@Test (expected = AccessDeniedException.class) public void testNoSamlRoles() { Set<Entity> seoas = new HashSet<Entity>(); seoas.add(createSEOA("LEA1", "IT Admin")); seoas.add(createSEOA("LEA1", "Educator")); seoas.add(createSEOA("LEA2", "Educator")); Mockito.when(edorgHelper.locateNonExpiredSEOAs(Mockito.anyString())).thenReturn(seoas); Map<String, List<String>> edOrgRoles = edOrgRoleBuilder.buildValidStaffRoles(realmId, staffId, tenant, new ArrayList<String>()); Assert.assertTrue(edOrgRoles.isEmpty()); }
public Map<String, List<String>> buildValidStaffRoles(String realmId, String staffId, String tenant, List<String> roles) { Set<String> samlRoleSet = new HashSet<String>(roles); Set<Entity> staffEdOrgAssoc = edorgHelper.locateNonExpiredSEOAs(staffId); if (staffEdOrgAssoc.size() == 0) { LOG.error("Attempted login by a user that did not include any current valid roles in the SAML Assertion."); throw new APIAccessDeniedException("Invalid user. User is not currently associated with any school/edorg", true); } Map<String, List<String>> sliEdOrgRoleMap = buildEdOrgContextualRoles(staffEdOrgAssoc, samlRoleSet); if(sliEdOrgRoleMap.isEmpty()) { LOG.error("Attempted login by a user that did not include any valid roles in the SAML Assertion."); throw new APIAccessDeniedException("Invalid user. No valid roles specified for user.", true); } for (Map.Entry<String, List<String>> entry : sliEdOrgRoleMap.entrySet()) { sliEdOrgRoleMap.put(entry.getKey(), getRoleNameList(resolver.mapRoles(tenant, realmId, entry.getValue(), false))); } if (isInValidRoleMap(sliEdOrgRoleMap)) { LOG.error("Attempted login by a user that included no roles in the SAML Assertion that mapped to any of the SLI roles."); throw new APIAccessDeniedException( "Invalid user. No valid role mappings exist for the roles specified in the SAML Assertion.", true); } return sliEdOrgRoleMap; }
EdOrgContextualRoleBuilder { public Map<String, List<String>> buildValidStaffRoles(String realmId, String staffId, String tenant, List<String> roles) { Set<String> samlRoleSet = new HashSet<String>(roles); Set<Entity> staffEdOrgAssoc = edorgHelper.locateNonExpiredSEOAs(staffId); if (staffEdOrgAssoc.size() == 0) { LOG.error("Attempted login by a user that did not include any current valid roles in the SAML Assertion."); throw new APIAccessDeniedException("Invalid user. User is not currently associated with any school/edorg", true); } Map<String, List<String>> sliEdOrgRoleMap = buildEdOrgContextualRoles(staffEdOrgAssoc, samlRoleSet); if(sliEdOrgRoleMap.isEmpty()) { LOG.error("Attempted login by a user that did not include any valid roles in the SAML Assertion."); throw new APIAccessDeniedException("Invalid user. No valid roles specified for user.", true); } for (Map.Entry<String, List<String>> entry : sliEdOrgRoleMap.entrySet()) { sliEdOrgRoleMap.put(entry.getKey(), getRoleNameList(resolver.mapRoles(tenant, realmId, entry.getValue(), false))); } if (isInValidRoleMap(sliEdOrgRoleMap)) { LOG.error("Attempted login by a user that included no roles in the SAML Assertion that mapped to any of the SLI roles."); throw new APIAccessDeniedException( "Invalid user. No valid role mappings exist for the roles specified in the SAML Assertion.", true); } return sliEdOrgRoleMap; } }
EdOrgContextualRoleBuilder { public Map<String, List<String>> buildValidStaffRoles(String realmId, String staffId, String tenant, List<String> roles) { Set<String> samlRoleSet = new HashSet<String>(roles); Set<Entity> staffEdOrgAssoc = edorgHelper.locateNonExpiredSEOAs(staffId); if (staffEdOrgAssoc.size() == 0) { LOG.error("Attempted login by a user that did not include any current valid roles in the SAML Assertion."); throw new APIAccessDeniedException("Invalid user. User is not currently associated with any school/edorg", true); } Map<String, List<String>> sliEdOrgRoleMap = buildEdOrgContextualRoles(staffEdOrgAssoc, samlRoleSet); if(sliEdOrgRoleMap.isEmpty()) { LOG.error("Attempted login by a user that did not include any valid roles in the SAML Assertion."); throw new APIAccessDeniedException("Invalid user. No valid roles specified for user.", true); } for (Map.Entry<String, List<String>> entry : sliEdOrgRoleMap.entrySet()) { sliEdOrgRoleMap.put(entry.getKey(), getRoleNameList(resolver.mapRoles(tenant, realmId, entry.getValue(), false))); } if (isInValidRoleMap(sliEdOrgRoleMap)) { LOG.error("Attempted login by a user that included no roles in the SAML Assertion that mapped to any of the SLI roles."); throw new APIAccessDeniedException( "Invalid user. No valid role mappings exist for the roles specified in the SAML Assertion.", true); } return sliEdOrgRoleMap; }  }
EdOrgContextualRoleBuilder { public Map<String, List<String>> buildValidStaffRoles(String realmId, String staffId, String tenant, List<String> roles) { Set<String> samlRoleSet = new HashSet<String>(roles); Set<Entity> staffEdOrgAssoc = edorgHelper.locateNonExpiredSEOAs(staffId); if (staffEdOrgAssoc.size() == 0) { LOG.error("Attempted login by a user that did not include any current valid roles in the SAML Assertion."); throw new APIAccessDeniedException("Invalid user. User is not currently associated with any school/edorg", true); } Map<String, List<String>> sliEdOrgRoleMap = buildEdOrgContextualRoles(staffEdOrgAssoc, samlRoleSet); if(sliEdOrgRoleMap.isEmpty()) { LOG.error("Attempted login by a user that did not include any valid roles in the SAML Assertion."); throw new APIAccessDeniedException("Invalid user. No valid roles specified for user.", true); } for (Map.Entry<String, List<String>> entry : sliEdOrgRoleMap.entrySet()) { sliEdOrgRoleMap.put(entry.getKey(), getRoleNameList(resolver.mapRoles(tenant, realmId, entry.getValue(), false))); } if (isInValidRoleMap(sliEdOrgRoleMap)) { LOG.error("Attempted login by a user that included no roles in the SAML Assertion that mapped to any of the SLI roles."); throw new APIAccessDeniedException( "Invalid user. No valid role mappings exist for the roles specified in the SAML Assertion.", true); } return sliEdOrgRoleMap; }  Map<String, List<String>> buildValidStaffRoles(String realmId, String staffId, String tenant, List<String> roles); }
EdOrgContextualRoleBuilder { public Map<String, List<String>> buildValidStaffRoles(String realmId, String staffId, String tenant, List<String> roles) { Set<String> samlRoleSet = new HashSet<String>(roles); Set<Entity> staffEdOrgAssoc = edorgHelper.locateNonExpiredSEOAs(staffId); if (staffEdOrgAssoc.size() == 0) { LOG.error("Attempted login by a user that did not include any current valid roles in the SAML Assertion."); throw new APIAccessDeniedException("Invalid user. User is not currently associated with any school/edorg", true); } Map<String, List<String>> sliEdOrgRoleMap = buildEdOrgContextualRoles(staffEdOrgAssoc, samlRoleSet); if(sliEdOrgRoleMap.isEmpty()) { LOG.error("Attempted login by a user that did not include any valid roles in the SAML Assertion."); throw new APIAccessDeniedException("Invalid user. No valid roles specified for user.", true); } for (Map.Entry<String, List<String>> entry : sliEdOrgRoleMap.entrySet()) { sliEdOrgRoleMap.put(entry.getKey(), getRoleNameList(resolver.mapRoles(tenant, realmId, entry.getValue(), false))); } if (isInValidRoleMap(sliEdOrgRoleMap)) { LOG.error("Attempted login by a user that included no roles in the SAML Assertion that mapped to any of the SLI roles."); throw new APIAccessDeniedException( "Invalid user. No valid role mappings exist for the roles specified in the SAML Assertion.", true); } return sliEdOrgRoleMap; }  Map<String, List<String>> buildValidStaffRoles(String realmId, String staffId, String tenant, List<String> roles);  }