From bf898b59fc674cd276669ef7c545fcfb88f0f919 Mon Sep 17 00:00:00 2001
From: Steffen Schaefer <steffen.schaefer@oio.de>
Date: Mon, 17 Aug 2020 16:13:23 +0200
Subject: [PATCH] Bug 5239: Ensures that roles associated to a UserGroup are
 also part of the meta permission check when changing the permissions of a
 RoleDefinition.

---
 .../sap/sse/security/userstore/mongodb/UserStoreImpl.java    | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/java/com.sap.sse.security.userstore.mongodb/src/com/sap/sse/security/userstore/mongodb/UserStoreImpl.java b/java/com.sap.sse.security.userstore.mongodb/src/com/sap/sse/security/userstore/mongodb/UserStoreImpl.java
index 7c77a093732..51f01f00b61 100644
--- a/java/com.sap.sse.security.userstore.mongodb/src/com/sap/sse/security/userstore/mongodb/UserStoreImpl.java
+++ b/java/com.sap.sse.security.userstore.mongodb/src/com/sap/sse/security/userstore/mongodb/UserStoreImpl.java
@@ -819,6 +819,11 @@ public class UserStoreImpl implements UserStore {
                 logger.log(Level.SEVERE, e.getMessage(), e);
             }
         }
+        for (UserGroup userGroup : userGroups.values()) {
+            if (userGroup.getRoleDefinitionMap().containsKey(roleToCheck)) {
+                ownerships.add(new Ownership(null, userGroup));
+            }
+        }
         return new Pair<>(false, ownerships);
     }