DBService implements RolesProvider { void executePutTenantRoles(ResourceContext ctx, String provSvcDomain, String provSvcName, String tenantDomain, String resourceGroup, List<TenantRoleAction> roles, String auditRef, String caller) { for (int retryCount = defaultRetryCount; ; retryCount--) { try (ObjectStoreConnection con = store.getConnection(false, true)) { checkDomainAuditEnabled(con, provSvcDomain, auditRef, caller, getPrincipalName(ctx), AUDIT_TYPE_TENANCY); String trustedRolePrefix = ZMSUtils.getTrustedResourceGroupRolePrefix(provSvcDomain, provSvcName, tenantDomain, resourceGroup); StringBuilder auditDetails = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); auditDetails.append("{\"put-tenant-roles\": ["); boolean firstEntry = true; for (TenantRoleAction ra : roles) { String tenantRole = ra.getRole(); String tenantAction = ra.getAction(); String trustedRole = trustedRolePrefix + tenantRole; String trustedName = trustedRole.substring((provSvcDomain + AuthorityConsts.ROLE_SEP).length()); Role role = new Role().setName(trustedRole).setTrust(tenantDomain); if (LOG.isInfoEnabled()) { LOG.info(caller + ": add trusted Role to domain " + provSvcDomain + ": " + trustedRole + " -> " + role); } Role originalRole = getRole(con, provSvcDomain, trustedName, false, false, false); firstEntry = auditLogSeparator(auditDetails, firstEntry); auditDetails.append("{\"role\": "); if (!processRole(con, originalRole, provSvcDomain, trustedName, role, getPrincipalName(ctx), auditRef, false, auditDetails)) { con.rollbackChanges(); throw ZMSUtils.internalServerError("unable to put role: " + trustedRole, caller); } String policyResourceName = ZMSUtils.policyResourceName(provSvcDomain, trustedName); final String resourceName = provSvcDomain + ":service." + ZMSUtils.getTenantResourceGroupRolePrefix(provSvcName, tenantDomain, resourceGroup) + '*'; List<Assertion> assertions = Collections.singletonList( new Assertion().setRole(trustedRole) .setResource(resourceName) .setAction(tenantAction)); Policy policy = new Policy().setName(policyResourceName).setAssertions(assertions); if (LOG.isInfoEnabled()) { LOG.info(caller + ": add trust policy to domain " + provSvcDomain + ": " + trustedRole + " -> " + policy); } Policy originalPolicy = getPolicy(con, provSvcDomain, trustedName); auditDetails.append(", \"policy\": "); if (!processPolicy(con, originalPolicy, provSvcDomain, trustedName, policy, false, auditDetails)) { con.rollbackChanges(); throw ZMSUtils.internalServerError("unable to put policy: " + policy.getName(), caller); } auditDetails.append('}'); } saveChanges(con, provSvcDomain); auditLogRequest(ctx, provSvcDomain, auditRef, caller, ZMSConsts.HTTP_PUT, tenantDomain, auditDetails.toString()); return; } catch (ResourceException ex) { if (!shouldRetryOperation(ex, retryCount)) { throw ex; } } } } DBService(ObjectStore store, AuditLogger auditLogger, ZMSConfig zmsConfig, AuditReferenceValidator auditReferenceValidator); DomainRoleMembers listOverdueReviewRoleMembers(String domainName); @Override List<Role> getRolesByDomain(String domain); ResourceAccessList getResourceAccessList(String principal, String action); AthenzDomain getAthenzDomain(final String domainName, boolean masterCopy); Quota getQuota(String domainName); void executePutRoleSystemMeta(ResourceContext ctx, final String domainName, final String roleName,
           RoleSystemMeta meta, final String attribute, final String auditRef, final String caller); void executePutGroupSystemMeta(ResourceContext ctx, final String domainName, final String groupName,
                                          GroupSystemMeta meta, final String attribute, final String auditRef); void executePutServiceIdentitySystemMeta(ResourceContext ctx, String domainName, String serviceName,
            ServiceIdentitySystemMeta meta, String attribute, String auditRef, String caller); void executePutRoleMeta(ResourceContext ctx, String domainName, String roleName, Role originalRole,
                                   RoleMeta meta, String auditRef, String caller); void executePutGroupMeta(ResourceContext ctx, final String domainName, final String groupName,
                                    GroupMeta meta, final String auditRef); Set<String> getPendingMembershipApproverRoles(int delayDays); Set<String> getPendingGroupMembershipApproverRoles(int delayDays); Map<String, DomainRoleMember> getRoleExpiryMembers(int delayDays); Map<String, DomainRoleMember> getRoleReviewMembers(int delayDays); Map<String, DomainGroupMember> getGroupExpiryMembers(int delayDays); void processExpiredPendingMembers(int pendingRoleMemberLifespan, final String monitorIdentity); void processExpiredPendingGroupMembers(int pendingGroupMemberLifespan, final String monitorIdentity); static int AUDIT_TYPE_ROLE; static int AUDIT_TYPE_POLICY; static int AUDIT_TYPE_SERVICE; static int AUDIT_TYPE_DOMAIN; static int AUDIT_TYPE_ENTITY; static int AUDIT_TYPE_TENANCY; static int AUDIT_TYPE_TEMPLATE; static int AUDIT_TYPE_GROUP; }
@Test public void testExecutePutTenantRoles() { String tenantDomain = "tenantadminpolicy"; String providerDomain = "coretech"; String providerService = "storage"; TopLevelDomain dom1 = createTopLevelDomainObject(tenantDomain, "Test Tenant Domain1", "testOrg", adminUser); zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); TopLevelDomain domProv = createTopLevelDomainObject(providerDomain, "Test Provider Domain1", "testOrg", adminUser); zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, domProv); ServiceIdentity service = createServiceObject( providerDomain, providerService, "http: "/usr/bin/java", "root", "users", "localhost"); zms.putServiceIdentity(mockDomRsrcCtx, providerDomain, providerService, auditRef, service); Tenancy tenant = new Tenancy(); tenant.setDomain(tenantDomain); tenant.setService("coretech.storage"); zms.putTenancy(mockDomRsrcCtx, tenantDomain, "coretech.storage", auditRef, tenant); List<TenantRoleAction> roleActions = new ArrayList<>(); for (Struct.Field f : TABLE_PROVIDER_ROLE_ACTIONS) { roleActions.add(new TenantRoleAction().setRole(f.name()).setAction( (String) f.value())); } zms.dbService.executePutTenantRoles(mockDomRsrcCtx, providerDomain, providerService, tenantDomain, null, roleActions, auditRef, "putTenantRoles"); zms.deleteTenancy(mockDomRsrcCtx, tenantDomain, "coretech.storage", auditRef); zms.deleteTopLevelDomain(mockDomRsrcCtx, tenantDomain, auditRef); zms.deleteTopLevelDomain(mockDomRsrcCtx, providerDomain, auditRef); }