@Test public void test_offboardServiceAccount_failure() { UserDetails userDetails = getMockUser(true); String token = userDetails.getClientToken(); OnboardedServiceAccount onboardedServiceAccount = generateOnboardedServiceAccount("testacc02","testacc01"); ServiceAccountUser serviceAccountUser = new ServiceAccountUser("testacc01", userDetails.getUsername(), "sudo"); String [] policies = {"o_svcacct_testacc01"}; when(policyUtils.getCurrentPolicies(token, userDetails.getUsername(), userDetails)).thenReturn(policies); Response userResponse = getMockResponse(HttpStatus.OK, true, "{\"data\":{\"bound_cidrs\":[],\"max_ttl\":0,\"policies\":[\"default\", \"o_svcacct_testacc02\"],\"ttl\":0,\"groups\":\"admin\"}}"); when(reqProcessor.process("/auth/ldap/users","{\"username\":\"user1\"}",token)).thenReturn(userResponse); Response userResponse2 = getMockResponse(HttpStatus.OK, true, "{\"data\":{\"bound_cidrs\":[],\"max_ttl\":0,\"policies\":[\"default\", \"r_svcacct_testacc02\"],\"ttl\":0,\"groups\":\"\"}}"); when(reqProcessor.process("/auth/ldap/users","{\"username\":\"user2\"}",token)).thenReturn(userResponse2); Response groupResponse = getMockResponse(HttpStatus.OK, true, "{\"data\":{\"policies\":[\"default\", \"r_svcacct_testacc02\"],\"ttl\":0}}"); when(reqProcessor.process("/auth/ldap/groups","{\"groupname\":\"group1\"}",token)).thenReturn(groupResponse); Response responseNoContent = getMockResponse(HttpStatus.NO_CONTENT, true, "{\"policies\":null}"); try { List<String> resList = new ArrayList<>(); resList.add("default"); resList.add("o_svcacct_testacc02"); List<String> groupResList = new ArrayList<>(); resList.add("default"); resList.add("r_svcacct_testacc02"); when(ControllerUtil.getPoliciesAsListFromJson(any(), any())).thenReturn(resList); when(ControllerUtil.getPoliciesAsListFromJson(any(), any())).thenReturn(groupResList); } catch (IOException e) { e.printStackTrace(); } when(ControllerUtil.configureLDAPUser(eq("testacc01"),any(),any(),eq(token))).thenReturn(responseNoContent); when(ControllerUtil.configureLDAPGroup(any(),any(),any())).thenReturn(responseNoContent); when(ControllerUtil.updateMetadata(any(),eq(token))).thenReturn(responseNoContent); ResponseEntity<String> createPolicyResponse = ResponseEntity.status(HttpStatus.OK).body("{\"messages\":[\"Access is deleted\"]}"); when(accessService.deletePolicyInfo(Mockito.anyString(), Mockito.any())).thenReturn(createPolicyResponse); String _path = TVaultConstants.SVC_ACC_ROLES_METADATA_MOUNT_PATH + "/testacc02"; Response metaResponse = getMockResponse(HttpStatus.OK, true, "{\"data\":{\n" + " \"groups\": {\n" + " \"group1\": \"read\"\n" + " },\n" + " \"managedBy\": \"user2\",\n" + " \"name\": \"testacc02\",\n" + " \"users\": {\n" + " \"user1\": \"read\"\n" + " }\n" + "}}"); when(reqProcessor.process("/sdb","{\"path\":\""+_path+"\"}",token)).thenReturn(metaResponse); ServiceAccountTTL serviceAccountTTL = new ServiceAccountTTL(); serviceAccountTTL.setRole_name(onboardedServiceAccount.getName()); serviceAccountTTL.setService_account_name(onboardedServiceAccount.getName() + "@aaa.bbb.ccc.com") ; String svc_account_payload = getJSON(serviceAccountTTL); Response deleteRoleResponse = getMockResponse(HttpStatus.BAD_REQUEST, true, ""); when(JSONUtil.getJSON(Mockito.any(ServiceAccountTTL.class))).thenReturn(svc_account_payload); when(reqProcessor.process("/ad/serviceaccount/offboard",svc_account_payload,token)).thenReturn(deleteRoleResponse); String expectedResponse = "{\"errors\":[\"Failed to offboard AD service account from TVault for password rotation.\"]}"; ResponseEntity<String> responseEntityExpected = ResponseEntity.status(HttpStatus.MULTI_STATUS).body(expectedResponse); ResponseEntity<String> responseEntity = serviceAccountsService.offboardServiceAccount(token, onboardedServiceAccount, userDetails); assertEquals(HttpStatus.MULTI_STATUS, responseEntity.getStatusCode()); assertEquals(responseEntityExpected, responseEntity); }
public ResponseEntity<String> offboardServiceAccount(String token, OnboardedServiceAccount serviceAccount, UserDetails userDetails) { String managedBy = ""; String svcAccName = serviceAccount.getName(); ResponseEntity<String> svcAccPolicyDeletionResponse = deleteServiceAccountPolicies(token, svcAccName); if (!HttpStatus.OK.equals(svcAccPolicyDeletionResponse.getStatusCode())) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "offboardServiceAccount"). put(LogMessage.MESSAGE, String.format ("Failed to delete some of the policies for service account")). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } String _path = TVaultConstants.SVC_ACC_ROLES_METADATA_MOUNT_PATH + "/" + svcAccName; Response metaResponse = reqProcessor.process("/sdb","{\"path\":\""+_path+"\"}",token); Map<String, Object> responseMap = null; try { responseMap = new ObjectMapper().readValue(metaResponse.getResponse(), new TypeReference<Map<String, Object>>(){}); } catch (IOException e) { log.error(e); return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"Error Fetching existing service account info \"]}"); } if(responseMap!=null && responseMap.get("data")!=null){ Map<String,Object> metadataMap = (Map<String,Object>)responseMap.get("data"); Map<String,String> awsroles = (Map<String, String>)metadataMap.get("aws-roles"); Map<String,String> approles = (Map<String, String>)metadataMap.get("app-roles"); Map<String,String> groups = (Map<String, String>)metadataMap.get("groups"); Map<String,String> users = (Map<String, String>) metadataMap.get("users"); managedBy = (String) metadataMap.get("managedBy"); if (!org.apache.commons.lang3.StringUtils.isEmpty(managedBy)) { if (null == users) { users = new HashMap<>(); } users.put(managedBy, "sudo"); } updateUserPolicyAssociationOnSvcaccDelete(svcAccName, users, token, userDetails); updateGroupPolicyAssociationOnSvcaccDelete(svcAccName,groups,token, userDetails); deleteAwsRoleonOnSvcaccDelete(svcAccName,awsroles,token); updateApprolePolicyAssociationOnSvcaccDelete(svcAccName,approles,token); } ResponseEntity<String> accountRoleDeletionResponse = deleteAccountRole(token, serviceAccount); if (HttpStatus.OK.equals(accountRoleDeletionResponse.getStatusCode())) { serviceAccount.setOwner(managedBy); ResponseEntity<String> metadataUpdateResponse = deleteMetadata(token, serviceAccount); if (HttpStatus.OK.equals(metadataUpdateResponse.getStatusCode())) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "offboardServiceAccount"). put(LogMessage.MESSAGE, String.format ("Successfully completed offboarding of AD service account from TVault for password rotation.")). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.OK).body("{\"messages\":[\"Successfully completed offboarding of AD service account from TVault for password rotation.\"]}"); } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "offboardServiceAccount"). put(LogMessage.MESSAGE, String.format ("Unable to delete Metadata for the Service Account")). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.MULTI_STATUS).body("{\"errors\":[\"Failed to offboard AD service account from TVault for password rotation.\"]}"); } } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "offboardServiceAccount"). put(LogMessage.MESSAGE, String.format ("Failed to offboard AD service account from TVault for password rotation.")). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.MULTI_STATUS).body("{\"errors\":[\"Failed to offboard AD service account from TVault for password rotation.\"]}"); } }
ServiceAccountsService { public ResponseEntity<String> offboardServiceAccount(String token, OnboardedServiceAccount serviceAccount, UserDetails userDetails) { String managedBy = ""; String svcAccName = serviceAccount.getName(); ResponseEntity<String> svcAccPolicyDeletionResponse = deleteServiceAccountPolicies(token, svcAccName); if (!HttpStatus.OK.equals(svcAccPolicyDeletionResponse.getStatusCode())) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "offboardServiceAccount"). put(LogMessage.MESSAGE, String.format ("Failed to delete some of the policies for service account")). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } String _path = TVaultConstants.SVC_ACC_ROLES_METADATA_MOUNT_PATH + "/" + svcAccName; Response metaResponse = reqProcessor.process("/sdb","{\"path\":\""+_path+"\"}",token); Map<String, Object> responseMap = null; try { responseMap = new ObjectMapper().readValue(metaResponse.getResponse(), new TypeReference<Map<String, Object>>(){}); } catch (IOException e) { log.error(e); return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"Error Fetching existing service account info \"]}"); } if(responseMap!=null && responseMap.get("data")!=null){ Map<String,Object> metadataMap = (Map<String,Object>)responseMap.get("data"); Map<String,String> awsroles = (Map<String, String>)metadataMap.get("aws-roles"); Map<String,String> approles = (Map<String, String>)metadataMap.get("app-roles"); Map<String,String> groups = (Map<String, String>)metadataMap.get("groups"); Map<String,String> users = (Map<String, String>) metadataMap.get("users"); managedBy = (String) metadataMap.get("managedBy"); if (!org.apache.commons.lang3.StringUtils.isEmpty(managedBy)) { if (null == users) { users = new HashMap<>(); } users.put(managedBy, "sudo"); } updateUserPolicyAssociationOnSvcaccDelete(svcAccName, users, token, userDetails); updateGroupPolicyAssociationOnSvcaccDelete(svcAccName,groups,token, userDetails); deleteAwsRoleonOnSvcaccDelete(svcAccName,awsroles,token); updateApprolePolicyAssociationOnSvcaccDelete(svcAccName,approles,token); } ResponseEntity<String> accountRoleDeletionResponse = deleteAccountRole(token, serviceAccount); if (HttpStatus.OK.equals(accountRoleDeletionResponse.getStatusCode())) { serviceAccount.setOwner(managedBy); ResponseEntity<String> metadataUpdateResponse = deleteMetadata(token, serviceAccount); if (HttpStatus.OK.equals(metadataUpdateResponse.getStatusCode())) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "offboardServiceAccount"). put(LogMessage.MESSAGE, String.format ("Successfully completed offboarding of AD service account from TVault for password rotation.")). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.OK).body("{\"messages\":[\"Successfully completed offboarding of AD service account from TVault for password rotation.\"]}"); } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "offboardServiceAccount"). put(LogMessage.MESSAGE, String.format ("Unable to delete Metadata for the Service Account")). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.MULTI_STATUS).body("{\"errors\":[\"Failed to offboard AD service account from TVault for password rotation.\"]}"); } } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "offboardServiceAccount"). put(LogMessage.MESSAGE, String.format ("Failed to offboard AD service account from TVault for password rotation.")). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.MULTI_STATUS).body("{\"errors\":[\"Failed to offboard AD service account from TVault for password rotation.\"]}"); } } }
ServiceAccountsService { public ResponseEntity<String> offboardServiceAccount(String token, OnboardedServiceAccount serviceAccount, UserDetails userDetails) { String managedBy = ""; String svcAccName = serviceAccount.getName(); ResponseEntity<String> svcAccPolicyDeletionResponse = deleteServiceAccountPolicies(token, svcAccName); if (!HttpStatus.OK.equals(svcAccPolicyDeletionResponse.getStatusCode())) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "offboardServiceAccount"). put(LogMessage.MESSAGE, String.format ("Failed to delete some of the policies for service account")). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } String _path = TVaultConstants.SVC_ACC_ROLES_METADATA_MOUNT_PATH + "/" + svcAccName; Response metaResponse = reqProcessor.process("/sdb","{\"path\":\""+_path+"\"}",token); Map<String, Object> responseMap = null; try { responseMap = new ObjectMapper().readValue(metaResponse.getResponse(), new TypeReference<Map<String, Object>>(){}); } catch (IOException e) { log.error(e); return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"Error Fetching existing service account info \"]}"); } if(responseMap!=null && responseMap.get("data")!=null){ Map<String,Object> metadataMap = (Map<String,Object>)responseMap.get("data"); Map<String,String> awsroles = (Map<String, String>)metadataMap.get("aws-roles"); Map<String,String> approles = (Map<String, String>)metadataMap.get("app-roles"); Map<String,String> groups = (Map<String, String>)metadataMap.get("groups"); Map<String,String> users = (Map<String, String>) metadataMap.get("users"); managedBy = (String) metadataMap.get("managedBy"); if (!org.apache.commons.lang3.StringUtils.isEmpty(managedBy)) { if (null == users) { users = new HashMap<>(); } users.put(managedBy, "sudo"); } updateUserPolicyAssociationOnSvcaccDelete(svcAccName, users, token, userDetails); updateGroupPolicyAssociationOnSvcaccDelete(svcAccName,groups,token, userDetails); deleteAwsRoleonOnSvcaccDelete(svcAccName,awsroles,token); updateApprolePolicyAssociationOnSvcaccDelete(svcAccName,approles,token); } ResponseEntity<String> accountRoleDeletionResponse = deleteAccountRole(token, serviceAccount); if (HttpStatus.OK.equals(accountRoleDeletionResponse.getStatusCode())) { serviceAccount.setOwner(managedBy); ResponseEntity<String> metadataUpdateResponse = deleteMetadata(token, serviceAccount); if (HttpStatus.OK.equals(metadataUpdateResponse.getStatusCode())) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "offboardServiceAccount"). put(LogMessage.MESSAGE, String.format ("Successfully completed offboarding of AD service account from TVault for password rotation.")). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.OK).body("{\"messages\":[\"Successfully completed offboarding of AD service account from TVault for password rotation.\"]}"); } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "offboardServiceAccount"). put(LogMessage.MESSAGE, String.format ("Unable to delete Metadata for the Service Account")). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.MULTI_STATUS).body("{\"errors\":[\"Failed to offboard AD service account from TVault for password rotation.\"]}"); } } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "offboardServiceAccount"). put(LogMessage.MESSAGE, String.format ("Failed to offboard AD service account from TVault for password rotation.")). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.MULTI_STATUS).body("{\"errors\":[\"Failed to offboard AD service account from TVault for password rotation.\"]}"); } }  }
ServiceAccountsService { public ResponseEntity<String> offboardServiceAccount(String token, OnboardedServiceAccount serviceAccount, UserDetails userDetails) { String managedBy = ""; String svcAccName = serviceAccount.getName(); ResponseEntity<String> svcAccPolicyDeletionResponse = deleteServiceAccountPolicies(token, svcAccName); if (!HttpStatus.OK.equals(svcAccPolicyDeletionResponse.getStatusCode())) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "offboardServiceAccount"). put(LogMessage.MESSAGE, String.format ("Failed to delete some of the policies for service account")). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } String _path = TVaultConstants.SVC_ACC_ROLES_METADATA_MOUNT_PATH + "/" + svcAccName; Response metaResponse = reqProcessor.process("/sdb","{\"path\":\""+_path+"\"}",token); Map<String, Object> responseMap = null; try { responseMap = new ObjectMapper().readValue(metaResponse.getResponse(), new TypeReference<Map<String, Object>>(){}); } catch (IOException e) { log.error(e); return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"Error Fetching existing service account info \"]}"); } if(responseMap!=null && responseMap.get("data")!=null){ Map<String,Object> metadataMap = (Map<String,Object>)responseMap.get("data"); Map<String,String> awsroles = (Map<String, String>)metadataMap.get("aws-roles"); Map<String,String> approles = (Map<String, String>)metadataMap.get("app-roles"); Map<String,String> groups = (Map<String, String>)metadataMap.get("groups"); Map<String,String> users = (Map<String, String>) metadataMap.get("users"); managedBy = (String) metadataMap.get("managedBy"); if (!org.apache.commons.lang3.StringUtils.isEmpty(managedBy)) { if (null == users) { users = new HashMap<>(); } users.put(managedBy, "sudo"); } updateUserPolicyAssociationOnSvcaccDelete(svcAccName, users, token, userDetails); updateGroupPolicyAssociationOnSvcaccDelete(svcAccName,groups,token, userDetails); deleteAwsRoleonOnSvcaccDelete(svcAccName,awsroles,token); updateApprolePolicyAssociationOnSvcaccDelete(svcAccName,approles,token); } ResponseEntity<String> accountRoleDeletionResponse = deleteAccountRole(token, serviceAccount); if (HttpStatus.OK.equals(accountRoleDeletionResponse.getStatusCode())) { serviceAccount.setOwner(managedBy); ResponseEntity<String> metadataUpdateResponse = deleteMetadata(token, serviceAccount); if (HttpStatus.OK.equals(metadataUpdateResponse.getStatusCode())) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "offboardServiceAccount"). put(LogMessage.MESSAGE, String.format ("Successfully completed offboarding of AD service account from TVault for password rotation.")). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.OK).body("{\"messages\":[\"Successfully completed offboarding of AD service account from TVault for password rotation.\"]}"); } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "offboardServiceAccount"). put(LogMessage.MESSAGE, String.format ("Unable to delete Metadata for the Service Account")). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.MULTI_STATUS).body("{\"errors\":[\"Failed to offboard AD service account from TVault for password rotation.\"]}"); } } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "offboardServiceAccount"). put(LogMessage.MESSAGE, String.format ("Failed to offboard AD service account from TVault for password rotation.")). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.MULTI_STATUS).body("{\"errors\":[\"Failed to offboard AD service account from TVault for password rotation.\"]}"); } }  ResponseEntity<ADServiceAccountObjects> getADServiceAccounts(String token, UserDetails userDetails, String UserPrincipalName, boolean excludeOnboarded); ResponseEntity<String> onboardServiceAccount(String token, ServiceAccount serviceAccount, UserDetails userDetails); ResponseEntity<String> offboardServiceAccount(String token, OnboardedServiceAccount serviceAccount, UserDetails userDetails); ResponseEntity<String> addUserToServiceAccount(String token, ServiceAccountUser serviceAccountUser, UserDetails userDetails, boolean isPartOfSvcAccOnboard); ResponseEntity<String> removeUserFromServiceAccount(String token, ServiceAccountUser serviceAccountUser, UserDetails userDetails); ResponseEntity<String> resetSvcAccPassword(String token, String svcAccName, UserDetails userDetails); ResponseEntity<String> readSvcAccPassword(String token, String svcAccName, UserDetails userDetails); ResponseEntity<String> getOnboarderdServiceAccount(String token, String svcAccName, UserDetails userDetails); boolean canAddOrRemoveUser(UserDetails userDetails, ServiceAccountUser serviceAccountUser, String action); ResponseEntity<String> getOnboardedServiceAccounts(String token,  UserDetails userDetails); boolean hasAddOrRemovePermission(UserDetails userDetails, String serviceAccount, String token); boolean hasAddUserPermission(UserDetails userDetails, String serviceAccount, String token, boolean isPartOfSvcAccOnboard); static boolean isSvcaccPermissionInputValid(String access); ResponseEntity<String> addGroupToServiceAccount(String token, ServiceAccountGroup serviceAccountGroup, UserDetails userDetails); ResponseEntity<String> removeGroupFromServiceAccount(String token, ServiceAccountGroup serviceAccountGroup, UserDetails userDetails); ResponseEntity<String> associateApproletoSvcAcc(UserDetails userDetails, String token, ServiceAccountApprole serviceAccountApprole); ResponseEntity<String> getServiceAccountMeta(String token, UserDetails userDetails, String path); ResponseEntity<String> removeApproleFromSvcAcc(UserDetails userDetails, String token, ServiceAccountApprole serviceAccountApprole); ResponseEntity<String> addAwsRoleToSvcacc(UserDetails userDetails, String token, ServiceAccountAWSRole serviceAccountAWSRole); ResponseEntity<String> removeAWSRoleFromSvcacc(UserDetails userDetails, String token, ServiceAccountAWSRole serviceAccountAWSRole); ResponseEntity<String> createAWSRole(UserDetails userDetails, String token, AWSLoginRole awsLoginRole); ResponseEntity<String> createIAMRole(UserDetails userDetails, String token, AWSIAMRole awsiamRole); ResponseEntity<String> updateOnboardedServiceAccount(String token, ServiceAccount serviceAccount, UserDetails userDetails); ResponseEntity<String> transferSvcAccountOwner(UserDetails userDetails, String token, String svcAccName); ResponseEntity<String> getServiceAccounts(UserDetails userDetails, String userToken); }
ServiceAccountsService { public ResponseEntity<String> offboardServiceAccount(String token, OnboardedServiceAccount serviceAccount, UserDetails userDetails) { String managedBy = ""; String svcAccName = serviceAccount.getName(); ResponseEntity<String> svcAccPolicyDeletionResponse = deleteServiceAccountPolicies(token, svcAccName); if (!HttpStatus.OK.equals(svcAccPolicyDeletionResponse.getStatusCode())) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "offboardServiceAccount"). put(LogMessage.MESSAGE, String.format ("Failed to delete some of the policies for service account")). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } String _path = TVaultConstants.SVC_ACC_ROLES_METADATA_MOUNT_PATH + "/" + svcAccName; Response metaResponse = reqProcessor.process("/sdb","{\"path\":\""+_path+"\"}",token); Map<String, Object> responseMap = null; try { responseMap = new ObjectMapper().readValue(metaResponse.getResponse(), new TypeReference<Map<String, Object>>(){}); } catch (IOException e) { log.error(e); return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"Error Fetching existing service account info \"]}"); } if(responseMap!=null && responseMap.get("data")!=null){ Map<String,Object> metadataMap = (Map<String,Object>)responseMap.get("data"); Map<String,String> awsroles = (Map<String, String>)metadataMap.get("aws-roles"); Map<String,String> approles = (Map<String, String>)metadataMap.get("app-roles"); Map<String,String> groups = (Map<String, String>)metadataMap.get("groups"); Map<String,String> users = (Map<String, String>) metadataMap.get("users"); managedBy = (String) metadataMap.get("managedBy"); if (!org.apache.commons.lang3.StringUtils.isEmpty(managedBy)) { if (null == users) { users = new HashMap<>(); } users.put(managedBy, "sudo"); } updateUserPolicyAssociationOnSvcaccDelete(svcAccName, users, token, userDetails); updateGroupPolicyAssociationOnSvcaccDelete(svcAccName,groups,token, userDetails); deleteAwsRoleonOnSvcaccDelete(svcAccName,awsroles,token); updateApprolePolicyAssociationOnSvcaccDelete(svcAccName,approles,token); } ResponseEntity<String> accountRoleDeletionResponse = deleteAccountRole(token, serviceAccount); if (HttpStatus.OK.equals(accountRoleDeletionResponse.getStatusCode())) { serviceAccount.setOwner(managedBy); ResponseEntity<String> metadataUpdateResponse = deleteMetadata(token, serviceAccount); if (HttpStatus.OK.equals(metadataUpdateResponse.getStatusCode())) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "offboardServiceAccount"). put(LogMessage.MESSAGE, String.format ("Successfully completed offboarding of AD service account from TVault for password rotation.")). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.OK).body("{\"messages\":[\"Successfully completed offboarding of AD service account from TVault for password rotation.\"]}"); } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "offboardServiceAccount"). put(LogMessage.MESSAGE, String.format ("Unable to delete Metadata for the Service Account")). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.MULTI_STATUS).body("{\"errors\":[\"Failed to offboard AD service account from TVault for password rotation.\"]}"); } } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "offboardServiceAccount"). put(LogMessage.MESSAGE, String.format ("Failed to offboard AD service account from TVault for password rotation.")). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.MULTI_STATUS).body("{\"errors\":[\"Failed to offboard AD service account from TVault for password rotation.\"]}"); } }  ResponseEntity<ADServiceAccountObjects> getADServiceAccounts(String token, UserDetails userDetails, String UserPrincipalName, boolean excludeOnboarded); ResponseEntity<String> onboardServiceAccount(String token, ServiceAccount serviceAccount, UserDetails userDetails); ResponseEntity<String> offboardServiceAccount(String token, OnboardedServiceAccount serviceAccount, UserDetails userDetails); ResponseEntity<String> addUserToServiceAccount(String token, ServiceAccountUser serviceAccountUser, UserDetails userDetails, boolean isPartOfSvcAccOnboard); ResponseEntity<String> removeUserFromServiceAccount(String token, ServiceAccountUser serviceAccountUser, UserDetails userDetails); ResponseEntity<String> resetSvcAccPassword(String token, String svcAccName, UserDetails userDetails); ResponseEntity<String> readSvcAccPassword(String token, String svcAccName, UserDetails userDetails); ResponseEntity<String> getOnboarderdServiceAccount(String token, String svcAccName, UserDetails userDetails); boolean canAddOrRemoveUser(UserDetails userDetails, ServiceAccountUser serviceAccountUser, String action); ResponseEntity<String> getOnboardedServiceAccounts(String token,  UserDetails userDetails); boolean hasAddOrRemovePermission(UserDetails userDetails, String serviceAccount, String token); boolean hasAddUserPermission(UserDetails userDetails, String serviceAccount, String token, boolean isPartOfSvcAccOnboard); static boolean isSvcaccPermissionInputValid(String access); ResponseEntity<String> addGroupToServiceAccount(String token, ServiceAccountGroup serviceAccountGroup, UserDetails userDetails); ResponseEntity<String> removeGroupFromServiceAccount(String token, ServiceAccountGroup serviceAccountGroup, UserDetails userDetails); ResponseEntity<String> associateApproletoSvcAcc(UserDetails userDetails, String token, ServiceAccountApprole serviceAccountApprole); ResponseEntity<String> getServiceAccountMeta(String token, UserDetails userDetails, String path); ResponseEntity<String> removeApproleFromSvcAcc(UserDetails userDetails, String token, ServiceAccountApprole serviceAccountApprole); ResponseEntity<String> addAwsRoleToSvcacc(UserDetails userDetails, String token, ServiceAccountAWSRole serviceAccountAWSRole); ResponseEntity<String> removeAWSRoleFromSvcacc(UserDetails userDetails, String token, ServiceAccountAWSRole serviceAccountAWSRole); ResponseEntity<String> createAWSRole(UserDetails userDetails, String token, AWSLoginRole awsLoginRole); ResponseEntity<String> createIAMRole(UserDetails userDetails, String token, AWSIAMRole awsiamRole); ResponseEntity<String> updateOnboardedServiceAccount(String token, ServiceAccount serviceAccount, UserDetails userDetails); ResponseEntity<String> transferSvcAccountOwner(UserDetails userDetails, String token, String svcAccName); ResponseEntity<String> getServiceAccounts(UserDetails userDetails, String userToken);  }