ServiceAccountsService { public ResponseEntity<String> readSvcAccPassword(String token, String svcAccName, UserDetails userDetails){ ServiceAccountMetadataDetails metadataDetails = getServiceAccountMetadataDetails(token, userDetails, svcAccName); if (userDetails.getUsername().equalsIgnoreCase(metadataDetails.getManagedBy()) && !metadataDetails.getInitialPasswordReset()) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "readSvcAccPassword"). put(LogMessage.MESSAGE, "Failed to read service account password. Initial password reset is pending for this Service Account."). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Failed to read service account password. Initial password reset is pending for this Service Account. Please reset the password and try again.\"]}"); } Response response = reqProcessor.process("/ad/serviceaccount/readpwd","{\"role_name\":\""+svcAccName+"\"}",token); ADServiceAccountCreds adServiceAccountCreds = null; if (HttpStatus.OK.equals(response.getHttpstatus())) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "readSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Successfully read the password details for the service account [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); try { adServiceAccountCreds = new ADServiceAccountCreds(); Map<String, Object> requestParams = new ObjectMapper().readValue(response.getResponse(), new TypeReference<Map<String, Object>>(){}); if (requestParams.get("current_password") != null) { adServiceAccountCreds.setCurrent_password((String) requestParams.get("current_password")); } if (requestParams.get("username") != null) { adServiceAccountCreds.setUsername((String) requestParams.get("username")); } if (requestParams.get("last_password") != null ) { adServiceAccountCreds.setLast_password((String) requestParams.get("last_password")); } return ResponseEntity.status(HttpStatus.OK).body(JSONUtil.getJSON(adServiceAccountCreds)); } catch(Exception ex) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "readSvcAccPassword"). put(LogMessage.MESSAGE, String.format("There are no service accounts currently onboarded or error in retrieving credentials for the onboarded service account [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to get password details for the given service account\"]}"); } else if (HttpStatus.FORBIDDEN.equals(response.getHttpstatus())) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "readSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Permission denied to read password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.FORBIDDEN).body("{\"errors\":[\"Access denied: no permission to read the password details for the given service account\"]}"); } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "readSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Unable to read password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to get password details for the given service account\"]}"); } }  ResponseEntity<ADServiceAccountObjects> getADServiceAccounts(String token, UserDetails userDetails, String UserPrincipalName, boolean excludeOnboarded); ResponseEntity<String> onboardServiceAccount(String token, ServiceAccount serviceAccount, UserDetails userDetails); ResponseEntity<String> offboardServiceAccount(String token, OnboardedServiceAccount serviceAccount, UserDetails userDetails); ResponseEntity<String> addUserToServiceAccount(String token, ServiceAccountUser serviceAccountUser, UserDetails userDetails, boolean isPartOfSvcAccOnboard); ResponseEntity<String> removeUserFromServiceAccount(String token, ServiceAccountUser serviceAccountUser, UserDetails userDetails); ResponseEntity<String> resetSvcAccPassword(String token, String svcAccName, UserDetails userDetails); ResponseEntity<String> readSvcAccPassword(String token, String svcAccName, UserDetails userDetails); ResponseEntity<String> getOnboarderdServiceAccount(String token, String svcAccName, UserDetails userDetails); boolean canAddOrRemoveUser(UserDetails userDetails, ServiceAccountUser serviceAccountUser, String action); ResponseEntity<String> getOnboardedServiceAccounts(String token,  UserDetails userDetails); boolean hasAddOrRemovePermission(UserDetails userDetails, String serviceAccount, String token); boolean hasAddUserPermission(UserDetails userDetails, String serviceAccount, String token, boolean isPartOfSvcAccOnboard); static boolean isSvcaccPermissionInputValid(String access); ResponseEntity<String> addGroupToServiceAccount(String token, ServiceAccountGroup serviceAccountGroup, UserDetails userDetails); ResponseEntity<String> removeGroupFromServiceAccount(String token, ServiceAccountGroup serviceAccountGroup, UserDetails userDetails); ResponseEntity<String> associateApproletoSvcAcc(UserDetails userDetails, String token, ServiceAccountApprole serviceAccountApprole); ResponseEntity<String> getServiceAccountMeta(String token, UserDetails userDetails, String path); ResponseEntity<String> removeApproleFromSvcAcc(UserDetails userDetails, String token, ServiceAccountApprole serviceAccountApprole); ResponseEntity<String> addAwsRoleToSvcacc(UserDetails userDetails, String token, ServiceAccountAWSRole serviceAccountAWSRole); ResponseEntity<String> removeAWSRoleFromSvcacc(UserDetails userDetails, String token, ServiceAccountAWSRole serviceAccountAWSRole); ResponseEntity<String> createAWSRole(UserDetails userDetails, String token, AWSLoginRole awsLoginRole); ResponseEntity<String> createIAMRole(UserDetails userDetails, String token, AWSIAMRole awsiamRole); ResponseEntity<String> updateOnboardedServiceAccount(String token, ServiceAccount serviceAccount, UserDetails userDetails); ResponseEntity<String> transferSvcAccountOwner(UserDetails userDetails, String token, String svcAccName); ResponseEntity<String> getServiceAccounts(UserDetails userDetails, String userToken);  }
@Test public void test_readSvcAccPassword_success() { UserDetails userDetails = getMockUser(true); String token = userDetails.getClientToken(); String svcAccName = "testacc03"; ADServiceAccountCreds adServiceAccountCreds = new ADServiceAccountCreds(); adServiceAccountCreds.setCurrent_password("current_password"); adServiceAccountCreds.setLast_password("last_password"); adServiceAccountCreds.setUsername(svcAccName); String expectedOutput = getJSON(adServiceAccountCreds); Response pwdReadResponse = getMockResponse(HttpStatus.OK, true,expectedOutput); when(JSONUtil.getJSON(Mockito.any(ADServiceAccountCreds.class))).thenReturn(expectedOutput); when(reqProcessor.process("/ad/serviceaccount/readpwd","{\"role_name\":\""+svcAccName+"\"}",token)).thenReturn(pwdReadResponse); when(JSONUtil.getJSON(Mockito.any(ADServiceAccountCreds.class))).thenReturn(expectedOutput); ResponseEntity<String> responseEntityExpected = ResponseEntity.status(HttpStatus.OK).body(expectedOutput); when(reqProcessor.process(eq("/sdb"),Mockito.any(),eq(token))).thenReturn(getMockResponse(HttpStatus.OK, true, "{\"data\":{\"initialPasswordReset\":true,\"managedBy\":\"normaluser\",\"name\":\"svc_vault_test5\",\"users\":{\"normaluser\":\"sudo\"}}}")); ResponseEntity<String> responseEntity = serviceAccountsService.readSvcAccPassword(token, svcAccName, userDetails); assertEquals(HttpStatus.OK, responseEntity.getStatusCode()); assertEquals(responseEntityExpected, responseEntity); }
@Test public void test_readSvcAccPassword_failed_activation_pending() { UserDetails userDetails = getMockUser(true); String token = userDetails.getClientToken(); String svcAccName = "testacc03"; when(reqProcessor.process(eq("/sdb"),Mockito.any(),eq(token))).thenReturn(getMockResponse(HttpStatus.OK, true, "{\"data\":{\"initialPasswordReset\":true,\"managedBy\":\"smohan11\",\"name\":\"svc_vault_test5\",\"users\":{\"smohan11\":\"sudo\"}}}")); ResponseEntity<String> responseEntityExpected = ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Failed to read service account password. Initial password reset is pending for this Service Account. Please reset the password and try again.\"]}"); when(reqProcessor.process(eq("/sdb"),Mockito.any(),eq(token))).thenReturn(getMockResponse(HttpStatus.OK, true, "{\"data\":{\"initialPasswordReset\":false,\"managedBy\":\"normaluser\",\"name\":\"svc_vault_test5\",\"users\":{\"normaluser\":\"sudo\"}}}")); Response response = getMockResponse(HttpStatus.OK, true, "{\"data\":{\"initialPasswordReset\":false,\"managedBy\":\"normaluser\",\"name\":\"svc_vault_test5\",\"users\":{\"normaluser\":\"sudo\"}}}"); String _path = TVaultConstants.SVC_ACC_ROLES_PATH + svcAccName; when(reqProcessor.process("/sdb","{\"path\":\""+_path+"\"}",token)).thenReturn(response); ResponseEntity<String> responseEntity = serviceAccountsService.readSvcAccPassword(token, svcAccName, userDetails); assertEquals(HttpStatus.BAD_REQUEST, responseEntity.getStatusCode()); assertEquals(responseEntityExpected, responseEntity); }
@Test public void test_readSvcAccPassword_403() { UserDetails userDetails = getMockUser(true); String token = userDetails.getClientToken(); String svcAccName = "testacc03"; Response pwdReadResponse = getMockResponse(HttpStatus.FORBIDDEN, true,""); when(reqProcessor.process("/ad/serviceaccount/readpwd","{\"role_name\":\""+svcAccName+"\"}",token)).thenReturn(pwdReadResponse); ResponseEntity<String> responseEntityExpected = ResponseEntity.status(HttpStatus.FORBIDDEN).body("{\"errors\":[\"Access denied: no permission to read the password details for the given service account\"]}"); when(reqProcessor.process(eq("/sdb"),Mockito.any(),eq(token))).thenReturn(getMockResponse(HttpStatus.OK, true, "{\"data\":{\"initialPasswordReset\":true,\"managedBy\":\"normaluser\",\"name\":\"svc_vault_test5\",\"users\":{\"normaluser\":\"sudo\"}}}")); ResponseEntity<String> responseEntity = serviceAccountsService.readSvcAccPassword(token, svcAccName, userDetails); assertEquals(HttpStatus.FORBIDDEN, responseEntity.getStatusCode()); assertEquals(responseEntityExpected, responseEntity); }
@Test public void test_readSvcAccPassword_400() { UserDetails userDetails = getMockUser(true); String token = userDetails.getClientToken(); String svcAccName = "testacc03"; Response pwdReadResponse = getMockResponse(HttpStatus.BAD_REQUEST, true,""); when(reqProcessor.process("/ad/serviceaccount/readpwd","{\"role_name\":\""+svcAccName+"\"}",token)).thenReturn(pwdReadResponse); ResponseEntity<String> responseEntityExpected = ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to get password details for the given service account\"]}"); when(reqProcessor.process(eq("/sdb"),Mockito.any(),eq(token))).thenReturn(getMockResponse(HttpStatus.OK, true, "{\"data\":{\"initialPasswordReset\":true,\"managedBy\":\"normaluser\",\"name\":\"svc_vault_test5\",\"users\":{\"normaluser\":\"sudo\"}}}")); ResponseEntity<String> responseEntity = serviceAccountsService.readSvcAccPassword(token, svcAccName, userDetails); assertEquals(HttpStatus.BAD_REQUEST, responseEntity.getStatusCode()); assertEquals(responseEntityExpected, responseEntity); }