Package io.jans.ca.plugin.adminui.service.adminui

Class AdminUISecurityService

java.lang.Object
io.jans.ca.plugin.adminui.service.adminui.AdminUISecurityService
@Singleton public class AdminUISecurityService extends Object
Service responsible for managing Admin UI security related operations such as searching, uploading, editing, deleting and synchronizing the Cedarling policy store.

This service interacts with:

  • The Jans persistence layer, where policy stores are persisted (the Cedar archive is held as a base64-encoded document)
  • Admin UI role and permission configuration

It also synchronizes Admin UI role-to-scope mappings from the active policy store held in persistence.

  • Constructor Details

    • AdminUISecurityService

      public AdminUISecurityService()

  • Method Details

    • searchPolicyStores

      public io.jans.orm.model.PagedResult<AdminUIPolicyStore> searchPolicyStores(io.jans.model.SearchRequest searchRequest) throws ApplicationException
      Searches persisted policy stores matching the given request.

      Each filter-assertion value is matched (as a substring) against the inum, status and display name, combined with OR semantics, and the results are paged and sorted according to the request.

      Parameters:
      searchRequest - the search parameters (filters, paging and sort options)
      Returns:
      a PagedResult of matching policy stores
      Throws:
      ApplicationException - (HTTP 500) if the underlying persistence query fails

    • uploadPolicyStore

      public GenericResponse uploadPolicyStore(AdminUIPolicyStore adminUIPolicyStore) throws ApplicationException
      Validates and persists a new policy store.

      The request is validated (base64 decoding, zip MIME type and trusted-issuer domain check) and, on success, persisted with a freshly generated inum/dn, creation and last-update timestamps, and an inactive status. Any client-supplied inum, dn, status or timestamps are overwritten by the server.

      Parameters:
      adminUIPolicyStore - the policy store to create (must contain a valid base64 document)
      Returns:
      a GenericResponse indicating success
      Throws:
      ApplicationException - (HTTP 500) if validation or persistence fails

    • editPolicyStore

      public GenericResponse editPolicyStore(String inum, AdminUIPolicyStore adminUIPolicyStore) throws ApplicationException
      Applies editable fields to an existing policy store.

      Only the display name, description and status are updated; read-only fields (inum, dn, creation date, owner and the policy-store document) are preserved from persistence. If the status is being set to active, any other currently-active store is demoted to inactive so that at most one policy store is active at a time.

      Parameters:
      inum - the inum of the policy store to edit
      adminUIPolicyStore - the source of the editable field values
      Returns:
      a GenericResponse indicating success
      Throws:
      ApplicationException - with HTTP 400 if the request or inum is invalid, HTTP 404 if no store exists for the inum, or HTTP 500 if the update fails

    • deletePolicyStore

      public GenericResponse deletePolicyStore(String inum) throws ApplicationException
      Deletes the policy store identified by the given inum.
      Parameters:
      inum - the inum of the policy store to delete
      Returns:
      a GenericResponse indicating success
      Throws:
      ApplicationException - with HTTP 400 if the inum is blank, or HTTP 404 if no store exists for the inum

    • syncRoleScopeMapping

      public GenericResponse syncRoleScopeMapping() throws ApplicationException
      Synchronizes Admin UI role-to-scope mappings using the active Cedar policy store stored in the database.

      The synchronization process includes:

      1. Retrieving resource-to-scope mappings from persistence
      2. Fetching the active policy store from the database and parsing its Cedar archive (.cjar)
      3. Deriving principal-to-scope mappings from policies
      4. Generating Admin UI roles from the principals
      5. Generating role-permission mappings
      6. Removing duplicate permissions
      7. Updating Admin UI roles and permissions

      This ensures that Admin UI access control remains consistent with Cedar authorization policies.

      Returns:
      GenericResponse indicating success or failure of the synchronization process
      Throws:
      ApplicationException - if synchronization fails due to validation or system errors

    • getDnForPolicyStore

      public String getDnForPolicyStore(String inum)
      Builds the persistence DN for a policy store from its inum.
      Parameters:
      inum - the policy store inum
      Returns:
      the fully-qualified DN under the policy-store base DN

    • getRecordMaxCount

      public int getRecordMaxCount()
      Returns the maximum number of records a search may return.
      Returns:
      the configured API max count if positive, otherwise ApiConstants.DEFAULT_MAX_COUNT