SafesService { public ResponseEntity<String> removeUserFromSafe(String token, SafeUser safeUser, UserDetails userDetails) { OIDCEntityResponse oidcEntityResponse = new OIDCEntityResponse(); String jsonstr = JSONUtil.getJSON(safeUser); log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove User from SDB"). put(LogMessage.MESSAGE, String.format ("Trying to remove user from SDB [%s]", jsonstr)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); ObjectMapper objMapper = new ObjectMapper(); Map<String,String> requestMap = null; try { requestMap = objMapper.readValue(jsonstr, new TypeReference<Map<String,String>>() {}); } catch (IOException e) { log.error(e); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "removeUserFromSafe"). put(LogMessage.MESSAGE, "Exception occurred while creating requestMap from input jsonstr"). put(LogMessage.RESPONSE,e.getMessage()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } String userName = requestMap.get("username"); userName = (userName !=null) ? userName.toLowerCase() : userName; if (StringUtils.isEmpty(userName)) { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"username can't be empty\"]}"); } String path = requestMap.get("path"); boolean canDeletePermission = ControllerUtil.canAddPermission(path, token); if(ControllerUtil.isValidSafePath(path) && canDeletePermission){ String folders[] = path.split("[/]+"); String r_policy = "r_"; String w_policy = "w_"; String d_policy = "d_"; String s_policy = "s_"; if (folders.length > 0) { for (int index = 0; index < folders.length; index++) { if (index == folders.length -1 ) { r_policy += folders[index]; w_policy += folders[index]; d_policy += folders[index]; s_policy += folders[index]; } else { r_policy += folders[index] +"_"; w_policy += folders[index] +"_"; d_policy += folders[index] +"_"; s_policy += folders[index] +"_"; } } } Response userResponse = new Response(); if (TVaultConstants.USERPASS.equals(vaultAuthMethod)) { userResponse = reqProcessor.process("/auth/userpass/read", "{\"username\":\"" + userName + "\"}", token); } else if (TVaultConstants.LDAP.equals(vaultAuthMethod)) { userResponse = reqProcessor.process("/auth/ldap/users", "{\"username\":\"" + userName + "\"}", token); } else if (TVaultConstants.OIDC.equals(vaultAuthMethod)){ ResponseEntity<OIDCEntityResponse> responseEntity = oidcUtil.oidcFetchEntityDetails(token, userName, userDetails); if (!responseEntity.getStatusCode().equals(HttpStatus.OK)) { if (responseEntity.getStatusCode().equals(HttpStatus.FORBIDDEN)) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder() .put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()) .put(LogMessage.ACTION, "removeUserFromSafe") .put(LogMessage.MESSAGE, String.format("Trying to fetch OIDC user policies, failed")) .put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()) .build())); Map<String, String> params = new HashMap<String, String>(); params.put("type", "users"); params.put("name", userName); params.put("path", path); params.put("access", TVaultConstants.DELETE); Response metadataResponse = ControllerUtil.updateMetadata(params, token); if (HttpStatus.NO_CONTENT.equals(metadataResponse.getHttpstatus())) { log.debug( JSONUtil.getJSON(ImmutableMap.<String, String>builder() .put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()) .put(LogMessage.ACTION, "removeUserFromSafe") .put(LogMessage.MESSAGE, "Successfully removed of dangling user associations") .put(LogMessage.STATUS, metadataResponse.getHttpstatus().toString()) .put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()) .build())); } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder() .put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()) .put(LogMessage.ACTION, "removeUserFromSafe") .put(LogMessage.MESSAGE, "Error occurred while removing of dangling user associations") .put(LogMessage.STATUS, metadataResponse.getHttpstatus().toString()) .put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()) .build())); return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR) .body("{\"messages\":[\"User configuration failed. Please try again\"]}"); } } return ResponseEntity.status(HttpStatus.NOT_FOUND) .body("{\"messages\":[\"User configuration failed. Invalid user\"]}"); } oidcEntityResponse.setEntityName(responseEntity.getBody().getEntityName()); oidcEntityResponse.setPolicies(responseEntity.getBody().getPolicies()); userResponse.setResponse(oidcEntityResponse.getPolicies().toString()); userResponse.setHttpstatus(responseEntity.getStatusCode()); } String responseJson=""; String groups=""; List<String> policies = new ArrayList<>(); List<String> currentpolicies = new ArrayList<>(); if(HttpStatus.OK.equals(userResponse.getHttpstatus())){ responseJson = userResponse.getResponse(); try { if (TVaultConstants.OIDC.equals(vaultAuthMethod)) { currentpolicies.addAll(oidcEntityResponse.getPolicies()); } else { currentpolicies = ControllerUtil.getPoliciesAsListFromJson(objMapper, responseJson); if (TVaultConstants.LDAP.equals(vaultAuthMethod)) { groups = objMapper.readTree(responseJson).get("data").get("groups").asText(); } } } catch (IOException e) { log.error(e); } policies.addAll(currentpolicies); policies.remove(r_policy); policies.remove(w_policy); policies.remove(d_policy); String policiesString = StringUtils.join(policies, ","); String currentpoliciesString = StringUtils.join(currentpolicies, ","); Response ldapConfigresponse = new Response(); if (TVaultConstants.USERPASS.equals(vaultAuthMethod)) { ldapConfigresponse = ControllerUtil.configureUserpassUser(userName, policiesString, token); } else if (TVaultConstants.LDAP.equals(vaultAuthMethod)) { ldapConfigresponse = ControllerUtil.configureLDAPUser(userName, policiesString, groups, token); } else if (TVaultConstants.OIDC.equals(vaultAuthMethod)){ try { ldapConfigresponse = oidcUtil.updateOIDCEntity(policies, oidcEntityResponse.getEntityName()); oidcUtil.renewUserToken(userDetails.getClientToken()); } catch (Exception e) { log.error(e); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder() .put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)) .put(LogMessage.ACTION, "Remove User to SDB") .put(LogMessage.MESSAGE, String.format("Exception while updating the identity")) .put(LogMessage.STACKTRACE, Arrays.toString(e.getStackTrace())) .put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)) .build())); } } if(ldapConfigresponse.getHttpstatus().equals(HttpStatus.NO_CONTENT)){ Map<String,String> params = new HashMap<String,String>(); params.put("type", "users"); params.put("name",userName); params.put("path",path); params.put("access",TVaultConstants.DELETE); Response metadataResponse = ControllerUtil.updateMetadata(params,token); if(metadataResponse != null && HttpStatus.NO_CONTENT.equals(metadataResponse.getHttpstatus())){ return ResponseEntity.status(HttpStatus.OK).body("{\"Message\":\"User association is removed \"}"); }else{ String safeType = ControllerUtil.getSafeType(path); String safeName = ControllerUtil.getSafeName(path); List<String> safeNames = ControllerUtil.getAllExistingSafeNames(safeType, token); String newPath = path; if (safeNames != null ) { for (String existingSafeName: safeNames) { if (existingSafeName.equalsIgnoreCase(safeName)) { newPath = safeType + "/" + existingSafeName; break; } } } params.put("path",newPath); metadataResponse = ControllerUtil.updateMetadata(params,token); if(metadataResponse != null && HttpStatus.NO_CONTENT.equals(metadataResponse.getHttpstatus())) { return ResponseEntity.status(HttpStatus.OK).body("{\"Message\":\"User association is removed \"}"); } else { log.debug("Meta data update failed"); log.debug((metadataResponse!=null)?metadataResponse.getResponse():TVaultConstants.EMPTY); if (TVaultConstants.USERPASS.equals(vaultAuthMethod)) { ldapConfigresponse = ControllerUtil.configureUserpassUser(userName, currentpoliciesString, token); } else if (TVaultConstants.LDAP.equals(vaultAuthMethod)) { ldapConfigresponse = ControllerUtil.configureLDAPUser(userName, currentpoliciesString, groups, token); } else if (TVaultConstants.OIDC.equals(vaultAuthMethod)){ try { ldapConfigresponse = oidcUtil.updateOIDCEntity(currentpolicies, oidcEntityResponse.getEntityName()); oidcUtil.renewUserToken(userDetails.getClientToken()); } catch (Exception e2) { log.error(e2); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder() .put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)) .put(LogMessage.ACTION, "Remove User to SDB") .put(LogMessage.MESSAGE, String.format("Exception while updating the identity")) .put(LogMessage.STACKTRACE, Arrays.toString(e2.getStackTrace())) .put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)) .build())); } } if(ldapConfigresponse.getHttpstatus().equals(HttpStatus.NO_CONTENT)){ log.debug("Reverting user policy uupdate"); return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"messages\":[\"User configuration failed.Please try again\"]}"); }else{ log.debug("Reverting user policy update failed"); return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"messages\":[\"User configuration failed.Contact Admin \"]}"); } } } }else{ return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"messages\":[\"User configuration failed.Try Again\"]}"); } }else{ Map<String,String> params = new HashMap<String,String>(); params.put("type", "users"); params.put("name",userName); params.put("path",path); params.put("access",TVaultConstants.DELETE); Response metadataResponse = ControllerUtil.updateMetadata(params,token); if(HttpStatus.NO_CONTENT.equals(metadataResponse.getHttpstatus())){ log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "removeUserFromSafe"). put(LogMessage.MESSAGE, "Successfully removed of dangling user associations"). put(LogMessage.STATUS, metadataResponse.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); }else{ log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "removeUserFromSafe"). put(LogMessage.MESSAGE, "Error occurred while removing of dangling user associations"). put(LogMessage.STATUS, metadataResponse.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"messages\":[\"User configuration failed. Please try again\"]}"); } }else{ return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid 'path' specified\"]}"); } }  ResponseEntity<String> getFolders( String token, String path); ResponseEntity<String> getInfo(String token, String path); ResponseEntity<String> createfolder(String token, String path); ResponseEntity<String> createSafe(String token, Safe safe); ResponseEntity<String> getSafe(String token, String path); ResponseEntity<String> deleteSafe(String token, Safe safe, UserDetails userDetails); ResponseEntity<String> updateSafe(String token, Safe safe); ResponseEntity<String> addUserToSafe(String token, SafeUser safeUser, UserDetails userDetails); ResponseEntity<String> addGroupToSafe(String token, SafeGroup safeGroup, UserDetails userDetails); ResponseEntity<String> removeUserFromSafe(String token, SafeUser safeUser, UserDetails userDetails); ResponseEntity<String> removeGroupFromSafe(String token, SafeGroup safeGroup, UserDetails userDetails); ResponseEntity<String> addAwsRoleToSafe(String token, AWSRole awsRole); ResponseEntity<String> removeAWSRoleFromSafe(String token, AWSRole awsRole, boolean detachOnly, UserDetails userDetails); ResponseEntity<String> deletefolder(String token, String path, UserDetails userDetails); ResponseEntity<String> getFoldersRecursively(String token, String path); ResponseEntity<String> createNestedfolder(String token, String path, UserDetails userDetails); ResponseEntity<String> associateApproletoSDB(String token, SafeAppRoleAccess safeAppRoleAccess); ResponseEntity<String> removeApproleFromSafe(String token, String jsonstr);  }
@Test public void test_removeUserFromSafe_failure_400() { String token = "5PDrOhsy4ig8L3EpsJZSLAMg"; String path = "shared/mysafe01"; SafeUser safeUser = new SafeUser(path, "testuser1","write"); String jsonStr = "{ \"path\": \"shared/mysafe01\", \"username\": \"testuser1\", \"access\": \"write\"}"; ResponseEntity<String> responseEntityExpected = ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid 'path' specified\"]}"); when(JSONUtil.getJSON(safeUser)).thenReturn(jsonStr); when(ControllerUtil.isValidSafePath(path)).thenReturn(false); ResponseEntity<String> responseEntity = safesService.removeUserFromSafe(token, safeUser, getMockUser(true)); assertEquals(HttpStatus.BAD_REQUEST, responseEntity.getStatusCode()); assertEquals(responseEntityExpected, responseEntity); }