AuthzHelper { public static boolean assumeRoleResourceMatch(String roleName, Assertion assertion) { if (!ASSUME_ROLE.equalsIgnoreCase(assertion.getAction())) { return false; } String rezPattern = StringUtils.patternFromGlob(assertion.getResource()); return roleName.matches(rezPattern); }  static void removeRoleMembers(List<RoleMember> originalRoleMembers, List<RoleMember> removeRoleMembers); static void removeGroupMembers(List<GroupMember> originalGroupMembers, List<GroupMember> removeGroupMembers); static boolean isMemberDisabled(Integer systemDisabled); static boolean isMemberExpired(Timestamp expiration, long currentTime); static boolean shouldSkipGroupMember(GroupMember member, long currentTime); static boolean isMemberOfGroup(List<GroupMember> groupMembers, final String member); static boolean checkGroupMemberValidity(List<GroupMember> groupMembers, final String member); static boolean memberNameMatch(final String memberName, final  String matchName); static boolean shouldRunDelegatedTrustCheck(final String trust, final String trustDomain); static String retrieveResourceDomain(String resource, String op, String trustDomain); static String extractResourceDomainName(final String resource); static boolean authorityAuthorizationAllowed(Principal principal); static boolean checkRoleMemberValidity(List<RoleMember> roleMembers, final String member,
                                                  GroupMembersFetcher groupMembersFetcher); static boolean isMemberOfRole(Role role, final String member, GroupMembersFetcher groupMembersFetcher); static boolean assumeRoleResourceMatch(String roleName, Assertion assertion); static boolean matchDelegatedTrustPolicy(Policy policy, final String roleName, final String roleMember,
                                                    List<Role> roles, GroupMembersFetcher groupMembersFetcher); static boolean matchDelegatedTrustAssertion(Assertion assertion, final String roleName, final String roleMember,
                                                       List<Role> roles, GroupMembersFetcher groupMembersFetcher);  }
@Test public void testAssumeRoleResourceMatchActionNoMatch() { Assertion assertion = new Assertion() .setAction("test") .setEffect(AssertionEffect.ALLOW) .setRole("domain1:role.role1") .setResource("domain1:*"); assertFalse(AuthzHelper.assumeRoleResourceMatch("domain1:role.role1", assertion)); assertion = new Assertion() .setAction("assume_role1") .setEffect(AssertionEffect.ALLOW) .setRole("domain1:role.role1") .setResource("domain1:*"); assertFalse(AuthzHelper.assumeRoleResourceMatch("domain1:role.role1", assertion)); assertion = new Assertion() .setAction("assume_rol") .setEffect(AssertionEffect.ALLOW) .setRole("domain1:role.role1") .setResource("domain1:*"); assertFalse(AuthzHelper.assumeRoleResourceMatch("domain1:role.role1", assertion)); }
@Test public void testAssumeRoleResourceMatchRoleNoMatch() { Assertion assertion = new Assertion() .setAction("assume_role") .setEffect(AssertionEffect.ALLOW) .setRole("domain1:role.role1") .setResource("domain1:role.role2"); assertFalse(AuthzHelper.assumeRoleResourceMatch("domain1:role.role1", assertion)); assertion = new Assertion() .setAction("assume_role") .setEffect(AssertionEffect.ALLOW) .setRole("domain1:role.role1") .setResource("domain2:role.role1"); assertFalse(AuthzHelper.assumeRoleResourceMatch("domain1:role.role1", assertion)); assertion = new Assertion() .setAction("assume_role") .setEffect(AssertionEffect.ALLOW) .setRole("domain1:role.role1") .setResource("domain1:role.reader*"); assertFalse(AuthzHelper.assumeRoleResourceMatch("domain1:role.role1", assertion)); assertion = new Assertion() .setAction("assume_role") .setEffect(AssertionEffect.ALLOW) .setRole("domain1:role.role1") .setResource("*:role.role2"); assertFalse(AuthzHelper.assumeRoleResourceMatch("domain1:role.role1", assertion)); }
@Test public void testAssumeRoleResourceMatch() { Assertion assertion = new Assertion() .setAction("assume_role") .setEffect(AssertionEffect.ALLOW) .setRole("domain2:role.role1") .setResource("domain1:role.role1"); assertTrue(AuthzHelper.assumeRoleResourceMatch("domain1:role.role1", assertion)); assertion = new Assertion() .setAction("assume_role") .setEffect(AssertionEffect.ALLOW) .setRole("domain2:role.role1") .setResource("domain1:role.*"); assertTrue(AuthzHelper.assumeRoleResourceMatch("domain1:role.role1", assertion)); assertion = new Assertion() .setAction("assume_role") .setEffect(AssertionEffect.ALLOW) .setRole("domain2:role.role1") .setResource("domain1:*"); assertTrue(AuthzHelper.assumeRoleResourceMatch("domain1:role.role1", assertion)); assertion = new Assertion() .setAction("assume_role") .setEffect(AssertionEffect.ALLOW) .setRole("domain2:role.role1") .setResource("*:role.role1"); assertTrue(AuthzHelper.assumeRoleResourceMatch("domain1:role.role1", assertion)); }