tvaultapi/src/main/java/com/tmobile/cso/vault/api/service/IAMServiceAccountsService.java
private boolean hasResetPermissionForIAMServiceAccount(String token, String uniqueIAMSvcaccName, UserDetails userDetails) {
		// Admin users have reset permission in all service accounts.
		if (userDetails.isAdmin()) {
			return true;
		}
		String resetPermission = "w_"+ IAMServiceAccountConstants.IAMSVCACC_POLICY_PREFIX + uniqueIAMSvcaccName;
		ObjectMapper objectMapper = new ObjectMapper();
		List<String> currentPolicies = new ArrayList<>();
		List<String> identityPolicies = new ArrayList<>();
		Response response = reqProcessor.process("/auth/tvault/lookup","{}", token);
		if(HttpStatus.OK.equals(response.getHttpstatus())) {
			String responseJson = response.getResponse();
			try {
				currentPolicies = iamServiceAccountUtils.getTokenPoliciesAsListFromTokenLookupJson(objectMapper, responseJson);
				identityPolicies = iamServiceAccountUtils.getIdentityPoliciesAsListFromTokenLookupJson(objectMapper, responseJson);
				if (currentPolicies.contains(resetPermission) || identityPolicies.contains(resetPermission)) {
					log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder()
							.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
							.put(LogMessage.ACTION, "hasResetPermissionForIAMServiceAccount")
							.put(LogMessage.MESSAGE, "User has reset permission on this IAM service account.")
							.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).build()));
					return true;
				}
			} catch (IOException e) {
				log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder()
						.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
						.put(LogMessage.ACTION, "hasResetPermissionForIAMServiceAccount")
						.put(LogMessage.MESSAGE,
								"Failed to parse policies from token")
						.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).build()));
			}
		}
		log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder()
				.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
				.put(LogMessage.ACTION, "hasResetPermissionForIAMServiceAccount")
				.put(LogMessage.MESSAGE, "Access denied. User is not permitted for IAM secret rotation.")
				.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).build()));
		return false;
	}
/**
	 * Method to check if the user/approle has reset permission.
	 * @param token
	 * @param uniqueIAMSvcaccName
	 * @return
	 */
Method to check if the user/approle has reset permission.
@param token
@param uniqueIAMSvcaccName
@return
Method to check if the user / approle has reset permission . @param token @param uniqueIAMSvcaccName @return
private boolean hasResetPermissionForIAMServiceAccount(String token, String uniqueIAMSvcaccName, UserDetails userDetails) {
		if (userDetails.isAdmin()) {
			return true;
		}
		String resetPermission = "w_"+ IAMServiceAccountConstants.IAMSVCACC_POLICY_PREFIX + uniqueIAMSvcaccName;
		ObjectMapper objectMapper = new ObjectMapper();
		List<String> currentPolicies = new ArrayList<>();
		List<String> identityPolicies = new ArrayList<>();
		Response response = reqProcessor.process("/auth/tvault/lookup","{}", token);
		if(HttpStatus.OK.equals(response.getHttpstatus())) {
			String responseJson = response.getResponse();
			try {
				currentPolicies = iamServiceAccountUtils.getTokenPoliciesAsListFromTokenLookupJson(objectMapper, responseJson);
				identityPolicies = iamServiceAccountUtils.getIdentityPoliciesAsListFromTokenLookupJson(objectMapper, responseJson);
				if (currentPolicies.contains(resetPermission) || identityPolicies.contains(resetPermission)) {
					log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder()
							.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
							.put(LogMessage.ACTION, "hasResetPermissionForIAMServiceAccount")
							.put(LogMessage.MESSAGE, "User has reset permission on this IAM service account.")
							.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).build()));
					return true;
				}
			} catch (IOException e) {
				log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder()
						.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
						.put(LogMessage.ACTION, "hasResetPermissionForIAMServiceAccount")
						.put(LogMessage.MESSAGE,
								"Failed to parse policies from token")
						.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).build()));
			}
		}
		log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder()
				.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
				.put(LogMessage.ACTION, "hasResetPermissionForIAMServiceAccount")
				.put(LogMessage.MESSAGE, "Access denied. User is not permitted for IAM secret rotation.")
				.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).build()));
		return false;
	}
private boolean hasResetPermissionForIAMServiceAccount ( String token , String uniqueIAMSvcaccName , UserDetails userDetails ) { if ( userDetails . isAdmin ( ) ) { return true ; } String resetPermission = "w_" + IAMServiceAccountConstants . IAMSVCACC_POLICY_PREFIX + uniqueIAMSvcaccName ; ObjectMapper objectMapper = new ObjectMapper ( ) ; List < String > currentPolicies = new ArrayList < > ( ) ; List < String > identityPolicies = new ArrayList < > ( ) ; Response response = reqProcessor . process ( "/auth/tvault/lookup" , "{}" , token ) ; if ( HttpStatus . OK . equals ( response . getHttpstatus ( ) ) ) { String responseJson = response . getResponse ( ) ; try { currentPolicies = iamServiceAccountUtils . getTokenPoliciesAsListFromTokenLookupJson ( objectMapper , responseJson ) ; identityPolicies = iamServiceAccountUtils . getIdentityPoliciesAsListFromTokenLookupJson ( objectMapper , responseJson ) ; if ( currentPolicies . contains ( resetPermission ) || identityPolicies . contains ( resetPermission ) ) { log . debug ( JSONUtil . getJSON ( ImmutableMap . < String , String > builder ( ) . put ( LogMessage . USER , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . USER ) ) . put ( LogMessage . ACTION , "hasResetPermissionForIAMServiceAccount" ) . put ( LogMessage . MESSAGE , "User has reset permission on this IAM service account." ) . put ( LogMessage . APIURL , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . APIURL ) ) . build ( ) ) ) ; return true ; } } catch ( IOException e ) { log . error ( JSONUtil . getJSON ( ImmutableMap . < String , String > builder ( ) . put ( LogMessage . USER , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . USER ) ) . put ( LogMessage . ACTION , "hasResetPermissionForIAMServiceAccount" ) . put ( LogMessage . MESSAGE , "Failed to parse policies from token" ) . put ( LogMessage . APIURL , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . APIURL ) ) . build ( ) ) ) ; } } log . debug ( JSONUtil . getJSON ( ImmutableMap . < String , String > builder ( ) . put ( LogMessage . USER , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . USER ) ) . put ( LogMessage . ACTION , "hasResetPermissionForIAMServiceAccount" ) . put ( LogMessage . MESSAGE , "Access denied. User is not permitted for IAM secret rotation." ) . put ( LogMessage . APIURL , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . APIURL ) ) . build ( ) ) ) ; return false ; }
Method to check if the user/approle has reset permission.
Method to check if the user / approle has reset permission .
// Admin users have reset permission in all service accounts.