import org.wso2.carbon.user.core.UserStoreException; //导入依赖的package包/类
/**
 * This method is overridden to clear caches on doPostAddRole operation
 *
 * @param roleName         Name of the added role
 * @param userList         List of the users who got added the role
 * @param permissions      set of permissions
 * @param userStoreManager UserStoreManager instance got called
 * @return Always Returns true, since no major effect on further procedures
 * @throws org.wso2.carbon.user.core.UserStoreException
 */
@Override
public boolean doPostAddRole(String roleName, String[] userList, Permission[] permissions,
                             UserStoreManager userStoreManager) throws UserStoreException {
    if (!isEnable()) {
        return true;
    }

    if (log.isDebugEnabled()) {
        log.debug("Clearing entitlement cache on post add role operation for role " +
                  roleName);
    }
    clearCarbonAttributeCache();
    // Always returns true since cache clearing failure does not make an effect on subsequent
    // User Operation Listeners
    return true;
}
 

import org.wso2.carbon.user.core.UserStoreException; //导入依赖的package包/类
/**
 * List users with given claim value and permission
 *
 * @param claimValue claim to check
 * @param filter     filter to check
 * @param permission permission to check
 * @param maxLimit
 * @return
 * @throws UserAdminException
 */
public FlaggedName[] listUserByClaimWithPermission(ClaimValue claimValue, String filter, String permission, int
        maxLimit)
        throws UserAdminException {

    List<FlaggedName> permittedUsers = new ArrayList<>();
    try {
        org.wso2.carbon.user.api.UserRealm realm = UserMgtDSComponent.getRealmService().getTenantUserRealm
                (PrivilegedCarbonContext.getThreadLocalCarbonContext().getTenantId());
        AuthorizationManager authorizationManager = realm.getAuthorizationManager();
        FlaggedName[] users = getUserAdminProxy().listUsers(claimValue, filter, maxLimit);
        for (int i = 0; i < users.length - 1; i++) {
            if (authorizationManager.isUserAuthorized(users[i].getItemName(),
                    permission, UserMgtConstants.EXECUTE_ACTION)) {
                permittedUsers.add(users[i]);
            }
        }
    } catch (org.wso2.carbon.user.api.UserStoreException e) {
        throw new UserAdminException("Error while filtering authorized users.", e);
    }
    FlaggedName[] permittedUsersArray = new FlaggedName[permittedUsers.size()];
    return permittedUsers.toArray(permittedUsersArray);
}
 

import org.wso2.carbon.user.core.UserStoreException; //导入依赖的package包/类
public static String preparePassword(String password, String saltValue) throws UserStoreException {
    try {
        String digestInput = password;
        if (saltValue != null) {
            digestInput = password + saltValue;
        }
        String digsestFunction = Util.getRealmConfig().getUserStoreProperties()
                .get(JDBCRealmConstants.DIGEST_FUNCTION);
        if (digsestFunction != null) {

            if (digsestFunction.equals(UserCoreConstants.RealmConfig.PASSWORD_HASH_METHOD_PLAIN_TEXT)) {
                return password;
            }

            MessageDigest dgst = MessageDigest.getInstance(digsestFunction);
            byte[] byteValue = dgst.digest(digestInput.getBytes(Charset.forName("UTF-8")));
            password = Base64.encode(byteValue);
        }
        return password;
    } catch (NoSuchAlgorithmException e) {
        log.error(e.getMessage(), e);
        throw new UserStoreException(e.getMessage(), e);
    }
}
 

import org.wso2.carbon.user.core.UserStoreException; //导入依赖的package包/类
/**
 * @param roleName         Old role name of the updating role
 * @param newRoleName      New role name of the updating role name
 * @param userStoreManager UserStoreManager instance got called
 * @return Always returns true since no major effect on further procedure.
 * @throws org.wso2.carbon.user.core.UserStoreException
 */
@Override
public boolean doPostUpdateRoleName(String roleName, String newRoleName,
                                    UserStoreManager userStoreManager) throws
                                                                       UserStoreException {
    if (!isEnable()) {
        return true;
    }

    if (log.isDebugEnabled()) {
        log.debug("Clearing entitlement cache on post update role operation for role " +
                  roleName);
    }
    clearCarbonAttributeCache();
    // Always returns true since cache clearing failure does not make an effect on subsequent
    // User Operation Listeners
    return true;
}
 

import org.wso2.carbon.user.core.UserStoreException; //导入依赖的package包/类
/**
 * Checks whether the given user name is admin user name and the currently logged in user also admin.
 * Only admin user is allowed for admin user profile related operations.
 *
 * @param username Username to be checked.
 * @return True only if admin user.
 * @throws UserStoreException Error occurred while retrieving realm configuration.
 */
private boolean isAdminProfileSpoof(String username) throws UserStoreException {

    if (StringUtils.isEmpty(username)) {
        return false;
    }

    RealmConfiguration realmConfiguration = getUserRealm().getRealmConfiguration();
    String adminUsername = IdentityUtil.addDomainToName(realmConfiguration.getAdminUserName(),
            IdentityUtil.getPrimaryDomainName());
    String targetUsername = IdentityUtil.addDomainToName(username, IdentityUtil.getPrimaryDomainName());

    // If the given user name is not the admin username, simply we can allow and return false. Our intention is to
    // check whether a non admin user is trying to do operations on an admin profile.
    if (!StringUtils.equalsIgnoreCase(targetUsername, adminUsername)) {
        return false;
    }

    String loggedInUsername = CarbonContext.getThreadLocalCarbonContext().getUsername();
    if (loggedInUsername != null) {
        loggedInUsername = IdentityUtil.addDomainToName(loggedInUsername, IdentityUtil.getPrimaryDomainName());
    }

    // If the currently logged in user is also the admin user this isn't a spoof attempt. Hence returning false.
    return !StringUtils.equalsIgnoreCase(loggedInUsername, adminUsername);
}
 

import org.wso2.carbon.user.core.UserStoreException; //导入依赖的package包/类
/**
 * Overridden to trigger Notification Sending module to send messages to registered modules
 * on PostUpdateRoleListOfUser
 *
 * @param username         Username of role updated user
 * @param deletedRoles     List of roles deleted
 * @param newRoles         list of roles added
 * @param userStoreManager Instance of user store manager called
 * @return always returns true since no major effect on further operations.
 * @throws org.wso2.carbon.user.core.UserStoreException
 */
public boolean doPostUpdateRoleListOfUser(String username,
                                          String[] deletedRoles, String[] newRoles,
                                          UserStoreManager userStoreManager)
        throws UserStoreException {
    if (!isEnable()) {
        return true;
    }

    if (log.isDebugEnabled()) {
        log.debug("Sending user role list update notification for user " + username);
    }
    sendNotification(EVENT_TYPE_ROLE_UPDATE, username);
    // Returns true since no major effect on upcoming listeners
    return true;
}
 

import org.wso2.carbon.user.core.UserStoreException; //导入依赖的package包/类
@Test
public void testLocalIsExistingUserException() throws Exception {

    initCommonMocks();
    setMockHttpSession();
    setMockAuthenticationContext();
    setMockIWAAuthenticationUtil();
    setMockUserCoreUtil();

    mockSession.setAttribute(IWAConstants.KERBEROS_TOKEN, Base64.encode(token));
    when(IWAAuthenticationUtil.processToken(any(byte[].class))).thenReturn("[email protected]");
    when(mockUserStoreManager.isExistingUser(anyString())).thenThrow(new UserStoreException());

    try {
        iwaLocalAuthenticator.processAuthenticationResponse(
                mockHttpRequest, mockHttpResponse, mockAuthenticationContext);
        Assert.fail("Response processed with user store exception");
    } catch (AuthenticationFailedException e) {
        Assert.assertTrue(e.getMessage().contains("IWALocalAuthenticator failed to find the user in the userstore"));
    }
}
 

import org.wso2.carbon.user.core.UserStoreException; //导入依赖的package包/类
/**
 * TThis method is overridden to clear caches on doPostDeleteUserClaimValues operation
 *
 * @param userName         username
 * @param userStoreManager UserStoreManagerClass
 * @return Returns true always since no major effect on further procedures
 * @throws org.wso2.carbon.user.core.UserStoreException
 */
@Override
public boolean doPostDeleteUserClaimValues(String userName,
                                           UserStoreManager userStoreManager) throws
                                                                              UserStoreException {
    if (!isEnable()) {
        return true;
    }

    if (log.isDebugEnabled()) {
        log.debug("Clearing entitlement cache on post delete user claim values operation for " +
                  "user " + userName);
    }
    // Always returns true since cache clearing failure does not make an effect on subsequent
    // User Operation Listeners
    clearCarbonAttributeCache();
    return true;
}
 

import org.wso2.carbon.user.core.UserStoreException; //导入依赖的package包/类
/**
 * This method is overridden to clear caches on doPostDeleteUserClaimValue operation
 *
 * @param userName         username
 * @param userStoreManager UserStoreManagerClass
 * @return Always Returns true, since no major effect on further procedures
 * @throws org.wso2.carbon.user.core.UserStoreException
 */
@Override
public boolean doPostDeleteUserClaimValue(String userName, UserStoreManager userStoreManager)
        throws UserStoreException {
    if (!isEnable()) {
        return true;
    }

    if (log.isDebugEnabled()) {
        log.debug("Clearing entitlement cache on post delete user claim value operation for " +
                  "user " + userName);
    }
    // Always returns true since cache clearing failure does not make an effect on subsequent
    // User Operation Listeners
    clearCarbonAttributeCache();
    return true;
}
 

import org.wso2.carbon.user.core.UserStoreException; //导入依赖的package包/类
public boolean doPostAddUser(String userName, Object credential, String[] roleList, Map<String, String> claims,
                             String profile, UserStoreManager userStoreManager) throws UserStoreException {

    if(!isEnable()) {
        return true;
    }

    StringBuilder builder = new StringBuilder();
    if (roleList != null) {
        for (int i = 0; i < roleList.length; i++) {
            builder.append(roleList[i] + ",");
        }
    }
    audit.info(String.format(AUDIT_MESSAGE, getUser(), "Add User", userName, "Roles :"
            + builder.toString(), SUCCESS));
    return true;
}
 

import org.wso2.carbon.user.core.UserStoreException; //导入依赖的package包/类
public boolean isAddProfileEnabledForDomain(String domain) throws UserProfileException {

        org.wso2.carbon.user.core.UserStoreManager userStoreManager = null;
        org.wso2.carbon.user.core.UserRealm realm = getUserRealm();
        boolean isAddProfileEnabled = false;

        try {
            if (StringUtils.isBlank(domain) || StringUtils.equals(domain, UserCoreConstants.PRIMARY_DEFAULT_DOMAIN_NAME)) {
                userStoreManager = realm.getUserStoreManager();
            } else {
                userStoreManager = realm.getUserStoreManager().getSecondaryUserStoreManager(domain);
            }

        } catch (UserStoreException e) {
            String errorMessage = "Error in obtaining SecondaryUserStoreManager.";
            log.error(errorMessage, e);
            throw new UserProfileException(errorMessage, e);
        }

        if (userStoreManager != null) {
            isAddProfileEnabled = userStoreManager.isMultipleProfilesAllowed();
        }

        return isAddProfileEnabled;
    }
 

import org.wso2.carbon.user.core.UserStoreException; //导入依赖的package包/类
/**
 * Overridden to trigger Notification Sending module to send messages to registered modules
 * on doPostDeleteUserClaimValues
 *
 * @param username         Username of the deleted user
 * @param userStoreManager Instance of user store manager called
 * @return Always returns true, even if message sending fails there is no major effect on
 * further operations.
 * @throws org.wso2.carbon.user.core.UserStoreException
 */
@Override
public boolean doPostDeleteUserClaimValues(String username, UserStoreManager userStoreManager)
        throws UserStoreException {

    if (!isEnable()) {
        return true;
    }

    if (log.isDebugEnabled()) {
        log.debug("Sending user claim value update notification for user " + username);
    }
    sendNotification(EVENT_TYPE_PROFILE_UPDATE, username);
    // Returns true since no major effect on upcoming listeners
    return true;
}
 

import org.wso2.carbon.user.core.UserStoreException; //导入依赖的package包/类
/**
 * This method is overridden to clear caches on doPostDeleteRole operation
 *
 * @param roleName         Deleted role name
 * @param userStoreManager UserStoreManagerClass
 * @return Always Returns true, since no major effect on further procedures
 * @throws org.wso2.carbon.user.core.UserStoreException
 */
@Override
public boolean doPostDeleteRole(String roleName, UserStoreManager userStoreManager) throws
                                                                                    UserStoreException {
    if (!isEnable()) {
        return true;
    }

    if (log.isDebugEnabled()) {
        log.debug("Clearing entitlement cache on post delete role operation for role " +
                  roleName);
    }
    clearCarbonAttributeCache();
    // Always returns true since cache clearing failure does not make an effect on subsequent
    // User Operation Listeners
    return true;
}
 

import org.wso2.carbon.user.core.UserStoreException; //导入依赖的package包/类
private Collection<String> getRolesToAdd(UserStoreManager userStoreManager, String[] newRoles)
        throws UserStoreException {

    List<String> rolesToAdd = Arrays.asList(newRoles);
    List<String> updatedRolesToAdd = new ArrayList<>();

    // Make Internal domain name case insensitive
    for (String role : rolesToAdd) {
        if (StringUtils.containsIgnoreCase(role, UserCoreConstants.INTERNAL_DOMAIN +
                CarbonConstants.DOMAIN_SEPARATOR)) {
            updatedRolesToAdd.add(UserCoreConstants.INTERNAL_DOMAIN + CarbonConstants.DOMAIN_SEPARATOR +
                    UserCoreUtil.removeDomainFromName(role));
        } else {
            updatedRolesToAdd.add(role);
        }
    }
    List<String> allExistingRoles = removeDomainFromNamesExcludeInternal(
            Arrays.asList(userStoreManager.getRoleNames()), userStoreManager.getTenantId());
    updatedRolesToAdd.retainAll(allExistingRoles);
    return updatedRolesToAdd;
}
 

import org.wso2.carbon.user.core.UserStoreException; //导入依赖的package包/类
private void handleFederatedUserNameEqualsToSuperAdminUserName(UserRealm realm, String username,
                                                               UserStoreManager userStoreManager,
                                                               Collection<String> deletingRoles)
        throws UserStoreException, FrameworkException {
    if (userStoreManager.getRealmConfiguration().isPrimary()
        && username.equals(realm.getRealmConfiguration().getAdminUserName())) {
        if (log.isDebugEnabled()) {
            log.debug("Federated user's username is equal to super admin's username of local IdP.");
        }

        // Whether superadmin login without superadmin role is permitted
        if (deletingRoles
                .contains(realm.getRealmConfiguration().getAdminRoleName())) {
            if (log.isDebugEnabled()) {
                log.debug("Federated user doesn't have super admin role. Unable to sync roles, since" +
                          " super admin role cannot be unassigned from super admin user");
            }
            throw new FrameworkException(
                    "Federated user which having same username to super admin username of local IdP," +
                    " trying login without having super admin role assigned");
        }
    }
}
 

import org.wso2.carbon.user.core.UserStoreException; //导入依赖的package包/类
/**
 * TThis method is overridden to clear caches on doPostDeleteUser operation
 *
 * @param userName         username
 * @param userStoreManager UserStoreManagerClass
 * @return Returns true always since no major effect on further procedures
 * @throws org.wso2.carbon.user.core.UserStoreException
 */
@Override
public boolean doPostDeleteUser(String userName, UserStoreManager userStoreManager) throws
                                                                                    UserStoreException {
    if (!isEnable()) {
        return true;
    }

    if (log.isDebugEnabled()) {
        log.debug("Clearing entitlement cache on post delete user operation for user " +
                  userName);
    }
    clearCarbonAttributeCache();
    // Always returns true since cache clearing failure does not make an effect on subsequent
    // User Operation Listeners
    return true;
}
 

import org.wso2.carbon.user.core.UserStoreException; //导入依赖的package包/类
/**
 * Gets the regular expression which defines the format of the service principle, password.
 *
 * @return Regular expression.
 * @throws DirectoryServerManagerException If unable to get RealmConfiguration.
 */
public String getPasswordConformanceRegularExpression() throws DirectoryServerManagerException {

    try {
        RealmConfiguration userStoreConfigurations = this.getUserRealm().getRealmConfiguration();
        if (userStoreConfigurations != null) {
            String passwordRegEx = userStoreConfigurations.getUserStoreProperty(
                    LDAPServerManagerConstants.SERVICE_PASSWORD_REGEX_PROPERTY);
            if (passwordRegEx == null) {
                return LDAPServerManagerConstants.DEFAULT_PASSWORD_REGULAR_EXPRESSION;
            } else {
                log.info("Service password format is " + passwordRegEx);
                return passwordRegEx;
            }
        }
    } catch (UserStoreException e) {
        log.error("Unable to retrieve service password format.", e);
        throw new DirectoryServerManagerException("Unable to retrieve service password format.", e);
    }

    return LDAPServerManagerConstants.DEFAULT_PASSWORD_REGULAR_EXPRESSION;
}
 

import org.wso2.carbon.user.core.UserStoreException; //导入依赖的package包/类
/**
 * Gets the regular expression which defines the format of the service principle.
 * Current we use following like format,
 * ftp/localhost
 *
 * @return Service principle name format as a regular expression.
 * @throws DirectoryServerManagerException If unable to retrieve RealmConfiguration.
 */
public String getServiceNameConformanceRegularExpression() throws DirectoryServerManagerException {

    try {
        RealmConfiguration userStoreConfigurations = this.getUserRealm().getRealmConfiguration();
        if (userStoreConfigurations != null) {
            String serviceNameRegEx = userStoreConfigurations.getUserStoreProperty(
                    LDAPServerManagerConstants.SERVICE_PRINCIPLE_NAME_REGEX_PROPERTY);
            if (serviceNameRegEx == null) {
                return LDAPServerManagerConstants.DEFAULT_SERVICE_NAME_REGULAR_EXPRESSION;
            } else {
                log.info("Service name format is " + serviceNameRegEx);
                return serviceNameRegEx;
            }
        }
    } catch (UserStoreException e) {
        log.error("Unable to retrieve service name format.", e);
        throw new DirectoryServerManagerException("Unable to retrieve service name format.", e);
    }

    return LDAPServerManagerConstants.DEFAULT_SERVICE_NAME_REGULAR_EXPRESSION;
}
 

import org.wso2.carbon.user.core.UserStoreException; //导入依赖的package包/类
public UserRealm getUserRealm(RealmConfiguration tenantRealmConfig) throws UserStoreException {
    int tenantId = tenantRealmConfig.getTenantId();
    if (tenantId == -1234) {
        return this.bootstrapRealm;
    } else {
        UserRealm userRealm = (UserRealm) this.userRealmMap.get(Integer.valueOf(tenantId));
        if (userRealm == null) {
            userRealm = this.initializeRealm(tenantRealmConfig, tenantId);
            this.userRealmMap.put(Integer.valueOf(tenantId), userRealm);
        } else {
            long existingRealmPersistedTime = -1L;
            long newRealmConfigPersistedTime = -1L;
            if (userRealm.getRealmConfiguration().getPersistedTimestamp() != null) {
                existingRealmPersistedTime = userRealm.getRealmConfiguration().getPersistedTimestamp().getTime();
            }

            if (tenantRealmConfig.getPersistedTimestamp() != null) {
                newRealmConfigPersistedTime = tenantRealmConfig.getPersistedTimestamp().getTime();
            }

            if (existingRealmPersistedTime != newRealmConfigPersistedTime) {
                userRealm = this.initializeRealm(tenantRealmConfig, tenantId);
                this.userRealmMap.put(Integer.valueOf(tenantId), userRealm);
            }
        }

        return userRealm;
    }
}
 

import org.wso2.carbon.user.core.UserStoreException; //导入依赖的package包/类
public boolean doPreUpdateCredentialByAdmin(String userName, Object newCredential, UserStoreManager
        userStoreManager) throws UserStoreException {

    if(!isEnable()) {
        return true;
    }

    audit.info(String.format(AUDIT_MESSAGE, getUser(), "Change Password by Administrator",
            userName, "", SUCCESS));
    return true;
}