Improve user delete and update for sub organizations

wso2-extensions · Apr 24, 2024 · 81fbe65 · 81fbe65
1 parent 547c875
commit 81fbe65
Show file tree

Hide file tree

Showing 2 changed files with 37 additions and 12 deletions.
diff --git a/...im2.common/src/main/java/org/wso2/carbon/identity/scim2/common/utils/SCIMCommonUtils.java b/...im2.common/src/main/java/org/wso2/carbon/identity/scim2/common/utils/SCIMCommonUtils.java
@@ -34,6 +34,8 @@
 import org.wso2.carbon.identity.core.util.IdentityTenantUtil;
 import org.wso2.carbon.identity.core.util.IdentityUtil;
 import org.wso2.carbon.identity.handler.event.account.lock.constants.AccountConstants;
+import org.wso2.carbon.identity.organization.management.service.exception.OrganizationManagementException;
+import org.wso2.carbon.identity.organization.management.service.util.OrganizationManagementUtil;
 import org.wso2.carbon.identity.role.mgt.core.IdentityRoleManagementException;
 import org.wso2.carbon.identity.role.mgt.core.util.UserIDResolver;
 import org.wso2.carbon.identity.scim2.common.cache.SCIMCustomAttributeSchemaCache;
@@ -948,4 +950,20 @@ public static String getLoggedInUserID() throws CharonException {
             throw new CharonException("Error occurred while retrieving super admin ID.", e);
         }
     }
+
+    /**
+     * Check whether the given tenant domain is an organization.
+     *
+     * @param tenantDomain Tenant domain of the request
+     * @return True if the tenant domain is an organization.
+     * @throws CharonException If an error occurred while checking the organization state.
+     */
+    public static boolean isOrganization(String tenantDomain) throws CharonException {
+
+        try {
+            return OrganizationManagementUtil.isOrganization(tenantDomain);
+        } catch (OrganizationManagementException e) {
+            throw new CharonException("Error occurred while checking the organization state.", e);
+        }
+    }
 }
diff --git a/...rovider/src/main/java/org/wso2/carbon/identity/scim2/provider/resources/UserResource.java b/...rovider/src/main/java/org/wso2/carbon/identity/scim2/provider/resources/UserResource.java
@@ -40,6 +40,7 @@
 import javax.ws.rs.core.Response;
 
 import static org.wso2.carbon.identity.scim2.provider.util.SupportUtils.buildCustomSchema;
+import static org.wso2.carbon.identity.scim2.provider.util.SupportUtils.getTenantDomain;
 import static org.wso2.carbon.identity.scim2.provider.util.SupportUtils.getTenantId;
 
 @Path("/")
@@ -151,13 +152,16 @@ public Response deleteUser(@PathParam(SCIMProviderConstants.ID) String id,
             // obtain the user store manager
             UserManager userManager = IdentitySCIMManager.getInstance().getUserManager();
 
-            String superAdminID = AdminAttributeUtil.getSuperAdminID();
-            String loggedInUser = SCIMCommonUtils.getLoggedInUserID();
-            if ((superAdminID.equals(id)) && (!loggedInUser.equals(id))) {
-                if (LOG.isDebugEnabled()) {
-                    LOG.debug("Do not have permission to delete SuperAdmin user.");
+            // Skipping this validation if the request comes from a sub organization.
+            if (!SCIMCommonUtils.isOrganization(getTenantDomain())) {
+                String superAdminID = AdminAttributeUtil.getSuperAdminID();
+                String loggedInUser = SCIMCommonUtils.getLoggedInUserID();
+                if ((superAdminID.equals(id)) && (!loggedInUser.equals(id))) {
+                    if (LOG.isDebugEnabled()) {
+                        LOG.debug("Do not have permission to delete SuperAdmin user.");
+                    }
+                    return Response.status(Response.Status.FORBIDDEN).build();
                 }
-                return Response.status(Response.Status.FORBIDDEN).build();
             }
 
             // create charon-SCIM user resource manager and hand-over the request.
@@ -348,13 +352,16 @@ public Response patchUser(@PathParam(SCIMConstants.CommonSchemaConstants.ID) Str
             // obtain the user store manager
             UserManager userManager = IdentitySCIMManager.getInstance().getUserManager();
 
-            String superAdminID = AdminAttributeUtil.getSuperAdminID();
-            String loggedInUser = SCIMCommonUtils.getLoggedInUserID();
-            if ((superAdminID.equals(id)) && (!loggedInUser.equals(id))) {
-                if (LOG.isDebugEnabled()) {
-                    LOG.debug("Do not have permission to patch SuperAdmin user.");
+            // Skipping this validation if the request comes from a sub organization.
+            if (!SCIMCommonUtils.isOrganization(getTenantDomain())) {
+                String superAdminID = AdminAttributeUtil.getSuperAdminID();
+                String loggedInUser = SCIMCommonUtils.getLoggedInUserID();
+                if ((superAdminID.equals(id)) && (!loggedInUser.equals(id))) {
+                    if (LOG.isDebugEnabled()) {
+                        LOG.debug("Do not have permission to patch SuperAdmin user.");
+                    }
+                    return Response.status(Response.Status.FORBIDDEN).build();
                 }
-                return Response.status(Response.Status.FORBIDDEN).build();
             }
 
             // Build Custom schema