DBService implements RolesProvider { List<RoleMember> getDelegatedRoleMembers(ObjectStoreConnection con, final String domainName, final String trustDomain, final String roleName) { if (domainName.equals(trustDomain)) { return null; } AthenzDomain domain = null; try { domain = getAthenzDomain(con, trustDomain); } catch (ResourceException ex) { LOG.error("unable to fetch domain {}: {}", trustDomain, ex.getMessage()); } if (domain == null) { return null; } Map<String, RoleMember> roleMembers = new HashMap<>(); String fullRoleName = ZMSUtils.roleResourceName(domainName, roleName); for (Policy policy : domain.getPolicies()) { List<Assertion> assertions = policy.getAssertions(); if (assertions == null) { continue; } for (Assertion assertion : assertions) { if (!AuthzHelper.assumeRoleResourceMatch(fullRoleName, assertion)) { continue; } String rolePattern = StringUtils.patternFromGlob(assertion.getRole()); for (Role role : domain.getRoles()) { List<RoleMember> members = role.getRoleMembers(); if (members == null || members.isEmpty()) { continue; } if (!role.getName().matches(rolePattern)) { continue; } for (RoleMember member : members) { String memberName = member.getMemberName(); if (!roleMembers.containsKey(memberName)) { roleMembers.put(memberName, member); } } } } } return new ArrayList<>(roleMembers.values()); } DBService(ObjectStore store, AuditLogger auditLogger, ZMSConfig zmsConfig, AuditReferenceValidator auditReferenceValidator); DomainRoleMembers listOverdueReviewRoleMembers(String domainName); @Override List<Role> getRolesByDomain(String domain); ResourceAccessList getResourceAccessList(String principal, String action); AthenzDomain getAthenzDomain(final String domainName, boolean masterCopy); Quota getQuota(String domainName); void executePutRoleSystemMeta(ResourceContext ctx, final String domainName, final String roleName,
           RoleSystemMeta meta, final String attribute, final String auditRef, final String caller); void executePutGroupSystemMeta(ResourceContext ctx, final String domainName, final String groupName,
                                          GroupSystemMeta meta, final String attribute, final String auditRef); void executePutServiceIdentitySystemMeta(ResourceContext ctx, String domainName, String serviceName,
            ServiceIdentitySystemMeta meta, String attribute, String auditRef, String caller); void executePutRoleMeta(ResourceContext ctx, String domainName, String roleName, Role originalRole,
                                   RoleMeta meta, String auditRef, String caller); void executePutGroupMeta(ResourceContext ctx, final String domainName, final String groupName,
                                    GroupMeta meta, final String auditRef); Set<String> getPendingMembershipApproverRoles(int delayDays); Set<String> getPendingGroupMembershipApproverRoles(int delayDays); Map<String, DomainRoleMember> getRoleExpiryMembers(int delayDays); Map<String, DomainRoleMember> getRoleReviewMembers(int delayDays); Map<String, DomainGroupMember> getGroupExpiryMembers(int delayDays); void processExpiredPendingMembers(int pendingRoleMemberLifespan, final String monitorIdentity); void processExpiredPendingGroupMembers(int pendingGroupMemberLifespan, final String monitorIdentity); static int AUDIT_TYPE_ROLE; static int AUDIT_TYPE_POLICY; static int AUDIT_TYPE_SERVICE; static int AUDIT_TYPE_DOMAIN; static int AUDIT_TYPE_ENTITY; static int AUDIT_TYPE_TENANCY; static int AUDIT_TYPE_TEMPLATE; static int AUDIT_TYPE_GROUP; }
@Test public void testGetDelegatedRoleMembersInvalidDomain() { ObjectStoreConnection conn = zms.dbService.store.getConnection(true, false); assertNull(zms.dbService.getDelegatedRoleMembers(conn, "dom1", "dom1", "role1")); assertNull(zms.dbService.getDelegatedRoleMembers(conn, "dom1", "invalid-domain", "role1")); }
@Test public void testGetDelegatedRoleMembers() { String domainName1 = "role-expand1"; String domainName2 = "role-expand2"; String roleName = "role1"; TopLevelDomain dom1 = createTopLevelDomainObject(domainName1, "Test Domain1", "testOrg", adminUser); zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); TopLevelDomain dom2 = createTopLevelDomainObject(domainName2, "Test Domain2", "testOrg", adminUser); zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom2); Role role1 = createRoleObject(domainName1, roleName, domainName2, null, null); zms.putRole(mockDomRsrcCtx, domainName1, roleName, auditRef, role1); Role role2a = createRoleObject(domainName2, "role2a", null, "user.joe", "user.jane"); zms.putRole(mockDomRsrcCtx, domainName2, "role2a", auditRef, role2a); Role role2b = createRoleObject(domainName2, "role2b", null, "user.joe", "user.doe"); zms.putRole(mockDomRsrcCtx, domainName2, "role2b", auditRef, role2b); Role role2c = createRoleObject(domainName2, "role2c", "sys.auth", null, null); zms.putRole(mockDomRsrcCtx, domainName2, "role2c", auditRef, role2c); Role role2d = createRoleObject(domainName2, "role2d", null, "user.user1", "user.user2"); zms.putRole(mockDomRsrcCtx, domainName2, "role2d", auditRef, role2d); Role role2e = createRoleObject(domainName2, "role2e", null, null, null); zms.putRole(mockDomRsrcCtx, domainName2, "role2e", auditRef, role2e); Policy policy = createPolicyObject(domainName2, "policy", domainName2 + ":role.role2a", false, "assume_role", domainName1 + ":role." + roleName, AssertionEffect.ALLOW); Assertion assertion = new Assertion(); assertion.setAction("assume_role"); assertion.setEffect(AssertionEffect.ALLOW); assertion.setResource("*:role." + roleName); assertion.setRole(domainName2 + ":role.role2b"); policy.getAssertions().add(assertion); zms.putPolicy(mockDomRsrcCtx, domainName2, "policy", auditRef, policy); policy = new Policy().setName(domainName2 + ":policy.policy2"); zms.dbService.executePutPolicy(mockDomRsrcCtx, domainName2, "policy2", policy, auditRef, "putPolicy"); ObjectStoreConnection conn = zms.dbService.store.getConnection(true, false); List<RoleMember> members = zms.dbService.getDelegatedRoleMembers(conn, domainName1, domainName2, roleName); assertEquals(3, members.size()); List<String> checkList = new ArrayList<>(); checkList.add("user.joe"); checkList.add("user.jane"); checkList.add("user.doe"); checkRoleMember(checkList, members); zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName1, auditRef); zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName2, auditRef); }