policy/plugins/DSAMERole.java

bee2440354b4bc8796e1de0b6cbd60e1f68deba0Phill Cunnington/*
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * Copyright (c) 2006 Sun Microsystems Inc. All Rights Reserved
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * The contents of this file are subject to the terms
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * of the Common Development and Distribution License
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * (the License). You may not use this file except in
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * compliance with the License.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * You can obtain a copy of the License at
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * https://opensso.dev.java.net/public/CDDLv1.0.html or
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * opensso/legal/CDDLv1.0.txt
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * See the License for the specific language governing
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * permission and limitations under the License.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * When distributing Covered Code, include this CDDL
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * Header Notice in each file and include the License file
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * at opensso/legal/CDDLv1.0.txt.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * If applicable, add the following below the CDDL Header,
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * with the fields enclosed by brackets [] replaced by
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * your own identifying information:
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * "Portions Copyrighted [year] [name of copyright owner]"
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * $Id: DSAMERole.java,v 1.4 2009/01/28 05:35:01 ww203982 Exp $
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster *
f48118365a7f4f1240516dbe66e47b24a896ff16Craig McDonnell * Portions Copyrighted 2011-2016 ForgeRock AS.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterpackage com.sun.identity.policy.plugins;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
ce4d3fddc8fe2eddd68a20af9570b3cc63ece5abNeil Maddenimport com.iplanet.am.sdk.AMConstants;
ce4d3fddc8fe2eddd68a20af9570b3cc63ece5abNeil Maddenimport com.iplanet.am.sdk.AMException;
ce4d3fddc8fe2eddd68a20af9570b3cc63ece5abNeil Maddenimport com.iplanet.am.sdk.AMOrganization;
ce4d3fddc8fe2eddd68a20af9570b3cc63ece5abNeil Maddenimport com.iplanet.am.sdk.AMSearchControl;
ce4d3fddc8fe2eddd68a20af9570b3cc63ece5abNeil Maddenimport com.iplanet.am.sdk.AMSearchResults;
ce4d3fddc8fe2eddd68a20af9570b3cc63ece5abNeil Maddenimport com.iplanet.am.sdk.AMStoreConnection;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.iplanet.sso.SSOException;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.iplanet.sso.SSOToken;
f48118365a7f4f1240516dbe66e47b24a896ff16Craig McDonnellimport com.iplanet.sso.SSOTokenListenersUnsupportedException;
ce4d3fddc8fe2eddd68a20af9570b3cc63ece5abNeil Maddenimport com.sun.identity.policy.InvalidNameException;
ce4d3fddc8fe2eddd68a20af9570b3cc63ece5abNeil Maddenimport com.sun.identity.policy.NameNotFoundException;
ce4d3fddc8fe2eddd68a20af9570b3cc63ece5abNeil Maddenimport com.sun.identity.policy.PolicyConfig;
ce4d3fddc8fe2eddd68a20af9570b3cc63ece5abNeil Maddenimport com.sun.identity.policy.PolicyEvaluator;
ce4d3fddc8fe2eddd68a20af9570b3cc63ece5abNeil Maddenimport com.sun.identity.policy.PolicyException;
ce4d3fddc8fe2eddd68a20af9570b3cc63ece5abNeil Maddenimport com.sun.identity.policy.PolicyManager;
ce4d3fddc8fe2eddd68a20af9570b3cc63ece5abNeil Maddenimport com.sun.identity.policy.PolicyUtils;
ce4d3fddc8fe2eddd68a20af9570b3cc63ece5abNeil Maddenimport com.sun.identity.policy.ResBundleUtils;
ce4d3fddc8fe2eddd68a20af9570b3cc63ece5abNeil Maddenimport com.sun.identity.policy.SubjectEvaluationCache;
ce4d3fddc8fe2eddd68a20af9570b3cc63ece5abNeil Maddenimport com.sun.identity.policy.Syntax;
ce4d3fddc8fe2eddd68a20af9570b3cc63ece5abNeil Maddenimport com.sun.identity.policy.ValidValues;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.sun.identity.policy.interfaces.Subject;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.sun.identity.shared.debug.Debug;
ce4d3fddc8fe2eddd68a20af9570b3cc63ece5abNeil Madden
ce4d3fddc8fe2eddd68a20af9570b3cc63ece5abNeil Maddenimport java.util.Collections;
ce4d3fddc8fe2eddd68a20af9570b3cc63ece5abNeil Maddenimport java.util.HashSet;
ce4d3fddc8fe2eddd68a20af9570b3cc63ece5abNeil Maddenimport java.util.Iterator;
ce4d3fddc8fe2eddd68a20af9570b3cc63ece5abNeil Maddenimport java.util.Locale;
ce4d3fddc8fe2eddd68a20af9570b3cc63ece5abNeil Maddenimport java.util.Map;
ce4d3fddc8fe2eddd68a20af9570b3cc63ece5abNeil Maddenimport java.util.Set;
ce4d3fddc8fe2eddd68a20af9570b3cc63ece5abNeil Madden
bee2440354b4bc8796e1de0b6cbd60e1f68deba0Phill Cunningtonimport org.forgerock.opendj.ldap.DN;
ce4d3fddc8fe2eddd68a20af9570b3cc63ece5abNeil Maddenimport org.forgerock.opendj.ldap.LdapException;
bee2440354b4bc8796e1de0b6cbd60e1f68deba0Phill Cunningtonimport org.forgerock.opendj.ldap.ResultCode;
bee2440354b4bc8796e1de0b6cbd60e1f68deba0Phill Cunnington
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster/**
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * DSAME Role plugin lets policy admins specify the DSAME roles as a subject.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * The plugin validates a user belonging to a DSAME role specified with this
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * plugin.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterpublic class DSAMERole implements Subject {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private boolean initialized;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private String organizationDN;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private Set subjectRoles = Collections.EMPTY_SET;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private int timeLimit;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private int maxResults;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private int roleSearchScope;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private String ldapServer;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private static final String LDAP_SCOPE_BASE = "SCOPE_BASE";
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private static final String LDAP_SCOPE_ONE = "SCOPE_ONE";
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    // Debug
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    static Debug debug = Debug.getInstance(
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        PolicyManager.POLICY_DEBUG_NAME);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    public DSAMERole() {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        // do nothing
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    /**
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * This method initializes the DSAME Role plugin with the organization
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * DN, search configuration, ldap server name,  in which this plugin
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * is specified for a <code>Policy</code>.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @param configParams configuration parameters as a map.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * The values in the map is <code>java.util.Set</code>,
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * which contains one or more configuration paramaters.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @exception PolicyException if an error occured during
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * initialization of <code>Subject</code> instance
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    public void initialize(Map configParams) throws PolicyException {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        String configuredLdapServer =
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            (String)configParams.get(PolicyConfig.LDAP_SERVER);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        if (configuredLdapServer == null) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            debug.error("DSAMERole.initialize(): failed to get LDAP "
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster              + "server name. If you enter more than one server name "
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster              + "in the policy config service's Primary LDAP Server "
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster              + "field, please make sure the ldap server name is preceded "
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster              + "with the local server name.");
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            throw (new PolicyException(ResBundleUtils.rbName,
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                "invalid_ldap_server_host", null, null));
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        ldapServer = configuredLdapServer.toLowerCase();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        organizationDN = (String) configParams.get(
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            PolicyConfig.IS_ROLES_BASE_DN);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        String scope = (String) configParams.get(
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            PolicyConfig.IS_ROLES_SEARCH_SCOPE);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        if (scope.equalsIgnoreCase(LDAP_SCOPE_BASE)) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            roleSearchScope = AMConstants.SCOPE_BASE;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        } else if (scope.equalsIgnoreCase(LDAP_SCOPE_ONE)) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            roleSearchScope = AMConstants.SCOPE_ONE;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        } else {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            roleSearchScope = AMConstants.SCOPE_SUB;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        try {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            timeLimit = Integer.parseInt((String) configParams.get(
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                                        PolicyConfig.LDAP_SEARCH_TIME_OUT));
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            maxResults = Integer.parseInt((String) configParams.get(
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                                        PolicyConfig.LDAP_SEARCH_LIMIT));
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        } catch (NumberFormatException nfe) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            debug.error("Can not parse search parameters in DSAMERole", nfe);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            timeLimit = 5;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            maxResults = 100;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        initialized = true;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    /**
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * Returns the syntax of the values this <code>Subject</code>
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * implementation can have.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @see com.sun.identity.policy.Syntax
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @param token the <code>SSOToken</code> that will be used
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * to determine the syntax
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @return set of of valid names for the user collection.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @exception SSOException if SSO token is not valid
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @exception PolicyException if unable to get the list of valid
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * names.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @return syntax of the values for the <code>Subject</code>
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    public Syntax getValueSyntax(SSOToken token) throws SSOException {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        return (Syntax.MULTIPLE_CHOICE);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    /**
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * Returns a list of possible values for the <code>Subject</code>.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @param token the <code>SSOToken</code> that will be used
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * to determine the possible values
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @return <code>ValidValues</code> object
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @exception SSOException if SSO token is not valid
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @exception PolicyException if unable to get the list of valid
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * names.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    public ValidValues getValidValues(SSOToken token) throws
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        SSOException, PolicyException {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        return (getValidValues(token, "*"));
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    /**
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * Returns a list of possible values for the <code>Subject
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * </code> that matches the pattern.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @param token the <code>SSOToken</code> that will be used
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * to determine the possible values
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @return <code>ValidValues</code> object
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @exception SSOException if SSO token is not valid
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @exception PolicyException if unable to get the list of valid
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * names.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    public ValidValues getValidValues(SSOToken token, String pattern)
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        throws SSOException, PolicyException {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        if (!initialized) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            throw (new PolicyException(ResBundleUtils.rbName,
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                "role_subject_not_yet_initialized", null, null));
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        try {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            AMStoreConnection amConnection = new AMStoreConnection(token);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            AMOrganization orgObject = amConnection.getOrganization(
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                organizationDN);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            AMSearchControl sc = new AMSearchControl();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            sc.setMaxResults(maxResults);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            sc.setTimeOut(timeLimit);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            sc.setSearchScope(roleSearchScope);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            AMSearchResults results = orgObject.searchAllRoles(pattern, sc);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            int status;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            switch(results.getErrorCode()) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                case AMSearchResults.SUCCESS:
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    status = ValidValues.SUCCESS;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    break;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                case AMSearchResults.SIZE_LIMIT_EXCEEDED:
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    status = ValidValues.SIZE_LIMIT_EXCEEDED;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    break;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                case AMSearchResults.TIME_LIMIT_EXCEEDED:
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    status = ValidValues.TIME_LIMIT_EXCEEDED;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    break;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                default:
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    status = ValidValues.SUCCESS;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            }
bee2440354b4bc8796e1de0b6cbd60e1f68deba0Phill Cunnington            return new ValidValues(status, results.getSearchResults());
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        } catch (AMException e) {
ce4d3fddc8fe2eddd68a20af9570b3cc63ece5abNeil Madden            LdapException lde = e.getLDAPException();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            if (lde != null) {
bee2440354b4bc8796e1de0b6cbd60e1f68deba0Phill Cunnington                ResultCode ldapErrorCode = lde.getResult().getResultCode();
bee2440354b4bc8796e1de0b6cbd60e1f68deba0Phill Cunnington                if (ResultCode.INVALID_CREDENTIALS.equals(ldapErrorCode)) {
bee2440354b4bc8796e1de0b6cbd60e1f68deba0Phill Cunnington                    throw new PolicyException(ResBundleUtils.rbName,"ldap_invalid_password", null, null);
bee2440354b4bc8796e1de0b6cbd60e1f68deba0Phill Cunnington                } else if (ResultCode.NO_SUCH_OBJECT.equals(ldapErrorCode)) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    String[] objs = { organizationDN };
bee2440354b4bc8796e1de0b6cbd60e1f68deba0Phill Cunnington                    throw new PolicyException(ResBundleUtils.rbName, "no_such_am_roles_base_dn", objs, null);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                }
bee2440354b4bc8796e1de0b6cbd60e1f68deba0Phill Cunnington                String errorMsg = lde.getResult().getDiagnosticMessage();
bee2440354b4bc8796e1de0b6cbd60e1f68deba0Phill Cunnington                String additionalMsg = lde.getResult().getResultCode().getName().toString(Locale.ROOT);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                if (additionalMsg != null) {
bee2440354b4bc8796e1de0b6cbd60e1f68deba0Phill Cunnington                    throw new PolicyException(errorMsg + ": " + additionalMsg);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                } else {
bee2440354b4bc8796e1de0b6cbd60e1f68deba0Phill Cunnington                    throw new PolicyException(errorMsg);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            }
bee2440354b4bc8796e1de0b6cbd60e1f68deba0Phill Cunnington            throw new PolicyException(e);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    /**
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * Returns the display name for the value for the given locale.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * For all the valid values obtained through the methods
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * <code>getValidValues</code> this method must be called
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * by GUI and CLI to get the corresponding display name.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * The <code>locale</code> variable could be used by the
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * plugin to customize the display name for the given locale.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * The <code>locale</code> variable could be <code>null</code>,
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * in which case the plugin must use the default locale (most probabily
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * en_US).
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * Alternatively, if the plugin does not have to localize
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * the value, it can just return the <code>value</code> as is.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @param value one of the valid value for the plugin
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @param locale locale for which the display name must be customized
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @exception NameNotFoundException if the given <code>value</code>
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * is not one of the valid values for the plugin
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    public String getDisplayNameForValue(String value, Locale locale)
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        throws NameNotFoundException {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        return PolicyUtils.getDNDisplayString(value);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    /**
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * Returns the values that was set using the
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * method <code>setValues</code>.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @return values that have been set for the user collection
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    public Set getValues() {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        if (subjectRoles == null) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            return (Collections.EMPTY_SET);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        return (subjectRoles);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    /**
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * Sets the names for the instance of the <code>Subject</code>
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * object. The names are obtained from the policy object,
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * usually configured when a policy is created.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @param names names selected for the instance of
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * the user collection object.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @exception InvalidNameException if the given names are not valid
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    public void setValues(Set names) throws InvalidNameException {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        if (names == null) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            throw (new InvalidNameException(ResBundleUtils.rbName,
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                "role_subject_invalid_role_names", null, null,
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                PolicyException.USER_COLLECTION));
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        if (names.isEmpty()) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            subjectRoles = names;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        } else {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            subjectRoles = new HashSet();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            Iterator iter = names.iterator();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            while (iter.hasNext()) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                String role = (String) iter.next();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                if (role != null) {
bee2440354b4bc8796e1de0b6cbd60e1f68deba0Phill Cunnington                    subjectRoles.add(DN.valueOf(role).toString().toLowerCase());
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        if (debug.messageEnabled()) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            debug.message("Set subjectRoles to: " + subjectRoles);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    /**
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * Determines if the user belongs to this instance of the
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * <code>Subject</code> object.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @param token single-sign-on token of the user
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @return <code>true</code> if the user is memeber of the
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * given subject; <code>false</code> otherwise.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @exception SSOException if SSO token is not valid
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @exception PolicyException if an error occured while
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * checking if the user is a member of this subject
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    public boolean isMember(SSOToken token)
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        throws SSOException, PolicyException {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        String tokenID = token.getTokenID().toString();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        String userDN = token.getPrincipal().getName();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        boolean roleMatch = false;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        Set roleSet = null;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        if (subjectRoles.size() > 0) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            Iterator roleIter = subjectRoles.iterator();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            while (roleIter.hasNext()) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                Boolean matchFound = null;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                String valueDN = (String)roleIter.next();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                if ((matchFound = SubjectEvaluationCache.isMember(
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                tokenID, ldapServer,valueDN)) != null) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    if (debug.messageEnabled()) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                        debug.message("DSAMERole.isMember():Got membership "
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                            +"from cache of " +token.getPrincipal().getName()
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                            +" in DSAME role "+valueDN
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                            + " :"+matchFound.booleanValue());
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    boolean result = matchFound.booleanValue();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    if (result) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                        return result;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    } else {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                        continue;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                // got here so entry not in subject evalauation cache
f48118365a7f4f1240516dbe66e47b24a896ff16Craig McDonnell                boolean listeningToSsoToken = true;
f48118365a7f4f1240516dbe66e47b24a896ff16Craig McDonnell                if (!PolicyEvaluator.ssoListenerRegistry.containsKey(tokenID)) {
f48118365a7f4f1240516dbe66e47b24a896ff16Craig McDonnell                    try {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                        token.addSSOTokenListener(PolicyEvaluator.ssoListener);
f48118365a7f4f1240516dbe66e47b24a896ff16Craig McDonnell                        PolicyEvaluator.ssoListenerRegistry.put(tokenID, PolicyEvaluator.ssoListener);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                        if (debug.messageEnabled()) {
f48118365a7f4f1240516dbe66e47b24a896ff16Craig McDonnell                            debug.message("DSAMERole.isMember(): sso listener added .\n");
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                        }
f48118365a7f4f1240516dbe66e47b24a896ff16Craig McDonnell                    } catch (SSOTokenListenersUnsupportedException ex) {
f48118365a7f4f1240516dbe66e47b24a896ff16Craig McDonnell                        // Catching exception to avoid adding tokenID to ssoListenerRegistry
f48118365a7f4f1240516dbe66e47b24a896ff16Craig McDonnell                        debug.message("DSAMERole.isMember(): could not add sso listener: {}", ex.getMessage());
f48118365a7f4f1240516dbe66e47b24a896ff16Craig McDonnell                        listeningToSsoToken = false;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                if (debug.messageEnabled()) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    debug.message("DSAMERole:isMember():entry for "
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                        +valueDN+" not in subject evaluation cache, fetching "
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                        +"from NS User Cache.");
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                if (roleSet == null) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    roleSet = PolicyEvaluator.getUserNSRoleValues(token);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                if ((roleSet != null) && !roleSet.isEmpty()) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    if (debug.messageEnabled()) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                        debug.message("DSAMERole.isMember():" +
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                        "\n  user roles: " + roleSet +
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                        "\n  subject roles: " + subjectRoles);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    if (roleSet.contains(valueDN)) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                        roleMatch = true;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                if (debug.messageEnabled()) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                        debug.message("DSAMERole.isMember:adding entry "
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                          +tokenID+" "+ldapServer+" "+valueDN+" "+roleMatch
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                        +" in subject evaluation cache.");
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                }
f48118365a7f4f1240516dbe66e47b24a896ff16Craig McDonnell                if (listeningToSsoToken) {
f48118365a7f4f1240516dbe66e47b24a896ff16Craig McDonnell                    SubjectEvaluationCache.addEntry(tokenID, ldapServer, valueDN, roleMatch);
f48118365a7f4f1240516dbe66e47b24a896ff16Craig McDonnell                }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                if (roleMatch) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                    break;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        if (debug.messageEnabled()) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            if (!roleMatch) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                debug.message("DSAMERole.isMember(): User " + userDN
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                  + " is not a member of this DSAMERole object");
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            } else {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                debug.message("DSAMERole.isMember(): User " + userDN
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                  + " is a member of this DSAMERole object");
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        return roleMatch;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster   /**
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    * Return a hash code for this <code>DSAMERole</code>.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    * @return a hash code for this <code>DSAMERole</code> object.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    public int hashCode() {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        return subjectRoles.hashCode();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    /**
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * Indicates whether some other object is "equal to" this one.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @param o another object that will be compared with this one
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @return <code>true</code> if eqaul; <code>false</code>
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * otherwise
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    public boolean equals(Object o) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        if (o instanceof DSAMERole) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            DSAMERole role = (DSAMERole) o;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            return(subjectRoles.equals(role.subjectRoles));
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        return (false);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    /**
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * Creates and returns a copy of this object.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     * @return a copy of this object
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster     */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    public Object clone() {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        DSAMERole theClone = null;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        try {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            theClone = (DSAMERole) super.clone();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        } catch (CloneNotSupportedException e) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            // this should never happen
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            throw new InternalError();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        if (subjectRoles != null) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            theClone.subjectRoles = new HashSet();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            theClone.subjectRoles.addAll(subjectRoles);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        return theClone;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster}