Examples with CerberusPrincipal com.nike.cerberus.security.CerberusPrincipal used on opensource projects

Example 26 with CerberusPrincipal

use of com.nike.cerberus.security.CerberusPrincipal in project cerberus by Nike-Inc.

the class PermissionValidationServiceTest method testDoesPrincipalHaveReadPermissionWithPrincipalTypeAndGroupsCaseSensitive.

@Test
public void testDoesPrincipalHaveReadPermissionWithPrincipalTypeAndGroupsCaseSensitive() {
    PermissionValidationService permissionValidationService = createPermissionValidationServiceWithGroupCaseSensitive(true);
    Set<String> userGroups = new HashSet<>();
    userGroups.add("userGroup1");
    CerberusPrincipal cerberusPrincipal = mockCerberusPrincipalWithPrincipalTypeAndUserGroups(PrincipalType.USER, userGroups);
    Set<UserGroupPermission> userGroupPermissions = mockUserGroupPermissionWithName();
    Mockito.when(userGroupPermissionService.getUserGroupPermissions("sdbId")).thenReturn(userGroupPermissions);
    boolean hasPermission = permissionValidationService.doesPrincipalHaveReadPermission(cerberusPrincipal, "sdbId");
    Assert.assertTrue(hasPermission);
}

Example 27 with CerberusPrincipal

use of com.nike.cerberus.security.CerberusPrincipal in project cerberus by Nike-Inc.

the class PermissionValidationServiceTest method testDoesPrincipalHaveOwnerPermissionsWithPrincipalTypeIAM.

@Test
public void testDoesPrincipalHaveOwnerPermissionsWithPrincipalTypeIAM() {
    PermissionValidationService permissionValidationService = createPermissionValidationServiceWithGroupCaseSensitive(false);
    SafeDepositBoxV2 safeDepositBoxV2 = mockSafeDepositBoxV2WithId("id");
    Mockito.when(safeDepositBoxService.getSafeDepositBoxDangerouslyWithoutPermissionValidation("sdbId")).thenReturn(safeDepositBoxV2);
    CerberusPrincipal cerberusPrincipal = mockCerberusPrincipalWithPrincipalTypeAndName(PrincipalType.IAM, IAM_PRINCIPAL_ARN);
    String iamRootArn = "iamRootArn";
    Mockito.when(awsIamRoleArnParser.convertPrincipalArnToRootArn(IAM_PRINCIPAL_ARN)).thenReturn(iamRootArn);
    Mockito.when(awsIamRoleArnParser.isAssumedRoleArn(IAM_PRINCIPAL_ARN)).thenReturn(true);
    String iamRoleArn = "iamRoleArn";
    Mockito.when(awsIamRoleArnParser.convertPrincipalArnToRoleArn(IAM_PRINCIPAL_ARN)).thenReturn(iamRoleArn);
    Mockito.when(permissionsDao.doesAssumedRoleHaveRoleForSdb(Mockito.eq("id"), Mockito.eq(IAM_PRINCIPAL_ARN), Mockito.eq(iamRoleArn), Mockito.eq(iamRootArn), Mockito.anySet())).thenReturn(true);
    boolean hasOwnerPermission = permissionValidationService.doesPrincipalHaveOwnerPermissions(cerberusPrincipal, "sdbId");
    Assert.assertTrue(hasOwnerPermission);
    Mockito.verify(awsIamRoleArnParser).convertPrincipalArnToRootArn(IAM_PRINCIPAL_ARN);
    Mockito.verify(awsIamRoleArnParser).isAssumedRoleArn(IAM_PRINCIPAL_ARN);
    Mockito.verify(awsIamRoleArnParser).convertPrincipalArnToRoleArn(IAM_PRINCIPAL_ARN);
    Mockito.verify(permissionsDao, Mockito.never()).doesIamPrincipalHaveRoleForSdb(Mockito.anyString(), Mockito.anyString(), Mockito.anyString(), Mockito.anySet());
}

Example 28 with CerberusPrincipal

use of com.nike.cerberus.security.CerberusPrincipal in project cerberus by Nike-Inc.

the class PermissionValidationServiceTest method testDoesPrincipalHaveSdbPermissionsForActionWhenRequestAttributesWhenServletPathIsSecuredAndHasPermission.

private void testDoesPrincipalHaveSdbPermissionsForActionWhenRequestAttributesWhenServletPathIsSecuredAndHasPermission() {
    PermissionValidationService permissionValidationService = Mockito.spy(createPermissionValidationServiceWithGroupCaseSensitive(false));
    RequestAttributes requestAttributes = mockServletRequestAttributesWithRequestWithServletPath("/v1/secret/1/2/3/4");
    Mockito.when(permissionValidationService.getRequestAttributesFromContext()).thenReturn(requestAttributes);
    Mockito.when(sdbAccessRequest.getCategory()).thenReturn("category");
    Mockito.when(sdbAccessRequest.getSdbSlug()).thenReturn("slug");
    Set<String> userGroups = new HashSet<>();
    userGroups.add("userGroup1");
    CerberusPrincipal cerberusPrincipal = mockCerberusPrincipalWithPrincipalTypeAndUserGroups(PrincipalType.USER, userGroups);
    Mockito.when(permissionValidationService.getCerberusPrincipalFromContext()).thenReturn(cerberusPrincipal);
    Mockito.when(safeDepositBoxService.getSafeDepositBoxIdByPath("category/slug/")).thenReturn(Optional.of("sdbId"));
    Mockito.when(permissionsDao.doesUserHavePermsForRoleAndSdbCaseInsensitive(Mockito.eq("sdbId"), Mockito.anySet(), Mockito.anySet())).thenReturn(true);
    boolean hasPermission = permissionValidationService.doesPrincipalHaveSdbPermissionsForAction("READ");
    Assert.assertTrue(hasPermission);
    Mockito.verify(sdbAccessRequest).setPrincipal(Mockito.any(CerberusPrincipal.class));
    Mockito.verify(sdbAccessRequest).setSdbId("sdbId");
}

Example 29 with CerberusPrincipal

use of com.nike.cerberus.security.CerberusPrincipal in project cerberus by Nike-Inc.

the class AuthenticationServiceTest method tests_that_refreshUserToken_throws_access_denied_token_when_count_is_eq_or_greater_than_limit.

@Test
public void tests_that_refreshUserToken_throws_access_denied_token_when_count_is_eq_or_greater_than_limit() {
    CerberusPrincipal principal = mock(CerberusPrincipal.class);
    when(principal.getPrincipalType()).thenReturn(PrincipalType.USER);
    when(principal.getTokenRefreshCount()).thenReturn(MAX_LIMIT);
    Exception e = null;
    try {
        authenticationService.refreshUserToken(principal);
    } catch (Exception e2) {
        e = e2;
    }
    IsInstanceOf isInstanceOfException = new IsInstanceOf(ApiException.class);
    assertTrue(isInstanceOfException.matches(e));
    assertTrue(((ApiException) e).getApiErrors().contains(DefaultApiError.MAXIMUM_TOKEN_REFRESH_COUNT_REACHED));
}

Example 30 with CerberusPrincipal

use of com.nike.cerberus.security.CerberusPrincipal in project cerberus by Nike-Inc.

the class SecureDataControllerTest method testDeleteSecureData.

@Test
public void testDeleteSecureData() {
    Mockito.when(sdbAccessRequest.getSdbId()).thenReturn("sdbId");
    Mockito.when(sdbAccessRequest.getPath()).thenReturn("path");
    CerberusPrincipal cerberusPrincipal = Mockito.mock(CerberusPrincipal.class);
    Mockito.when(sdbAccessRequest.getPrincipal()).thenReturn(cerberusPrincipal);
    Mockito.when(cerberusPrincipal.getName()).thenReturn("name");
    secureDataController.deleteSecureData();
    Mockito.verify(secureDataService).deleteSecret("sdbId", "path", SecureDataType.OBJECT, "name");
}