An utility class/managed bean(JSF) to manage user's roles and group assignment in exoplatform gatein container.

OrganizationServiceUtil.java

import java.util.ArrayList;
import java.util.Collection;
import java.util.Iterator;
import java.util.List;

import javax.faces.bean.ManagedBean;
import javax.faces.bean.SessionScoped;

import org.apache.log4j.Logger;
import org.exoplatform.commons.utils.secure.SecureSet;
import org.exoplatform.container.ExoContainer;
import org.exoplatform.container.ExoContainerContext;
import org.exoplatform.container.PortalContainer;
import org.exoplatform.container.RootContainer;
import org.exoplatform.container.component.ComponentRequestLifecycle;
import org.exoplatform.container.component.RequestLifeCycle;
import org.exoplatform.portal.application.PortalRequestContext;
import org.exoplatform.services.organization.Group;
import org.exoplatform.services.organization.Membership;
import org.exoplatform.services.organization.MembershipType;
import org.exoplatform.services.organization.OrganizationService;
import org.exoplatform.services.organization.idm.ExtGroup;
import org.exoplatform.services.organization.User;
import org.exoplatform.services.security.Identity;
import org.exoplatform.services.security.IdentityRegistry;
import org.exoplatform.services.security.MembershipEntry;

@ManagedBean
@SessionScoped
/**
 * An utility class to manage user's roles and group assignment in exoplatform gatein container.
 * 
 * @author Sachin Handiekar
 */
public class OrganizationServiceUtil {
	private static final Logger LOGGER = Logger.getLogger(OrganizationServiceUtil.class);

	private static final String MEMBERSHIP_TYPE = "member";

	private static final String PLATFORM_PREFIX = "/platform/";

	public synchronized void refreshUserGroups(String userName) throws OrganizationServiceUtilException {

		List<String> usersGroupList = getUserGroups(userName);

		LOGGER.info("Removing currently assigned groups from platform....");
		removeUserFromAllGroups(userName);

		// Add the groups into platforms
		for (String groupName : usersGroupList) {
			LOGGER.info("Adding user into " + groupName);
			addUserToPicketLinkGroup(userName, groupName);
		}

		addUserToPicketLinkGroup(userName, "users");

	}

	/**
	 * A method which returns a list of user's group. The groups should be
	 * defined in LDAP. Please see the usage guide on Picketlink Groups in
	 * Gatein.
	 * 
	 * @param userName current logged in user's username
	 * @return a list of user groups.
	 */
	private List<String> getUserGroups(String userName) throws OrganizationServiceUtilException {

		/**
		 * A web=service can be called in this method to retrieve a list of
		 * groups which are stored in the database
		 */
		List<String> groupList = new ArrayList<String>();

		groupList.add("SampleGroup1");
		groupList.add("SampleGroup2");
		groupList.add("SampleGroup3");

		return groupList;

	}

	/**
	 * Refresh the permission of the current logged in user. The userName will
	 * be taken from the Future's Content Bean.
	 * 
	 * @param userName userName of the user whose permission's need to get
	 * refreshed.
	 * @throws OrganizationServiceUtilException if any error occurs
	 */
	public synchronized void refreshUserPermissions(String userName) throws OrganizationServiceUtilException {

		List<String> userPermissions = null;
		try {
			userPermissions = getUserPermissions(userName);

			LOGGER.info(":: userPermissions :: ");
			for (String perm : userPermissions) {
				LOGGER.info("Permission :: " + perm);

			}

			getIdentity(userName).setRoles(userPermissions);
		}
		catch (Exception ex) {
			LOGGER.error("An error occurred while getting permission for user (" + userName + ")", ex);
		}

	}

	/**
	 * A method which returns a list of permission/roles. This method can be
	 * used to call a webservice to retrieve a list of roles for a given
	 * username.
	 * 
	 * @throws ServiceRuntimeFault
	 * @throws RoleExpiredFault
	 * @throws RoleNotFoundFault
	 */
	private synchronized List<String> getUserPermissions(String userName) {

		List<String> userPerms = new ArrayList<String>();

		userPerms.add("PERMISSION_1");
		userPerms.add("PERMISSION_2");
		userPerms.add("PERMISSION_3");
		userPerms.add("PERMISSION_4");

		return userPerms;
	}

	/**
	 * Add a role/permission from the User Identity object.
	 * 
	 * @param userName userName of the user
	 * @param permissionName name of the permission.
	 */
	public synchronized void addUserPermission(String userName, String permissionName) {

		getIdentity(userName).getRoles().add(permissionName);
	}

	/**
	 * Remove a role/permission from the User Identity object.
	 * 
	 * @param userName userName of the user
	 * @param permissionName name of the permission.
	 */
	public synchronized void removeUserPermission(String userName, String permissionName) {
		getIdentity(userName).getRoles().remove(permissionName);
	}

	public void printAllGroups(String userName) {
		printSet(getIdentity(userName).getMemberships());
	}

	public void printAllPermissions(String userName) {
		LOGGER.info(":: Printing Roles/Permissions for user - " + userName);

		SecureSet<String> secureSet1 = (SecureSet<String>) getIdentity(userName).getRoles();

		Iterator<String> itr1 = secureSet1.iterator();

		while (itr1.hasNext()) {
			LOGGER.info("Role/Permission Name : " + itr1.next());
		}

	}

	private void printSet(Collection<MembershipEntry> membershipSet) {
		SecureSet<MembershipEntry> membershipEntrySet = (SecureSet<MembershipEntry>) membershipSet;

		Iterator<MembershipEntry> membershipEntryIterator = membershipEntrySet.iterator();

		while (membershipEntryIterator.hasNext()) {

			MembershipEntry membershipEntry = membershipEntryIterator.next();
			LOGGER.info("Group :: " + membershipEntry.getGroup());
			LOGGER.info("MembershipType :: " + membershipEntry.getMembershipType());

		}
	}

	public synchronized void removeUserFromPicketLinkGroup(String userName, String groupName) {
		OrganizationService orgService = (OrganizationService) getContainer().getComponentInstanceOfType(
				OrganizationService.class);
		final String groupNameVal = PLATFORM_PREFIX + groupName;

		try {
			begin(orgService);

			Membership membership = orgService.getMembershipHandler().findMembershipByUserGroupAndType(userName,
					groupNameVal, MEMBERSHIP_TYPE);

			orgService.getMembershipHandler().removeMembership(membership.getId(), true);

		}
		catch (Exception e) {
			LOGGER.error("Failed to remove user (" + userName + ") from group (" + groupNameVal + ").", e);
		}
		finally {
			end(orgService);
		}
	}

public synchronized void addUserToPicketLinkGroup(String userName, String groupName) throws Exception {
		OrganizationService orgService = (OrganizationService) getContainer().getComponentInstanceOfType(
				OrganizationService.class);

		final String groupNameVal = PLATFORM_PREFIX + groupName;

		try {
			begin(orgService);
			User user = orgService.getUserHandler().findUserByName(userName);

			MembershipType memberType = orgService.getMembershipTypeHandler().findMembershipType(MEMBERSHIP_TYPE);

			
			Group platformUserGroup = orgService.getGroupHandler().findGroupById("/platform");

			Group userGroup = orgService.getGroupHandler().findGroupById(groupNameVal);

			// If the group is not present, then create one
			if(userGroup == null) {
				Group tmpGroup = new ExtGroup();
				
				tmpGroup.setGroupName(groupName);
				tmpGroup.setLabel(groupName);

				orgService.getGroupHandler().addChild(platformUserGroup, tmpGroup, false);
				
				userGroup = orgService.getGroupHandler().findGroupById(groupNameVal);
			}
			
			orgService.getMembershipHandler().linkMembership(user, userGroup, memberType, true);

		}
		catch (Exception e) {
			log.error("Failed to add user " + userName + " to group " + groupNameVal + ".", e);
		}
		finally {
			end(orgService);
		}
	}

	@SuppressWarnings("unchecked")
	public synchronized void removeUserFromAllGroups(String userName) {
		OrganizationService orgService = (OrganizationService) getContainer().getComponentInstanceOfType(
				OrganizationService.class);
		LOGGER.info(":: removeUserFromAllGroups ::  ");
		try {
			begin(orgService);

			Collection<Membership> membershipList = orgService.getMembershipHandler().findMembershipsByUser(userName);

			LOGGER.debug("Membership List Size :  " + membershipList.size());

			for (Membership member : membershipList) {
				LOGGER.info("Id : " + member.getId());
				LOGGER.info("GroupId : " + member.getGroupId());
				LOGGER.info("Membership Type : " + member.getMembershipType());
				LOGGER.info("GroupId : " + member.getUserName());

			}

			orgService.getMembershipHandler().removeMembershipByUser(userName, true);

		}
		catch (Exception e) {
			LOGGER.error("Failed to remove groups for user " + userName + ".", e);
		}
		finally {
			end(orgService);
		}

	}

	/**
	 * Begin the lifecycle of Organization Service.
	 * 
	 * @param orgService organization service
	 */
	private void begin(OrganizationService orgService) {
		if (orgService instanceof ComponentRequestLifecycle) {
			RequestLifeCycle.begin((ComponentRequestLifecycle) orgService);
		}
	}

	/**
	 * End the lifecycle of Organization Service.
	 * 
	 * @param orgService organization service
	 */
	private void end(OrganizationService orgService) {
		if (orgService instanceof ComponentRequestLifecycle) {
			RequestLifeCycle.end();
		}
	}

	/**
	 * @return Gives the {@link ExoContainer} that fits best with the current
	 * context
	 */
	private ExoContainer getContainer() {
		ExoContainer container = ExoContainerContext.getCurrentContainer();
		if (container instanceof RootContainer) {
			// The top container is a RootContainer, thus we assume that we are
			// in a portal mode
			PortalRequestContext portalRequestContext = PortalRequestContext.getCurrentInstance();

			container = PortalContainer.getCurrentInstance(portalRequestContext.getRequest().getSession()
					.getServletContext());

			if (container == null) {
				container = ExoContainerContext.getTopContainer();
			}
		}
		// The container is a PortalContainer or a StandaloneContainer
		return container;
	}

	private Identity getIdentity(String userName) {
		IdentityRegistry identityRegistry = (IdentityRegistry) PortalContainer.getInstance()
				.getComponentInstanceOfType(IdentityRegistry.class);
		return identityRegistry.getIdentity(userName);
	}

}

OrganizationServiceUtilException.java

public class OrganizationServiceUtilException extends Exception {

	private static final long serialVersionUID = 1L;

	public OrganizationServiceUtilException() {
		super();
	}

	public OrganizationServiceUtilException(String message) {
		super(message);
	}

	public OrganizationServiceUtilException(Throwable cause) {
		super(cause);
	}

	public OrganizationServiceUtilException(String message, Throwable cause) {
		super(message, cause);
	}
}