ZMSImpl implements Authorizer, KeyStore, ZMSHandler { public DomainDataCheck getDomainDataCheck(ResourceContext ctx, String domainName) { final String caller = ctx.getApiName(); logPrincipal(ctx); validateRequest(ctx.request(), caller); validate(domainName, TYPE_DOMAIN_NAME, caller); domainName = domainName.toLowerCase(); setRequestDomain(ctx, domainName); if (LOG.isDebugEnabled()) { LOG.debug("getDomainDataCheck: domain=" + domainName); } AthenzDomain domain = getAthenzDomain(domainName, false); if (domain == null) { throw ZMSUtils.notFoundError("getDomainDataCheck: Domain not found: '" + domainName + "'", caller); } Set<String> roleSet = new HashSet<>(); Set<String> trustRoleSet = new HashSet<>(); Map<String, Set<String>> trustRoleMap = new HashMap<>(); for (Role role : domain.getRoles()) { if (LOG.isDebugEnabled()) { LOG.debug("getDomainDataCheck: processing role - " + role.getName()); } roleSet.add(role.getName()); String roleName = ZMSUtils.removeDomainPrefix(role.getName(), domainName, ROLE_PREFIX); String trustDomain = role.getTrust(); if (trustDomain != null) { if (LOG.isDebugEnabled()) { LOG.debug("trust role for domain: " + trustDomain); } trustRoleSet.add(trustDomain); Set<String> tset = trustRoleMap.computeIfAbsent(trustDomain, k -> new HashSet<>()); tset.add(roleName); } } int assertionCount = 0; int roleWildcardCount = 0; Set<String> usedRoleSet = new HashSet<>(); Set<String> providerSet = new HashSet<>(); Map<String, Set<String>> svcRoleMap = new HashMap<>(); List<DanglingPolicy> danglingPolicies = new ArrayList<>(); List<Policy> policies = domain.getPolicies(); for (Policy policy : policies) { String pname = ZMSUtils.removeDomainPrefix(policy.getName(), domainName, POLICY_PREFIX); if (LOG.isDebugEnabled()) { LOG.debug("getDomainDataCheck: processing policy=" + pname + " in domain=" + domainName); } List<Assertion> assertions = policy.getAssertions(); if (assertions == null) { continue; } for (Assertion assertion : assertions) { assertionCount++; if (ZMSConsts.ACTION_ASSUME_ROLE.equalsIgnoreCase(assertion.getAction())) { int index = pname.indexOf("tenancy."); if (index == -1) { continue; } int lindex = pname.lastIndexOf('.'); if (lindex == -1) { continue; } String provSvcDomain = pname.substring(index + "tenancy.".length(), lindex); providerSet.add(provSvcDomain); String rsrc = assertion.getResource(); Set<String> rset = svcRoleMap.computeIfAbsent(provSvcDomain, k -> new HashSet<>()); rset.add(rsrc); } String roleName = assertion.getRole(); if (roleName.lastIndexOf('*') != -1) { roleWildcardCount++; String rolePattern = StringUtils.patternFromGlob(roleName); boolean wildCardMatch = false; for (String role: roleSet) { if (role.matches(rolePattern)) { wildCardMatch = true; break; } } if (!wildCardMatch) { DanglingPolicy dp = new DanglingPolicy(); dp.setRoleName(ZMSUtils.removeDomainPrefix(roleName, domainName, ROLE_PREFIX)); dp.setPolicyName(ZMSUtils.removeDomainPrefix(pname, domainName, POLICY_PREFIX)); danglingPolicies.add(dp); } } else if (roleSet.contains(roleName)) { usedRoleSet.add(roleName); } else { DanglingPolicy dp = new DanglingPolicy(); dp.setRoleName(ZMSUtils.removeDomainPrefix(roleName, domainName, ROLE_PREFIX)); dp.setPolicyName(ZMSUtils.removeDomainPrefix(pname, domainName, POLICY_PREFIX)); danglingPolicies.add(dp); } } } DomainDataCheck ddc = new DomainDataCheck(); ddc.setPolicyCount(policies.size()); ddc.setAssertionCount(assertionCount); ddc.setRoleWildCardCount(roleWildcardCount); if (!danglingPolicies.isEmpty()) { ddc.setDanglingPolicies(danglingPolicies); } if (roleSet.size() != usedRoleSet.size()) { roleSet.removeAll(usedRoleSet); List<String> danglingRoleList = new ArrayList<>(); for (String roleName : roleSet) { danglingRoleList.add(ZMSUtils.removeDomainPrefix(roleName, domainName, ROLE_PREFIX)); } ddc.setDanglingRoles(danglingRoleList); } if (LOG.isDebugEnabled()) { LOG.debug("getDomainDataCheck: domain=" + domainName + " policy-count=" + policies.size() + " assertion-count=" + assertionCount + " wildcard-count==" + roleWildcardCount + " dangling-policies=" + danglingPolicies.size() + " dangling-roles=" + roleSet.size()); } List<String> provsWithoutTrust = new ArrayList<>(); for (String provSvc : providerSet) { if (LOG.isDebugEnabled()) { LOG.debug("getDomainDataCheck: domain=" + domainName + " provider-service=" + provSvc); } int idx = provSvc.indexOf(".res_group."); String provSvcDomain; if (idx == -1) { provSvcDomain = providerServiceDomain(provSvc); } else { provSvcDomain = providerServiceDomain(provSvc.substring(0, idx)); } AthenzDomain providerDomain = getAthenzDomain(provSvcDomain, true); Set<String> rset = svcRoleMap.get(provSvc); if (rset == null || rset.isEmpty() || providerDomain == null) { provsWithoutTrust.add(provSvc); continue; } int foundTrust = 0; for (Role role : providerDomain.getRoles()) { String trustDomain = role.getTrust(); if (trustDomain != null) { if (domainName.equals(trustDomain)) { if (rset.contains(role.getName())) { foundTrust++; } } } } if (foundTrust != rset.size()) { provsWithoutTrust.add(provSvc); } } if (!provsWithoutTrust.isEmpty()) { ddc.setProvidersWithoutTrust(provsWithoutTrust); } List<String> tenantsWithoutProv = new ArrayList<>(); Map<String, AthenzDomain> tenantDomMap = new HashMap<>(); for (String trustRole: trustRoleSet) { if (LOG.isDebugEnabled()) { LOG.debug("getDomainDataCheck: processing trust role: " + trustRole); } AthenzDomain tenantDomain = tenantDomMap.get(trustRole); if (tenantDomain == null) { tenantDomain = getAthenzDomain(trustRole, true); if (tenantDomain == null) { tenantsWithoutProv.add(trustRole); continue; } else { tenantDomMap.put(trustRole, tenantDomain); } } Set<String> tset = trustRoleMap.get(trustRole); if (tset == null || tset.isEmpty()) { tenantsWithoutProv.add(trustRole); continue; } int foundProviderCnt = 0; for (Policy policy : tenantDomain.getPolicies()) { List<Assertion> assertions = policy.getAssertions(); if (assertions == null) { continue; } for (Assertion assertion : assertions) { if (ZMSConsts.ACTION_ASSUME_ROLE.equalsIgnoreCase(assertion.getAction())) { String rsrc = assertion.getResource(); if (roleSet.contains(rsrc)) { foundProviderCnt++; } } } } if (foundProviderCnt < tset.size()) { tenantsWithoutProv.add(trustRole); } } if (!tenantsWithoutProv.isEmpty()) { ddc.setTenantsWithoutAssumeRole(tenantsWithoutProv); } return ddc; } ZMSImpl(); Schema schema(); DomainList getDomainList(ResourceContext ctx, Integer limit, String skip, String prefix,
            Integer depth, String account, Integer productId, String roleMember, String roleName,
            String modifiedSince); Domain getDomain(ResourceContext ctx, String domainName); Domain postTopLevelDomain(ResourceContext ctx, String auditRef, TopLevelDomain detail); void deleteTopLevelDomain(ResourceContext ctx, String domainName, String auditRef); Domain postUserDomain(ResourceContext ctx, String name, String auditRef, UserDomain detail); Domain postSubDomain(ResourceContext ctx, String parent, String auditRef, SubDomain detail); void deleteSubDomain(ResourceContext ctx, String parent, String name, String auditRef); void deleteUserDomain(ResourceContext ctx, String name, String auditRef); UserList getUserList(ResourceContext ctx); @Override void deleteDomainRoleMember(ResourceContext ctx, String domainName, String memberName, String auditRef); @Override void deleteUser(ResourceContext ctx, String name, String auditRef); @Override void putDomainMeta(ResourceContext ctx, String domainName, String auditRef,
            DomainMeta meta); @Override void putDomainSystemMeta(ResourceContext ctx, String domainName, String attribute,
            String auditRef, DomainMeta meta); DomainTemplateList getDomainTemplateList(ResourceContext ctx, String domainName); @Override void putDomainTemplate(ResourceContext ctx, String domainName, String auditRef,
            DomainTemplate domainTemplate); @Override void putDomainTemplateExt(ResourceContext ctx, String domainName,
            String templateName, String auditRef, DomainTemplate domainTemplate); void deleteDomainTemplate(ResourceContext ctx, String domainName, String templateName, String auditRef); boolean access(String action, String resource, Principal principal, String trustDomain); Access getAccessExt(ResourceContext ctx, String action, String resource,
            String trustDomain, String checkPrincipal); Access getAccess(ResourceContext ctx, String action, String resource,
            String trustDomain, String checkPrincipal); @Override void putEntity(ResourceContext ctx, String domainName, String entityName, String auditRef, Entity resource); @Override EntityList getEntityList(ResourceContext ctx, String domainName); Entity getEntity(ResourceContext ctx, String domainName, String entityName); void deleteEntity(ResourceContext ctx, String domainName, String entityName, String auditRef); ServerTemplateList getServerTemplateList(ResourceContext ctx); Template getTemplate(ResourceContext ctx, String templateName); @Override DomainTemplateDetailsList getDomainTemplateDetailsList(ResourceContext ctx, String domainName); RoleList getRoleList(ResourceContext ctx, String domainName, Integer limit, String skip); Roles getRoles(ResourceContext ctx, String domainName, Boolean members); @Override DomainRoleMembers getDomainRoleMembers(ResourceContext ctx, String domainName); @Override DomainRoleMember getPrincipalRoles(ResourceContext context, String principal, String domainName); @Override Role getRole(ResourceContext ctx, String domainName, String roleName,
            Boolean auditLog, Boolean expand, Boolean pending); @Override void putRole(ResourceContext ctx, String domainName, String roleName, String auditRef, Role role); void deleteRole(ResourceContext ctx, String domainName, String roleName, String auditRef); @Override Membership getMembership(ResourceContext ctx, String domainName,
            String roleName, String memberName, String expiration); @Override DomainRoleMembers getOverdueReview(ResourceContext ctx, String domainName); @Override void putMembership(ResourceContext ctx, String domainName, String roleName,
            String memberName, String auditRef, Membership membership); void deletePendingMembership(ResourceContext ctx, String domainName, String roleName,
            String memberName, String auditRef); void deleteMembership(ResourceContext ctx, String domainName, String roleName,
            String memberName, String auditRef); Quota getQuota(ResourceContext ctx, String domainName); @Override void putQuota(ResourceContext ctx, String domainName, String auditRef, Quota quota); void deleteQuota(ResourceContext ctx, String domainName, String auditRef); PolicyList getPolicyList(ResourceContext ctx, String domainName, Integer limit, String skip); Policies getPolicies(ResourceContext ctx, String domainName, Boolean assertions); Policy getPolicy(ResourceContext ctx, String domainName, String policyName); Assertion getAssertion(ResourceContext ctx, String domainName, String policyName,
            Long assertionId); @Override Assertion putAssertion(ResourceContext ctx, String domainName, String policyName,
            String auditRef, Assertion assertion); void deleteAssertion(ResourceContext ctx, String domainName, String policyName,
            Long assertionId, String auditRef); @Override void putPolicy(ResourceContext ctx, String domainName, String policyName, String auditRef, Policy policy); void deletePolicy(ResourceContext ctx, String domainName, String policyName, String auditRef); boolean isValidServiceName(final String serviceName); @Override void putServiceIdentity(ResourceContext ctx, String domainName, String serviceName,
                                   String auditRef, ServiceIdentity service); @Override void putServiceIdentitySystemMeta(ResourceContext ctx, String domainName, String serviceName,
             String attribute, String auditRef, ServiceIdentitySystemMeta meta); ServiceIdentity getServiceIdentity(ResourceContext ctx, String domainName, String serviceName); void deleteServiceIdentity(ResourceContext ctx, String domainName,
            String serviceName, String auditRef); ServiceIdentities getServiceIdentities(ResourceContext ctx, String domainName,
            Boolean publicKeys, Boolean hosts); ServiceIdentityList getServiceIdentityList(ResourceContext ctx, String domainName,
            Integer limit, String skip); PublicKeyEntry getPublicKeyEntry(ResourceContext ctx, String domainName, String serviceName, String keyId); void deletePublicKeyEntry(ResourceContext ctx, String domainName, String serviceName,
            String keyId, String auditRef); @Override void putPublicKeyEntry(ResourceContext ctx, String domainName, String serviceName,
            String keyId, String auditRef, PublicKeyEntry keyEntry); @Override Response getSignedDomains(ResourceContext ctx, String domainName, String metaOnly,
            String metaAttr, Boolean master, String matchingTag); @Override JWSDomain getJWSDomain(ResourceContext ctx, String domainName); @Override UserToken getUserToken(ResourceContext ctx, String userName, String authorizedServices,
            Boolean header); UserToken optionsUserToken(ResourceContext ctx, String userName, String authorizedServices); @Override void putTenancy(ResourceContext ctx, String tenantDomain, String provider,
            String auditRef, Tenancy detail); @Override void deleteTenancy(ResourceContext ctx, String tenantDomain, String provider, String auditRef); @Override void putTenant(ResourceContext ctx, String providerDomain, String providerService,
           String tenantDomain, String auditRef, Tenancy detail); @Override void deleteTenant(ResourceContext ctx, String providerDomain, String providerService,
            String tenantDomain, String auditRef); @Override TenantResourceGroupRoles putTenantResourceGroupRoles(ResourceContext ctx, String provSvcDomain,
            String provSvcName, String tenantDomain, String resourceGroup, String auditRef,
            TenantResourceGroupRoles detail); DomainDataCheck getDomainDataCheck(ResourceContext ctx, String domainName); void deleteProviderResourceGroupRoles(ResourceContext ctx, String tenantDomain,
             String provSvcDomain, String provSvcName, String resourceGroup, String auditRef); ProviderResourceGroupRoles getProviderResourceGroupRoles(ResourceContext ctx, String tenantDomain,
            String provSvcDomain, String provSvcName, String resourceGroup); @Override ProviderResourceGroupRoles putProviderResourceGroupRoles(ResourceContext ctx, String tenantDomain,
             String provSvcDomain, String provSvcName, String resourceGroup, String auditRef,
             ProviderResourceGroupRoles detail); TenantResourceGroupRoles getTenantResourceGroupRoles(ResourceContext ctx, String provSvcDomain,
            String provSvcName, String tenantDomain, String resourceGroup); void deleteTenantResourceGroupRoles(ResourceContext ctx, String provSvcDomain,
            String provSvcName, String tenantDomain, String resourceGroup, String auditRef); @Override String getPublicKey(String domain, String service, String keyId); @Override void putDefaultAdmins(ResourceContext ctx, String domainName, String auditRef,
            DefaultAdmins defaultAdmins); ServicePrincipal getServicePrincipal(ResourceContext ctx); @Override ResourceAccessList getResourceAccessList(ResourceContext ctx, String principal,
            String action); @Override Status getStatus(ResourceContext ctx); ResourceContext newResourceContext(HttpServletRequest request,
                                              HttpServletResponse response,
                                              String apiName); @Override Schema getRdlSchema(ResourceContext context); static String getRootDir(); @Override void putRoleSystemMeta(ResourceContext ctx, String domainName, String roleName, String attribute,
            String auditRef, RoleSystemMeta meta); @Override void putRoleMeta(ResourceContext ctx, String domainName, String roleName, String auditRef, RoleMeta meta); @Override void putMembershipDecision(ResourceContext ctx, String domainName, String roleName,
            String memberName, String auditRef, Membership membership); @Override DomainRoleMembership getPendingDomainRoleMembersList(ResourceContext ctx, String principal); @Override void putRoleReview(ResourceContext ctx, String domainName, String roleName, String auditRef, Role role); @Override Groups getGroups(ResourceContext ctx, String domainName, Boolean members); @Override Group getGroup(ResourceContext ctx, String domainName, String groupName, Boolean auditLog, Boolean pending); @Override void putGroup(ResourceContext ctx, String domainName, String groupName, String auditRef, Group group); @Override void deleteGroup(ResourceContext ctx, String domainName, String groupName, String auditRef); @Override GroupMembership getGroupMembership(ResourceContext ctx, String domainName, String groupName, String memberName, String expiration); @Override void putGroupMembership(ResourceContext ctx, String domainName, String groupName, String memberName, String auditRef, GroupMembership membership); @Override void deleteGroupMembership(ResourceContext ctx, String domainName, String groupName, String memberName, String auditRef); @Override void deletePendingGroupMembership(ResourceContext ctx, String domainName, String groupName, String memberName, String auditRef); @Override DomainGroupMember getPrincipalGroups(ResourceContext ctx, String principal, String domainName); @Override void putGroupSystemMeta(ResourceContext ctx, String domainName, String groupName, String attribute,
                                   String auditRef, GroupSystemMeta meta); @Override void putGroupMeta(ResourceContext ctx, String domainName, String groupName, String auditRef, GroupMeta meta); @Override void putGroupMembershipDecision(ResourceContext ctx, String domainName, String groupName, String memberName,
                                           String auditRef, GroupMembership membership); @Override void putGroupReview(ResourceContext ctx, String domainName, String groupName, String auditRef, Group group); @Override DomainGroupMembership getPendingDomainGroupMembersList(ResourceContext ctx, String principal); void recordMetrics(ResourceContext ctx, int httpStatus); static Metric metric; static String serverHostName; }
@Test public void testGetDomainDataCheck() { String tenantDomainName = "testGetDomainDataCheck"; TopLevelDomain tenDom = createTopLevelDomainObject(tenantDomainName, "Test Provider Domain", "testOrg", adminUser); zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, tenDom); Role role1 = createRoleObject(tenantDomainName, "Role1", null, "user.joe", "user.jane"); zms.putRole(mockDomRsrcCtx, tenantDomainName, "Role1", auditRef, role1); Role role2 = createRoleObject(tenantDomainName, "Role2", null, "user.phil", "user.gil"); zms.putRole(mockDomRsrcCtx, tenantDomainName, "Role2", auditRef, role2); Policy policy1 = createPolicyObject(tenantDomainName, "Policy1", "Role1", "UPDATE", tenantDomainName + ":resource1", AssertionEffect.ALLOW); zms.putPolicy(mockDomRsrcCtx, tenantDomainName, "Policy1", auditRef, policy1); Policy policy2 = createPolicyObject(tenantDomainName, "Policy2", "Role2", "READ", tenantDomainName + ":resource1", AssertionEffect.ALLOW); zms.putPolicy(mockDomRsrcCtx, tenantDomainName, "Policy2", auditRef, policy2); DomainDataCheck ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); assertNotNull(ddc); assertEquals(3, ddc.getPolicyCount()); assertEquals(3, ddc.getAssertionCount()); assertEquals(0, ddc.getRoleWildCardCount()); assertNull(ddc.getDanglingRoles()); assertNull(ddc.getDanglingPolicies()); assertNull(ddc.getProvidersWithoutTrust()); assertNull(ddc.getTenantsWithoutAssumeRole()); Assertion assertion = new Assertion(); assertion.setAction("MANAGE"); assertion.setEffect(AssertionEffect.ALLOW); assertion.setResource(tenantDomainName + ":wildlife"); assertion.setRole(tenantDomainName + ":role.Role*"); Policy policy = zms.getPolicy(mockDomRsrcCtx, tenantDomainName, "Policy2"); List<Assertion> assertList = policy.getAssertions(); assertList.add(assertion); policy.setAssertions(assertList); zms.putPolicy(mockDomRsrcCtx, tenantDomainName, "Policy2", auditRef, policy); ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); assertNotNull(ddc); assertEquals(3, ddc.getPolicyCount()); assertEquals(4, ddc.getAssertionCount()); assertEquals(1, ddc.getRoleWildCardCount()); assertNull(ddc.getDanglingRoles()); assertNull(ddc.getDanglingPolicies()); assertNull(ddc.getProvidersWithoutTrust()); assertNull(ddc.getTenantsWithoutAssumeRole()); assertion = new Assertion(); assertion.setAction("MANAGE"); assertion.setEffect(AssertionEffect.ALLOW); assertion.setResource(tenantDomainName + ":wildlife"); assertion.setRole(tenantDomainName + ":role.Wild*"); policy = zms.getPolicy(mockDomRsrcCtx, tenantDomainName, "Policy2"); assertList = policy.getAssertions(); assertList.add(assertion); policy.setAssertions(assertList); zms.putPolicy(mockDomRsrcCtx, tenantDomainName, "Policy2", auditRef, policy); ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); assertNotNull(ddc); assertEquals(3, ddc.getPolicyCount()); assertEquals(5, ddc.getAssertionCount()); assertEquals(2, ddc.getRoleWildCardCount()); assertNull(ddc.getDanglingRoles()); assertEquals(1, ddc.getDanglingPolicies().size()); assertNull(ddc.getProvidersWithoutTrust()); assertNull(ddc.getTenantsWithoutAssumeRole()); Role role3 = createRoleObject(tenantDomainName, "Role3", null, "user.user1", "user.user3"); zms.putRole(mockDomRsrcCtx, tenantDomainName, "Role3", auditRef, role3); ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); assertNotNull(ddc); assertEquals(3, ddc.getPolicyCount()); assertEquals(5, ddc.getAssertionCount()); assertEquals(2, ddc.getRoleWildCardCount()); assertEquals(1, ddc.getDanglingRoles().size()); assertEquals(1, ddc.getDanglingPolicies().size()); assertNull(ddc.getProvidersWithoutTrust()); assertNull(ddc.getTenantsWithoutAssumeRole()); assertion = new Assertion(); assertion.setAction("snorkel"); assertion.setEffect(AssertionEffect.ALLOW); assertion.setResource(tenantDomainName + ":molokoni"); assertion.setRole(tenantDomainName + ":role.snorkeler"); policy = zms.getPolicy(mockDomRsrcCtx, tenantDomainName, "Policy2"); assertList = policy.getAssertions(); assertList.add(assertion); policy.setAssertions(assertList); zms.putPolicy(mockDomRsrcCtx, tenantDomainName, "Policy2", auditRef, policy); ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); assertNotNull(ddc); assertEquals(3, ddc.getPolicyCount()); assertEquals(6, ddc.getAssertionCount()); assertEquals(2, ddc.getRoleWildCardCount()); assertEquals(1, ddc.getDanglingRoles().size()); assertEquals(2, ddc.getDanglingPolicies().size()); assertNull(ddc.getProvidersWithoutTrust()); assertNull(ddc.getTenantsWithoutAssumeRole()); String provDomainTop = "testGetDomainDataCheckProvider"; TopLevelDomain provDom = createTopLevelDomainObject(provDomainTop, "Test Provider Domain", "testOrg", adminUser); zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, provDom); String provDomainSub = provDomainTop + ".sub"; SubDomain subDom = createSubDomainObject("sub", provDomainTop, null, null, adminUser); subDom.setAuditEnabled(true); zms.postSubDomain(mockDomRsrcCtx, provDomainTop, auditRef, subDom); String provEndPoint = "http: String provSvc = "storage"; ServiceIdentity service = createServiceObject( provDomainSub, provSvc, provEndPoint, "/usr/bin/java", "root", "users", "localhost"); zms.putServiceIdentity(mockDomRsrcCtx, provDomainSub, provSvc, auditRef, service); Tenancy tenant = createTenantObject(tenantDomainName, provDomainSub + "." + provSvc); zms.putTenancy(mockDomRsrcCtx, tenantDomainName, provDomainSub + "." + provSvc, auditRef, tenant); ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); assertNotNull(ddc); assertEquals(4, ddc.getPolicyCount()); assertEquals(9, ddc.getAssertionCount()); assertEquals(2, ddc.getRoleWildCardCount()); assertEquals(1, ddc.getDanglingRoles().size()); assertEquals(2, ddc.getDanglingPolicies().size()); assertTrue(ddc.getDanglingRoles().contains("role3")); boolean danglingPolicy1Found = false; boolean danglingPolicy2Found = false; for (DanglingPolicy danglingPolicy : ddc.getDanglingPolicies()) { if (danglingPolicy.getPolicyName().equals("policy2") && danglingPolicy.getRoleName().equals("wild*")) { danglingPolicy1Found = true; } else if (danglingPolicy.getPolicyName().equals("policy2") && danglingPolicy.getRoleName().equals("snorkeler")) { danglingPolicy2Found = true; } } assertTrue(danglingPolicy1Found); assertTrue(danglingPolicy2Found); assertEquals(1, ddc.getProvidersWithoutTrust().size()); assertNull(ddc.getTenantsWithoutAssumeRole()); List<TenantRoleAction> roleActions = new ArrayList<>(); for (Struct.Field f : TABLE_PROVIDER_ROLE_ACTIONS) { roleActions.add(new TenantRoleAction().setRole(f.name()).setAction((String) f.value())); } TenantResourceGroupRoles tenantRoles = new TenantResourceGroupRoles().setDomain(provDomainSub) .setService(provSvc).setTenant(tenantDomainName) .setRoles(roleActions).setResourceGroup("set1"); zms.putTenantResourceGroupRoles(mockDomRsrcCtx, provDomainSub, provSvc, tenantDomainName, "set1", auditRef, tenantRoles); ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); assertNotNull(ddc); assertEquals(4, ddc.getPolicyCount()); assertEquals(9, ddc.getAssertionCount()); assertEquals(2, ddc.getRoleWildCardCount()); assertEquals(1, ddc.getDanglingRoles().size()); assertEquals(2, ddc.getDanglingPolicies().size()); assertNull(ddc.getTenantsWithoutAssumeRole()); ddc = zms.getDomainDataCheck(mockDomRsrcCtx, provDomainSub); assertNotNull(ddc); assertEquals(5, ddc.getPolicyCount()); assertEquals(5, ddc.getAssertionCount()); assertEquals(0, ddc.getRoleWildCardCount()); assertNull(ddc.getDanglingRoles()); assertNull(ddc.getDanglingPolicies()); assertNull(ddc.getProvidersWithoutTrust()); assertNotNull(ddc.getTenantsWithoutAssumeRole()); zms.deleteTenancy(mockDomRsrcCtx, tenantDomainName, provDomainSub + "." + provSvc, auditRef); ddc = zms.getDomainDataCheck(mockDomRsrcCtx, provDomainSub); assertNotNull(ddc); assertEquals(5, ddc.getPolicyCount()); assertEquals(5, ddc.getAssertionCount()); assertEquals(0, ddc.getRoleWildCardCount()); assertNull(ddc.getDanglingRoles()); assertNull(ddc.getDanglingPolicies()); assertNull(ddc.getProvidersWithoutTrust()); assertEquals(1, ddc.getTenantsWithoutAssumeRole().size()); ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); assertNotNull(ddc); assertEquals(3, ddc.getPolicyCount()); assertEquals(6, ddc.getAssertionCount()); assertEquals(2, ddc.getRoleWildCardCount()); assertEquals(2, ddc.getDanglingRoles().size()); assertEquals(2, ddc.getDanglingPolicies().size()); assertNull(ddc.getProvidersWithoutTrust()); assertNull(ddc.getTenantsWithoutAssumeRole()); String provSvcTop = "shelter"; service = createServiceObject( provDomainTop, provSvcTop, provEndPoint, "/usr/bin/java", "root", "users", "localhost"); zms.putServiceIdentity(mockDomRsrcCtx, provDomainTop, provSvcTop, auditRef, service); TenantResourceGroupRoles tenantGroupRoles = new TenantResourceGroupRoles() .setDomain(provDomainTop) .setService(provSvcTop).setTenant(tenantDomainName) .setRoles(roleActions).setResourceGroup("ravers"); zms.putTenantResourceGroupRoles(mockDomRsrcCtx, provDomainTop, provSvcTop, tenantDomainName, "ravers", auditRef, tenantGroupRoles); ddc = zms.getDomainDataCheck(mockDomRsrcCtx, provDomainTop); assertNotNull(ddc); assertEquals(5, ddc.getPolicyCount()); assertEquals(5, ddc.getAssertionCount()); assertEquals(0, ddc.getRoleWildCardCount()); assertNull(ddc.getDanglingRoles()); assertNull(ddc.getDanglingPolicies()); assertNull(ddc.getProvidersWithoutTrust()); assertEquals(1, ddc.getTenantsWithoutAssumeRole().size()); ProviderResourceGroupRoles providerRoles = new ProviderResourceGroupRoles() .setDomain(provDomainSub).setService(provSvc) .setTenant(tenantDomainName).setRoles(roleActions) .setResourceGroup("ravers"); zms.putProviderResourceGroupRoles(mockDomRsrcCtx, tenantDomainName, provDomainSub, provSvc, "ravers", auditRef, providerRoles); ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); assertNotNull(ddc, ddc.toString()); assertEquals(7, ddc.getPolicyCount()); assertEquals(12, ddc.getAssertionCount()); assertEquals(2, ddc.getRoleWildCardCount()); assertEquals(1, ddc.getDanglingRoles().size()); assertEquals(2, ddc.getDanglingPolicies().size()); assertEquals(1, ddc.getProvidersWithoutTrust().size()); assertNull(ddc.getTenantsWithoutAssumeRole()); zms.putTenancy(mockDomRsrcCtx, tenantDomainName, provDomainSub + "." + provSvc, auditRef, tenant); ddc = zms.getDomainDataCheck(mockDomRsrcCtx, provDomainSub); assertNotNull(ddc); assertEquals(5, ddc.getPolicyCount()); assertEquals(5, ddc.getAssertionCount()); assertEquals(0, ddc.getRoleWildCardCount()); assertNull(ddc.getDanglingRoles()); assertNull(ddc.getDanglingPolicies()); assertNull(ddc.getProvidersWithoutTrust()); assertNotNull(ddc.getTenantsWithoutAssumeRole()); ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); assertNotNull(ddc); assertEquals(7, ddc.getPolicyCount()); assertEquals(12, ddc.getAssertionCount()); assertEquals(2, ddc.getRoleWildCardCount()); assertEquals(1, ddc.getDanglingRoles().size()); assertEquals(2, ddc.getDanglingPolicies().size()); assertEquals(1, ddc.getProvidersWithoutTrust().size()); assertNull(ddc.getTenantsWithoutAssumeRole()); tenantGroupRoles = new TenantResourceGroupRoles() .setDomain(provDomainSub) .setService(provSvc).setTenant(tenantDomainName) .setRoles(roleActions).setResourceGroup("ravers"); zms.putTenantResourceGroupRoles(mockDomRsrcCtx, provDomainSub, provSvc, tenantDomainName, "ravers", auditRef, tenantGroupRoles); ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); assertNotNull(ddc); assertEquals(7, ddc.getPolicyCount()); assertEquals(12, ddc.getAssertionCount()); assertEquals(2, ddc.getRoleWildCardCount()); assertEquals(1, ddc.getDanglingRoles().size()); assertEquals(2, ddc.getDanglingPolicies().size()); assertNull(ddc.getProvidersWithoutTrust()); assertNull(ddc.getTenantsWithoutAssumeRole()); providerRoles = new ProviderResourceGroupRoles() .setDomain(provDomainTop).setService(provSvcTop) .setTenant(tenantDomainName).setRoles(roleActions) .setResourceGroup("ravers"); zms.putProviderResourceGroupRoles(mockDomRsrcCtx, tenantDomainName, provDomainTop, provSvcTop, "ravers", auditRef, providerRoles); ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); assertNotNull(ddc); assertEquals(11, ddc.getPolicyCount()); assertEquals(18, ddc.getAssertionCount()); assertEquals(2, ddc.getRoleWildCardCount()); assertEquals(1, ddc.getDanglingRoles().size()); assertEquals(2, ddc.getDanglingPolicies().size()); assertNull(ddc.getProvidersWithoutTrust()); assertNull(ddc.getTenantsWithoutAssumeRole()); zms.deleteTenantResourceGroupRoles(mockDomRsrcCtx, provDomainSub, provSvc, tenantDomainName, "ravers", auditRef); ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); assertNotNull(ddc); assertEquals(11, ddc.getPolicyCount()); assertEquals(18, ddc.getAssertionCount()); assertEquals(2, ddc.getRoleWildCardCount()); assertEquals(1, ddc.getDanglingRoles().size()); assertEquals(2, ddc.getDanglingPolicies().size()); assertEquals(1, ddc.getProvidersWithoutTrust().size()); assertNull(ddc.getTenantsWithoutAssumeRole()); zms.deletePolicy(mockDomRsrcCtx, tenantDomainName, "Policy2", auditRef); zms.deleteRole(mockDomRsrcCtx, tenantDomainName, "Role3", auditRef); zms.deleteRole(mockDomRsrcCtx, tenantDomainName, "Role2", auditRef); ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); assertNotNull(ddc); assertEquals(10, ddc.getPolicyCount()); assertEquals(14, ddc.getAssertionCount()); assertEquals(0, ddc.getRoleWildCardCount()); assertNull(ddc.getDanglingRoles()); assertNull(ddc.getDanglingPolicies()); assertEquals(1, ddc.getProvidersWithoutTrust().size()); assertNull(ddc.getTenantsWithoutAssumeRole()); tenantRoles = new TenantResourceGroupRoles().setDomain(provDomainTop) .setService(provSvcTop).setTenant(tenantDomainName) .setRoles(roleActions).setResourceGroup("set1"); zms.putTenantResourceGroupRoles(mockDomRsrcCtx, provDomainTop, provSvcTop, tenantDomainName, "set1", auditRef, tenantRoles); ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); assertNotNull(ddc); assertEquals(10, ddc.getPolicyCount()); assertEquals(14, ddc.getAssertionCount()); assertEquals(0, ddc.getRoleWildCardCount()); assertNull(ddc.getDanglingRoles()); assertNull(ddc.getDanglingPolicies()); assertEquals(1, ddc.getProvidersWithoutTrust().size()); assertNull(ddc.getTenantsWithoutAssumeRole()); zms.deleteProviderResourceGroupRoles(mockDomRsrcCtx, tenantDomainName, provDomainSub, provSvc, "ravers", auditRef); ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); assertNotNull(ddc); assertEquals(7, ddc.getPolicyCount()); assertEquals(11, ddc.getAssertionCount()); assertEquals(0, ddc.getRoleWildCardCount()); assertNull(ddc.getDanglingRoles()); assertNull(ddc.getDanglingPolicies()); assertNull(ddc.getProvidersWithoutTrust()); assertNull(ddc.getTenantsWithoutAssumeRole()); zms.deleteTopLevelDomain(mockDomRsrcCtx, tenantDomainName, auditRef); zms.deleteSubDomain(mockDomRsrcCtx, provDomainTop, "sub", auditRef); zms.deleteTopLevelDomain(mockDomRsrcCtx, provDomainTop, auditRef); }