Examples with NamespaceIamRoleAuthorizationEntity org.finra.herd.model.jpa.NamespaceIamRoleAuthorizationEntity used on opensource projects

Example 26 with NamespaceIamRoleAuthorizationEntity

use of org.finra.herd.model.jpa.NamespaceIamRoleAuthorizationEntity in project herd by FINRAOS.

the class NamespaceIamRoleAuthorizationServiceImpl method createNamespaceIamRoleAuthorization.

@NamespacePermission(fields = "#request?.namespace", permissions = NamespacePermissionEnum.GRANT)
@Override
public NamespaceIamRoleAuthorization createNamespaceIamRoleAuthorization(NamespaceIamRoleAuthorizationCreateRequest request) {
    Assert.notNull(request, "NamespaceIamRoleAuthorizationCreateRequest must be specified");
    Assert.hasText(request.getNamespace(), "Namespace must be specified");
    validateIamRoles(request.getIamRoles());
    NamespaceEntity namespaceEntity = namespaceDaoHelper.getNamespaceEntity(request.getNamespace().trim());
    assertNamespaceIamRoleAuthorizationNotExist(namespaceEntity);
    NamespaceIamRoleAuthorization result = new NamespaceIamRoleAuthorization(namespaceEntity.getCode(), new ArrayList<>());
    for (IamRole iamRole : request.getIamRoles()) {
        NamespaceIamRoleAuthorizationEntity namespaceIamRoleAuthorizationEntity = createNamespaceIamRoleAuthorizationEntity(namespaceEntity, iamRole);
        namespaceIamRoleAuthorizationDao.saveAndRefresh(namespaceIamRoleAuthorizationEntity);
        result.getIamRoles().add(new IamRole(namespaceIamRoleAuthorizationEntity.getIamRoleName(), namespaceIamRoleAuthorizationEntity.getDescription()));
    }
    return result;
}

Example 27 with NamespaceIamRoleAuthorizationEntity

use of org.finra.herd.model.jpa.NamespaceIamRoleAuthorizationEntity in project herd by FINRAOS.

the class NamespaceIamRoleAuthorizationHelper method checkPermissions.

/**
 * Throws AccessDeniedException if the given namespace is not authorized to access any of the given IAM role names. The IAM role names are case-insensitive.
 * This method does nothing if ConfigurationValue.NAMESPACE_IAM_ROLE_AUTHORIZATION_ENABLED is false.
 *
 * @param namespaceEntity The namespace entity
 * @param requestedIamRoleNames The collection of requested IAM role names
 */
public void checkPermissions(NamespaceEntity namespaceEntity, Collection<String> requestedIamRoleNames) {
    if (Boolean.TRUE.equals(configurationHelper.getBooleanProperty(ConfigurationValue.NAMESPACE_IAM_ROLE_AUTHORIZATION_ENABLED))) {
        // Get the authorized IAM roles as upper case so that we can check in a case-insensitive manner
        Set<String> authorizedIamRoleNamesUpper = new HashSet<>();
        for (NamespaceIamRoleAuthorizationEntity namespaceIamRoleAuthorizationEntity : namespaceIamRoleAuthorizationDao.getNamespaceIamRoleAuthorizations(namespaceEntity)) {
            authorizedIamRoleNamesUpper.add(namespaceIamRoleAuthorizationEntity.getIamRoleName().toUpperCase().trim());
        }
        // Gather unauthorized IAM roles
        Set<String> unauthorizedIamRoles = new TreeSet<>();
        for (String requestedIamRoleName : requestedIamRoleNames) {
            // Ignore blank and null IAM roles
            if (StringUtils.isNotBlank(requestedIamRoleName) && !authorizedIamRoleNamesUpper.contains(requestedIamRoleName.toUpperCase().trim())) {
                unauthorizedIamRoles.add(requestedIamRoleName);
            }
        }
        if (!unauthorizedIamRoles.isEmpty()) {
            throw new AccessDeniedException(String.format("The namespace \"%s\" does not have access to the following IAM roles: %s", namespaceEntity.getCode(), unauthorizedIamRoles));
        }
    }
}