import org.wso2.carbon.user.core.UserRealm; //导入依赖的package包/类
private void handleFederatedUserNameEqualsToSuperAdminUserName(UserRealm realm, String username,
                                                               UserStoreManager userStoreManager,
                                                               Collection<String> deletingRoles)
        throws UserStoreException, FrameworkException {
    if (userStoreManager.getRealmConfiguration().isPrimary()
        && username.equals(realm.getRealmConfiguration().getAdminUserName())) {
        if (log.isDebugEnabled()) {
            log.debug("Federated user's username is equal to super admin's username of local IdP.");
        }

        // Whether superadmin login without superadmin role is permitted
        if (deletingRoles
                .contains(realm.getRealmConfiguration().getAdminRoleName())) {
            if (log.isDebugEnabled()) {
                log.debug("Federated user doesn't have super admin role. Unable to sync roles, since" +
                          " super admin role cannot be unassigned from super admin user");
            }
            throw new FrameworkException(
                    "Federated user which having same username to super admin username of local IdP," +
                    " trying login without having super admin role assigned");
        }
    }
}
 

import org.wso2.carbon.user.core.UserRealm; //导入依赖的package包/类
private UserStoreManager getUserStoreManager(String tenantDomain, UserRealm realm, String userDomain) throws
        FrameworkException {
    UserStoreManager userStore = null;
    try {
        userStore = realm.getUserStoreManager();
        if (StringUtils.isNotBlank(userDomain)) {
            userStore = realm.getUserStoreManager().getSecondaryUserStoreManager(userDomain);
        }

        if (userStore == null) {
            // To avoid NPEs
            throw new FrameworkException("Invalid user store domain name : " + userDomain + " in tenant : "
                    + tenantDomain);
        }
    } catch (UserStoreException e) {
        throw new FrameworkException("Error occurred while retrieving the UserStoreManager " +
                                     "from Realm for " + tenantDomain + " to handle local claims", e);
    }
    return userStore;
}
 

import org.wso2.carbon.user.core.UserRealm; //导入依赖的package包/类
/**
 * Returns all supported claims.
 *
 * @param realm user realm
 * @return array of all supported claims
 * @throws IdentityException if error occurs while building supported claims
 */
public Claim[] getAllSupportedClaims(UserRealm realm) throws IdentityException {
    try {
        ClaimManager claimAdmin = realm.getClaimManager();
        ClaimMapping[] mappings = claimAdmin.getAllSupportClaimMappingsByDefault();
        Claim[] claims = new Claim[0];
        if (mappings != null) {
            claims = new Claim[mappings.length];
            for (int i = 0; i < mappings.length; i++) {
                claims[i] = (Claim) mappings[i].getClaim();
            }
        }
        return claims;
    } catch (org.wso2.carbon.user.api.UserStoreException e) {
        log.error("Error occurred while loading supported claims", e);
        getException("Error occurred while loading supported claima", e);
    }

    return new Claim[0];
}
 

import org.wso2.carbon.user.core.UserRealm; //导入依赖的package包/类
private static UserRealm getRealmForAnonymousSession(String domainName, String username)
        throws IdentityException {

    try {
        if (username != null) {
            return AnonymousSessionUtil.getRealmByUserName(registryService, realmService,
                    username);
        }

        if (domainName == null) {
            domainName = MultitenantConstants.SUPER_TENANT_DOMAIN_NAME;
        }

        return AnonymousSessionUtil.getRealmByTenantDomain(registryService, realmService,
                domainName);

    } catch (CarbonException e) {
        throw IdentityException.error("Error Obtaining a realm for user name: " + username + " and " +
                "domain:" + domainName, e);
    }
}
 

import org.wso2.carbon.user.core.UserRealm; //导入依赖的package包/类
public void addUser(UserDTO user) throws Exception {
    UserFieldDTO[] userFieldDTOs = null;
    Map<String, String> userClaims = null;

    userFieldDTOs = user.getUserFields();
    userClaims = new HashMap<String, String>();

    if (userFieldDTOs != null) {
        for (UserFieldDTO userFieldDTO : userFieldDTOs) {
            userClaims.put(userFieldDTO.getClaimUri(), userFieldDTO.getFieldValue());
        }
    }

    UserRealm realm = null;
    String tenantAwareUserName = MultitenantUtils.getTenantAwareUsername(user.getUserName());
    String tenantName = MultitenantUtils.getTenantDomain(user.getUserName());
    realm = IdentityTenantUtil.getRealm(tenantName, null);
    addUser(tenantAwareUserName, user.getPassword(), userClaims, null, realm);
}
 

import org.wso2.carbon.user.core.UserRealm; //导入依赖的package包/类
private boolean isUserNameWithAllowedDomainName(String userName, UserRealm realm)
        throws IdentityException {
    int index;
    index = userName.indexOf("/");

    // Check whether we have a secondary UserStoreManager setup.
    if (index > 0) {
        // Using the short-circuit. User name comes with the domain name.
        try {
            return !realm.getRealmConfiguration().isRestrictedDomainForSlefSignUp(
                    userName.substring(0, index));
        } catch (UserStoreException e) {
            throw IdentityException.error(e.getMessage(), e);
        }
    }
    return true;
}
 

import org.wso2.carbon.user.core.UserRealm; //导入依赖的package包/类
/**
 * Get list of roles which have given permission
 *
 * @param filter     filter to check
 * @param permission permission to check
 * @param limit
 * @return
 * @throws UserAdminException
 */
public FlaggedName[] getAllPermittedRoleNames(String filter, String permission, int limit) throws
        UserAdminException {

    FlaggedName[] roles = getUserAdminProxy().getAllRolesNames(filter, limit);
    List<FlaggedName> permittedRoles = new ArrayList<>();
    try {
        org.wso2.carbon.user.api.UserRealm realm = UserMgtDSComponent.getRealmService().getTenantUserRealm
                (PrivilegedCarbonContext.getThreadLocalCarbonContext().getTenantId());
        AuthorizationManager authorizationManager = realm.getAuthorizationManager();
        for (int i = 0; i < roles.length - 1; i++) {
            if (authorizationManager.isRoleAuthorized(roles[i].getItemName(), permission, UserMgtConstants
                    .EXECUTE_ACTION)) {
                permittedRoles.add(roles[i]);
            }
        }
        permittedRoles.add(roles[roles.length - 1]);
    } catch (org.wso2.carbon.user.api.UserStoreException e) {
        throw new UserAdminException("Error while filtering authorized roles.", e);
    }
    FlaggedName[] permittedRolesArray = new FlaggedName[permittedRoles.size()];
    return permittedRoles.toArray(permittedRolesArray);
}
 

import org.wso2.carbon.user.core.UserRealm; //导入依赖的package包/类
private void addUserRole(String roleName, String[] userList, String[] permissions, boolean isSharedRole, boolean
        isInternalRole) throws UserAdminException {
    String result = null;

    if (permissions == null) {
        permissions = new String[0];
    }

    try {
        UserRealm realm = (UserRealm) CarbonContext.getThreadLocalCarbonContext().getUserRealm();
        if (!isAllowedRoleName(roleName, realm)) {
            throw new UserAdminException("Role name is reserved by the system");
        }
        if (!isInternalRole) {
            getUserAdminProxy().addRole(roleName, userList, permissions, isSharedRole);
        } else {
            getUserAdminProxy().addInternalRole(roleName, userList, permissions);

        }
    } catch (UserAdminException e) {
        throw e;
    }
}
 

import org.wso2.carbon.user.core.UserRealm; //导入依赖的package包/类
/**
 * @param roleName
 * @param realm
 * @return
 * @throws UserAdminException
 */
private boolean isAllowedRoleName(String roleName, UserRealm realm) throws UserAdminException {

    int index;
    index = roleName.indexOf("/");

    if (index > 0) {
        roleName = roleName.substring(index + 1);
    }

    try {
        return !realm.getRealmConfiguration().isReservedRoleName(roleName);
    } catch (UserStoreException e) {
        throw new UserAdminException(e.getMessage(), e);
    }
}
 

import org.wso2.carbon.user.core.UserRealm; //导入依赖的package包/类
/**
 * List users with given claim value and permission
 *
 * @param claimValue claim to check
 * @param filter     filter to check
 * @param permission permission to check
 * @param maxLimit
 * @return
 * @throws UserAdminException
 */
public FlaggedName[] listUserByClaimWithPermission(ClaimValue claimValue, String filter, String permission, int
        maxLimit)
        throws UserAdminException {

    List<FlaggedName> permittedUsers = new ArrayList<>();
    try {
        org.wso2.carbon.user.api.UserRealm realm = UserMgtDSComponent.getRealmService().getTenantUserRealm
                (PrivilegedCarbonContext.getThreadLocalCarbonContext().getTenantId());
        AuthorizationManager authorizationManager = realm.getAuthorizationManager();
        FlaggedName[] users = getUserAdminProxy().listUsers(claimValue, filter, maxLimit);
        for (int i = 0; i < users.length - 1; i++) {
            if (authorizationManager.isUserAuthorized(users[i].getItemName(),
                    permission, UserMgtConstants.EXECUTE_ACTION)) {
                permittedUsers.add(users[i]);
            }
        }
    } catch (org.wso2.carbon.user.api.UserStoreException e) {
        throw new UserAdminException("Error while filtering authorized users.", e);
    }
    FlaggedName[] permittedUsersArray = new FlaggedName[permittedUsers.size()];
    return permittedUsers.toArray(permittedUsersArray);
}
 

import org.wso2.carbon.user.core.UserRealm; //导入依赖的package包/类
public boolean isAddProfileEnabledForDomain(String domain) throws UserProfileException {

        org.wso2.carbon.user.core.UserStoreManager userStoreManager = null;
        org.wso2.carbon.user.core.UserRealm realm = getUserRealm();
        boolean isAddProfileEnabled = false;

        try {
            if (StringUtils.isBlank(domain) || StringUtils.equals(domain, UserCoreConstants.PRIMARY_DEFAULT_DOMAIN_NAME)) {
                userStoreManager = realm.getUserStoreManager();
            } else {
                userStoreManager = realm.getUserStoreManager().getSecondaryUserStoreManager(domain);
            }

        } catch (UserStoreException e) {
            String errorMessage = "Error in obtaining SecondaryUserStoreManager.";
            log.error(errorMessage, e);
            throw new UserProfileException(errorMessage, e);
        }

        if (userStoreManager != null) {
            isAddProfileEnabled = userStoreManager.isMultipleProfilesAllowed();
        }

        return isAddProfileEnabled;
    }
 

import org.wso2.carbon.user.core.UserRealm; //导入依赖的package包/类
private static boolean isUserAuthorizedToConfigureProfile(UserRealm realm, String currentUserName,
                                                          String targetUser, String permission)
        throws UserStoreException {
    boolean isAuthrized = false;
    if (currentUserName == null) {
        //do nothing
    } else if (currentUserName.equals(targetUser)) {
        isAuthrized = true;
    } else {
        AuthorizationManager authorizer = realm.getAuthorizationManager();
        isAuthrized = authorizer.isUserAuthorized(currentUserName,
                CarbonConstants.UI_ADMIN_PERMISSION_COLLECTION + permission,
                "ui.execute");
    }
    return isAuthrized;
}
 

import org.wso2.carbon.user.core.UserRealm; //导入依赖的package包/类
/**
 * @return
 * @throws UserStoreException
 */
private Claim[] getAllSupportedClaims(UserRealm realm, String dialectUri)
        throws org.wso2.carbon.user.api.UserStoreException {
    ClaimMapping[] claims = null;
    List<Claim> reqClaims = null;

    claims = realm.getClaimManager().getAllSupportClaimMappingsByDefault();
    reqClaims = new ArrayList<Claim>();
    for (int i = 0; i < claims.length; i++) {
        if (dialectUri.equals(claims[i].getClaim().getDialectURI()) && (claims[i] != null && claims[i].getClaim().getDisplayTag() != null
                && !claims[i].getClaim().getClaimUri().equals(IdentityConstants.CLAIM_PPID))) {

            reqClaims.add((Claim) claims[i].getClaim());
        }
    }

    return reqClaims.toArray(new Claim[reqClaims.size()]);
}
 

import org.wso2.carbon.user.core.UserRealm; //导入依赖的package包/类
/**
 * Returns all supported claims.
 *
 * @return
 * @throws IdentityException
 */
public Claim[] getAllSupportedClaims(UserRealm realm) throws IdentityException {
    try {
        ClaimManager claimAdmin = realm.getClaimManager();
        ClaimMapping[] mappings = claimAdmin.getAllSupportClaimMappingsByDefault();
        Claim[] claims = new Claim[0];
        if (mappings != null) {
            claims = new Claim[mappings.length];
            for (int i = 0; i < mappings.length; i++) {
                claims[i] = (Claim) mappings[i].getClaim();
            }
        }
        return claims;
    } catch (org.wso2.carbon.user.api.UserStoreException e) {
        log.error("Error occurred while loading supported claims", e);
        getException("Error occurred while loading supported claima", e);
    }

    return new Claim[0];
}
 

import org.wso2.carbon.user.core.UserRealm; //导入依赖的package包/类
private static UserRealm getRealmForAnonymousSession(String domainName, String username)
        throws IdentityException {
    try {
        if (domainName == null && username == null) {
            domainName = MultitenantConstants.SUPER_TENANT_DOMAIN_NAME;
        }

        if (username == null) {
            return AnonymousSessionUtil.getRealmByTenantDomain(registryService, realmService,
                    domainName);
        } else if (username != null) {
            return AnonymousSessionUtil.getRealmByUserName(registryService, realmService,
                    username);
        }
    } catch (CarbonException e) {
        log.error("Error obtaining the realm", e);
        throw IdentityException.error("Error Obtaining a realm", e);
    }
    return null;
}
 

import org.wso2.carbon.user.core.UserRealm; //导入依赖的package包/类
public RealmConfigurationDTO getRealmConfiguration() throws UserStoreException {
    UserRealm userRealm = getApplicableUserRealm();
    RealmConfiguration realmConfig = userRealm.getRealmConfiguration();
    RealmConfigurationDTO realmConfigDTO = new RealmConfigurationDTO();
    realmConfigDTO.setRealmClassName(realmConfig.getRealmClassName());
    realmConfigDTO.setUserStoreClass(realmConfig.getUserStoreClass());
    realmConfigDTO.setAuthorizationManagerClass(realmConfig.getAuthorizationManagerClass());
    realmConfigDTO.setAdminRoleName(realmConfig.getAdminRoleName());
    realmConfigDTO.setAdminUserName(realmConfig.getAdminUserName());
    realmConfigDTO.setAdminPassword(realmConfig.getAdminPassword());
    realmConfigDTO.setEveryOneRoleName(realmConfig.getEveryOneRoleName());
    realmConfigDTO.setUserStoreProperties(getPropertyValueArray(realmConfig
            .getUserStoreProperties()));
    realmConfigDTO.setAuthzProperties(getPropertyValueArray(realmConfig.getAuthzProperties()));
    realmConfigDTO.setRealmProperties(getPropertyValueArray(realmConfig.getRealmProperties()));
    return realmConfigDTO;
}
 

import org.wso2.carbon.user.core.UserRealm; //导入依赖的package包/类
public void addUser(UserDTO user) throws Exception {
    UserFieldDTO[] userFieldDTOs = null;
    Map<String, String> userClaims = null;

    userFieldDTOs = user.getUserFields();
    userClaims = new HashMap<String, String>();

    if (userFieldDTOs != null) {
        for (UserFieldDTO userFieldDTO : userFieldDTOs) {
            userClaims.put(userFieldDTO.getClaimUri(), userFieldDTO.getFieldValue());
        }
    }

    UserRealm realm = null;
    String tenantAwareUserName = MultitenantUtils.getTenantAwareUsername(user.getUserName());
    String tenantName = MultitenantUtils.getTenantDomain(user.getUserName());
    realm = IdentityTenantUtil.getRealm(tenantName, null);
    Registry registry = IdentityTenantUtil.getRegistry(null, null);
    addUser(tenantAwareUserName, user.getPassword(), userClaims, null, realm);
}
 

import org.wso2.carbon.user.core.UserRealm; //导入依赖的package包/类
public static void setAnonAuthorization(String path, UserRealm userRealm)
        throws RegistryException {

    if (userRealm == null) {
        return;
    }

    try {
        AuthorizationManager accessControlAdmin = userRealm.getAuthorizationManager();
        String everyoneRole = CarbonConstants.REGISTRY_ANONNYMOUS_ROLE_NAME;

        accessControlAdmin.authorizeRole(everyoneRole, path, ActionConstants.GET);
        accessControlAdmin.denyRole(everyoneRole, path, ActionConstants.PUT);
        accessControlAdmin.denyRole(everyoneRole, path, ActionConstants.DELETE);
        accessControlAdmin.denyRole(everyoneRole, path, AccessControlConstants.AUTHORIZE);

    } catch (UserStoreException e) {
        String msg = "Could not set authorizations for the " + path + ".";
        log.error(msg, e);
        throw new RegistryException(msg);
    }
}
 

import org.wso2.carbon.user.core.UserRealm; //导入依赖的package包/类
private TUser[] getUserListForRole(String roleName, int tenantId, String actualOwnerUserName)
        throws RegistryException, UserStoreException {
    TUser[] userList = new TUser[0];

    RegistryService registryService = HumanTaskServiceComponent.getRegistryService();
    if(registryService != null && registryService.getUserRealm(tenantId) != null) {
        UserRealm userRealm = registryService.getUserRealm(tenantId);
        String[] assignableUserNameList = userRealm.getUserStoreManager().getUserListOfRole(roleName);
        if(assignableUserNameList != null) {
            userList = new TUser[assignableUserNameList.length];
            for(int i= 0 ; i < assignableUserNameList.length ; i++) {
                TUser user  = new TUser();
                user.setTUser(assignableUserNameList[i]);
                if(StringUtils.isEmpty(actualOwnerUserName)) {
                    userList[i] = user;
                } else if(StringUtils.isNotEmpty(actualOwnerUserName) &&
                          !actualOwnerUserName.equals(assignableUserNameList[i])) {
                    userList[i] = user;
                }
            }
        }
    } else {
        log.warn("Cannot load User Realm for Tenant Id: " + tenantId);
    }
    return userList;
}
 

import org.wso2.carbon.user.core.UserRealm; //导入依赖的package包/类
public static boolean isPutAllowed(
        String userName, String resourcePath, UserRegistry userRegistry)
        throws RegistryException {

    boolean putAllowed = false;

    UserRealm userRealm = userRegistry.getUserRealm();

    try {
        if (userRealm.getAuthorizationManager().isUserAuthorized(
                userName, resourcePath, ActionConstants.PUT)) {
            putAllowed = true;
        }
    } catch (UserStoreException e) {

        String msg = "Could not the permission details for the user: " + userName +
                     " for the resource: " + resourcePath + ". Caused by: " + e.getMessage();
        throw new RegistryException(msg);
    }

    return putAllowed;
}