DBService implements RolesProvider { Role getRole(String domainName, String roleName, Boolean auditLog, Boolean expand, Boolean pending) { try (ObjectStoreConnection con = store.getConnection(true, false)) { return getRole(con, domainName, roleName, auditLog, expand, pending); } } DBService(ObjectStore store, AuditLogger auditLogger, ZMSConfig zmsConfig, AuditReferenceValidator auditReferenceValidator); DomainRoleMembers listOverdueReviewRoleMembers(String domainName); @Override List<Role> getRolesByDomain(String domain); ResourceAccessList getResourceAccessList(String principal, String action); AthenzDomain getAthenzDomain(final String domainName, boolean masterCopy); Quota getQuota(String domainName); void executePutRoleSystemMeta(ResourceContext ctx, final String domainName, final String roleName,
           RoleSystemMeta meta, final String attribute, final String auditRef, final String caller); void executePutGroupSystemMeta(ResourceContext ctx, final String domainName, final String groupName,
                                          GroupSystemMeta meta, final String attribute, final String auditRef); void executePutServiceIdentitySystemMeta(ResourceContext ctx, String domainName, String serviceName,
            ServiceIdentitySystemMeta meta, String attribute, String auditRef, String caller); void executePutRoleMeta(ResourceContext ctx, String domainName, String roleName, Role originalRole,
                                   RoleMeta meta, String auditRef, String caller); void executePutGroupMeta(ResourceContext ctx, final String domainName, final String groupName,
                                    GroupMeta meta, final String auditRef); Set<String> getPendingMembershipApproverRoles(int delayDays); Set<String> getPendingGroupMembershipApproverRoles(int delayDays); Map<String, DomainRoleMember> getRoleExpiryMembers(int delayDays); Map<String, DomainRoleMember> getRoleReviewMembers(int delayDays); Map<String, DomainGroupMember> getGroupExpiryMembers(int delayDays); void processExpiredPendingMembers(int pendingRoleMemberLifespan, final String monitorIdentity); void processExpiredPendingGroupMembers(int pendingGroupMemberLifespan, final String monitorIdentity); static int AUDIT_TYPE_ROLE; static int AUDIT_TYPE_POLICY; static int AUDIT_TYPE_SERVICE; static int AUDIT_TYPE_DOMAIN; static int AUDIT_TYPE_ENTITY; static int AUDIT_TYPE_TENANCY; static int AUDIT_TYPE_TEMPLATE; static int AUDIT_TYPE_GROUP; }
@Test public void testGetDelegatedRoleNoExpand() { String domainName = "rolenoexpand"; String roleName = "role1"; TopLevelDomain dom1 = createTopLevelDomainObject(domainName, "Test Domain1", "testOrg", adminUser); zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); Role role1 = createRoleObject(domainName, roleName, "sys.auth", null, null); zms.putRole(mockDomRsrcCtx, domainName, roleName, auditRef, role1); Role role = zms.dbService.getRole(domainName, roleName, false, false, false); assertNotNull(role); assertEquals(role.getTrust(), "sys.auth"); assertNull(role.getRoleMembers()); zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); }
@Test public void testGetDelegatedRoleExpand() { String domainName1 = "role-expand1"; String domainName2 = "role-expand2"; String roleName = "role1"; TopLevelDomain dom1 = createTopLevelDomainObject(domainName1, "Test Domain1", "testOrg", adminUser); zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); TopLevelDomain dom2 = createTopLevelDomainObject(domainName2, "Test Domain2", "testOrg", adminUser); zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom2); Role role1 = createRoleObject(domainName1, roleName, domainName2, null, null); zms.putRole(mockDomRsrcCtx, domainName1, roleName, auditRef, role1); Role role2a = createRoleObject(domainName2, "role2a", null, "user.joe", "user.jane"); zms.putRole(mockDomRsrcCtx, domainName2, "role2a", auditRef, role2a); Role role2b = createRoleObject(domainName2, "role2b", null, "user.joe", "user.doe"); zms.putRole(mockDomRsrcCtx, domainName2, "role2b", auditRef, role2b); Policy policy = createPolicyObject(domainName2, "policy", domainName2 + ":role.role2a", false, "assume_role", domainName1 + ":role." + roleName, AssertionEffect.ALLOW); Assertion assertion = new Assertion(); assertion.setAction("assume_role"); assertion.setEffect(AssertionEffect.ALLOW); assertion.setResource("*:role." + roleName); assertion.setRole(domainName2 + ":role.role2b"); policy.getAssertions().add(assertion); zms.putPolicy(mockDomRsrcCtx, domainName2, "policy", auditRef, policy); Role role = zms.dbService.getRole(domainName1, roleName, false, true, false); assertNotNull(role); assertEquals(role.getTrust(), domainName2); List<RoleMember> members = role.getRoleMembers(); assertEquals(3, members.size()); List<String> checkList = new ArrayList<>(); checkList.add("user.joe"); checkList.add("user.jane"); checkList.add("user.doe"); checkRoleMember(checkList, members); zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName1, auditRef); zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName2, auditRef); }