DBService implements RolesProvider { void validateGroupUserAuthorityAttrRequirements(ObjectStoreConnection con, Group originalGroup, Group updatedGroup, final String caller) { boolean filterRemoved = ZMSUtils.userAuthorityAttrMissing(originalGroup.getUserAuthorityFilter(), updatedGroup.getUserAuthorityFilter()); boolean expiryRemoved = ZMSUtils.userAuthorityAttrMissing(originalGroup.getUserAuthorityExpiration(), updatedGroup.getUserAuthorityExpiration()); if (!filterRemoved && !expiryRemoved) { return; } DomainRoleMember domainRoleMember; try { domainRoleMember = con.getPrincipalRoles(updatedGroup.getName(), null); } catch (ResourceException ex) { if (ex.getCode() == ResourceException.NOT_FOUND) { return; } throw ex; } Map<String, String> domainFitlerMap = new HashMap<>(); for (MemberRole memberRole : domainRoleMember.getMemberRoles()) { Role role = con.getRole(memberRole.getDomainName(), memberRole.getRoleName()); if (role == null) { continue; } if (filterRemoved) { String domainUserAuthorityFilter = getDomainUserAuthorityFilterFromMap(con, domainFitlerMap, memberRole.getDomainName()); final String roleUserAuthorityFilter = ZMSUtils.combineUserAuthorityFilters(role.getUserAuthorityFilter(), domainUserAuthorityFilter); if (ZMSUtils.userAuthorityAttrMissing(roleUserAuthorityFilter, updatedGroup.getUserAuthorityFilter())) { throw ZMSUtils.requestError("Setting " + updatedGroup.getUserAuthorityFilter() + " user authority filter on the group will not satisfy " + ZMSUtils.roleResourceName(memberRole.getDomainName(), memberRole.getRoleName()) + " role filter requirements", caller); } } if (expiryRemoved) { if (ZMSUtils.userAuthorityAttrMissing(role.getUserAuthorityExpiration(), updatedGroup.getUserAuthorityExpiration())) { throw ZMSUtils.requestError("Setting " + updatedGroup.getUserAuthorityExpiration() + " user authority expiration on the group will not satisfy " + ZMSUtils.roleResourceName(memberRole.getDomainName(), memberRole.getRoleName()) + " role expiration requirements", caller); } } } } DBService(ObjectStore store, AuditLogger auditLogger, ZMSConfig zmsConfig, AuditReferenceValidator auditReferenceValidator); DomainRoleMembers listOverdueReviewRoleMembers(String domainName); @Override List<Role> getRolesByDomain(String domain); ResourceAccessList getResourceAccessList(String principal, String action); AthenzDomain getAthenzDomain(final String domainName, boolean masterCopy); Quota getQuota(String domainName); void executePutRoleSystemMeta(ResourceContext ctx, final String domainName, final String roleName,
           RoleSystemMeta meta, final String attribute, final String auditRef, final String caller); void executePutGroupSystemMeta(ResourceContext ctx, final String domainName, final String groupName,
                                          GroupSystemMeta meta, final String attribute, final String auditRef); void executePutServiceIdentitySystemMeta(ResourceContext ctx, String domainName, String serviceName,
            ServiceIdentitySystemMeta meta, String attribute, String auditRef, String caller); void executePutRoleMeta(ResourceContext ctx, String domainName, String roleName, Role originalRole,
                                   RoleMeta meta, String auditRef, String caller); void executePutGroupMeta(ResourceContext ctx, final String domainName, final String groupName,
                                    GroupMeta meta, final String auditRef); Set<String> getPendingMembershipApproverRoles(int delayDays); Set<String> getPendingGroupMembershipApproverRoles(int delayDays); Map<String, DomainRoleMember> getRoleExpiryMembers(int delayDays); Map<String, DomainRoleMember> getRoleReviewMembers(int delayDays); Map<String, DomainGroupMember> getGroupExpiryMembers(int delayDays); void processExpiredPendingMembers(int pendingRoleMemberLifespan, final String monitorIdentity); void processExpiredPendingGroupMembers(int pendingGroupMemberLifespan, final String monitorIdentity); static int AUDIT_TYPE_ROLE; static int AUDIT_TYPE_POLICY; static int AUDIT_TYPE_SERVICE; static int AUDIT_TYPE_DOMAIN; static int AUDIT_TYPE_ENTITY; static int AUDIT_TYPE_TENANCY; static int AUDIT_TYPE_TEMPLATE; static int AUDIT_TYPE_GROUP; }
@Test public void testValidateGroupUserAuthorityAttrRequirements() { Group originalGroup = new Group().setName("group1").setUserAuthorityFilter("OnShore-US"); Group updatedGroup = new Group().setName("group1"); ObjectStoreConnection conn = Mockito.mock(ObjectStoreConnection.class); Mockito.when(conn.getPrincipalRoles("group1", null)).thenThrow(new ResourceException(ResourceException.BAD_REQUEST)); try { zms.dbService.validateGroupUserAuthorityAttrRequirements(conn, originalGroup, updatedGroup, "unittest"); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), ResourceException.BAD_REQUEST); } List<MemberRole> memberRoles = new ArrayList<>(); memberRoles.add(new MemberRole().setDomainName("coretech").setRoleName("role1")); DomainRoleMember domainRoleMember = new DomainRoleMember(); domainRoleMember.setMemberRoles(memberRoles); ObjectStoreConnection conn2 = Mockito.mock(ObjectStoreConnection.class); Mockito.when(conn2.getPrincipalRoles("group1", null)).thenReturn(domainRoleMember); Mockito.when(conn2.getRole("coretech", "role1")).thenReturn(null); zms.dbService.validateGroupUserAuthorityAttrRequirements(conn2, originalGroup, updatedGroup, "unittest"); }