Check if the role displayName contains a domain
Prevent adding roles with domain name with the scim2 api since the scim2 api does not have context about user stores. It only add the roles to the primary store.
@@ -159,6 +159,13 @@ public class RoleDAOImpl implements RoleDAO {
roleName = removeInternalDomain(roleName);
String roleID;
+ if (isDomainSeparatorPresent(roleName)) {
+ /* SCIM2 API do not support for roles with domains. Currently, role endpoint does not have context about
+ userstores. */
+ throw new IdentityRoleManagementClientException(INVALID_REQUEST.getCode(),
+ "Entered role name contains a domain. Role name: " + roleName);
+ }
+
if (!isExistingRoleName(roleName, tenantDomain)) {
try (Connection connection = IdentityDatabaseUtil.getUserDBConnection(true)) {
try {
@@ -266,6 +273,16 @@ public class RoleDAOImpl implements RoleDAO {
return roleName;
}
+ /**
+ * Check if the role name has a domain.
+ * @param roleName Role name.
+ * @return True if the role name has a domain.
+ */
+ private boolean isDomainSeparatorPresent(String roleName) {
+
+ return roleName.contains(UserCoreConstants.DOMAIN_SEPARATOR);
+ }
+
@Override
public Role getRole(String roleID, String tenantDomain) throws IdentityRoleManagementException {
@@ -802,6 +819,12 @@ public class RoleDAOImpl implements RoleDAO {
"Invalid operation. Role: " + roleName + " Cannot be renamed since it's a read only system role.");
}
int tenantId = IdentityTenantUtil.getTenantId(tenantDomain);
+ if (isDomainSeparatorPresent(roleName)) {
+ /* SCIM2 API do not support for roles with domains. Currently, role endpoint does not have context about
+ userstores. */
+ throw new IdentityRoleManagementClientException(INVALID_REQUEST.getCode(),
+ "Entered role name contains a domain. Role name: " + roleName);
+ }
if (!isExistingRoleID(roleID, tenantDomain)) {
throw new IdentityRoleManagementClientException(ROLE_NOT_FOUND.getCode(),
"Role id: " + roleID + " does not exist in the system.");
