ControllerUtil { public static void updateUserPolicyAssociationOnSDBDelete(String sdb,Map<String,String> acessInfo,String token, UserDetails userDetails){ OIDCEntityResponse oidcEntityResponse = new OIDCEntityResponse(); log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "updateUserPolicyAssociationOnSDBDelete"). put(LogMessage.MESSAGE, String.format ("trying updateUserPolicyAssociationOnSDBDelete")). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); log.debug ("updateUserPolicyAssociationOnSDBDelete...for auth method " + vaultAuthMethod); if(acessInfo!=null){ String folders[] = sdb.split("[/]+"); String r_policy = "r_"; String w_policy = "w_"; String d_policy = "d_"; String s_policy = "s_"; if (folders.length > 0) { for (int index = 0; index < folders.length; index++) { if (index == folders.length -1 ) { r_policy += folders[index]; w_policy += folders[index]; d_policy += folders[index]; s_policy += folders[index]; } else { r_policy += folders[index] +"_"; w_policy += folders[index] +"_"; d_policy += folders[index] +"_"; s_policy += folders[index] +"_"; } } } Set<String> users = acessInfo.keySet(); ObjectMapper objMapper = new ObjectMapper(); for(String userName : users){ Response userResponse = new Response(); if (TVaultConstants.USERPASS.equals(vaultAuthMethod)) { userResponse = reqProcessor.process("/auth/userpass/read","{\"username\":\""+userName+"\"}",token); } else if (TVaultConstants.LDAP.equals(vaultAuthMethod)){ userResponse = reqProcessor.process("/auth/ldap/users","{\"username\":\""+userName+"\"}",token); }else if (TVaultConstants.OIDC.equals(vaultAuthMethod)) { ResponseEntity<OIDCEntityResponse> responseEntity = oidcUtil.oidcFetchEntityDetails(token, userName, null); if (!responseEntity.getStatusCode().equals(HttpStatus.OK)) { if (responseEntity.getStatusCode().equals(HttpStatus.FORBIDDEN)) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder() .put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()) .put(LogMessage.ACTION, "Add User to SDB") .put(LogMessage.MESSAGE, String.format("Trying to fetch OIDC user policies, failed")) .put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()) .build())); ResponseEntity.status(HttpStatus.FORBIDDEN) .body("{\"messages\":[\"User configuration failed. Please try again.\"]}"); } ResponseEntity.status(HttpStatus.NOT_FOUND) .body("{\"messages\":[\"User configuration failed. Invalid user\"]}"); } oidcEntityResponse.setEntityName(responseEntity.getBody().getEntityName()); oidcEntityResponse.setPolicies(responseEntity.getBody().getPolicies()); userResponse.setResponse(oidcEntityResponse.getPolicies().toString()); userResponse.setHttpstatus(responseEntity.getStatusCode()); } String responseJson=""; String groups=""; List<String> policies = new ArrayList<>(); List<String> currentpolicies = new ArrayList<>(); if(HttpStatus.OK.equals(userResponse.getHttpstatus())){ responseJson = userResponse.getResponse(); try { if (TVaultConstants.OIDC.equals(vaultAuthMethod)) { currentpolicies.addAll(oidcEntityResponse.getPolicies()); } else { currentpolicies = ControllerUtil.getPoliciesAsListFromJson(objMapper, responseJson); if (TVaultConstants.LDAP.equals(vaultAuthMethod)) { groups = objMapper.readTree(responseJson).get("data").get("groups").asText(); } } } catch (IOException e) { log.error(e); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "updateUserPolicyAssociationOnSDBDelete"). put(LogMessage.MESSAGE, String.format ("updateUserPolicyAssociationOnSDBDelete failed [%s]", e.getMessage())). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } policies.addAll(currentpolicies); policies.remove(r_policy); policies.remove(w_policy); policies.remove(d_policy); policies.remove(s_policy); String policiesString = org.apache.commons.lang3.StringUtils.join(policies, ","); log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "updateUserPolicyAssociationOnSDBDelete"). put(LogMessage.MESSAGE, String.format ("Current policies [%s]", policies )). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); if (TVaultConstants.USERPASS.equals(vaultAuthMethod)) { log.debug ("Inside userpass"); ControllerUtil.configureUserpassUser(userName,policiesString,token); } else if (TVaultConstants.LDAP.equals(vaultAuthMethod)){ log.debug ("Inside non-userpass"); ControllerUtil.configureLDAPUser(userName,policiesString,groups,token); } else if (TVaultConstants.OIDC.equals(vaultAuthMethod)) { try { oidcUtil.updateOIDCEntity(policies, oidcEntityResponse.getEntityName()); oidcUtil.renewUserToken(userDetails.getClientToken()); } catch (Exception e) { log.error(e); log.error( JSONUtil.getJSON( ImmutableMap.<String, String> builder() .put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)) .put(LogMessage.ACTION, "Add User to SDB") .put(LogMessage.MESSAGE, "Exception while adding or updating the identity ") .put(LogMessage.STACKTRACE, Arrays.toString(e.getStackTrace())) .put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)) .build())); } } } } } }  @Autowired(required = true) void setreqProcessor(RequestProcessor reqProcessor); static RequestProcessor getReqProcessor(); static OIDCUtil getOidcUtil(); @Autowired(required = true) void setOidcUtil(OIDCUtil oidcUtil); static void recursivedeletesdb(String jsonstr,String token,  Response responseVO); static void recursiveRead(String jsonstr,String token,  Response responseVO, SafeNode safeNode); static void getFoldersAndSecrets(String jsonstr,String token,  Response responseVO, SafeNode safeNode); static Response configureLDAPUser(String userName,String policies,String groups,String token ); static Response configureUserpassUser(String userName,String policies,String token ); static Response configureLDAPGroup(String groupName,String policies,String token ); static Response configureAWSRole(String roleName,String policies,String token ); static Response configureAWSIAMRole(String roleName,String policies,String token ); static Response updateMetadata(Map<String,String> params,String token); static Response updateMetaDataOnConfigChanges(String name, String type,String currentPolicies, String latestPolicies, String token); static Response updateMetadataOnSvcUpdate(String path, ServiceAccount serviceAccount, String token); static Response updateMetadataOnSvcaccPwdReset(Map<String,String> params,String token); static Map<String,Object> parseJson(String jsonString); static String convetToJson(Map<String,Object> jsonMap); static String getPoliciesAsStringFromJson(ObjectMapper objMapper, String policyJson); static List<String> getPoliciesAsListFromJson(ObjectMapper objMapper, String policyJson); static void updateUserPolicyAssociationOnSDBDelete(String sdb,Map<String,String> acessInfo,String token, UserDetails userDetails); static void updateGroupPolicyAssociationOnSDBDelete(String sdb,Map<String,String> acessInfo,String token, UserDetails userDetails); static void updateAwsRolePolicyAssociationOnSDBDelete(String sdb,Map<String,String> acessInfo,String token); static void deleteAwsRoleOnSDBDelete(String sdb,Map<String,String> acessInfo,String token); static boolean isValidDataPath(String path); static boolean isPathValid(String path); static boolean isValidSafePath(String path); static String getSafePath(String path); static String getSafeType(String path); static String getSafeName(String path); static boolean canAddPermission(String path,String token); static boolean isValidSafe(String path,String token); static boolean areSDBInputsValid(Map<String, Object> requestParams); static boolean areSDBInputsValid(Safe safe); static boolean areSDBInputsValidForUpdate(Map<String, Object> requestParams); static boolean areSafeGroupInputsValid(Map<String,String> requestMap); static boolean areAWSRoleInputsValid(Map<String, String> requestMap); static boolean areSafeUserInputsValid(SafeUser safeUser); static boolean areSafeUserInputsValid(Map<String,Object> requestMap); static boolean areSafeGroupInputsValid(SafeGroup safeGroup); static boolean areSafeAppRoleInputsValid(Map<String,Object> requestMap); static boolean areAWSRoleInputsValid(AWSRole awsRole); static String converSDBInputsToLowerCase(String jsonStr); static void converSDBInputsToLowerCase(Safe safe); static String convertAppRoleInputsToLowerCase(String jsonstr); static String convertSafeAppRoleAccessToLowerCase(String jsonstr); static String convertAppRoleSecretIdToLowerCase(String jsonstr); static boolean isSecretKeyValid(String jsonString); static boolean areAppRoleInputsValid(String jsonstr); static boolean areAppRoleInputsValid(AppRole approle); static AppRole getAppRoleObjFromString(String jsonstr); static boolean areSecretKeysValid(String jsonString); static String addDefaultSecretKey(String jsonString); static boolean areAwsLoginInputsValid(AWSAuthType authType, AWSAuthLogin awsAuthLogin); static boolean areAWSEC2RoleInputsValid(AWSLoginRole awsLoginRole); static boolean areAWSEC2RoleInputsValid(String jsonStr); static boolean areAWSIAMRoleInputsValid(AWSIAMRole awsiamRole); static HashMap<String, List<String>> getAllExistingSafeNames(String token); static List<String> getAllExistingSafeNames(String type, String token); static int getCountOfSafesForGivenSafeName(String safeName, String token); static int getCountOfSafesForGivenSafeName(String safeName, String safeType, String token); static String generateSafePath(String safeName, String safeType); static String populateAWSMetaJson(String appRoleName, String username); static boolean createMetadata(String metadataJson, String token); static Response canDeleteRole(String roleName, String token, UserDetails userDetails, String metadataPath); static String populateAppRoleMetaJson(String appRoleName, String username); static String populateUserMetaJson(String appRoleName, String username); static SSCred readSSCredFile(String fileLocation, boolean isDelete); static String getNclmUsername(); static String getNclmPassword(); static String getCwmToken(); static String getSsUsername(); static void setSscred(SSCred sscred); static String getSsPassword(); static SSCred getSscred(); static OIDCCred readOIDCCredFile(String fileLocation, boolean isDelete); static String getOidcClientName(); static String getOidcClientId(); static String getOidcClientSecret(); static String getOidcBoundAudiences(); static String getOidcDiscoveryUrl(); static String getOidcADLoginUrl(); static OIDCCred getOidcCred(); static Response hideMasterAppRoleFromResponse(Response response); static boolean updateMetaData(String path, Map<String,String> params,String token); static boolean arecertificateGroupInputsValid(CertificateGroup certificateGroup); static boolean canAddCertPermission(String path,String certificateName,String token); static List<String> getAllExistingCertNames(String type, String token); static Response updateSslCertificateMetadata(Map<String,String> params,String token); static Response updateSslMetaDataOnConfigChanges(String name, String type,String currentPolicies, String latestPolicies, String token); static Map<String,Object> filterDuplicateSafePermissions(Map<String,Object> access); static Map<String,Object> filterDuplicateSvcaccPermissions(Map<String,Object> access); static final Logger log; }
@Test public void test_updateUserPolicyAssociationOnSDBDelete_successfully() { String token = "7QPMPIGiyDFlJkrK3jFykUqa"; String userName = "testuser1"; Response userResponse = getMockResponse(HttpStatus.OK, true, "{\"data\":{\"bound_cidrs\":[],\"max_ttl\":0,\"policies\":[\"approle_normal_user\",\"w_users_safe01\"],\"ttl\":0}}"); when(reqProcessor.process("/auth/userpass/read","{\"username\":\""+userName+"\"}",token)).thenReturn(userResponse); UserDetails userDetails = new UserDetails(); userDetails.setUsername("testuser1"); ReflectionTestUtils.setField(ControllerUtil.class,"vaultAuthMethod", "userpass"); Map<String,String> acessInfo = new HashMap<>(); acessInfo.put("testuser1", "write"); ControllerUtil.updateUserPolicyAssociationOnSDBDelete("users/safe01", acessInfo, token, userDetails); assertTrue(true); }
@Test public void test_updateUserPolicyAssociationOnSDBDelete_oidc_successfully() { String token = "7QPMPIGiyDFlJkrK3jFykUqa"; String userName = "testuser1"; Response userResponse = getMockResponse(HttpStatus.OK, true, "{\"data\":{\"bound_cidrs\":[],\"max_ttl\":0,\"policies\":[\"approle_normal_user\",\"w_users_safe01\"],\"ttl\":0}}"); when(reqProcessor.process("/auth/userpass/read","{\"username\":\""+userName+"\"}",token)).thenReturn(userResponse); ReflectionTestUtils.setField(ControllerUtil.class,"vaultAuthMethod", "oidc"); Map<String,String> acessInfo = new HashMap<>(); acessInfo.put("testuser1", "write"); OIDCEntityResponse oidcEntityResponse = new OIDCEntityResponse(); oidcEntityResponse.setEntityName("entity"); List<String> policies = new ArrayList<>(); policies.add("safeadmin"); oidcEntityResponse.setPolicies(policies); ResponseEntity<OIDCEntityResponse> responseEntity2 = ResponseEntity.status(HttpStatus.OK) .body(oidcEntityResponse); when(tokenUtils.getSelfServiceTokenWithAppRole()).thenReturn(token); UserDetails userDetails = new UserDetails(); userDetails.setUsername("testuser1"); Response responseEntity3 = getMockResponse(HttpStatus.NO_CONTENT, true, "{\"data\": [\"safeadmin\",\"vaultadmin\"]]"); when(oidcUtil.updateOIDCEntity(any(), any())) .thenReturn(responseEntity3); when(oidcUtil.oidcFetchEntityDetails(any(), any(), any())).thenReturn(responseEntity2); ControllerUtil.updateUserPolicyAssociationOnSDBDelete("users/safe01", acessInfo, token, userDetails); assertTrue(true); }