@Test public void test_getVaultTokenLookupDetails_successfully_oidc() throws TVaultValidationException, IOException { String token = "7QPMPIGiyDFlJkrK3jFykUqa"; Response response = getMockResponse(HttpStatus.OK, true, "{\"id\":\"7DXvbGXxu81LC724cRrrqYyq\", \"display_name\": \"oidc-user1@company.com\",\"last_renewal_time\":null,\"renewable\":false,\"policies\":[\"default\"],\"creation_ttl\":0,\"username\":null,\"path\":\"auth/oidc/oidc/callback\"}"); VaultTokenLookupDetails expectedLookupDetails = new VaultTokenLookupDetails(); expectedLookupDetails.setAdmin(false); expectedLookupDetails.setValid(true); expectedLookupDetails.setToken(token); expectedLookupDetails.setUsername(null); String [] policies = {"default"}; ArrayList<String> adminPolicies = new ArrayList<>(); adminPolicies.add("adminpolicy"); expectedLookupDetails.setPolicies(policies); ReflectionTestUtils.setField(tokenValidator, "vaultAuthMethod", TVaultConstants.OIDC); DirectoryUser directoryUser = new DirectoryUser(); directoryUser.setDisplayName("user1"); directoryUser.setGivenName("user1"); directoryUser.setUserEmail("oidc-user1.company.com"); directoryUser.setUserId("user1"); directoryUser.setUserName("user1"); List<DirectoryUser> persons = new ArrayList<>(); persons.add(directoryUser); DirectoryObjects users = new DirectoryObjects(); DirectoryObjectsList usersList = new DirectoryObjectsList(); usersList.setValues(persons.toArray(new DirectoryUser[persons.size()])); users.setData(usersList); ResponseEntity<DirectoryObjects> directoryObjectsResponseEntity = ResponseEntity.status(HttpStatus.OK).body(users); when(directoryService.searchByUPN("user1@company.com")).thenReturn(directoryObjectsResponseEntity); when(reqProcessor.process("/auth/tvault/lookup","{}", token)).thenReturn(response); when(commonUtils.getPoliciesAsArray(Mockito.any(), eq(response.getResponse()))).thenReturn(policies); when(policyUtils.getAdminPolicies()).thenReturn(adminPolicies); when(authorizationUtils.containsAdminPolicies(Mockito.anyList(), Mockito.anyList())).thenReturn(true); VaultTokenLookupDetails lookupDetails = tokenValidator.getVaultTokenLookupDetails(token); assertEquals(JSONUtil.getJSON(expectedLookupDetails), JSONUtil.getJSON(lookupDetails)); }
public VaultTokenLookupDetails getVaultTokenLookupDetails(String token) throws TVaultValidationException{ Response response = reqProcessor.process("/auth/tvault/lookup","{}", token); VaultTokenLookupDetails lookupDetails = null; if(HttpStatus.OK.equals(response.getHttpstatus())){ try { lookupDetails = new VaultTokenLookupDetails(); ObjectMapper objMapper = new ObjectMapper(); ObjectNode objNode = (ObjectNode) objMapper.readTree(response.getResponse()); lookupDetails.setUsername(objNode.get("username").asText()); String[] policies = commonUtils.getPoliciesAsArray(objMapper, response.getResponse()); lookupDetails.setPolicies(policies); lookupDetails.setToken(token); lookupDetails.setValid(true); lookupDetails.setAdmin(authorizationUtils.containsAdminPolicies(Arrays.asList(policies), policyUtils.getAdminPolicies())); if (TVaultConstants.OIDC.equals(vaultAuthMethod) && objNode.get("display_name") != null && objNode.get("path") != null ) { String authPath = objNode.get("path").asText(); String displayName = objNode.get("display_name").asText(); if (TVaultConstants.OIDC_AUTH_PATH.equalsIgnoreCase(authPath) && !StringUtils.isEmpty(displayName) && displayName.contains("oidc-")) { String email = objNode.get("display_name").asText().substring(5); if (!StringUtils.isEmpty(email)) { lookupDetails.setEmail(email); } ResponseEntity<DirectoryObjects> directoryObjectsResponseEntity = directoryService.searchByUPN(email); if (directoryObjectsResponseEntity != null && HttpStatus.OK.equals(directoryObjectsResponseEntity.getStatusCode())) { Object[] adUser = directoryObjectsResponseEntity.getBody().getData().getValues(); if (adUser.length > 0) { DirectoryUser directoryUser = (DirectoryUser) adUser[0]; lookupDetails.setUsername(directoryUser.getUserName()); } } } else { lookupDetails.setEmail(null); lookupDetails.setUsername(displayName); } } } catch (IOException e) { throw new TVaultValidationException(e); } } else if(HttpStatus.FORBIDDEN.equals(response.getHttpstatus())){ throw new TVaultValidationException( String.format("Can't perform the required operation. Possible reasons: 1. Invalid/expired client token or 2. Insufficient permissions. Actual Status: [%s], Reason [%s]", response.getHttpstatus(), response.getResponse())); } else { throw new TVaultValidationException( String.format("Can't perform the required operation. Actual Status: [%s], Reason [%s]", response.getHttpstatus(), response.getResponse())); } return lookupDetails; }
TokenValidator { public VaultTokenLookupDetails getVaultTokenLookupDetails(String token) throws TVaultValidationException{ Response response = reqProcessor.process("/auth/tvault/lookup","{}", token); VaultTokenLookupDetails lookupDetails = null; if(HttpStatus.OK.equals(response.getHttpstatus())){ try { lookupDetails = new VaultTokenLookupDetails(); ObjectMapper objMapper = new ObjectMapper(); ObjectNode objNode = (ObjectNode) objMapper.readTree(response.getResponse()); lookupDetails.setUsername(objNode.get("username").asText()); String[] policies = commonUtils.getPoliciesAsArray(objMapper, response.getResponse()); lookupDetails.setPolicies(policies); lookupDetails.setToken(token); lookupDetails.setValid(true); lookupDetails.setAdmin(authorizationUtils.containsAdminPolicies(Arrays.asList(policies), policyUtils.getAdminPolicies())); if (TVaultConstants.OIDC.equals(vaultAuthMethod) && objNode.get("display_name") != null && objNode.get("path") != null ) { String authPath = objNode.get("path").asText(); String displayName = objNode.get("display_name").asText(); if (TVaultConstants.OIDC_AUTH_PATH.equalsIgnoreCase(authPath) && !StringUtils.isEmpty(displayName) && displayName.contains("oidc-")) { String email = objNode.get("display_name").asText().substring(5); if (!StringUtils.isEmpty(email)) { lookupDetails.setEmail(email); } ResponseEntity<DirectoryObjects> directoryObjectsResponseEntity = directoryService.searchByUPN(email); if (directoryObjectsResponseEntity != null && HttpStatus.OK.equals(directoryObjectsResponseEntity.getStatusCode())) { Object[] adUser = directoryObjectsResponseEntity.getBody().getData().getValues(); if (adUser.length > 0) { DirectoryUser directoryUser = (DirectoryUser) adUser[0]; lookupDetails.setUsername(directoryUser.getUserName()); } } } else { lookupDetails.setEmail(null); lookupDetails.setUsername(displayName); } } } catch (IOException e) { throw new TVaultValidationException(e); } } else if(HttpStatus.FORBIDDEN.equals(response.getHttpstatus())){ throw new TVaultValidationException( String.format("Can't perform the required operation. Possible reasons: 1. Invalid/expired client token or 2. Insufficient permissions. Actual Status: [%s], Reason [%s]", response.getHttpstatus(), response.getResponse())); } else { throw new TVaultValidationException( String.format("Can't perform the required operation. Actual Status: [%s], Reason [%s]", response.getHttpstatus(), response.getResponse())); } return lookupDetails; } }
TokenValidator { public VaultTokenLookupDetails getVaultTokenLookupDetails(String token) throws TVaultValidationException{ Response response = reqProcessor.process("/auth/tvault/lookup","{}", token); VaultTokenLookupDetails lookupDetails = null; if(HttpStatus.OK.equals(response.getHttpstatus())){ try { lookupDetails = new VaultTokenLookupDetails(); ObjectMapper objMapper = new ObjectMapper(); ObjectNode objNode = (ObjectNode) objMapper.readTree(response.getResponse()); lookupDetails.setUsername(objNode.get("username").asText()); String[] policies = commonUtils.getPoliciesAsArray(objMapper, response.getResponse()); lookupDetails.setPolicies(policies); lookupDetails.setToken(token); lookupDetails.setValid(true); lookupDetails.setAdmin(authorizationUtils.containsAdminPolicies(Arrays.asList(policies), policyUtils.getAdminPolicies())); if (TVaultConstants.OIDC.equals(vaultAuthMethod) && objNode.get("display_name") != null && objNode.get("path") != null ) { String authPath = objNode.get("path").asText(); String displayName = objNode.get("display_name").asText(); if (TVaultConstants.OIDC_AUTH_PATH.equalsIgnoreCase(authPath) && !StringUtils.isEmpty(displayName) && displayName.contains("oidc-")) { String email = objNode.get("display_name").asText().substring(5); if (!StringUtils.isEmpty(email)) { lookupDetails.setEmail(email); } ResponseEntity<DirectoryObjects> directoryObjectsResponseEntity = directoryService.searchByUPN(email); if (directoryObjectsResponseEntity != null && HttpStatus.OK.equals(directoryObjectsResponseEntity.getStatusCode())) { Object[] adUser = directoryObjectsResponseEntity.getBody().getData().getValues(); if (adUser.length > 0) { DirectoryUser directoryUser = (DirectoryUser) adUser[0]; lookupDetails.setUsername(directoryUser.getUserName()); } } } else { lookupDetails.setEmail(null); lookupDetails.setUsername(displayName); } } } catch (IOException e) { throw new TVaultValidationException(e); } } else if(HttpStatus.FORBIDDEN.equals(response.getHttpstatus())){ throw new TVaultValidationException( String.format("Can't perform the required operation. Possible reasons: 1. Invalid/expired client token or 2. Insufficient permissions. Actual Status: [%s], Reason [%s]", response.getHttpstatus(), response.getResponse())); } else { throw new TVaultValidationException( String.format("Can't perform the required operation. Actual Status: [%s], Reason [%s]", response.getHttpstatus(), response.getResponse())); } return lookupDetails; } TokenValidator(); }
TokenValidator { public VaultTokenLookupDetails getVaultTokenLookupDetails(String token) throws TVaultValidationException{ Response response = reqProcessor.process("/auth/tvault/lookup","{}", token); VaultTokenLookupDetails lookupDetails = null; if(HttpStatus.OK.equals(response.getHttpstatus())){ try { lookupDetails = new VaultTokenLookupDetails(); ObjectMapper objMapper = new ObjectMapper(); ObjectNode objNode = (ObjectNode) objMapper.readTree(response.getResponse()); lookupDetails.setUsername(objNode.get("username").asText()); String[] policies = commonUtils.getPoliciesAsArray(objMapper, response.getResponse()); lookupDetails.setPolicies(policies); lookupDetails.setToken(token); lookupDetails.setValid(true); lookupDetails.setAdmin(authorizationUtils.containsAdminPolicies(Arrays.asList(policies), policyUtils.getAdminPolicies())); if (TVaultConstants.OIDC.equals(vaultAuthMethod) && objNode.get("display_name") != null && objNode.get("path") != null ) { String authPath = objNode.get("path").asText(); String displayName = objNode.get("display_name").asText(); if (TVaultConstants.OIDC_AUTH_PATH.equalsIgnoreCase(authPath) && !StringUtils.isEmpty(displayName) && displayName.contains("oidc-")) { String email = objNode.get("display_name").asText().substring(5); if (!StringUtils.isEmpty(email)) { lookupDetails.setEmail(email); } ResponseEntity<DirectoryObjects> directoryObjectsResponseEntity = directoryService.searchByUPN(email); if (directoryObjectsResponseEntity != null && HttpStatus.OK.equals(directoryObjectsResponseEntity.getStatusCode())) { Object[] adUser = directoryObjectsResponseEntity.getBody().getData().getValues(); if (adUser.length > 0) { DirectoryUser directoryUser = (DirectoryUser) adUser[0]; lookupDetails.setUsername(directoryUser.getUserName()); } } } else { lookupDetails.setEmail(null); lookupDetails.setUsername(displayName); } } } catch (IOException e) { throw new TVaultValidationException(e); } } else if(HttpStatus.FORBIDDEN.equals(response.getHttpstatus())){ throw new TVaultValidationException( String.format("Can't perform the required operation. Possible reasons: 1. Invalid/expired client token or 2. Insufficient permissions. Actual Status: [%s], Reason [%s]", response.getHttpstatus(), response.getResponse())); } else { throw new TVaultValidationException( String.format("Can't perform the required operation. Actual Status: [%s], Reason [%s]", response.getHttpstatus(), response.getResponse())); } return lookupDetails; } TokenValidator(); VaultTokenLookupDetails getVaultTokenLookupDetails(String token); }
TokenValidator { public VaultTokenLookupDetails getVaultTokenLookupDetails(String token) throws TVaultValidationException{ Response response = reqProcessor.process("/auth/tvault/lookup","{}", token); VaultTokenLookupDetails lookupDetails = null; if(HttpStatus.OK.equals(response.getHttpstatus())){ try { lookupDetails = new VaultTokenLookupDetails(); ObjectMapper objMapper = new ObjectMapper(); ObjectNode objNode = (ObjectNode) objMapper.readTree(response.getResponse()); lookupDetails.setUsername(objNode.get("username").asText()); String[] policies = commonUtils.getPoliciesAsArray(objMapper, response.getResponse()); lookupDetails.setPolicies(policies); lookupDetails.setToken(token); lookupDetails.setValid(true); lookupDetails.setAdmin(authorizationUtils.containsAdminPolicies(Arrays.asList(policies), policyUtils.getAdminPolicies())); if (TVaultConstants.OIDC.equals(vaultAuthMethod) && objNode.get("display_name") != null && objNode.get("path") != null ) { String authPath = objNode.get("path").asText(); String displayName = objNode.get("display_name").asText(); if (TVaultConstants.OIDC_AUTH_PATH.equalsIgnoreCase(authPath) && !StringUtils.isEmpty(displayName) && displayName.contains("oidc-")) { String email = objNode.get("display_name").asText().substring(5); if (!StringUtils.isEmpty(email)) { lookupDetails.setEmail(email); } ResponseEntity<DirectoryObjects> directoryObjectsResponseEntity = directoryService.searchByUPN(email); if (directoryObjectsResponseEntity != null && HttpStatus.OK.equals(directoryObjectsResponseEntity.getStatusCode())) { Object[] adUser = directoryObjectsResponseEntity.getBody().getData().getValues(); if (adUser.length > 0) { DirectoryUser directoryUser = (DirectoryUser) adUser[0]; lookupDetails.setUsername(directoryUser.getUserName()); } } } else { lookupDetails.setEmail(null); lookupDetails.setUsername(displayName); } } } catch (IOException e) { throw new TVaultValidationException(e); } } else if(HttpStatus.FORBIDDEN.equals(response.getHttpstatus())){ throw new TVaultValidationException( String.format("Can't perform the required operation. Possible reasons: 1. Invalid/expired client token or 2. Insufficient permissions. Actual Status: [%s], Reason [%s]", response.getHttpstatus(), response.getResponse())); } else { throw new TVaultValidationException( String.format("Can't perform the required operation. Actual Status: [%s], Reason [%s]", response.getHttpstatus(), response.getResponse())); } return lookupDetails; } TokenValidator(); VaultTokenLookupDetails getVaultTokenLookupDetails(String token);  }