a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * Copyright (c) 2005 Sun Microsystems Inc. All Rights Reserved
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * The contents of this file are subject to the terms
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * of the Common Development and Distribution License
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * (the License). You may not use this file except in
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * compliance with the License.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * You can obtain a copy of the License at
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * https://opensso.dev.java.net/public/CDDLv1.0.html or
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * See the License for the specific language governing
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * permission and limitations under the License.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * When distributing Covered Code, include this CDDL
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * Header Notice in each file and include the License file
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * If applicable, add the following below the CDDL Header,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * with the fields enclosed by brackets [] replaced by
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * your own identifying information:
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * "Portions Copyrighted [year] [name of copyright owner]"
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * $Id: AMCompliance.java,v 1.8 2009/01/28 05:34:47 ww203982 Exp $
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * Portions Copyright 2011-2015 ForgeRock AS.
91cb2bef1c88e70b5d433c2a34bca110a35786ceMark Craigimport com.iplanet.am.sdk.common.IComplianceServices;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.security.AdminTokenAction;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.sm.ServiceSchemaManager;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * This class <code>AMCompliance</code> contains the functionality to support
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * iPlanet Compliant DIT. The methods of this class will be used by other
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * classes in <code>com.iplanet.am.sdk package</code>.<p>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * In order to determine if iPlanet Compliance mode is required or not, the
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * parameter <code>com.iplanet.am.compliance</code> will be verified. A value
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * of <code>true</code> for this parameter, means iPlanet Compliance mode.<p>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * NOTE: An explicit check must be performed using AMCompliance.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * isIplanetCompliant() method before calling any other methods in this
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * @deprecated As of Sun Java System Access Manager 7.1.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // Map to keep role->group name mapping
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster private static IComplianceServices complianceServices =
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster AMDirectoryAccessFactory.getComplianceServices();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster protected static final String ADMIN_GROUPS_ENABLED_ATTR =
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster "iplanet-am-admin-console-compliance-admin-groups";
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster protected static final String COMPLIANCE_USER_DELETION_ATTR =
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster "iplanet-am-admin-console-compliance-user-deletion";
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * Method to intialize all the AMCompliance class static variables
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster rootSuffix = AMStoreConnection.getAMSdkBaseDN();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (rootSuffix == null || rootSuffix.equals("")) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster debug.error("com.iplanet.am.rootsuffix property value "
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster + "should not be null");
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * Method which checks all the parent organizations of this entry
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * till the base DN, and returns true if any one of them is
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * @param token SSO token of user
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * @param dn string representing dn of the object.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * @param profileType the profile type of the object whose ancestor is
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * is being checked.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster protected static boolean isAncestorOrgDeleted(SSOToken token, String dn,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster return complianceServices.isAncestorOrgDeleted(token, dn, profileType);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * Method to clean up the deletedOrg cache, when an event notification
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * occurs from the directory
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * @param orgDN DN of organization that has been modified
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster protected static void cleanDeletedOrgCache(String orgDN) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // check to see if this dn is in the deletedOrg cache.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // delete this entry if it is
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster synchronized (deletedOrg) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // Get the parent DN..
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster tdn = DN.valueOf(tdn).parent().toString().toLowerCase();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * Method which checks if Admin Groups need to be created for an
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * organization.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * @param orgDN organization dn
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * @return true if Admin Groups need to be created
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * @exception AMException if an error is encountered
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster protected static boolean isAdminGroupsEnabled(String orgDN)
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster return false;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ServiceSchemaManager scm = new ServiceSchemaManager(
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ADMINISTRATION_SERVICE, (SSOToken) AccessController
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster .doPrivileged(AdminTokenAction.getInstance()));
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Map attrMap = AMDCTree.gsc.getReadOnlyAttributeDefaults();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Set values = (Set) attrMap.get(ADMIN_GROUPS_ENABLED_ATTR);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster boolean enabled = false;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String val = (String) values.iterator().next();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster debug.message("Compliance.isAdminGroupsEnabled = " + enabled);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster throw new AMException(AMSDKBundle.getString("357"), "357");
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster throw new AMException(AMSDKBundle.getString("357"), "357");
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster //return compl.isAdminGroupsEnabled(orgDN);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * Method which checks if the object is directly under root suffix
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * @param objDN object dn
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * @return true if the object is directly under root suffix
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster protected static boolean isUnderRootSuffix(String objDN) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if ((objDN == null) || (objDN.length() == 0)) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // Will be null only in special cases during search filter
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // construction (AMSearchFilterMaanager.getSearchFilter())
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster return true;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster return rootDN.equals(objectDN) || rootDN.equals(objectDN.parent());
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * Method which checks if Compliance User Deletion is enabled
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * @return true if Compliance User Deletion is enabled
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * @exception AMException if an error is encountered
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster protected static boolean isComplianceUserDeletionEnabled()
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ServiceSchemaManager scm = new ServiceSchemaManager(
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ADMINISTRATION_SERVICE, (SSOToken) AccessController
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster .doPrivileged(AdminTokenAction.getInstance()));
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Map attrMap = AMDCTree.gsc.getReadOnlyAttributeDefaults();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Set values = (Set) attrMap.get(COMPLIANCE_USER_DELETION_ATTR);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster boolean enabled = false;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String val = (String) values.iterator().next();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster debug.message("Compliance.isComplianceUserDeletionEnabled = "
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster throw new AMException(AMSDKBundle.getString("359"), "359");
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster throw new AMException(AMSDKBundle.getString("359"), "359");
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster protected static void verifyAndDeleteObject(SSOToken token,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster complianceServices.verifyAndDeleteObject(token, profileDN);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * Protected method to get the search filter to be used for
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * searching for deleted objects.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster protected static String getDeletedObjectFilter(int objectType)