DBService implements RolesProvider { void executePutMembership(ResourceContext ctx, String domainName, String roleName, RoleMember roleMember, String auditRef, String caller) { for (int retryCount = defaultRetryCount; ; retryCount--) { try (ObjectStoreConnection con = store.getConnection(true, true)) { String principal = getPrincipalName(ctx); checkDomainAuditEnabled(con, domainName, auditRef, caller, principal, AUDIT_TYPE_ROLE); Role originalRole = con.getRole(domainName, roleName); if (originalRole == null) { con.rollbackChanges(); throw ZMSUtils.notFoundError(caller + ": Unknown role: " + roleName, caller); } checkObjectAuditEnabled(con, originalRole.getAuditEnabled(), originalRole.getName(), auditRef, caller, principal); if (isTrustRole(originalRole)) { con.rollbackChanges(); throw ZMSUtils.requestError(caller + ": " + roleName + "is a delegated role", caller); } quotaCheck.checkRoleMembershipQuota(con, domainName, roleName, caller); if (!con.insertRoleMember(domainName, roleName, roleMember, principal, auditRef)) { con.rollbackChanges(); throw ZMSUtils.requestError(caller + ": unable to insert role member: " + roleMember.getMemberName() + " to role: " + roleName, caller); } con.updateRoleModTimestamp(domainName, roleName); con.updateDomainModTimestamp(domainName); cacheStore.invalidate(domainName); StringBuilder auditDetails = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); auditLogRoleMember(auditDetails, roleMember, true); auditLogRequest(ctx, domainName, auditRef, caller, ZMSConsts.HTTP_PUT, roleName, auditDetails.toString()); return; } catch (ResourceException ex) { if (!shouldRetryOperation(ex, retryCount)) { throw ex; } } } } DBService(ObjectStore store, AuditLogger auditLogger, ZMSConfig zmsConfig, AuditReferenceValidator auditReferenceValidator); DomainRoleMembers listOverdueReviewRoleMembers(String domainName); @Override List<Role> getRolesByDomain(String domain); ResourceAccessList getResourceAccessList(String principal, String action); AthenzDomain getAthenzDomain(final String domainName, boolean masterCopy); Quota getQuota(String domainName); void executePutRoleSystemMeta(ResourceContext ctx, final String domainName, final String roleName,
           RoleSystemMeta meta, final String attribute, final String auditRef, final String caller); void executePutGroupSystemMeta(ResourceContext ctx, final String domainName, final String groupName,
                                          GroupSystemMeta meta, final String attribute, final String auditRef); void executePutServiceIdentitySystemMeta(ResourceContext ctx, String domainName, String serviceName,
            ServiceIdentitySystemMeta meta, String attribute, String auditRef, String caller); void executePutRoleMeta(ResourceContext ctx, String domainName, String roleName, Role originalRole,
                                   RoleMeta meta, String auditRef, String caller); void executePutGroupMeta(ResourceContext ctx, final String domainName, final String groupName,
                                    GroupMeta meta, final String auditRef); Set<String> getPendingMembershipApproverRoles(int delayDays); Set<String> getPendingGroupMembershipApproverRoles(int delayDays); Map<String, DomainRoleMember> getRoleExpiryMembers(int delayDays); Map<String, DomainRoleMember> getRoleReviewMembers(int delayDays); Map<String, DomainGroupMember> getGroupExpiryMembers(int delayDays); void processExpiredPendingMembers(int pendingRoleMemberLifespan, final String monitorIdentity); void processExpiredPendingGroupMembers(int pendingGroupMemberLifespan, final String monitorIdentity); static int AUDIT_TYPE_ROLE; static int AUDIT_TYPE_POLICY; static int AUDIT_TYPE_SERVICE; static int AUDIT_TYPE_DOMAIN; static int AUDIT_TYPE_ENTITY; static int AUDIT_TYPE_TENANCY; static int AUDIT_TYPE_TEMPLATE; static int AUDIT_TYPE_GROUP; }
@Test public void testExecutePutMembership() { String domainName = "mgradddom1"; String roleName = "role1"; TopLevelDomain dom1 = createTopLevelDomainObject(domainName, "Test Domain1", "testOrg", adminUser); zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); TopLevelDomain dom2 = createTopLevelDomainObject("coretech", "Test Domain2", "testOrg", adminUser); zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom2); SubDomain subDom2 = createSubDomainObject("storage", "coretech", "Test Domain2", "testOrg", adminUser); zms.postSubDomain(mockDomRsrcCtx, "coretech", auditRef, subDom2); Role role1 = createRoleObject(domainName, roleName, null, "user.joe", "user.jane"); zms.putRole(mockDomRsrcCtx, domainName, roleName, auditRef, role1); zms.dbService.executePutMembership(mockDomRsrcCtx, domainName, roleName, new RoleMember().setMemberName("user.doe"), auditRef, "putMembership"); zms.dbService.executePutMembership(mockDomRsrcCtx, domainName, roleName, new RoleMember().setMemberName("coretech.storage"), auditRef, "putMembership"); Role role = zms.getRole(mockDomRsrcCtx, domainName, roleName, false, false, false); assertNotNull(role); List<RoleMember> members = role.getRoleMembers(); assertNotNull(members); assertEquals(members.size(), 4); List<String> checkList = new ArrayList<>(); checkList.add("user.joe"); checkList.add("user.jane"); checkList.add("user.doe"); checkList.add("coretech.storage"); checkRoleMember(checkList, members); zms.deleteSubDomain(mockDomRsrcCtx, "coretech", "storage", auditRef); zms.deleteTopLevelDomain(mockDomRsrcCtx, "coretech", auditRef); zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); }
@Test public void testExecutePutMembershipTrustRole() { String domainName = "putmbrtrustrole"; String roleName = "role1"; TopLevelDomain dom1 = createTopLevelDomainObject(domainName, "Test Domain1", "testOrg", adminUser); zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); Role role1 = createRoleObject(domainName, roleName, "sys.auth", null, null); zms.putRole(mockDomRsrcCtx, domainName, roleName, auditRef, role1); try { zms.dbService.executePutMembership(mockDomRsrcCtx, domainName, roleName, new RoleMember().setMemberName("user.doe"), auditRef, "putMembership"); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 400); } zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); }