Package edu.internet2.middleware.grouper.app.scim2Provisioning

Class GrouperScim2ProvisioningTargetNativeSync

java.lang.Object
edu.internet2.middleware.grouper.app.provisioning.GrouperProvisioningTargetNativeSync
edu.internet2.middleware.grouper.app.scim2Provisioning.GrouperScim2ProvisioningTargetNativeSync
public class GrouperScim2ProvisioningTargetNativeSync extends GrouperProvisioningTargetNativeSync
SCIM-specific GrouperProvisioningTargetNativeSync: builds native-target reporting beans directly from the SCIM JSON resource and drains the GrouperScim2MembershipCache populated as a side-effect of retrieveScimGroups / retrieveScimUsers into the native memberships list.

Capture is hooked at GrouperScim2ApiCommands (the protocol-I/O seam) rather than in the DAO, because SCIM API methods are axis-typed. The static …FromCurrentProvisioner dispatchers absorb the ThreadLocal lookup + instanceof check so call sites stay 1 line.

Attribute capture is config-driven, not "everything in the JSON":

  • If the operator has set nativeAttributesEntities / nativeAttributesGroups in the provisioner config, those exact paths are captured.
  • If blank, a curated SCIM core-schema default list (DEFAULT_ENTITY_ATTRS / DEFAULT_GROUP_ATTRS) is used. The defaults intentionally do NOT include id since that is already the target_user_id / target_group_id column on the prov_* row.

  • Constructor Details

    • GrouperScim2ProvisioningTargetNativeSync

      public GrouperScim2ProvisioningTargetNativeSync()

  • Method Details

    • getDefaultNativeAttributeConfigsEntities

      protected List<GrouperProvisioningNativeAttributeConfig> getDefaultNativeAttributeConfigsEntities()
      Description copied from class: GrouperProvisioningTargetNativeSync
      Per-protocol sensible-default attribute list for entities (users) when the operator hasn't configured nativeAttributesEntities. Override in protocol subclasses to return a curated list (e.g. SCIM core schema fields). Default is empty — for LDAP this means "no extra capture beyond what the regular target query returned," which is the historical behavior.
      Overrides:
      getDefaultNativeAttributeConfigsEntities in class GrouperProvisioningTargetNativeSync

    • getDefaultNativeAttributeConfigsGroups

      protected List<GrouperProvisioningNativeAttributeConfig> getDefaultNativeAttributeConfigsGroups()
      Description copied from class: GrouperProvisioningTargetNativeSync
      Per-protocol sensible-default attribute list for groups. See GrouperProvisioningTargetNativeSync.getDefaultNativeAttributeConfigsEntities().
      Overrides:
      getDefaultNativeAttributeConfigsGroups in class GrouperProvisioningTargetNativeSync

    • buildNativeGroupFromJson

      public GrouperProvisioningTargetNativeGroup buildNativeGroupFromJson(com.fasterxml.jackson.databind.JsonNode resourceNode)
      Build a native group bean from the SCIM JSON resource. targetId is read from /id; the attributes map is populated for each entry in GrouperProvisioningTargetNativeSync.effectiveNativeAttributeConfigsGroups() (operator-configured or default).

    • buildNativeUserFromJson

      public GrouperProvisioningTargetNativeUser buildNativeUserFromJson(com.fasterxml.jackson.databind.JsonNode resourceNode)
      Build a native user bean from the SCIM JSON resource. targetId is read from /id; the attributes map is populated for each entry in GrouperProvisioningTargetNativeSync.effectiveNativeAttributeConfigsEntities() (operator-configured or default).

    • captureGroupJson

      public void captureGroupJson(com.fasterxml.jackson.databind.JsonNode resourceNode)
      Build a native group bean from the SCIM JSON and record it. No-op if reporting is off.

    • recordGroupInsertJson

      public void recordGroupInsertJson(com.fasterxml.jackson.databind.JsonNode resourceNode)
      Group-insert sync-back: build the native group from the create (POST) response JSON and run it through the generic insert hook. SCIM echoes the created resource on POST, so this registers it "like a read" (no re-read needed) and the drain skips the id.

    • captureEntityJson

      public void captureEntityJson(com.fasterxml.jackson.databind.JsonNode resourceNode)
      Build a native user bean from the SCIM JSON and record it. No-op if reporting is off.

    • recordUserInsertJson

      public void recordUserInsertJson(com.fasterxml.jackson.databind.JsonNode resourceNode)
      Entity-insert sync-back: build the native user from the create (POST) response JSON and run it through the generic insert hook. SCIM echoes the created resource on POST, so this registers it "like a read" (no re-read needed) and the drain skips the id.

    • captureMembershipsFromCache

      public void captureMembershipsFromCache(GrouperScim2MembershipCache grouperScim2MembershipCache)
      Translate the GrouperScim2MembershipCache's groupId → userIds map into GrouperProvisioningTargetNativeMembership records and record them in bulk. No-op if the cache is empty or reporting is off.

    • captureUserJsonFromCurrentProvisioner

      public static void captureUserJsonFromCurrentProvisioner(com.fasterxml.jackson.databind.JsonNode resourceNode)
      Capture a SCIM user JSON resource against the current provisioner's sync. No-op if there's no current provisioner (e.g. an out-of-cycle CLI call) or if the active provisioner isn't a SCIM one (defensive — shouldn't happen in practice since these dispatchers are only called from the SCIM commands class).

    • captureUserInsertFromCurrentProvisioner

      public static void captureUserInsertFromCurrentProvisioner(com.fasterxml.jackson.databind.JsonNode resourceNode)
      Run a SCIM user create (POST) response through the insert sync-back hook.

    • captureGroupUpdateFromCurrentProvisioner

      public static void captureGroupUpdateFromCurrentProvisioner(String targetId, com.fasterxml.jackson.databind.JsonNode resourceNode)
      SCIM group-update sync-back (uniform write rule): if the update response carries the resource, register it like a read so the end-of-run drain skips it; if there is no body (e.g. a 204), buildNativeGroupFromJson returns null and the id is only marked for the drain to re-read. Either way the stale pre-update read-pass native is dropped.

    • captureUserUpdateFromCurrentProvisioner

      public static void captureUserUpdateFromCurrentProvisioner(String targetId, com.fasterxml.jackson.databind.JsonNode resourceNode)
      see captureGroupUpdateFromCurrentProvisioner(java.lang.String, com.fasterxml.jackson.databind.JsonNode); user axis

    • captureGroupJsonFromCurrentProvisioner

      public static void captureGroupJsonFromCurrentProvisioner(com.fasterxml.jackson.databind.JsonNode resourceNode)
      Capture a SCIM group JSON resource against the current provisioner's sync.

    • captureGroupInsertFromCurrentProvisioner

      public static void captureGroupInsertFromCurrentProvisioner(com.fasterxml.jackson.databind.JsonNode resourceNode)
      Run a SCIM group create (POST) response through the insert sync-back hook.

    • captureMembershipsFromCacheIfActive

      public static void captureMembershipsFromCacheIfActive(GrouperScim2MembershipCache grouperScim2MembershipCache)
      Drain a SCIM membership cache into the current provisioner's native memberships list.

    • captureMembershipInsertFromCurrentProvisioner

      public static void captureMembershipInsertFromCurrentProvisioner(String groupId, String userId)
      Record a successful SCIM membership add (PATCH op=add) against the current provisioner. No-op out of cycle or for a non-SCIM provisioner. Memberships are tracked from writes only (never re-read) -- see GrouperProvisioningTargetNativeSync.recordTargetNativeMembershipInsert(java.lang.String, java.lang.String).

    • captureMembershipDeleteFromCurrentProvisioner

      public static void captureMembershipDeleteFromCurrentProvisioner(String groupId, String userId)
      Record a successful SCIM membership remove (PATCH op=remove) against the current provisioner.

    • captureMembershipReplaceFromCurrentProvisioner

      public static void captureMembershipReplaceFromCurrentProvisioner(String groupId, Set<String> userIds)
      Record a successful SCIM full-members replace (PATCH op=replace on members) against the current provisioner: the group's mirror membership set becomes exactly userIds.