SafesService { public ResponseEntity<String> associateApproletoSDB(String token, SafeAppRoleAccess safeAppRoleAccess) { String jsonstr = JSONUtil.getJSON(safeAppRoleAccess); log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Associate AppRole to SDB"). put(LogMessage.MESSAGE, String.format ("Trying to associate AppRole to SDB [%s]", jsonstr)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); Map<String,Object> requestMap = ControllerUtil.parseJson(jsonstr); if(!ControllerUtil.areSafeAppRoleInputsValid(requestMap)) { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid input values\"]}"); } if (safeAppRoleAccess.getRole_name().equals(TVaultConstants.SELF_SERVICE_APPROLE_NAME)) { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Access denied: no permission to associate this AppRole to any safe\"]}"); } String approle = requestMap.get("role_name").toString().toLowerCase(); String path = requestMap.get("path").toString(); String access = requestMap.get("access").toString(); boolean canAddAppRole = ControllerUtil.canAddPermission(path, token); if(canAddAppRole){ log.info("Associate approle to SDB - path :" + path + "valid" ); String folders[] = path.split("[/]+"); String policy =""; switch (access){ case "read": policy = "r_" + folders[0].toLowerCase() + "_" + folders[1] ; break ; case "write": policy = "w_" + folders[0].toLowerCase() + "_" + folders[1] ;break; case "deny": policy = "d_" + folders[0].toLowerCase() + "_" + folders[1] ;break; } String policyPostfix = folders[0].toLowerCase() + "_" + folders[1]; Response roleResponse = reqProcessor.process("/auth/approle/role/read","{\"role_name\":\""+approle+"\"}",token); String responseJson=""; List<String> policies = new ArrayList<>(); List<String> currentpolicies = new ArrayList<>(); if(HttpStatus.OK.equals(roleResponse.getHttpstatus())){ responseJson = roleResponse.getResponse(); ObjectMapper objMapper = new ObjectMapper(); try { JsonNode policiesArry = objMapper.readTree(responseJson).get("data").get("policies"); if (null != policiesArry) { for(JsonNode policyNode : policiesArry){ currentpolicies.add(policyNode.asText()); } } } catch (IOException e) { log.error(e); } policies.addAll(currentpolicies); policies.remove("r_"+policyPostfix); policies.remove("w_"+policyPostfix); policies.remove("d_"+policyPostfix); } else { return ResponseEntity.status(HttpStatus.UNPROCESSABLE_ENTITY).body("{\"errors\":[\"Non existing role name. Please configure approle as first step\"]}"); } if("".equals(policy)){ return ResponseEntity.status(HttpStatus.UNPROCESSABLE_ENTITY).body("{\"errors\":[\"Incorrect access requested. Valid values are read,write,deny \"]}"); } policies.add(policy); String policiesString = StringUtils.join(policies, ","); String currentpoliciesString = StringUtils.join(currentpolicies, ","); log.info(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Associate AppRole to SDB"). put(LogMessage.MESSAGE, "Associate approle to SDB - policy :" + policiesString + " is being configured" ). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); Response approleControllerResp = appRoleService.configureApprole(approle,policiesString,token); if(HttpStatus.OK.equals(approleControllerResp.getHttpstatus()) || (HttpStatus.NO_CONTENT.equals(approleControllerResp.getHttpstatus()))) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Associate AppRole to SDB"). put(LogMessage.MESSAGE, "Associate approle to SDB - policy :" + policiesString + " is associated"). put(LogMessage.STATUS, approleControllerResp.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); Map<String,String> params = new HashMap<String,String>(); params.put("type", "app-roles"); params.put("name",approle); params.put("path",path); params.put("access",access); Response metadataResponse = ControllerUtil.updateMetadata(params,token); if(metadataResponse != null && HttpStatus.NO_CONTENT.equals(metadataResponse.getHttpstatus())){ log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add AppRole To SDB"). put(LogMessage.MESSAGE, "AppRole is successfully associated"). put(LogMessage.STATUS, metadataResponse.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.OK).body("{\"messages\":[\"Approle :" + approle + " is successfully associated with SDB\"]}"); }else{ String safeType = ControllerUtil.getSafeType(path); String safeName = ControllerUtil.getSafeName(path); List<String> safeNames = ControllerUtil.getAllExistingSafeNames(safeType, token); String newPath = path; if (safeNames != null ) { for (String existingSafeName: safeNames) { if (existingSafeName.equalsIgnoreCase(safeName)) { newPath = safeType + "/" + existingSafeName; break; } } } params.put("path",newPath); metadataResponse = ControllerUtil.updateMetadata(params,token); if(HttpStatus.NO_CONTENT.equals(metadataResponse.getHttpstatus())){ log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add AppRole To SDB"). put(LogMessage.MESSAGE, "AppRole is successfully associated"). put(LogMessage.STATUS, metadataResponse.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.OK).body("{\"messages\":[\"Approle :" + approle + " is successfully associated with SDB\"]}"); } else { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add AppRole To SDB"). put(LogMessage.MESSAGE, "AppRole configuration failed."). put(LogMessage.RESPONSE, metadataResponse.getResponse()). put(LogMessage.STATUS, metadataResponse.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); approleControllerResp = appRoleService.configureApprole(approle,currentpoliciesString,token); if(approleControllerResp.getHttpstatus().equals(HttpStatus.NO_CONTENT)){ log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add AppRole To SDB"). put(LogMessage.MESSAGE, "Reverting user policy update failed"). put(LogMessage.RESPONSE, metadataResponse.getResponse()). put(LogMessage.STATUS, metadataResponse.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"Role configuration failed.Please try again\"]}"); }else{ log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add AppRole To SDB"). put(LogMessage.MESSAGE, "Reverting user policy update failed"). put(LogMessage.RESPONSE, metadataResponse.getResponse()). put(LogMessage.STATUS, metadataResponse.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"Role configuration failed.Contact Admin \"]}"); } } } }else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Associate AppRole to SDB"). put(LogMessage.MESSAGE, "Association of AppRole to SDB failed"). put(LogMessage.RESPONSE, approleControllerResp.getResponse()). put(LogMessage.STATUS, approleControllerResp.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); log.error( "Associate Approle" +approle + "to sdb FAILED"); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"messages\":[\"Approle :" + approle + " failed to be associated with SDB\"]}"); } } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Associate AppRole to SDB"). put(LogMessage.MESSAGE, "Association of AppRole to SDB failed"). put(LogMessage.RESPONSE, "Invalid Path"). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"messages\":[\"Approle :" + approle + " failed to be associated with SDB.. Invalid Path specified\"]}"); } }  ResponseEntity<String> getFolders( String token, String path); ResponseEntity<String> getInfo(String token, String path); ResponseEntity<String> createfolder(String token, String path); ResponseEntity<String> createSafe(String token, Safe safe); ResponseEntity<String> getSafe(String token, String path); ResponseEntity<String> deleteSafe(String token, Safe safe, UserDetails userDetails); ResponseEntity<String> updateSafe(String token, Safe safe); ResponseEntity<String> addUserToSafe(String token, SafeUser safeUser, UserDetails userDetails); ResponseEntity<String> addGroupToSafe(String token, SafeGroup safeGroup, UserDetails userDetails); ResponseEntity<String> removeUserFromSafe(String token, SafeUser safeUser, UserDetails userDetails); ResponseEntity<String> removeGroupFromSafe(String token, SafeGroup safeGroup, UserDetails userDetails); ResponseEntity<String> addAwsRoleToSafe(String token, AWSRole awsRole); ResponseEntity<String> removeAWSRoleFromSafe(String token, AWSRole awsRole, boolean detachOnly, UserDetails userDetails); ResponseEntity<String> deletefolder(String token, String path, UserDetails userDetails); ResponseEntity<String> getFoldersRecursively(String token, String path); ResponseEntity<String> createNestedfolder(String token, String path, UserDetails userDetails); ResponseEntity<String> associateApproletoSDB(String token, SafeAppRoleAccess safeAppRoleAccess); ResponseEntity<String> removeApproleFromSafe(String token, String jsonstr);  }
@Test public void test_AssociateAppRole_failure_400() throws Exception { ResponseEntity<String> responseEntityExpected = ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Access denied: no permission to associate this AppRole to any safe\"]}"); String token = "5PDrOhsy4ig8L3EpsJZSLAMg"; SafeAppRoleAccess safeAppRoleAccess = new SafeAppRoleAccess("selfservicesupportrole", "shared/mysafe01", "write"); when(ControllerUtil.areSafeAppRoleInputsValid(Mockito.any())).thenReturn(true); ResponseEntity<String> responseEntityActual = safesService.associateApproletoSDB(token, safeAppRoleAccess); assertEquals(HttpStatus.BAD_REQUEST, responseEntityActual.getStatusCode()); assertEquals(responseEntityExpected, responseEntityActual); }