@Test public void test_removeAWSRoleFromSvcacc_failure_initialreset() throws Exception { ResponseEntity<String> responseEntityExpected = ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Failed to remove awsrole permission from Service account. Initial password reset is pending for this Service Account. Please reset the password and try again.\"]}"); String token = "5PDrOhsy4ig8L3EpsJZSLAMg"; UserDetails userDetails = getMockUser(false); ServiceAccountAWSRole serviceAccountAWSRole = new ServiceAccountAWSRole("testsvcname", "role1", "reset"); when(tokenUtils.getSelfServiceToken()).thenReturn("5PDrOhsy4ig8L3EpsJZSLAMg"); when(reqProcessor.process(eq("/sdb"),Mockito.any(),eq(token))).thenReturn(getMockResponse(HttpStatus.OK, true, "{\"data\":{\"initialPasswordReset\":false,\"managedBy\":\"smohan11\",\"name\":\"svc_vault_test5\",\"users\":{\"smohan11\":\"sudo\"}}}")); String[] latestPolicies = {"o_svcacct_testsvcname"}; when(policyUtils.getCurrentPolicies(userDetails.getSelfSupportToken(), userDetails.getUsername(), userDetails)).thenReturn(latestPolicies); ResponseEntity<String> responseEntityActual = serviceAccountsService.removeAWSRoleFromSvcacc(userDetails, token, serviceAccountAWSRole); assertEquals(HttpStatus.BAD_REQUEST, responseEntityActual.getStatusCode()); assertEquals(responseEntityExpected, responseEntityActual); }
public ResponseEntity<String> removeAWSRoleFromSvcacc(UserDetails userDetails, String token, ServiceAccountAWSRole serviceAccountAWSRole) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWS Role from Service Account"). put(LogMessage.MESSAGE, String.format ("Trying to remove AWS Role from Service Account [%s]", serviceAccountAWSRole.getRolename())). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); if (!userDetails.isAdmin()) { token = tokenUtils.getSelfServiceToken(); } if(!isSvcaccPermissionInputValid(serviceAccountAWSRole.getAccess())) { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid value specified for access. Valid values are read, reset, deny\"]}"); } if (serviceAccountAWSRole.getAccess().equalsIgnoreCase("reset")) { serviceAccountAWSRole.setAccess(TVaultConstants.WRITE_POLICY); } String roleName = serviceAccountAWSRole.getRolename(); String svcAccName = serviceAccountAWSRole.getSvcAccName(); String access = serviceAccountAWSRole.getAccess(); roleName = (roleName !=null) ? roleName.toLowerCase() : roleName; access = (access != null) ? access.toLowerCase(): access; boolean isAuthorized = hasAddOrRemovePermission(userDetails, svcAccName, token); if (isAuthorized) { if (!ifInitialPwdReset(token, userDetails, serviceAccountAWSRole.getSvcAccName())) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWSRole from ServiceAccount"). put(LogMessage.MESSAGE, "Failed to remove awsrole permission from Service account. Initial password reset is pending for this Service Account."). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Failed to remove awsrole permission from Service account. Initial password reset is pending for this Service Account. Please reset the password and try again.\"]}"); } String r_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.READ_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); String w_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.WRITE_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); String d_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.DENY_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); String o_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.SUDO_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWS Role from Service Account"). put(LogMessage.MESSAGE, String.format ("Policies are, read - [%s], write - [%s], deny -[%s], owner - [%s]", r_policy, w_policy, d_policy, o_policy)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); Response roleResponse = reqProcessor.process("/auth/aws/roles","{\"role\":\""+roleName+"\"}",token); String responseJson=""; String auth_type = TVaultConstants.EC2; List<String> policies = new ArrayList<>(); List<String> currentpolicies = new ArrayList<>(); if(HttpStatus.OK.equals(roleResponse.getHttpstatus())){ responseJson = roleResponse.getResponse(); ObjectMapper objMapper = new ObjectMapper(); try { JsonNode policiesArry =objMapper.readTree(responseJson).get("policies"); for(JsonNode policyNode : policiesArry){ currentpolicies.add(policyNode.asText()); } auth_type = objMapper.readTree(responseJson).get("auth_type").asText(); } catch (IOException e) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWS Role from Service Account"). put(LogMessage.MESSAGE, e.getMessage()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } policies.addAll(currentpolicies); policies.remove(r_policy); policies.remove(w_policy); policies.remove(d_policy); } else{ return ResponseEntity.status(HttpStatus.UNPROCESSABLE_ENTITY).body("{\"errors\":[\"AppRole doesn't exist\"]}"); } String policiesString = org.apache.commons.lang3.StringUtils.join(policies, ","); String currentpoliciesString = org.apache.commons.lang3.StringUtils.join(currentpolicies, ","); log.info(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWS Role from Service account"). put(LogMessage.MESSAGE, "Remove AWS Role from Service account - policy :" + policiesString + " is being configured" ). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); Response awsRoleConfigresponse = null; if (TVaultConstants.IAM.equals(auth_type)) { awsRoleConfigresponse = awsiamAuthService.configureAWSIAMRole(roleName,policiesString,token); } else { awsRoleConfigresponse = awsAuthService.configureAWSRole(roleName,policiesString,token); } if(awsRoleConfigresponse.getHttpstatus().equals(HttpStatus.NO_CONTENT) || awsRoleConfigresponse.getHttpstatus().equals(HttpStatus.OK)){ String path = new StringBuffer(TVaultConstants.SVC_ACC_ROLES_PATH).append(svcAccName).toString(); Map<String,String> params = new HashMap<String,String>(); params.put("type", "aws-roles"); params.put("name",roleName); params.put("path",path); params.put("access","delete"); Response metadataResponse = ControllerUtil.updateMetadata(params,token); if(metadataResponse !=null && (HttpStatus.NO_CONTENT.equals(metadataResponse.getHttpstatus()) || HttpStatus.OK.equals(metadataResponse.getHttpstatus()))){ log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWS Role from Service Account"). put(LogMessage.MESSAGE, "AWS Role configuration Success."). put(LogMessage.STATUS, metadataResponse.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.OK).body("{\"messages\":[\"AWS Role is successfully removed from Service Account\"]}"); } if (TVaultConstants.IAM.equals(auth_type)) { awsRoleConfigresponse = awsiamAuthService.configureAWSIAMRole(roleName,currentpoliciesString,token); } else { awsRoleConfigresponse = awsAuthService.configureAWSRole(roleName,currentpoliciesString,token); } if(awsRoleConfigresponse.getHttpstatus().equals(HttpStatus.NO_CONTENT)){ log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWS Role from Service Account"). put(LogMessage.MESSAGE, "Reverting, AWS Role policy update success"). put(LogMessage.RESPONSE, (null!=metadataResponse)?metadataResponse.getResponse():TVaultConstants.EMPTY). put(LogMessage.STATUS, (null!=metadataResponse)?metadataResponse.getHttpstatus().toString():TVaultConstants.EMPTY). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"AWS Role configuration failed. Please try again\"]}"); }else{ log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AppRole from Service Account"). put(LogMessage.MESSAGE, "Reverting approle policy update failed"). put(LogMessage.RESPONSE, (null!=metadataResponse)?metadataResponse.getResponse():TVaultConstants.EMPTY). put(LogMessage.STATUS, (null!=metadataResponse)?metadataResponse.getHttpstatus().toString():TVaultConstants.EMPTY). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"AWS Role configuration failed. Contact Admin \"]}"); } } else { return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"Failed to remove AWS Role from the Service Account\"]}"); } } else { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Access denied: No permission to remove AWS Role from Service Account\"]}"); } }
ServiceAccountsService { public ResponseEntity<String> removeAWSRoleFromSvcacc(UserDetails userDetails, String token, ServiceAccountAWSRole serviceAccountAWSRole) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWS Role from Service Account"). put(LogMessage.MESSAGE, String.format ("Trying to remove AWS Role from Service Account [%s]", serviceAccountAWSRole.getRolename())). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); if (!userDetails.isAdmin()) { token = tokenUtils.getSelfServiceToken(); } if(!isSvcaccPermissionInputValid(serviceAccountAWSRole.getAccess())) { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid value specified for access. Valid values are read, reset, deny\"]}"); } if (serviceAccountAWSRole.getAccess().equalsIgnoreCase("reset")) { serviceAccountAWSRole.setAccess(TVaultConstants.WRITE_POLICY); } String roleName = serviceAccountAWSRole.getRolename(); String svcAccName = serviceAccountAWSRole.getSvcAccName(); String access = serviceAccountAWSRole.getAccess(); roleName = (roleName !=null) ? roleName.toLowerCase() : roleName; access = (access != null) ? access.toLowerCase(): access; boolean isAuthorized = hasAddOrRemovePermission(userDetails, svcAccName, token); if (isAuthorized) { if (!ifInitialPwdReset(token, userDetails, serviceAccountAWSRole.getSvcAccName())) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWSRole from ServiceAccount"). put(LogMessage.MESSAGE, "Failed to remove awsrole permission from Service account. Initial password reset is pending for this Service Account."). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Failed to remove awsrole permission from Service account. Initial password reset is pending for this Service Account. Please reset the password and try again.\"]}"); } String r_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.READ_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); String w_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.WRITE_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); String d_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.DENY_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); String o_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.SUDO_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWS Role from Service Account"). put(LogMessage.MESSAGE, String.format ("Policies are, read - [%s], write - [%s], deny -[%s], owner - [%s]", r_policy, w_policy, d_policy, o_policy)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); Response roleResponse = reqProcessor.process("/auth/aws/roles","{\"role\":\""+roleName+"\"}",token); String responseJson=""; String auth_type = TVaultConstants.EC2; List<String> policies = new ArrayList<>(); List<String> currentpolicies = new ArrayList<>(); if(HttpStatus.OK.equals(roleResponse.getHttpstatus())){ responseJson = roleResponse.getResponse(); ObjectMapper objMapper = new ObjectMapper(); try { JsonNode policiesArry =objMapper.readTree(responseJson).get("policies"); for(JsonNode policyNode : policiesArry){ currentpolicies.add(policyNode.asText()); } auth_type = objMapper.readTree(responseJson).get("auth_type").asText(); } catch (IOException e) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWS Role from Service Account"). put(LogMessage.MESSAGE, e.getMessage()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } policies.addAll(currentpolicies); policies.remove(r_policy); policies.remove(w_policy); policies.remove(d_policy); } else{ return ResponseEntity.status(HttpStatus.UNPROCESSABLE_ENTITY).body("{\"errors\":[\"AppRole doesn't exist\"]}"); } String policiesString = org.apache.commons.lang3.StringUtils.join(policies, ","); String currentpoliciesString = org.apache.commons.lang3.StringUtils.join(currentpolicies, ","); log.info(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWS Role from Service account"). put(LogMessage.MESSAGE, "Remove AWS Role from Service account - policy :" + policiesString + " is being configured" ). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); Response awsRoleConfigresponse = null; if (TVaultConstants.IAM.equals(auth_type)) { awsRoleConfigresponse = awsiamAuthService.configureAWSIAMRole(roleName,policiesString,token); } else { awsRoleConfigresponse = awsAuthService.configureAWSRole(roleName,policiesString,token); } if(awsRoleConfigresponse.getHttpstatus().equals(HttpStatus.NO_CONTENT) || awsRoleConfigresponse.getHttpstatus().equals(HttpStatus.OK)){ String path = new StringBuffer(TVaultConstants.SVC_ACC_ROLES_PATH).append(svcAccName).toString(); Map<String,String> params = new HashMap<String,String>(); params.put("type", "aws-roles"); params.put("name",roleName); params.put("path",path); params.put("access","delete"); Response metadataResponse = ControllerUtil.updateMetadata(params,token); if(metadataResponse !=null && (HttpStatus.NO_CONTENT.equals(metadataResponse.getHttpstatus()) || HttpStatus.OK.equals(metadataResponse.getHttpstatus()))){ log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWS Role from Service Account"). put(LogMessage.MESSAGE, "AWS Role configuration Success."). put(LogMessage.STATUS, metadataResponse.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.OK).body("{\"messages\":[\"AWS Role is successfully removed from Service Account\"]}"); } if (TVaultConstants.IAM.equals(auth_type)) { awsRoleConfigresponse = awsiamAuthService.configureAWSIAMRole(roleName,currentpoliciesString,token); } else { awsRoleConfigresponse = awsAuthService.configureAWSRole(roleName,currentpoliciesString,token); } if(awsRoleConfigresponse.getHttpstatus().equals(HttpStatus.NO_CONTENT)){ log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWS Role from Service Account"). put(LogMessage.MESSAGE, "Reverting, AWS Role policy update success"). put(LogMessage.RESPONSE, (null!=metadataResponse)?metadataResponse.getResponse():TVaultConstants.EMPTY). put(LogMessage.STATUS, (null!=metadataResponse)?metadataResponse.getHttpstatus().toString():TVaultConstants.EMPTY). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"AWS Role configuration failed. Please try again\"]}"); }else{ log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AppRole from Service Account"). put(LogMessage.MESSAGE, "Reverting approle policy update failed"). put(LogMessage.RESPONSE, (null!=metadataResponse)?metadataResponse.getResponse():TVaultConstants.EMPTY). put(LogMessage.STATUS, (null!=metadataResponse)?metadataResponse.getHttpstatus().toString():TVaultConstants.EMPTY). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"AWS Role configuration failed. Contact Admin \"]}"); } } else { return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"Failed to remove AWS Role from the Service Account\"]}"); } } else { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Access denied: No permission to remove AWS Role from Service Account\"]}"); } } }
ServiceAccountsService { public ResponseEntity<String> removeAWSRoleFromSvcacc(UserDetails userDetails, String token, ServiceAccountAWSRole serviceAccountAWSRole) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWS Role from Service Account"). put(LogMessage.MESSAGE, String.format ("Trying to remove AWS Role from Service Account [%s]", serviceAccountAWSRole.getRolename())). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); if (!userDetails.isAdmin()) { token = tokenUtils.getSelfServiceToken(); } if(!isSvcaccPermissionInputValid(serviceAccountAWSRole.getAccess())) { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid value specified for access. Valid values are read, reset, deny\"]}"); } if (serviceAccountAWSRole.getAccess().equalsIgnoreCase("reset")) { serviceAccountAWSRole.setAccess(TVaultConstants.WRITE_POLICY); } String roleName = serviceAccountAWSRole.getRolename(); String svcAccName = serviceAccountAWSRole.getSvcAccName(); String access = serviceAccountAWSRole.getAccess(); roleName = (roleName !=null) ? roleName.toLowerCase() : roleName; access = (access != null) ? access.toLowerCase(): access; boolean isAuthorized = hasAddOrRemovePermission(userDetails, svcAccName, token); if (isAuthorized) { if (!ifInitialPwdReset(token, userDetails, serviceAccountAWSRole.getSvcAccName())) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWSRole from ServiceAccount"). put(LogMessage.MESSAGE, "Failed to remove awsrole permission from Service account. Initial password reset is pending for this Service Account."). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Failed to remove awsrole permission from Service account. Initial password reset is pending for this Service Account. Please reset the password and try again.\"]}"); } String r_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.READ_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); String w_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.WRITE_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); String d_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.DENY_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); String o_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.SUDO_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWS Role from Service Account"). put(LogMessage.MESSAGE, String.format ("Policies are, read - [%s], write - [%s], deny -[%s], owner - [%s]", r_policy, w_policy, d_policy, o_policy)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); Response roleResponse = reqProcessor.process("/auth/aws/roles","{\"role\":\""+roleName+"\"}",token); String responseJson=""; String auth_type = TVaultConstants.EC2; List<String> policies = new ArrayList<>(); List<String> currentpolicies = new ArrayList<>(); if(HttpStatus.OK.equals(roleResponse.getHttpstatus())){ responseJson = roleResponse.getResponse(); ObjectMapper objMapper = new ObjectMapper(); try { JsonNode policiesArry =objMapper.readTree(responseJson).get("policies"); for(JsonNode policyNode : policiesArry){ currentpolicies.add(policyNode.asText()); } auth_type = objMapper.readTree(responseJson).get("auth_type").asText(); } catch (IOException e) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWS Role from Service Account"). put(LogMessage.MESSAGE, e.getMessage()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } policies.addAll(currentpolicies); policies.remove(r_policy); policies.remove(w_policy); policies.remove(d_policy); } else{ return ResponseEntity.status(HttpStatus.UNPROCESSABLE_ENTITY).body("{\"errors\":[\"AppRole doesn't exist\"]}"); } String policiesString = org.apache.commons.lang3.StringUtils.join(policies, ","); String currentpoliciesString = org.apache.commons.lang3.StringUtils.join(currentpolicies, ","); log.info(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWS Role from Service account"). put(LogMessage.MESSAGE, "Remove AWS Role from Service account - policy :" + policiesString + " is being configured" ). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); Response awsRoleConfigresponse = null; if (TVaultConstants.IAM.equals(auth_type)) { awsRoleConfigresponse = awsiamAuthService.configureAWSIAMRole(roleName,policiesString,token); } else { awsRoleConfigresponse = awsAuthService.configureAWSRole(roleName,policiesString,token); } if(awsRoleConfigresponse.getHttpstatus().equals(HttpStatus.NO_CONTENT) || awsRoleConfigresponse.getHttpstatus().equals(HttpStatus.OK)){ String path = new StringBuffer(TVaultConstants.SVC_ACC_ROLES_PATH).append(svcAccName).toString(); Map<String,String> params = new HashMap<String,String>(); params.put("type", "aws-roles"); params.put("name",roleName); params.put("path",path); params.put("access","delete"); Response metadataResponse = ControllerUtil.updateMetadata(params,token); if(metadataResponse !=null && (HttpStatus.NO_CONTENT.equals(metadataResponse.getHttpstatus()) || HttpStatus.OK.equals(metadataResponse.getHttpstatus()))){ log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWS Role from Service Account"). put(LogMessage.MESSAGE, "AWS Role configuration Success."). put(LogMessage.STATUS, metadataResponse.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.OK).body("{\"messages\":[\"AWS Role is successfully removed from Service Account\"]}"); } if (TVaultConstants.IAM.equals(auth_type)) { awsRoleConfigresponse = awsiamAuthService.configureAWSIAMRole(roleName,currentpoliciesString,token); } else { awsRoleConfigresponse = awsAuthService.configureAWSRole(roleName,currentpoliciesString,token); } if(awsRoleConfigresponse.getHttpstatus().equals(HttpStatus.NO_CONTENT)){ log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWS Role from Service Account"). put(LogMessage.MESSAGE, "Reverting, AWS Role policy update success"). put(LogMessage.RESPONSE, (null!=metadataResponse)?metadataResponse.getResponse():TVaultConstants.EMPTY). put(LogMessage.STATUS, (null!=metadataResponse)?metadataResponse.getHttpstatus().toString():TVaultConstants.EMPTY). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"AWS Role configuration failed. Please try again\"]}"); }else{ log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AppRole from Service Account"). put(LogMessage.MESSAGE, "Reverting approle policy update failed"). put(LogMessage.RESPONSE, (null!=metadataResponse)?metadataResponse.getResponse():TVaultConstants.EMPTY). put(LogMessage.STATUS, (null!=metadataResponse)?metadataResponse.getHttpstatus().toString():TVaultConstants.EMPTY). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"AWS Role configuration failed. Contact Admin \"]}"); } } else { return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"Failed to remove AWS Role from the Service Account\"]}"); } } else { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Access denied: No permission to remove AWS Role from Service Account\"]}"); } }  }
ServiceAccountsService { public ResponseEntity<String> removeAWSRoleFromSvcacc(UserDetails userDetails, String token, ServiceAccountAWSRole serviceAccountAWSRole) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWS Role from Service Account"). put(LogMessage.MESSAGE, String.format ("Trying to remove AWS Role from Service Account [%s]", serviceAccountAWSRole.getRolename())). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); if (!userDetails.isAdmin()) { token = tokenUtils.getSelfServiceToken(); } if(!isSvcaccPermissionInputValid(serviceAccountAWSRole.getAccess())) { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid value specified for access. Valid values are read, reset, deny\"]}"); } if (serviceAccountAWSRole.getAccess().equalsIgnoreCase("reset")) { serviceAccountAWSRole.setAccess(TVaultConstants.WRITE_POLICY); } String roleName = serviceAccountAWSRole.getRolename(); String svcAccName = serviceAccountAWSRole.getSvcAccName(); String access = serviceAccountAWSRole.getAccess(); roleName = (roleName !=null) ? roleName.toLowerCase() : roleName; access = (access != null) ? access.toLowerCase(): access; boolean isAuthorized = hasAddOrRemovePermission(userDetails, svcAccName, token); if (isAuthorized) { if (!ifInitialPwdReset(token, userDetails, serviceAccountAWSRole.getSvcAccName())) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWSRole from ServiceAccount"). put(LogMessage.MESSAGE, "Failed to remove awsrole permission from Service account. Initial password reset is pending for this Service Account."). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Failed to remove awsrole permission from Service account. Initial password reset is pending for this Service Account. Please reset the password and try again.\"]}"); } String r_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.READ_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); String w_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.WRITE_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); String d_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.DENY_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); String o_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.SUDO_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWS Role from Service Account"). put(LogMessage.MESSAGE, String.format ("Policies are, read - [%s], write - [%s], deny -[%s], owner - [%s]", r_policy, w_policy, d_policy, o_policy)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); Response roleResponse = reqProcessor.process("/auth/aws/roles","{\"role\":\""+roleName+"\"}",token); String responseJson=""; String auth_type = TVaultConstants.EC2; List<String> policies = new ArrayList<>(); List<String> currentpolicies = new ArrayList<>(); if(HttpStatus.OK.equals(roleResponse.getHttpstatus())){ responseJson = roleResponse.getResponse(); ObjectMapper objMapper = new ObjectMapper(); try { JsonNode policiesArry =objMapper.readTree(responseJson).get("policies"); for(JsonNode policyNode : policiesArry){ currentpolicies.add(policyNode.asText()); } auth_type = objMapper.readTree(responseJson).get("auth_type").asText(); } catch (IOException e) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWS Role from Service Account"). put(LogMessage.MESSAGE, e.getMessage()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } policies.addAll(currentpolicies); policies.remove(r_policy); policies.remove(w_policy); policies.remove(d_policy); } else{ return ResponseEntity.status(HttpStatus.UNPROCESSABLE_ENTITY).body("{\"errors\":[\"AppRole doesn't exist\"]}"); } String policiesString = org.apache.commons.lang3.StringUtils.join(policies, ","); String currentpoliciesString = org.apache.commons.lang3.StringUtils.join(currentpolicies, ","); log.info(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWS Role from Service account"). put(LogMessage.MESSAGE, "Remove AWS Role from Service account - policy :" + policiesString + " is being configured" ). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); Response awsRoleConfigresponse = null; if (TVaultConstants.IAM.equals(auth_type)) { awsRoleConfigresponse = awsiamAuthService.configureAWSIAMRole(roleName,policiesString,token); } else { awsRoleConfigresponse = awsAuthService.configureAWSRole(roleName,policiesString,token); } if(awsRoleConfigresponse.getHttpstatus().equals(HttpStatus.NO_CONTENT) || awsRoleConfigresponse.getHttpstatus().equals(HttpStatus.OK)){ String path = new StringBuffer(TVaultConstants.SVC_ACC_ROLES_PATH).append(svcAccName).toString(); Map<String,String> params = new HashMap<String,String>(); params.put("type", "aws-roles"); params.put("name",roleName); params.put("path",path); params.put("access","delete"); Response metadataResponse = ControllerUtil.updateMetadata(params,token); if(metadataResponse !=null && (HttpStatus.NO_CONTENT.equals(metadataResponse.getHttpstatus()) || HttpStatus.OK.equals(metadataResponse.getHttpstatus()))){ log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWS Role from Service Account"). put(LogMessage.MESSAGE, "AWS Role configuration Success."). put(LogMessage.STATUS, metadataResponse.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.OK).body("{\"messages\":[\"AWS Role is successfully removed from Service Account\"]}"); } if (TVaultConstants.IAM.equals(auth_type)) { awsRoleConfigresponse = awsiamAuthService.configureAWSIAMRole(roleName,currentpoliciesString,token); } else { awsRoleConfigresponse = awsAuthService.configureAWSRole(roleName,currentpoliciesString,token); } if(awsRoleConfigresponse.getHttpstatus().equals(HttpStatus.NO_CONTENT)){ log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWS Role from Service Account"). put(LogMessage.MESSAGE, "Reverting, AWS Role policy update success"). put(LogMessage.RESPONSE, (null!=metadataResponse)?metadataResponse.getResponse():TVaultConstants.EMPTY). put(LogMessage.STATUS, (null!=metadataResponse)?metadataResponse.getHttpstatus().toString():TVaultConstants.EMPTY). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"AWS Role configuration failed. Please try again\"]}"); }else{ log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AppRole from Service Account"). put(LogMessage.MESSAGE, "Reverting approle policy update failed"). put(LogMessage.RESPONSE, (null!=metadataResponse)?metadataResponse.getResponse():TVaultConstants.EMPTY). put(LogMessage.STATUS, (null!=metadataResponse)?metadataResponse.getHttpstatus().toString():TVaultConstants.EMPTY). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"AWS Role configuration failed. Contact Admin \"]}"); } } else { return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"Failed to remove AWS Role from the Service Account\"]}"); } } else { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Access denied: No permission to remove AWS Role from Service Account\"]}"); } }  ResponseEntity<ADServiceAccountObjects> getADServiceAccounts(String token, UserDetails userDetails, String UserPrincipalName, boolean excludeOnboarded); ResponseEntity<String> onboardServiceAccount(String token, ServiceAccount serviceAccount, UserDetails userDetails); ResponseEntity<String> offboardServiceAccount(String token, OnboardedServiceAccount serviceAccount, UserDetails userDetails); ResponseEntity<String> addUserToServiceAccount(String token, ServiceAccountUser serviceAccountUser, UserDetails userDetails, boolean isPartOfSvcAccOnboard); ResponseEntity<String> removeUserFromServiceAccount(String token, ServiceAccountUser serviceAccountUser, UserDetails userDetails); ResponseEntity<String> resetSvcAccPassword(String token, String svcAccName, UserDetails userDetails); ResponseEntity<String> readSvcAccPassword(String token, String svcAccName, UserDetails userDetails); ResponseEntity<String> getOnboarderdServiceAccount(String token, String svcAccName, UserDetails userDetails); boolean canAddOrRemoveUser(UserDetails userDetails, ServiceAccountUser serviceAccountUser, String action); ResponseEntity<String> getOnboardedServiceAccounts(String token,  UserDetails userDetails); boolean hasAddOrRemovePermission(UserDetails userDetails, String serviceAccount, String token); boolean hasAddUserPermission(UserDetails userDetails, String serviceAccount, String token, boolean isPartOfSvcAccOnboard); static boolean isSvcaccPermissionInputValid(String access); ResponseEntity<String> addGroupToServiceAccount(String token, ServiceAccountGroup serviceAccountGroup, UserDetails userDetails); ResponseEntity<String> removeGroupFromServiceAccount(String token, ServiceAccountGroup serviceAccountGroup, UserDetails userDetails); ResponseEntity<String> associateApproletoSvcAcc(UserDetails userDetails, String token, ServiceAccountApprole serviceAccountApprole); ResponseEntity<String> getServiceAccountMeta(String token, UserDetails userDetails, String path); ResponseEntity<String> removeApproleFromSvcAcc(UserDetails userDetails, String token, ServiceAccountApprole serviceAccountApprole); ResponseEntity<String> addAwsRoleToSvcacc(UserDetails userDetails, String token, ServiceAccountAWSRole serviceAccountAWSRole); ResponseEntity<String> removeAWSRoleFromSvcacc(UserDetails userDetails, String token, ServiceAccountAWSRole serviceAccountAWSRole); ResponseEntity<String> createAWSRole(UserDetails userDetails, String token, AWSLoginRole awsLoginRole); ResponseEntity<String> createIAMRole(UserDetails userDetails, String token, AWSIAMRole awsiamRole); ResponseEntity<String> updateOnboardedServiceAccount(String token, ServiceAccount serviceAccount, UserDetails userDetails); ResponseEntity<String> transferSvcAccountOwner(UserDetails userDetails, String token, String svcAccName); ResponseEntity<String> getServiceAccounts(UserDetails userDetails, String userToken); }
ServiceAccountsService { public ResponseEntity<String> removeAWSRoleFromSvcacc(UserDetails userDetails, String token, ServiceAccountAWSRole serviceAccountAWSRole) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWS Role from Service Account"). put(LogMessage.MESSAGE, String.format ("Trying to remove AWS Role from Service Account [%s]", serviceAccountAWSRole.getRolename())). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); if (!userDetails.isAdmin()) { token = tokenUtils.getSelfServiceToken(); } if(!isSvcaccPermissionInputValid(serviceAccountAWSRole.getAccess())) { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid value specified for access. Valid values are read, reset, deny\"]}"); } if (serviceAccountAWSRole.getAccess().equalsIgnoreCase("reset")) { serviceAccountAWSRole.setAccess(TVaultConstants.WRITE_POLICY); } String roleName = serviceAccountAWSRole.getRolename(); String svcAccName = serviceAccountAWSRole.getSvcAccName(); String access = serviceAccountAWSRole.getAccess(); roleName = (roleName !=null) ? roleName.toLowerCase() : roleName; access = (access != null) ? access.toLowerCase(): access; boolean isAuthorized = hasAddOrRemovePermission(userDetails, svcAccName, token); if (isAuthorized) { if (!ifInitialPwdReset(token, userDetails, serviceAccountAWSRole.getSvcAccName())) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWSRole from ServiceAccount"). put(LogMessage.MESSAGE, "Failed to remove awsrole permission from Service account. Initial password reset is pending for this Service Account."). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Failed to remove awsrole permission from Service account. Initial password reset is pending for this Service Account. Please reset the password and try again.\"]}"); } String r_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.READ_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); String w_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.WRITE_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); String d_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.DENY_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); String o_policy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.SUDO_POLICY)).append(TVaultConstants.SVC_ACC_PATH_PREFIX).append("_").append(svcAccName).toString(); log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWS Role from Service Account"). put(LogMessage.MESSAGE, String.format ("Policies are, read - [%s], write - [%s], deny -[%s], owner - [%s]", r_policy, w_policy, d_policy, o_policy)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); Response roleResponse = reqProcessor.process("/auth/aws/roles","{\"role\":\""+roleName+"\"}",token); String responseJson=""; String auth_type = TVaultConstants.EC2; List<String> policies = new ArrayList<>(); List<String> currentpolicies = new ArrayList<>(); if(HttpStatus.OK.equals(roleResponse.getHttpstatus())){ responseJson = roleResponse.getResponse(); ObjectMapper objMapper = new ObjectMapper(); try { JsonNode policiesArry =objMapper.readTree(responseJson).get("policies"); for(JsonNode policyNode : policiesArry){ currentpolicies.add(policyNode.asText()); } auth_type = objMapper.readTree(responseJson).get("auth_type").asText(); } catch (IOException e) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWS Role from Service Account"). put(LogMessage.MESSAGE, e.getMessage()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } policies.addAll(currentpolicies); policies.remove(r_policy); policies.remove(w_policy); policies.remove(d_policy); } else{ return ResponseEntity.status(HttpStatus.UNPROCESSABLE_ENTITY).body("{\"errors\":[\"AppRole doesn't exist\"]}"); } String policiesString = org.apache.commons.lang3.StringUtils.join(policies, ","); String currentpoliciesString = org.apache.commons.lang3.StringUtils.join(currentpolicies, ","); log.info(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWS Role from Service account"). put(LogMessage.MESSAGE, "Remove AWS Role from Service account - policy :" + policiesString + " is being configured" ). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); Response awsRoleConfigresponse = null; if (TVaultConstants.IAM.equals(auth_type)) { awsRoleConfigresponse = awsiamAuthService.configureAWSIAMRole(roleName,policiesString,token); } else { awsRoleConfigresponse = awsAuthService.configureAWSRole(roleName,policiesString,token); } if(awsRoleConfigresponse.getHttpstatus().equals(HttpStatus.NO_CONTENT) || awsRoleConfigresponse.getHttpstatus().equals(HttpStatus.OK)){ String path = new StringBuffer(TVaultConstants.SVC_ACC_ROLES_PATH).append(svcAccName).toString(); Map<String,String> params = new HashMap<String,String>(); params.put("type", "aws-roles"); params.put("name",roleName); params.put("path",path); params.put("access","delete"); Response metadataResponse = ControllerUtil.updateMetadata(params,token); if(metadataResponse !=null && (HttpStatus.NO_CONTENT.equals(metadataResponse.getHttpstatus()) || HttpStatus.OK.equals(metadataResponse.getHttpstatus()))){ log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWS Role from Service Account"). put(LogMessage.MESSAGE, "AWS Role configuration Success."). put(LogMessage.STATUS, metadataResponse.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.OK).body("{\"messages\":[\"AWS Role is successfully removed from Service Account\"]}"); } if (TVaultConstants.IAM.equals(auth_type)) { awsRoleConfigresponse = awsiamAuthService.configureAWSIAMRole(roleName,currentpoliciesString,token); } else { awsRoleConfigresponse = awsAuthService.configureAWSRole(roleName,currentpoliciesString,token); } if(awsRoleConfigresponse.getHttpstatus().equals(HttpStatus.NO_CONTENT)){ log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AWS Role from Service Account"). put(LogMessage.MESSAGE, "Reverting, AWS Role policy update success"). put(LogMessage.RESPONSE, (null!=metadataResponse)?metadataResponse.getResponse():TVaultConstants.EMPTY). put(LogMessage.STATUS, (null!=metadataResponse)?metadataResponse.getHttpstatus().toString():TVaultConstants.EMPTY). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"AWS Role configuration failed. Please try again\"]}"); }else{ log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Remove AppRole from Service Account"). put(LogMessage.MESSAGE, "Reverting approle policy update failed"). put(LogMessage.RESPONSE, (null!=metadataResponse)?metadataResponse.getResponse():TVaultConstants.EMPTY). put(LogMessage.STATUS, (null!=metadataResponse)?metadataResponse.getHttpstatus().toString():TVaultConstants.EMPTY). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"AWS Role configuration failed. Contact Admin \"]}"); } } else { return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"Failed to remove AWS Role from the Service Account\"]}"); } } else { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Access denied: No permission to remove AWS Role from Service Account\"]}"); } }  ResponseEntity<ADServiceAccountObjects> getADServiceAccounts(String token, UserDetails userDetails, String UserPrincipalName, boolean excludeOnboarded); ResponseEntity<String> onboardServiceAccount(String token, ServiceAccount serviceAccount, UserDetails userDetails); ResponseEntity<String> offboardServiceAccount(String token, OnboardedServiceAccount serviceAccount, UserDetails userDetails); ResponseEntity<String> addUserToServiceAccount(String token, ServiceAccountUser serviceAccountUser, UserDetails userDetails, boolean isPartOfSvcAccOnboard); ResponseEntity<String> removeUserFromServiceAccount(String token, ServiceAccountUser serviceAccountUser, UserDetails userDetails); ResponseEntity<String> resetSvcAccPassword(String token, String svcAccName, UserDetails userDetails); ResponseEntity<String> readSvcAccPassword(String token, String svcAccName, UserDetails userDetails); ResponseEntity<String> getOnboarderdServiceAccount(String token, String svcAccName, UserDetails userDetails); boolean canAddOrRemoveUser(UserDetails userDetails, ServiceAccountUser serviceAccountUser, String action); ResponseEntity<String> getOnboardedServiceAccounts(String token,  UserDetails userDetails); boolean hasAddOrRemovePermission(UserDetails userDetails, String serviceAccount, String token); boolean hasAddUserPermission(UserDetails userDetails, String serviceAccount, String token, boolean isPartOfSvcAccOnboard); static boolean isSvcaccPermissionInputValid(String access); ResponseEntity<String> addGroupToServiceAccount(String token, ServiceAccountGroup serviceAccountGroup, UserDetails userDetails); ResponseEntity<String> removeGroupFromServiceAccount(String token, ServiceAccountGroup serviceAccountGroup, UserDetails userDetails); ResponseEntity<String> associateApproletoSvcAcc(UserDetails userDetails, String token, ServiceAccountApprole serviceAccountApprole); ResponseEntity<String> getServiceAccountMeta(String token, UserDetails userDetails, String path); ResponseEntity<String> removeApproleFromSvcAcc(UserDetails userDetails, String token, ServiceAccountApprole serviceAccountApprole); ResponseEntity<String> addAwsRoleToSvcacc(UserDetails userDetails, String token, ServiceAccountAWSRole serviceAccountAWSRole); ResponseEntity<String> removeAWSRoleFromSvcacc(UserDetails userDetails, String token, ServiceAccountAWSRole serviceAccountAWSRole); ResponseEntity<String> createAWSRole(UserDetails userDetails, String token, AWSLoginRole awsLoginRole); ResponseEntity<String> createIAMRole(UserDetails userDetails, String token, AWSIAMRole awsiamRole); ResponseEntity<String> updateOnboardedServiceAccount(String token, ServiceAccount serviceAccount, UserDetails userDetails); ResponseEntity<String> transferSvcAccountOwner(UserDetails userDetails, String token, String svcAccName); ResponseEntity<String> getServiceAccounts(UserDetails userDetails, String userToken);  }