Examples with Policy com.yahoo.athenz.zms.Policy used on opensource projects

Example 31 with Policy

use of com.yahoo.athenz.zms.Policy in project athenz by yahoo.

the class DataCacheTest method testPolicyWithAssertions.

@Test
public void testPolicyWithAssertions() {
    Domain domain = new Domain();
    domain.setName("testDomain");
    Role role1 = new Role();
    role1.setName("testDomain.role.role1");
    List<RoleMember> members1 = new ArrayList<>();
    members1.add(new RoleMember().setMemberName("user_domain.user1"));
    members1.add(new RoleMember().setMemberName("user_domain.user2"));
    role1.setRoleMembers(members1);
    Role role2 = new Role();
    role2.setName("testDomain.role.role2");
    List<RoleMember> members2 = new ArrayList<>();
    members2.add(new RoleMember().setMemberName("user_domain.user2"));
    role2.setRoleMembers(members2);
    Role role3 = new Role();
    role3.setName("testDomain.role.role3");
    List<RoleMember> members3 = new ArrayList<>();
    members3.add(new RoleMember().setMemberName("user_domain.user3"));
    role3.setRoleMembers(members3);
    Policy policy = new Policy();
    policy.setName("testDomain.policy.policy1");
    Assertion assertion1 = new Assertion();
    assertion1.setAction("assume_role");
    assertion1.setEffect(AssertionEffect.ALLOW);
    assertion1.setResource("testDomain.roleA");
    assertion1.setRole("testDomain.role.role1");
    Assertion assertion2 = new Assertion();
    assertion2.setAction("read");
    assertion2.setEffect(AssertionEffect.ALLOW);
    assertion2.setResource("testDomain.data:*");
    assertion2.setRole("testDomain.role.role1");
    List<Assertion> assertList = new ArrayList<Assertion>();
    assertList.add(assertion1);
    assertList.add(assertion2);
    policy.setAssertions(assertList);
    DataCache cache = new DataCache();
    cache.processRole(role1);
    cache.processRole(role2);
    cache.processRole(role3);
    HashMap<String, Role> roleList = new HashMap<>();
    roleList.put(role1.getName(), role1);
    roleList.put(role2.getName(), role2);
    roleList.put(role3.getName(), role3);
    cache.processPolicy(domain.getName(), policy, roleList);
    Set<MemberRole> set1 = cache.getMemberRoleSet("user_domain.user1");
    assertNotNull(set1);
    assertTrue(set1.contains(new MemberRole("testDomain.role.role1", 0)));
    assertTrue(set1.contains(new MemberRole("testDomain.roleA", 0)));
    assertEquals(set1.size(), 2);
    Set<MemberRole> set2 = cache.getMemberRoleSet("user_domain.user2");
    assertNotNull(set2);
    assertTrue(set2.contains(new MemberRole("testDomain.role.role1", 0)));
    assertTrue(set2.contains(new MemberRole("testDomain.role.role2", 0)));
    assertTrue(set2.contains(new MemberRole("testDomain.roleA", 0)));
    assertEquals(set2.size(), 3);
    Set<MemberRole> set3 = cache.getMemberRoleSet("user_domain.user3");
    assertNotNull(set3);
    assertTrue(set3.contains(new MemberRole("testDomain.role.role3", 0)));
    assertEquals(set3.size(), 1);
}

Example 32 with Policy

use of com.yahoo.athenz.zms.Policy in project athenz by yahoo.

the class DataCacheTest method testPolicyWithNoAssertions.

@Test
public void testPolicyWithNoAssertions() {
    Domain domain = new Domain();
    domain.setName("testDomain");
    Role role1 = new Role();
    role1.setName("testDomain.role.role1");
    List<RoleMember> members1 = new ArrayList<>();
    members1.add(new RoleMember().setMemberName("user_domain.user1"));
    members1.add(new RoleMember().setMemberName("user_domain.user2"));
    role1.setRoleMembers(members1);
    Role role2 = new Role();
    role2.setName("testDomain.role.role2");
    List<RoleMember> members2 = new ArrayList<>();
    members2.add(new RoleMember().setMemberName("user_domain.user2"));
    role2.setRoleMembers(members2);
    Role role3 = new Role();
    role3.setName("testDomain.role.role3");
    List<RoleMember> members3 = new ArrayList<>();
    members3.add(new RoleMember().setMemberName("user_domain.user3"));
    role3.setRoleMembers(members3);
    Policy policy = new Policy();
    policy.setName("testDomain.policy.policy1");
    HashMap<String, Role> roleList = new HashMap<>();
    roleList.put(role1.getName(), role1);
    roleList.put(role2.getName(), role2);
    roleList.put(role3.getName(), role3);
    DataCache cache = new DataCache();
    cache.processRole(role1);
    cache.processRole(role2);
    cache.processRole(role3);
    cache.processPolicy(domain.getName(), policy, roleList);
    Set<MemberRole> set1 = cache.getMemberRoleSet("user_domain.user1");
    assertNotNull(set1);
    assertTrue(set1.contains(new MemberRole("testDomain.role.role1", 0)));
    assertEquals(set1.size(), 1);
    Set<MemberRole> set2 = cache.getMemberRoleSet("user_domain.user2");
    assertNotNull(set2);
    assertTrue(set2.contains(new MemberRole("testDomain.role.role1", 0)));
    assertTrue(set2.contains(new MemberRole("testDomain.role.role2", 0)));
    assertEquals(set2.size(), 2);
    Set<MemberRole> set3 = cache.getMemberRoleSet("user_domain.user3");
    assertNotNull(set3);
    assertTrue(set3.contains(new MemberRole("testDomain.role.role3", 0)));
    assertEquals(set3.size(), 1);
}

Example 33 with Policy

use of com.yahoo.athenz.zms.Policy in project athenz by yahoo.

the class ZTSImplTest method createTenantSignedDomain.

private SignedDomain createTenantSignedDomain(String domainName, String providerDomain, String providerService) {
    SignedDomain signedDomain = new SignedDomain();
    List<Role> roles = new ArrayList<>();
    Role role = new Role();
    role.setName(generateRoleName(domainName, "admin"));
    List<RoleMember> members = new ArrayList<>();
    members.add(new RoleMember().setMemberName("user_domain.user"));
    role.setRoleMembers(members);
    roles.add(role);
    role = new Role();
    role.setName(generateRoleName(domainName, "tenancy." + providerDomain + "." + providerService + ".admin"));
    members = new ArrayList<>();
    members.add(new RoleMember().setMemberName("user_domain.user100"));
    members.add(new RoleMember().setMemberName("user_domain.user101"));
    role.setRoleMembers(members);
    roles.add(role);
    role = new Role();
    role.setName(generateRoleName(domainName, "readers"));
    members = new ArrayList<>();
    members.add(new RoleMember().setMemberName("user_domain.user100"));
    members.add(new RoleMember().setMemberName("user_domain.user101"));
    role.setRoleMembers(members);
    roles.add(role);
    ServiceIdentity service = new ServiceIdentity();
    service.setName(domainName + ".storage");
    setServicePublicKey(service, "0", ZTS_Y64_CERT0);
    List<String> hosts = new ArrayList<>();
    hosts.add("host1");
    hosts.add("host2");
    service.setHosts(hosts);
    List<ServiceIdentity> services = new ArrayList<>();
    services.add(service);
    List<com.yahoo.athenz.zms.Policy> policies = new ArrayList<>();
    com.yahoo.athenz.zms.Policy policy = new com.yahoo.athenz.zms.Policy();
    com.yahoo.athenz.zms.Assertion assertion = new com.yahoo.athenz.zms.Assertion();
    assertion.setResource(generateRoleName(providerDomain, "tenant.readers"));
    assertion.setAction("assume_role");
    assertion.setRole(generateRoleName(domainName, "readers"));
    List<com.yahoo.athenz.zms.Assertion> assertions = new ArrayList<>();
    assertions.add(assertion);
    policy.setAssertions(assertions);
    policy.setName(generatePolicyName(domainName, "tenancy.readers"));
    policies.add(policy);
    policy = new com.yahoo.athenz.zms.Policy();
    assertion = new com.yahoo.athenz.zms.Assertion();
    assertion.setResource(generateRoleName(providerDomain, providerService + ".tenant." + domainName + ".admin"));
    assertion.setAction("assume_role");
    assertion.setRole(generateRoleName(domainName, "tenancy." + providerDomain + "." + providerService + ".admin"));
    assertions = new ArrayList<>();
    assertions.add(assertion);
    policy.setAssertions(assertions);
    policy.setName(generatePolicyName(domainName, "tenancy." + providerDomain + "." + providerService + ".admin"));
    policies.add(policy);
    com.yahoo.athenz.zms.DomainPolicies domainPolicies = new com.yahoo.athenz.zms.DomainPolicies();
    domainPolicies.setDomain(domainName);
    domainPolicies.setPolicies(policies);
    com.yahoo.athenz.zms.SignedPolicies signedPolicies = new com.yahoo.athenz.zms.SignedPolicies();
    signedPolicies.setContents(domainPolicies);
    signedPolicies.setSignature(Crypto.sign(SignUtils.asCanonicalString(domainPolicies), privateKey));
    signedPolicies.setKeyId("0");
    DomainData domain = new DomainData();
    domain.setName(domainName);
    domain.setRoles(roles);
    domain.setServices(services);
    domain.setPolicies(signedPolicies);
    signedDomain.setDomain(domain);
    signedDomain.setSignature(Crypto.sign(SignUtils.asCanonicalString(domain), privateKey));
    signedDomain.setKeyId("0");
    return signedDomain;
}

Example 34 with Policy

use of com.yahoo.athenz.zms.Policy in project athenz by yahoo.

the class ZTSImplTest method createAwsSignedDomain.

private SignedDomain createAwsSignedDomain(String domainName, String account) {
    SignedDomain signedDomain = new SignedDomain();
    List<Role> roles = new ArrayList<>();
    Role role = new Role();
    role.setName(generateRoleName(domainName, "admin"));
    List<RoleMember> members = new ArrayList<>();
    members.add(new RoleMember().setMemberName("user_domain.user"));
    role.setRoleMembers(members);
    roles.add(role);
    role = new Role();
    role.setName(generateRoleName(domainName, "aws_role"));
    members = new ArrayList<>();
    members.add(new RoleMember().setMemberName("user_domain.user100"));
    members.add(new RoleMember().setMemberName("user_domain.user101"));
    role.setRoleMembers(members);
    roles.add(role);
    List<com.yahoo.athenz.zms.Policy> policies = new ArrayList<>();
    com.yahoo.athenz.zms.Policy policy = new com.yahoo.athenz.zms.Policy();
    com.yahoo.athenz.zms.Assertion assertion = new com.yahoo.athenz.zms.Assertion();
    assertion.setResource(domainName + ":aws_role_name");
    assertion.setAction("assume_aws_role");
    assertion.setRole(generateRoleName(domainName, "aws_role"));
    List<com.yahoo.athenz.zms.Assertion> assertions = new ArrayList<>();
    assertions.add(assertion);
    policy.setAssertions(assertions);
    policy.setName(generatePolicyName(domainName, "aws_policy"));
    policies.add(policy);
    com.yahoo.athenz.zms.DomainPolicies domainPolicies = new com.yahoo.athenz.zms.DomainPolicies();
    domainPolicies.setDomain(domainName);
    domainPolicies.setPolicies(policies);
    com.yahoo.athenz.zms.SignedPolicies signedPolicies = new com.yahoo.athenz.zms.SignedPolicies();
    signedPolicies.setContents(domainPolicies);
    signedPolicies.setSignature(Crypto.sign(SignUtils.asCanonicalString(domainPolicies), privateKey));
    signedPolicies.setKeyId("0");
    DomainData domain = new DomainData();
    domain.setName(domainName);
    domain.setAccount(account);
    domain.setRoles(roles);
    domain.setPolicies(signedPolicies);
    signedDomain.setDomain(domain);
    signedDomain.setSignature(Crypto.sign(SignUtils.asCanonicalString(domain), privateKey));
    signedDomain.setKeyId("0");
    return signedDomain;
}

Example 35 with Policy

use of com.yahoo.athenz.zms.Policy in project athenz by yahoo.

the class ZTSImplTest method testMatchDelegatedTrustPolicyNoAssertions.

@Test
public void testMatchDelegatedTrustPolicyNoAssertions() {
    Policy policy = new Policy();
    assertFalse(authorizer.matchDelegatedTrustPolicy(policy, "roleName", "user_domain.user1", null));
}