SSLCertificateService { public ResponseEntity<String> associateApproletoCertificate(CertificateApprole certificateApprole, UserDetails userDetails) { String authToken = null; boolean isAuthorized = true; if(!areCertificateApproleInputsValid(certificateApprole)) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)). put(LogMessage.ACTION, SSLCertificateConstants.ADD_APPROLE_TO_CERT_MSG). put(LogMessage.MESSAGE, "Invalid input values"). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid input values\"]}"); } log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)). put(LogMessage.ACTION, SSLCertificateConstants.ADD_APPROLE_TO_CERT_MSG). put(LogMessage.MESSAGE, String.format("Trying to add Approle to Certificate - Request [%s]", certificateApprole.toString())). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)). build())); String approleName = certificateApprole.getApproleName().toLowerCase(); String certificateName = certificateApprole.getCertificateName().toLowerCase(); String access = certificateApprole.getAccess().toLowerCase(); String certType = certificateApprole.getCertType().toLowerCase(); if (approleName.equals(TVaultConstants.SELF_SERVICE_APPROLE_NAME)) { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Access denied: no permission to associate this AppRole to any Certificate\"]}"); } if (!ObjectUtils.isEmpty(userDetails)) { if (userDetails.isAdmin()) { authToken = userDetails.getClientToken(); }else { authToken = userDetails.getSelfSupportToken(); } SSLCertificateMetadataDetails certificateMetaData = certificateUtils.getCertificateMetaData(authToken, certificateName, certType); isAuthorized = certificateUtils.hasAddOrRemovePermission(userDetails, certificateMetaData); }else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)). put(LogMessage.ACTION, SSLCertificateConstants.ADD_APPROLE_TO_CERT_MSG). put(LogMessage.MESSAGE, "Access denied: No permission to add approle to this certificate"). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Access denied: No permission to add approle to this certificate\"]}"); } if(isAuthorized){ return createPoliciesAndConfigureApproleToCertificate(authToken, approleName, certificateName, access, certType); } else{ log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)). put(LogMessage.ACTION, SSLCertificateConstants.ADD_APPROLE_TO_CERT_MSG). put(LogMessage.MESSAGE, String.format("Access denied: No permission to add Approle [%s] to the Certificate [%s]", approleName, certificateName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Access denied: No permission to add Approle to this Certificate\"]}"); } }  ResponseEntity<String> authenticate(CertManagerLoginRequest certManagerLoginRequest); CertManagerLogin login(CertManagerLoginRequest certManagerLoginRequest); ResponseEntity<String> generateSSLCertificate(SSLCertificateRequest sslCertificateRequest,
                                                               UserDetails userDetails ,String token); ResponseEntity<String> getServiceCertificates(String token, UserDetails userDetails, String certName, Integer limit, Integer offset, String certType); String getNclmToken(); ResponseEntity<String> getTargetSystemList(String token, UserDetails userDetails,String certType); ResponseEntity<String> getTargetSystemServiceList(String token, UserDetails userDetails, String targetSystemId); ResponseEntity<String> getRevocationReasons(Integer certificateId, String token); ResponseEntity<String> issueRevocationRequest(String certType, String certificateName, UserDetails userDetails, String token,
			RevocationRequest revocationRequest); String getCurrentLocalDateTimeStamp(); Boolean validateOwnerPermissionForNonAdmin(UserDetails userDetails, String certificateName); ResponseEntity<String> addUserToCertificate(CertificateUser certificateUser, UserDetails userDetails, boolean addSudoPermission); ResponseEntity<String> addGroupToCertificate(UserDetails userDetails, String userToken, CertificateGroup certificateGroup); boolean isAuthorized(UserDetails userDetails, String certificatename, String certType); ResponseEntity<String> addingGroupToCertificate(String token, CertificateGroup certificateGroup, UserDetails userDetails); ResponseEntity<String> associateApproletoCertificate(CertificateApprole certificateApprole, UserDetails userDetails); boolean hasDownloadPermission(String certificateName, UserDetails userDetails, String certType); SSLCertificateMetadataDetails getCertificateMetadata(String token, String certificateName); ResponseEntity<InputStreamResource> downloadCertificateWithPrivateKey(String token, CertificateDownloadRequest certificateDownloadRequest, UserDetails userDetails); ResponseEntity<InputStreamResource> downloadCertificateWithPrivateKey(CertificateDownloadRequest certificateDownloadRequest, SSLCertificateMetadataDetails sslCertificateMetadataDetails); ResponseEntity<InputStreamResource> downloadCertificate(String token, UserDetails userDetails,
                                                                   String certificateName, String certificateType,
                                                                   String sslCertType); ResponseEntity<String> getCertificateDetails(String token, String certificateName, String certificateType); ResponseEntity<String> renewCertificate(String certType, String certificateName, UserDetails userDetails, String token); ResponseEntity<String> removeUserFromCertificate(CertificateUser certificateUser, UserDetails userDetails); ResponseEntity<String> removeGroupFromCertificate(CertificateGroup certificateGroup, UserDetails userDetails); ResponseEntity<String> getListOfCertificates(String token, String certificateType); ResponseEntity<String> updateCertOwner(String token, String certType,String certName,String certOwnerEmailId,  UserDetails userDetails); ResponseEntity<String> validateApprovalStatusAndGetCertificateDetails(String certName, String certType,
			UserDetails userDetails); ResponseEntity<String> deleteCertificate( String token, String certType, String certificateName, UserDetails userDetails); Boolean validateCertOwnerPermissionForNonAdmin(UserDetails userDetails, String certificateName, String certType); ResponseEntity<String> getAllCertificates(String token, String certName, Integer limit, Integer offset); ResponseEntity<String> getAllCertificatesOnCertType(UserDetails userDetails, String certificateType); ResponseEntity<String> checkCertificateStatus(String certName, String certType,	
			UserDetails userDetails); ResponseEntity<String> getAllSelfServiceGroups(UserDetails userDetails); ResponseEntity<String> removeGroupFromCertificateForDelete(CertificateGroup certificateGroup, UserDetails userDetails); @Value("${sslcertmanager.targetsystemgroup.public_single_san.ts_gp_id}")
    private int public_single_san_ts_gp_id; @Value("${sslcertmanager.targetsystemgroup.public_multi_san.ts_gp_id}")
    private int public_multi_san_ts_gp_id; }
@Test public void testAssociateAppRoleToCertificateFailure403() { ResponseEntity<String> responseEntityExpected = ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Access denied: No permission to add Approle to this Certificate\"]}"); token = "5PDrOhsy4ig8L3EpsJZSLAMg"; userDetails = getMockUser(false); CertificateApprole certificateApprole = new CertificateApprole("certificatename.t-mobile.com", "role1", "read", "internal"); ResponseEntity<String> responseEntityActual = sSLCertificateService.associateApproletoCertificate(certificateApprole, userDetails); assertEquals(HttpStatus.BAD_REQUEST, responseEntityActual.getStatusCode()); assertEquals(responseEntityExpected, responseEntityActual); }