use of com.yahoo.athenz.zms.Role in project athenz by yahoo.
the class ZTSImplTest method createSignedDomain.
private SignedDomain createSignedDomain(String domainName, String tenantDomain, String serviceName, List<RoleMember> writers, List<RoleMember> readers, boolean includeServices) {
SignedDomain signedDomain = new SignedDomain();
List<Role> roles = new ArrayList<>();
Role role = new Role();
role.setName(generateRoleName(domainName, "admin"));
List<RoleMember> members = new ArrayList<>();
members.add(new RoleMember().setMemberName("user_domain.adminuser"));
role.setRoleMembers(members);
roles.add(role);
role = new Role();
role.setName(generateRoleName(domainName, "writers"));
role.setRoleMembers(writers);
roles.add(role);
role = new Role();
role.setName(generateRoleName(domainName, "readers"));
role.setRoleMembers(readers);
roles.add(role);
role = new Role();
role.setName(generateRoleName(domainName, "tenant.readers"));
role.setTrust(tenantDomain);
roles.add(role);
role = new Role();
role.setName(generateRoleName(domainName, serviceName + ".tenant." + tenantDomain + ".admin"));
role.setTrust(tenantDomain);
roles.add(role);
List<ServiceIdentity> services = new ArrayList<>();
if (includeServices) {
ServiceIdentity service = new ServiceIdentity();
service.setName(generateServiceIdentityName(domainName, serviceName));
setServicePublicKey(service, "0", ZTS_Y64_CERT0);
List<String> hosts = new ArrayList<>();
hosts.add("host1");
hosts.add("host2");
service.setHosts(hosts);
services.add(service);
service = new ServiceIdentity();
service.setName(generateServiceIdentityName(domainName, "backup"));
setServicePublicKey(service, "0", ZTS_Y64_CERT0);
hosts = new ArrayList<>();
hosts.add("host2");
hosts.add("host3");
service.setHosts(hosts);
services.add(service);
}
List<com.yahoo.athenz.zms.Policy> policies = new ArrayList<>();
com.yahoo.athenz.zms.Policy policy = new com.yahoo.athenz.zms.Policy();
com.yahoo.athenz.zms.Assertion assertion = new com.yahoo.athenz.zms.Assertion();
assertion.setResource(domainName + ":tenant." + tenantDomain + ".*");
assertion.setAction("read");
assertion.setRole(generateRoleName(domainName, "tenant.readers"));
List<com.yahoo.athenz.zms.Assertion> assertions = new ArrayList<>();
assertions.add(assertion);
policy.setAssertions(assertions);
policy.setName(generatePolicyName(domainName, "tenant.reader"));
policies.add(policy);
// tenant admin domain
policy = new com.yahoo.athenz.zms.Policy();
assertion = new com.yahoo.athenz.zms.Assertion();
assertion.setResource(domainName + ":service." + serviceName + ".tenant." + tenantDomain + ".*");
assertion.setAction("read");
assertion.setRole(generateRoleName(domainName, serviceName + ".tenant." + tenantDomain + ".admin"));
assertions = new ArrayList<>();
assertions.add(assertion);
policy.setAssertions(assertions);
policy.setName(generatePolicyName(domainName, serviceName + ".tenant." + tenantDomain + ".admin"));
policies.add(policy);
com.yahoo.athenz.zms.DomainPolicies domainPolicies = new com.yahoo.athenz.zms.DomainPolicies();
domainPolicies.setDomain(domainName);
domainPolicies.setPolicies(policies);
com.yahoo.athenz.zms.SignedPolicies signedPolicies = new com.yahoo.athenz.zms.SignedPolicies();
signedPolicies.setContents(domainPolicies);
signedPolicies.setSignature(Crypto.sign(SignUtils.asCanonicalString(domainPolicies), privateKey));
signedPolicies.setKeyId("0");
DomainData domain = new DomainData();
domain.setName(domainName);
domain.setRoles(roles);
domain.setServices(services);
domain.setPolicies(signedPolicies);
domain.setModified(Timestamp.fromCurrentTime());
signedDomain.setDomain(domain);
signedDomain.setSignature(Crypto.sign(SignUtils.asCanonicalString(domain), privateKey));
signedDomain.setKeyId("0");
return signedDomain;
}
use of com.yahoo.athenz.zms.Role in project athenz by yahoo.
the class ZTSImplTest method createRoleObject.
public static Role createRoleObject(String domainName, String roleName, String trust, List<RoleMember> members) {
Role role = new Role();
role.setName(domainName + ":role." + roleName);
role.setRoleMembers(members);
if (trust != null) {
role.setTrust(trust);
}
return role;
}
use of com.yahoo.athenz.zms.Role in project athenz by yahoo.
the class DataCacheTest method testSimpleRole.
@Test
public void testSimpleRole() {
Role role = new Role();
role.setName("dom.role1");
List<RoleMember> members = new ArrayList<>();
members.add(new RoleMember().setMemberName("user_domain.user1"));
members.add(new RoleMember().setMemberName("user_domain.user2"));
role.setRoleMembers(members);
DataCache cache = new DataCache();
cache.processRole(role);
Set<MemberRole> set1 = cache.getMemberRoleSet("user_domain.user1");
assertNotNull(set1);
assertTrue(set1.contains(new MemberRole("dom.role1", 0)));
assertEquals(set1.size(), 1);
Set<MemberRole> set2 = cache.getMemberRoleSet("user_domain.user2");
assertNotNull(set2);
assertTrue(set2.contains(new MemberRole("dom.role1", 0)));
assertEquals(set2.size(), 1);
Set<MemberRole> set3 = cache.getMemberRoleSet("user_domain.user3");
assertNull(set3);
Map<String, Set<String>> map = cache.getTrustMap();
assertNotNull(map);
assertEquals(map.size(), 0);
}
use of com.yahoo.athenz.zms.Role in project athenz by yahoo.
the class DataCacheTest method testSimpleRoleDuplicateMember.
@Test
public void testSimpleRoleDuplicateMember() {
Role role = new Role();
role.setName("dom.role1");
List<RoleMember> members = new ArrayList<>();
members.add(new RoleMember().setMemberName("user_domain.user1"));
members.add(new RoleMember().setMemberName("user_domain.user2"));
members.add(new RoleMember().setMemberName("user_domain.user1"));
members.add(new RoleMember().setMemberName("user_domain.user1"));
role.setRoleMembers(members);
DataCache cache = new DataCache();
cache.processRole(role);
Set<MemberRole> set1 = cache.getMemberRoleSet("user_domain.user1");
assertNotNull(set1);
assertTrue(set1.contains(new MemberRole("dom.role1", 0)));
assertEquals(set1.size(), 1);
Set<MemberRole> set2 = cache.getMemberRoleSet("user_domain.user2");
assertNotNull(set2);
assertTrue(set2.contains(new MemberRole("dom.role1", 0)));
assertEquals(set2.size(), 1);
Set<MemberRole> set3 = cache.getMemberRoleSet("user_domain.user3");
assertNull(set3);
Map<String, Set<String>> map = cache.getTrustMap();
assertNotNull(map);
assertEquals(map.size(), 0);
}
use of com.yahoo.athenz.zms.Role in project athenz by yahoo.
the class DataCacheTest method testPolicyWithAssertions.
@Test
public void testPolicyWithAssertions() {
Domain domain = new Domain();
domain.setName("testDomain");
Role role1 = new Role();
role1.setName("testDomain.role.role1");
List<RoleMember> members1 = new ArrayList<>();
members1.add(new RoleMember().setMemberName("user_domain.user1"));
members1.add(new RoleMember().setMemberName("user_domain.user2"));
role1.setRoleMembers(members1);
Role role2 = new Role();
role2.setName("testDomain.role.role2");
List<RoleMember> members2 = new ArrayList<>();
members2.add(new RoleMember().setMemberName("user_domain.user2"));
role2.setRoleMembers(members2);
Role role3 = new Role();
role3.setName("testDomain.role.role3");
List<RoleMember> members3 = new ArrayList<>();
members3.add(new RoleMember().setMemberName("user_domain.user3"));
role3.setRoleMembers(members3);
Policy policy = new Policy();
policy.setName("testDomain.policy.policy1");
Assertion assertion1 = new Assertion();
assertion1.setAction("assume_role");
assertion1.setEffect(AssertionEffect.ALLOW);
assertion1.setResource("testDomain.roleA");
assertion1.setRole("testDomain.role.role1");
Assertion assertion2 = new Assertion();
assertion2.setAction("read");
assertion2.setEffect(AssertionEffect.ALLOW);
assertion2.setResource("testDomain.data:*");
assertion2.setRole("testDomain.role.role1");
List<Assertion> assertList = new ArrayList<Assertion>();
assertList.add(assertion1);
assertList.add(assertion2);
policy.setAssertions(assertList);
DataCache cache = new DataCache();
cache.processRole(role1);
cache.processRole(role2);
cache.processRole(role3);
HashMap<String, Role> roleList = new HashMap<>();
roleList.put(role1.getName(), role1);
roleList.put(role2.getName(), role2);
roleList.put(role3.getName(), role3);
cache.processPolicy(domain.getName(), policy, roleList);
Set<MemberRole> set1 = cache.getMemberRoleSet("user_domain.user1");
assertNotNull(set1);
assertTrue(set1.contains(new MemberRole("testDomain.role.role1", 0)));
assertTrue(set1.contains(new MemberRole("testDomain.roleA", 0)));
assertEquals(set1.size(), 2);
Set<MemberRole> set2 = cache.getMemberRoleSet("user_domain.user2");
assertNotNull(set2);
assertTrue(set2.contains(new MemberRole("testDomain.role.role1", 0)));
assertTrue(set2.contains(new MemberRole("testDomain.role.role2", 0)));
assertTrue(set2.contains(new MemberRole("testDomain.roleA", 0)));
assertEquals(set2.size(), 3);
Set<MemberRole> set3 = cache.getMemberRoleSet("user_domain.user3");
assertNotNull(set3);
assertTrue(set3.contains(new MemberRole("testDomain.role.role3", 0)));
assertEquals(set3.size(), 1);
}
Aggregations