SafesService { public ResponseEntity<String> addUserToSafe(String token, SafeUser safeUser, UserDetails userDetails) { OIDCEntityResponse oidcEntityResponse = new OIDCEntityResponse(); log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to SDB"). put(LogMessage.MESSAGE, String.format ("Trying to add user to SDB folder ")). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); if(!ControllerUtil.areSafeUserInputsValid(safeUser)) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to SDB"). put(LogMessage.MESSAGE, String.format ("Invalid user inputs [%s]", safeUser.toString())). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid input values\"]}"); } String userName = safeUser.getUsername(); String path = safeUser.getPath(); String access = safeUser.getAccess(); userName = (userName !=null) ? userName.toLowerCase() : userName; access = (access != null) ? access.toLowerCase(): access; boolean isAuthorized = true; if (userDetails != null) { isAuthorized = safeUtils.canAddOrRemoveUser(userDetails, safeUser, "addUser"); } boolean canAddUser = ControllerUtil.canAddPermission(path, token); if(isAuthorized && canAddUser){ String folders[] = path.split("[/]+"); String policyPrefix =""; switch (access){ case TVaultConstants.READ_POLICY: policyPrefix = "r_"; break ; case TVaultConstants.WRITE_POLICY: policyPrefix = "w_" ;break; case TVaultConstants.DENY_POLICY: policyPrefix = "d_" ;break; case TVaultConstants.SUDO_POLICY: policyPrefix = "s_" ;break; } if(TVaultConstants.EMPTY.equals(policyPrefix)){ log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to SDB"). put(LogMessage.MESSAGE, String.format ("Incorrect access requested. Valid values are read,write,deny")). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.UNPROCESSABLE_ENTITY).body("{\"errors\":[\"Incorrect access requested. Valid values are read,write,deny \"]}"); } String policy = policyPrefix+folders[0].toLowerCase()+"_"+folders[1]; log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to SDB"). put(LogMessage.MESSAGE, String.format ("policy is [%s]", policy)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); String r_policy = "r_"; String w_policy = "w_"; String d_policy = "d_"; String s_policy = "s_"; if (folders.length > 0) { for (int index = 0; index < folders.length; index++) { if (index == folders.length -1 ) { r_policy += folders[index]; w_policy += folders[index]; d_policy += folders[index]; s_policy += folders[index]; } else { r_policy += folders[index] +"_"; w_policy += folders[index] +"_"; d_policy += folders[index] +"_"; s_policy += folders[index] +"_"; } } } log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to SDB"). put(LogMessage.MESSAGE, String.format ("Policies are, read - [%s], write - [%s], deny -[%s]", r_policy, w_policy, d_policy)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); List<String> policies = new ArrayList<>(); List<String> currentpolicies = new ArrayList<>(); Response userResponse = new Response(); if (TVaultConstants.USERPASS.equals(vaultAuthMethod)) { userResponse = reqProcessor.process("/auth/userpass/read", "{\"username\":\"" + userName + "\"}", token); } else if (TVaultConstants.LDAP.equals(vaultAuthMethod)) { userResponse = reqProcessor.process("/auth/ldap/users", "{\"username\":\"" + userName + "\"}", token); } else if (TVaultConstants.OIDC.equals(vaultAuthMethod)){ ResponseEntity<OIDCEntityResponse> responseEntity = oidcUtil.oidcFetchEntityDetails(token, userName, userDetails); if (!responseEntity.getStatusCode().equals(HttpStatus.OK)) { if (responseEntity.getStatusCode().equals(HttpStatus.FORBIDDEN)) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder() .put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()) .put(LogMessage.ACTION, "Add User to SDB") .put(LogMessage.MESSAGE, String.format("Trying to fetch OIDC user policies, failed")) .put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()) .build())); return ResponseEntity.status(HttpStatus.FORBIDDEN) .body("{\"messages\":[\"User configuration failed. Please try again.\"]}"); } return ResponseEntity.status(HttpStatus.NOT_FOUND) .body("{\"messages\":[\"User configuration failed. Invalid user\"]}"); } oidcEntityResponse.setEntityName(responseEntity.getBody().getEntityName()); oidcEntityResponse.setPolicies(responseEntity.getBody().getPolicies()); userResponse.setResponse(oidcEntityResponse.getPolicies().toString()); userResponse.setHttpstatus(responseEntity.getStatusCode()); } log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to SDB"). put(LogMessage.MESSAGE, String.format ("userResponse status is [%s]", userResponse.getHttpstatus())). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); String responseJson=""; String groups=""; if(HttpStatus.OK.equals(userResponse.getHttpstatus())){ responseJson = userResponse.getResponse(); try { ObjectMapper objMapper = new ObjectMapper(); if (TVaultConstants.OIDC.equals(vaultAuthMethod)) { currentpolicies.addAll(oidcEntityResponse.getPolicies()); } else { currentpolicies = ControllerUtil.getPoliciesAsListFromJson(objMapper, responseJson); if (TVaultConstants.LDAP.equals(vaultAuthMethod)) { groups = objMapper.readTree(responseJson).get("data").get("groups").asText(); } } } catch (IOException e) { log.error(e); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to SDB"). put(LogMessage.MESSAGE, String.format ("Exception while creating currentpolicies or groups")). put(LogMessage.STACKTRACE, Arrays.toString(e.getStackTrace())). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } policies.addAll(currentpolicies); policies.remove(r_policy); policies.remove(w_policy); policies.remove(d_policy); policies.add(policy); }else{ policies.add(policy); } String policiesString = StringUtils.join(policies, ","); String currentpoliciesString = StringUtils.join(currentpolicies, ","); log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to SDB"). put(LogMessage.MESSAGE, String.format ("policies [%s] before calling configureUserpassUser/configureLDAPUser", policies)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); Response ldapConfigresponse = new Response(); if (TVaultConstants.USERPASS.equals(vaultAuthMethod)) { ldapConfigresponse = ControllerUtil.configureUserpassUser(userName,policiesString,token); } else if (TVaultConstants.LDAP.equals(vaultAuthMethod)){ ldapConfigresponse = ControllerUtil.configureLDAPUser(userName,policiesString,groups,token); }else if (TVaultConstants.OIDC.equals(vaultAuthMethod)){ try { ldapConfigresponse = oidcUtil.updateOIDCEntity(policies, oidcEntityResponse.getEntityName()); oidcUtil.renewUserToken(userDetails.getClientToken()); }catch (Exception e) { log.error(e); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)). put(LogMessage.ACTION, "Add User to SDB"). put(LogMessage.MESSAGE, String.format ("Exception while adding or updating the identity ")). put(LogMessage.STACKTRACE, Arrays.toString(e.getStackTrace())). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)). build())); } } if(ldapConfigresponse.getHttpstatus().equals(HttpStatus.NO_CONTENT)){ Map<String,String> params = new HashMap<String,String>(); params.put("type", "users"); params.put("name",userName); params.put("path",path); params.put("access",access); log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to SDB"). put(LogMessage.MESSAGE, String.format ("Trying to update metadata [%s]", params.toString())). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); Response metadataResponse = ControllerUtil.updateMetadata(params,token); if(metadataResponse != null && HttpStatus.NO_CONTENT.equals(metadataResponse.getHttpstatus())){ return ResponseEntity.status(HttpStatus.OK).body("{\"messages\":[\"User is successfully associated \"]}"); }else{ String safeType = ControllerUtil.getSafeType(path); String safeName = ControllerUtil.getSafeName(path); List<String> safeNames = ControllerUtil.getAllExistingSafeNames(safeType, token); String newPath = path; if (safeNames != null ) { for (String existingSafeName: safeNames) { if (existingSafeName.equalsIgnoreCase(safeName)) { newPath = safeType + "/" + existingSafeName; break; } } } params.put("path",newPath); metadataResponse = ControllerUtil.updateMetadata(params,token); if (metadataResponse != null && HttpStatus.NO_CONTENT.equals(metadataResponse.getHttpstatus())) { return ResponseEntity.status(HttpStatus.OK).body("{\"messages\":[\"User is successfully associated \"]}"); } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to SDB"). put(LogMessage.MESSAGE, "User configuration failed. Trying to revert..."). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); if (TVaultConstants.USERPASS.equals(vaultAuthMethod)) { ldapConfigresponse = ControllerUtil.configureUserpassUser(userName,currentpoliciesString,token); } else if (TVaultConstants.LDAP.equals(vaultAuthMethod)){ ldapConfigresponse = ControllerUtil.configureLDAPUser(userName,currentpoliciesString,groups,token); }else if (TVaultConstants.OIDC.equals(vaultAuthMethod)){ try { ldapConfigresponse = oidcUtil.updateOIDCEntity(currentpolicies, oidcEntityResponse.getEntityName()); oidcUtil.renewUserToken(userDetails.getClientToken()); } catch (Exception e) { log.error(e); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder() .put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)) .put(LogMessage.ACTION, "Add User to SDB") .put(LogMessage.MESSAGE, String.format("Exception while adding or updating the identity ")) .put(LogMessage.STACKTRACE, Arrays.toString(e.getStackTrace())) .put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)) .build())); } } if(ldapConfigresponse.getHttpstatus().equals(HttpStatus.NO_CONTENT)){ log.debug("Reverting user policy uupdate"); log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to SDB"). put(LogMessage.MESSAGE, "User configuration failed. Trying to revert...Passed"). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"messages\":[\"User configuration failed.Please try again\"]}"); }else{ log.debug("Reverting user policy update failed"); log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to SDB"). put(LogMessage.MESSAGE, "User configuration failed. Trying to revert...failed"). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"messages\":[\"User configuration failed.Contact Admin \"]}"); } } } }else{ log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to SDB"). put(LogMessage.MESSAGE, String.format ("Trying to configureUserpassUser/configureLDAPUser failed")). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"messages\":[\"User configuration failed.Try Again\"]}"); } }else{ return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid 'path' specified\"]}"); } }  ResponseEntity<String> getFolders( String token, String path); ResponseEntity<String> getInfo(String token, String path); ResponseEntity<String> createfolder(String token, String path); ResponseEntity<String> createSafe(String token, Safe safe); ResponseEntity<String> getSafe(String token, String path); ResponseEntity<String> deleteSafe(String token, Safe safe, UserDetails userDetails); ResponseEntity<String> updateSafe(String token, Safe safe); ResponseEntity<String> addUserToSafe(String token, SafeUser safeUser, UserDetails userDetails); ResponseEntity<String> addGroupToSafe(String token, SafeGroup safeGroup, UserDetails userDetails); ResponseEntity<String> removeUserFromSafe(String token, SafeUser safeUser, UserDetails userDetails); ResponseEntity<String> removeGroupFromSafe(String token, SafeGroup safeGroup, UserDetails userDetails); ResponseEntity<String> addAwsRoleToSafe(String token, AWSRole awsRole); ResponseEntity<String> removeAWSRoleFromSafe(String token, AWSRole awsRole, boolean detachOnly, UserDetails userDetails); ResponseEntity<String> deletefolder(String token, String path, UserDetails userDetails); ResponseEntity<String> getFoldersRecursively(String token, String path); ResponseEntity<String> createNestedfolder(String token, String path, UserDetails userDetails); ResponseEntity<String> associateApproletoSDB(String token, SafeAppRoleAccess safeAppRoleAccess); ResponseEntity<String> removeApproleFromSafe(String token, String jsonstr);  }
@Test public void test_addUserToSafe_failure_400() { String token = "5PDrOhsy4ig8L3EpsJZSLAMg"; String path = "shared/mysafe01"; SafeUser safeUser = new SafeUser(path, "testuser1","write"); UserDetails userDetails = new UserDetails(); userDetails.setUsername("testuser1"); ResponseEntity<String> responseEntityExpected = ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid input values\"]}"); when(ControllerUtil.areSafeUserInputsValid(safeUser)).thenReturn(false); when(safeUtils.canAddOrRemoveUser(userDetails, safeUser, "addUser")).thenReturn(true); ResponseEntity<String> responseEntity = safesService.addUserToSafe(token, safeUser, null); assertEquals(HttpStatus.BAD_REQUEST, responseEntity.getStatusCode()); assertEquals(responseEntityExpected, responseEntity); }