Merge remote-tracking branch 'origin/master'

infra/schema/src/main/java/com/evolveum/midpoint/schema/GetOperationOptions.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010-2013 Evolveum
+ * Copyright (c) 2010-2016 Evolveum
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -415,9 +415,43 @@ public GetOperationOptions clone() {
 
 	@Override
 	public String toString() {
-		return "GetOperationOptions(resolve=" + resolve + ", resolveNames=" + resolveNames + ",noFetch=" + noFetch
-				+ ", raw=" + raw + ", doNotDiscovery="+doNotDiscovery+", retrieve="+retrieve+", allowNotFound="+ allowNotFound 
-				+", relationalValueSearchQuery="+relationalValueSearchQuery+")";
+		StringBuilder sb = new StringBuilder("GetOperationOptions(");
+		appendFlag(sb, "resolve", resolve);
+		appendFlag(sb, "resolveNames", resolveNames);
+		appendFlag(sb, "noFetch", noFetch);
+		appendFlag(sb, "raw", raw);
+		appendFlag(sb, "doNotDiscovery", doNotDiscovery);
+		appendVal(sb, "retrieve", retrieve);
+		appendFlag(sb, "allowNotFound", allowNotFound);
+		appendVal(sb, "relationalValueSearchQuery", relationalValueSearchQuery);
+		if (sb.charAt(sb.length() - 1) == ',') {
+			sb.deleteCharAt(sb.length() - 1);
+		}
+		sb.append(")");
+		return sb.toString();
+	}
+
+	private void appendFlag(StringBuilder sb, String name, Boolean val) {
+		if (val == null) {
+			return;
+		} else if (val) {
+			sb.append(name);
+			sb.append(",");
+		} else {
+			sb.append(name);
+			sb.append("=false,");
+		}
+	}
+
+	private void appendVal(StringBuilder sb, String name, Object val) {
+		if (val == null) {
+			return;
+		} else {
+			sb.append(name);
+			sb.append("=");
+			sb.append(val);
+			sb.append(",");
+		}
 	}
 
 }

infra/schema/src/main/java/com/evolveum/midpoint/schema/ResourceShadowDiscriminator.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010-2015 Evolveum
+ * Copyright (c) 2010-2016 Evolveum
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -133,7 +133,11 @@ public void setOrder(int order) {
 	}
 
 	/**
-	 * Thumbstone flag is true: the account no longer exists. The data we have are the latest metadata we were able to get. 
+	 * Thumbstone flag is true: the account no longer exists. The data we have are the latest metadata we were able to get.
+	 * The projection will be marked as thombstone if we discover that the associated resource object is gone. Or the shadow
+	 * is gone and we can no longer associate the resource object. In any way the thombstoned projection is marked for removal.
+	 * It will be eventually unlinked and the shadow will be deleted. The shadow may stay around in the "dead" state for
+	 * some time for reporting purposes.
 	 */
 	public boolean isThombstone() {
 		return thombstone;

model/model-api/src/main/java/com/evolveum/midpoint/model/api/context/SynchronizationPolicyDecision.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010-2013 Evolveum
+ * Copyright (c) 2010-2016 Evolveum
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -47,9 +47,12 @@ public enum SynchronizationPolicyDecision {
 	UNLINK,
 
 	/**
-	 * The account is not usable. E.g. because the associated shadow does
-	 * not exist any more, resource does not exists any more, etc.
-	 * Such account link will be removed.
+	 * The projection is broken. I.e. there is some (fixable) state that
+	 * prevents proper operations with the projection. This may be schema violation
+	 * problem, security problem (access denied), misconfiguration, etc.
+	 * Broken projections will be kept in the state that they are (maintaining
+	 * status quo) until the problem is fixed. We will do no operations on broken
+	 * projections and we will NOT unlink them or delete them.
 	 */
 	BROKEN,
 

model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/lens/LensElementContext.java

@@ -16,11 +16,18 @@
 package com.evolveum.midpoint.model.impl.lens;
 
 import java.util.ArrayList;
+import java.util.Collection;
 import java.util.List;
 
+import javax.xml.namespace.QName;
+
 import com.evolveum.midpoint.prism.ConsistencyCheckScope;
 import com.evolveum.midpoint.prism.Objectable;
 import com.evolveum.midpoint.schema.DeltaConvertor;
+import com.evolveum.midpoint.schema.constants.MidPointConstants;
+import com.evolveum.midpoint.schema.constants.SchemaConstants;
+import com.evolveum.midpoint.schema.processor.ResourceAttribute;
+import com.evolveum.midpoint.schema.processor.ResourceAttributeContainer;
 import com.evolveum.midpoint.schema.result.OperationResult;
 import com.evolveum.midpoint.util.exception.CommunicationException;
 import com.evolveum.midpoint.util.exception.ConfigurationException;

model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/lens/LensProjectionContext.java

@@ -30,6 +30,7 @@
 import com.evolveum.midpoint.prism.delta.ItemDelta;
 import com.evolveum.midpoint.schema.DeltaConvertor;
 import com.evolveum.midpoint.schema.ResourceShadowDiscriminator;
+import com.evolveum.midpoint.schema.constants.SchemaConstants;
 import com.evolveum.midpoint.schema.result.OperationResult;
 import com.evolveum.midpoint.util.exception.*;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.*;
@@ -52,6 +53,7 @@
 import com.evolveum.midpoint.prism.delta.ReferenceDelta;
 import com.evolveum.midpoint.prism.path.ItemPath;
 import com.evolveum.midpoint.schema.processor.ResourceAttribute;
+import com.evolveum.midpoint.schema.processor.ResourceAttributeContainer;
 import com.evolveum.midpoint.schema.processor.ResourceSchema;
 import com.evolveum.midpoint.schema.util.MiscSchemaUtil;
 import com.evolveum.midpoint.schema.util.ShadowUtil;
@@ -543,6 +545,9 @@ public ResourceObjectTypeDefinitionType getResourceObjectTypeDefinitionType() {
 		if (discr == null) {
 			return null;			// maybe when an account is deleted
 		}
+		if (resource == null) {
+			return null;
+		}
 		ResourceObjectTypeDefinitionType def = ResourceTypeUtil.getResourceObjectTypeDefinitionType(resource, discr.getKind(), discr.getIntent());
         return def;
     }
@@ -887,7 +892,7 @@ public void checkConsistence(String contextDesc, boolean fresh, boolean force) {
 		if (synchronizationPolicyDecision == SynchronizationPolicyDecision.BROKEN) {
 			return;
 		}
-    	if (fresh && !force) {
+    	if (fresh && !force && resourceShadowDiscriminator != null && !resourceShadowDiscriminator.isThombstone()) {
     		if (resource == null) {
 	    		throw new IllegalStateException("Null resource in "+this + (contextDesc == null ? "" : " in " +contextDesc));
 	    	}
@@ -906,6 +911,29 @@ public void checkConsistence(String contextDesc, boolean fresh, boolean force) {
     	}
     }
 
+	@Override
+	protected void checkConsistence(PrismObject<ShadowType> object, String elementDesc, String contextDesc) {
+		super.checkConsistence(object, elementDesc, contextDesc);
+		ResourceAttributeContainer attributesContainer = ShadowUtil.getAttributesContainer(object);
+    	if (attributesContainer != null) {
+    		ResourceType resource = getResource();
+    		if (resource != null) {
+	    		String resourceNamespace = ResourceTypeUtil.getResourceNamespace(resource);
+	    		for(ResourceAttribute<?> attribute: attributesContainer.getAttributes()) {
+	    			QName attrName = attribute.getElementName();
+	    			if (SchemaConstants.NS_ICF_SCHEMA.equals(attrName.getNamespaceURI())) {
+	    				continue;
+	    			}
+	    			if (resourceNamespace.equals(attrName.getNamespaceURI())) {
+	    				continue;
+	    			}
+	    			String desc = elementDesc+" in "+this + (contextDesc == null ? "" : " in " +contextDesc);
+	    			throw new IllegalStateException("Invalid namespace for attribute "+attrName+" in "+desc);
+	    		}
+    		}
+    	}
+	}
+
 	protected boolean isRequireSecondardyDeltaOid() {
 		if (synchronizationPolicyDecision == SynchronizationPolicyDecision.ADD ||
 				synchronizationPolicyDecision == SynchronizationPolicyDecision.BROKEN ||