8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * Copyright (c) 2005 Sun Microsystems Inc. All Rights Reserved
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * The contents of this file are subject to the terms
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * of the Common Development and Distribution License
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * (the License). You may not use this file except in
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * compliance with the License.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * You can obtain a copy of the License at
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * https://opensso.dev.java.net/public/CDDLv1.0.html or
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * See the License for the specific language governing
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * permission and limitations under the License.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * When distributing Covered Code, include this CDDL
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * Header Notice in each file and include the License file
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * If applicable, add the following below the CDDL Header,
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * with the fields enclosed by brackets [] replaced by
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * your own identifying information:
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * "Portions Copyrighted [year] [name of copyright owner]"
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * $Id: AMCompliance.java,v 1.8 2009/01/28 05:34:47 ww203982 Exp $
bee2440354b4bc8796e1de0b6cbd60e1f68deba0Phill Cunnington * Portions Copyright 2011-2015 ForgeRock AS.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.iplanet.am.sdk.common.IComplianceServices;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.sun.identity.security.AdminTokenAction;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.sun.identity.sm.ServiceSchemaManager;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * This class <code>AMCompliance</code> contains the functionality to support
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * iPlanet Compliant DIT. The methods of this class will be used by other
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * classes in <code>com.iplanet.am.sdk package</code>.<p>
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * In order to determine if iPlanet Compliance mode is required or not, the
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * parameter <code>com.iplanet.am.compliance</code> will be verified. A value
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * of <code>true</code> for this parameter, means iPlanet Compliance mode.<p>
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * NOTE: An explicit check must be performed using AMCompliance.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * isIplanetCompliant() method before calling any other methods in this
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * @deprecated As of Sun Java System Access Manager 7.1.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster // Map to keep role->group name mapping
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster private static IComplianceServices complianceServices =
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster AMDirectoryAccessFactory.getComplianceServices();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster protected static final String ADMIN_GROUPS_ENABLED_ATTR =
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster "iplanet-am-admin-console-compliance-admin-groups";
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster protected static final String COMPLIANCE_USER_DELETION_ATTR =
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster "iplanet-am-admin-console-compliance-user-deletion";
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * Method to intialize all the AMCompliance class static variables
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster rootSuffix = AMStoreConnection.getAMSdkBaseDN();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster if (rootSuffix == null || rootSuffix.equals("")) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster debug.error("com.iplanet.am.rootsuffix property value "
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster + "should not be null");
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * Method which checks all the parent organizations of this entry
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * till the base DN, and returns true if any one of them is
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * @param token SSO token of user
bee2440354b4bc8796e1de0b6cbd60e1f68deba0Phill Cunnington * @param dn string representing dn of the object.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * @param profileType the profile type of the object whose ancestor is
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * is being checked.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster protected static boolean isAncestorOrgDeleted(SSOToken token, String dn,
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster return complianceServices.isAncestorOrgDeleted(token, dn, profileType);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * Method to clean up the deletedOrg cache, when an event notification
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * occurs from the directory
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * @param orgDN DN of organization that has been modified
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster protected static void cleanDeletedOrgCache(String orgDN) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster // check to see if this dn is in the deletedOrg cache.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster // delete this entry if it is
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster synchronized (deletedOrg) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster // Get the parent DN..
bee2440354b4bc8796e1de0b6cbd60e1f68deba0Phill Cunnington tdn = DN.valueOf(tdn).parent().toString().toLowerCase();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * Method which checks if Admin Groups need to be created for an
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * organization.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * @param orgDN organization dn
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * @return true if Admin Groups need to be created
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * @exception AMException if an error is encountered
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster protected static boolean isAdminGroupsEnabled(String orgDN)
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster return false;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster ServiceSchemaManager scm = new ServiceSchemaManager(
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster ADMINISTRATION_SERVICE, (SSOToken) AccessController
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster .doPrivileged(AdminTokenAction.getInstance()));
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster Map attrMap = AMDCTree.gsc.getReadOnlyAttributeDefaults();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster Set values = (Set) attrMap.get(ADMIN_GROUPS_ENABLED_ATTR);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster boolean enabled = false;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster String val = (String) values.iterator().next();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster debug.message("Compliance.isAdminGroupsEnabled = " + enabled);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster throw new AMException(AMSDKBundle.getString("357"), "357");
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster throw new AMException(AMSDKBundle.getString("357"), "357");
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster //return compl.isAdminGroupsEnabled(orgDN);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * Method which checks if the object is directly under root suffix
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * @param objDN object dn
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * @return true if the object is directly under root suffix
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster protected static boolean isUnderRootSuffix(String objDN) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster if ((objDN == null) || (objDN.length() == 0)) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster // Will be null only in special cases during search filter
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster // construction (AMSearchFilterMaanager.getSearchFilter())
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster return true;
bee2440354b4bc8796e1de0b6cbd60e1f68deba0Phill Cunnington return rootDN.equals(objectDN) || rootDN.equals(objectDN.parent());
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * Method which checks if Compliance User Deletion is enabled
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * @return true if Compliance User Deletion is enabled
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * @exception AMException if an error is encountered
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster protected static boolean isComplianceUserDeletionEnabled()
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster ServiceSchemaManager scm = new ServiceSchemaManager(
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster ADMINISTRATION_SERVICE, (SSOToken) AccessController
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster .doPrivileged(AdminTokenAction.getInstance()));
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster Map attrMap = AMDCTree.gsc.getReadOnlyAttributeDefaults();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster Set values = (Set) attrMap.get(COMPLIANCE_USER_DELETION_ATTR);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster boolean enabled = false;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster String val = (String) values.iterator().next();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster debug.message("Compliance.isComplianceUserDeletionEnabled = "
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster throw new AMException(AMSDKBundle.getString("359"), "359");
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster throw new AMException(AMSDKBundle.getString("359"), "359");
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster protected static void verifyAndDeleteObject(SSOToken token,
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster complianceServices.verifyAndDeleteObject(token, profileDN);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * Protected method to get the search filter to be used for
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * searching for deleted objects.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster protected static String getDeletedObjectFilter(int objectType)