@Test public void test_resetSvcAccPassword_bad_request() { UserDetails userDetails = getMockUser(true); String token = userDetails.getClientToken(); String svcAccName = "testacc03"; ServiceAccount serviceAccount = generateServiceAccount("testacc02","testacc01"); serviceAccount.setAutoRotate(true); ServiceAccountTTL serviceAccountTTL = new ServiceAccountTTL(); serviceAccountTTL.setRole_name(serviceAccount.getName()); serviceAccountTTL.setService_account_name(serviceAccount.getName() + "@aaa.bbb.ccc.com") ; serviceAccountTTL.setTtl(serviceAccount.getTtl()); String svc_account_payload = getJSON(serviceAccountTTL); when(JSONUtil.getJSON(Mockito.any(ServiceAccountTTL.class))).thenReturn(svc_account_payload); Response onboardResponse = getMockResponse(HttpStatus.OK, true, "{\"messages\":[\"Successfully created service account role.\"]}"); when(reqProcessor.process("/ad/serviceaccount/onboard", svc_account_payload, token)).thenReturn(onboardResponse); Map<String,Object> rqstParams = new HashMap<>(); rqstParams.put("service_account_name",svcAccName); rqstParams.put("ttl", 10); rqstParams.put("last_vault_rotation", "2018-05-24T17:14:38.677370855Z"); rqstParams.put("password_last_set","2018-05-24T17:14:38.6038495Z"); Response svcAccDetailsRes = getMockResponse(HttpStatus.OK, true, getJSON(rqstParams)); when(reqProcessor.process("/ad/serviceaccount/details","{\"role_name\":\""+svcAccName+"\"}",token)).thenReturn(svcAccDetailsRes); String expectedOutput = "{\"errors\":[\"Unable to reset password details for the given service account. Failed to read the updated password after setting ttl to 1 second.\"]}"; Response pwdResetResponse = getMockResponse(HttpStatus.BAD_REQUEST, true, expectedOutput); when(reqProcessor.process("/ad/serviceaccount/resetpwd","{\"role_name\":\""+svcAccName+"\"}",token)).thenReturn(pwdResetResponse); ResponseEntity<String> responseEntityExpected = ResponseEntity.status(HttpStatus.BAD_REQUEST).body(expectedOutput); when(reqProcessor.process(eq("/sdb"),Mockito.any(),eq(token))).thenReturn(getMockResponse(HttpStatus.OK, true, "{\"data\":{\"initialPasswordReset\":true,\"managedBy\":\"normaluser\",\"name\":\"svc_vault_test5\",\"users\":{\"normaluser\":\"sudo\"}}}")); ResponseEntity<String> responseEntity = serviceAccountsService.resetSvcAccPassword(token, svcAccName, userDetails); assertEquals(HttpStatus.BAD_REQUEST, responseEntity.getStatusCode()); assertEquals(responseEntityExpected, responseEntity); }
public ResponseEntity<String> resetSvcAccPassword(String token, String svcAccName, UserDetails userDetails){ log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Trying to reset service account password [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); OnboardedServiceAccountDetails onbSvcAccDtls = getOnboarderdServiceAccountDetails(token, svcAccName); if (onbSvcAccDtls == null) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Unable to reset password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to reset password details for the given service account\"]}"); } long ttl = onbSvcAccDtls.getTtl(); ServiceAccount serviceAccount = new ServiceAccount(); serviceAccount.setName(svcAccName); serviceAccount.setAutoRotate(true); serviceAccount.setTtl(1L); ResponseEntity<String> roleCreationResetResponse = createAccountRole(token, serviceAccount); if(roleCreationResetResponse.getStatusCode().equals(HttpStatus.OK)) { sleep(); Response resetResponse = reqProcessor.process("/ad/serviceaccount/resetpwd","{\"role_name\":\""+svcAccName+"\"}",token); if(HttpStatus.OK.equals(resetResponse.getHttpstatus())) { serviceAccount.setTtl(ttl); ResponseEntity<String> roleCreationResponse = createAccountRole(token, serviceAccount); if(roleCreationResponse.getStatusCode().equals(HttpStatus.OK)) { Response response = reqProcessor.process("/ad/serviceaccount/readpwd","{\"role_name\":\""+svcAccName+"\"}",token); if(HttpStatus.OK.equals(response.getHttpstatus())) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Successfully reset service account password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); try { ADServiceAccountCreds adServiceAccountCreds = new ADServiceAccountCreds(); Map<String, Object> requestParams = new ObjectMapper().readValue(response.getResponse(), new TypeReference<Map<String, Object>>(){}); if (requestParams.get("current_password") != null) { adServiceAccountCreds.setCurrent_password((String) requestParams.get("current_password")); } if (requestParams.get("username") != null) { adServiceAccountCreds.setUsername((String) requestParams.get("username")); } if (requestParams.get("last_password") != null ) { adServiceAccountCreds.setLast_password((String) requestParams.get("last_password")); } Response metaDataResponse = getMetadata(token, userDetails, TVaultConstants.SVC_ACC_ROLES_PATH + svcAccName); if (metaDataResponse!=null) { try { JsonNode metaNode = new ObjectMapper().readTree(metaDataResponse.getResponse()).get("data").get("initialPasswordReset"); if (metaNode != null) { boolean initialResetStatus = false; initialResetStatus = Boolean.parseBoolean(metaNode.asText()); if (!initialResetStatus) { String path = new StringBuffer(TVaultConstants.SVC_ACC_ROLES_PATH).append(svcAccName).toString(); Map<String,String> params = new Hashtable<>(); params.put("type", "initialPasswordReset"); params.put("path",path); params.put("value","true"); Response metadataResponse = ControllerUtil.updateMetadataOnSvcaccPwdReset(params,token); if(metadataResponse !=null && (HttpStatus.NO_CONTENT.equals(metadataResponse.getHttpstatus()) || HttpStatus.OK.equals(metadataResponse.getHttpstatus()))){ log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Update metadata on password reset"). put(LogMessage.MESSAGE, "Metadata update Success."). put(LogMessage.STATUS, metadataResponse.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } else { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Update metadata on password reset"). put(LogMessage.MESSAGE, "Metadata update failed."). put(LogMessage.STATUS, metadataResponse!=null?metadataResponse.getHttpstatus().toString():HttpStatus.BAD_REQUEST.toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } metaNode = new ObjectMapper().readTree(metaDataResponse.getResponse()).get("data").get("managedBy"); String svcOwner = metaNode.asText(); ServiceAccountUser serviceAccountOwner = new ServiceAccountUser(svcAccName, svcOwner, TVaultConstants.RESET_POLICY); ResponseEntity<String> addOwnerWriteToServiceAccountResponse = addUserToServiceAccount(token, serviceAccountOwner, userDetails, false); if (addOwnerWriteToServiceAccountResponse!= null && HttpStatus.NO_CONTENT.equals(addOwnerWriteToServiceAccountResponse.getStatusCode())) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "readSvcAccPassword"). put(LogMessage.MESSAGE, "Updated write permission to Service account owner as part of initial reset."). put(LogMessage.STATUS, addOwnerWriteToServiceAccountResponse.getStatusCode().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } } } } catch (IOException e) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format ("Failed to get metadata for the Service account [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format ("Failed to get metadata for the Service account [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } return ResponseEntity.status(HttpStatus.OK).body(JSONUtil.getJSON(adServiceAccountCreds)); } catch(Exception ex) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "readSvcAccPassword"). put(LogMessage.MESSAGE, String.format("There are no service accounts currently onboarded or error in retrieving credentials for the onboarded service account [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to get password details for the given service account\"]}"); } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Unable to reset password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to reset password details for the given service account. Failed to read the updated password.\"]}"); } } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Unable to reset password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to reset password details for the given service account. Failed to reset the service account with original ttl.\"]}"); } } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Unable to reset password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); serviceAccount.setTtl(ttl); ResponseEntity<String> roleCreationResponse = createAccountRole(token, serviceAccount); if(roleCreationResponse.getStatusCode().equals(HttpStatus.OK)) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Unable to reset password for [%s]. Role updated back to the correct ttl", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } if (HttpStatus.FORBIDDEN.equals(resetResponse.getHttpstatus())) { return ResponseEntity.status(HttpStatus.FORBIDDEN).body("{\"errors\":[\"Access denied: Unable to reset password details for the given service account.\"]}"); } else { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to reset password details for the given service account. Failed to read the updated password after setting ttl to 1 second.\"]}"); } } } log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Unable to reset password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to reset password details for the given service account\"]}"); }
ServiceAccountsService { public ResponseEntity<String> resetSvcAccPassword(String token, String svcAccName, UserDetails userDetails){ log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Trying to reset service account password [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); OnboardedServiceAccountDetails onbSvcAccDtls = getOnboarderdServiceAccountDetails(token, svcAccName); if (onbSvcAccDtls == null) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Unable to reset password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to reset password details for the given service account\"]}"); } long ttl = onbSvcAccDtls.getTtl(); ServiceAccount serviceAccount = new ServiceAccount(); serviceAccount.setName(svcAccName); serviceAccount.setAutoRotate(true); serviceAccount.setTtl(1L); ResponseEntity<String> roleCreationResetResponse = createAccountRole(token, serviceAccount); if(roleCreationResetResponse.getStatusCode().equals(HttpStatus.OK)) { sleep(); Response resetResponse = reqProcessor.process("/ad/serviceaccount/resetpwd","{\"role_name\":\""+svcAccName+"\"}",token); if(HttpStatus.OK.equals(resetResponse.getHttpstatus())) { serviceAccount.setTtl(ttl); ResponseEntity<String> roleCreationResponse = createAccountRole(token, serviceAccount); if(roleCreationResponse.getStatusCode().equals(HttpStatus.OK)) { Response response = reqProcessor.process("/ad/serviceaccount/readpwd","{\"role_name\":\""+svcAccName+"\"}",token); if(HttpStatus.OK.equals(response.getHttpstatus())) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Successfully reset service account password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); try { ADServiceAccountCreds adServiceAccountCreds = new ADServiceAccountCreds(); Map<String, Object> requestParams = new ObjectMapper().readValue(response.getResponse(), new TypeReference<Map<String, Object>>(){}); if (requestParams.get("current_password") != null) { adServiceAccountCreds.setCurrent_password((String) requestParams.get("current_password")); } if (requestParams.get("username") != null) { adServiceAccountCreds.setUsername((String) requestParams.get("username")); } if (requestParams.get("last_password") != null ) { adServiceAccountCreds.setLast_password((String) requestParams.get("last_password")); } Response metaDataResponse = getMetadata(token, userDetails, TVaultConstants.SVC_ACC_ROLES_PATH + svcAccName); if (metaDataResponse!=null) { try { JsonNode metaNode = new ObjectMapper().readTree(metaDataResponse.getResponse()).get("data").get("initialPasswordReset"); if (metaNode != null) { boolean initialResetStatus = false; initialResetStatus = Boolean.parseBoolean(metaNode.asText()); if (!initialResetStatus) { String path = new StringBuffer(TVaultConstants.SVC_ACC_ROLES_PATH).append(svcAccName).toString(); Map<String,String> params = new Hashtable<>(); params.put("type", "initialPasswordReset"); params.put("path",path); params.put("value","true"); Response metadataResponse = ControllerUtil.updateMetadataOnSvcaccPwdReset(params,token); if(metadataResponse !=null && (HttpStatus.NO_CONTENT.equals(metadataResponse.getHttpstatus()) || HttpStatus.OK.equals(metadataResponse.getHttpstatus()))){ log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Update metadata on password reset"). put(LogMessage.MESSAGE, "Metadata update Success."). put(LogMessage.STATUS, metadataResponse.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } else { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Update metadata on password reset"). put(LogMessage.MESSAGE, "Metadata update failed."). put(LogMessage.STATUS, metadataResponse!=null?metadataResponse.getHttpstatus().toString():HttpStatus.BAD_REQUEST.toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } metaNode = new ObjectMapper().readTree(metaDataResponse.getResponse()).get("data").get("managedBy"); String svcOwner = metaNode.asText(); ServiceAccountUser serviceAccountOwner = new ServiceAccountUser(svcAccName, svcOwner, TVaultConstants.RESET_POLICY); ResponseEntity<String> addOwnerWriteToServiceAccountResponse = addUserToServiceAccount(token, serviceAccountOwner, userDetails, false); if (addOwnerWriteToServiceAccountResponse!= null && HttpStatus.NO_CONTENT.equals(addOwnerWriteToServiceAccountResponse.getStatusCode())) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "readSvcAccPassword"). put(LogMessage.MESSAGE, "Updated write permission to Service account owner as part of initial reset."). put(LogMessage.STATUS, addOwnerWriteToServiceAccountResponse.getStatusCode().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } } } } catch (IOException e) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format ("Failed to get metadata for the Service account [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format ("Failed to get metadata for the Service account [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } return ResponseEntity.status(HttpStatus.OK).body(JSONUtil.getJSON(adServiceAccountCreds)); } catch(Exception ex) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "readSvcAccPassword"). put(LogMessage.MESSAGE, String.format("There are no service accounts currently onboarded or error in retrieving credentials for the onboarded service account [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to get password details for the given service account\"]}"); } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Unable to reset password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to reset password details for the given service account. Failed to read the updated password.\"]}"); } } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Unable to reset password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to reset password details for the given service account. Failed to reset the service account with original ttl.\"]}"); } } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Unable to reset password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); serviceAccount.setTtl(ttl); ResponseEntity<String> roleCreationResponse = createAccountRole(token, serviceAccount); if(roleCreationResponse.getStatusCode().equals(HttpStatus.OK)) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Unable to reset password for [%s]. Role updated back to the correct ttl", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } if (HttpStatus.FORBIDDEN.equals(resetResponse.getHttpstatus())) { return ResponseEntity.status(HttpStatus.FORBIDDEN).body("{\"errors\":[\"Access denied: Unable to reset password details for the given service account.\"]}"); } else { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to reset password details for the given service account. Failed to read the updated password after setting ttl to 1 second.\"]}"); } } } log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Unable to reset password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to reset password details for the given service account\"]}"); } }
ServiceAccountsService { public ResponseEntity<String> resetSvcAccPassword(String token, String svcAccName, UserDetails userDetails){ log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Trying to reset service account password [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); OnboardedServiceAccountDetails onbSvcAccDtls = getOnboarderdServiceAccountDetails(token, svcAccName); if (onbSvcAccDtls == null) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Unable to reset password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to reset password details for the given service account\"]}"); } long ttl = onbSvcAccDtls.getTtl(); ServiceAccount serviceAccount = new ServiceAccount(); serviceAccount.setName(svcAccName); serviceAccount.setAutoRotate(true); serviceAccount.setTtl(1L); ResponseEntity<String> roleCreationResetResponse = createAccountRole(token, serviceAccount); if(roleCreationResetResponse.getStatusCode().equals(HttpStatus.OK)) { sleep(); Response resetResponse = reqProcessor.process("/ad/serviceaccount/resetpwd","{\"role_name\":\""+svcAccName+"\"}",token); if(HttpStatus.OK.equals(resetResponse.getHttpstatus())) { serviceAccount.setTtl(ttl); ResponseEntity<String> roleCreationResponse = createAccountRole(token, serviceAccount); if(roleCreationResponse.getStatusCode().equals(HttpStatus.OK)) { Response response = reqProcessor.process("/ad/serviceaccount/readpwd","{\"role_name\":\""+svcAccName+"\"}",token); if(HttpStatus.OK.equals(response.getHttpstatus())) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Successfully reset service account password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); try { ADServiceAccountCreds adServiceAccountCreds = new ADServiceAccountCreds(); Map<String, Object> requestParams = new ObjectMapper().readValue(response.getResponse(), new TypeReference<Map<String, Object>>(){}); if (requestParams.get("current_password") != null) { adServiceAccountCreds.setCurrent_password((String) requestParams.get("current_password")); } if (requestParams.get("username") != null) { adServiceAccountCreds.setUsername((String) requestParams.get("username")); } if (requestParams.get("last_password") != null ) { adServiceAccountCreds.setLast_password((String) requestParams.get("last_password")); } Response metaDataResponse = getMetadata(token, userDetails, TVaultConstants.SVC_ACC_ROLES_PATH + svcAccName); if (metaDataResponse!=null) { try { JsonNode metaNode = new ObjectMapper().readTree(metaDataResponse.getResponse()).get("data").get("initialPasswordReset"); if (metaNode != null) { boolean initialResetStatus = false; initialResetStatus = Boolean.parseBoolean(metaNode.asText()); if (!initialResetStatus) { String path = new StringBuffer(TVaultConstants.SVC_ACC_ROLES_PATH).append(svcAccName).toString(); Map<String,String> params = new Hashtable<>(); params.put("type", "initialPasswordReset"); params.put("path",path); params.put("value","true"); Response metadataResponse = ControllerUtil.updateMetadataOnSvcaccPwdReset(params,token); if(metadataResponse !=null && (HttpStatus.NO_CONTENT.equals(metadataResponse.getHttpstatus()) || HttpStatus.OK.equals(metadataResponse.getHttpstatus()))){ log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Update metadata on password reset"). put(LogMessage.MESSAGE, "Metadata update Success."). put(LogMessage.STATUS, metadataResponse.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } else { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Update metadata on password reset"). put(LogMessage.MESSAGE, "Metadata update failed."). put(LogMessage.STATUS, metadataResponse!=null?metadataResponse.getHttpstatus().toString():HttpStatus.BAD_REQUEST.toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } metaNode = new ObjectMapper().readTree(metaDataResponse.getResponse()).get("data").get("managedBy"); String svcOwner = metaNode.asText(); ServiceAccountUser serviceAccountOwner = new ServiceAccountUser(svcAccName, svcOwner, TVaultConstants.RESET_POLICY); ResponseEntity<String> addOwnerWriteToServiceAccountResponse = addUserToServiceAccount(token, serviceAccountOwner, userDetails, false); if (addOwnerWriteToServiceAccountResponse!= null && HttpStatus.NO_CONTENT.equals(addOwnerWriteToServiceAccountResponse.getStatusCode())) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "readSvcAccPassword"). put(LogMessage.MESSAGE, "Updated write permission to Service account owner as part of initial reset."). put(LogMessage.STATUS, addOwnerWriteToServiceAccountResponse.getStatusCode().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } } } } catch (IOException e) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format ("Failed to get metadata for the Service account [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format ("Failed to get metadata for the Service account [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } return ResponseEntity.status(HttpStatus.OK).body(JSONUtil.getJSON(adServiceAccountCreds)); } catch(Exception ex) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "readSvcAccPassword"). put(LogMessage.MESSAGE, String.format("There are no service accounts currently onboarded or error in retrieving credentials for the onboarded service account [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to get password details for the given service account\"]}"); } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Unable to reset password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to reset password details for the given service account. Failed to read the updated password.\"]}"); } } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Unable to reset password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to reset password details for the given service account. Failed to reset the service account with original ttl.\"]}"); } } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Unable to reset password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); serviceAccount.setTtl(ttl); ResponseEntity<String> roleCreationResponse = createAccountRole(token, serviceAccount); if(roleCreationResponse.getStatusCode().equals(HttpStatus.OK)) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Unable to reset password for [%s]. Role updated back to the correct ttl", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } if (HttpStatus.FORBIDDEN.equals(resetResponse.getHttpstatus())) { return ResponseEntity.status(HttpStatus.FORBIDDEN).body("{\"errors\":[\"Access denied: Unable to reset password details for the given service account.\"]}"); } else { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to reset password details for the given service account. Failed to read the updated password after setting ttl to 1 second.\"]}"); } } } log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Unable to reset password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to reset password details for the given service account\"]}"); }  }
ServiceAccountsService { public ResponseEntity<String> resetSvcAccPassword(String token, String svcAccName, UserDetails userDetails){ log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Trying to reset service account password [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); OnboardedServiceAccountDetails onbSvcAccDtls = getOnboarderdServiceAccountDetails(token, svcAccName); if (onbSvcAccDtls == null) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Unable to reset password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to reset password details for the given service account\"]}"); } long ttl = onbSvcAccDtls.getTtl(); ServiceAccount serviceAccount = new ServiceAccount(); serviceAccount.setName(svcAccName); serviceAccount.setAutoRotate(true); serviceAccount.setTtl(1L); ResponseEntity<String> roleCreationResetResponse = createAccountRole(token, serviceAccount); if(roleCreationResetResponse.getStatusCode().equals(HttpStatus.OK)) { sleep(); Response resetResponse = reqProcessor.process("/ad/serviceaccount/resetpwd","{\"role_name\":\""+svcAccName+"\"}",token); if(HttpStatus.OK.equals(resetResponse.getHttpstatus())) { serviceAccount.setTtl(ttl); ResponseEntity<String> roleCreationResponse = createAccountRole(token, serviceAccount); if(roleCreationResponse.getStatusCode().equals(HttpStatus.OK)) { Response response = reqProcessor.process("/ad/serviceaccount/readpwd","{\"role_name\":\""+svcAccName+"\"}",token); if(HttpStatus.OK.equals(response.getHttpstatus())) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Successfully reset service account password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); try { ADServiceAccountCreds adServiceAccountCreds = new ADServiceAccountCreds(); Map<String, Object> requestParams = new ObjectMapper().readValue(response.getResponse(), new TypeReference<Map<String, Object>>(){}); if (requestParams.get("current_password") != null) { adServiceAccountCreds.setCurrent_password((String) requestParams.get("current_password")); } if (requestParams.get("username") != null) { adServiceAccountCreds.setUsername((String) requestParams.get("username")); } if (requestParams.get("last_password") != null ) { adServiceAccountCreds.setLast_password((String) requestParams.get("last_password")); } Response metaDataResponse = getMetadata(token, userDetails, TVaultConstants.SVC_ACC_ROLES_PATH + svcAccName); if (metaDataResponse!=null) { try { JsonNode metaNode = new ObjectMapper().readTree(metaDataResponse.getResponse()).get("data").get("initialPasswordReset"); if (metaNode != null) { boolean initialResetStatus = false; initialResetStatus = Boolean.parseBoolean(metaNode.asText()); if (!initialResetStatus) { String path = new StringBuffer(TVaultConstants.SVC_ACC_ROLES_PATH).append(svcAccName).toString(); Map<String,String> params = new Hashtable<>(); params.put("type", "initialPasswordReset"); params.put("path",path); params.put("value","true"); Response metadataResponse = ControllerUtil.updateMetadataOnSvcaccPwdReset(params,token); if(metadataResponse !=null && (HttpStatus.NO_CONTENT.equals(metadataResponse.getHttpstatus()) || HttpStatus.OK.equals(metadataResponse.getHttpstatus()))){ log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Update metadata on password reset"). put(LogMessage.MESSAGE, "Metadata update Success."). put(LogMessage.STATUS, metadataResponse.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } else { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Update metadata on password reset"). put(LogMessage.MESSAGE, "Metadata update failed."). put(LogMessage.STATUS, metadataResponse!=null?metadataResponse.getHttpstatus().toString():HttpStatus.BAD_REQUEST.toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } metaNode = new ObjectMapper().readTree(metaDataResponse.getResponse()).get("data").get("managedBy"); String svcOwner = metaNode.asText(); ServiceAccountUser serviceAccountOwner = new ServiceAccountUser(svcAccName, svcOwner, TVaultConstants.RESET_POLICY); ResponseEntity<String> addOwnerWriteToServiceAccountResponse = addUserToServiceAccount(token, serviceAccountOwner, userDetails, false); if (addOwnerWriteToServiceAccountResponse!= null && HttpStatus.NO_CONTENT.equals(addOwnerWriteToServiceAccountResponse.getStatusCode())) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "readSvcAccPassword"). put(LogMessage.MESSAGE, "Updated write permission to Service account owner as part of initial reset."). put(LogMessage.STATUS, addOwnerWriteToServiceAccountResponse.getStatusCode().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } } } } catch (IOException e) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format ("Failed to get metadata for the Service account [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format ("Failed to get metadata for the Service account [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } return ResponseEntity.status(HttpStatus.OK).body(JSONUtil.getJSON(adServiceAccountCreds)); } catch(Exception ex) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "readSvcAccPassword"). put(LogMessage.MESSAGE, String.format("There are no service accounts currently onboarded or error in retrieving credentials for the onboarded service account [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to get password details for the given service account\"]}"); } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Unable to reset password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to reset password details for the given service account. Failed to read the updated password.\"]}"); } } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Unable to reset password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to reset password details for the given service account. Failed to reset the service account with original ttl.\"]}"); } } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Unable to reset password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); serviceAccount.setTtl(ttl); ResponseEntity<String> roleCreationResponse = createAccountRole(token, serviceAccount); if(roleCreationResponse.getStatusCode().equals(HttpStatus.OK)) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Unable to reset password for [%s]. Role updated back to the correct ttl", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } if (HttpStatus.FORBIDDEN.equals(resetResponse.getHttpstatus())) { return ResponseEntity.status(HttpStatus.FORBIDDEN).body("{\"errors\":[\"Access denied: Unable to reset password details for the given service account.\"]}"); } else { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to reset password details for the given service account. Failed to read the updated password after setting ttl to 1 second.\"]}"); } } } log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Unable to reset password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to reset password details for the given service account\"]}"); }  ResponseEntity<ADServiceAccountObjects> getADServiceAccounts(String token, UserDetails userDetails, String UserPrincipalName, boolean excludeOnboarded); ResponseEntity<String> onboardServiceAccount(String token, ServiceAccount serviceAccount, UserDetails userDetails); ResponseEntity<String> offboardServiceAccount(String token, OnboardedServiceAccount serviceAccount, UserDetails userDetails); ResponseEntity<String> addUserToServiceAccount(String token, ServiceAccountUser serviceAccountUser, UserDetails userDetails, boolean isPartOfSvcAccOnboard); ResponseEntity<String> removeUserFromServiceAccount(String token, ServiceAccountUser serviceAccountUser, UserDetails userDetails); ResponseEntity<String> resetSvcAccPassword(String token, String svcAccName, UserDetails userDetails); ResponseEntity<String> readSvcAccPassword(String token, String svcAccName, UserDetails userDetails); ResponseEntity<String> getOnboarderdServiceAccount(String token, String svcAccName, UserDetails userDetails); boolean canAddOrRemoveUser(UserDetails userDetails, ServiceAccountUser serviceAccountUser, String action); ResponseEntity<String> getOnboardedServiceAccounts(String token,  UserDetails userDetails); boolean hasAddOrRemovePermission(UserDetails userDetails, String serviceAccount, String token); boolean hasAddUserPermission(UserDetails userDetails, String serviceAccount, String token, boolean isPartOfSvcAccOnboard); static boolean isSvcaccPermissionInputValid(String access); ResponseEntity<String> addGroupToServiceAccount(String token, ServiceAccountGroup serviceAccountGroup, UserDetails userDetails); ResponseEntity<String> removeGroupFromServiceAccount(String token, ServiceAccountGroup serviceAccountGroup, UserDetails userDetails); ResponseEntity<String> associateApproletoSvcAcc(UserDetails userDetails, String token, ServiceAccountApprole serviceAccountApprole); ResponseEntity<String> getServiceAccountMeta(String token, UserDetails userDetails, String path); ResponseEntity<String> removeApproleFromSvcAcc(UserDetails userDetails, String token, ServiceAccountApprole serviceAccountApprole); ResponseEntity<String> addAwsRoleToSvcacc(UserDetails userDetails, String token, ServiceAccountAWSRole serviceAccountAWSRole); ResponseEntity<String> removeAWSRoleFromSvcacc(UserDetails userDetails, String token, ServiceAccountAWSRole serviceAccountAWSRole); ResponseEntity<String> createAWSRole(UserDetails userDetails, String token, AWSLoginRole awsLoginRole); ResponseEntity<String> createIAMRole(UserDetails userDetails, String token, AWSIAMRole awsiamRole); ResponseEntity<String> updateOnboardedServiceAccount(String token, ServiceAccount serviceAccount, UserDetails userDetails); ResponseEntity<String> transferSvcAccountOwner(UserDetails userDetails, String token, String svcAccName); ResponseEntity<String> getServiceAccounts(UserDetails userDetails, String userToken); }
ServiceAccountsService { public ResponseEntity<String> resetSvcAccPassword(String token, String svcAccName, UserDetails userDetails){ log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Trying to reset service account password [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); OnboardedServiceAccountDetails onbSvcAccDtls = getOnboarderdServiceAccountDetails(token, svcAccName); if (onbSvcAccDtls == null) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Unable to reset password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to reset password details for the given service account\"]}"); } long ttl = onbSvcAccDtls.getTtl(); ServiceAccount serviceAccount = new ServiceAccount(); serviceAccount.setName(svcAccName); serviceAccount.setAutoRotate(true); serviceAccount.setTtl(1L); ResponseEntity<String> roleCreationResetResponse = createAccountRole(token, serviceAccount); if(roleCreationResetResponse.getStatusCode().equals(HttpStatus.OK)) { sleep(); Response resetResponse = reqProcessor.process("/ad/serviceaccount/resetpwd","{\"role_name\":\""+svcAccName+"\"}",token); if(HttpStatus.OK.equals(resetResponse.getHttpstatus())) { serviceAccount.setTtl(ttl); ResponseEntity<String> roleCreationResponse = createAccountRole(token, serviceAccount); if(roleCreationResponse.getStatusCode().equals(HttpStatus.OK)) { Response response = reqProcessor.process("/ad/serviceaccount/readpwd","{\"role_name\":\""+svcAccName+"\"}",token); if(HttpStatus.OK.equals(response.getHttpstatus())) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Successfully reset service account password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); try { ADServiceAccountCreds adServiceAccountCreds = new ADServiceAccountCreds(); Map<String, Object> requestParams = new ObjectMapper().readValue(response.getResponse(), new TypeReference<Map<String, Object>>(){}); if (requestParams.get("current_password") != null) { adServiceAccountCreds.setCurrent_password((String) requestParams.get("current_password")); } if (requestParams.get("username") != null) { adServiceAccountCreds.setUsername((String) requestParams.get("username")); } if (requestParams.get("last_password") != null ) { adServiceAccountCreds.setLast_password((String) requestParams.get("last_password")); } Response metaDataResponse = getMetadata(token, userDetails, TVaultConstants.SVC_ACC_ROLES_PATH + svcAccName); if (metaDataResponse!=null) { try { JsonNode metaNode = new ObjectMapper().readTree(metaDataResponse.getResponse()).get("data").get("initialPasswordReset"); if (metaNode != null) { boolean initialResetStatus = false; initialResetStatus = Boolean.parseBoolean(metaNode.asText()); if (!initialResetStatus) { String path = new StringBuffer(TVaultConstants.SVC_ACC_ROLES_PATH).append(svcAccName).toString(); Map<String,String> params = new Hashtable<>(); params.put("type", "initialPasswordReset"); params.put("path",path); params.put("value","true"); Response metadataResponse = ControllerUtil.updateMetadataOnSvcaccPwdReset(params,token); if(metadataResponse !=null && (HttpStatus.NO_CONTENT.equals(metadataResponse.getHttpstatus()) || HttpStatus.OK.equals(metadataResponse.getHttpstatus()))){ log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Update metadata on password reset"). put(LogMessage.MESSAGE, "Metadata update Success."). put(LogMessage.STATUS, metadataResponse.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } else { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Update metadata on password reset"). put(LogMessage.MESSAGE, "Metadata update failed."). put(LogMessage.STATUS, metadataResponse!=null?metadataResponse.getHttpstatus().toString():HttpStatus.BAD_REQUEST.toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } metaNode = new ObjectMapper().readTree(metaDataResponse.getResponse()).get("data").get("managedBy"); String svcOwner = metaNode.asText(); ServiceAccountUser serviceAccountOwner = new ServiceAccountUser(svcAccName, svcOwner, TVaultConstants.RESET_POLICY); ResponseEntity<String> addOwnerWriteToServiceAccountResponse = addUserToServiceAccount(token, serviceAccountOwner, userDetails, false); if (addOwnerWriteToServiceAccountResponse!= null && HttpStatus.NO_CONTENT.equals(addOwnerWriteToServiceAccountResponse.getStatusCode())) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "readSvcAccPassword"). put(LogMessage.MESSAGE, "Updated write permission to Service account owner as part of initial reset."). put(LogMessage.STATUS, addOwnerWriteToServiceAccountResponse.getStatusCode().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } } } } catch (IOException e) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format ("Failed to get metadata for the Service account [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format ("Failed to get metadata for the Service account [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } return ResponseEntity.status(HttpStatus.OK).body(JSONUtil.getJSON(adServiceAccountCreds)); } catch(Exception ex) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "readSvcAccPassword"). put(LogMessage.MESSAGE, String.format("There are no service accounts currently onboarded or error in retrieving credentials for the onboarded service account [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to get password details for the given service account\"]}"); } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Unable to reset password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to reset password details for the given service account. Failed to read the updated password.\"]}"); } } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Unable to reset password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to reset password details for the given service account. Failed to reset the service account with original ttl.\"]}"); } } else { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Unable to reset password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); serviceAccount.setTtl(ttl); ResponseEntity<String> roleCreationResponse = createAccountRole(token, serviceAccount); if(roleCreationResponse.getStatusCode().equals(HttpStatus.OK)) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Unable to reset password for [%s]. Role updated back to the correct ttl", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); } if (HttpStatus.FORBIDDEN.equals(resetResponse.getHttpstatus())) { return ResponseEntity.status(HttpStatus.FORBIDDEN).body("{\"errors\":[\"Access denied: Unable to reset password details for the given service account.\"]}"); } else { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to reset password details for the given service account. Failed to read the updated password after setting ttl to 1 second.\"]}"); } } } log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "resetSvcAccPassword"). put(LogMessage.MESSAGE, String.format("Unable to reset password for [%s]", svcAccName)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Unable to reset password details for the given service account\"]}"); }  ResponseEntity<ADServiceAccountObjects> getADServiceAccounts(String token, UserDetails userDetails, String UserPrincipalName, boolean excludeOnboarded); ResponseEntity<String> onboardServiceAccount(String token, ServiceAccount serviceAccount, UserDetails userDetails); ResponseEntity<String> offboardServiceAccount(String token, OnboardedServiceAccount serviceAccount, UserDetails userDetails); ResponseEntity<String> addUserToServiceAccount(String token, ServiceAccountUser serviceAccountUser, UserDetails userDetails, boolean isPartOfSvcAccOnboard); ResponseEntity<String> removeUserFromServiceAccount(String token, ServiceAccountUser serviceAccountUser, UserDetails userDetails); ResponseEntity<String> resetSvcAccPassword(String token, String svcAccName, UserDetails userDetails); ResponseEntity<String> readSvcAccPassword(String token, String svcAccName, UserDetails userDetails); ResponseEntity<String> getOnboarderdServiceAccount(String token, String svcAccName, UserDetails userDetails); boolean canAddOrRemoveUser(UserDetails userDetails, ServiceAccountUser serviceAccountUser, String action); ResponseEntity<String> getOnboardedServiceAccounts(String token,  UserDetails userDetails); boolean hasAddOrRemovePermission(UserDetails userDetails, String serviceAccount, String token); boolean hasAddUserPermission(UserDetails userDetails, String serviceAccount, String token, boolean isPartOfSvcAccOnboard); static boolean isSvcaccPermissionInputValid(String access); ResponseEntity<String> addGroupToServiceAccount(String token, ServiceAccountGroup serviceAccountGroup, UserDetails userDetails); ResponseEntity<String> removeGroupFromServiceAccount(String token, ServiceAccountGroup serviceAccountGroup, UserDetails userDetails); ResponseEntity<String> associateApproletoSvcAcc(UserDetails userDetails, String token, ServiceAccountApprole serviceAccountApprole); ResponseEntity<String> getServiceAccountMeta(String token, UserDetails userDetails, String path); ResponseEntity<String> removeApproleFromSvcAcc(UserDetails userDetails, String token, ServiceAccountApprole serviceAccountApprole); ResponseEntity<String> addAwsRoleToSvcacc(UserDetails userDetails, String token, ServiceAccountAWSRole serviceAccountAWSRole); ResponseEntity<String> removeAWSRoleFromSvcacc(UserDetails userDetails, String token, ServiceAccountAWSRole serviceAccountAWSRole); ResponseEntity<String> createAWSRole(UserDetails userDetails, String token, AWSLoginRole awsLoginRole); ResponseEntity<String> createIAMRole(UserDetails userDetails, String token, AWSIAMRole awsiamRole); ResponseEntity<String> updateOnboardedServiceAccount(String token, ServiceAccount serviceAccount, UserDetails userDetails); ResponseEntity<String> transferSvcAccountOwner(UserDetails userDetails, String token, String svcAccName); ResponseEntity<String> getServiceAccounts(UserDetails userDetails, String userToken);  }