DBService implements RolesProvider { void setupTenantAdminPolicy(String tenantDomain, String provSvcDomain, String provSvcName, String auditRef, String caller) { for (int retryCount = defaultRetryCount; ; retryCount--) { try (ObjectStoreConnection con = store.getConnection(false, true)) { checkDomainAuditEnabled(con, tenantDomain, auditRef, caller, provSvcDomain + "." + provSvcName, AUDIT_TYPE_TENANCY); String domainAdminRole = ZMSUtils.roleResourceName(tenantDomain, ZMSConsts.ADMIN_ROLE_NAME); String serviceRoleResourceName = ZMSUtils.getTrustedResourceGroupRolePrefix(provSvcDomain, provSvcName, tenantDomain, null) + ZMSConsts.ADMIN_ROLE_NAME; final String tenancyResource = "tenancy." + provSvcDomain + '.' + provSvcName; String adminName = tenancyResource + ".admin"; String tenantAdminRole = ZMSUtils.roleResourceName(tenantDomain, adminName); if (con.getRole(tenantDomain, adminName) == null) { con.insertRole(tenantDomain, new Role().setName(tenantAdminRole)); } if (con.getPolicy(tenantDomain, adminName) == null) { Policy adminPolicy = new Policy().setName(ZMSUtils.policyResourceName(tenantDomain, adminName)); con.insertPolicy(tenantDomain, adminPolicy); Assertion assertion = new Assertion().setRole(domainAdminRole) .setResource(serviceRoleResourceName).setAction(ZMSConsts.ACTION_ASSUME_ROLE) .setEffect(AssertionEffect.ALLOW); con.insertAssertion(tenantDomain, adminName, assertion); assertion = new Assertion().setRole(tenantAdminRole) .setResource(serviceRoleResourceName).setAction(ZMSConsts.ACTION_ASSUME_ROLE) .setEffect(AssertionEffect.ALLOW); con.insertAssertion(tenantDomain, adminName, assertion); String tenantResourceName = tenantDomain + ":" + tenancyResource; assertion = new Assertion().setRole(tenantAdminRole) .setResource(tenantResourceName).setAction(ZMSConsts.ACTION_UPDATE) .setEffect(AssertionEffect.ALLOW); con.insertAssertion(tenantDomain, adminName, assertion); } saveChanges(con, tenantDomain); return; } catch (ResourceException ex) { if (!shouldRetryOperation(ex, retryCount)) { throw ex; } } } } DBService(ObjectStore store, AuditLogger auditLogger, ZMSConfig zmsConfig, AuditReferenceValidator auditReferenceValidator); DomainRoleMembers listOverdueReviewRoleMembers(String domainName); @Override List<Role> getRolesByDomain(String domain); ResourceAccessList getResourceAccessList(String principal, String action); AthenzDomain getAthenzDomain(final String domainName, boolean masterCopy); Quota getQuota(String domainName); void executePutRoleSystemMeta(ResourceContext ctx, final String domainName, final String roleName,
           RoleSystemMeta meta, final String attribute, final String auditRef, final String caller); void executePutGroupSystemMeta(ResourceContext ctx, final String domainName, final String groupName,
                                          GroupSystemMeta meta, final String attribute, final String auditRef); void executePutServiceIdentitySystemMeta(ResourceContext ctx, String domainName, String serviceName,
            ServiceIdentitySystemMeta meta, String attribute, String auditRef, String caller); void executePutRoleMeta(ResourceContext ctx, String domainName, String roleName, Role originalRole,
                                   RoleMeta meta, String auditRef, String caller); void executePutGroupMeta(ResourceContext ctx, final String domainName, final String groupName,
                                    GroupMeta meta, final String auditRef); Set<String> getPendingMembershipApproverRoles(int delayDays); Set<String> getPendingGroupMembershipApproverRoles(int delayDays); Map<String, DomainRoleMember> getRoleExpiryMembers(int delayDays); Map<String, DomainRoleMember> getRoleReviewMembers(int delayDays); Map<String, DomainGroupMember> getGroupExpiryMembers(int delayDays); void processExpiredPendingMembers(int pendingRoleMemberLifespan, final String monitorIdentity); void processExpiredPendingGroupMembers(int pendingGroupMemberLifespan, final String monitorIdentity); static int AUDIT_TYPE_ROLE; static int AUDIT_TYPE_POLICY; static int AUDIT_TYPE_SERVICE; static int AUDIT_TYPE_DOMAIN; static int AUDIT_TYPE_ENTITY; static int AUDIT_TYPE_TENANCY; static int AUDIT_TYPE_TEMPLATE; static int AUDIT_TYPE_GROUP; }
@Test public void testSetupTenantAdminPolicy() { String caller = "testSetupTenantAdminPolicy"; String tenantDomain = "tenantadminpolicy"; String providerDomain = "coretech"; String providerService = "storage"; TopLevelDomain dom1 = createTopLevelDomainObject(tenantDomain, "Test Tenant Domain1", "testOrg", adminUser); zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); TopLevelDomain domProv = createTopLevelDomainObject(providerDomain, "Test Provider Domain1", "testOrg", adminUser); zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, domProv); ServiceIdentity service = createServiceObject( providerDomain, providerService, "http: "/usr/bin/java", "root", "users", "localhost"); zms.putServiceIdentity(mockDomRsrcCtx, providerDomain, providerService, auditRef, service); zms.dbService.setupTenantAdminPolicy(tenantDomain, providerDomain, providerService, auditRef, caller); String policyName = "tenancy.coretech.storage.admin"; Policy policy = zms.dbService.getPolicy(tenantDomain, policyName); assertNotNull(policy); List<Assertion> assertList = policy.getAssertions(); assertNotNull(assertList); assertEquals(3, assertList.size()); boolean domainAdminRoleCheck = false; boolean tenantAdminRoleCheck = false; boolean tenantUpdateCheck = false; for (Assertion obj : assertList) { assertEquals(AssertionEffect.ALLOW, obj.getEffect()); if (obj.getRole().equals("tenantadminpolicy:role.admin")) { assertEquals(obj.getResource(), "coretech:role.storage.tenant.tenantadminpolicy.admin"); assertEquals(obj.getAction(), "assume_role"); domainAdminRoleCheck = true; } else if (obj.getRole().equals("tenantadminpolicy:role.tenancy.coretech.storage.admin")) { if (obj.getAction().equals("assume_role")) { assertEquals(obj.getResource(), "coretech:role.storage.tenant.tenantadminpolicy.admin"); tenantAdminRoleCheck = true; } else if (obj.getAction().equals("update")) { assertEquals("tenantadminpolicy:tenancy.coretech.storage", obj.getResource()); tenantUpdateCheck = true; } } } assertTrue(domainAdminRoleCheck); assertTrue(tenantAdminRoleCheck); assertTrue(tenantUpdateCheck); zms.deleteTopLevelDomain(mockDomRsrcCtx, tenantDomain, auditRef); zms.deleteTopLevelDomain(mockDomRsrcCtx, providerDomain, auditRef); }