IdStory Identity Manager

ProcessAllAutomaticRoleByAttributeTaskExecutor doesn't really touch automatic role "in the middle", i. e., newly assigned ones or newly removed ones, in terms of validity. This is done by the IdentityContractUpdateByAutomaticRoleProcessor which is run after the contract is updated. I will investigate it, it's not covered by tests so I will add them and try to replicate the issue reported. But of course, the issue may be located elsewhere.

I've abandoned the attempts to use Clock to mock time. This would be useful but it would also be a massive rework of fairly critical parts of the application.

I was, however, able to write a test that fails even though it shouldn't. I have a user with a valid contract, create an automatic role, then change the contract's validity to the past (using saveInteral to skip all processors), then set the contract validity to the future (via an event, the same way a synchronization does). In the end, the user should have the role with the last validity but instead, they have the role with the validity of the original contract.

The culprit seems to be in the IdentityContractUpdateByAutomaticRoleProcessor. The way I tested this was fairly desperate - I put a breakpoint in every class which can set the role validity, then ran the code. This was the only class where role validity was set...

Implemented. I ended up using a fairly careful approach that cannot break anything, even though a deeper refactoring would be great. Instead, I just ensured that the code would run the way it was intended.

I tried to run the code in the appliance from a WAR file but, in the end, I gave up. The appliance started with the correct version but didn't use the correct configuration. At this moment, I don't suggest anybody try this. But it would be useful and we could quite easily add this to CzechIdM Docker image for development purposes.

1. have a user with a valid contract from synchronization
2. set the system time to yesterday (-1 day from today) - in Ubuntu, a simple GUI change in settings does that
3. change the user's contract end of validity to yesterday
4. set the system time to today
5. synchronize the contract with HR processes enabled
6. check that the validity of the assigned role was updated based on the contract's validity

This didn't work in the past but it works now. If you don't want to or can't follow the testing steps, please let me know, and I will show you it's working.

@kucerar, can you please give me feedback?

PR: https://github.com/bcvsolutions/CzechIdMng/pull/198

In the end, this ticket could have been much easier to solve but I tried fairly complicated steps to replicate the issue. It can be replicated quite easily.

LGTM, thx. Merged to develop