UserWorkflowAdapter.java
index f91b83f..0d7c86a 100644
--- a/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/UserWorkflowAdapter.java
+++ b/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/UserWorkflowAdapter.java
@@ -18,8 +18,8 @@
  */
 package org.apache.syncope.core.workflow.api;
 
+import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.core.provisioning.api.WorkflowResult;
-import java.util.Map;
 import org.apache.syncope.common.lib.mod.UserMod;
 import org.apache.syncope.common.lib.to.UserTO;
 import org.apache.syncope.core.persistence.api.entity.user.User;
@@ -36,7 +36,7 @@ public interface UserWorkflowAdapter extends WorkflowAdapter {
      * @param storePassword whether password shall be stored into the internal storage
      * @return user just created
      */
-    WorkflowResult<Map.Entry<Long, Boolean>> create(UserTO userTO, boolean storePassword);
+    WorkflowResult<Pair<Long, Boolean>> create(UserTO userTO, boolean storePassword);
 
     /**
      * Create an user, optionally disabling password policy check.
@@ -46,7 +46,7 @@ public interface UserWorkflowAdapter extends WorkflowAdapter {
      * @param storePassword whether password shall be stored into the internal storage
      * @return user just created
      */
-    WorkflowResult<Map.Entry<Long, Boolean>> create(
+    WorkflowResult<Pair<Long, Boolean>> create(
             UserTO userTO, boolean disablePwdPolicyCheck, boolean storePassword);
 
     /**
@@ -58,7 +58,7 @@ public interface UserWorkflowAdapter extends WorkflowAdapter {
      * @param storePassword whether password shall be stored into the internal storage
      * @return user just created
      */
-    WorkflowResult<Map.Entry<Long, Boolean>> create(
+    WorkflowResult<Pair<Long, Boolean>> create(
             UserTO userTO, boolean disablePwdPolicyCheck, final Boolean enabled, boolean storePassword);
 
     /**
@@ -85,7 +85,7 @@ public interface UserWorkflowAdapter extends WorkflowAdapter {
      * @param userMod modification set to be performed
      * @return user just updated and propagations to be performed
      */
-    WorkflowResult<Map.Entry<UserMod, Boolean>> update(UserMod userMod);
+    WorkflowResult<Pair<UserMod, Boolean>> update(UserMod userMod);
 
     /**
      * Suspend an user.

http://git-wip-us.apache.org/repos/asf/syncope/blob/65d652af/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractUserWorkflowAdapter.java
----------------------------------------------------------------------
diff --git a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractUserWorkflowAdapter.java b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractUserWorkflowAdapter.java
index c37d8b2..cc27a4b 100644
--- a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractUserWorkflowAdapter.java
+++ b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractUserWorkflowAdapter.java
@@ -18,7 +18,7 @@
  */
 package org.apache.syncope.core.workflow.java;
 
-import java.util.Map;
+import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.lib.mod.UserMod;
 import org.apache.syncope.core.persistence.api.dao.UserDAO;
 import org.apache.syncope.core.persistence.api.entity.EntityFactory;
@@ -68,11 +68,11 @@ public abstract class AbstractUserWorkflowAdapter implements UserWorkflowAdapter
         return doActivate(userDAO.authFetch(userKey), token);
     }
 
-    protected abstract WorkflowResult<Map.Entry<UserMod, Boolean>> doUpdate(User user, UserMod userMod)
+    protected abstract WorkflowResult<Pair<UserMod, Boolean>> doUpdate(User user, UserMod userMod)
             throws WorkflowException;
 
     @Override
-    public WorkflowResult<Map.Entry<UserMod, Boolean>> update(final UserMod userMod)
+    public WorkflowResult<Pair<UserMod, Boolean>> update(final UserMod userMod)
             throws WorkflowException {
 
         return doUpdate(userDAO.authFetch(userMod.getKey()), userMod);

http://git-wip-us.apache.org/repos/asf/syncope/blob/65d652af/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java
----------------------------------------------------------------------
diff --git a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java
index 1db511b..7b92490 100644
--- a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java
+++ b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java
@@ -19,12 +19,11 @@
 package org.apache.syncope.core.workflow.java;
 
 import java.io.OutputStream;
-import java.util.AbstractMap;
-import java.util.AbstractMap.SimpleEntry;
 import java.util.Collections;
 import java.util.List;
-import java.util.Map;
 import org.apache.commons.lang3.SerializationUtils;
+import org.apache.commons.lang3.tuple.ImmutablePair;
+import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.lib.mod.UserMod;
 import org.apache.syncope.common.lib.to.UserTO;
 import org.apache.syncope.common.lib.to.WorkflowFormTO;
@@ -49,21 +48,21 @@ public class DefaultUserWorkflowAdapter extends AbstractUserWorkflowAdapter {
     private ConfDAO confDAO;
 
     @Override
-    public WorkflowResult<Map.Entry<Long, Boolean>> create(UserTO userTO, boolean storePassword)
+    public WorkflowResult<Pair<Long, Boolean>> create(UserTO userTO, boolean storePassword)
             throws WorkflowException {
 
         return create(userTO, false, true);
     }
 
     @Override
-    public WorkflowResult<Map.Entry<Long, Boolean>> create(final UserTO userTO, final boolean disablePwdPolicyCheck,
+    public WorkflowResult<Pair<Long, Boolean>> create(final UserTO userTO, final boolean disablePwdPolicyCheck,
             final boolean storePassword) throws WorkflowException {
 
         return create(userTO, disablePwdPolicyCheck, null, storePassword);
     }
 
     @Override
-    public WorkflowResult<Map.Entry<Long, Boolean>> create(final UserTO userTO, final boolean disablePwdPolicyCheck,
+    public WorkflowResult<Pair<Long, Boolean>> create(final UserTO userTO, final boolean disablePwdPolicyCheck,
             final Boolean enabled, final boolean storePassword) throws WorkflowException {
 
         User user = entityFactory.newEntity(User.class);
@@ -93,8 +92,8 @@ public class DefaultUserWorkflowAdapter extends AbstractUserWorkflowAdapter {
         final PropagationByResource propByRes = new PropagationByResource();
         propByRes.set(ResourceOperation.CREATE, user.getResourceNames());
 
-        return new WorkflowResult<Map.Entry<Long, Boolean>>(
-                new SimpleEntry<>(user.getKey(), propagateEnable), propByRes, "create");
+        return new WorkflowResult<Pair<Long, Boolean>>(
+                new ImmutablePair<>(user.getKey(), propagateEnable), propByRes, "create");
     }
 
     @Override
@@ -113,7 +112,7 @@ public class DefaultUserWorkflowAdapter extends AbstractUserWorkflowAdapter {
     }
 
     @Override
-    protected WorkflowResult<Map.Entry<UserMod, Boolean>> doUpdate(final User user, final UserMod userMod)
+    protected WorkflowResult<Pair<UserMod, Boolean>> doUpdate(final User user, final UserMod userMod)
             throws WorkflowException {
 
         // update password internally only if required
@@ -127,8 +126,8 @@ public class DefaultUserWorkflowAdapter extends AbstractUserWorkflowAdapter {
         User updated = userDAO.save(user);
 
         userMod.setKey(updated.getKey());
-        return new WorkflowResult<Map.Entry<UserMod, Boolean>>(
-                new AbstractMap.SimpleEntry<>(userMod, !user.isSuspended()), propByRes, "update");
+        return new WorkflowResult<Pair<UserMod, Boolean>>(
+                new ImmutablePair<>(userMod, !user.isSuspended()), propByRes, "update");
     }
 
     @Override

http://git-wip-us.apache.org/repos/asf/syncope/blob/65d652af/ext/camel/logic/src/main/java/org/apache/syncope/core/logic/init/CamelRouteLoader.java
----------------------------------------------------------------------
diff --git a/ext/camel/logic/src/main/java/org/apache/syncope/core/logic/init/CamelRouteLoader.java b/ext/camel/logic/src/main/java/org/apache/syncope/core/logic/init/CamelRouteLoader.java
index 3fe8592..8134eb0 100644
--- a/ext/camel/logic/src/main/java/org/apache/syncope/core/logic/init/CamelRouteLoader.java
+++ b/ext/camel/logic/src/main/java/org/apache/syncope/core/logic/init/CamelRouteLoader.java
@@ -75,7 +75,6 @@ public class CamelRouteLoader implements SyncopeLoader {
             if (!loaded) {
                 loadRoutes(userRoutesLoader.getResource(), SubjectType.USER);
                 loadRoutes(groupRoutesLoader.getResource(), SubjectType.GROUP);
-                loadEntitlements();
                 loaded = true;
             }
         }
@@ -137,31 +136,4 @@ public class CamelRouteLoader implements SyncopeLoader {
             }
         }
     }
-
-    private void loadEntitlements() {
-        final JdbcTemplate jdbcTemplate = new JdbcTemplate(dataSource);
-
-        boolean existingData;
-        try {
-            existingData = jdbcTemplate.queryForObject(
-                    "SELECT COUNT(0) FROM Entitlement WHERE NAME LIKE 'ROUTE_%'", Integer.class) > 0;
-        } catch (DataAccessException e) {
-            LOG.error("Could not access to Entitlement table", e);
-            existingData = true;
-        }
-
-        if (existingData) {
-            LOG.info("Camel route entitlements found in the database, leaving untouched");
-        } else {
-            LOG.info("No Camel route entitlements found in the database, loading");
-
-            try {
-                jdbcTemplate.update("INSERT INTO Entitlement(NAME) VALUES('ROUTE_READ')");
-                jdbcTemplate.update("INSERT INTO Entitlement(NAME) VALUES('ROUTE_LIST')");
-                jdbcTemplate.update("INSERT INTO Entitlement(NAME) VALUES('ROUTE_UPDATE')");
-            } catch (Exception e) {
-                LOG.error("While adding additional entitlements", e);
-            }
-        }
-    }
 }

http://git-wip-us.apache.org/repos/asf/syncope/blob/65d652af/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelGroupProvisioningManager.java
----------------------------------------------------------------------
diff --git a/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelGroupProvisioningManager.java b/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelGroupProvisioningManager.java
index 8ab600a..13a69a1 100644
--- a/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelGroupProvisioningManager.java
+++ b/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelGroupProvisioningManager.java
@@ -26,6 +26,7 @@ import java.util.Map;
 import java.util.Set;
 import org.apache.camel.Exchange;
 import org.apache.camel.PollingConsumer;
+import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.lib.mod.GroupMod;
 import org.apache.syncope.common.lib.to.PropagationStatus;
 import org.apache.syncope.common.lib.to.GroupTO;
@@ -36,13 +37,13 @@ public class CamelGroupProvisioningManager
         extends AbstractCamelProvisioningManager implements GroupProvisioningManager {
 
     @Override
-    public Map.Entry<Long, List<PropagationStatus>> create(final GroupTO subject) {
+    public Pair<Long, List<PropagationStatus>> create(final GroupTO subject) {
         return create(subject, Collections.<String>emptySet());
     }
 
     @Override
     @SuppressWarnings("unchecked")
-    public Map.Entry<Long, List<PropagationStatus>> create(final GroupTO groupTO, final Set<String> excludedResources) {
+    public Pair<Long, List<PropagationStatus>> create(final GroupTO groupTO, final Set<String> excludedResources) {
         PollingConsumer pollingConsumer = getConsumer("direct:createGroupPort");
 
         Map<String, Object> props = new HashMap<>();
@@ -56,12 +57,12 @@ public class CamelGroupProvisioningManager
             throw (RuntimeException) exchange.getProperty(Exchange.EXCEPTION_CAUGHT);
         }
 
-        return exchange.getIn().getBody(Map.Entry.class);
+        return exchange.getIn().getBody(Pair.class);
     }
 
     @Override
     @SuppressWarnings("unchecked")
-    public Map.Entry<Long, List<PropagationStatus>> create(final GroupTO groupTO, final Map<Long, String> groupOwnerMap,
+    public Pair<Long, List<PropagationStatus>> create(final GroupTO groupTO, final Map<Long, String> groupOwnerMap,
             final Set<String> excludedResources) throws PropagationException {
 
         PollingConsumer pollingConsumer = getConsumer("direct:createGroupInSyncPort");
@@ -78,17 +79,17 @@ public class CamelGroupProvisioningManager
             throw (RuntimeException) exchange.getProperty(Exchange.EXCEPTION_CAUGHT);
         }
 
-        return exchange.getIn().getBody(Map.Entry.class);
+        return exchange.getIn().getBody(Pair.class);
     }
 
     @Override
-    public Map.Entry<Long, List<PropagationStatus>> update(final GroupMod subjectMod) {
+    public Pair<Long, List<PropagationStatus>> update(final GroupMod subjectMod) {
         return update(subjectMod, Collections.<String>emptySet());
     }
 
     @Override
     @SuppressWarnings("unchecked")
-    public Map.Entry<Long, List<PropagationStatus>> update(
+    public Pair<Long, List<PropagationStatus>> update(
             final GroupMod subjectMod, final Set<String> excludedResources) {
 
         PollingConsumer pollingConsumer = getConsumer("direct:updateGroupPort");
@@ -104,7 +105,7 @@ public class CamelGroupProvisioningManager
             throw (RuntimeException) exchange.getProperty(Exchange.EXCEPTION_CAUGHT);
         }
 
-        return exchange.getIn().getBody(Map.Entry.class);
+        return exchange.getIn().getBody(Pair.class);
     }
 
     @Override

http://git-wip-us.apache.org/repos/asf/syncope/blob/65d652af/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelUserProvisioningManager.java
----------------------------------------------------------------------
diff --git a/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelUserProvisioningManager.java b/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelUserProvisioningManager.java
index c182c57..f8b076a 100644
--- a/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelUserProvisioningManager.java
+++ b/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/CamelUserProvisioningManager.java
@@ -18,7 +18,6 @@
  */
 package org.apache.syncope.core.provisioning.camel;
 
-import java.util.AbstractMap;
 import java.util.Collection;
 import java.util.Collections;
 import java.util.HashMap;
@@ -28,6 +27,8 @@ import java.util.Map;
 import java.util.Set;
 import org.apache.camel.Exchange;
 import org.apache.camel.PollingConsumer;
+import org.apache.commons.lang3.tuple.ImmutablePair;
+import org.apache.commons.lang3.tuple.Pair;
 import org.apache.syncope.common.lib.mod.StatusMod;
 import org.apache.syncope.common.lib.mod.UserMod;
 import org.apache.syncope.common.lib.to.PropagationStatus;
@@ -45,18 +46,18 @@ public class CamelUserProvisioningManager extends AbstractCamelProvisioningManag
     private static final Logger LOG = LoggerFactory.getLogger(CamelUserProvisioningManager.class);
 
     @Override
-    public Map.Entry<Long, List<PropagationStatus>> create(final UserTO userTO) {
+    public Pair<Long, List<PropagationStatus>> create(final UserTO userTO) {
         return create(userTO, true, false, null, Collections.<String>emptySet());
     }
 
     @Override
-    public Map.Entry<Long, List<PropagationStatus>> create(final UserTO userTO, boolean storePassword) {
+    public Pair<Long, List<PropagationStatus>> create(final UserTO userTO, boolean storePassword) {
         return create(userTO, storePassword, false, null, Collections.<String>emptySet());
     }
 
     @Override
     @SuppressWarnings("unchecked")
-    public Map.Entry<Long, List<PropagationStatus>> create(final UserTO userTO, final boolean storePassword,
+    public Pair<Long, List<PropagationStatus>> create(final UserTO userTO, final boolean storePassword,
             boolean disablePwdPolicyCheck, Boolean enabled, Set<String> excludedResources) {
 
         PollingConsumer pollingConsumer = getConsumer("direct:createPort");
@@ -75,17 +76,17 @@ public class CamelUserProvisioningManager extends AbstractCamelProvisioningManag
             throw (RuntimeException) exchange.getProperty(Exchange.EXCEPTION_CAUGHT);
         }
 
-        return exchange.getIn().getBody(Map.Entry.class);
+        return exchange.getIn().getBody(Pair.class);
     }
 
     @Override
-    public Map.Entry<Long, List<PropagationStatus>> update(final UserMod userMod) {
+    public Pair<Long, List<PropagationStatus>> update(final UserMod userMod) {
         return update(userMod, false);
     }
 
     @Override
     @SuppressWarnings("unchecked")
-    public Map.Entry<Long, List<PropagationStatus>> update(UserMod userMod, boolean removeMemberships) {
+    public Pair<Long, List<PropagationStatus>> update(UserMod userMod, boolean removeMemberships) {
         PollingConsumer pollingConsumer = getConsumer("direct:updatePort");
 
         Map<String, Object> props = new HashMap<>();
@@ -99,7 +100,7 @@ public class CamelUserProvisioningManager extends AbstractCamelProvisioningManag
             throw (RuntimeException) exchange.getProperty(Exchange.EXCEPTION_CAUGHT);
         }
 
-        return exchange.getIn().getBody(Map.Entry.class);
+        return exchange.getIn().getBody(Pair.class);
     }
 
     @Override
@@ -144,7 +145,7 @@ public class CamelUserProvisioningManager extends AbstractCamelProvisioningManag
 
     @Override
     @SuppressWarnings("unchecked")
-    public Map.Entry<Long, List<PropagationStatus>> activate(final User user, final StatusMod statusMod) {
+    public Pair<Long, List<PropagationStatus>> activate(final User user, final StatusMod statusMod) {
         PollingConsumer pollingConsumer = getConsumer("direct:statusPort");
 
         Map<String, Object> props = new HashMap<>();
@@ -166,12 +167,12 @@ public class CamelUserProvisioningManager extends AbstractCamelProvisioningManag
             throw (RuntimeException) exchange.getProperty(Exchange.EXCEPTION_CAUGHT);
         }
 
-        return exchange.getIn().getBody(Map.Entry.class);
+        return exchange.getIn().getBody(Pair.class);
     }
 
     @Override
     @SuppressWarnings("unchecked")
-    public Map.Entry<Long, List<PropagationStatus>> reactivate(final User user, final StatusMod statusMod) {
+    public Pair<Long, List<PropagationStatus>> reactivate(final User user, final StatusMod statusMod) {
         PollingConsumer pollingConsumer = getConsumer("direct:statusPort");
 
         Map<String, Object> props = new HashMap<>();
@@ -192,12 +193,12 @@ public class CamelUserProvisioningManager extends AbstractCamelProvisioningManag
             throw (RuntimeException) exchange.getProperty(Exchange.EXCEPTION_CAUGHT);
         }
 
-        return exchange.getIn().getBody(Map.Entry.class);
+        return exchange.getIn().getBody(Pair.class);
     }
 
     @Override
     @SuppressWarnings("unchecked")
-    public Map.Entry<Long, List<PropagationStatus>> suspend(final User user, final StatusMod statusMod) {
+    public Pair<Long, List<PropagationStatus>> suspend(final User user, final StatusMod statusMod) {
         PollingConsumer pollingConsumer = getConsumer("direct:statusPort");
 
         Map<String, Object> props = new HashMap<>();
@@ -218,7 +219,7 @@ public class CamelUserProvisioningManager extends AbstractCamelProvisioningManag
             throw (RuntimeException) exchange.getProperty(Exchange.EXCEPTION_CAUGHT);
         }
 
-        return exchange.getIn().getBody(Map.Entry.class);
+        return exchange.getIn().getBody(Pair.class);
     }
 
     @Override
@@ -258,7 +259,7 @@ public class CamelUserProvisioningManager extends AbstractCamelProvisioningManag
 
     @Override
     @SuppressWarnings("unchecked")
-    public Map.Entry<Long, List<PropagationStatus>> update(
+    public Pair<Long, List<PropagationStatus>> update(
             final UserMod userMod, final Long key, final ProvisioningResult result,
             final Boolean enabled, final Set<String> excludedResources) {
 
@@ -281,14 +282,14 @@ public class CamelUserProvisioningManager extends AbstractCamelProvisioningManag
             result.setStatus(ProvisioningResult.Status.FAILURE);
             result.setMessage("Update failed, trying to sync status anyway (if configured)\n" + e.getMessage());
 
-            WorkflowResult<Map.Entry<UserMod, Boolean>> updated = new WorkflowResult<Map.Entry<UserMod, Boolean>>(
-                    new AbstractMap.SimpleEntry<>(userMod, false), new PropagationByResource(),
+            WorkflowResult<Pair<UserMod, Boolean>> updated = new WorkflowResult<Pair<UserMod, Boolean>>(
+                    new ImmutablePair<>(userMod, false), new PropagationByResource(),
                     new HashSet<String>());
             sendMessage("direct:userInSync", updated, props);
             exchange = pollingConsumer.receive();
         }
 
-        return exchange.getIn().getBody(Map.Entry.class);
+        return exchange.getIn().getBody(Pair.class);
     }
 
     @Override

http://git-wip-us.apache.org/repos/asf/syncope/blob/65d652af/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/processor/GroupCreateInSyncProcessor.java
----------------------------------------------------------------------
diff --git a/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/processor/GroupCreateInSyncProcessor.java b/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/processor/GroupCreateInSyncProcessor.java
index 97a2783..a22f2eb 100644
--- a/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/processor/GroupCreateInSyncProcessor.java
+++ b/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/processor/GroupCreateInSyncProcessor.java
@@ -18,7 +18,6 @@ package org.apache.syncope.core.provisioning.camel.processor;
  * specific language governing permissions and limitations
  * under the License.
  */
-import java.util.AbstractMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
@@ -26,10 +25,9 @@ import org.apache.camel.Exchange;
 import org.apache.camel.Processor;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.apache.commons.lang3.StringUtils;
+import org.apache.commons.lang3.tuple.ImmutablePair;
 import org.apache.syncope.common.lib.to.AttrTO;
 import org.apache.syncope.common.lib.to.GroupTO;
-import org.apache.syncope.core.misc.security.AuthContextUtil;
-import org.apache.syncope.core.persistence.api.GroupEntitlementUtil;
 import org.apache.syncope.core.persistence.api.entity.task.PropagationTask;
 import org.apache.syncope.core.provisioning.api.WorkflowResult;
 import org.apache.syncope.core.provisioning.api.propagation.PropagationManager;
@@ -52,21 +50,18 @@ public class GroupCreateInSyncProcessor implements Processor {
 
         GroupTO actual = exchange.getProperty("subject", GroupTO.class);
         Map<Long, String> groupOwnerMap = exchange.getProperty("groupOwnerMap", Map.class);
-        Set<String> excludedResource = exchange.getProperty("excludedResources", Set.class);
+        Set<String> excludedResources = exchange.getProperty("excludedResources", Set.class);
 
         AttrTO groupOwner = actual.getPlainAttrMap().get(StringUtils.EMPTY);
         if (groupOwner != null) {
             groupOwnerMap.put(created.getResult(), groupOwner.getValues().iterator().next());
         }
 
-        AuthContextUtil.extendAuthContext(
-                created.getResult(), GroupEntitlementUtil.getEntitlementNameFromGroupKey(created.getResult()));
-
-        List<PropagationTask> tasks = propagationManager.getGroupCreateTaskIds(
-                created, actual.getVirAttrs(), excludedResource);
+        List<PropagationTask> tasks = propagationManager.getGroupCreateTasks(
+                created, actual.getVirAttrs(), excludedResources);
 
         taskExecutor.execute(tasks);
 
-        exchange.getOut().setBody(new AbstractMap.SimpleEntry<>(created.getResult(), null));
+        exchange.getOut().setBody(new ImmutablePair<>(created.getResult(), null));
     }
 }

http://git-wip-us.apache.org/repos/asf/syncope/blob/65d652af/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/processor/GroupCreateProcessor.java
----------------------------------------------------------------------
diff --git a/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/processor/GroupCreateProcessor.java b/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/processor/GroupCreateProcessor.java
index 239e209..6805a5e 100644
--- a/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/processor/GroupCreateProcessor.java
+++ b/ext/camel/provisioning-camel/src/main/java/org/apache/syncope/core/provisioning/camel/processor/GroupCreateProcessor.java
@@ -18,15 +18,13 @@
  */
 package org.apache.syncope.core.provisioning.camel.processor;
 
-import java.util.AbstractMap;
 import java.util.List;
 import java.util.Set;
 import org.apache.camel.Exchange;
 import org.apache.camel.Processor;
+import org.apache.commons.lang3.tuple.ImmutablePair;
 import org.apache.syncope.common.lib.to.GroupTO;
-import org.apache.syncope.core.misc.security.AuthContextUtil;
 import org.apache.syncope.core.misc.spring.ApplicationContextProvider;
-import org.apache.syncope.core.persistence.api.GroupEntitlementUtil;
 import org.apache.syncope.core.persistence.api.entity.task.PropagationTask;
 import org.apache.syncope.core.provisioning.api.WorkflowResult;
 import org.apache.syncope.core.provisioning.api.propagation.PropagationException;
@@ -56,10 +54,8 @@ public class GroupCreateProcessor implements Processor {
         GroupTO subject = exchange.getProperty("subject", GroupTO.class);
         Set<String> excludedResource = exchange.getProperty("excludedResources", Set.class);
 
-        AuthContextUtil.extendAuthContext(created.getResult(), GroupEntitlementUtil.getEntitlementNameFromGroupKey(created.getResult()));
-
         List<PropagationTask> tasks =
-                propagationManager.getGroupCreateTaskIds(created, subject.getVirAttrs(), excludedResource);
+                propagationManager.getGroupCreateTasks(created, subject.getVirAttrs(), excludedResource);
         PropagationReporter propagationReporter =
                 ApplicationContextProvider.getApplicationContext().getBean(PropagationReporter.class);
         try {
@@ -69,7 +65,7 @@ public class GroupCreateProcessor implements Processor {
             propagationReporter.onPrimaryResourceFailure(tasks);
         }
 
-        exchange.getOut().setBody(new AbstractMap.SimpleEntry<>(
+        exchange.getOut().setBody(new ImmutablePair<>(
                 created.getResult(), propagationReporter.getStatuses()));
     }