DBService implements RolesProvider { void processRoleUserAuthorityRestrictions() { if (zmsConfig.getUserAuthority() == null) { return; } List<PrincipalRole> roles; try (ObjectStoreConnection con = store.getConnection(true, false)) { roles = con.listRolesWithUserAuthorityRestrictions(); } if (roles == null) { return; } for (PrincipalRole role : roles) { try { enforceRoleUserAuthorityRestrictions(role.getDomainName(), role.getRoleName(), role.getDomainUserAuthorityFilter()); } catch (Exception ex) { LOG.error("Unable to process user authority restrictions for {}:role.{} - {}", role.getDomainName(), role.getRoleName(), ex.getMessage()); } } } DBService(ObjectStore store, AuditLogger auditLogger, ZMSConfig zmsConfig, AuditReferenceValidator auditReferenceValidator); DomainRoleMembers listOverdueReviewRoleMembers(String domainName); @Override List<Role> getRolesByDomain(String domain); ResourceAccessList getResourceAccessList(String principal, String action); AthenzDomain getAthenzDomain(final String domainName, boolean masterCopy); Quota getQuota(String domainName); void executePutRoleSystemMeta(ResourceContext ctx, final String domainName, final String roleName,
           RoleSystemMeta meta, final String attribute, final String auditRef, final String caller); void executePutGroupSystemMeta(ResourceContext ctx, final String domainName, final String groupName,
                                          GroupSystemMeta meta, final String attribute, final String auditRef); void executePutServiceIdentitySystemMeta(ResourceContext ctx, String domainName, String serviceName,
            ServiceIdentitySystemMeta meta, String attribute, String auditRef, String caller); void executePutRoleMeta(ResourceContext ctx, String domainName, String roleName, Role originalRole,
                                   RoleMeta meta, String auditRef, String caller); void executePutGroupMeta(ResourceContext ctx, final String domainName, final String groupName,
                                    GroupMeta meta, final String auditRef); Set<String> getPendingMembershipApproverRoles(int delayDays); Set<String> getPendingGroupMembershipApproverRoles(int delayDays); Map<String, DomainRoleMember> getRoleExpiryMembers(int delayDays); Map<String, DomainRoleMember> getRoleReviewMembers(int delayDays); Map<String, DomainGroupMember> getGroupExpiryMembers(int delayDays); void processExpiredPendingMembers(int pendingRoleMemberLifespan, final String monitorIdentity); void processExpiredPendingGroupMembers(int pendingGroupMemberLifespan, final String monitorIdentity); static int AUDIT_TYPE_ROLE; static int AUDIT_TYPE_POLICY; static int AUDIT_TYPE_SERVICE; static int AUDIT_TYPE_DOMAIN; static int AUDIT_TYPE_ENTITY; static int AUDIT_TYPE_TENANCY; static int AUDIT_TYPE_TEMPLATE; static int AUDIT_TYPE_GROUP; }
@Test public void testProcessRoleUserAuthorityRestrictions() { Authority savedAuthority = zms.dbService.zmsConfig.getUserAuthority(); Authority authority = Mockito.mock(Authority.class); Mockito.when(authority.getDateAttribute("user.joe", "elevated-clearance")) .thenReturn(null); zms.dbService.zmsConfig.setUserAuthority(authority); final String domainName = "authority-test"; final String roleName = "auth-role"; ObjectStoreConnection mockConn = Mockito.mock(ObjectStoreConnection.class); Mockito.when(mockConn.insertRoleMember(Mockito.anyString(), Mockito.anyString(), Mockito.any(), Mockito.any(), Mockito.anyString())).thenReturn(true); Mockito.when(mockConn.updateDomainModTimestamp(domainName)).thenReturn(true); Mockito.when(mockObjStore.getConnection(true, true)).thenReturn(mockConn); Mockito.when(mockObjStore.getConnection(true, false)).thenReturn(mockConn); Role role = new Role().setUserAuthorityExpiration("elevated-clearance"); List<RoleMember> roleMembers = new ArrayList<>(); roleMembers.add(new RoleMember().setMemberName("user.joe")); Mockito.when(mockConn.getRole(domainName, roleName)).thenReturn(role); Mockito.when(mockConn.listRoleMembers(domainName, roleName, false)) .thenReturn(roleMembers); List<PrincipalRole> roles = new ArrayList<>(); PrincipalRole prRole = new PrincipalRole(); prRole.setDomainName(domainName); prRole.setRoleName(roleName); roles.add(prRole); Mockito.when(mockConn.listRolesWithUserAuthorityRestrictions()) .thenReturn(null) .thenReturn(roles); ObjectStore savedStore = zms.dbService.store; zms.dbService.store = mockObjStore; zms.dbService.processRoleUserAuthorityRestrictions(); zms.dbService.processRoleUserAuthorityRestrictions(); zms.dbService.zmsConfig.setUserAuthority(savedAuthority); zms.dbService.store = savedStore; }