OPENIDM-4820 - updating to forgerock-ui 10.0.4 and fixing various validation bugs

OPENIDM-4685 - Using policy service to validate self-service pages

Updates to use forgerock-ui 8.6.0 and forgerock-selfservice * Includes forgotten username process in admin and enduser UI * Aligns contractor sample with userQuery stage, and account for double-quotes in userNames passed to queryFilters * Updates self-service examples * Support for updating kba questions as part of self-service profile * Bug with update logic in router-authz * Support for locales in email

[OPENIDM-4588] Fixed bug with managed object policies.

[OPENIDM-4199] Added support for conditional policies with optional dependencies and fallback policies.

OPENIDM-4289 - Aligns workflow sample with relationships (authzRoles and manager) and refactoring and cleanup of contractorOnBoarding workflow Uses selfservice reset to set the new contractor's password.

OPENIDM-4287 - Updates workflow endpoints to use current user's security context

OPENIDM-3559 - Moving policy details for managed objects into json schema Adjusting authz rules for self-service requests (taking CSS-28 into account) Including kbaInfo in default user schema Progress with adding new properties to json editor for managed objects Aligning the Admin UI and authz rules with backend, removing default configs Using external/email endpoint in access.js authz rule

CHF-68 and CHF-69: move Context, SecurityContext, and AbstractRouter to services package

Replaces request.resourceName with request.resourcePath in scripts

OPENIDM-3223 CR-7161 Implement policy to prevent duplicate Managed User role assignments

OPENIDM-2708 CR-5735 Fix issue whereby a create of a managed object within an explicit table returns the resulting JSON object with an invalid (qualified) id instead of the expected unqualified id. Also switched to using queryFilter within policy.js instead of invoking the legacy get-by-field-value query which does not have a functional version for explicit tables.

OPENIDM-2079 : CR-4125. Checked in the changes for Chad.There are places in the policy.js script where it is expecting request.resourceName to not be encoded so that the resourceId can be extracted from it. Issue addressed by making ResourceName object available to scripts and logic was updated in policy.js to use ResourceName.leaf() to get the decoded resourceId.

OPENIDM-1735 / OPENIDM-1134 (CR-3503) Provide additional detail on sync failures from managed object CRUD operations. Provide example compensation script to compensate for sync failures.

CR-3300 - OPENIDM-1748 Confusing policy validation display for passwords in the UI Updating several of the policy functions to check to see if the "REQUIRED" requirement has been specified, using a sort of policy function "chaining" mechanism.

http://sources.forgerock.org/cru/CR-3209 - OpenIDM various policy validation clean-up

http://sources.forgerock.org/cru/CR-3109 - IDME-49: Fix additional reauth errors Also an update to http://sources.forgerock.org/cru/FR-89 to better support checking the array container

IDME-122 (CR-3057) Revert changes to use current contet in policyFilter, but instead use special parameter to trigger reauth policy when necessary (patch operation).

IDME-127 (CR-3047) Enhance isEncrypted to return false on null or undefined arguments so javascript doesn't have to precheck arguments.

https://bugster.forgerock.org/jira/browse/IDME-127 - ReAuthentication fails with error in policy.js about isEncrypted function Also, http://sources.forgerock.org/cru/FR-89 - Support for policies on array elements

IDME-122 (CR-3020) The type is now boolean, and we do not need the extra local variable.

IDME-122 (CR-3020) Align internal context changes from CREST-142/IDME-121/IDME-123 Reverts part of r2848 to allow policy service _validateObject action from policyFilter.js to be viewed "external" without extra param hook.

Fix for reauth policy when patching managed objects

Bulk update to update to forgerock-rest-2.2.1 and forgerock-script-1.1.1 in order to resolve CREST-138 - UpdateRequest#getNewContent -> UpdateRequest#getContent CREST-139 - ActionRequest#getAdditionalActionParameters -> ActionRequest#getAdditionalParamters QueryRequest#getAdditionalQueryParameters -> QueryRequest#getAdditionalParamters OPENIDM-1617 - revert request member "method" back to "type" and use lowercase values IDME-72 - Allow javascript to set element at variable[0]

Fixes for "reauthenticate" not working from policy script.

Update javascript to use new request/context bindings. Retool PolicyService to pass CREST Request objects on through rather than build custom maps (for the old javacript)

Fixed an issue where a read on openidm/policy was not correctly returning the configured policies.

Cleaned up some debug messages.

Policy service and script updates to get actions and reads working.

Reverting r2048 - change was mistakenly made, I was confused by configuration options.

https://bugster.forgerock.org/jira/browse/OPENIDM-1256 - additionalPolicies option in policy.json not working http://sources.forgerock.org/cru/CR-1436

[OPENIDM-1247][CR-1385] Added null check before validation call when executing the validateProperty action.

http://sources.forgerock.org/cru/CR-1237 - bugs from JSLint refactoring Resolves: https://bugster.forgerock.org/jira/browse/OPENIDM-1150 https://bugster.forgerock.org/jira/browse/OPENIDM-1149

Fixing bug with policy.js which was missing the case where managed objects were configured without specifying any properties.

Using JSLint to validate server-side JavaScript code as part of the maven build process. Updates to server-side JavaScript to pass JSLint validation rules. http://sources.forgerock.org/cru/CR-1175

http://sources.forgerock.org/cru/CR-1157 - Commons UI: Updating patch actions to try using add when replace fails These changes allow for the possibility of a non-existent password property on the managed/user object as a valid state. This could arise when, for example, a record was create via recon from a source system which doesn't expose a cleartext password. Code changes to policy and onCreate script to make this more sensible, and within the UI code to do an "add"-type of patch rather than a "replace" patch (which would fail, since the property doesn't exist).

merging trunk 1773-1783

[OPENIDM-1036] Reworked and moved exceptRoles logic to its own function and cleaned up the usage, also created a getSecurityContext function for finding the security context.

merging trunk r1735-1772

https://bugster.forgerock.org/jira/browse/OPENIDM-1031 - Username can be exploited with arbitrary HTML code http://sources.forgerock.org/cru/CR-1073 - OpenIDM - prevent embedded HTML from rendering in the UI

New sample workflow: http://sources.forgerock.org/cru/CR-1055 Also included is an update to most recent changes to policy.js, fixing issue discovered with workflow testing.

OpenIDM Fix reauth policy to not fail when value has not changed http://sources.forgerock.org/cru/CR-1057 Calls to patch were failing now that validation is properly being applied to patch calls. The failure was due to the fact that the whole object was being validated, and some properties in the object were requiring reauth. So even if you were not changing a property which required reauth, the reauth validation rule was being raised. This fixed the problem by not raising the failure if the value being evaluated is the same as the current value for the object. https://bugster.forgerock.org/jira/browse/OPENIDM-1011

[OPENIDM-990] Fixed bug in re-authentication policy function and added a new "_isDirectHttp" flag to indicate an "http" request type.

Merging trunk r1688-1715

[OPENIDM-984] Fixed code in the mergePolicies() function that was causing configs in manage.json to overwrite configs in policy.json.

merging ui branch r1634-1654 Using new validateOnlyIfPresent flag to solve https://bugster.forgerock.org/jira/browse/OPENIDM-934 Modifying apache configuration to reverse proxy for all requests to openidm/ rather than just to openidm/managed misc trivial cleanup

Reverting "checkIfRequiredApplies" in favor of "validateOnlyIfPresent" Deleting unnecessary hard-coded addition of properties in admin user create screen

Changes to policy code to use new "context" idea

[OPENIDM-938] Added "validateOnlyIfPresent" option to the policy configurations.

OPENIDM-937 Fix null check for value

[OPENIDM-937] Added a null check on when traversing parent requests in the requiredIfConfigured policy function.

Merging trunk r1582-1607 http://sources.forgerock.org/cru/CR-912 Tag, you're it QA!

Fixing requiredIfConfigured to no longer use _caller attribute of request, since this appears to not work any more?

Merging trunk r1596-1602

[OPENIDM-904] Added an addPolicy() function to the policy.js script for supporting the adding of policy configs (from custom policy scripts) without modifying the policy.js file.

Reverting change made in r1584, improving check for internal user conflict

removed @license from licenses, changed © to (c)

Fixing policy to look for security context more flexibly; necessary now that we are using POST+_action=patch, as apparently this builds a different structure than simply PATCH

Removing extraneous values leftover from copy/paste

Adding policy to prevent managed users from having the same names as internal users

Moving scripts to bin/defaults and updating references in conf