private static Map<String, String> mapUserProperties(final User user) throws RepositoryException {
    final Map<String, String> userProperties = new HashMap<>();
    final Iterator<String> keys = user.getPropertyNames();
    while (keys.hasNext()) {
        final String key = keys.next();
        final Value[] values = user.getProperty(key);
        if (values != null && values.length > 0) {
            if (values.length == 1) {
                userProperties.put(key, values[0].getString());
            } else {
                final String[] strings = new String[values.length];
                for (int i = 0; i < values.length; i++) {
                    strings[i] = values[i].getString();
                }
                userProperties.put(key, Arrays.toString(strings));
            }
        }
    }
    return userProperties;
}
 

public ActionResult process(final Context context) {
  ActionResult actionResult = context.createActionResult();
  try {

    if (shouldBeGroup) {
      Group group = context.getAuthorizableManager().getGroup(id);
      context.setCurrentAuthorizable(group);
      actionResult.logMessage("Group with id: " + group.getID() + " set as current authorizable");
    } else {
      User user = context.getAuthorizableManager().getUser(id);
      context.setCurrentAuthorizable(user);
      actionResult.logMessage("User with id: " + user.getID() + " set as current authorizable");
    }

  } catch (RepositoryException | ActionExecutionException e) {
    actionResult.logError(MessagingUtils.createMessage(e));
  }
  return actionResult;
}
 

@Override
public ActionResult simulate(Context context) throws ActionExecutionException {
  ActionResult actionResult;
  try {
    User user = context.getAuthorizableManager().getUser(userId);
    context.setCurrentAuthorizable(user);
    Action removeFromGroups = new RemoveParents(getGroups(user));
    ActionResult purgeResult = purge.simulate(context);
    ActionResult removeFromGroupsResult = removeFromGroups.execute(context);
    ActionResult removeResult = remove.simulate(context);
    actionResult = purgeResult.merge(removeFromGroupsResult, removeResult);
  } catch (RepositoryException | ActionExecutionException e) {
    actionResult = context.createActionResult();
    actionResult.logError(MessagingUtils.createMessage(e));
  }
  return actionResult;
}
 

@Override
public ActionResult execute(Context context) throws ActionExecutionException {
  ActionResult actionResult;
  try {
    User user = context.getAuthorizableManager().getUser(userId);
    context.setCurrentAuthorizable(user);
    Action removeFromGroups = new RemoveParents(getGroups(user));
    ActionResult purgeResult = purge.execute(context);
    ActionResult removeFromGroupsResult = removeFromGroups.execute(context);
    ActionResult removeResult = remove.execute(context);
    actionResult = purgeResult.merge(removeFromGroupsResult, removeResult);
  } catch (RepositoryException | ActionExecutionException e) {
    actionResult = context.createActionResult();
    actionResult.logError(MessagingUtils.createMessage(e));
  }
  return actionResult;
}
 

/**
 * Get the authorable status of the current user.
 *
 * @param session The current session.
 * @return true if the current user is an admin or author.
 */
public boolean isAuthorable(Session session) {
    boolean authorable = false;

    JackrabbitSession js = (JackrabbitSession)session;

    try {
        Group authors = (Group)js.getUserManager().getAuthorizable(PublickConstants.GROUP_ID_AUTHORS);
        User user = (User)js.getUserManager().getAuthorizable(js.getUserID());

        authorable = user.isAdmin() || authors.isMember(user);
    } catch (RepositoryException e) {
        LOGGER.error("Could not determine group membership", e);
    }

    return authorable;
}
 

/**
 * Get the authorable status of the current user.
 * TODO: remove and use UserService
 *
 * @return true if the current user is an admin or author.
 */
public boolean isAuthorable() {
    boolean authorable = false;

    JackrabbitSession js = (JackrabbitSession)getSession();

    try {
        Group authors = (Group)js.getUserManager().getAuthorizable(PublickConstants.GROUP_ID_AUTHORS);
        User user = (User)js.getUserManager().getAuthorizable(js.getUserID());

        authorable = user.isAdmin() || authors.isMember(user);
    } catch (RepositoryException e) {
        LOGGER.error("Could not determine group membership", e);
    }

    return authorable;
}
 

@Test
public void installUserA_Profile() throws RepositoryException, IOException, PackageException {
    // install default user at package path
    User userA = installUserA(ImportMode.REPLACE, true, true);
    String authPath = userA.getPath();

    assertPropertyMissing(authPath + "/" + NAME_PROFILE_PROPERTY);

    // install updated profile
    JcrPackage pack = packMgr.upload(getStream("/test-packages/test_user_a_profile.zip"), false);
    assertNotNull(pack);
    pack.install(getDefaultOptions());

    assertProperty(authPath + "/" + NAME_PROFILE_FULLNAME, "Test User");
    assertProperty(authPath + "/" + NAME_PROFILE_PROPERTY, "a");
}
 

@Test
public void installUserA_Profile_Moved() throws RepositoryException, IOException, PackageException {
    // install default user at package path
    User userA = installUserA(ImportMode.UPDATE, false, false);
    String authPath = userA.getPath();

    assertPropertyMissing(authPath + "/" + NAME_PROFILE_PROPERTY);

    // install updated profile
    JcrPackage pack = packMgr.upload(getStream("/test-packages/test_user_a_profile.zip"), false);
    assertNotNull(pack);
    pack.install(getDefaultOptions());

    assertProperty(authPath + "/" + NAME_PROFILE_FULLNAME, "Test User");
    assertProperty(authPath + "/" + NAME_PROFILE_PROPERTY, "a");
}
 

@Test
public void installUserA_Profile_Picture() throws RepositoryException, IOException, PackageException {
    // install default user at package path
    User userA = installUserA(ImportMode.REPLACE, true, true);
    String authPath = userA.getPath();

    assertPropertyMissing(authPath + "/" + NAME_PROFILE_PROPERTY);

    // install updated profile
    JcrPackage pack = packMgr.upload(getStream("/test-packages/test_user_a_profile_picture.zip"), false);
    assertNotNull(pack);
    pack.install(getDefaultOptions());

    assertProperty(authPath + "/" + NAME_PROFILE_FULLNAME, "Test User");
    assertProperty(authPath + "/" + NAME_PROFILE_PROPERTY, "a");
    assertNodeExists(authPath + "/" + NAME_PROFILE_PICTURE_NODE);
}
 

@Test
public void installUserA_Profile_Picture_Moved() throws RepositoryException, IOException, PackageException {
    // install default user at package path
    User userA = installUserA(ImportMode.UPDATE, false, false);
    String authPath = userA.getPath();

    assertPropertyMissing(authPath + "/" + NAME_PROFILE_PROPERTY);

    // install updated profile
    JcrPackage pack = packMgr.upload(getStream("/test-packages/test_user_a_profile_picture.zip"), false);
    assertNotNull(pack);
    pack.install(getDefaultOptions());

    assertProperty(authPath + "/" + NAME_PROFILE_FULLNAME, "Test User");
    assertProperty(authPath + "/" + NAME_PROFILE_PROPERTY, "a");
    assertNodeExists(authPath + "/" + NAME_PROFILE_PICTURE_NODE);
}
 

/**
 * Installs a package that contains a "test-group" and a "test-user-a" as member of the group.
 */
@Test
public void installGroupA() throws RepositoryException, IOException, PackageException {
    UserManager mgr = ((JackrabbitSession) admin).getUserManager();
    assertNull("test-group must not exist", mgr.getAuthorizable("test-group"));
    assertNull("test-user-a must not exist", mgr.getAuthorizable("test-user-a"));

    JcrPackage pack = packMgr.upload(getStream("/test-packages/group_with_a.zip"), false);
    assertNotNull(pack);
    pack.install(getDefaultOptions());

    // check if group exists
    Group grp = (Group) mgr.getAuthorizable("test-group");
    assertNotNull("test-group must exist", grp);
    User userA = (User) mgr.getAuthorizable("test-user-a");
    assertNotNull("test-user-a must exist", userA);
    assertTrue("test-user-a is member of test-group", grp.isMember(userA));
}
 

@Override
public void setUp() throws Exception {
    super.setUp();
    uMgr = ((JackrabbitSession) admin).getUserManager();
    User testuser = uMgr.createUser(NAME_TEST_USER, null);
    admin.save();

    acMgr = admin.getAccessControlManager();

    Node tmp = admin.getRootNode().addNode("testroot").addNode("secured");
    JackrabbitAccessControlList list = AccessControlUtils.getAccessControlList(acMgr, tmp.getPath());
    Privilege[] writePrivilege = AccessControlUtils.privilegesFromNames(acMgr, Privilege.JCR_WRITE);
    ValueFactory vf = admin.getValueFactory();
    Principal everyone = ((JackrabbitSession) admin).getPrincipalManager().getEveryone();
    list.addEntry(everyone, writePrivilege, true, ImmutableMap.of("rep:glob", vf.createValue("/foo")));
    list.addEntry(testuser.getPrincipal(), writePrivilege, false, ImmutableMap.of("rep:glob", vf.createValue("/foo")));
    list.addEntry(everyone, writePrivilege, true, ImmutableMap.of("rep:glob", vf.createValue("/bar")));
    acMgr.setPolicy(tmp.getPath(), list);

    expectedEntries = ImmutableList.copyOf(list.getAccessControlEntries());

    admin.refresh(false);
}
 

@Test
public void testAdminGroup() throws Exception {
    JackrabbitSession jackrabbitSession = (JackrabbitSession) admin;
    Authorizable admins = jackrabbitSession.getUserManager().getAuthorizable("administrators");
    if (admins == null) {
        admins = jackrabbitSession.getUserManager().createGroup("administrators");
    }
    Group adminsGroup = (Group) admins;
    User testUser = (User) jackrabbitSession.getUserManager().getAuthorizable(TEST_USER);
    if (testUser == null) {
        testUser = jackrabbitSession.getUserManager().createUser(TEST_USER, TEST_USER);
    }
    adminsGroup.addMember(testUser);
    admin.save();
    Session session = repository.login(new SimpleCredentials(TEST_USER, TEST_USER.toCharArray()));
    try {
        assertTrue(
                "user \"" + TEST_USER + "\" has been added to administrators group thus should have admin permissions",
                AdminPermissionChecker.hasAdministrativePermissions(session));
    } finally {
        session.logout();
    }
}
 

@Test
public void testAdditionalAdminGroup() throws Exception {
    JackrabbitSession jackrabbitSession = (JackrabbitSession) admin;
    Authorizable admins = jackrabbitSession.getUserManager().getAuthorizable("myadmins");
    if (admins == null) {
        admins = jackrabbitSession.getUserManager().createGroup("myadmins");
    }
    Group adminsGroup = (Group) admins;
    User testUser = (User) jackrabbitSession.getUserManager().getAuthorizable(TEST_USER);
    if (testUser == null) {
        testUser = jackrabbitSession.getUserManager().createUser(TEST_USER, TEST_USER);
    }
    adminsGroup.addMember(testUser);
    admin.save();
    Session session = repository.login(new SimpleCredentials(TEST_USER, TEST_USER.toCharArray()));
    try {
        assertTrue(
                "user \"" + TEST_USER + "\" has been added to additional administrators group thus should have admin permissions",
                AdminPermissionChecker.hasAdministrativePermissions(session, "myadmins"));
    } finally {
        session.logout();
    }
}
 

@Activate
public void start(ActivatorConfiguration config) {
    String[] authorizableIds = config.pwdreset_authorizables();

    Session session = null;
    try {
        ResourceResolver resolver = resolverFactory.getAdministrativeResourceResolver(null);

        UserManager userManager = resolver.adaptTo(UserManager.class);
        session = resolver.adaptTo(Session.class);

        for (String authorizable : authorizableIds) {
            try {
                Authorizable user = userManager.getAuthorizable(authorizable);
                if (user != null) {
                    ((User) user).changePassword(authorizable);
                    if (!userManager.isAutoSave()) {
                        session.save();
                    }
                    log.info("Changed the password for {}", authorizable);
                } else {
                    log.error("Could not find authorizable {}", authorizable);
                }
            } catch (RepositoryException repEx) {
                log.error("Could not change password for {}", authorizable, repEx);
            }
        }
    } catch (LoginException loginEx) {
        log.error("Could not login to the repository", loginEx);
    } finally {
        if(session != null) {
            session.logout();
        }
    }
}
 

@PostConstruct
public void init() throws Exception {
    final Session session = resource.getResourceResolver().adaptTo(Session.class);
    final UserManager userManager = AccessControlUtil.getUserManager(session);
    user = (User) userManager.getAuthorizable(session.getUserID());
    userProperties = mapUserProperties(user);
}
 

private AuthenticationInfo buildAuthInfo(final User user){
    //AUTHENTICATION_INFO_CREDENTIALS
    try {
        AuthenticationInfo authInfo = new AuthenticationInfo(AUTH_TYPE, user.getID());
        authInfo.put("user.jcr.credentials", new Saml2Credentials(user.getID()));
        return authInfo;
    } catch (RepositoryException e) {
        logger.error("failed to build Authentication Info");
        throw new RuntimeException(e);
    }
}
 

private boolean tryGetUser(final Context context, final ActionResult actionResult)
    throws ActionExecutionException, RepositoryException {
  User user = context.getAuthorizableManager().getUserIfExists(userId);
  if (user == null) {
    actionResult.logError(MessagingUtils.authorizableNotExists(userId));
    return false;
  }
  return true;
}
 

private ActionResult process(final Context context, boolean execute) {
  ActionResult actionResult = context.createActionResult();
  try {
    User user = context.getCurrentUser();
    actionResult.setAuthorizable(user.getID());
    LOGGER.info(String.format("Setting password for user with id = %s", user.getID()));
    if (execute) {
      user.changePassword(password);
    }
    actionResult.logMessage(MessagingUtils.newPasswordSet(user.getID()));
  } catch (RepositoryException | ActionExecutionException e) {
    actionResult.logError(MessagingUtils.createMessage(e));
  }
  return actionResult;
}
 

private List<String> getGroups(User user) throws RepositoryException {
  List<String> groups = new ArrayList<>();
  Iterator<Group> groupIterator = user.declaredMemberOf();
  while (groupIterator.hasNext()) {
    Group group = groupIterator.next();
    groups.add(group.getID());
  }
  return groups;
}
 

private ActionResult process(final Context context, boolean execute) {
  ActionResult actionResult = context.createActionResult();
  List<String> errors = new ArrayList<>();
  LOGGER.info(String.format("Removing users with ids = %s", StringUtils.join(ids, ", ")));
  for (String id : ids) {
    try {
      User user = context.getAuthorizableManager().getUserIfExists(id);
      if (user != null) {
        context.getAuthorizableManager().markAuthorizableAsRemoved(user);
        if (execute) {
          context.getAuthorizableManager().removeUser(user);
        }
        actionResult.logMessage("User with id: " + id + " removed");
      }
    } catch (RepositoryException | ActionExecutionException e) {
      errors.add(MessagingUtils.createMessage(e));
    }
  }

  if (!errors.isEmpty()) {
    for (String error : errors) {
      actionResult.logError(error);
    }
    actionResult.logError("Execution interrupted");
  }
  return actionResult;
}
 

@Override
public User createUser(String id, String password, Principal namePrincipal, String path) throws RepositoryException {
  User user = userManager.createUser(id, password, namePrincipal, path);
  existingAuthorizables.put(id, user);
  removedAuthorizables.remove(id);
  return user;
}
 

@Override
public User createSystemUser(String id, String path) throws RepositoryException {
  User user = userManager.createSystemUser(id, path);
  existingAuthorizables.put(id, user);
  removedAuthorizables.remove(id);
  return user;
}
 

@Override
public User createMockUser(String id) {
  User user = new MockUser(id);
  existingAuthorizables.put(id, user);
  removedAuthorizables.remove(id);
  return user;
}
 

@Override
public void removeUser(User user) throws RepositoryException {
  Iterator<Group> groups = user.memberOf();
  while (groups.hasNext()) {
    groups.next().removeMember(user);
  }
  existingAuthorizables.remove(user.getID());
  user.remove();
}
 

@Override
public Group getCurrentGroup() throws ActionExecutionException {
  if (getCurrentAuthorizable() instanceof User) {
    throw new ActionExecutionException("Current authorizable is not a group");
  }
  return (Group) currentAuthorizable;
}
 

@Override
public User getCurrentUser() throws ActionExecutionException {
  if (getCurrentAuthorizable() instanceof Group) {
    throw new ActionExecutionException("Current authorizable is not a user");
  }
  return (User) currentAuthorizable;
}
 

@Override
@After
public void tearDown() throws Exception {
    try {
        User u = userManager.getAuthorizable(SYSTEM_USER_ID, User.class);
        if (u != null) {
            u.remove();
            admin.save();
        }
    } finally {
        super.tearDown();
        shutdownRepository();
        initRepository();
    }
}
 

@Test
public void installUserA_Policy_Moved() throws RepositoryException, IOException, PackageException {
    UserManager mgr = ((JackrabbitSession) admin).getUserManager();
    assertNull("test-user-a must not exist", mgr.getAuthorizable(ID_TEST_USER_A));

    User u = mgr.createUser(ID_TEST_USER_A, "nonce");
    String authPath = u.getPath();
    assertNotSame("authorizable path must be different than the one in the package", PARENT_PATH_TEST_USER_A, Text.getRelativeParent(authPath, 1));

    // assert that user does not have an ACL setup
    assertPermissionMissing(authPath, true, new String[]{"jcr:all"}, "everyone", null);

    JcrPackage pack = packMgr.upload(getStream("/test-packages/test_user_a_policy.zip"), false);
    assertNotNull(pack);
    ImportOptions opts = getDefaultOptions();
    opts.setImportMode(ImportMode.MERGE);
    opts.setAccessControlHandling(AccessControlHandling.MERGE_PRESERVE);
    pack.install(opts);

    // check if user exists
    User userA = (User) mgr.getAuthorizable(ID_TEST_USER_A);
    assertNotNull("test-user-a must exist", userA);
    authPath = u.getPath();

    // assert that user has an ACL setup
    assertPermission(authPath, true, new String[]{"jcr:all"}, "everyone", null);
}
 

private void install_user_with_rep_cache(ImportMode mode) throws RepositoryException, IOException, PackageException {
    UserManager mgr = ((JackrabbitSession) admin).getUserManager();
    assertNull("test-user-a must not exist", mgr.getAuthorizable(ID_TEST_USER_A));

    // install user package
    JcrPackage pack = packMgr.upload(getStream("/test-packages/test_user_with_rep_cache.zip"), false);
    assertNotNull(pack);
    ImportOptions opts = getDefaultOptions();
    opts.setImportMode(mode);
    pack.install(opts);

    // check if user exists
    User userA = (User) mgr.getAuthorizable(ID_TEST_USER_A);
    assertNotNull("test-user-a must exist", userA);
}