IdStory Identity Manager

I tested this and it works for manually assigned contract guarantees by default. If user A is a manager of an expired contract of user B, user B will not be listed among user A's subordinates.

I updated the title.

After much testing, I found that filters for subordinates do not return subordinates if their contract was expired. No change is needed there. The UC is this:

1. have a tree node T and a tree node U where the tree node T is the parent of tree node U
2. have a user with contract C which is valid and is in position T and contract D which is expired and is in position U
3. contract D has a manager (the same as the owner of the contract) - this is correct since the filter can be parametrized to prevent this
4. the user should have no subordinates because the only potential candidate (the user themselves) has the relevant contract expired

That's how subordinate filters work in general. However, point 4 does not work this way for EavCodeContractByManagerFilter (this filter has different ways of expressing tree node hierarchy, of course).

I checked the generated SQLs and found there is a mistake in the predicate which needs to be fixed.

Fixed, tests are running:

PR: https://github.com/bcvsolutions/CzechIdMng/pull/267

Tests passed.

@kucerar, can you give me feedback?

As for testing, you need to have this config:

idm.sec.core.filter.IdmIdentity.managersFor.impl=eavCodeManagersFilter
idm.sec.core.filter.IdmIdentity.managersFor.formAttribute=super
idm.sec.core.filter.IdmIdentity.managersFor.formDefinition=default
idm.sec.core.filter.IdmIdentity.managersFor.persistentType=shortTextValue
idm.sec.core.filter.IdmIdentityContract.subordinatesFor.impl=eav-code-contract-by-manager-filter
idm.sec.core.filter.IdmIdentityContract.subordinatesFor.formDefinition=default
idm.sec.core.filter.IdmIdentityContract.subordinatesFor.formAttribute=super
idm.sec.core.filter.IdmIdentityContract.subordinatesFor.persistentType=shortTextValue

Have two tree nodes, create a short text EAV attribute called "super". The tree nodes don't need to be parents of each other (the structure can be flat) but the subordinate tree should have in the EAV attribute the code of the superior tree. After that, you can follow notes from #3129#note-6. If you have any questions, please let me know. I also have the SQLs from generated by Hibernate based on the predicates before and after the change if you want to see them.

thx for detailed info how to test it :) , it works. Merged.