import org.kuali.rice.kim.api.identity.Person; //导入依赖的package包/类
private ActionTakenValue createDummyActionTaken(DocumentRouteHeaderValue routeHeader, Person userToPerformAction, String actionToPerform, Recipient delegator) {
      ActionTakenValue val = new ActionTakenValue();
      val.setActionTaken(actionToPerform);
      if (KewApiConstants.ACTION_TAKEN_ROUTED_CD.equals(actionToPerform)) {
          val.setActionTaken(KewApiConstants.ACTION_TAKEN_COMPLETED_CD);
      }
val.setAnnotation("");
val.setDocVersion(routeHeader.getDocVersion());
val.setDocumentId(routeHeader.getDocumentId());
val.setPrincipalId(userToPerformAction.getPrincipalId());

if (delegator != null) {
	if (delegator instanceof KimPrincipalRecipient) {
		val.setDelegatorPrincipalId(((KimPrincipalRecipient) delegator).getPrincipalId());
	} else if (delegator instanceof KimGroupRecipient) {
		Group group = ((KimGroupRecipient) delegator).getGroup();
		val.setDelegatorGroupId(group.getId());
	} else{
		throw new IllegalArgumentException("Invalid Recipient type received: " + delegator.getClass().getName());
	}
}
val.setCurrentIndicator(Boolean.TRUE);
return val;
  }
 

import org.kuali.rice.kim.api.identity.Person; //导入依赖的package包/类
private void transform(EDLContext edlContext, Document dom, HttpServletResponse response) throws Exception {
	if (StringUtils.isNotBlank(edlContext.getRedirectUrl())) {
		response.sendRedirect(edlContext.getRedirectUrl());
		return;
	}
    response.setContentType("text/html; charset=UTF-8");
	Transformer transformer = edlContext.getTransformer();

       transformer.setOutputProperty("indent", "yes");
       transformer.setOutputProperty(OutputKeys.INDENT, "yes");
       String user = null;
       String loggedInUser = null;
       if (edlContext.getUserSession() != null) {
           Person wu = edlContext.getUserSession().getPerson();
           if (wu != null) user = wu.getPrincipalId();
           wu = edlContext.getUserSession().getPerson();
           if (wu != null) loggedInUser = wu.getPrincipalId();
       }
       transformer.setParameter("user", user);
       transformer.setParameter("loggedInUser", loggedInUser);
       if (LOG.isDebugEnabled()) {
       	LOG.debug("Transforming dom " + XmlJotter.jotNode(dom, true));
       }
       transformer.transform(new DOMSource(dom), new StreamResult(response.getOutputStream()));
}
 

import org.kuali.rice.kim.api.identity.Person; //导入依赖的package包/类
/**
 * Gets the person attribute.
 * @return Returns the person.
 */
public Person getPerson() {
    if( (StringUtils.isNotEmpty(principalMemberPrincipalId)
            || StringUtils.isNotEmpty(principalMemberPrincipalName))
            &&
            (person==null || !StringUtils.equals(person.getPrincipalId(), principalMemberPrincipalId) ) ) {
        if ( StringUtils.isNotEmpty(principalMemberPrincipalId) ) {
            person = KimApiServiceLocator.getPersonService().getPerson(principalMemberPrincipalId);
        } else if ( StringUtils.isNotEmpty(principalMemberPrincipalName) ) {
            person = KimApiServiceLocator.getPersonService().getPersonByPrincipalName(principalMemberPrincipalName);
        } else {
            person = null;
        }
        if ( person != null ) {
            principalMemberPrincipalId = person.getPrincipalId();
            principalMemberPrincipalName = person.getPrincipalName();
            principalMemberName = person.getName();
        } else {
            principalMemberPrincipalId = "";
            principalMemberName = "";
        }
    }
    return person;
}
 

import org.kuali.rice.kim.api.identity.Person; //导入依赖的package包/类
/**
 * Test for https://test.kuali.org/jira/browse/KULRICE-1968 - Document search fails when users are missing
 * Tests that we can safely search on docs whose initiator no longer exists in the identity management system
 * This test searches by doc type name criteria.
 * @throws Exception
 */
@Test public void testDocSearch_MissingInitiator() throws Exception {
    String documentTypeName = "SearchDocType";
    DocumentType docType = ((DocumentTypeService)KEWServiceLocator.getService(KEWServiceLocator.DOCUMENT_TYPE_SERVICE)).findByName(documentTypeName);
    String userNetworkId = "arh14";
    // route a document to enroute and route one to final
    WorkflowDocument workflowDocument = WorkflowDocumentFactory.createDocument(getPrincipalId(userNetworkId), documentTypeName);
    workflowDocument.setTitle("testDocSearch_MissingInitiator");
    workflowDocument.route("routing this document.");

    // verify the document is enroute for jhopf
    workflowDocument = WorkflowDocumentFactory.loadDocument(getPrincipalId("jhopf"),workflowDocument.getDocumentId());
    assertTrue(workflowDocument.isEnroute());
    assertTrue(workflowDocument.isApprovalRequested());

    // now nuke the initiator...
    new JdbcTemplate(TestHarnessServiceLocator.getDataSource()).execute("update " + KREW_DOC_HDR_T + " set " + INITIATOR_COL + " = 'bogus user' where DOC_HDR_ID = " + workflowDocument.getDocumentId());


    Person user = KimApiServiceLocator.getPersonService().getPersonByPrincipalName("jhopf");
    DocumentSearchCriteria.Builder criteria = DocumentSearchCriteria.Builder.create();
    criteria.setDocumentTypeName(documentTypeName);
    DocumentSearchResults results = docSearchService.lookupDocuments(user.getPrincipalId(), criteria.build());
    assertEquals("Search returned invalid number of documents", 1, results.getSearchResults().size());
}
 

import org.kuali.rice.kim.api.identity.Person; //导入依赖的package包/类
protected String getPersonInquiryUrlLink(Person user, String linkBody) {
    StringBuffer urlBuffer = new StringBuffer();
    
    if(user != null && StringUtils.isNotEmpty(linkBody) ) {
    	ModuleService moduleService = KRADServiceLocatorWeb.getKualiModuleService().getResponsibleModuleService(Person.class);
    	Map<String, String[]> parameters = new HashMap<String, String[]>();
    	parameters.put(KimConstants.AttributeConstants.PRINCIPAL_ID, new String[] { user.getPrincipalId() });
    	String inquiryUrl = moduleService.getExternalizableBusinessObjectInquiryUrl(Person.class, parameters);
        if(!StringUtils.equals(KimConstants.EntityTypes.SYSTEM, user.getEntityTypeCode())){
         urlBuffer.append("<a href='");
         urlBuffer.append(inquiryUrl);
         urlBuffer.append("' ");
         urlBuffer.append("target='_blank'");
         urlBuffer.append("title='Person Inquiry'>");
         urlBuffer.append(linkBody);
         urlBuffer.append("</a>");
        } else{
        	urlBuffer.append(linkBody);
        }
    }
    
    return urlBuffer.toString();
}
 

import org.kuali.rice.kim.api.identity.Person; //导入依赖的package包/类
/**
 * Generates the messages that warn users that the document has been locked for editing by another user.
 *
 * @param form form instance containing the transactional document data
 */
protected void generatePessimisticLockMessages(TransactionalDocumentFormBase form) {
    Document document = form.getDocument();
    Person user = GlobalVariables.getUserSession().getPerson();

    for (PessimisticLock lock : document.getPessimisticLocks()) {
        if (!lock.isOwnedByUser(user)) {
            String lockDescriptor = StringUtils.defaultIfBlank(lock.getLockDescriptor(), "full");
            String lockOwner = lock.getOwnedByUser().getName();
            String lockTime = RiceConstants.getDefaultTimeFormat().format(lock.getGeneratedTimestamp());
            String lockDate = RiceConstants.getDefaultDateFormat().format(lock.getGeneratedTimestamp());

            GlobalVariables.getMessageMap().putError(KRADConstants.GLOBAL_ERRORS,
                    RiceKeyConstants.ERROR_TRANSACTIONAL_LOCKED, lockDescriptor, lockOwner, lockTime, lockDate);
        }
    }
}
 

import org.kuali.rice.kim.api.identity.Person; //导入依赖的package包/类
public boolean canMaintain(Object dataObject, Person user) {
	Map<String, String> permissionDetails = new HashMap<String, String>(2);
	permissionDetails.put(KimConstants.AttributeConstants.DOCUMENT_TYPE_NAME,
			getDocumentDictionaryService().getMaintenanceDocumentTypeName(
					dataObject.getClass()));
	permissionDetails.put(KRADConstants.MAINTENANCE_ACTN,
			KRADConstants.MAINTENANCE_EDIT_ACTION);
	return !permissionExistsByTemplate(KRADConstants.KNS_NAMESPACE,
			KimConstants.PermissionTemplateNames.CREATE_MAINTAIN_RECORDS,
			permissionDetails)
			|| isAuthorizedByTemplate(
					dataObject,
					KRADConstants.KNS_NAMESPACE,
					KimConstants.PermissionTemplateNames.CREATE_MAINTAIN_RECORDS,
					user.getPrincipalId(), permissionDetails, null);
}
 

import org.kuali.rice.kim.api.identity.Person; //导入依赖的package包/类
public boolean canSuperUserTakeAction(Document document, Person user) {
    if (!document.getDocumentHeader().hasWorkflowDocument()) {
        return false;
    }

    String principalId = user.getPrincipalId();

    String documentTypeId = document.getDocumentHeader().getWorkflowDocument().getDocumentTypeId();
    if (KewApiServiceLocator.getDocumentTypeService().isSuperUserForDocumentTypeId(principalId, documentTypeId)) {
        return true;
    }

    String documentTypeName = document.getDocumentHeader().getWorkflowDocument().getDocumentTypeName();
    List<RouteNodeInstance> routeNodeInstances = document.getDocumentHeader().getWorkflowDocument().getRouteNodeInstances();
    String documentStatus =  document.getDocumentHeader().getWorkflowDocument().getStatus().getCode();
    return KewApiServiceLocator.getDocumentTypeService().canSuperUserApproveSingleActionRequest(
            principalId, documentTypeName, routeNodeInstances, documentStatus);
}
 

import org.kuali.rice.kim.api.identity.Person; //导入依赖的package包/类
/**
    * @see org.kuali.rice.krad.service.PessimisticLockService#releaseAllLocksForUser(java.util.List, org.kuali.rice.kim.api.identity.Person)
    */
   @Override
public void releaseAllLocksForUser(List<PessimisticLock> locks, Person user) {
       for (Iterator<PessimisticLock> iterator = locks.iterator(); iterator.hasNext();) {
           PessimisticLock lock = iterator.next();
           if (lock.isOwnedByUser(user)) {
               try {
                   delete(lock);
               } catch ( RuntimeException ex ) {
               	if ( ex.getCause() != null && ex.getCause().getClass().equals( LegacyDataAdapter.OPTIMISTIC_LOCK_OJB_EXCEPTION_CLASS ) ) {
                       LOG.warn( "Suppressing Optimistic Lock Exception. Document Num: " +  lock.getDocumentNumber());
                   } else {
                       throw ex;
                   }
               }
           }
       }
   }
 

import org.kuali.rice.kim.api.identity.Person; //导入依赖的package包/类
protected void considerBusinessObjectFieldUnmaskAuthorization(Object dataObject, Person user, BusinessObjectRestrictions businessObjectRestrictions, String propertyPrefix, Document document) {
	DataObjectEntry objectEntry = getDataDictionaryService().getDataDictionary().getDataObjectEntry(dataObject.getClass().getName());
	for (String attributeName : objectEntry.getAttributeNames()) {
		AttributeDefinition attributeDefinition = objectEntry.getAttributeDefinition(attributeName);
		if (attributeDefinition.getAttributeSecurity() != null) {
			if (attributeDefinition.getAttributeSecurity().isMask() &&
					!canFullyUnmaskField(user, dataObject.getClass(), attributeName, document)) {
				businessObjectRestrictions.addFullyMaskedField(propertyPrefix + attributeName, attributeDefinition.getAttributeSecurity().getMaskFormatter());
			}
			if (attributeDefinition.getAttributeSecurity().isPartialMask() &&
					!canPartiallyUnmaskField(user, dataObject.getClass(), attributeName, document)) {
				businessObjectRestrictions.addPartiallyMaskedField(propertyPrefix + attributeName, attributeDefinition.getAttributeSecurity().getPartialMaskFormatter());
			}
		}
	}
}
 

import org.kuali.rice.kim.api.identity.Person; //导入依赖的package包/类
@Test public void testDocSearch() throws Exception {
    Person user = KimApiServiceLocator.getPersonService().getPersonByPrincipalName("bmcgough");
    DocumentSearchCriteria.Builder criteria = DocumentSearchCriteria.Builder.create();
    DocumentSearchResults results = null;
    criteria.setTitle("*IN");
    criteria.setSaveName("bytitle");
    results = docSearchService.lookupDocuments(user.getPrincipalId(), criteria.build());
    criteria = DocumentSearchCriteria.Builder.create();
    criteria.setTitle("*IN-CFSG");
    criteria.setSaveName("for in accounts");
    results = docSearchService.lookupDocuments(user.getPrincipalId(), criteria.build());
    criteria = DocumentSearchCriteria.Builder.create();
    criteria.setDateApprovedFrom(new DateTime(2004, 9, 16, 0, 0));
    results = docSearchService.lookupDocuments(user.getPrincipalId(), criteria.build());
    criteria = DocumentSearchCriteria.Builder.create();
    user = KimApiServiceLocator.getPersonService().getPersonByPrincipalName("bmcgough");
    DocumentSearchCriteria savedCriteria = docSearchService.getNamedSearchCriteria(user.getPrincipalId(), "bytitle");
    assertNotNull(savedCriteria);
    assertEquals("bytitle", savedCriteria.getSaveName());
    savedCriteria = docSearchService.getNamedSearchCriteria(user.getPrincipalId(), "for in accounts");
    assertNotNull(savedCriteria);
    assertEquals("for in accounts", savedCriteria.getSaveName());
}
 

import org.kuali.rice.kim.api.identity.Person; //导入依赖的package包/类
public static SimulationActionToTake from(RoutingReportActionToTake actionToTake) {
    if (actionToTake == null) {
        return null;
    }
    SimulationActionToTake simActionToTake = new SimulationActionToTake();
    simActionToTake.setNodeName(actionToTake.getNodeName());
    if (StringUtils.isBlank(actionToTake.getActionToPerform())) {
        throw new IllegalArgumentException("ReportActionToTakeVO must contain an action taken code and does not");
    }
    simActionToTake.setActionToPerform(actionToTake.getActionToPerform());
    if (actionToTake.getPrincipalId() == null) {
        throw new IllegalArgumentException("ReportActionToTakeVO must contain a principalId and does not");
    }
    Principal kPrinc = KEWServiceLocator.getIdentityHelperService().getPrincipal(actionToTake.getPrincipalId());
    Person user = KimApiServiceLocator.getPersonService().getPerson(kPrinc.getPrincipalId());
    if (user == null) {
        throw new IllegalStateException("Could not locate Person for the given id: " + actionToTake.getPrincipalId());
    }
    simActionToTake.setUser(user);
    return simActionToTake;
}
 

import org.kuali.rice.kim.api.identity.Person; //导入依赖的package包/类
public WebFriendlyRecipient(Object recipient) {
 if (recipient instanceof WebFriendlyRecipient) {
        recipientId = ((WebFriendlyRecipient) recipient).getRecipientId();
        displayName = ((WebFriendlyRecipient) recipient).getDisplayName();

    // NOTE: ActionItemDAO code is constructing WebFriendlyRecipient directly w/ Person objects
    // this should probably be changed to return only Recipients from DAO tier to web tier
    } else if(recipient instanceof Person){
    	recipientId = ((Person)recipient).getPrincipalId();
   	displayName = ((Person)recipient).getLastName() + ", " + ((Person)recipient).getFirstName();

    } else if(recipient instanceof KimGroupRecipient){
        recipientId = ((KimGroupRecipient)recipient).getGroupId();
        displayName = ((KimGroupRecipient)recipient).getGroup().getNamespaceCode() + ":" + ((KimGroupRecipient)recipient).getGroup().getName();

    }else {
   	throw new IllegalArgumentException("Must pass in type Recipient or Person");
   }
}
 

import org.kuali.rice.kim.api.identity.Person; //导入依赖的package包/类
/**
 * Test for https://test.kuali.org/jira/browse/KULRICE-1968 - Document search fails when users are missing
 * Tests that we can safely search on docs whose initiator no longer exists in the identity management system
 * This test searches by doc type name criteria.
 * @throws Exception
 */
@Test public void testDocSearchSecurityPermissionDocType() throws Exception {
    String documentTypeName = "SecurityDoc_PermissionOnly";
    String userNetworkId = "arh14";
    // route a document to enroute and route one to final
    WorkflowDocument workflowDocument = WorkflowDocumentFactory.createDocument(getPrincipalId(userNetworkId), documentTypeName);
    workflowDocument.setTitle("testDocSearch_PermissionSecurity");
    workflowDocument.route("routing this document.");

    Person user = KimApiServiceLocator.getPersonService().getPersonByPrincipalName("edna");
    DocumentSearchCriteria.Builder criteria = DocumentSearchCriteria.Builder.create();
    criteria.setDocumentTypeName(documentTypeName);
    DocumentSearchResults results = docSearchService.lookupDocuments(user.getPrincipalId(), criteria.build());
    assertEquals(0, results.getNumberOfSecurityFilteredResults());
    assertEquals("Search returned invalid number of documents", 1, results.getSearchResults().size());
}
 

import org.kuali.rice.kim.api.identity.Person; //导入依赖的package包/类
/**
 * Test method for {@link org.kuali.rice.kim.impl.identity.PersonServiceImpl#getPersonByExternalIdentifier(java.lang.String, java.lang.String)}.
 */
@Test
public void testGetPersonByExternalIdentifier() {
	//insert external identifier
	Principal principal = KimApiServiceLocator.getIdentityService().getPrincipal("p1");

       EntityExternalIdentifierBo externalIdentifier = new EntityExternalIdentifierBo();
	externalIdentifier.setId("externalIdentifierId");
	externalIdentifier.setEntityId(principal.getEntityId());
	externalIdentifier.setExternalId("000-00-0000");
	externalIdentifier.setExternalIdentifierTypeCode("SSN");
       KradDataServiceLocator.getDataObjectService().save(externalIdentifier);
	
	List<Person> people = personService.getPersonByExternalIdentifier( "SSN", "000-00-0000" );
	assertNotNull( "result object must not be null", people );
	assertEquals( "exactly one record should be returned", 1, people.size() );
	assertEquals( "the returned principal is not correct", "p1", people.get(0).getPrincipalId() );
}
 

import org.kuali.rice.kim.api.identity.Person; //导入依赖的package包/类
protected static String replaceCurrentUserToken(String value, Person person) {
    Matcher matcher = CURRENT_USER_PATTERN.matcher(value);
    boolean matched = false;
    StringBuffer sb = new StringBuffer();
    while (matcher.find()) {
        matched = true;
        String idType = "principalName";
        if (matcher.groupCount() > 0) {
            String group = matcher.group(1);
            if (group != null) {
                idType = group.substring(1); // discard period after CURRENT_USER
            }
        }
        String idValue = UserUtils.getIdValue(idType, person);
        if (!StringUtils.isBlank(idValue)) {
            value = idValue;
        } else {
            value = matcher.group();
        }
        matcher.appendReplacement(sb, value);

    }
    matcher.appendTail(sb);
    return matched ? sb.toString() : null;
}
 

import org.kuali.rice.kim.api.identity.Person; //导入依赖的package包/类
protected EmailTo getEmailTo(Person user) {
    String address = user.getEmailAddressUnmasked();
    if (!isProduction()) {
        LOG.info("If this were production, email would be sent to "+ user.getEmailAddressUnmasked());
        address = CoreFrameworkServiceLocator.getParameterService().getParameterValueAsString(
            KewApiConstants.KEW_NAMESPACE,
            KRADConstants.DetailTypes.ACTION_LIST_DETAIL_TYPE,
            KewApiConstants.ACTIONLIST_EMAIL_TEST_ADDRESS);
    }
    return new EmailTo(address);
}
 

import org.kuali.rice.kim.api.identity.Person; //导入依赖的package包/类
/**
 * {@inheritDoc}
 */
@Override
public boolean canFyi(Document document, Person user) {
    initializeDocumentAuthorizerIfNecessary(document);

    return getDocumentAuthorizer().canFyi(document, user);
}
 

import org.kuali.rice.kim.api.identity.Person; //导入依赖的package包/类
/**
 * Override to check the for permissions of type 'Look Up Records' in addition to the open view check
 * done in super
 *
 * @param view view instance the open permission should be checked for
 * @param model object containing the model data associated with the view
 * @param user user who is requesting the view
 */
@Override
public boolean canOpenView(View view, ViewModel model, Person user) {
    boolean canOpen = super.canOpenView(view, model, user);

    if (canOpen) {
        LookupForm lookupForm = (LookupForm) model;

        Map<String, String> additionalPermissionDetails;
        try {
            additionalPermissionDetails = KRADUtils.getNamespaceAndComponentSimpleName(Class.forName(
                    lookupForm.getDataObjectClassName()));
        } catch (ClassNotFoundException e) {
            throw new RiceRuntimeException(
                    "Unable to create class for lookup class name: " + lookupForm.getDataObjectClassName(), e);
        }

        if (permissionExistsByTemplate(model, KRADConstants.KNS_NAMESPACE,
                KimConstants.PermissionTemplateNames.LOOK_UP_RECORDS, additionalPermissionDetails)) {
            canOpen = isAuthorizedByTemplate(model, KRADConstants.KNS_NAMESPACE,
                    KimConstants.PermissionTemplateNames.LOOK_UP_RECORDS, user.getPrincipalId(),
                    additionalPermissionDetails, null);
        }
    }

    return canOpen;
}
 

import org.kuali.rice.kim.api.identity.Person; //导入依赖的package包/类
/**
* @see org.kuali.rice.kim.api.identity.PersonService#updatePersonIfNecessary(java.lang.String, org.kuali.rice.kim.api.identity.Person)
*/
  @Override
  public Person updatePersonIfNecessary(String sourcePrincipalId, Person currentPerson ) {
      if (currentPerson  == null // no person set
              || !StringUtils.equals(sourcePrincipalId, currentPerson.getPrincipalId() ) // principal ID mismatch
              || currentPerson.getEntityId() == null ) { // syntheticially created Person object
          Person person = getPerson( sourcePrincipalId );
          // if a synthetically created person object is present, leave it - required for property derivation and the UI layer for
          // setting the principal name
          if ( person == null ) {
              if ( currentPerson != null && currentPerson.getEntityId() == null ) {
                  return currentPerson;
              }
          }
          // if both are null, create an empty object for property derivation
          if ( person == null && currentPerson == null ) {
          	try {
          		return new PersonImpl();
          	} catch ( Exception ex ) {
          		LOG.error( "unable to instantiate an object of type: " + getPersonImplementationClass() + " - returning null", ex );
          		return null;
          	}
          }
          return person;
      }
      // otherwise, no need to change the given object
      return currentPerson;
  }