[JBoss JIRA] Created: (JBPORTAL-1707) New UserModule/RoleModule finders
by Andrew Oliver (JIRA)
New UserModule/RoleModule finders
---------------------------------
Key: JBPORTAL-1707
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1707
Project: JBoss Portal
Issue Type: Feature Request
Security Level: Public (Everyone can see)
Components: Portal Security
Affects Versions: 2.6.1 Final
Reporter: Andrew Oliver
Assigned To: Julien Viet
While working with clients using the portal API some efficiency issues with regards to finders have become apparent:
It is presently possible to find users having a role by calling MembershipModule.getUsers(role). However it is not possible to get a list of users with a set of roles, a list of users who do NOT have a role or set of roles. (there are ways in both HQL and LDAP to construct each type of query). I suggest something similar to hibernate conditions.
MembershipModule.getUsers().addCondition(
Condition.and(
Condition.not(roleSet), Condition.with(roleSet)
)
)
this would result in roughly:
from Users where roles in (:roleSet) and roles not in (:roleSet2)
and something like
(& (|(role=roleName)(role=roleName) )
(&(!role=roleName)(!role=roleName) )
)
in LDAP
the attribute name can be based on the type. As it stands you have to do something like:
try {
Role roleApproved = rolemodule.findRoleByName("approved");
Role roleUsers = rolemodule.findRoleByName("User");
//todo create transient wrapper set.
Set users = membership.getUsers(roleUsers);
dirtyStinkyHackToGetAroundPortalAPIBugACO(users);
System.err.println("Total number of users with User Role : " + users.size() );
Set temp = new HashSet();
temp = dirtyStinkyHackToGetAroundPortalAPIBugACO(users); //because the hibernate set doesn't have removeall
users = temp;
Set usersApproved = membership.getUsers(roleApproved);
System.err.println("number of users with approved role: "+usersApproved.size());
users.removeAll(usersApproved);
System.err.println("Total number of users with User Role and NO approved role : " + users.size() );
Map profiles = profiles(users);
response.setRenderParameter("op", "new");
request.getPortletSession().setAttribute("users", users);
request.getPortletSession().setAttribute("profiles", profiles);
} catch (IdentityException e) {
//todo type this and catch it up higher to make a
//smarter error message
throw new RuntimeException(e);
}
private Map profiles(Set users) throws IdentityException {
Iterator i = users.iterator();
Map retval = new HashMap();
while(i.hasNext()) {
User user = (User) i.next();
retval.put(user, profileModule.getProperties(user));
}
return retval;
}
private Set dirtyStinkyHackToGetAroundPortalAPIBugACO(Set users) {
Iterator i = users.iterator();
Set retval = new HashSet();
while(i.hasNext()) {
User u = (User)i.next();
u.getUserName();
retval.add(u);
}
return retval;
}
Just to get the list of users who DONT have the "approved" role. For our immediate needs:
UserModule.getUsersWithout(role) would work...until next time.
-Andy
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
14 years, 6 months
[JBoss JIRA] Created: (JBPORTAL-1708) Identity APIs should invalidate cache on update/change of role membership
by Andrew Oliver (JIRA)
Identity APIs should invalidate cache on update/change of role membership
-------------------------------------------------------------------------
Key: JBPORTAL-1708
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1708
Project: JBoss Portal
Issue Type: Bug
Security Level: Public (Everyone can see)
Components: Portal Identity
Affects Versions: 2.6.1 Final
Reporter: Andrew Oliver
Consider this code:
String username = request.getParameter("username");
User user= usermodule.findUserByUserName(username);
System.err.println("user was equal to "+(user == null ? "null" : user.getUserName()));
Role role = rolemodule.findRoleByName("approved");
Set users = new HashSet();
users.add(user);
membership.assignUsers(role, users);
And this code:
Role roleApproved = rolemodule.findRoleByName("approved");
Set usersApproved = membership.getUsers(roleApproved);
With the default Hibernate settings for identity in server\default\deploy\jboss-portal.sar\conf\hibernate\user\hibernate.cfg.xml:
<property name="cache.use_second_level_cache">true</property>
<property name="cache.use_query_cache">true</property>
The second bit of code doesn't see changes by the first bit of code until the portal is restarted (it seems).
Switching these to false solves the problem. It is likely that this is due to the HibernateMembershipModuleImpl and the <set
name="roles"
table="jbp_role_membership"
lazy="false"
inverse="false"
cascade="none"
sort="unsorted">
<cache usage="read-write"/>
<key column="jbp_uid"/>
<many-to-many
class="org.jboss.portal.identity.db.HibernateRoleImpl"
column="jbp_rid"
outer-join="true"/>
</set>
which specifies a cached collection and in http://viewvc.jboss.org/cgi-bin/viewvc.cgi/portal/branches/JBoss_Portal_B...
public void assignRoles(User user, Set roles) throws IdentityException
{
//throw new UnsupportedOperationException("Not yet implemented");
if (!(user instanceof HibernateUserImpl))
{
throw new IllegalArgumentException("User is not a HibernateUserImpl user");
}
// We make a defensive copy with unwrapped maps and update with a new set
Set copy = new HashSet();
for (Iterator i = roles.iterator(); i.hasNext();)
{
Object o = i.next();
if (o instanceof HibernateRoleImpl)
{
copy.add(o);
}
else
{
throw new IllegalArgumentException("Only HibernateRoleImpl roles can be accepted");
}
}
// Assign new roles
HibernateUserImpl ui = (HibernateUserImpl)user;
ui.setRoles(copy);
}
The defensive copy which avoids the hibernate collection probably prevents triggering of the cache invalidation logic in the many-many relationship (not 100% sure that this is how hibernate works for collection caching but it seems logical).
The hibernate membership module's usage of hibernate is a bit odd and probably needs review anyhow.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
14 years, 6 months
[JBoss JIRA] Created: (JBPORTAL-1493) Separate internal configuration state (DB / LDAP) from the exposed meta data of the property
by Julien Viet (JIRA)
Separate internal configuration state (DB / LDAP) from the exposed meta data of the property
--------------------------------------------------------------------------------------------
Key: JBPORTAL-1493
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1493
Project: JBoss Portal
Issue Type: Task
Security Level: Public (Everyone can see)
Components: Portal Identity
Reporter: Julien Viet
Assigned To: Boleslaw Dawidowicz
Fix For: 2.8 Final
For example :
public String getName();
public String getType();
public String getAccessMode();
public String getUsage();
public LocalizedString getDisplayName();
public LocalizedString getDescription();
is what client of the API will care about.
public String getMappingDBType();
public String getMappingLDAPValue();
public String getMappingDBValue();
public boolean isMappedDB();
public boolean isMappedLDAP();
is an internal implementation detail that the client should not know about, as it is part of the configuration of the property, not the usage.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
14 years, 6 months