JDBCConnection implements ObjectStoreConnection { @Override public ResourceAccessList listResourceAccess(String principal, String action, String userDomain) { final String caller = "listResourceAccess"; ResourceAccessList rsrcAccessList = new ResourceAccessList(); List<ResourceAccess> resources = new ArrayList<>(); rsrcAccessList.setResources(resources); boolean awsQuery = (action != null && action.equals(ZMSConsts.ACTION_ASSUME_AWS_ROLE)); boolean singlePrincipalQuery = (principal != null && !principal.isEmpty()); Map<String, List<String>> rolePrincipals = getRolePrincipals(principal, awsQuery, userDomain, caller); if (rolePrincipals.isEmpty()) { if (singlePrincipalQuery) { if (getPrincipalId(principal) == 0) { throw notFoundError(caller, ZMSConsts.OBJECT_PRINCIPAL, principal); } resources.add(getResourceAccessObject(principal, null)); } return rsrcAccessList; } Map<String, List<Assertion>> roleAssertions = getRoleAssertions(action, caller); if (roleAssertions.isEmpty()) { if (singlePrincipalQuery) { resources.add(getResourceAccessObject(principal, null)); } return rsrcAccessList; } Map<String, List<String>> trustedRoles = getTrustedRoles(caller); Map<String, String> awsDomains = null; if (awsQuery) { awsDomains = getAwsDomains(caller); } Map<String, List<Assertion>> principalAssertions = new HashMap<>(); for (Map.Entry<String, List<String>> entry : rolePrincipals.entrySet()) { String roleIndex = entry.getKey(); if (LOG.isDebugEnabled()) { LOG.debug(caller + ": processing role: " + roleIndex); } List<String> rPrincipals = entry.getValue(); for (String rPrincipal : rPrincipals) { if (LOG.isDebugEnabled()) { LOG.debug(caller + ": processing role principal: " + rPrincipal); } if (skipAwsUserQuery(awsDomains, principal, rPrincipal, userDomain)) { if (LOG.isDebugEnabled()) { LOG.debug(caller + ": skipping non-user: " + rPrincipal); } continue; } List<Assertion> assertions = principalAssertions.computeIfAbsent(rPrincipal, k -> new ArrayList<>()); addRoleAssertions(assertions, roleAssertions.get(roleIndex), awsDomains); List<String> mappedTrustedRoles = trustedRoles.get(roleIndex); if (mappedTrustedRoles != null) { for (String mappedTrustedRole : mappedTrustedRoles) { if (LOG.isDebugEnabled()) { LOG.debug(caller + ": processing trusted role: " + mappedTrustedRole); } addRoleAssertions(assertions, roleAssertions.get(mappedTrustedRole), awsDomains); } } } } for (Map.Entry<String, List<Assertion>> entry : principalAssertions.entrySet()) { List<Assertion> assertions = entry.getValue(); if (!singlePrincipalQuery && (assertions == null || assertions.isEmpty())) { continue; } resources.add(getResourceAccessObject(entry.getKey(), assertions)); } return rsrcAccessList; } JDBCConnection(Connection con, boolean autoCommit); @Override void setOperationTimeout(int queryTimeout); @Override void close(); @Override void rollbackChanges(); @Override void commitChanges(); @Override Domain getDomain(String domainName); @Override boolean insertDomain(Domain domain); @Override boolean updateDomain(Domain domain); @Override boolean updateDomainModTimestamp(String domainName); @Override long getDomainModTimestamp(String domainName); @Override boolean deleteDomain(String domainName); @Override List<String> lookupDomainByRole(String roleMember, String roleName); @Override String lookupDomainById(String account, int productId); @Override List<String> listDomains(String prefix, long modifiedSince); @Override boolean insertDomainTemplate(String domainName, String templateName, String params); @Override boolean updateDomainTemplate(String domainName, String templateName, TemplateMetaData templateMetaData); @Override boolean deleteDomainTemplate(String domainName, String templateName, String params); @Override List<String> listDomainTemplates(String domainName); @Override Map<String, List<String>> getDomainFromTemplateName(Map<String, Integer> templateNameAndLatestVersion); @Override List<String> listPrincipals(String domainName); @Override boolean deletePrincipal(String principalName, boolean subDomains); @Override Role getRole(String domainName, String roleName); @Override boolean insertRole(String domainName, Role role); @Override boolean updateRole(String domainName, Role role); @Override boolean updateRoleModTimestamp(String domainName, String roleName); @Override boolean updateRoleReviewTimestamp(String domainName, String roleName); @Override boolean updateServiceIdentityModTimestamp(String domainName, String serviceName); @Override boolean deleteRole(String domainName, String roleName); @Override List<String> listRoles(String domainName); @Override int countRoles(String domainName); @Override List<RoleMember> listRoleMembers(String domainName, String roleName, Boolean pending); @Override int countRoleMembers(String domainName, String roleName); @Override List<PrincipalRole> listPrincipalRoles(String domainName, String principalName); @Override List<RoleAuditLog> listRoleAuditLogs(String domainName, String roleName); @Override Membership getRoleMember(String domainName, String roleName, String member,
            long expiration, boolean pending); @Override boolean insertRoleMember(String domainName, String roleName, RoleMember roleMember,
            String admin, String auditRef); @Override boolean updateRoleMemberDisabledState(String domainName, String roleName, String principal,
            String admin, int disabledState, String auditRef); @Override boolean deleteRoleMember(String domainName, String roleName, String principal,
            String admin, String auditRef); @Override Assertion getAssertion(String domainName, String policyName, Long assertionId); @Override Policy getPolicy(String domainName, String policyName); @Override boolean insertPolicy(String domainName, Policy policy); @Override boolean updatePolicy(String domainName, Policy policy); @Override boolean updatePolicyModTimestamp(String domainName, String policyName); @Override boolean deletePolicy(String domainName, String policyName); @Override List<String> listPolicies(String domainName, String assertionRoleName); @Override int countPolicies(String domainName); @Override boolean insertAssertion(String domainName, String policyName, Assertion assertion); @Override boolean deleteAssertion(String domainName, String policyName, Long assertionId); @Override List<Assertion> listAssertions(String domainName, String policyName); @Override int countAssertions(String domainName, String policyName); @Override ServiceIdentity getServiceIdentity(String domainName, String serviceName); @Override boolean insertServiceIdentity(String domainName, ServiceIdentity service); @Override boolean updateServiceIdentity(String domainName, ServiceIdentity service); @Override boolean deleteServiceIdentity(String domainName, String serviceName); @Override List<String> listServiceIdentities(String domainName); @Override int countServiceIdentities(String domainName); @Override List<PublicKeyEntry> listPublicKeys(String domainName, String serviceName); @Override int countPublicKeys(String domainName, String serviceName); @Override PublicKeyEntry getPublicKeyEntry(String domainName, String serviceName,
            String keyId, boolean domainStateCheck); @Override boolean insertPublicKeyEntry(String domainName, String serviceName, PublicKeyEntry publicKey); @Override boolean updatePublicKeyEntry(String domainName, String serviceName, PublicKeyEntry publicKey); @Override boolean deletePublicKeyEntry(String domainName, String serviceName, String keyId); @Override List<String> listServiceHosts(String domainName, String serviceName); @Override boolean insertServiceHost(String domainName, String serviceName, String hostName); @Override boolean deleteServiceHost(String domainName, String serviceName, String hostName); @Override boolean insertEntity(String domainName, Entity entity); @Override boolean updateEntity(String domainName, Entity entity); @Override boolean deleteEntity(String domainName, String entityName); @Override Entity getEntity(String domainName, String entityName); @Override List<String> listEntities(String domainName); @Override int countEntities(String domainName); @Override AthenzDomain getAthenzDomain(String domainName); @Override DomainMetaList listModifiedDomains(long modifiedSince); @Override ResourceAccessList listResourceAccess(String principal, String action, String userDomain); @Override Quota getQuota(String domainName); @Override boolean insertQuota(String domainName, Quota quota); @Override boolean updateQuota(String domainName, Quota quota); @Override boolean deleteQuota(String domainName); @Override DomainRoleMembers listDomainRoleMembers(String domainName); @Override DomainRoleMember getPrincipalRoles(String principal, String domainName); @Override DomainRoleMembers listOverdueReviewRoleMembers(String domainName); @Override Map<String, List<DomainGroupMember>> getPendingDomainGroupMembers(String principal); @Override Map<String, List<DomainGroupMember>> getExpiredPendingDomainGroupMembers(int pendingGroupMemberLifespan); @Override Set<String> getPendingGroupMembershipApproverRoles(String server, long timestamp); @Override boolean updatePendingGroupMembersNotificationTimestamp(String server, long timestamp, int delayDays); @Override boolean deletePendingRoleMember(String domainName, String roleName, String principal,
            String admin, String auditRef); boolean executeDeletePendingRoleMember(int roleId, int principalId, final String admin,
            final String principal, final String auditRef, boolean auditLog, final String caller); @Override boolean confirmRoleMember(String domainName, String roleName, RoleMember roleMember,
            String admin, String auditRef); @Override Map<String, List<DomainRoleMember>> getPendingDomainRoleMembers(String principal); @Override Set<String> getPendingMembershipApproverRoles(String server, long timestamp); @Override Map<String, List<DomainRoleMember>> getExpiredPendingDomainRoleMembers(int pendingRoleMemberLifespan); @Override boolean updatePendingRoleMembersNotificationTimestamp(String server, long timestamp, int delayDays); @Override Map<String, DomainRoleMember> getNotifyTemporaryRoleMembers(String server, long timestamp); @Override boolean updateRoleMemberExpirationNotificationTimestamp(String server, long timestamp, int delayDays); @Override Map<String, DomainGroupMember> getNotifyTemporaryGroupMembers(String server, long timestamp); @Override boolean updateGroupMemberExpirationNotificationTimestamp(String server, long timestamp, int delayDays); @Override Map<String, DomainRoleMember> getNotifyReviewRoleMembers(String server, long timestamp); @Override boolean updateRoleMemberReviewNotificationTimestamp(String server, long timestamp, int delayDays); @Override List<TemplateMetaData> getDomainTemplates(String domainName); @Override List<PrincipalRole> listRolesWithUserAuthorityRestrictions(); @Override Group getGroup(String domainName, String groupName); @Override boolean insertGroup(String domainName, Group group); @Override boolean updateGroup(String domainName, Group group); @Override boolean deleteGroup(String domainName, String groupName); @Override boolean updateGroupModTimestamp(String domainName, String groupName); @Override int countGroups(String domainName); @Override List<GroupAuditLog> listGroupAuditLogs(String domainName, String groupName); @Override boolean updateGroupReviewTimestamp(String domainName, String groupName); @Override List<GroupMember> listGroupMembers(String domainName, String groupName, Boolean pending); @Override int countGroupMembers(String domainName, String groupName); @Override GroupMembership getGroupMember(String domainName, String groupName, String member, long expiration, boolean pending); @Override boolean insertGroupMember(String domainName, String groupName, GroupMember groupMember,
                                     String admin, String auditRef); @Override boolean deleteGroupMember(String domainName, String groupName, String principal, String admin, String auditRef); @Override boolean updateGroupMemberDisabledState(String domainName, String groupName, String principal, String admin,
                                                  int disabledState, String auditRef); @Override boolean deletePendingGroupMember(String domainName, String groupName, String principal,
                                           String admin, String auditRef); boolean executeDeletePendingGroupMember(int groupId, int principalId, final String admin,
                                                  final String principal, final String auditRef, boolean auditLog, final String caller); @Override boolean confirmGroupMember(String domainName, String groupName, GroupMember groupMember,
                                      String admin, String auditRef); @Override DomainGroupMember getPrincipalGroups(String principal, String domainName); @Override List<PrincipalGroup> listGroupsWithUserAuthorityRestrictions(); String generateDomainTemplateVersionQuery(Map<String, Integer> templateNameAndLatestVersion); static Comparator<RoleMember> RoleMemberComparator; static Comparator<GroupMember> GroupMemberComparator; }
@Test public void testListResourceAccess() throws SQLException { JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); Mockito.when(mockResultSet.next()) .thenReturn(true) .thenReturn(true) .thenReturn(true) .thenReturn(true) .thenReturn(false) .thenReturn(true) .thenReturn(true) .thenReturn(true) .thenReturn(false) .thenReturn(false); Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_NAME)) .thenReturn("user.user1") .thenReturn("user.user2") .thenReturn("user.user3") .thenReturn("user.user4") .thenReturn("dom1") .thenReturn("dom1") .thenReturn("dom2"); Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_DOMAIN_ID)) .thenReturn("101") .thenReturn("101") .thenReturn("102") .thenReturn("101") .thenReturn("101") .thenReturn("102"); Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_ROLE_NAME)) .thenReturn("role1") .thenReturn("role1") .thenReturn("role3"); java.sql.Timestamp expiredTime = new java.sql.Timestamp(System.currentTimeMillis() - 100000); java.sql.Timestamp nonExpiredTime = new java.sql.Timestamp(System.currentTimeMillis() + 1000000); Mockito.when(mockResultSet.getTimestamp(ZMSConsts.DB_COLUMN_EXPIRATION)) .thenReturn(null) .thenReturn(nonExpiredTime) .thenReturn(null) .thenReturn(expiredTime); Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_ROLE)) .thenReturn("role1") .thenReturn("role1") .thenReturn("role3") .thenReturn("role4"); Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_RESOURCE)) .thenReturn("resource1") .thenReturn("resource2") .thenReturn("resource3") .thenReturn("resource4"); Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_ACTION)) .thenReturn("update"); Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_EFFECT)) .thenReturn("ALLOW"); ResourceAccessList resourceAccessList = jdbcConn.listResourceAccess(null, "update", "user"); List<ResourceAccess> resources = resourceAccessList.getResources(); assertEquals(3, resources.size()); boolean userUser1 = false; boolean userUser2 = false; boolean userUser3 = false; for (ResourceAccess rsrcAccess : resources) { switch (rsrcAccess.getPrincipal()) { case "user.user1": userUser1 = true; assertEquals(2, rsrcAccess.getAssertions().size()); break; case "user.user2": userUser2 = true; assertEquals(2, rsrcAccess.getAssertions().size()); break; case "user.user3": userUser3 = true; assertEquals(1, rsrcAccess.getAssertions().size()); break; } } assertTrue(userUser1); assertTrue(userUser2); assertTrue(userUser3); jdbcConn.close(); }