Skip to content

Commit

Permalink
Reworked ProvisioningPolicy into ObjectOperationPolicy
Browse files Browse the repository at this point in the history
  • Loading branch information
@tonydamage
tonydamage committed Feb 13, 2023
1 parent 7a3748b commit fd1ca5f
Show file tree
Hide file tree
Showing 12 changed files with 432 additions and 137 deletions.
83 changes: 82 additions & 1 deletion infra/schema/src/main/resources/xml/ns/public/common/common-core-3.xsd
View file
Original file line number Diff line number Diff line change
Expand Up @@ -506,6 +506,37 @@
</xsd:annotation>
</xsd:element>

<xsd:element name="effectiveMarkRef" type="tns:ObjectReferenceType" minOccurs="0" maxOccurs="unbounded">
<xsd:annotation>
<xsd:documentation>
Tags and Shadow marks assigned to the shadow.
</xsd:documentation>
<xsd:appinfo>
<a:objectReferenceTargetType>tns:MarkType</a:objectReferenceTargetType>
<a:experimental />
</xsd:appinfo>
</xsd:annotation>
</xsd:element>
<xsd:element name="policyStatement" type="tns:PolicyStatementType" minOccurs="0" maxOccurs="unbounded">
<xsd:annotation>
<xsd:documentation>
Policy statements to manually add or exclude effective marks of shadow.
</xsd:documentation>
<xsd:appinfo>
<a:experimental>true</a:experimental>
</xsd:appinfo>
</xsd:annotation>
</xsd:element>
<xsd:element name="effectiveOperationPolicy" type="tns:ObjectOperationPolicyType" minOccurs="0">
<xsd:annotation>
<xsd:documentation>
Effective provisioning policy derived from Shadow marks and resource configuration.
</xsd:documentation>
<xsd:appinfo>
<a:experimental>true</a:experimental>
</xsd:appinfo>
</xsd:annotation>
</xsd:element>
</xsd:sequence>

<xsd:attribute name="oid" type="xsd:string">
Expand Down Expand Up @@ -808,7 +839,7 @@
</xsd:appinfo>
</xsd:annotation>
</xsd:element>
<xsd:element name="provisioningPolicy" type="tns:ShadowProvisioningPolicyType" minOccurs="0">
<xsd:element name="objectOperationPolicy" type="tns:ObjectOperationPolicyType" minOccurs="0">
<xsd:annotation>
<xsd:documentation>
Provisioning policy, which is applied to shadows, which have this tag assigned.
Expand Down Expand Up @@ -15611,6 +15642,13 @@
</xsd:appinfo>
</xsd:annotation>
</xsd:enumeration>
<xsd:enumeration value="00000000-0000-0000-0000-000000000702">
<xsd:annotation>
<xsd:appinfo>
<jaxb:typesafeEnumMember name="ARCHETYPE_SHADOW_MARK"/>
</xsd:appinfo>
</xsd:annotation>
</xsd:enumeration>
<!-- Do we want also these tags? -->
<xsd:enumeration value="00000000-0000-0000-0000-000000000710">
<xsd:annotation>
Expand Down Expand Up @@ -19764,4 +19802,47 @@
<xsd:element name="selector" type="q:SearchFilterType" minOccurs="0" />
</xsd:sequence>
</xsd:complexType>

<xsd:complexType name="OperationPolicyConfigurationType">
<xsd:sequence>
<xsd:element name="enabled" minOccurs="0" type="xsd:boolean" default="true" />
<xsd:element name="severity" minOccurs="0" type="tns:ValidationIssueSeverityType" />
</xsd:sequence>
</xsd:complexType>


<xsd:complexType name="SynchronizeOperationPolicyConfigurationType">
<xsd:sequence>
<xsd:element name="inbound" type="tns:OperationPolicyConfigurationType" minOccurs="0" />
<xsd:element name="outbound" type="tns:OperationPolicyConfigurationType" minOccurs="0" />
</xsd:sequence>
</xsd:complexType>

<xsd:complexType name="ObjectOperationPolicyType">
<xsd:annotation>
<xsd:documentation>
Shadow specific provisioning policy. This policy is applied to concrete shadows using TagType.
</xsd:documentation>
<xsd:appinfo>
<a:container>true</a:container>
<a:since>4.7</a:since>
<a:experimental>true</a:experimental>
</xsd:appinfo>
</xsd:annotation>
<xsd:sequence>
<!--
If false: (like protected)
Inbound / outbound mapping changes are disabled
do not run clockwork (SynchronizationServiceImpl)
do not run inbounds
do not run outbounds
-->

<xsd:element name="synchronize" type="tns:SynchronizeOperationPolicyConfigurationType" minOccurs="0" />
<xsd:element name="add" type="tns:OperationPolicyConfigurationType" minOccurs="0" />
<xsd:element name="modify" type="tns:OperationPolicyConfigurationType" minOccurs="0" />
<xsd:element name="delete" type="tns:OperationPolicyConfigurationType" minOccurs="0" />
</xsd:sequence>
</xsd:complexType>

</xsd:schema>
72 changes: 0 additions & 72 deletions infra/schema/src/main/resources/xml/ns/public/common/common-provisioning-3.xsd
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4295,26 +4295,6 @@
</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="policyStatement" type="tns:PolicyStatementType" minOccurs="0" maxOccurs="unbounded">
<xsd:annotation>
<xsd:documentation>
Policy statements to manually add or exclude effective marks of shadow.
</xsd:documentation>
<xsd:appinfo>
<a:experimental>true</a:experimental>
</xsd:appinfo>
</xsd:annotation>
</xsd:element>
<xsd:element name="effectiveProvisioningPolicy" type="tns:EffectiveShadowProvisioningPolicyType" minOccurs="0">
<xsd:annotation>
<xsd:documentation>
Effective provisioning policy derived from Shadow marks and resource configuration.
</xsd:documentation>
<xsd:appinfo>
<a:experimental>true</a:experimental>
</xsd:appinfo>
</xsd:annotation>
</xsd:element>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
Expand Down Expand Up @@ -5584,56 +5564,4 @@
<!-- inheritance options may be included later -->
</xsd:sequence>
</xsd:complexType>

<xsd:complexType name="ShadowProvisioningPolicyType">
<xsd:annotation>
<xsd:documentation>
Shadow specific provisioning policy. This policy is applied to concrete shadows using TagType.
</xsd:documentation>
<xsd:appinfo>
<a:container>true</a:container>
<a:since>4.7</a:since>
<a:experimental>true</a:experimental>
</xsd:appinfo>
</xsd:annotation>
<xsd:sequence>
<xsd:element name="protected" type="xsd:boolean" minOccurs="0" default="false">
<xsd:annotation>
<xsd:documentation>
Protected shadows cannot be changed. They are out of IDM control.
This is only informational property. Changing it will have no effect on
whether object is protected or not. Object protection is a strict policy that
cannot be easily overridden.
</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="readOnly" type="xsd:boolean" minOccurs="0" default="false" />
</xsd:sequence>
</xsd:complexType>

<xsd:complexType name="EffectiveShadowProvisioningPolicyType">
<xsd:annotation>
<xsd:documentation>
Shadow specific provisioning policy. This policy is applied to concrete shadows using TagType.
</xsd:documentation>
<xsd:appinfo>
<a:container>true</a:container>
<a:since>4.7</a:since>
<a:experimental>true</a:experimental>
</xsd:appinfo>
</xsd:annotation>
<xsd:sequence>
<xsd:element name="protected" type="xsd:boolean" minOccurs="1" default="false">
<xsd:annotation>
<xsd:documentation>
Protected shadows cannot be changed. They are out of IDM control.
This is only informational property. Changing it will have no effect on
whether object is protected or not. Object protection is a strict policy that
cannot be easily overridden.
</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="readOnly" type="xsd:boolean" minOccurs="1" default="false" />
</xsd:sequence>
</xsd:complexType>
</xsd:schema>
4 changes: 3 additions & 1 deletion ...model-impl/src/main/java/com/evolveum/midpoint/model/impl/lens/LensProjectionContext.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,7 @@

import com.evolveum.midpoint.common.crypto.CryptoUtil;
import com.evolveum.midpoint.prism.util.ObjectDeltaObject;
import com.evolveum.midpoint.repo.common.ShadowMarkManager;
import com.evolveum.midpoint.task.api.Task;
import com.evolveum.midpoint.util.DebugUtil;

Expand Down Expand Up @@ -1903,6 +1904,7 @@ public boolean isAdministrativeStatusSupported() throws SchemaException, Configu
}

public boolean isMarkedReadOnly() {
return Boolean.TRUE.equals(getObjectCurrentOrOld().asObjectable().getEffectiveProvisioningPolicy().isReadOnly());
var policy = ShadowMarkManager.get().computeEffectivePolicy(getObjectCurrentOrOld().asObjectable(), new OperationResult("markReadOnly"));
return !policy.getAdd().isEnabled() && !policy.getModify().isEnabled() && !policy.getDelete().isEnabled();
}
}
4 changes: 4 additions & 0 deletions ...odel-impl/src/main/java/com/evolveum/midpoint/model/impl/sync/SynchronizationContext.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -193,6 +193,10 @@ boolean isSynchronizationEnabled() {
&& synchronizationPolicy.isSynchronizationEnabled();
}

public boolean isMarkedSkipSynchronization() {
return !shadowedResourceObject.getEffectiveOperationPolicy().getSynchronize().getInbound().isEnabled();
}

public boolean isProtected() {
return BooleanUtils.isTrue(shadowedResourceObject.isProtectedObject());
}
Expand Down
13 changes: 13 additions & 0 deletions ...-impl/src/main/java/com/evolveum/midpoint/model/impl/sync/SynchronizationServiceImpl.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -230,6 +230,19 @@ private boolean shouldSkipSynchronization(SynchronizationContext<?> syncCtx, Ope
return true;
}

if (syncCtx.isMarkedSkipSynchronization()) {
String message = String.format(
"SYNCHRONIZATION is skipped for marked shadow %s, ignoring change from channel %s", shadow, channel);
LOGGER.debug(message);
syncCtx.getUpdater()
.updateBothSyncTimestamps() // TODO should we really record this as full synchronization?
.updateCoordinatesIfMissing();
result.recordNotApplicable(message);
syncCtx.recordSyncExclusionInTask(PROTECTED);
return true;
}


if (syncCtx.isProtected()) {
String message = String.format(
"SYNCHRONIZATION is skipped for protected shadow %s, ignoring change from channel %s", shadow, channel);
Expand Down

0 comments on commit fd1ca5f

Please sign in to comment.