AuthzHelper { public static boolean matchDelegatedTrustAssertion(Assertion assertion, final String roleName, final String roleMember, List<Role> roles, GroupMembersFetcher groupMembersFetcher) { if (!assumeRoleResourceMatch(roleName, assertion)) { return false; } String rolePattern = StringUtils.patternFromGlob(assertion.getRole()); for (Role role : roles) { String name = role.getName(); if (!name.matches(rolePattern)) { continue; } if (isMemberOfRole(role, roleMember, groupMembersFetcher)) { return true; } } return false; }  static void removeRoleMembers(List<RoleMember> originalRoleMembers, List<RoleMember> removeRoleMembers); static void removeGroupMembers(List<GroupMember> originalGroupMembers, List<GroupMember> removeGroupMembers); static boolean isMemberDisabled(Integer systemDisabled); static boolean isMemberExpired(Timestamp expiration, long currentTime); static boolean shouldSkipGroupMember(GroupMember member, long currentTime); static boolean isMemberOfGroup(List<GroupMember> groupMembers, final String member); static boolean checkGroupMemberValidity(List<GroupMember> groupMembers, final String member); static boolean memberNameMatch(final String memberName, final  String matchName); static boolean shouldRunDelegatedTrustCheck(final String trust, final String trustDomain); static String retrieveResourceDomain(String resource, String op, String trustDomain); static String extractResourceDomainName(final String resource); static boolean authorityAuthorizationAllowed(Principal principal); static boolean checkRoleMemberValidity(List<RoleMember> roleMembers, final String member,
                                                  GroupMembersFetcher groupMembersFetcher); static boolean isMemberOfRole(Role role, final String member, GroupMembersFetcher groupMembersFetcher); static boolean assumeRoleResourceMatch(String roleName, Assertion assertion); static boolean matchDelegatedTrustPolicy(Policy policy, final String roleName, final String roleMember,
                                                    List<Role> roles, GroupMembersFetcher groupMembersFetcher); static boolean matchDelegatedTrustAssertion(Assertion assertion, final String roleName, final String roleMember,
                                                       List<Role> roles, GroupMembersFetcher groupMembersFetcher);  }
@Test public void testMatchDelegatedTrustAssertionInvalidAction() { Assertion assertion = new Assertion(); assertion.setAction("READ"); assertion.setEffect(AssertionEffect.ALLOW); assertion.setResource("domain:*"); assertion.setRole("domain:role.Role"); assertFalse(AuthzHelper.matchDelegatedTrustAssertion(assertion, null, null, null, nullFetcher)); }
@Test public void testMatchDelegatedTrustAssertionNoResPatternMatchWithOutPattern() { Assertion assertion = new Assertion(); assertion.setAction("ASSUME_ROLE"); assertion.setEffect(AssertionEffect.ALLOW); assertion.setResource("domain:role.Role"); assertion.setRole("domain:role.Role"); assertFalse(AuthzHelper.matchDelegatedTrustAssertion(assertion, "domain:role.Role2", null, null, nullFetcher)); assertFalse(AuthzHelper.matchDelegatedTrustAssertion(assertion, "coretech:role.Role", null, null, nullFetcher)); }
@Test public void testMatchDelegatedTrustAssertionNoResPatternMatchWithPattern() { Assertion assertion = new Assertion(); assertion.setAction("ASSUME_ROLE"); assertion.setEffect(AssertionEffect.ALLOW); assertion.setResource("*:role.Role"); assertion.setRole("domain:role.Role"); assertFalse(AuthzHelper.matchDelegatedTrustAssertion(assertion, "domain:role.Role2", null, null, nullFetcher)); assertFalse(AuthzHelper.matchDelegatedTrustAssertion(assertion, "coretech:role.Role2", null, null, nullFetcher)); }
@Test public void testMatchDelegatedTrustAssertionNoRoleMatchWithPattern() { Assertion assertion = new Assertion(); assertion.setAction("ASSUME_ROLE"); assertion.setEffect(AssertionEffect.ALLOW); assertion.setResource("*:role.Role"); assertion.setRole("weather:role.*"); List<Role> roles = new ArrayList<>(); Role role = createRoleObject("coretech", "readers", null); roles.add(role); role = createRoleObject("coretech", "writers", null); roles.add(role); role = createRoleObject("coretech", "updaters", null); roles.add(role); assertFalse(AuthzHelper.matchDelegatedTrustAssertion(assertion, "coretech:role.Role", null, roles, nullFetcher)); }
@Test public void testMatchDelegatedTrustAssertionNoRoleMatchWithOutPattern() { Assertion assertion = new Assertion(); assertion.setAction("ASSUME_ROLE"); assertion.setEffect(AssertionEffect.ALLOW); assertion.setResource("*:role.Role"); assertion.setRole("weather:role.Role"); List<Role> roles = new ArrayList<>(); Role role = createRoleObject("coretech", "Role1", null); roles.add(role); role = createRoleObject("coretech", "Role2", null); roles.add(role); assertFalse(AuthzHelper.matchDelegatedTrustAssertion(assertion, "weather:role.Role1", null, roles, nullFetcher)); assertFalse(AuthzHelper.matchDelegatedTrustAssertion(assertion, "coretech:role.Role", null, roles, nullFetcher)); }
@Test public void testMatchDelegatedTrustAssertionNoMemberMatch() { Assertion assertion = new Assertion(); assertion.setAction("ASSUME_ROLE"); assertion.setEffect(AssertionEffect.ALLOW); assertion.setResource("*:role.Role"); assertion.setRole("weather:role.Role"); List<Role> roles = new ArrayList<>(); Role role = createRoleObject("weather", "Role1", "user.user1"); roles.add(role); role = createRoleObject("weather", "Role", "user.user2"); roles.add(role); assertFalse(AuthzHelper.matchDelegatedTrustAssertion(assertion, "weather:role.Role", "user.user1", roles, nullFetcher)); }
@Test public void testMatchDelegatedTrustAssertionValidWithPattern() { Assertion assertion = new Assertion(); assertion.setAction("ASSUME_ROLE"); assertion.setEffect(AssertionEffect.ALLOW); assertion.setResource("*:role.Role"); assertion.setRole("weather:role.*"); List<Role> roles = new ArrayList<>(); Role role = createRoleObject("weather", "Role1", "user.user1"); roles.add(role); role = createRoleObject("weather", "Role", "user.user2"); roles.add(role); assertTrue(AuthzHelper.matchDelegatedTrustAssertion(assertion, "weather:role.Role", "user.user2", roles, nullFetcher)); }
@Test public void testMatchDelegatedTrustAssertionValidWithOutPattern() { Assertion assertion = new Assertion(); assertion.setAction("ASSUME_ROLE"); assertion.setEffect(AssertionEffect.ALLOW); assertion.setResource("*:role.Role"); assertion.setRole("weather:role.Role"); List<Role> roles = new ArrayList<>(); Role role = createRoleObject("weather", "Role1", "user.user1"); roles.add(role); role = createRoleObject("weather", "Role", "user.user2"); roles.add(role); assertTrue(AuthzHelper.matchDelegatedTrustAssertion(assertion, "weather:role.Role", "user.user2", roles, nullFetcher)); }