tvaultapi/src/main/java/com/tmobile/cso/vault/api/service/SSLCertificateService.java
public ResponseEntity<String> removeGroupFromCertificate(CertificateGroup certificateGroup, UserDetails userDetails) {

    	if(!areCertificateGroupInputsValid(certificateGroup)) {
   			log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder().
   					put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)).
   					put(LogMessage.ACTION, SSLCertificateConstants.REMOVE_GROUP_FROM_CERT_MSG).
   					put(LogMessage.MESSAGE, SSLCertificateConstants.INVALID_INPUT_MSG).
   					put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).
   					build()));
   			return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(ERRORINVALID);
   		}

        // External certificate disabled check
        if (certificateGroup.getCertType().equalsIgnoreCase(SSLCertificateConstants.EXTERNAL) && !isExternalCertEnabled){
            log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder()
                    .put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
                    .put(LogMessage.ACTION, SSLCertificateConstants.REMOVE_GROUP_FROM_CERT_MSG)
                    .put(LogMessage.MESSAGE,
                            "Failed to remove group from external SSL certificate. Operation not allowed.")
                    .put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).build()));
            return ResponseEntity.status(HttpStatus.UNPROCESSABLE_ENTITY).body(
                    "{\"errors\":[\"Failed to remove group from external SSL certificate. Operation not allowed.\"]}");
        }

        log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder().
                put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)).
                put(LogMessage.ACTION, SSLCertificateConstants.REMOVE_GROUP_FROM_CERT_MSG).
                put(LogMessage.MESSAGE, String.format("Trying to remove Group from certificate - [%s]", certificateGroup.toString())).
                put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).
                build()));

        String groupName = certificateGroup.getGroupname();
   		String certificateName = certificateGroup.getCertificateName().toLowerCase();
   		String certificateType = certificateGroup.getCertType();
   		String authToken = null;

   		boolean isAuthorized = true;

   		if (!ObjectUtils.isEmpty(userDetails)) {
			if (userDetails.isAdmin()) {
   				authToken = userDetails.getClientToken();   	            
   	        }else {
   	        	authToken = userDetails.getSelfSupportToken();
   	        }
   			SSLCertificateMetadataDetails certificateMetaData = certificateUtils.getCertificateMetaData(authToken, certificateName, certificateType);

   			isAuthorized = certificateUtils.hasAddOrRemovePermission(userDetails, certificateMetaData);

   		}else {
			log.error(
					JSONUtil.getJSON(ImmutableMap.<String, String>builder()
							.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
							.put(LogMessage.ACTION, SSLCertificateConstants.REMOVE_GROUP_FROM_CERT_MSG)
							.put(LogMessage.MESSAGE, String.format(
									"Access denied: No permission to remove group [%s] from this certificate [%s]",
									groupName, certificateName))
							.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL))
							.build()));
   			
   			return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Access denied: No permission to remove group from this certificate\"]}");
   		} 

        if(isAuthorized){        	
			return checkPolicyDetailsAndRemoveGroupFromCertificate(groupName, certificateName, authToken,
					certificateType, userDetails);
        } else {
        	log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder().
                    put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)).
                    put(LogMessage.ACTION, SSLCertificateConstants.REMOVE_GROUP_FROM_CERT_MSG).
                    put(LogMessage.MESSAGE, "Access denied: No permission to remove groups from this certificate").
                    put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).
                    build()));
            return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Access denied: No permission to remove groups from this certificate\"]}");
        }

    }
/**
     * Remove Group from certificate
     * @param certificateGroup
     * @param userDetails
     * @return
     */
Remove Group from certificate
@param certificateGroup
@param userDetails
@return
Remove Group from certificate @param certificateGroup @param userDetails @return
public ResponseEntity<String> removeGroupFromCertificate(CertificateGroup certificateGroup, UserDetails userDetails) {
    	if(!areCertificateGroupInputsValid(certificateGroup)) {
   			log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder().
   					put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)).
   					put(LogMessage.ACTION, SSLCertificateConstants.REMOVE_GROUP_FROM_CERT_MSG).
   					put(LogMessage.MESSAGE, SSLCertificateConstants.INVALID_INPUT_MSG).
   					put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).
   					build()));
   			return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(ERRORINVALID);
   		}
        if (certificateGroup.getCertType().equalsIgnoreCase(SSLCertificateConstants.EXTERNAL) && !isExternalCertEnabled){
            log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder()
                    .put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
                    .put(LogMessage.ACTION, SSLCertificateConstants.REMOVE_GROUP_FROM_CERT_MSG)
                    .put(LogMessage.MESSAGE,
                            "Failed to remove group from external SSL certificate. Operation not allowed.")
                    .put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).build()));
            return ResponseEntity.status(HttpStatus.UNPROCESSABLE_ENTITY).body(
                    "{\"errors\":[\"Failed to remove group from external SSL certificate. Operation not allowed.\"]}");
        }
        log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder().
                put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)).
                put(LogMessage.ACTION, SSLCertificateConstants.REMOVE_GROUP_FROM_CERT_MSG).
                put(LogMessage.MESSAGE, String.format("Trying to remove Group from certificate - [%s]", certificateGroup.toString())).
                put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).
                build()));
        String groupName = certificateGroup.getGroupname();
   		String certificateName = certificateGroup.getCertificateName().toLowerCase();
   		String certificateType = certificateGroup.getCertType();
   		String authToken = null;
   		boolean isAuthorized = true;
   		if (!ObjectUtils.isEmpty(userDetails)) {
			if (userDetails.isAdmin()) {
   				authToken = userDetails.getClientToken();   	            
   	        }else {
   	        	authToken = userDetails.getSelfSupportToken();
   	        }
   			SSLCertificateMetadataDetails certificateMetaData = certificateUtils.getCertificateMetaData(authToken, certificateName, certificateType);
   			isAuthorized = certificateUtils.hasAddOrRemovePermission(userDetails, certificateMetaData);
   		}else {
			log.error(
					JSONUtil.getJSON(ImmutableMap.<String, String>builder()
							.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
							.put(LogMessage.ACTION, SSLCertificateConstants.REMOVE_GROUP_FROM_CERT_MSG)
							.put(LogMessage.MESSAGE, String.format(
									"Access denied: No permission to remove group [%s] from this certificate [%s]",
									groupName, certificateName))
							.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL))
							.build()));
   			return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Access denied: No permission to remove group from this certificate\"]}");
   		} 
        if(isAuthorized){        	
			return checkPolicyDetailsAndRemoveGroupFromCertificate(groupName, certificateName, authToken,
					certificateType, userDetails);
        } else {
        	log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder().
                    put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)).
                    put(LogMessage.ACTION, SSLCertificateConstants.REMOVE_GROUP_FROM_CERT_MSG).
                    put(LogMessage.MESSAGE, "Access denied: No permission to remove groups from this certificate").
                    put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).
                    build()));
            return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Access denied: No permission to remove groups from this certificate\"]}");
        }
    }
public ResponseEntity < String > removeGroupFromCertificate ( CertificateGroup certificateGroup , UserDetails userDetails ) { if ( ! areCertificateGroupInputsValid ( certificateGroup ) ) { log . debug ( JSONUtil . getJSON ( ImmutableMap . < String , String > builder ( ) . put ( LogMessage . USER , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . USER ) ) . put ( LogMessage . ACTION , SSLCertificateConstants . REMOVE_GROUP_FROM_CERT_MSG ) . put ( LogMessage . MESSAGE , SSLCertificateConstants . INVALID_INPUT_MSG ) . put ( LogMessage . APIURL , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . APIURL ) ) . build ( ) ) ) ; return ResponseEntity . status ( HttpStatus . BAD_REQUEST ) . body ( ERRORINVALID ) ; } if ( certificateGroup . getCertType ( ) . equalsIgnoreCase ( SSLCertificateConstants . EXTERNAL ) && ! isExternalCertEnabled ) { log . error ( JSONUtil . getJSON ( ImmutableMap . < String , String > builder ( ) . put ( LogMessage . USER , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . USER ) ) . put ( LogMessage . ACTION , SSLCertificateConstants . REMOVE_GROUP_FROM_CERT_MSG ) . put ( LogMessage . MESSAGE , "Failed to remove group from external SSL certificate. Operation not allowed." ) . put ( LogMessage . APIURL , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . APIURL ) ) . build ( ) ) ) ; return ResponseEntity . status ( HttpStatus . UNPROCESSABLE_ENTITY ) . body ( "{\"errors\":[\"Failed to remove group from external SSL certificate. Operation not allowed.\"]}" ) ; } log . debug ( JSONUtil . getJSON ( ImmutableMap . < String , String > builder ( ) . put ( LogMessage . USER , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . USER ) ) . put ( LogMessage . ACTION , SSLCertificateConstants . REMOVE_GROUP_FROM_CERT_MSG ) . put ( LogMessage . MESSAGE , String . format ( "Trying to remove Group from certificate - [%s]" , certificateGroup . toString ( ) ) ) . put ( LogMessage . APIURL , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . APIURL ) ) . build ( ) ) ) ; String groupName = certificateGroup . getGroupname ( ) ; String certificateName = certificateGroup . getCertificateName ( ) . toLowerCase ( ) ; String certificateType = certificateGroup . getCertType ( ) ; String authToken = null ; boolean isAuthorized = true ; if ( ! ObjectUtils . isEmpty ( userDetails ) ) { if ( userDetails . isAdmin ( ) ) { authToken = userDetails . getClientToken ( ) ; } else { authToken = userDetails . getSelfSupportToken ( ) ; } SSLCertificateMetadataDetails certificateMetaData = certificateUtils . getCertificateMetaData ( authToken , certificateName , certificateType ) ; isAuthorized = certificateUtils . hasAddOrRemovePermission ( userDetails , certificateMetaData ) ; } else { log . error ( JSONUtil . getJSON ( ImmutableMap . < String , String > builder ( ) . put ( LogMessage . USER , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . USER ) ) . put ( LogMessage . ACTION , SSLCertificateConstants . REMOVE_GROUP_FROM_CERT_MSG ) . put ( LogMessage . MESSAGE , String . format ( "Access denied: No permission to remove group [%s] from this certificate [%s]" , groupName , certificateName ) ) . put ( LogMessage . APIURL , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . APIURL ) ) . build ( ) ) ) ; return ResponseEntity . status ( HttpStatus . BAD_REQUEST ) . body ( "{\"errors\":[\"Access denied: No permission to remove group from this certificate\"]}" ) ; } if ( isAuthorized ) { return checkPolicyDetailsAndRemoveGroupFromCertificate ( groupName , certificateName , authToken , certificateType , userDetails ) ; } else { log . error ( JSONUtil . getJSON ( ImmutableMap . < String , String > builder ( ) . put ( LogMessage . USER , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . USER ) ) . put ( LogMessage . ACTION , SSLCertificateConstants . REMOVE_GROUP_FROM_CERT_MSG ) . put ( LogMessage . MESSAGE , "Access denied: No permission to remove groups from this certificate" ) . put ( LogMessage . APIURL , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . APIURL ) ) . build ( ) ) ) ; return ResponseEntity . status ( HttpStatus . BAD_REQUEST ) . body ( "{\"errors\":[\"Access denied: No permission to remove groups from this certificate\"]}" ) ; } }
Remove Group from certificate
 @param certificateGroup
 @param userDetails
 @return
Remove Group from certificate @param certificateGroup @param userDetails @return
// External certificate disabled check