DBService implements RolesProvider { Role updateTemplateRole(Role role, String domainName, List<TemplateParam> params) { String templateRoleName = role.getName().replace(TEMPLATE_DOMAIN_NAME, domainName); if (params != null) { for (TemplateParam param : params) { final String paramKey = "_" + param.getName() + "_"; templateRoleName = templateRoleName.replace(paramKey, param.getValue()); } } Role templateRole = new Role() .setName(templateRoleName) .setTrust(role.getTrust()) .setCertExpiryMins(role.getCertExpiryMins()) .setSelfServe(role.getSelfServe()) .setMemberExpiryDays(role.getMemberExpiryDays()) .setTokenExpiryMins(role.getTokenExpiryMins()) .setSignAlgorithm(role.getSignAlgorithm()) .setServiceExpiryDays(role.getServiceExpiryDays()) .setGroupExpiryDays(role.getGroupExpiryDays()) .setMemberReviewDays(role.getMemberReviewDays()) .setServiceReviewDays(role.getServiceReviewDays()) .setReviewEnabled(role.getReviewEnabled()) .setNotifyRoles(role.getNotifyRoles()) .setUserAuthorityFilter(role.getUserAuthorityFilter()) .setUserAuthorityExpiration(role.getUserAuthorityExpiration()); List<RoleMember> roleMembers = role.getRoleMembers(); List<RoleMember> newMembers = new ArrayList<>(); if (roleMembers != null && !roleMembers.isEmpty()) { for (RoleMember roleMember : roleMembers) { RoleMember newRoleMember = new RoleMember(); String memberName = roleMember.getMemberName().replace(TEMPLATE_DOMAIN_NAME, domainName); if (params != null) { for (TemplateParam param : params) { final String paramKey = "_" + param.getName() + "_"; memberName = memberName.replace(paramKey, param.getValue()); } } newRoleMember.setMemberName(memberName); newRoleMember.setExpiration(roleMember.getExpiration()); newMembers.add(newRoleMember); } } templateRole.setRoleMembers(newMembers); return templateRole; } DBService(ObjectStore store, AuditLogger auditLogger, ZMSConfig zmsConfig, AuditReferenceValidator auditReferenceValidator); DomainRoleMembers listOverdueReviewRoleMembers(String domainName); @Override List<Role> getRolesByDomain(String domain); ResourceAccessList getResourceAccessList(String principal, String action); AthenzDomain getAthenzDomain(final String domainName, boolean masterCopy); Quota getQuota(String domainName); void executePutRoleSystemMeta(ResourceContext ctx, final String domainName, final String roleName,
           RoleSystemMeta meta, final String attribute, final String auditRef, final String caller); void executePutGroupSystemMeta(ResourceContext ctx, final String domainName, final String groupName,
                                          GroupSystemMeta meta, final String attribute, final String auditRef); void executePutServiceIdentitySystemMeta(ResourceContext ctx, String domainName, String serviceName,
            ServiceIdentitySystemMeta meta, String attribute, String auditRef, String caller); void executePutRoleMeta(ResourceContext ctx, String domainName, String roleName, Role originalRole,
                                   RoleMeta meta, String auditRef, String caller); void executePutGroupMeta(ResourceContext ctx, final String domainName, final String groupName,
                                    GroupMeta meta, final String auditRef); Set<String> getPendingMembershipApproverRoles(int delayDays); Set<String> getPendingGroupMembershipApproverRoles(int delayDays); Map<String, DomainRoleMember> getRoleExpiryMembers(int delayDays); Map<String, DomainRoleMember> getRoleReviewMembers(int delayDays); Map<String, DomainGroupMember> getGroupExpiryMembers(int delayDays); void processExpiredPendingMembers(int pendingRoleMemberLifespan, final String monitorIdentity); void processExpiredPendingGroupMembers(int pendingGroupMemberLifespan, final String monitorIdentity); static int AUDIT_TYPE_ROLE; static int AUDIT_TYPE_POLICY; static int AUDIT_TYPE_SERVICE; static int AUDIT_TYPE_DOMAIN; static int AUDIT_TYPE_ENTITY; static int AUDIT_TYPE_TENANCY; static int AUDIT_TYPE_TEMPLATE; static int AUDIT_TYPE_GROUP; }
@Test public void testUpdateTemplateRoleNoMembers() { Role role = new Role().setName("_domain_:role.readers"); Role newRole = zms.dbService.updateTemplateRole(role, "athenz", null); assertEquals("athenz:role.readers", newRole.getName()); assertEquals(0, newRole.getRoleMembers().size()); }
@Test public void testUpdateTemplateRoleWithTrust() { Role role = new Role().setName("_domain_:role.readers").setTrust("trustdomain"); Role newRole = zms.dbService.updateTemplateRole(role, "athenz", null); assertEquals("athenz:role.readers", newRole.getName()); assertEquals("trustdomain", newRole.getTrust()); assertEquals(0, newRole.getRoleMembers().size()); }
@Test public void testUpdateTemplateRoleWithMembers() { Role role = new Role().setName("_domain_:role.readers"); List<RoleMember> members = new ArrayList<>(); members.add(new RoleMember().setMemberName("user.user1")); members.add(new RoleMember().setMemberName("user.user2")); members.add(new RoleMember().setMemberName("_domain_.user3")); role.setRoleMembers(members); Role newRole = zms.dbService.updateTemplateRole(role, "athenz", null); assertEquals("athenz:role.readers", newRole.getName()); List<RoleMember> newMembers = newRole.getRoleMembers(); assertEquals(3, newMembers.size()); List<String> checkList = new ArrayList<>(); checkList.add("user.user1"); checkList.add("user.user2"); checkList.add("athenz.user3"); checkRoleMember(checkList, newMembers); }
@Test public void testUpdateTemplateRoleWithMembersWithParams() { Role role = new Role().setName("_domain_:role._service___api_readers"); List<RoleMember> members = new ArrayList<>(); members.add(new RoleMember().setMemberName("user.user1")); members.add(new RoleMember().setMemberName("user._service_")); members.add(new RoleMember().setMemberName("_domain_.user3")); role.setRoleMembers(members); List<TemplateParam> params = new ArrayList<>(); params.add(new TemplateParam().setName("service").setValue("storage")); params.add(new TemplateParam().setName("api").setValue("java")); params.add(new TemplateParam().setName("name").setValue("notfound")); Role newRole = zms.dbService.updateTemplateRole(role, "athenz", params); assertEquals("athenz:role.storage_javareaders", newRole.getName()); List<RoleMember> newMembers = newRole.getRoleMembers(); assertEquals(3, newMembers.size()); List<String> checkList = new ArrayList<>(); checkList.add("user.user1"); checkList.add("user.storage"); checkList.add("athenz.user3"); checkRoleMember(checkList, newMembers); }