DBService implements RolesProvider { void executePutDomainMeta(ResourceContext ctx, String domainName, DomainMeta meta, final String systemAttribute, boolean deleteAllowed, String auditRef, String caller) { for (int retryCount = defaultRetryCount; ; retryCount--) { try (ObjectStoreConnection con = store.getConnection(false, true)) { Domain domain = con.getDomain(domainName); if (domain == null) { con.rollbackChanges(); throw ZMSUtils.notFoundError(caller + ": Unknown domain: " + domainName, caller); } checkDomainAuditEnabled(con, domain, auditRef, caller, getPrincipalName(ctx), AUDIT_TYPE_DOMAIN); Domain updatedDomain = new Domain() .setName(domain.getName()) .setEnabled(domain.getEnabled()) .setId(domain.getId()) .setAuditEnabled(domain.getAuditEnabled()) .setDescription(domain.getDescription()) .setOrg(domain.getOrg()) .setApplicationId(domain.getApplicationId()) .setAccount(domain.getAccount()) .setYpmId(domain.getYpmId()) .setCertDnsDomain(domain.getCertDnsDomain()) .setMemberExpiryDays(domain.getMemberExpiryDays()) .setServiceExpiryDays(domain.getServiceExpiryDays()) .setGroupExpiryDays(domain.getGroupExpiryDays()) .setTokenExpiryMins(domain.getTokenExpiryMins()) .setRoleCertExpiryMins(domain.getRoleCertExpiryMins()) .setServiceCertExpiryMins(domain.getServiceCertExpiryMins()) .setSignAlgorithm(domain.getSignAlgorithm()) .setUserAuthorityFilter(domain.getUserAuthorityFilter()); if (systemAttribute != null) { updateSystemMetaFields(updatedDomain, systemAttribute, deleteAllowed, meta); } else { updateDomainMetaFields(updatedDomain, meta); } con.updateDomain(updatedDomain); con.commitChanges(); cacheStore.invalidate(domainName); StringBuilder auditDetails = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); auditLogDomain(auditDetails, updatedDomain); auditLogRequest(ctx, domainName, auditRef, caller, ZMSConsts.HTTP_PUT, domainName, auditDetails.toString()); updateDomainMembersExpiration(ctx, con, domain, updatedDomain, auditRef, caller); updateDomainMembersUserAuthorityFilter(ctx, con, domain, updatedDomain, auditRef, caller); return; } catch (ResourceException ex) { if (!shouldRetryOperation(ex, retryCount)) { throw ex; } } } } DBService(ObjectStore store, AuditLogger auditLogger, ZMSConfig zmsConfig, AuditReferenceValidator auditReferenceValidator); DomainRoleMembers listOverdueReviewRoleMembers(String domainName); @Override List<Role> getRolesByDomain(String domain); ResourceAccessList getResourceAccessList(String principal, String action); AthenzDomain getAthenzDomain(final String domainName, boolean masterCopy); Quota getQuota(String domainName); void executePutRoleSystemMeta(ResourceContext ctx, final String domainName, final String roleName,
           RoleSystemMeta meta, final String attribute, final String auditRef, final String caller); void executePutGroupSystemMeta(ResourceContext ctx, final String domainName, final String groupName,
                                          GroupSystemMeta meta, final String attribute, final String auditRef); void executePutServiceIdentitySystemMeta(ResourceContext ctx, String domainName, String serviceName,
            ServiceIdentitySystemMeta meta, String attribute, String auditRef, String caller); void executePutRoleMeta(ResourceContext ctx, String domainName, String roleName, Role originalRole,
                                   RoleMeta meta, String auditRef, String caller); void executePutGroupMeta(ResourceContext ctx, final String domainName, final String groupName,
                                    GroupMeta meta, final String auditRef); Set<String> getPendingMembershipApproverRoles(int delayDays); Set<String> getPendingGroupMembershipApproverRoles(int delayDays); Map<String, DomainRoleMember> getRoleExpiryMembers(int delayDays); Map<String, DomainRoleMember> getRoleReviewMembers(int delayDays); Map<String, DomainGroupMember> getGroupExpiryMembers(int delayDays); void processExpiredPendingMembers(int pendingRoleMemberLifespan, final String monitorIdentity); void processExpiredPendingGroupMembers(int pendingGroupMemberLifespan, final String monitorIdentity); static int AUDIT_TYPE_ROLE; static int AUDIT_TYPE_POLICY; static int AUDIT_TYPE_SERVICE; static int AUDIT_TYPE_DOMAIN; static int AUDIT_TYPE_ENTITY; static int AUDIT_TYPE_TENANCY; static int AUDIT_TYPE_TEMPLATE; static int AUDIT_TYPE_GROUP; }
@Test public void testExecutePutDomainMeta() { TopLevelDomain dom1 = createTopLevelDomainObject("MetaDom1", "Test Domain1", "testOrg", adminUser); zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); Domain resDom1 = zms.getDomain(mockDomRsrcCtx, "MetaDom1"); assertNotNull(resDom1); assertEquals("Test Domain1", resDom1.getDescription()); assertEquals("testorg", resDom1.getOrg()); assertTrue(resDom1.getEnabled()); assertFalse(resDom1.getAuditEnabled()); assertNull(resDom1.getTokenExpiryMins()); assertNull(resDom1.getMemberExpiryDays()); assertNull(resDom1.getServiceExpiryDays()); assertNull(resDom1.getRoleCertExpiryMins()); assertNull(resDom1.getServiceCertExpiryMins()); DomainMeta meta = new DomainMeta().setDescription("Test2 Domain").setOrg("NewOrg") .setEnabled(true).setAuditEnabled(false).setAccount("12345").setYpmId(1001) .setCertDnsDomain("athenz1.cloud").setMemberExpiryDays(10).setTokenExpiryMins(20) .setServiceExpiryDays(45).setGroupExpiryDays(50); zms.dbService.executePutDomainMeta(mockDomRsrcCtx, "metadom1", meta, null, false, auditRef, "putDomainMeta"); zms.dbService.executePutDomainMeta(mockDomRsrcCtx, "metadom1", meta, "productid", true, auditRef, "putDomainMeta"); zms.dbService.executePutDomainMeta(mockDomRsrcCtx, "metadom1", meta, "account", true, auditRef, "putDomainMeta"); zms.dbService.executePutDomainMeta(mockDomRsrcCtx, "metadom1", meta, "certdnsdomain", true, auditRef, "putDomainMeta"); zms.dbService.executePutDomainMeta(mockDomRsrcCtx, "metadom1", meta, "org", true, auditRef, "putDomainMeta"); Domain resDom2 = zms.getDomain(mockDomRsrcCtx, "MetaDom1"); assertNotNull(resDom2); assertEquals("Test2 Domain", resDom2.getDescription()); assertEquals("NewOrg", resDom2.getOrg()); assertTrue(resDom2.getEnabled()); assertFalse(resDom2.getAuditEnabled()); assertEquals(Integer.valueOf(1001), resDom2.getYpmId()); assertEquals("12345", resDom2.getAccount()); assertEquals(resDom2.getCertDnsDomain(), "athenz1.cloud"); assertEquals(Integer.valueOf(20), resDom2.getTokenExpiryMins()); assertEquals(Integer.valueOf(10), resDom2.getMemberExpiryDays()); assertEquals(Integer.valueOf(45), resDom2.getServiceExpiryDays()); assertEquals(Integer.valueOf(50), resDom2.getGroupExpiryDays()); assertNull(resDom2.getRoleCertExpiryMins()); assertNull(resDom2.getServiceCertExpiryMins()); meta = new DomainMeta().setDescription("Test2 Domain-New").setOrg("NewOrg-New") .setEnabled(true).setAuditEnabled(false).setRoleCertExpiryMins(30) .setServiceCertExpiryMins(40).setSignAlgorithm("rsa") .setServiceExpiryDays(45).setGroupExpiryDays(50); zms.dbService.executePutDomainMeta(mockDomRsrcCtx, "metadom1", meta, null, false, auditRef, "putDomainMeta"); zms.dbService.executePutDomainMeta(mockDomRsrcCtx, "metadom1", meta, "org", true, auditRef, "putDomainMeta"); Domain resDom3 = zms.getDomain(mockDomRsrcCtx, "MetaDom1"); assertNotNull(resDom3); assertEquals("Test2 Domain-New", resDom3.getDescription()); assertEquals("NewOrg-New", resDom3.getOrg()); assertTrue(resDom3.getEnabled()); assertFalse(resDom3.getAuditEnabled()); assertEquals(Integer.valueOf(1001), resDom3.getYpmId()); assertEquals("12345", resDom3.getAccount()); assertEquals(resDom3.getCertDnsDomain(), "athenz1.cloud"); assertEquals(Integer.valueOf(20), resDom3.getTokenExpiryMins()); assertEquals(Integer.valueOf(10), resDom3.getMemberExpiryDays()); assertEquals(Integer.valueOf(45), resDom3.getServiceExpiryDays()); assertEquals(Integer.valueOf(50), resDom3.getGroupExpiryDays()); assertEquals(Integer.valueOf(30), resDom3.getRoleCertExpiryMins()); assertEquals(Integer.valueOf(40), resDom3.getServiceCertExpiryMins()); assertEquals(resDom3.getSignAlgorithm(), "rsa"); meta = new DomainMeta().setDescription("Test2 Domain-New").setOrg("NewOrg-New") .setEnabled(true).setAuditEnabled(false).setRoleCertExpiryMins(300) .setServiceCertExpiryMins(400).setTokenExpiryMins(500) .setSignAlgorithm("ec").setServiceExpiryDays(20).setGroupExpiryDays(25); zms.dbService.executePutDomainMeta(mockDomRsrcCtx, "metadom1", meta, null, false, auditRef, "putDomainMeta"); Domain resDom4 = zms.getDomain(mockDomRsrcCtx, "MetaDom1"); assertNotNull(resDom4); assertEquals("Test2 Domain-New", resDom4.getDescription()); assertEquals("NewOrg-New", resDom4.getOrg()); assertTrue(resDom4.getEnabled()); assertFalse(resDom4.getAuditEnabled()); assertEquals(Integer.valueOf(1001), resDom4.getYpmId()); assertEquals("12345", resDom4.getAccount()); assertEquals(resDom4.getCertDnsDomain(), "athenz1.cloud"); assertEquals(Integer.valueOf(500), resDom4.getTokenExpiryMins()); assertEquals(Integer.valueOf(10), resDom4.getMemberExpiryDays()); assertEquals(Integer.valueOf(20), resDom4.getServiceExpiryDays()); assertEquals(Integer.valueOf(25), resDom4.getGroupExpiryDays()); assertEquals(Integer.valueOf(300), resDom4.getRoleCertExpiryMins()); assertEquals(Integer.valueOf(400), resDom4.getServiceCertExpiryMins()); assertEquals(resDom4.getSignAlgorithm(), "ec"); zms.deleteTopLevelDomain(mockDomRsrcCtx, "MetaDom1", auditRef); }