ZTSImpl implements KeyStore, ZTSHandler { public RoleAccess getRoleAccess(ResourceContext ctx, String domainName, String principal) { final String caller = ctx.getApiName(); final String principalDomain = logPrincipalAndGetDomain(ctx); validateRequest(ctx.request(), principalDomain, caller); validate(domainName, TYPE_DOMAIN_NAME, principalDomain, caller); validate(principal, TYPE_ENTITY_NAME, principalDomain, caller); domainName = domainName.toLowerCase(); setRequestDomain(ctx, domainName); principal = normalizeDomainAliasUser(principal.toLowerCase()); if (LOGGER.isDebugEnabled()) { LOGGER.debug("getRoleAccess(domain: " + domainName + ", principal: " + principal + ")"); } DataCache data = dataStore.getDataCache(domainName); if (data == null) { setRequestDomain(ctx, ZTSConsts.ZTS_UNKNOWN_DOMAIN); throw notFoundError("getRoleAccess: No such domain: " + domainName, caller, ZTSConsts.ZTS_UNKNOWN_DOMAIN, principalDomain); } Set<String> roles = new HashSet<>(); dataStore.getAccessibleRoles(data, domainName, principal, null, roles, false); return new RoleAccess().setRoles(new ArrayList<>(roles)); } ZTSImpl();  ZTSImpl(CloudStore implCloudStore, DataStore implDataStore); @Override String getPublicKey(String domain, String service, String keyId); ServiceIdentity getServiceIdentity(ResourceContext ctx, String domainName, String serviceName); PublicKeyEntry getPublicKeyEntry(ResourceContext ctx, String domainName,
            String serviceName, String keyId); ServiceIdentityList getServiceIdentityList(ResourceContext ctx, String domainName); HostServices getHostServices(ResourceContext ctx, String host); Response getDomainSignedPolicyData(ResourceContext ctx, String domainName, String matchingTag); TenantDomains getTenantDomains(ResourceContext ctx, String providerDomainName,
            String userName, String roleName, String serviceName); @Override RoleToken getRoleToken(ResourceContext ctx, String domainName, String roleNames,
            Integer minExpiryTime, Integer maxExpiryTime, String proxyForPrincipal); @Override AccessTokenResponse postAccessTokenRequest(ResourceContext ctx, String request); RoleAccess getRoleAccess(ResourceContext ctx, String domainName, String principal); @Override RoleToken postRoleCertificateRequest(ResourceContext ctx, String domainName,
            String roleName, RoleCertificateRequest req); @Override RoleCertificate postRoleCertificateRequestExt(ResourceContext ctx, RoleCertificateRequest req); AWSTemporaryCredentials getAWSTemporaryCredentials(ResourceContext ctx, String domainName,
            String roleName, Integer durationSeconds, String externalId); @Override Response postInstanceRegisterInformation(ResourceContext ctx, InstanceRegisterInformation info); @Override InstanceIdentity postInstanceRefreshInformation(ResourceContext ctx, String provider,
            String domain, String service, String instanceId, InstanceRefreshInformation info); @Override void deleteInstanceIdentity(ResourceContext ctx, String provider,
            String domain, String service, String instanceId); @Deprecated @Override Identity postInstanceRefreshRequest(ResourceContext ctx, String domain,
            String service, InstanceRefreshRequest req); @Override Response postSSHCertRequest(ResourceContext ctx, SSHCertRequest certRequest); @Override JWKList getJWKList(ResourceContext ctx, Boolean rfc); @Deprecated @Override Identity postOSTKInstanceRefreshRequest(ResourceContext ctx, String domain,
            String service, OSTKInstanceRefreshRequest req); @Override ResourceAccess getResourceAccessExt(ResourceContext ctx, String action, String resource,
            String trustDomain, String checkPrincipal); @Override ResourceAccess getResourceAccess(ResourceContext ctx, String action, String resource,
            String trustDomain, String checkPrincipal); @Override Access getAccess(ResourceContext ctx, String domainName, String roleName,
            String principal); CertificateAuthorityBundle getCertificateAuthorityBundle(ResourceContext ctx, String name); @Override DomainMetrics postDomainMetrics(ResourceContext ctx, String domainName,
            DomainMetrics domainMetrics); @Override Status getStatus(ResourceContext ctx); @Override Schema getRdlSchema(ResourceContext context); ResourceContext newResourceContext(HttpServletRequest request,
                                              HttpServletResponse response,
                                              String apiName); static String getRootDir(); void recordMetrics(ResourceContext ctx, int httpStatus);  }
@Test public void testGetRoleAccess() { SignedDomain signedDomain = createSignedDomain("roleaccess", "tenantrole", "storage", true); store.processDomain(signedDomain, false); Principal principal = SimplePrincipal.create("user_domain", "user", "v=U1;d=user_domain;n=user;s=sig", 0, null); ResourceContext context = createResourceContext(principal); RoleAccess roleAccess = zts.getRoleAccess(context, "roleaccess", "user_domain.user"); assertEquals(roleAccess.getRoles().size(), 1); assertTrue(roleAccess.getRoles().contains("writers")); Principal principal1 = SimplePrincipal.create("user_domain", "user1", "v=U1;d=user_domain;n=user1;s=sig", 0, null); ResourceContext context1 = createResourceContext(principal1); roleAccess = zts.getRoleAccess(context1, "roleaccess", "user_domain.user1"); assertEquals(roleAccess.getRoles().size(), 2); assertTrue(roleAccess.getRoles().contains("readers")); assertTrue(roleAccess.getRoles().contains("writers")); Principal principal4 = SimplePrincipal.create("user_domain", "user4", "v=U1;d=user_domain;n=user1;s=sig", 0, null); ResourceContext context4 = createResourceContext(principal4); roleAccess = zts.getRoleAccess(context4, "roleaccess", "user_domain.user4"); assertEquals(roleAccess.getRoles().size(), 1); assertTrue(roleAccess.getRoles().contains("readers")); try { zts.getRoleAccess(context4, "unknowndomain", "user_domain.user4"); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 404); } }