callResourceMethod 

Invokes the specified method on the resource by passing it the specified arguments. 

buildDn, buildDns 

Takes a name (or names) and the base context to append to the name. This method returns a string of fully qualified distinguished (DN) names. For example, passing in group1 and dc=example,dc=com returns the string cn=group1, dc=example, dc=com. 

checkStringQualityPolicy 

Checks the value of a designated string against string policy. 

controlsAtLeastOneOrganization 

Determines whether a currently authenticated user controls any of the organizations specified on a list of one or more organization (ObjectGroup) names. The supported list of organizations include those returned by listing all objects of type ObjectGroup. 

getObject 

Retrieves an object from the repository (subject to authorization). 

getObjectNames 

Returns a list of the names of objects of a given type to which the session owner (or currently logged-in user) has access. Additional parameters can be specified in the options map to control the list of names returned. 

This method is the preferred way for returning a list of names of objects rather than attempting session.getObjects(). This method first goes to the ObjectCache, then to the repository, if necessary, for searches.

getOrganizationsDisplayNames 

Returns a list of organization handles that the current administrator has access to. Forms that need select and multiselection lists of organizations should use this method. 

getResources 

Builds a list of the names of resources that match a particular resource attribute value (such as type=LDAP). If a current list is passed in, the lists are merged. 

getResourceObjects 

Returns a list of objects where each object contains a set of attributes including type, name, and ID (a DN, or fully qualified name) as well as any requested searchAttrsToGet value. The returned value is a List of GenericObjects. Each GenericObject can be accessed similar to how a Map is accessed. Invoking a get method on each object, which passes in the name of the attribute, returns the attribute value.

getRoles 

Returns a list of role names that the current administrator has access to. If a current value or current list is supplied, the role name or names on the list are added to the role names returned. 

getUnassignedApplications 

Builds a list of application names suitable for a user’s private applications. (A private application is an application that is directly assigned to a user.) This is the list of all accessible applications minus the names of the applications that are already assigned to the user through their role.

The resulting list is convenient for use in forms for assigning private applications. 

getSubordinates 

Retrieves a list of the specified managerial subordinates of a user. 

getUnassignedResources 

Build a list of resource names suitable for the private resources of a user. (A private resource is a resource that is directly assigned to a user.) This is the list of all accessible resources minus the names of the resources that are already assigned to the user through their role.

The resulting list is convenient for use in forms for assigning private resources. 

getUsers 

The first variant of this method returns all users. The second variant by default returns all users, but you can specify a map of options to further filter the list. 

listResourceIObjects 

Retrieves a list of resource objects of a specified type (for example, group). This method first attempts to get the list from the server’s resourceObjectListCache. If found, this list is returned.

If this list is not found, the method invokes the listResourceObjects method on each resource before merging, sorting, and removing duplicates on the resulting lists. Finally, it caches this new list in the server’s resourceObjectListCache for any subsequent requests for the same resource object type from the same resource(s).

This method runs as the currently authenticated administrator (for example, subject). Variants take a single resource ID or a subject string and an existing session.

This method has multiple variants that differ on whether: 

The method returns a single resource versus a resource list. 

The cache should be cleared. 

The method is sending a session ID (implemented when the user has already been authenticated) or a subject string (subjectString). Typically, you will use Session.

testObject 

Tests to see if a specified object exists, even if the subject is not authorized to view the object. When launching processes to create new users, use this method to prevent attempts to create duplicate objects by an administrator who cannot see the entire tree. 

testUser 

Tests to see if a specified user exists, even if the subject is not authorized to view the object. When launching processes to create new users, use this method to prevent attempts to create duplicate objects by an administrator who cannot see the entire tree. 

hasCapability, hasCapabilities 

Checks to see if the user has a specified capability or capabilities (String). This method checks for a capability that is assigned either directly or indirectly through AdminGroups and/or AdminRoles. Requires a session value.