Fix associationFromLink with dead shadows

This resolves MID-9468 and MID-9487.
Evolveum · Apr 26, 2024 · 502d08c · 502d08c
1 parent 9155f5c
commit 502d08c
Show file tree

Hide file tree

Showing 4 changed files with 89 additions and 3 deletions.
diff --git a/...um/midpoint/model/common/expression/evaluator/AssociationFromLinkExpressionEvaluator.java b/...um/midpoint/model/common/expression/evaluator/AssociationFromLinkExpressionEvaluator.java
@@ -15,6 +15,8 @@
 import java.util.List;
 import javax.xml.namespace.QName;
 
+import com.evolveum.midpoint.schema.util.ShadowUtil;
+
 import org.apache.commons.collections4.CollectionUtils;
 import org.jetbrains.annotations.NotNull;
 
@@ -188,9 +190,10 @@ private ShadowAssociation createAssociationFromMatchingValues(
 
             ShadowAssociation outputAssociation = outputDefinition.instantiate();
             for (PrismObject<ShadowType> targetObject : targetObjects) {
-                // We also need to add identifiers here. Otherwise the delta won't match the shadow association.
-                // And therefore new values won't be computed correctly (MID-4948). This is not a clean systemic solution.
-                outputAssociation.createNewValueWithFullObject(AbstractShadow.of(targetObject));
+                if (ShadowUtil.isNotDead(targetObject)) {
+                    outputAssociation.createNewValueWithFullObject(
+                            AbstractShadow.of(targetObject));
+                }
             }
 
             return outputAssociation;

diff --git a/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/TestEntitlements.java b/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/TestEntitlements.java
@@ -6,6 +6,7 @@
  */
 package com.evolveum.midpoint.model.intest;
 
+import static com.evolveum.midpoint.schema.constants.SchemaConstants.ORG_RELATED;
 import static com.evolveum.midpoint.schema.constants.SchemaConstants.RI_GROUP_OBJECT_CLASS;
 
 import static com.evolveum.midpoint.test.DummyResourceContoller.DUMMY_ENTITLEMENT_GROUP_QNAME;
@@ -128,6 +129,9 @@ public class TestEntitlements extends AbstractInitializedModelIntegrationTest {
     private static final TestObject<ShadowType> SHADOW_MAPMAKERS_DEAD = TestObject.file(
             TEST_DIR, "group-mapmakers-dead.xml", "1ff68c92-d526-4cfb-8df5-539bc5fdd097");
 
+    private static final TestObject<ShadowType> SHADOW_CHESS_DEAD = TestObject.file(
+            TEST_DIR, "group-chess-dead.xml", "43bf9f91-5487-487b-aa3c-0eda2ba66f79");
+
     private static final TestObject<ShadowType> SHADOW_GUYBRUSH_DEAD = TestObject.file(
             TEST_DIR, "account-guybrush-dead.xml", "2947d268-1d43-4114-bd4c-f4aa723d884a");
 
@@ -148,6 +152,8 @@ public class TestEntitlements extends AbstractInitializedModelIntegrationTest {
             TEST_DIR, "metarole-art.xml", "bf1178f4-d59a-47d1-b00b-f696b7bf6565");
     private static final TestObject<RoleType> ROLE_BASKETBALL = TestObject.file(
             TEST_DIR, "role-basketball.xml", "d2aa8c0f-7883-4c36-8446-7b4ddbf8b0a3");
+    private static final TestObject<RoleType> ROLE_CHESS = TestObject.file(
+            TEST_DIR, "role-chess.xml", "8d5c099c-bbdc-4584-a5eb-4931319d09b6");
     private static final TestObject<RoleType> ROLE_MUSIC = TestObject.file(
             TEST_DIR, "role-music.xml", "1095efcd-6677-4adc-b1d7-984014b2b87b");
 
@@ -174,6 +180,7 @@ public void initSystem(Task initTask, OperationResult initResult) throws Excepti
                 METAROLE_SPORT,
                 METAROLE_ART,
                 ROLE_BASKETBALL,
+                ROLE_CHESS,
                 ROLE_MUSIC,
                 ROLE_MAPMAKER,
                 ROLE_MAPMAKER_LANDLUBER,
@@ -2467,6 +2474,45 @@ public void test925AssociationTargetSearchMultipleIntentsInRepository() throws E
         assertGroupMember(ROLE_MUSIC.getNameOrig(), userName, RESOURCE_DUMMY_WILD_ASSOCIATIONS.getDummyResource());
     }
 
+    /**
+     * Using `associationFromLink` with a dead shadow.
+     *
+     * MID-9468, MID-9487.
+     */
+    @Test
+    public void test930AssociationFromLinkWithDeadShadow() throws Exception {
+        Task task = getTestTask();
+        OperationResult result = task.getResult();
+        String userName = "test930";
+
+        given("a dead shadow for 'chess' role");
+        repoAdd(SHADOW_CHESS_DEAD, result);
+        repositoryService.modifyObject(
+                RoleType.class,
+                ROLE_CHESS.oid,
+                deltaFor(RoleType.class)
+                        .item(RoleType.F_LINK_REF)
+                        .add(new ObjectReferenceType()
+                                .oid(SHADOW_CHESS_DEAD.oid)
+                                .type(ShadowType.COMPLEX_TYPE)
+                                .relation(ORG_RELATED))
+                        .asItemDeltas(),
+                result);
+
+        when("user with role 'chess' is created");
+        UserType user = new UserType()
+                .name(userName)
+                .assignment(ROLE_CHESS.assignmentTo());
+
+        addObject(user, task, result);
+
+        then("operation is OK and account with appropriate group memberships exists");
+        assertSuccess(result);
+
+        assertDummyAccount(RESOURCE_DUMMY_WILD_ASSOCIATIONS.name, userName);
+        assertGroupMember(ROLE_CHESS.getNameOrig(), userName, RESOURCE_DUMMY_WILD_ASSOCIATIONS.getDummyResource());
+    }
+
     private void assertJackClean() throws SchemaViolationException, ConflictException, ObjectNotFoundException, SchemaException, SecurityViolationException, CommunicationException, ConfigurationException, ExpressionEvaluationException, InterruptedException {
         PrismObject<UserType> userBefore = getUser(USER_JACK_OID);
         display("User before", userBefore);

diff --git a/model/model-intest/src/test/resources/entitlements/group-chess-dead.xml b/model/model-intest/src/test/resources/entitlements/group-chess-dead.xml
@@ -0,0 +1,23 @@
+<!--
+  ~ Copyright (C) 2010-2022 Evolveum and contributors
+  ~
+  ~ This work is dual-licensed under the Apache License 2.0
+  ~ and European Union Public License. See LICENSE file for details.
+  -->
+
+<shadow xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
+        xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3"
+        xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3"
+        oid="43bf9f91-5487-487b-aa3c-0eda2ba66f79">
+    <name>chess</name>
+    <resourceRef oid="9437c94e-af47-4976-bbfc-cc7a59538ddf"/>
+    <dead>true</dead>
+    <objectClass>ri:GroupObjectClass</objectClass>
+    <kind>entitlement</kind>
+    <intent>sport</intent>
+    <exists>false</exists>
+    <attributes>
+        <icfs:name>WRONG NAME</icfs:name>
+        <icfs:uid>WRONG UID</icfs:uid>
+    </attributes>
+</shadow>
diff --git a/model/model-intest/src/test/resources/entitlements/role-chess.xml b/model/model-intest/src/test/resources/entitlements/role-chess.xml
@@ -0,0 +1,14 @@
+<!--
+  ~ Copyright (C) 2010-2023 Evolveum and contributors
+  ~
+  ~ This work is dual-licensed under the Apache License 2.0
+  ~ and European Union Public License. See LICENSE file for details.
+  -->
+
+<role xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
+    oid="8d5c099c-bbdc-4584-a5eb-4931319d09b6">
+    <name>chess</name>
+    <assignment>
+        <targetRef oid="8da65c58-063c-45be-9b97-3af9be1530b3" type="RoleType"/>
+    </assignment>
+</role>