AuthzHelper { public static boolean checkRoleMemberValidity(List<RoleMember> roleMembers, final String member, GroupMembersFetcher groupMembersFetcher) { List<RoleMember> groupMembers = new ArrayList<>(); for (RoleMember memberInfo: roleMembers) { if (memberInfo.getPrincipalType() != null && memberInfo.getPrincipalType() == Principal.Type.GROUP.getValue()) { groupMembers.add(memberInfo); } } boolean isMember = false; long currentTime = System.currentTimeMillis(); for (RoleMember memberInfo: roleMembers) { if (memberInfo.getPrincipalType() != null && memberInfo.getPrincipalType() == Principal.Type.GROUP.getValue()) { continue; } final String memberName = memberInfo.getMemberName(); if (memberNameMatch(memberName, member)) { isMember = !isMemberDisabled(memberInfo.getSystemDisabled()) && !isMemberExpired(memberInfo.getExpiration(), currentTime); break; } } if (isMember || groupMembers.isEmpty()) { return isMember; } for (RoleMember memberInfo : groupMembers) { if (isMemberExpired(memberInfo.getExpiration(), currentTime)) { continue; } isMember = isMemberOfGroup(groupMembersFetcher.getGroupMembers(memberInfo.getMemberName()), member); if (isMember) { break; } } return isMember; }  static void removeRoleMembers(List<RoleMember> originalRoleMembers, List<RoleMember> removeRoleMembers); static void removeGroupMembers(List<GroupMember> originalGroupMembers, List<GroupMember> removeGroupMembers); static boolean isMemberDisabled(Integer systemDisabled); static boolean isMemberExpired(Timestamp expiration, long currentTime); static boolean shouldSkipGroupMember(GroupMember member, long currentTime); static boolean isMemberOfGroup(List<GroupMember> groupMembers, final String member); static boolean checkGroupMemberValidity(List<GroupMember> groupMembers, final String member); static boolean memberNameMatch(final String memberName, final  String matchName); static boolean shouldRunDelegatedTrustCheck(final String trust, final String trustDomain); static String retrieveResourceDomain(String resource, String op, String trustDomain); static String extractResourceDomainName(final String resource); static boolean authorityAuthorizationAllowed(Principal principal); static boolean checkRoleMemberValidity(List<RoleMember> roleMembers, final String member,
                                                  GroupMembersFetcher groupMembersFetcher); static boolean isMemberOfRole(Role role, final String member, GroupMembersFetcher groupMembersFetcher); static boolean assumeRoleResourceMatch(String roleName, Assertion assertion); static boolean matchDelegatedTrustPolicy(Policy policy, final String roleName, final String roleMember,
                                                    List<Role> roles, GroupMembersFetcher groupMembersFetcher); static boolean matchDelegatedTrustAssertion(Assertion assertion, final String roleName, final String roleMember,
                                                       List<Role> roles, GroupMembersFetcher groupMembersFetcher);  }
@Test public void testCheckRoleMemberValidity() { List<RoleMember> roleMembers = new ArrayList<>(); RoleMember roleMemberJoe = new RoleMember() .setMemberName("user.joe") .setPrincipalType(Principal.Type.USER.getValue()); RoleMember roleMemberJane = new RoleMember() .setMemberName("user.jane") .setSystemDisabled(null) .setExpiration(null); RoleMember roleMemberJohn = new RoleMember() .setSystemDisabled(0) .setMemberName("user.john") .setExpiration(Timestamp.fromMillis(System.currentTimeMillis() + 100000)); roleMembers.add(roleMemberJoe); roleMembers.add(roleMemberJane); roleMembers.add(roleMemberJohn); RoleMember roleMemberJoeBad = new RoleMember() .setMemberName("user.joe-bad") .setSystemDisabled(1); RoleMember roleMemberJaneBad = new RoleMember() .setMemberName("user.jane-bad") .setSystemDisabled(null) .setExpiration(Timestamp.fromMillis(System.currentTimeMillis() - 1)); RoleMember roleMemberJohnBad = new RoleMember() .setSystemDisabled(3) .setMemberName("user.john-bad") .setExpiration(Timestamp.fromMillis(System.currentTimeMillis() - 10000)); RoleMember roleGroup1 = new RoleMember() .setMemberName("coretech:group.dev-team") .setPrincipalType(Principal.Type.GROUP.getValue()); roleMembers.add(roleMemberJoeBad); roleMembers.add(roleMemberJaneBad); roleMembers.add(roleMemberJohnBad); roleMembers.add(roleGroup1); assertTrue(AuthzHelper.checkRoleMemberValidity(roleMembers, "user.joe", nullFetcher)); assertTrue(AuthzHelper.checkRoleMemberValidity(roleMembers, "user.jane", nullFetcher)); assertTrue(AuthzHelper.checkRoleMemberValidity(roleMembers, "user.john", nullFetcher)); assertFalse(AuthzHelper.checkRoleMemberValidity(roleMembers, "user.joe-bad", nullFetcher)); assertFalse(AuthzHelper.checkRoleMemberValidity(roleMembers, "user.jane-bad", nullFetcher)); assertFalse(AuthzHelper.checkRoleMemberValidity(roleMembers, "user.john-bad", nullFetcher)); assertFalse(AuthzHelper.checkRoleMemberValidity(roleMembers, "user.unknown", nullFetcher)); }
@Test public void testCheckRoleMemberValidityGroupMember() { List<RoleMember> roleMembers = new ArrayList<>(); RoleMember roleMemberJoe = new RoleMember() .setMemberName("user.joe") .setPrincipalType(Principal.Type.USER.getValue()); RoleMember roleMemberJane = new RoleMember() .setMemberName("user.jane"); RoleMember roleGroup1 = new RoleMember() .setMemberName("coretech:group.dev-team") .setPrincipalType(Principal.Type.GROUP.getValue()); roleMembers.add(roleMemberJoe); roleMembers.add(roleMemberJane); roleMembers.add(roleGroup1); assertTrue(AuthzHelper.checkRoleMemberValidity(roleMembers, "user.joe", devTeamFetcher)); assertTrue(AuthzHelper.checkRoleMemberValidity(roleMembers, "user.jane", devTeamFetcher)); assertFalse(AuthzHelper.checkRoleMemberValidity(roleMembers, "user.john", devTeamFetcher)); assertTrue(AuthzHelper.checkRoleMemberValidity(roleMembers, "user.valid", devTeamFetcher)); assertFalse(AuthzHelper.checkRoleMemberValidity(roleMembers, "user.disabled", devTeamFetcher)); assertFalse(AuthzHelper.checkRoleMemberValidity(roleMembers, "user.expired", devTeamFetcher)); assertFalse(AuthzHelper.checkRoleMemberValidity(roleMembers, "user.unknown", devTeamFetcher)); }
@Test public void testCheckRoleMemberValidityExpiredGroupMember() { List<RoleMember> roleMembers = new ArrayList<>(); RoleMember roleGroup1 = new RoleMember() .setMemberName("coretech:group.dev-team") .setExpiration(Timestamp.fromMillis(1000)) .setPrincipalType(Principal.Type.GROUP.getValue()); roleMembers.add(roleGroup1); assertFalse(AuthzHelper.checkRoleMemberValidity(roleMembers, "user.joe", devTeamFetcher)); assertFalse(AuthzHelper.checkRoleMemberValidity(roleMembers, "user.jane", devTeamFetcher)); assertFalse(AuthzHelper.checkRoleMemberValidity(roleMembers, "user.john", devTeamFetcher)); assertFalse(AuthzHelper.checkRoleMemberValidity(roleMembers, "user.valid", devTeamFetcher)); assertFalse(AuthzHelper.checkRoleMemberValidity(roleMembers, "user.disabled", devTeamFetcher)); assertFalse(AuthzHelper.checkRoleMemberValidity(roleMembers, "user.expired", devTeamFetcher)); assertFalse(AuthzHelper.checkRoleMemberValidity(roleMembers, "user.unknown", devTeamFetcher)); }
@Test public void testCheckRoleMemberExpiration() { RoleMember roleMember1 = new RoleMember(); roleMember1.setExpiration(Timestamp.fromMillis(1001)); roleMember1.setMemberName("user.athenz1"); RoleMember roleMember2 = new RoleMember(); roleMember2.setExpiration(Timestamp.fromMillis(System.currentTimeMillis() + 10000)); roleMember2.setMemberName("user.athenz2"); List<RoleMember> members = new ArrayList<>(); members.add(roleMember1); members.add(roleMember2); assertTrue(AuthzHelper.checkRoleMemberValidity(members, "user.athenz2", nullFetcher)); assertFalse(AuthzHelper.checkRoleMemberValidity(members, "user.athenz1", nullFetcher)); }