Added user-find-membership CLI.

A new CLI has been added to find the groups which a particular user
is a member.

Ticket #190

13 files changed, 482 insertions, 3 deletions

diff --git a/base/ca/src/com/netscape/ca/CertificateAuthorityApplication.java b/base/ca/src/com/netscape/ca/CertificateAuthorityApplication.java
index 14b44e5d7..4c81ff925 100644
--- a/base/ca/src/com/netscape/ca/CertificateAuthorityApplication.java
+++ b/base/ca/src/com/netscape/ca/CertificateAuthorityApplication.java
@@ -16,6 +16,7 @@ import com.netscape.cms.servlet.admin.GroupService;
 import com.netscape.cms.servlet.admin.KRAConnectorService;
 import com.netscape.cms.servlet.admin.SystemCertService;
 import com.netscape.cms.servlet.admin.UserCertService;
+import com.netscape.cms.servlet.admin.UserMembershipService;
 import com.netscape.cms.servlet.admin.UserService;
 import com.netscape.cms.servlet.cert.CertService;
 import com.netscape.cms.servlet.csadmin.SecurityDomainService;
@@ -46,6 +47,7 @@ public class CertificateAuthorityApplication extends Application {
         classes.add(GroupMemberService.class);
         classes.add(GroupService.class);
         classes.add(UserCertService.class);
+        classes.add(UserMembershipService.class);
         classes.add(UserService.class);
 
         // system certs
diff --git a/base/common/src/com/netscape/certsrv/user/UserClient.java b/base/common/src/com/netscape/certsrv/user/UserClient.java
index 23136200d..87fe391b6 100644
--- a/base/common/src/com/netscape/certsrv/user/UserClient.java
+++ b/base/common/src/com/netscape/certsrv/user/UserClient.java
@@ -32,6 +32,7 @@ public class UserClient extends PKIClient {
 
     public UserResource userClient;
     public UserCertResource userCertClient;
+    public UserMembershipResource userMembershipClient;
 
     public UserClient(PKIConnection connection) throws URISyntaxException {
         super(connection);
@@ -46,6 +47,7 @@ public class UserClient extends PKIClient {
     public void init() throws URISyntaxException {
         userClient = createProxy(UserResource.class);
         userCertClient = createProxy(UserCertResource.class);
+        userMembershipClient = createProxy(UserMembershipResource.class);
     }
 
     public UserCollection findUsers(String filter, Integer start, Integer size) {
@@ -89,4 +91,8 @@ public class UserClient extends PKIClient {
     public void removeUserCert(String userID, String certID) {
         userCertClient.removeUserCert(userID, certID);
     }
+
+    public UserMembershipCollection findUserMemberships(String userID, Integer start, Integer size) {
+        return userMembershipClient.findUserMemberships(userID, start, size);
+    }
 }
diff --git a/base/common/src/com/netscape/certsrv/user/UserMembershipCollection.java b/base/common/src/com/netscape/certsrv/user/UserMembershipCollection.java
new file mode 100644
index 000000000..f7646d2ef
--- /dev/null
+++ b/base/common/src/com/netscape/certsrv/user/UserMembershipCollection.java
@@ -0,0 +1,83 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2013 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.certsrv.user;
+
+import java.util.ArrayList;
+import java.util.Collection;
+
+import javax.xml.bind.JAXBContext;
+import javax.xml.bind.Marshaller;
+import javax.xml.bind.annotation.XmlElement;
+import javax.xml.bind.annotation.XmlRootElement;
+
+import org.jboss.resteasy.plugins.providers.atom.Link;
+
+/**
+ * @author Endi S. Dewata
+ */
+@XmlRootElement(name="UserMemberships")
+public class UserMembershipCollection {
+
+    Collection<UserMembershipData> memberships = new ArrayList<UserMembershipData>();
+    Collection<Link> links = new ArrayList<Link>();
+
+    @XmlElement(name="Membership")
+    public Collection<UserMembershipData> getMemberships() {
+        return memberships;
+    }
+
+    public void setMemberships(Collection<UserMembershipData> members) {
+        this.memberships = members;
+    }
+
+    public void addMembership(UserMembershipData member) {
+        memberships.add(member);
+    }
+
+    @XmlElement(name="Link")
+    public Collection<Link> getLinks() {
+        return links;
+    }
+
+    public void setLink(Collection<Link> links) {
+        this.links = links;
+    }
+
+    public void addLink(Link link) {
+        links.add(link);
+    }
+
+    public static void main(String args[]) throws Exception {
+
+        UserMembershipCollection response = new UserMembershipCollection();
+
+        UserMembershipData membership1 = new UserMembershipData();
+        membership1.setID("Group 1");
+        response.addMembership(membership1);
+
+        UserMembershipData membership2 = new UserMembershipData();
+        membership2.setID("Group 2");
+        response.addMembership(membership2);
+
+        JAXBContext context = JAXBContext.newInstance(UserMembershipCollection.class);
+        Marshaller marshaller = context.createMarshaller();
+        marshaller.setProperty(Marshaller.JAXB_FORMATTED_OUTPUT, true);
+        marshaller.marshal(response, System.out);
+    }
+}
diff --git a/base/common/src/com/netscape/certsrv/user/UserMembershipData.java b/base/common/src/com/netscape/certsrv/user/UserMembershipData.java
new file mode 100644
index 000000000..6d5a51ebe
--- /dev/null
+++ b/base/common/src/com/netscape/certsrv/user/UserMembershipData.java
@@ -0,0 +1,83 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2013 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.certsrv.user;
+
+import javax.ws.rs.FormParam;
+import javax.xml.bind.annotation.XmlAttribute;
+import javax.xml.bind.annotation.XmlElement;
+import javax.xml.bind.annotation.XmlRootElement;
+
+import org.jboss.resteasy.plugins.providers.atom.Link;
+
+import com.netscape.certsrv.common.Constants;
+
+/**
+ * @author Endi S. Dewata
+ */
+@XmlRootElement(name="UserMembership")
+public class UserMembershipData {
+
+    String id;
+
+    Link link;
+
+    @FormParam(Constants.PR_GROUP_USER)
+    @XmlAttribute(name="id")
+    public String getID() {
+        return id;
+    }
+
+    public void setID(String id) {
+        this.id = id;
+    }
+
+    @XmlElement(name="Link")
+    public Link getLink() {
+        return link;
+    }
+
+    public void setLink(Link link) {
+        this.link = link;
+    }
+
+    @Override
+    public int hashCode() {
+        final int prime = 31;
+        int result = 1;
+        result = prime * result + ((id == null) ? 0 : id.hashCode());
+        return result;
+    }
+
+    @Override
+    public boolean equals(Object obj) {
+        if (this == obj)
+            return true;
+        if (obj == null)
+            return false;
+        if (getClass() != obj.getClass())
+            return false;
+        UserMembershipData other = (UserMembershipData) obj;
+        if (id == null) {
+            if (other.id != null)
+                return false;
+        } else if (!id.equals(other.id))
+            return false;
+        return true;
+    }
+}
diff --git a/base/common/src/com/netscape/certsrv/user/UserMembershipResource.java b/base/common/src/com/netscape/certsrv/user/UserMembershipResource.java
new file mode 100644
index 000000000..193af5126
--- /dev/null
+++ b/base/common/src/com/netscape/certsrv/user/UserMembershipResource.java
@@ -0,0 +1,43 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2013 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.certsrv.user;
+
+import javax.ws.rs.GET;
+import javax.ws.rs.Path;
+import javax.ws.rs.PathParam;
+import javax.ws.rs.Produces;
+import javax.ws.rs.QueryParam;
+import javax.ws.rs.core.MediaType;
+
+import com.netscape.certsrv.acls.ACLMapping;
+
+/**
+ * @author Endi S. Dewata
+ */
+@Path("admin/users/{userID}/memberships")
+@ACLMapping("admin.users")
+public interface UserMembershipResource {
+
+    @GET
+    @Produces({ MediaType.APPLICATION_XML, MediaType.APPLICATION_JSON })
+    public UserMembershipCollection findUserMemberships(
+            @PathParam("userID") String userID,
+            @QueryParam("start") Integer start,
+            @QueryParam("size") Integer size);
+}
diff --git a/base/common/src/com/netscape/cms/servlet/admin/UserCertService.java b/base/common/src/com/netscape/cms/servlet/admin/UserCertService.java
index 57051040a..5f39b5800 100644
--- a/base/common/src/com/netscape/cms/servlet/admin/UserCertService.java
+++ b/base/common/src/com/netscape/cms/servlet/admin/UserCertService.java
@@ -112,7 +112,7 @@ public class UserCertService extends PKIService implements UserCertResource {
 
             if (user == null) {
                 log(ILogger.LL_FAILURE, CMS.getLogMessage("USRGRP_SRVLT_USER_NOT_EXIST"));
-                throw new UserNotFoundException(getUserMessage("CMS_USRGRP_SRVLT_USER_NOT_EXIST"));
+                throw new UserNotFoundException(userID, getUserMessage("CMS_USRGRP_SRVLT_USER_NOT_EXIST"));
             }
 
             UserCertCollection response = new UserCertCollection();
@@ -164,7 +164,7 @@ public class UserCertService extends PKIService implements UserCertResource {
 
             if (user == null) {
                 log(ILogger.LL_FAILURE, CMS.getLogMessage("USRGRP_SRVLT_USER_NOT_EXIST"));
-                throw new UserNotFoundException(getUserMessage("CMS_USRGRP_SRVLT_USER_NOT_EXIST"));
+                throw new UserNotFoundException(userID, getUserMessage("CMS_USRGRP_SRVLT_USER_NOT_EXIST"));
             }
 
             X509Certificate[] certs = user.getX509Certificates();
diff --git a/base/common/src/com/netscape/cms/servlet/admin/UserMembershipService.java b/base/common/src/com/netscape/cms/servlet/admin/UserMembershipService.java
new file mode 100644
index 000000000..995551905
--- /dev/null
+++ b/base/common/src/com/netscape/cms/servlet/admin/UserMembershipService.java
@@ -0,0 +1,140 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2013 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.cms.servlet.admin;
+
+import java.net.URI;
+import java.net.URLEncoder;
+import java.util.Enumeration;
+import java.util.Map;
+
+import org.jboss.resteasy.plugins.providers.atom.Link;
+
+import com.netscape.certsrv.apps.CMS;
+import com.netscape.certsrv.base.BadRequestException;
+import com.netscape.certsrv.base.PKIException;
+import com.netscape.certsrv.base.UserNotFoundException;
+import com.netscape.certsrv.common.OpDef;
+import com.netscape.certsrv.common.ScopeDef;
+import com.netscape.certsrv.group.GroupResource;
+import com.netscape.certsrv.logging.IAuditor;
+import com.netscape.certsrv.logging.ILogger;
+import com.netscape.certsrv.user.UserMembershipCollection;
+import com.netscape.certsrv.user.UserMembershipData;
+import com.netscape.certsrv.user.UserMembershipResource;
+import com.netscape.certsrv.usrgrp.IGroup;
+import com.netscape.certsrv.usrgrp.IUGSubsystem;
+import com.netscape.certsrv.usrgrp.IUser;
+import com.netscape.cms.servlet.base.PKIService;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class UserMembershipService extends PKIService implements UserMembershipResource {
+
+    public final static int DEFAULT_SIZE = 20;
+
+    public IUGSubsystem userGroupManager = (IUGSubsystem) CMS.getSubsystem(CMS.SUBSYSTEM_UG);
+
+    public UserMembershipData createUserMembershipData(IGroup group) throws Exception {
+
+        UserMembershipData userMembershipData = new UserMembershipData();
+
+        userMembershipData.setID(group.getName());
+
+        String userID = URLEncoder.encode(group.getName(), "UTF-8");
+        URI uri = uriInfo.getBaseUriBuilder().path(GroupResource.class).path("{groupID}").build(userID);
+        userMembershipData.setLink(new Link("self", uri));
+
+        return userMembershipData;
+    }
+
+    @Override
+    public UserMembershipCollection findUserMemberships(String userID, Integer start, Integer size) {
+        try {
+            start = start == null ? 0 : start;
+            size = size == null ? DEFAULT_SIZE : size;
+
+            if (userID == null) {
+                log(ILogger.LL_FAILURE, CMS.getLogMessage("ADMIN_SRVLT_NULL_RS_ID"));
+                throw new BadRequestException(getUserMessage("CMS_ADMIN_SRVLT_NULL_RS_ID"));
+            }
+
+            IUser user = userGroupManager.getUser(userID);
+
+            if (user == null) {
+                log(ILogger.LL_FAILURE, CMS.getLogMessage("USRGRP_SRVLT_USER_NOT_EXIST"));
+
+                throw new UserNotFoundException(userID, getUserMessage("CMS_USRGRP_SRVLT_USER_NOT_EXIST"));
+            }
+
+            UserMembershipCollection response = new UserMembershipCollection();
+
+            Enumeration<IGroup> groups = userGroupManager.findGroupsByUser(user.getUserDN());
+
+            int i = 0;
+
+            // skip to the start of the page
+            for ( ; i<start && groups.hasMoreElements(); i++) groups.nextElement();
+
+            // return entries up to the page size
+            for ( ; i<start+size && groups.hasMoreElements(); i++) {
+                IGroup group = groups.nextElement();
+                response.addMembership(createUserMembershipData(group));
+            }
+
+            // count the total entries
+            for ( ; groups.hasMoreElements(); i++) groups.nextElement();
+
+            if (start > 0) {
+                URI uri = uriInfo.getRequestUriBuilder().replaceQueryParam("start", Math.max(start-size, 0)).build();
+                response.addLink(new Link("prev", uri));
+            }
+
+            if (start+size < i) {
+                URI uri = uriInfo.getRequestUriBuilder().replaceQueryParam("start", start+size).build();
+                response.addLink(new Link("next", uri));
+            }
+
+            return response;
+
+        } catch (PKIException e) {
+            throw e;
+
+        } catch (Exception e) {
+            CMS.debug(e);
+            throw new PKIException(getUserMessage("CMS_INTERNAL_ERROR"));
+        }
+    }
+
+    public void log(int level, String message) {
+        log(ILogger.S_USRGRP, level, message);
+    }
+
+    public void auditAddUserMembership(String userID, UserMembershipData userMembershipData, String status) {
+        audit(OpDef.OP_ADD, userID, getParams(userMembershipData), status);
+    }
+
+    public void auditDeleteUserMembership(String userID, UserMembershipData userMembershipData, String status) {
+        audit(OpDef.OP_DELETE, userID, getParams(userMembershipData), status);
+    }
+
+    public void audit(String type, String id, Map<String, String> params, String status) {
+        audit(IAuditor.LOGGING_SIGNED_AUDIT_CONFIG_ROLE, ScopeDef.SC_GROUP_MEMBERS, type, id, params, status);
+    }
+}
diff --git a/base/common/src/com/netscape/cms/servlet/admin/UserService.java b/base/common/src/com/netscape/cms/servlet/admin/UserService.java
index 901d3891c..336a10db6 100644
--- a/base/common/src/com/netscape/cms/servlet/admin/UserService.java
+++ b/base/common/src/com/netscape/cms/servlet/admin/UserService.java
@@ -161,7 +161,7 @@ public class UserService extends PKIService implements UserResource {
             if (user == null) {
                 log(ILogger.LL_FAILURE, CMS.getLogMessage("USRGRP_SRVLT_USER_NOT_EXIST"));
 
-                throw new UserNotFoundException(getUserMessage("CMS_USRGRP_SRVLT_USER_NOT_EXIST"));
+                throw new UserNotFoundException(userID, getUserMessage("CMS_USRGRP_SRVLT_USER_NOT_EXIST"));
             }
 
             UserData userData = createUserData(user);
diff --git a/base/java-tools/src/com/netscape/cmstools/user/UserCLI.java b/base/java-tools/src/com/netscape/cmstools/user/UserCLI.java
index 8c24d1746..3e64a9227 100644
--- a/base/java-tools/src/com/netscape/cmstools/user/UserCLI.java
+++ b/base/java-tools/src/com/netscape/cmstools/user/UserCLI.java
@@ -26,6 +26,7 @@ import org.jboss.resteasy.plugins.providers.atom.Link;
 import com.netscape.certsrv.user.UserCertData;
 import com.netscape.certsrv.user.UserClient;
 import com.netscape.certsrv.user.UserData;
+import com.netscape.certsrv.user.UserMembershipData;
 import com.netscape.cmstools.cli.CLI;
 import com.netscape.cmstools.cli.MainCLI;
 
@@ -51,6 +52,8 @@ public class UserCLI extends CLI {
         addModule(new UserShowCertCLI(this));
         addModule(new UserAddCertCLI(this));
         addModule(new UserRemoveCertCLI(this));
+
+        addModule(new UserFindMembershipCLI(this));
     }
 
     public void printHelp() {
@@ -159,4 +162,13 @@ public class UserCLI extends CLI {
             System.out.println(encoded);
         }
     }
+
+    public static void printUserMembership(UserMembershipData userMembershipData) {
+        System.out.println("  Membership: "+userMembershipData.getID());
+
+        Link link = userMembershipData.getLink();
+        if (verbose && link != null) {
+            System.out.println("  Link: " + link.getHref());
+        }
+    }
 }
diff --git a/base/java-tools/src/com/netscape/cmstools/user/UserFindMembershipCLI.java b/base/java-tools/src/com/netscape/cmstools/user/UserFindMembershipCLI.java
new file mode 100644
index 000000000..494c3c323
--- /dev/null
+++ b/base/java-tools/src/com/netscape/cmstools/user/UserFindMembershipCLI.java
@@ -0,0 +1,104 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2013 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.cmstools.user;
+
+import java.util.Collection;
+
+import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.Option;
+
+import com.netscape.certsrv.user.UserMembershipCollection;
+import com.netscape.certsrv.user.UserMembershipData;
+import com.netscape.cmstools.cli.CLI;
+import com.netscape.cmstools.cli.MainCLI;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class UserFindMembershipCLI extends CLI {
+
+    public UserCLI parent;
+
+    public UserFindMembershipCLI(UserCLI parent) {
+        super("find-membership", "Find user memberships");
+        this.parent = parent;
+    }
+
+    public void printHelp() {
+        formatter.printHelp(parent.name + "-" + name + " <User ID> [OPTIONS...]", options);
+    }
+
+    public void execute(String[] args) throws Exception {
+
+        Option option = new Option(null, "start", true, "Page start");
+        option.setArgName("start");
+        options.addOption(option);
+
+        option = new Option(null, "size", true, "Page size");
+        option.setArgName("size");
+        options.addOption(option);
+
+        CommandLine cmd = null;
+
+        try {
+            cmd = parser.parse(options, args);
+
+        } catch (Exception e) {
+            System.err.println("Error: " + e.getMessage());
+            printHelp();
+            System.exit(1);
+        }
+
+        String[] cmdArgs = cmd.getArgs();
+
+        if (cmdArgs.length != 1) {
+            printHelp();
+            System.exit(1);
+        }
+
+        String userID = cmdArgs[0];
+
+        String s = cmd.getOptionValue("start");
+        Integer start = s == null ? null : Integer.valueOf(s);
+
+        s = cmd.getOptionValue("size");
+        Integer size = s == null ? null : Integer.valueOf(s);
+
+        UserMembershipCollection response = parent.client.findUserMemberships(userID, start, size);
+
+        Collection<UserMembershipData> entries = response.getMemberships();
+
+        MainCLI.printMessage(entries.size()+" membership(s) matched");
+
+        boolean first = true;
+
+        for (UserMembershipData userMembershipData : entries) {
+
+            if (first) {
+                first = false;
+            } else {
+                System.out.println();
+            }
+
+            UserCLI.printUserMembership(userMembershipData);
+        }
+
+        MainCLI.printMessage("Number of entries returned "+entries.size());
+    }
+}
diff --git a/base/kra/src/com/netscape/kra/KeyRecoveryAuthorityApplication.java b/base/kra/src/com/netscape/kra/KeyRecoveryAuthorityApplication.java
index 0ed23f697..b205c6a5d 100644
--- a/base/kra/src/com/netscape/kra/KeyRecoveryAuthorityApplication.java
+++ b/base/kra/src/com/netscape/kra/KeyRecoveryAuthorityApplication.java
@@ -12,6 +12,7 @@ import com.netscape.cms.servlet.admin.GroupMemberService;
 import com.netscape.cms.servlet.admin.GroupService;
 import com.netscape.cms.servlet.admin.SystemCertService;
 import com.netscape.cms.servlet.admin.UserCertService;
+import com.netscape.cms.servlet.admin.UserMembershipService;
 import com.netscape.cms.servlet.admin.UserService;
 import com.netscape.cms.servlet.csadmin.SystemConfigService;
 import com.netscape.cms.servlet.key.KeyService;
@@ -38,6 +39,7 @@ public class KeyRecoveryAuthorityApplication extends Application {
         classes.add(GroupMemberService.class);
         classes.add(GroupService.class);
         classes.add(UserCertService.class);
+        classes.add(UserMembershipService.class);
         classes.add(UserService.class);
 
         // system certs
diff --git a/base/ocsp/src/com/netscape/ocsp/OCSPApplication.java b/base/ocsp/src/com/netscape/ocsp/OCSPApplication.java
index 21b37f801..f9995c1a0 100644
--- a/base/ocsp/src/com/netscape/ocsp/OCSPApplication.java
+++ b/base/ocsp/src/com/netscape/ocsp/OCSPApplication.java
@@ -12,6 +12,7 @@ import com.netscape.cms.servlet.admin.GroupMemberService;
 import com.netscape.cms.servlet.admin.GroupService;
 import com.netscape.cms.servlet.admin.SystemCertService;
 import com.netscape.cms.servlet.admin.UserCertService;
+import com.netscape.cms.servlet.admin.UserMembershipService;
 import com.netscape.cms.servlet.admin.UserService;
 import com.netscape.cms.servlet.csadmin.SystemConfigService;
 
@@ -32,6 +33,7 @@ public class OCSPApplication extends Application {
         classes.add(GroupMemberService.class);
         classes.add(GroupService.class);
         classes.add(UserCertService.class);
+        classes.add(UserMembershipService.class);
         classes.add(UserService.class);
 
         // system certs
diff --git a/base/tks/src/com/netscape/tks/TKSApplication.java b/base/tks/src/com/netscape/tks/TKSApplication.java
index 229a64c95..0939d1cd2 100644
--- a/base/tks/src/com/netscape/tks/TKSApplication.java
+++ b/base/tks/src/com/netscape/tks/TKSApplication.java
@@ -12,6 +12,7 @@ import com.netscape.cms.servlet.admin.GroupMemberService;
 import com.netscape.cms.servlet.admin.GroupService;
 import com.netscape.cms.servlet.admin.SystemCertService;
 import com.netscape.cms.servlet.admin.UserCertService;
+import com.netscape.cms.servlet.admin.UserMembershipService;
 import com.netscape.cms.servlet.admin.UserService;
 import com.netscape.cms.servlet.csadmin.SystemConfigService;
 
@@ -32,6 +33,7 @@ public class TKSApplication extends Application {
         classes.add(GroupMemberService.class);
         classes.add(GroupService.class);
         classes.add(UserCertService.class);
+        classes.add(UserMembershipService.class);
         classes.add(UserService.class);
 
         // system certs