@Test public void test_addUserToServiceAccount_failure_initialreset() { UserDetails userDetails = getMockUser(true); String token = userDetails.getClientToken(); ServiceAccountUser serviceAccountUser = new ServiceAccountUser("testacc02", "testacc01", "read"); String expectedResponse = "{\"errors\":[\"Failed to add user permission to Service account. Initial password reset is pending for this Service Account. Please reset the password and try again.\"]}"; ResponseEntity<String> responseEntityExpected = ResponseEntity.status(HttpStatus.BAD_REQUEST).body(expectedResponse); when(reqProcessor.process(eq("/sdb"),Mockito.any(),eq(token))).thenReturn(getMockResponse(HttpStatus.OK, true, "{\"data\":{\"initialPasswordReset\":false,\"managedBy\":\"smohan11\",\"name\":\"svc_vault_test5\",\"users\":{\"smohan11\":\"sudo\"}}}")); String[] latestPolicies = {"o_svcacct_testacc02"}; when(policyUtils.getCurrentPolicies(userDetails.getSelfSupportToken(), userDetails.getUsername(), userDetails)).thenReturn(latestPolicies); ResponseEntity<String> responseEntity = serviceAccountsService.addUserToServiceAccount(token, serviceAccountUser, userDetails, false); assertEquals(HttpStatus.BAD_REQUEST, responseEntity.getStatusCode()); assertEquals(responseEntityExpected, responseEntity); }
public ResponseEntity<String> addUserToServiceAccount(String token, ServiceAccountUser serviceAccountUser, UserDetails userDetails, boolean isPartOfSvcAccOnboard) { OIDCEntityResponse oidcEntityResponse = new OIDCEntityResponse(); if (!userDetails.isAdmin()) { token = tokenUtils.getSelfServiceToken(); } log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to ServiceAccount"). put(LogMessage.MESSAGE, String.format ("Trying to add user to ServiceAccount")). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); if(!isSvcaccPermissionInputValid(serviceAccountUser.getAccess())) { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid value specified for access. Valid values are read, reset, deny\"]}"); } if (serviceAccountUser.getAccess().equalsIgnoreCase("reset")) { serviceAccountUser.setAccess(TVaultConstants.WRITE_POLICY); } String userName = serviceAccountUser.getUsername(); String svcAccName = serviceAccountUser.getSvcAccName(); String access = serviceAccountUser.getAccess(); userName = (userName !=null) ? userName.toLowerCase() : userName; access = (access != null) ? access.toLowerCase(): access; boolean isAuthorized = true; if (userDetails != null) { isAuthorized = hasAddUserPermission(userDetails, svcAccName, token, isPartOfSvcAccOnboard); } if(isAuthorized){ if (!ifInitialPwdReset(token, userDetails, serviceAccountUser.getSvcAccName()) && !TVaultConstants.SUDO_POLICY.equals(serviceAccountUser.getAccess())) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to ServiceAccount"). put(LogMessage.MESSAGE, "Failed to add user permission to Service account. Initial password reset is pending for this Service Account."). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Failed to add user permission to Service account. Initial password reset is pending for this Service Account. Please reset the password and try again.\"]}"); } String policy = TVaultConstants.EMPTY; policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(access)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to Service Account"). put(LogMessage.MESSAGE, String.format ("policy is [%s]", policy)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); String r_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.READ_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); String w_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.WRITE_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); String d_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.DENY_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); String o_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.SUDO_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to Service Account"). put(LogMessage.MESSAGE, String.format ("Policies are, read - [%s], write - [%s], deny -[%s], owner - [%s]", r_policy, w_policy, d_policy, o_policy)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); Response userResponse = new Response(); if (TVaultConstants.USERPASS.equals(vaultAuthMethod)) { userResponse = reqProcessor.process("/auth/userpass/read","{\"username\":\""+userName+"\"}",token); } else if (TVaultConstants.LDAP.equals(vaultAuthMethod)){ userResponse = reqProcessor.process("/auth/ldap/users","{\"username\":\""+userName+"\"}",token); } else if (TVaultConstants.OIDC.equals(vaultAuthMethod)){ ResponseEntity<OIDCEntityResponse> responseEntity = oidcUtil.oidcFetchEntityDetails(token, userName, userDetails); if (!responseEntity.getStatusCode().equals(HttpStatus.OK)) { if (responseEntity.getStatusCode().equals(HttpStatus.FORBIDDEN)) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder() .put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()) .put(LogMessage.ACTION, "Add User to SDB") .put(LogMessage.MESSAGE, String.format("Trying to fetch OIDC user policies, failed")) .put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()) .build())); return ResponseEntity.status(HttpStatus.FORBIDDEN) .body("{\"messages\":[\"User configuration failed. Please try again.\"]}"); } return ResponseEntity.status(HttpStatus.NOT_FOUND) .body("{\"messages\":[\"User configuration failed. Invalid user\"]}"); } oidcEntityResponse.setEntityName(responseEntity.getBody().getEntityName()); oidcEntityResponse.setPolicies(responseEntity.getBody().getPolicies()); userResponse.setResponse(oidcEntityResponse.getPolicies().toString()); userResponse.setHttpstatus(responseEntity.getStatusCode()); } String responseJson=""; String groups=""; List<String> policies = new ArrayList<>(); List<String> currentpolicies = new ArrayList<>(); if(HttpStatus.OK.equals(userResponse.getHttpstatus())){ responseJson = userResponse.getResponse(); try { ObjectMapper objMapper = new ObjectMapper(); if (TVaultConstants.OIDC.equals(vaultAuthMethod)) { currentpolicies.addAll(oidcEntityResponse.getPolicies()); } else { currentpolicies = ControllerUtil.getPoliciesAsListFromJson(objMapper, responseJson); if (TVaultConstants.LDAP.equals(vaultAuthMethod)) { groups = objMapper.readTree(responseJson).get("data").get("groups").asText(); } } } catch (IOException e) { log.error(e); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to ServiceAccount"). put(LogMessage.MESSAGE, String.format ("Exception while creating currentpolicies or groups")). put(LogMessage.STACKTRACE, Arrays.toString(e.getStackTrace())). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } policies.addAll(currentpolicies); policies.remove(r_policy); policies.remove(w_policy); policies.remove(d_policy); policies.add(policy); }else{ policies.add(policy); } String policiesString = org.apache.commons.lang3.StringUtils.join(policies, ","); String currentpoliciesString = org.apache.commons.lang3.StringUtils.join(currentpolicies, ","); log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to ServiceAccount"). put(LogMessage.MESSAGE, String.format ("policies [%s] before calling configureUserpassUser/configureLDAPUser", policies)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); Response ldapConfigresponse = new Response(); if (TVaultConstants.USERPASS.equals(vaultAuthMethod)) { ldapConfigresponse = ControllerUtil.configureUserpassUser(userName, policiesString, token); } else if (TVaultConstants.LDAP.equals(vaultAuthMethod)) { ldapConfigresponse = ControllerUtil.configureLDAPUser(userName, policiesString, groups, token); } else if (TVaultConstants.OIDC.equals(vaultAuthMethod)) { try { ldapConfigresponse = oidcUtil.updateOIDCEntity(policies, oidcEntityResponse.getEntityName()); oidcUtil.renewUserToken(userDetails.getClientToken()); }catch (Exception e) { log.error(e); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)). put(LogMessage.ACTION, "Add User to SDB"). put(LogMessage.MESSAGE, String.format ("Exception while adding or updating the identity ")). put(LogMessage.STACKTRACE, Arrays.toString(e.getStackTrace())). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)). build())); } } if(ldapConfigresponse.getHttpstatus().equals(HttpStatus.NO_CONTENT) || ldapConfigresponse.getHttpstatus().equals(HttpStatus.OK)){ String path = new StringBuffer(TVaultConstants.SVC_ACC_ROLES_PATH).append(svcAccName).toString(); Map<String,String> params = new HashMap<String,String>(); params.put("type", "users"); params.put("name",serviceAccountUser.getUsername()); params.put("path",path); params.put("access",access); Response metadataResponse = ControllerUtil.updateMetadata(params,token); if(metadataResponse != null && (HttpStatus.NO_CONTENT.equals(metadataResponse.getHttpstatus()) || HttpStatus.OK.equals(metadataResponse.getHttpstatus()))){ log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to ServiceAccount"). put(LogMessage.MESSAGE, "User is successfully associated with Service Account"). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.OK).body("{\"messages\":[\"Successfully added user to the Service Account\"]}"); } else{ log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to ServiceAccount"). put(LogMessage.MESSAGE, "Metadata creation for user association with service account failed"). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); if (TVaultConstants.USERPASS.equals(vaultAuthMethod)) { ldapConfigresponse = ControllerUtil.configureUserpassUser(userName, currentpoliciesString, token); } else if (TVaultConstants.LDAP.equals(vaultAuthMethod)) { ldapConfigresponse = ControllerUtil.configureLDAPUser(userName, currentpoliciesString, groups, token); } else if (TVaultConstants.OIDC.equals(vaultAuthMethod)) { try { ldapConfigresponse = oidcUtil.updateOIDCEntity(currentpolicies, oidcEntityResponse.getEntityName()); oidcUtil.renewUserToken(userDetails.getClientToken()); } catch (Exception e) { log.error(e); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder() .put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)) .put(LogMessage.ACTION, "Add User to SDB") .put(LogMessage.MESSAGE, String.format("Exception while adding or updating the identity ")) .put(LogMessage.STACKTRACE, Arrays.toString(e.getStackTrace())) .put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)) .build())); } } if(ldapConfigresponse.getHttpstatus().equals(HttpStatus.NO_CONTENT) || ldapConfigresponse.getHttpstatus().equals(HttpStatus.OK)) { return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"messages\":[\"Failed to add user to the Service Account. Metadata update failed\"]}"); } else { return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"messages\":[\"Failed to revert user association on Service Account\"]}"); } } } else { return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"Failed to add user to the Service Account\"]}"); } }else{ return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Access denied: No permission to users to this service account\"]}"); } }
ServiceAccountsService { public ResponseEntity<String> addUserToServiceAccount(String token, ServiceAccountUser serviceAccountUser, UserDetails userDetails, boolean isPartOfSvcAccOnboard) { OIDCEntityResponse oidcEntityResponse = new OIDCEntityResponse(); if (!userDetails.isAdmin()) { token = tokenUtils.getSelfServiceToken(); } log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to ServiceAccount"). put(LogMessage.MESSAGE, String.format ("Trying to add user to ServiceAccount")). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); if(!isSvcaccPermissionInputValid(serviceAccountUser.getAccess())) { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid value specified for access. Valid values are read, reset, deny\"]}"); } if (serviceAccountUser.getAccess().equalsIgnoreCase("reset")) { serviceAccountUser.setAccess(TVaultConstants.WRITE_POLICY); } String userName = serviceAccountUser.getUsername(); String svcAccName = serviceAccountUser.getSvcAccName(); String access = serviceAccountUser.getAccess(); userName = (userName !=null) ? userName.toLowerCase() : userName; access = (access != null) ? access.toLowerCase(): access; boolean isAuthorized = true; if (userDetails != null) { isAuthorized = hasAddUserPermission(userDetails, svcAccName, token, isPartOfSvcAccOnboard); } if(isAuthorized){ if (!ifInitialPwdReset(token, userDetails, serviceAccountUser.getSvcAccName()) && !TVaultConstants.SUDO_POLICY.equals(serviceAccountUser.getAccess())) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to ServiceAccount"). put(LogMessage.MESSAGE, "Failed to add user permission to Service account. Initial password reset is pending for this Service Account."). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Failed to add user permission to Service account. Initial password reset is pending for this Service Account. Please reset the password and try again.\"]}"); } String policy = TVaultConstants.EMPTY; policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(access)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to Service Account"). put(LogMessage.MESSAGE, String.format ("policy is [%s]", policy)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); String r_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.READ_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); String w_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.WRITE_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); String d_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.DENY_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); String o_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.SUDO_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to Service Account"). put(LogMessage.MESSAGE, String.format ("Policies are, read - [%s], write - [%s], deny -[%s], owner - [%s]", r_policy, w_policy, d_policy, o_policy)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); Response userResponse = new Response(); if (TVaultConstants.USERPASS.equals(vaultAuthMethod)) { userResponse = reqProcessor.process("/auth/userpass/read","{\"username\":\""+userName+"\"}",token); } else if (TVaultConstants.LDAP.equals(vaultAuthMethod)){ userResponse = reqProcessor.process("/auth/ldap/users","{\"username\":\""+userName+"\"}",token); } else if (TVaultConstants.OIDC.equals(vaultAuthMethod)){ ResponseEntity<OIDCEntityResponse> responseEntity = oidcUtil.oidcFetchEntityDetails(token, userName, userDetails); if (!responseEntity.getStatusCode().equals(HttpStatus.OK)) { if (responseEntity.getStatusCode().equals(HttpStatus.FORBIDDEN)) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder() .put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()) .put(LogMessage.ACTION, "Add User to SDB") .put(LogMessage.MESSAGE, String.format("Trying to fetch OIDC user policies, failed")) .put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()) .build())); return ResponseEntity.status(HttpStatus.FORBIDDEN) .body("{\"messages\":[\"User configuration failed. Please try again.\"]}"); } return ResponseEntity.status(HttpStatus.NOT_FOUND) .body("{\"messages\":[\"User configuration failed. Invalid user\"]}"); } oidcEntityResponse.setEntityName(responseEntity.getBody().getEntityName()); oidcEntityResponse.setPolicies(responseEntity.getBody().getPolicies()); userResponse.setResponse(oidcEntityResponse.getPolicies().toString()); userResponse.setHttpstatus(responseEntity.getStatusCode()); } String responseJson=""; String groups=""; List<String> policies = new ArrayList<>(); List<String> currentpolicies = new ArrayList<>(); if(HttpStatus.OK.equals(userResponse.getHttpstatus())){ responseJson = userResponse.getResponse(); try { ObjectMapper objMapper = new ObjectMapper(); if (TVaultConstants.OIDC.equals(vaultAuthMethod)) { currentpolicies.addAll(oidcEntityResponse.getPolicies()); } else { currentpolicies = ControllerUtil.getPoliciesAsListFromJson(objMapper, responseJson); if (TVaultConstants.LDAP.equals(vaultAuthMethod)) { groups = objMapper.readTree(responseJson).get("data").get("groups").asText(); } } } catch (IOException e) { log.error(e); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to ServiceAccount"). put(LogMessage.MESSAGE, String.format ("Exception while creating currentpolicies or groups")). put(LogMessage.STACKTRACE, Arrays.toString(e.getStackTrace())). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } policies.addAll(currentpolicies); policies.remove(r_policy); policies.remove(w_policy); policies.remove(d_policy); policies.add(policy); }else{ policies.add(policy); } String policiesString = org.apache.commons.lang3.StringUtils.join(policies, ","); String currentpoliciesString = org.apache.commons.lang3.StringUtils.join(currentpolicies, ","); log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to ServiceAccount"). put(LogMessage.MESSAGE, String.format ("policies [%s] before calling configureUserpassUser/configureLDAPUser", policies)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); Response ldapConfigresponse = new Response(); if (TVaultConstants.USERPASS.equals(vaultAuthMethod)) { ldapConfigresponse = ControllerUtil.configureUserpassUser(userName, policiesString, token); } else if (TVaultConstants.LDAP.equals(vaultAuthMethod)) { ldapConfigresponse = ControllerUtil.configureLDAPUser(userName, policiesString, groups, token); } else if (TVaultConstants.OIDC.equals(vaultAuthMethod)) { try { ldapConfigresponse = oidcUtil.updateOIDCEntity(policies, oidcEntityResponse.getEntityName()); oidcUtil.renewUserToken(userDetails.getClientToken()); }catch (Exception e) { log.error(e); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)). put(LogMessage.ACTION, "Add User to SDB"). put(LogMessage.MESSAGE, String.format ("Exception while adding or updating the identity ")). put(LogMessage.STACKTRACE, Arrays.toString(e.getStackTrace())). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)). build())); } } if(ldapConfigresponse.getHttpstatus().equals(HttpStatus.NO_CONTENT) || ldapConfigresponse.getHttpstatus().equals(HttpStatus.OK)){ String path = new StringBuffer(TVaultConstants.SVC_ACC_ROLES_PATH).append(svcAccName).toString(); Map<String,String> params = new HashMap<String,String>(); params.put("type", "users"); params.put("name",serviceAccountUser.getUsername()); params.put("path",path); params.put("access",access); Response metadataResponse = ControllerUtil.updateMetadata(params,token); if(metadataResponse != null && (HttpStatus.NO_CONTENT.equals(metadataResponse.getHttpstatus()) || HttpStatus.OK.equals(metadataResponse.getHttpstatus()))){ log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to ServiceAccount"). put(LogMessage.MESSAGE, "User is successfully associated with Service Account"). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.OK).body("{\"messages\":[\"Successfully added user to the Service Account\"]}"); } else{ log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to ServiceAccount"). put(LogMessage.MESSAGE, "Metadata creation for user association with service account failed"). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); if (TVaultConstants.USERPASS.equals(vaultAuthMethod)) { ldapConfigresponse = ControllerUtil.configureUserpassUser(userName, currentpoliciesString, token); } else if (TVaultConstants.LDAP.equals(vaultAuthMethod)) { ldapConfigresponse = ControllerUtil.configureLDAPUser(userName, currentpoliciesString, groups, token); } else if (TVaultConstants.OIDC.equals(vaultAuthMethod)) { try { ldapConfigresponse = oidcUtil.updateOIDCEntity(currentpolicies, oidcEntityResponse.getEntityName()); oidcUtil.renewUserToken(userDetails.getClientToken()); } catch (Exception e) { log.error(e); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder() .put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)) .put(LogMessage.ACTION, "Add User to SDB") .put(LogMessage.MESSAGE, String.format("Exception while adding or updating the identity ")) .put(LogMessage.STACKTRACE, Arrays.toString(e.getStackTrace())) .put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)) .build())); } } if(ldapConfigresponse.getHttpstatus().equals(HttpStatus.NO_CONTENT) || ldapConfigresponse.getHttpstatus().equals(HttpStatus.OK)) { return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"messages\":[\"Failed to add user to the Service Account. Metadata update failed\"]}"); } else { return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"messages\":[\"Failed to revert user association on Service Account\"]}"); } } } else { return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"Failed to add user to the Service Account\"]}"); } }else{ return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Access denied: No permission to users to this service account\"]}"); } } }
ServiceAccountsService { public ResponseEntity<String> addUserToServiceAccount(String token, ServiceAccountUser serviceAccountUser, UserDetails userDetails, boolean isPartOfSvcAccOnboard) { OIDCEntityResponse oidcEntityResponse = new OIDCEntityResponse(); if (!userDetails.isAdmin()) { token = tokenUtils.getSelfServiceToken(); } log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to ServiceAccount"). put(LogMessage.MESSAGE, String.format ("Trying to add user to ServiceAccount")). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); if(!isSvcaccPermissionInputValid(serviceAccountUser.getAccess())) { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid value specified for access. Valid values are read, reset, deny\"]}"); } if (serviceAccountUser.getAccess().equalsIgnoreCase("reset")) { serviceAccountUser.setAccess(TVaultConstants.WRITE_POLICY); } String userName = serviceAccountUser.getUsername(); String svcAccName = serviceAccountUser.getSvcAccName(); String access = serviceAccountUser.getAccess(); userName = (userName !=null) ? userName.toLowerCase() : userName; access = (access != null) ? access.toLowerCase(): access; boolean isAuthorized = true; if (userDetails != null) { isAuthorized = hasAddUserPermission(userDetails, svcAccName, token, isPartOfSvcAccOnboard); } if(isAuthorized){ if (!ifInitialPwdReset(token, userDetails, serviceAccountUser.getSvcAccName()) && !TVaultConstants.SUDO_POLICY.equals(serviceAccountUser.getAccess())) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to ServiceAccount"). put(LogMessage.MESSAGE, "Failed to add user permission to Service account. Initial password reset is pending for this Service Account."). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Failed to add user permission to Service account. Initial password reset is pending for this Service Account. Please reset the password and try again.\"]}"); } String policy = TVaultConstants.EMPTY; policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(access)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to Service Account"). put(LogMessage.MESSAGE, String.format ("policy is [%s]", policy)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); String r_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.READ_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); String w_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.WRITE_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); String d_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.DENY_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); String o_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.SUDO_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to Service Account"). put(LogMessage.MESSAGE, String.format ("Policies are, read - [%s], write - [%s], deny -[%s], owner - [%s]", r_policy, w_policy, d_policy, o_policy)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); Response userResponse = new Response(); if (TVaultConstants.USERPASS.equals(vaultAuthMethod)) { userResponse = reqProcessor.process("/auth/userpass/read","{\"username\":\""+userName+"\"}",token); } else if (TVaultConstants.LDAP.equals(vaultAuthMethod)){ userResponse = reqProcessor.process("/auth/ldap/users","{\"username\":\""+userName+"\"}",token); } else if (TVaultConstants.OIDC.equals(vaultAuthMethod)){ ResponseEntity<OIDCEntityResponse> responseEntity = oidcUtil.oidcFetchEntityDetails(token, userName, userDetails); if (!responseEntity.getStatusCode().equals(HttpStatus.OK)) { if (responseEntity.getStatusCode().equals(HttpStatus.FORBIDDEN)) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder() .put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()) .put(LogMessage.ACTION, "Add User to SDB") .put(LogMessage.MESSAGE, String.format("Trying to fetch OIDC user policies, failed")) .put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()) .build())); return ResponseEntity.status(HttpStatus.FORBIDDEN) .body("{\"messages\":[\"User configuration failed. Please try again.\"]}"); } return ResponseEntity.status(HttpStatus.NOT_FOUND) .body("{\"messages\":[\"User configuration failed. Invalid user\"]}"); } oidcEntityResponse.setEntityName(responseEntity.getBody().getEntityName()); oidcEntityResponse.setPolicies(responseEntity.getBody().getPolicies()); userResponse.setResponse(oidcEntityResponse.getPolicies().toString()); userResponse.setHttpstatus(responseEntity.getStatusCode()); } String responseJson=""; String groups=""; List<String> policies = new ArrayList<>(); List<String> currentpolicies = new ArrayList<>(); if(HttpStatus.OK.equals(userResponse.getHttpstatus())){ responseJson = userResponse.getResponse(); try { ObjectMapper objMapper = new ObjectMapper(); if (TVaultConstants.OIDC.equals(vaultAuthMethod)) { currentpolicies.addAll(oidcEntityResponse.getPolicies()); } else { currentpolicies = ControllerUtil.getPoliciesAsListFromJson(objMapper, responseJson); if (TVaultConstants.LDAP.equals(vaultAuthMethod)) { groups = objMapper.readTree(responseJson).get("data").get("groups").asText(); } } } catch (IOException e) { log.error(e); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to ServiceAccount"). put(LogMessage.MESSAGE, String.format ("Exception while creating currentpolicies or groups")). put(LogMessage.STACKTRACE, Arrays.toString(e.getStackTrace())). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } policies.addAll(currentpolicies); policies.remove(r_policy); policies.remove(w_policy); policies.remove(d_policy); policies.add(policy); }else{ policies.add(policy); } String policiesString = org.apache.commons.lang3.StringUtils.join(policies, ","); String currentpoliciesString = org.apache.commons.lang3.StringUtils.join(currentpolicies, ","); log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to ServiceAccount"). put(LogMessage.MESSAGE, String.format ("policies [%s] before calling configureUserpassUser/configureLDAPUser", policies)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); Response ldapConfigresponse = new Response(); if (TVaultConstants.USERPASS.equals(vaultAuthMethod)) { ldapConfigresponse = ControllerUtil.configureUserpassUser(userName, policiesString, token); } else if (TVaultConstants.LDAP.equals(vaultAuthMethod)) { ldapConfigresponse = ControllerUtil.configureLDAPUser(userName, policiesString, groups, token); } else if (TVaultConstants.OIDC.equals(vaultAuthMethod)) { try { ldapConfigresponse = oidcUtil.updateOIDCEntity(policies, oidcEntityResponse.getEntityName()); oidcUtil.renewUserToken(userDetails.getClientToken()); }catch (Exception e) { log.error(e); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)). put(LogMessage.ACTION, "Add User to SDB"). put(LogMessage.MESSAGE, String.format ("Exception while adding or updating the identity ")). put(LogMessage.STACKTRACE, Arrays.toString(e.getStackTrace())). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)). build())); } } if(ldapConfigresponse.getHttpstatus().equals(HttpStatus.NO_CONTENT) || ldapConfigresponse.getHttpstatus().equals(HttpStatus.OK)){ String path = new StringBuffer(TVaultConstants.SVC_ACC_ROLES_PATH).append(svcAccName).toString(); Map<String,String> params = new HashMap<String,String>(); params.put("type", "users"); params.put("name",serviceAccountUser.getUsername()); params.put("path",path); params.put("access",access); Response metadataResponse = ControllerUtil.updateMetadata(params,token); if(metadataResponse != null && (HttpStatus.NO_CONTENT.equals(metadataResponse.getHttpstatus()) || HttpStatus.OK.equals(metadataResponse.getHttpstatus()))){ log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to ServiceAccount"). put(LogMessage.MESSAGE, "User is successfully associated with Service Account"). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.OK).body("{\"messages\":[\"Successfully added user to the Service Account\"]}"); } else{ log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to ServiceAccount"). put(LogMessage.MESSAGE, "Metadata creation for user association with service account failed"). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); if (TVaultConstants.USERPASS.equals(vaultAuthMethod)) { ldapConfigresponse = ControllerUtil.configureUserpassUser(userName, currentpoliciesString, token); } else if (TVaultConstants.LDAP.equals(vaultAuthMethod)) { ldapConfigresponse = ControllerUtil.configureLDAPUser(userName, currentpoliciesString, groups, token); } else if (TVaultConstants.OIDC.equals(vaultAuthMethod)) { try { ldapConfigresponse = oidcUtil.updateOIDCEntity(currentpolicies, oidcEntityResponse.getEntityName()); oidcUtil.renewUserToken(userDetails.getClientToken()); } catch (Exception e) { log.error(e); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder() .put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)) .put(LogMessage.ACTION, "Add User to SDB") .put(LogMessage.MESSAGE, String.format("Exception while adding or updating the identity ")) .put(LogMessage.STACKTRACE, Arrays.toString(e.getStackTrace())) .put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)) .build())); } } if(ldapConfigresponse.getHttpstatus().equals(HttpStatus.NO_CONTENT) || ldapConfigresponse.getHttpstatus().equals(HttpStatus.OK)) { return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"messages\":[\"Failed to add user to the Service Account. Metadata update failed\"]}"); } else { return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"messages\":[\"Failed to revert user association on Service Account\"]}"); } } } else { return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"Failed to add user to the Service Account\"]}"); } }else{ return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Access denied: No permission to users to this service account\"]}"); } }  }
ServiceAccountsService { public ResponseEntity<String> addUserToServiceAccount(String token, ServiceAccountUser serviceAccountUser, UserDetails userDetails, boolean isPartOfSvcAccOnboard) { OIDCEntityResponse oidcEntityResponse = new OIDCEntityResponse(); if (!userDetails.isAdmin()) { token = tokenUtils.getSelfServiceToken(); } log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to ServiceAccount"). put(LogMessage.MESSAGE, String.format ("Trying to add user to ServiceAccount")). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); if(!isSvcaccPermissionInputValid(serviceAccountUser.getAccess())) { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid value specified for access. Valid values are read, reset, deny\"]}"); } if (serviceAccountUser.getAccess().equalsIgnoreCase("reset")) { serviceAccountUser.setAccess(TVaultConstants.WRITE_POLICY); } String userName = serviceAccountUser.getUsername(); String svcAccName = serviceAccountUser.getSvcAccName(); String access = serviceAccountUser.getAccess(); userName = (userName !=null) ? userName.toLowerCase() : userName; access = (access != null) ? access.toLowerCase(): access; boolean isAuthorized = true; if (userDetails != null) { isAuthorized = hasAddUserPermission(userDetails, svcAccName, token, isPartOfSvcAccOnboard); } if(isAuthorized){ if (!ifInitialPwdReset(token, userDetails, serviceAccountUser.getSvcAccName()) && !TVaultConstants.SUDO_POLICY.equals(serviceAccountUser.getAccess())) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to ServiceAccount"). put(LogMessage.MESSAGE, "Failed to add user permission to Service account. Initial password reset is pending for this Service Account."). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Failed to add user permission to Service account. Initial password reset is pending for this Service Account. Please reset the password and try again.\"]}"); } String policy = TVaultConstants.EMPTY; policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(access)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to Service Account"). put(LogMessage.MESSAGE, String.format ("policy is [%s]", policy)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); String r_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.READ_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); String w_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.WRITE_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); String d_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.DENY_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); String o_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.SUDO_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to Service Account"). put(LogMessage.MESSAGE, String.format ("Policies are, read - [%s], write - [%s], deny -[%s], owner - [%s]", r_policy, w_policy, d_policy, o_policy)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); Response userResponse = new Response(); if (TVaultConstants.USERPASS.equals(vaultAuthMethod)) { userResponse = reqProcessor.process("/auth/userpass/read","{\"username\":\""+userName+"\"}",token); } else if (TVaultConstants.LDAP.equals(vaultAuthMethod)){ userResponse = reqProcessor.process("/auth/ldap/users","{\"username\":\""+userName+"\"}",token); } else if (TVaultConstants.OIDC.equals(vaultAuthMethod)){ ResponseEntity<OIDCEntityResponse> responseEntity = oidcUtil.oidcFetchEntityDetails(token, userName, userDetails); if (!responseEntity.getStatusCode().equals(HttpStatus.OK)) { if (responseEntity.getStatusCode().equals(HttpStatus.FORBIDDEN)) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder() .put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()) .put(LogMessage.ACTION, "Add User to SDB") .put(LogMessage.MESSAGE, String.format("Trying to fetch OIDC user policies, failed")) .put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()) .build())); return ResponseEntity.status(HttpStatus.FORBIDDEN) .body("{\"messages\":[\"User configuration failed. Please try again.\"]}"); } return ResponseEntity.status(HttpStatus.NOT_FOUND) .body("{\"messages\":[\"User configuration failed. Invalid user\"]}"); } oidcEntityResponse.setEntityName(responseEntity.getBody().getEntityName()); oidcEntityResponse.setPolicies(responseEntity.getBody().getPolicies()); userResponse.setResponse(oidcEntityResponse.getPolicies().toString()); userResponse.setHttpstatus(responseEntity.getStatusCode()); } String responseJson=""; String groups=""; List<String> policies = new ArrayList<>(); List<String> currentpolicies = new ArrayList<>(); if(HttpStatus.OK.equals(userResponse.getHttpstatus())){ responseJson = userResponse.getResponse(); try { ObjectMapper objMapper = new ObjectMapper(); if (TVaultConstants.OIDC.equals(vaultAuthMethod)) { currentpolicies.addAll(oidcEntityResponse.getPolicies()); } else { currentpolicies = ControllerUtil.getPoliciesAsListFromJson(objMapper, responseJson); if (TVaultConstants.LDAP.equals(vaultAuthMethod)) { groups = objMapper.readTree(responseJson).get("data").get("groups").asText(); } } } catch (IOException e) { log.error(e); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to ServiceAccount"). put(LogMessage.MESSAGE, String.format ("Exception while creating currentpolicies or groups")). put(LogMessage.STACKTRACE, Arrays.toString(e.getStackTrace())). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } policies.addAll(currentpolicies); policies.remove(r_policy); policies.remove(w_policy); policies.remove(d_policy); policies.add(policy); }else{ policies.add(policy); } String policiesString = org.apache.commons.lang3.StringUtils.join(policies, ","); String currentpoliciesString = org.apache.commons.lang3.StringUtils.join(currentpolicies, ","); log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to ServiceAccount"). put(LogMessage.MESSAGE, String.format ("policies [%s] before calling configureUserpassUser/configureLDAPUser", policies)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); Response ldapConfigresponse = new Response(); if (TVaultConstants.USERPASS.equals(vaultAuthMethod)) { ldapConfigresponse = ControllerUtil.configureUserpassUser(userName, policiesString, token); } else if (TVaultConstants.LDAP.equals(vaultAuthMethod)) { ldapConfigresponse = ControllerUtil.configureLDAPUser(userName, policiesString, groups, token); } else if (TVaultConstants.OIDC.equals(vaultAuthMethod)) { try { ldapConfigresponse = oidcUtil.updateOIDCEntity(policies, oidcEntityResponse.getEntityName()); oidcUtil.renewUserToken(userDetails.getClientToken()); }catch (Exception e) { log.error(e); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)). put(LogMessage.ACTION, "Add User to SDB"). put(LogMessage.MESSAGE, String.format ("Exception while adding or updating the identity ")). put(LogMessage.STACKTRACE, Arrays.toString(e.getStackTrace())). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)). build())); } } if(ldapConfigresponse.getHttpstatus().equals(HttpStatus.NO_CONTENT) || ldapConfigresponse.getHttpstatus().equals(HttpStatus.OK)){ String path = new StringBuffer(TVaultConstants.SVC_ACC_ROLES_PATH).append(svcAccName).toString(); Map<String,String> params = new HashMap<String,String>(); params.put("type", "users"); params.put("name",serviceAccountUser.getUsername()); params.put("path",path); params.put("access",access); Response metadataResponse = ControllerUtil.updateMetadata(params,token); if(metadataResponse != null && (HttpStatus.NO_CONTENT.equals(metadataResponse.getHttpstatus()) || HttpStatus.OK.equals(metadataResponse.getHttpstatus()))){ log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to ServiceAccount"). put(LogMessage.MESSAGE, "User is successfully associated with Service Account"). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.OK).body("{\"messages\":[\"Successfully added user to the Service Account\"]}"); } else{ log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to ServiceAccount"). put(LogMessage.MESSAGE, "Metadata creation for user association with service account failed"). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); if (TVaultConstants.USERPASS.equals(vaultAuthMethod)) { ldapConfigresponse = ControllerUtil.configureUserpassUser(userName, currentpoliciesString, token); } else if (TVaultConstants.LDAP.equals(vaultAuthMethod)) { ldapConfigresponse = ControllerUtil.configureLDAPUser(userName, currentpoliciesString, groups, token); } else if (TVaultConstants.OIDC.equals(vaultAuthMethod)) { try { ldapConfigresponse = oidcUtil.updateOIDCEntity(currentpolicies, oidcEntityResponse.getEntityName()); oidcUtil.renewUserToken(userDetails.getClientToken()); } catch (Exception e) { log.error(e); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder() .put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)) .put(LogMessage.ACTION, "Add User to SDB") .put(LogMessage.MESSAGE, String.format("Exception while adding or updating the identity ")) .put(LogMessage.STACKTRACE, Arrays.toString(e.getStackTrace())) .put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)) .build())); } } if(ldapConfigresponse.getHttpstatus().equals(HttpStatus.NO_CONTENT) || ldapConfigresponse.getHttpstatus().equals(HttpStatus.OK)) { return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"messages\":[\"Failed to add user to the Service Account. Metadata update failed\"]}"); } else { return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"messages\":[\"Failed to revert user association on Service Account\"]}"); } } } else { return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"Failed to add user to the Service Account\"]}"); } }else{ return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Access denied: No permission to users to this service account\"]}"); } }  ResponseEntity<ADServiceAccountObjects> getADServiceAccounts(String token, UserDetails userDetails, String UserPrincipalName, boolean excludeOnboarded); ResponseEntity<String> onboardServiceAccount(String token, ServiceAccount serviceAccount, UserDetails userDetails); ResponseEntity<String> offboardServiceAccount(String token, OnboardedServiceAccount serviceAccount, UserDetails userDetails); ResponseEntity<String> addUserToServiceAccount(String token, ServiceAccountUser serviceAccountUser, UserDetails userDetails, boolean isPartOfSvcAccOnboard); ResponseEntity<String> removeUserFromServiceAccount(String token, ServiceAccountUser serviceAccountUser, UserDetails userDetails); ResponseEntity<String> resetSvcAccPassword(String token, String svcAccName, UserDetails userDetails); ResponseEntity<String> readSvcAccPassword(String token, String svcAccName, UserDetails userDetails); ResponseEntity<String> getOnboarderdServiceAccount(String token, String svcAccName, UserDetails userDetails); boolean canAddOrRemoveUser(UserDetails userDetails, ServiceAccountUser serviceAccountUser, String action); ResponseEntity<String> getOnboardedServiceAccounts(String token,  UserDetails userDetails); boolean hasAddOrRemovePermission(UserDetails userDetails, String serviceAccount, String token); boolean hasAddUserPermission(UserDetails userDetails, String serviceAccount, String token, boolean isPartOfSvcAccOnboard); static boolean isSvcaccPermissionInputValid(String access); ResponseEntity<String> addGroupToServiceAccount(String token, ServiceAccountGroup serviceAccountGroup, UserDetails userDetails); ResponseEntity<String> removeGroupFromServiceAccount(String token, ServiceAccountGroup serviceAccountGroup, UserDetails userDetails); ResponseEntity<String> associateApproletoSvcAcc(UserDetails userDetails, String token, ServiceAccountApprole serviceAccountApprole); ResponseEntity<String> getServiceAccountMeta(String token, UserDetails userDetails, String path); ResponseEntity<String> removeApproleFromSvcAcc(UserDetails userDetails, String token, ServiceAccountApprole serviceAccountApprole); ResponseEntity<String> addAwsRoleToSvcacc(UserDetails userDetails, String token, ServiceAccountAWSRole serviceAccountAWSRole); ResponseEntity<String> removeAWSRoleFromSvcacc(UserDetails userDetails, String token, ServiceAccountAWSRole serviceAccountAWSRole); ResponseEntity<String> createAWSRole(UserDetails userDetails, String token, AWSLoginRole awsLoginRole); ResponseEntity<String> createIAMRole(UserDetails userDetails, String token, AWSIAMRole awsiamRole); ResponseEntity<String> updateOnboardedServiceAccount(String token, ServiceAccount serviceAccount, UserDetails userDetails); ResponseEntity<String> transferSvcAccountOwner(UserDetails userDetails, String token, String svcAccName); ResponseEntity<String> getServiceAccounts(UserDetails userDetails, String userToken); }
ServiceAccountsService { public ResponseEntity<String> addUserToServiceAccount(String token, ServiceAccountUser serviceAccountUser, UserDetails userDetails, boolean isPartOfSvcAccOnboard) { OIDCEntityResponse oidcEntityResponse = new OIDCEntityResponse(); if (!userDetails.isAdmin()) { token = tokenUtils.getSelfServiceToken(); } log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to ServiceAccount"). put(LogMessage.MESSAGE, String.format ("Trying to add user to ServiceAccount")). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); if(!isSvcaccPermissionInputValid(serviceAccountUser.getAccess())) { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid value specified for access. Valid values are read, reset, deny\"]}"); } if (serviceAccountUser.getAccess().equalsIgnoreCase("reset")) { serviceAccountUser.setAccess(TVaultConstants.WRITE_POLICY); } String userName = serviceAccountUser.getUsername(); String svcAccName = serviceAccountUser.getSvcAccName(); String access = serviceAccountUser.getAccess(); userName = (userName !=null) ? userName.toLowerCase() : userName; access = (access != null) ? access.toLowerCase(): access; boolean isAuthorized = true; if (userDetails != null) { isAuthorized = hasAddUserPermission(userDetails, svcAccName, token, isPartOfSvcAccOnboard); } if(isAuthorized){ if (!ifInitialPwdReset(token, userDetails, serviceAccountUser.getSvcAccName()) && !TVaultConstants.SUDO_POLICY.equals(serviceAccountUser.getAccess())) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to ServiceAccount"). put(LogMessage.MESSAGE, "Failed to add user permission to Service account. Initial password reset is pending for this Service Account."). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Failed to add user permission to Service account. Initial password reset is pending for this Service Account. Please reset the password and try again.\"]}"); } String policy = TVaultConstants.EMPTY; policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(access)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to Service Account"). put(LogMessage.MESSAGE, String.format ("policy is [%s]", policy)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); String r_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.READ_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); String w_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.WRITE_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); String d_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.DENY_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); String o_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.SUDO_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to Service Account"). put(LogMessage.MESSAGE, String.format ("Policies are, read - [%s], write - [%s], deny -[%s], owner - [%s]", r_policy, w_policy, d_policy, o_policy)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); Response userResponse = new Response(); if (TVaultConstants.USERPASS.equals(vaultAuthMethod)) { userResponse = reqProcessor.process("/auth/userpass/read","{\"username\":\""+userName+"\"}",token); } else if (TVaultConstants.LDAP.equals(vaultAuthMethod)){ userResponse = reqProcessor.process("/auth/ldap/users","{\"username\":\""+userName+"\"}",token); } else if (TVaultConstants.OIDC.equals(vaultAuthMethod)){ ResponseEntity<OIDCEntityResponse> responseEntity = oidcUtil.oidcFetchEntityDetails(token, userName, userDetails); if (!responseEntity.getStatusCode().equals(HttpStatus.OK)) { if (responseEntity.getStatusCode().equals(HttpStatus.FORBIDDEN)) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder() .put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()) .put(LogMessage.ACTION, "Add User to SDB") .put(LogMessage.MESSAGE, String.format("Trying to fetch OIDC user policies, failed")) .put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()) .build())); return ResponseEntity.status(HttpStatus.FORBIDDEN) .body("{\"messages\":[\"User configuration failed. Please try again.\"]}"); } return ResponseEntity.status(HttpStatus.NOT_FOUND) .body("{\"messages\":[\"User configuration failed. Invalid user\"]}"); } oidcEntityResponse.setEntityName(responseEntity.getBody().getEntityName()); oidcEntityResponse.setPolicies(responseEntity.getBody().getPolicies()); userResponse.setResponse(oidcEntityResponse.getPolicies().toString()); userResponse.setHttpstatus(responseEntity.getStatusCode()); } String responseJson=""; String groups=""; List<String> policies = new ArrayList<>(); List<String> currentpolicies = new ArrayList<>(); if(HttpStatus.OK.equals(userResponse.getHttpstatus())){ responseJson = userResponse.getResponse(); try { ObjectMapper objMapper = new ObjectMapper(); if (TVaultConstants.OIDC.equals(vaultAuthMethod)) { currentpolicies.addAll(oidcEntityResponse.getPolicies()); } else { currentpolicies = ControllerUtil.getPoliciesAsListFromJson(objMapper, responseJson); if (TVaultConstants.LDAP.equals(vaultAuthMethod)) { groups = objMapper.readTree(responseJson).get("data").get("groups").asText(); } } } catch (IOException e) { log.error(e); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to ServiceAccount"). put(LogMessage.MESSAGE, String.format ("Exception while creating currentpolicies or groups")). put(LogMessage.STACKTRACE, Arrays.toString(e.getStackTrace())). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } policies.addAll(currentpolicies); policies.remove(r_policy); policies.remove(w_policy); policies.remove(d_policy); policies.add(policy); }else{ policies.add(policy); } String policiesString = org.apache.commons.lang3.StringUtils.join(policies, ","); String currentpoliciesString = org.apache.commons.lang3.StringUtils.join(currentpolicies, ","); log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to ServiceAccount"). put(LogMessage.MESSAGE, String.format ("policies [%s] before calling configureUserpassUser/configureLDAPUser", policies)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); Response ldapConfigresponse = new Response(); if (TVaultConstants.USERPASS.equals(vaultAuthMethod)) { ldapConfigresponse = ControllerUtil.configureUserpassUser(userName, policiesString, token); } else if (TVaultConstants.LDAP.equals(vaultAuthMethod)) { ldapConfigresponse = ControllerUtil.configureLDAPUser(userName, policiesString, groups, token); } else if (TVaultConstants.OIDC.equals(vaultAuthMethod)) { try { ldapConfigresponse = oidcUtil.updateOIDCEntity(policies, oidcEntityResponse.getEntityName()); oidcUtil.renewUserToken(userDetails.getClientToken()); }catch (Exception e) { log.error(e); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)). put(LogMessage.ACTION, "Add User to SDB"). put(LogMessage.MESSAGE, String.format ("Exception while adding or updating the identity ")). put(LogMessage.STACKTRACE, Arrays.toString(e.getStackTrace())). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)). build())); } } if(ldapConfigresponse.getHttpstatus().equals(HttpStatus.NO_CONTENT) || ldapConfigresponse.getHttpstatus().equals(HttpStatus.OK)){ String path = new StringBuffer(TVaultConstants.SVC_ACC_ROLES_PATH).append(svcAccName).toString(); Map<String,String> params = new HashMap<String,String>(); params.put("type", "users"); params.put("name",serviceAccountUser.getUsername()); params.put("path",path); params.put("access",access); Response metadataResponse = ControllerUtil.updateMetadata(params,token); if(metadataResponse != null && (HttpStatus.NO_CONTENT.equals(metadataResponse.getHttpstatus()) || HttpStatus.OK.equals(metadataResponse.getHttpstatus()))){ log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to ServiceAccount"). put(LogMessage.MESSAGE, "User is successfully associated with Service Account"). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.OK).body("{\"messages\":[\"Successfully added user to the Service Account\"]}"); } else{ log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Add User to ServiceAccount"). put(LogMessage.MESSAGE, "Metadata creation for user association with service account failed"). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); if (TVaultConstants.USERPASS.equals(vaultAuthMethod)) { ldapConfigresponse = ControllerUtil.configureUserpassUser(userName, currentpoliciesString, token); } else if (TVaultConstants.LDAP.equals(vaultAuthMethod)) { ldapConfigresponse = ControllerUtil.configureLDAPUser(userName, currentpoliciesString, groups, token); } else if (TVaultConstants.OIDC.equals(vaultAuthMethod)) { try { ldapConfigresponse = oidcUtil.updateOIDCEntity(currentpolicies, oidcEntityResponse.getEntityName()); oidcUtil.renewUserToken(userDetails.getClientToken()); } catch (Exception e) { log.error(e); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder() .put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)) .put(LogMessage.ACTION, "Add User to SDB") .put(LogMessage.MESSAGE, String.format("Exception while adding or updating the identity ")) .put(LogMessage.STACKTRACE, Arrays.toString(e.getStackTrace())) .put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)) .build())); } } if(ldapConfigresponse.getHttpstatus().equals(HttpStatus.NO_CONTENT) || ldapConfigresponse.getHttpstatus().equals(HttpStatus.OK)) { return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"messages\":[\"Failed to add user to the Service Account. Metadata update failed\"]}"); } else { return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"messages\":[\"Failed to revert user association on Service Account\"]}"); } } } else { return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"Failed to add user to the Service Account\"]}"); } }else{ return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Access denied: No permission to users to this service account\"]}"); } }  ResponseEntity<ADServiceAccountObjects> getADServiceAccounts(String token, UserDetails userDetails, String UserPrincipalName, boolean excludeOnboarded); ResponseEntity<String> onboardServiceAccount(String token, ServiceAccount serviceAccount, UserDetails userDetails); ResponseEntity<String> offboardServiceAccount(String token, OnboardedServiceAccount serviceAccount, UserDetails userDetails); ResponseEntity<String> addUserToServiceAccount(String token, ServiceAccountUser serviceAccountUser, UserDetails userDetails, boolean isPartOfSvcAccOnboard); ResponseEntity<String> removeUserFromServiceAccount(String token, ServiceAccountUser serviceAccountUser, UserDetails userDetails); ResponseEntity<String> resetSvcAccPassword(String token, String svcAccName, UserDetails userDetails); ResponseEntity<String> readSvcAccPassword(String token, String svcAccName, UserDetails userDetails); ResponseEntity<String> getOnboarderdServiceAccount(String token, String svcAccName, UserDetails userDetails); boolean canAddOrRemoveUser(UserDetails userDetails, ServiceAccountUser serviceAccountUser, String action); ResponseEntity<String> getOnboardedServiceAccounts(String token,  UserDetails userDetails); boolean hasAddOrRemovePermission(UserDetails userDetails, String serviceAccount, String token); boolean hasAddUserPermission(UserDetails userDetails, String serviceAccount, String token, boolean isPartOfSvcAccOnboard); static boolean isSvcaccPermissionInputValid(String access); ResponseEntity<String> addGroupToServiceAccount(String token, ServiceAccountGroup serviceAccountGroup, UserDetails userDetails); ResponseEntity<String> removeGroupFromServiceAccount(String token, ServiceAccountGroup serviceAccountGroup, UserDetails userDetails); ResponseEntity<String> associateApproletoSvcAcc(UserDetails userDetails, String token, ServiceAccountApprole serviceAccountApprole); ResponseEntity<String> getServiceAccountMeta(String token, UserDetails userDetails, String path); ResponseEntity<String> removeApproleFromSvcAcc(UserDetails userDetails, String token, ServiceAccountApprole serviceAccountApprole); ResponseEntity<String> addAwsRoleToSvcacc(UserDetails userDetails, String token, ServiceAccountAWSRole serviceAccountAWSRole); ResponseEntity<String> removeAWSRoleFromSvcacc(UserDetails userDetails, String token, ServiceAccountAWSRole serviceAccountAWSRole); ResponseEntity<String> createAWSRole(UserDetails userDetails, String token, AWSLoginRole awsLoginRole); ResponseEntity<String> createIAMRole(UserDetails userDetails, String token, AWSIAMRole awsiamRole); ResponseEntity<String> updateOnboardedServiceAccount(String token, ServiceAccount serviceAccount, UserDetails userDetails); ResponseEntity<String> transferSvcAccountOwner(UserDetails userDetails, String token, String svcAccName); ResponseEntity<String> getServiceAccounts(UserDetails userDetails, String userToken);  }