tvaultapi/src/main/java/com/tmobile/cso/vault/api/service/IAMServiceAccountsService.java
private ResponseEntity<String> removePoliciesAndUpdateMetadataForIAMSvcAcc(String token,
			IAMServiceAccountGroup iamServiceAccountGroup, UserDetails userDetails, OIDCGroup oidcGroup,
			String iamSvcAccountName, Response groupResp) {
		String readPolicy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.READ_POLICY)).append(IAMServiceAccountConstants.IAMSVCACC_POLICY_PREFIX).append(iamSvcAccountName).toString();
		String writePolicy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.WRITE_POLICY)).append(IAMServiceAccountConstants.IAMSVCACC_POLICY_PREFIX).append(iamSvcAccountName).toString();
		String denyPolicy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.DENY_POLICY)).append(IAMServiceAccountConstants.IAMSVCACC_POLICY_PREFIX).append(iamSvcAccountName).toString();
		String sudoPolicy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.SUDO_POLICY)).append(IAMServiceAccountConstants.IAMSVCACC_POLICY_PREFIX).append(iamSvcAccountName).toString();

		log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder().
		        put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)).
		        put(LogMessage.ACTION, IAMServiceAccountConstants.REMOVE_GROUP_FROM_IAMSVCACC_MSG).
		        put(LogMessage.MESSAGE, String.format ("Policies are, read - [%s], write - [%s], deny -[%s], owner - [%s]", readPolicy, writePolicy, denyPolicy, sudoPolicy)).
		        put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).
		        build()));

		String responseJson="";
		List<String> policies = new ArrayList<>();
		List<String> currentpolicies = new ArrayList<>();

		if(groupResp != null && HttpStatus.OK.equals(groupResp.getHttpstatus())){
		    responseJson = groupResp.getResponse();
		    try {
				ObjectMapper objMapper = new ObjectMapper();
				// OIDC Changes
				if (TVaultConstants.LDAP.equals(vaultAuthMethod)) {
					currentpolicies = ControllerUtil.getPoliciesAsListFromJson(objMapper, responseJson);
				} else if (TVaultConstants.OIDC.equals(vaultAuthMethod) && oidcGroup != null) {
					currentpolicies.addAll(oidcGroup.getPolicies());
				}
		    } catch (IOException e) {
		        log.error(e);
		        log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder().
		                put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)).
		                put(LogMessage.ACTION, IAMServiceAccountConstants.REMOVE_GROUP_FROM_IAMSVCACC_MSG).
		                put(LogMessage.MESSAGE, "Exception while creating currentpolicies or groups").
		                put(LogMessage.STACKTRACE, Arrays.toString(e.getStackTrace())).
		                put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).
		                build()));
		    }

		    policies.addAll(currentpolicies);
			policies.remove(readPolicy);
			policies.remove(writePolicy);
			policies.remove(denyPolicy);
		}else {
			return deleteOrphanGroupEntriesForIAMSvcAcc(token, iamServiceAccountGroup);
		}

		String policiesString = org.apache.commons.lang3.StringUtils.join(policies, ",");
		String currentpoliciesString = org.apache.commons.lang3.StringUtils.join(currentpolicies, ",");
		Response ldapConfigresponse = new Response();
		// OIDC Changes
		if (TVaultConstants.LDAP.equals(vaultAuthMethod)) {
			ldapConfigresponse = ControllerUtil.configureLDAPGroup(iamServiceAccountGroup.getGroupname(), policiesString, token);
		} else if (TVaultConstants.OIDC.equals(vaultAuthMethod)) {
			ldapConfigresponse = oidcUtil.updateGroupPolicies(token, iamServiceAccountGroup.getGroupname(), policies, currentpolicies,
					oidcGroup != null ? oidcGroup.getId() : null);
			oidcUtil.renewUserToken(userDetails.getClientToken());
		}
		if(ldapConfigresponse.getHttpstatus().equals(HttpStatus.NO_CONTENT) || ldapConfigresponse.getHttpstatus().equals(HttpStatus.OK)){
			return updateMetadataForRemoveGroupFromIAMSvcAcc(token, iamServiceAccountGroup, userDetails, oidcGroup,
					currentpolicies, currentpoliciesString);
		}
		else {
			String ssoToken = oidcUtil.getSSOToken();
			if (!StringUtils.isEmpty(ssoToken)) {
				String objectId = oidcUtil.getGroupObjectResponse(ssoToken, iamServiceAccountGroup.getGroupname());
				if (objectId == null || StringUtils.isEmpty(objectId)) {
					return deleteOrphanGroupEntriesForIAMSvcAcc(token, iamServiceAccountGroup);
				}
			}
		    return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"Group configuration failed.Try Again\"]}");
		}
	}
/**
	 * Method to update policies for remove group from IAM service account.
	 * @param token
	 * @param iamServiceAccountGroup
	 * @param userDetails
	 * @param oidcGroup
	 * @param iamSvcAccountName
	 * @param groupResp
	 * @return
	 */
Method to update policies for remove group from IAM service account.
Method to update policies for remove group from IAM service account .
private ResponseEntity<String> removePoliciesAndUpdateMetadataForIAMSvcAcc(String token,
			IAMServiceAccountGroup iamServiceAccountGroup, UserDetails userDetails, OIDCGroup oidcGroup,
			String iamSvcAccountName, Response groupResp) {
		String readPolicy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.READ_POLICY)).append(IAMServiceAccountConstants.IAMSVCACC_POLICY_PREFIX).append(iamSvcAccountName).toString();
		String writePolicy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.WRITE_POLICY)).append(IAMServiceAccountConstants.IAMSVCACC_POLICY_PREFIX).append(iamSvcAccountName).toString();
		String denyPolicy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.DENY_POLICY)).append(IAMServiceAccountConstants.IAMSVCACC_POLICY_PREFIX).append(iamSvcAccountName).toString();
		String sudoPolicy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.SUDO_POLICY)).append(IAMServiceAccountConstants.IAMSVCACC_POLICY_PREFIX).append(iamSvcAccountName).toString();
		log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder().
		        put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)).
		        put(LogMessage.ACTION, IAMServiceAccountConstants.REMOVE_GROUP_FROM_IAMSVCACC_MSG).
		        put(LogMessage.MESSAGE, String.format ("Policies are, read - [%s], write - [%s], deny -[%s], owner - [%s]", readPolicy, writePolicy, denyPolicy, sudoPolicy)).
		        put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).
		        build()));
		String responseJson="";
		List<String> policies = new ArrayList<>();
		List<String> currentpolicies = new ArrayList<>();
		if(groupResp != null && HttpStatus.OK.equals(groupResp.getHttpstatus())){
		    responseJson = groupResp.getResponse();
		    try {
				ObjectMapper objMapper = new ObjectMapper();
				if (TVaultConstants.LDAP.equals(vaultAuthMethod)) {
					currentpolicies = ControllerUtil.getPoliciesAsListFromJson(objMapper, responseJson);
				} else if (TVaultConstants.OIDC.equals(vaultAuthMethod) && oidcGroup != null) {
					currentpolicies.addAll(oidcGroup.getPolicies());
				}
		    } catch (IOException e) {
		        log.error(e);
		        log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder().
		                put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)).
		                put(LogMessage.ACTION, IAMServiceAccountConstants.REMOVE_GROUP_FROM_IAMSVCACC_MSG).
		                put(LogMessage.MESSAGE, "Exception while creating currentpolicies or groups").
		                put(LogMessage.STACKTRACE, Arrays.toString(e.getStackTrace())).
		                put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).
		                build()));
		    }
		    policies.addAll(currentpolicies);
			policies.remove(readPolicy);
			policies.remove(writePolicy);
			policies.remove(denyPolicy);
		}else {
			return deleteOrphanGroupEntriesForIAMSvcAcc(token, iamServiceAccountGroup);
		}
		String policiesString = org.apache.commons.lang3.StringUtils.join(policies, ",");
		String currentpoliciesString = org.apache.commons.lang3.StringUtils.join(currentpolicies, ",");
		Response ldapConfigresponse = new Response();
		if (TVaultConstants.LDAP.equals(vaultAuthMethod)) {
			ldapConfigresponse = ControllerUtil.configureLDAPGroup(iamServiceAccountGroup.getGroupname(), policiesString, token);
		} else if (TVaultConstants.OIDC.equals(vaultAuthMethod)) {
			ldapConfigresponse = oidcUtil.updateGroupPolicies(token, iamServiceAccountGroup.getGroupname(), policies, currentpolicies,
					oidcGroup != null ? oidcGroup.getId() : null);
			oidcUtil.renewUserToken(userDetails.getClientToken());
		}
		if(ldapConfigresponse.getHttpstatus().equals(HttpStatus.NO_CONTENT) || ldapConfigresponse.getHttpstatus().equals(HttpStatus.OK)){
			return updateMetadataForRemoveGroupFromIAMSvcAcc(token, iamServiceAccountGroup, userDetails, oidcGroup,
					currentpolicies, currentpoliciesString);
		}
		else {
			String ssoToken = oidcUtil.getSSOToken();
			if (!StringUtils.isEmpty(ssoToken)) {
				String objectId = oidcUtil.getGroupObjectResponse(ssoToken, iamServiceAccountGroup.getGroupname());
				if (objectId == null || StringUtils.isEmpty(objectId)) {
					return deleteOrphanGroupEntriesForIAMSvcAcc(token, iamServiceAccountGroup);
				}
			}
		    return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("{\"errors\":[\"Group configuration failed.Try Again\"]}");
		}
	}
private ResponseEntity < String > removePoliciesAndUpdateMetadataForIAMSvcAcc ( String token , IAMServiceAccountGroup iamServiceAccountGroup , UserDetails userDetails , OIDCGroup oidcGroup , String iamSvcAccountName , Response groupResp ) { String readPolicy = new StringBuffer ( ) . append ( TVaultConstants . SVC_ACC_POLICIES_PREFIXES . getKey ( TVaultConstants . READ_POLICY ) ) . append ( IAMServiceAccountConstants . IAMSVCACC_POLICY_PREFIX ) . append ( iamSvcAccountName ) . toString ( ) ; String writePolicy = new StringBuffer ( ) . append ( TVaultConstants . SVC_ACC_POLICIES_PREFIXES . getKey ( TVaultConstants . WRITE_POLICY ) ) . append ( IAMServiceAccountConstants . IAMSVCACC_POLICY_PREFIX ) . append ( iamSvcAccountName ) . toString ( ) ; String denyPolicy = new StringBuffer ( ) . append ( TVaultConstants . SVC_ACC_POLICIES_PREFIXES . getKey ( TVaultConstants . DENY_POLICY ) ) . append ( IAMServiceAccountConstants . IAMSVCACC_POLICY_PREFIX ) . append ( iamSvcAccountName ) . toString ( ) ; String sudoPolicy = new StringBuffer ( ) . append ( TVaultConstants . SVC_ACC_POLICIES_PREFIXES . getKey ( TVaultConstants . SUDO_POLICY ) ) . append ( IAMServiceAccountConstants . IAMSVCACC_POLICY_PREFIX ) . append ( iamSvcAccountName ) . toString ( ) ; log . error ( JSONUtil . getJSON ( ImmutableMap . < String , String > builder ( ) . put ( LogMessage . USER , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . USER ) ) . put ( LogMessage . ACTION , IAMServiceAccountConstants . REMOVE_GROUP_FROM_IAMSVCACC_MSG ) . put ( LogMessage . MESSAGE , String . format ( "Policies are, read - [%s], write - [%s], deny -[%s], owner - [%s]" , readPolicy , writePolicy , denyPolicy , sudoPolicy ) ) . put ( LogMessage . APIURL , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . APIURL ) ) . build ( ) ) ) ; String responseJson = "" ; List < String > policies = new ArrayList < > ( ) ; List < String > currentpolicies = new ArrayList < > ( ) ; if ( groupResp != null && HttpStatus . OK . equals ( groupResp . getHttpstatus ( ) ) ) { responseJson = groupResp . getResponse ( ) ; try { ObjectMapper objMapper = new ObjectMapper ( ) ; if ( TVaultConstants . LDAP . equals ( vaultAuthMethod ) ) { currentpolicies = ControllerUtil . getPoliciesAsListFromJson ( objMapper , responseJson ) ; } else if ( TVaultConstants . OIDC . equals ( vaultAuthMethod ) && oidcGroup != null ) { currentpolicies . addAll ( oidcGroup . getPolicies ( ) ) ; } } catch ( IOException e ) { log . error ( e ) ; log . error ( JSONUtil . getJSON ( ImmutableMap . < String , String > builder ( ) . put ( LogMessage . USER , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . USER ) ) . put ( LogMessage . ACTION , IAMServiceAccountConstants . REMOVE_GROUP_FROM_IAMSVCACC_MSG ) . put ( LogMessage . MESSAGE , "Exception while creating currentpolicies or groups" ) . put ( LogMessage . STACKTRACE , Arrays . toString ( e . getStackTrace ( ) ) ) . put ( LogMessage . APIURL , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . APIURL ) ) . build ( ) ) ) ; } policies . addAll ( currentpolicies ) ; policies . remove ( readPolicy ) ; policies . remove ( writePolicy ) ; policies . remove ( denyPolicy ) ; } else { return deleteOrphanGroupEntriesForIAMSvcAcc ( token , iamServiceAccountGroup ) ; } String policiesString = org . apache . commons . lang3 . StringUtils . join ( policies , "," ) ; String currentpoliciesString = org . apache . commons . lang3 . StringUtils . join ( currentpolicies , "," ) ; Response ldapConfigresponse = new Response ( ) ; if ( TVaultConstants . LDAP . equals ( vaultAuthMethod ) ) { ldapConfigresponse = ControllerUtil . configureLDAPGroup ( iamServiceAccountGroup . getGroupname ( ) , policiesString , token ) ; } else if ( TVaultConstants . OIDC . equals ( vaultAuthMethod ) ) { ldapConfigresponse = oidcUtil . updateGroupPolicies ( token , iamServiceAccountGroup . getGroupname ( ) , policies , currentpolicies , oidcGroup != null ? oidcGroup . getId ( ) : null ) ; oidcUtil . renewUserToken ( userDetails . getClientToken ( ) ) ; } if ( ldapConfigresponse . getHttpstatus ( ) . equals ( HttpStatus . NO_CONTENT ) || ldapConfigresponse . getHttpstatus ( ) . equals ( HttpStatus . OK ) ) { return updateMetadataForRemoveGroupFromIAMSvcAcc ( token , iamServiceAccountGroup , userDetails , oidcGroup , currentpolicies , currentpoliciesString ) ; } else { String ssoToken = oidcUtil . getSSOToken ( ) ; if ( ! StringUtils . isEmpty ( ssoToken ) ) { String objectId = oidcUtil . getGroupObjectResponse ( ssoToken , iamServiceAccountGroup . getGroupname ( ) ) ; if ( objectId == null || StringUtils . isEmpty ( objectId ) ) { return deleteOrphanGroupEntriesForIAMSvcAcc ( token , iamServiceAccountGroup ) ; } } return ResponseEntity . status ( HttpStatus . INTERNAL_SERVER_ERROR ) . body ( "{\"errors\":[\"Group configuration failed.Try Again\"]}" ) ; } }
Method to update policies for remove group from IAM service account.
Method to update policies for remove group from IAM service account .
// OIDC Changes // OIDC Changes