From commits-return-10934-archive-asf-public=cust-asf.ponee.io@syncope.apache.org Wed Mar 7 17:10:36 2018 Return-Path: X-Original-To: archive-asf-public@cust-asf.ponee.io Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by mx-eu-01.ponee.io (Postfix) with SMTP id B54ED180656 for ; Wed, 7 Mar 2018 17:10:35 +0100 (CET) Received: (qmail 43385 invoked by uid 500); 7 Mar 2018 16:10:34 -0000 Mailing-List: contact commits-help@syncope.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@syncope.apache.org Delivered-To: mailing list commits@syncope.apache.org Received: (qmail 43376 invoked by uid 99); 7 Mar 2018 16:10:34 -0000 Received: from git1-us-west.apache.org (HELO git1-us-west.apache.org) (140.211.11.23) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 07 Mar 2018 16:10:34 +0000 Received: by git1-us-west.apache.org (ASF Mail Server at git1-us-west.apache.org, from userid 33) id 33582F4EAC; Wed, 7 Mar 2018 16:10:33 +0000 (UTC) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: ilgrosso@apache.org To: commits@syncope.apache.org Date: Wed, 07 Mar 2018 16:10:33 -0000 Message-Id: X-Mailer: ASF-Git Admin Mailer Subject: [1/2] syncope git commit: Document NOT_ATTEMPTED Repository: syncope Updated Branches: refs/heads/2_0_X 8bf65e379 -> 3082508cd refs/heads/master 0c1f92afc -> 45124bdec Document NOT_ATTEMPTED Project: http://git-wip-us.apache.org/repos/asf/syncope/repo Commit: http://git-wip-us.apache.org/repos/asf/syncope/commit/3082508c Tree: http://git-wip-us.apache.org/repos/asf/syncope/tree/3082508c Diff: http://git-wip-us.apache.org/repos/asf/syncope/diff/3082508c Branch: refs/heads/2_0_X Commit: 3082508cd7bdc6adc98f3e06cfbcef0172083a50 Parents: 8bf65e3 Author: Francesco Chicchiriccò Authored: Wed Mar 7 17:10:14 2018 +0100 Committer: Francesco Chicchiriccò Committed: Wed Mar 7 17:10:14 2018 +0100 ---------------------------------------------------------------------- .../concepts/provisioning/propagation.adoc | 47 +++++++++++++------- 1 file changed, 30 insertions(+), 17 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/syncope/blob/3082508c/src/main/asciidoc/reference-guide/concepts/provisioning/propagation.adoc ---------------------------------------------------------------------- diff --git a/src/main/asciidoc/reference-guide/concepts/provisioning/propagation.adoc b/src/main/asciidoc/reference-guide/concepts/provisioning/propagation.adoc index 9ddd202..f69b51d 100644 --- a/src/main/asciidoc/reference-guide/concepts/provisioning/propagation.adoc +++ b/src/main/asciidoc/reference-guide/concepts/provisioning/propagation.adoc @@ -35,6 +35,14 @@ propagation process: * *Any Object*: the external resources directly assigned plus the ones assigned to Groups configured for the Any Object ==== +[WARNING] +.Adequate capabilities to Connectors and External Resources +==== +Ensure to provide an adequate set of <> to underlying Connectors and +External Resources for the actual operations to perform, otherwise the Propagation Tasks will report `NOT_ATTEMPTED` as +execution status. +==== + By default, the propagation process is controlled by the ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/PriorityPropagationTaskExecutor.java[PriorityPropagationTaskExecutor^], @@ -62,6 +70,28 @@ https://github.com/apache/syncope/tree/2_0_X/core/provisioning-api/src/main/java endif::[] interface can be provided, in case the required behaviour does not fit into the provided implementation. +[[propagation-password]] +[TIP] +.Propagate password values +==== +Password values are kept in the internal storage according to the `password.cipher.algorithm` +<>, whose value is `SHA1` by default. +`SHA1` is a hash algorithm: this means that, once stored, the cleartext value cannot be reverted any more. + +During propagation, Syncope fetches all data of the given User, then prepares the attributes to propagate, according to +the provided mapping; password has a special treatment: + +* if cleartext value is available (this cannot happen during <>), it is sent to the External Resource +* if `password.cipher.algorithm` is `AES` (the only supported reversible algorithm), then the ciphered password value is + made cleartext again, and sent to the External Resource +* if the <> is set, a random password value is generated + according to the defined password policies, and sent to the External Resource +* otherwise, a `null` value is sent to the External Resource + +Password values are always sent to External Resources wrapped as ConnId +http://connid.tirasa.net/apidocs/1.4/org/identityconnectors/common/security/GuardedString.html[GuardedString^] objects. +==== + ===== PropagationActions The propagation process can be decorated with custom logic to be invoked around task execution, by associating @@ -120,20 +150,3 @@ endif::[] | Required for setup of an External Resource based on the https://connid.atlassian.net/wiki/display/BASE/Google+Apps#GoogleApps-Configuration[ConnId GoogleApps connector bundle^]. |=== - -[[propagation-password]] -[TIP] -.Propagate password values -==== -Password values are kept in the internal storage according to the `password.cipher.algorithm` <>, whose value is `SHA1` by default. -`SHA1` is a hash algorithm: this means that, once stored, the cleartext value cannot be reverted any more. - -During propagation, Syncope fetches all data of the given User, then prepares the attributes to propagate, according to the provided mapping; password has a special treatment: - -* if cleartext value is available (this cannot happen during <>), it is sent to the External Resource -* if `password.cipher.algorithm` is `AES` (the only supported reversible algorithm), then the ciphered password value is made cleartext again, and sent to the External Resource -* if the <> is set, a random password value is generated according to the defined password policies, and sent to the External Resource -* otherwise, a `null` value is sent to the External Resource - -Password values are always sent to External Resources wrapped as ConnId http://connid.tirasa.net/apidocs/1.4/org/identityconnectors/common/security/GuardedString.html[GuardedString^] objects. -====