Fixes #398

Author: oharsta

client/src/api/index.js

@@ -168,6 +168,10 @@ export function organizationGUIDValidation(organizationGUID) {
     return fetchJson(`/api/v1/manage/organization-guid-validation/${organizationGUID}`, {}, {}, false);
 }
 
+export function hasProvisionings(manageId) {
+    return fetchJson(`/api/v1/manage/provisionings/${manageId}`);
+}
+
 //Roles
 export function rolesByApplication(force = true, pagination = {}) {
     const queryPart = paginationQueryParams(pagination, {force: !!force})

client/src/components/WarningIndicator.jsx

@@ -0,0 +1,15 @@
+import React from "react";
+import "./WarningIndicator.scss";
+import {ReactComponent as WarningIco} from "../icons/warning.svg";
+import DOMPurify from "dompurify";
+
+export default function WarningIndicator({msg, standalone = false, decode = true, adjustMargin = false}) {
+    const className = `warning-indication ${standalone ? "standalone" : ""} ${adjustMargin ? "adjust-margin" : ""}`;
+    msg = msg.replaceAll("?", "");
+    return decode ? <span className={className}><WarningIco/>{msg}</span> :
+        <span className={className}>
+            <WarningIco/>
+            <span className={"warning-message"}
+                  dangerouslySetInnerHTML={{__html: DOMPurify.sanitize(msg, {ADD_ATTR: ['target']})}}/>
+        </span>
+}

client/src/components/WarningIndicator.scss

@@ -0,0 +1,25 @@
+span.warning-indication {
+    color: #C15500;
+
+    display: flex;
+    align-items: center;
+    margin-top: 5px;
+
+    &.standalone {
+        margin-bottom: 15px;
+    }
+
+    &.adjust-margin {
+        margin-top: -15px;
+    }
+
+    span.warning-message {
+        word-break: keep-all;
+    }
+
+    svg {
+        margin-right: 10px;
+        width: 18px;
+        height: auto;
+    }
+}

client/src/icons/warning.svg

@@ -186,7 +186,8 @@
             info: "The following users will lose their access:",
             userInfo: "{{name}} ({{authority}}), last activity {{lastActivity}}",
             andMore: "And {{nbr}} more.. Check the list of current users for more details."
-        }
+        },
+        noProvisioning: "Users added to this role, won't have immediate access to this application. See the <a href='http://wiki.surfnet.nl/' target='_blank'>wiki</a> for more information"
     },
     applications: {
         title: "Access Roles for this application ({{nbr}})",

client/src/locale/en.js

@@ -186,7 +186,8 @@ const nl = {
             info: "De volgende gebruikers verliezen toegang tot deze rol:",
             userInfo: "{{name}} ({{authority}}), laatste activiteit {{lastActivity}}",
             andMore: "En nog {{nbr}} meer.. Bekijk de lijst van huidige gebruikers voor meer details."
-        }
+        },
+        noProvisioning: "Gebruikers die toegevoegd worden aan deze rol, hebben niet gelijk toegang tot deze applicatie. Zie de <a href='http://wiki.surfnet.nl/' target='_blank'>wiki</a> voor meer information"
     },
     applications: {
         title: "Toegangsrollen voor deze applicatie ({{nbr}})",

client/src/locale/nl.js

@@ -7,7 +7,7 @@ import {
     allProviders,
     consequencesRoleDeletion,
     createRole,
-    deleteRole,
+    deleteRole, hasProvisionings,
     me,
     organizationGUIDValidation,
     roleByID,
@@ -28,6 +28,7 @@ import ConfirmationDialog from "../components/ConfirmationDialog";
 import SwitchField from "../components/SwitchField";
 import {dateFromEpoch, displayExpiryDate, futureDate} from "../utils/Date";
 import DOMPurify from "dompurify";
+import WarningIndicator from "../components/WarningIndicator";
 
 const DEFAULT_EXPIRY_DAYS = 365;
 const CUT_OFF_DELETED_USER = 5;
@@ -58,6 +59,7 @@ export const RoleForm = () => {
     const [customRoleExpiryDate, setCustomRoleExpiryDate] = useState(false);
     const [customInviterDisplayName, setCustomInviterDisplayName] = useState(false);
     const [applications, setApplications] = useState([]);
+    const [provisionings, setProvisionings] = useState({});
     const [allowedToEditApplication, setAllowedToEditApplication] = useState(true);
     const [deletedUserRoles, setDeletedUserRoles] = useState(null);
 
@@ -247,6 +249,11 @@ export const RoleForm = () => {
     const changeApplication = (index, application) => {
         applications.splice(index, 1, application);
         setApplications([...applications]);
+        hasProvisionings(application.manageId)
+            .then(res => {
+                const newProvisionings = {...provisionings, [application.manageId]: !res && !application.receivesMemberships};
+                setProvisionings(newProvisionings);
+            })
     }
 
     const changeApplicationLandingPage = (index, e) => {
@@ -367,6 +374,9 @@ export const RoleForm = () => {
                                 <ErrorIndicator msg={I18n.t("forms.required", {
                                     attribute: I18n.t("roles.manage").toLowerCase()
                                 })}/>}
+                            {provisionings[application?.manageId] &&
+                                <WarningIndicator msg={I18n.t("roles.noProvisioning")} decode={false}/>
+                            }
                         </div>
                         <div className="input-field-container">
                             <InputField name={I18n.t("roles.landingPage")}

client/src/pages/RoleForm.js

@@ -10,6 +10,7 @@ export const singleProviderToOption = (provider, locale) => {
         type: manageType,
         manageType: manageType,
         manageId: manageId,
+        receivesMemberships: provider.receivesMemberships,
         url: provider.url || provider.landingPage,
         landingPage: provider.landingPage || provider.url
     };

client/src/utils/Manage.js

@@ -91,7 +91,6 @@ public ResponseEntity<Map<String, Object>> organizationGUIDValidation(@Parameter
 
     @GetMapping("applications")
     public ResponseEntity<Map<String, List<Map<String, Object>>>> applications(@Parameter(hidden = true) User user) {
-        LOG.debug("/applications");
         LOG.debug(String.format("GET /manage/applications for user %s", user.getEduPersonPrincipalName()));
 
         UserPermissions.assertInstitutionAdmin(user);
@@ -130,4 +129,12 @@ public ResponseEntity<Map<String, List<Map<String, Object>>>> applications(@Para
         ));
     }
 
+    @GetMapping("provisionings/{id}")
+    public ResponseEntity<Boolean> provisionings(@PathVariable("id") String id,
+                                                 @Parameter(hidden = true) User user) {
+        LOG.debug(String.format("GET /manage/provisionings for user %s", user.getEduPersonPrincipalName()));
+        UserPermissions.assertInstitutionAdmin(user);
+        List<Map<String, Object>> provisionings = manage.provisioning(List.of(id));
+        return ResponseEntity.ok(!provisionings.isEmpty());
+    }
 }

server/src/main/java/invite/api/ManageController.java

@@ -91,6 +91,23 @@ default Map<String, Object> transformProvider(Map<String, Object> provider) {
         application.put("name:en", metaDataFields.get("name:en"));
         application.put("name:nl", metaDataFields.get("name:nl"));
         application.put("institutionGuid", metaDataFields.get("coin:institution_guid"));
+        Map<String, Object> arp = (Map<String, Object>) data.get("arp");
+        if (!CollectionUtils.isEmpty(arp)) {
+            boolean enabled = (boolean) arp.getOrDefault("enabled", false);
+            if (!enabled) {
+                //Will receive all attributes, but not from any other source than idp
+                application.put("receivesMemberships", false);
+            } else {
+                Map<String, Object> attributes = (Map<String, Object>) arp.getOrDefault("attributes", Map.of());
+                List<Map<String, Object>> isMemberOf = (List<Map<String, Object>>) attributes.get("urn:mace:dir:attribute-def:isMemberOf");
+                if (CollectionUtils.isEmpty(isMemberOf)) {
+                    application.put("receivesMemberships", false);
+                } else {
+                    boolean receivesVootMemberships = isMemberOf.stream().anyMatch(m -> m.get("source") == "voot");
+                    application.put("receivesMemberships", receivesVootMemberships);
+                }
+            }
+        }
         return application;
     }