tvaultapi/src/main/java/com/tmobile/cso/vault/api/service/IAMServiceAccountsService.java
private boolean isAuthorizedToReadAccessKeys(UserDetails userDetails, String token, String iamSvcAccName, String awsAccountId) throws IOException {
		if (userDetails.isAdmin()) {
			log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder()
					.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
					.put(LogMessage.ACTION, "isAuthorizedToReadAccessKeys")
					.put(LogMessage.MESSAGE, String.format("User %s is authorized to read access keys because they are an admin user.",
							userDetails.getUsername()))
					.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).build()));
			return true;
		}

		boolean isAuthorized = false;

		String selfSupportToken = userDetails.getSelfSupportToken();

		JsonObject iamMetadata = getIAMMetadata(selfSupportToken, awsAccountId + "_" + iamSvcAccName);
		JsonElement appRoleElement = iamMetadata.get("app-roles");
		JsonElement awsRoleElement = iamMetadata.get("aws-roles");
		Map<String, Object> appRoles = null;
		Map<String, Object> awsRoles = null;
		if (appRoleElement != null) {
			appRoles = ControllerUtil.parseJson(appRoleElement.toString());
		}
		if (awsRoleElement != null) {
			awsRoles = ControllerUtil.parseJson(iamMetadata.get("aws-roles").toString());
		}

		if (appRoles != null) {
			for (Map.Entry<String, Object> entry : appRoles.entrySet()) {
				AppRoleMetadata appRoleMetadata = appRoleService.readAppRoleMetadata(selfSupportToken, entry.getKey());
				if (appRoleMetadata != null) {
					AppRoleMetadataDetails arDetails = appRoleMetadata.getAppRoleMetadataDetails();
					if (arDetails.getCreatedBy().equals(userDetails.getUsername()) ||
							(arDetails.getSharedTo() != null && arDetails.getSharedTo().contains(userDetails.getUsername()))) {
						if (entry.getValue().equals(TVaultConstants.DENY_POLICY)) {
							log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder()
									.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
									.put(LogMessage.ACTION, "isAuthorizedToReadAccessKeys")
									.put(LogMessage.MESSAGE, String.format("User %s is denied permission to read access keys because " +
													"of approle %s", userDetails.getUsername(), entry.getKey()))
									.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).build()));
							return false;
						} else {
							isAuthorized = true;
						}
					}
				}
			}
		}

		if (awsRoles != null) {
			for (Map.Entry<String, Object> entry : awsRoles.entrySet()) {
				String path = PATHSTR + "metadata/awsrole/" + entry.getKey() + "\"}";
				Response awsMetaResponse = reqProcessor.process("/read", path, selfSupportToken);
				if (awsMetaResponse.getHttpstatus().equals(HttpStatus.OK)) {
					String createdBy = new ObjectMapper().readTree(awsMetaResponse.getResponse()).get("data").get("createdBy").textValue();
					if (createdBy.equals(userDetails.getUsername())) {
						if (entry.getValue().equals(TVaultConstants.DENY_POLICY)) {
							return false;
						} else {
							isAuthorized = true;
						}
					}
				}
			}
		}

		Response response = reqProcessor.process("/auth/tvault/lookup","{}", token);
		if(HttpStatus.OK.equals(response.getHttpstatus())) {
			Response renewResponse = oidcUtil.renewUserToken(token);
			if (renewResponse != null) {
				Map<String, Object> responseMap;
				responseMap = ControllerUtil.parseJson(renewResponse.getResponse());
				if(responseMap.isEmpty()) {
					log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder().
							put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)).
							put(LogMessage.ACTION, "isAuthorizedToReadAccessKeys").
							put(LogMessage.MESSAGE, "Parsing Json for isAuthorizedToReadAccessKeys failed").
							put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).
							build()));
				} else {
					String readPolicyName = "r_iamsvcacc_" + awsAccountId + "_" + iamSvcAccName;
					String writePolicyName = "w_iamsvcacc_" + awsAccountId + "_" + iamSvcAccName;
					String denyPolicyName = "d_iamsvcacc_" + awsAccountId + "_" + iamSvcAccName;
					@SuppressWarnings("unchecked")
					List<String> policies = (List<String>) responseMap.get("policies");

					if (policies.contains(denyPolicyName)) {
						return false;
					} else if (policies.contains(iamSelfSupportAdminPolicyName) || policies.stream()
							.anyMatch((policy) -> policy.startsWith(readPolicyName) || policy.startsWith(writePolicyName))) {
						log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder()
								.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
								.put(LogMessage.ACTION, "isAuthorizedToReadAccessKeys")
								.put(LogMessage.MESSAGE, "The User/Token has required policies to read access keys for IAM Service Account.")
								.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).build()));
						isAuthorized = true;
					}
				}
			}
		}
		return isAuthorized;
	}
/**
	 * To check if the user/token has permission to read access keys for IAM service account.
	 * @param userDetails
	 * @param token
	 * @param iamSvcAccName
	 * @param awsAccountId
	 * @return boolean
	 */
To check if the user/token has permission to read access keys for IAM service account.
To check if the user / token has permission to read access keys for IAM service account .
private boolean isAuthorizedToReadAccessKeys(UserDetails userDetails, String token, String iamSvcAccName, String awsAccountId) throws IOException {
		if (userDetails.isAdmin()) {
			log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder()
					.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
					.put(LogMessage.ACTION, "isAuthorizedToReadAccessKeys")
					.put(LogMessage.MESSAGE, String.format("User %s is authorized to read access keys because they are an admin user.",
							userDetails.getUsername()))
					.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).build()));
			return true;
		}
		boolean isAuthorized = false;
		String selfSupportToken = userDetails.getSelfSupportToken();
		JsonObject iamMetadata = getIAMMetadata(selfSupportToken, awsAccountId + "_" + iamSvcAccName);
		JsonElement appRoleElement = iamMetadata.get("app-roles");
		JsonElement awsRoleElement = iamMetadata.get("aws-roles");
		Map<String, Object> appRoles = null;
		Map<String, Object> awsRoles = null;
		if (appRoleElement != null) {
			appRoles = ControllerUtil.parseJson(appRoleElement.toString());
		}
		if (awsRoleElement != null) {
			awsRoles = ControllerUtil.parseJson(iamMetadata.get("aws-roles").toString());
		}
		if (appRoles != null) {
			for (Map.Entry<String, Object> entry : appRoles.entrySet()) {
				AppRoleMetadata appRoleMetadata = appRoleService.readAppRoleMetadata(selfSupportToken, entry.getKey());
				if (appRoleMetadata != null) {
					AppRoleMetadataDetails arDetails = appRoleMetadata.getAppRoleMetadataDetails();
					if (arDetails.getCreatedBy().equals(userDetails.getUsername()) ||
							(arDetails.getSharedTo() != null && arDetails.getSharedTo().contains(userDetails.getUsername()))) {
						if (entry.getValue().equals(TVaultConstants.DENY_POLICY)) {
							log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder()
									.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
									.put(LogMessage.ACTION, "isAuthorizedToReadAccessKeys")
									.put(LogMessage.MESSAGE, String.format("User %s is denied permission to read access keys because " +
													"of approle %s", userDetails.getUsername(), entry.getKey()))
									.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).build()));
							return false;
						} else {
							isAuthorized = true;
						}
					}
				}
			}
		}
		if (awsRoles != null) {
			for (Map.Entry<String, Object> entry : awsRoles.entrySet()) {
				String path = PATHSTR + "metadata/awsrole/" + entry.getKey() + "\"}";
				Response awsMetaResponse = reqProcessor.process("/read", path, selfSupportToken);
				if (awsMetaResponse.getHttpstatus().equals(HttpStatus.OK)) {
					String createdBy = new ObjectMapper().readTree(awsMetaResponse.getResponse()).get("data").get("createdBy").textValue();
					if (createdBy.equals(userDetails.getUsername())) {
						if (entry.getValue().equals(TVaultConstants.DENY_POLICY)) {
							return false;
						} else {
							isAuthorized = true;
						}
					}
				}
			}
		}
		Response response = reqProcessor.process("/auth/tvault/lookup","{}", token);
		if(HttpStatus.OK.equals(response.getHttpstatus())) {
			Response renewResponse = oidcUtil.renewUserToken(token);
			if (renewResponse != null) {
				Map<String, Object> responseMap;
				responseMap = ControllerUtil.parseJson(renewResponse.getResponse());
				if(responseMap.isEmpty()) {
					log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder().
							put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)).
							put(LogMessage.ACTION, "isAuthorizedToReadAccessKeys").
							put(LogMessage.MESSAGE, "Parsing Json for isAuthorizedToReadAccessKeys failed").
							put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).
							build()));
				} else {
					String readPolicyName = "r_iamsvcacc_" + awsAccountId + "_" + iamSvcAccName;
					String writePolicyName = "w_iamsvcacc_" + awsAccountId + "_" + iamSvcAccName;
					String denyPolicyName = "d_iamsvcacc_" + awsAccountId + "_" + iamSvcAccName;
					@SuppressWarnings("unchecked")
					List<String> policies = (List<String>) responseMap.get("policies");
					if (policies.contains(denyPolicyName)) {
						return false;
					} else if (policies.contains(iamSelfSupportAdminPolicyName) || policies.stream()
							.anyMatch((policy) -> policy.startsWith(readPolicyName) || policy.startsWith(writePolicyName))) {
						log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder()
								.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
								.put(LogMessage.ACTION, "isAuthorizedToReadAccessKeys")
								.put(LogMessage.MESSAGE, "The User/Token has required policies to read access keys for IAM Service Account.")
								.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).build()));
						isAuthorized = true;
					}
				}
			}
		}
		return isAuthorized;
	}
private boolean isAuthorizedToReadAccessKeys ( UserDetails userDetails , String token , String iamSvcAccName , String awsAccountId ) throws IOException { if ( userDetails . isAdmin ( ) ) { log . debug ( JSONUtil . getJSON ( ImmutableMap . < String , String > builder ( ) . put ( LogMessage . USER , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . USER ) ) . put ( LogMessage . ACTION , "isAuthorizedToReadAccessKeys" ) . put ( LogMessage . MESSAGE , String . format ( "User %s is authorized to read access keys because they are an admin user." , userDetails . getUsername ( ) ) ) . put ( LogMessage . APIURL , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . APIURL ) ) . build ( ) ) ) ; return true ; } boolean isAuthorized = false ; String selfSupportToken = userDetails . getSelfSupportToken ( ) ; JsonObject iamMetadata = getIAMMetadata ( selfSupportToken , awsAccountId + "_" + iamSvcAccName ) ; JsonElement appRoleElement = iamMetadata . get ( "app-roles" ) ; JsonElement awsRoleElement = iamMetadata . get ( "aws-roles" ) ; Map < String , Object > appRoles = null ; Map < String , Object > awsRoles = null ; if ( appRoleElement != null ) { appRoles = ControllerUtil . parseJson ( appRoleElement . toString ( ) ) ; } if ( awsRoleElement != null ) { awsRoles = ControllerUtil . parseJson ( iamMetadata . get ( "aws-roles" ) . toString ( ) ) ; } if ( appRoles != null ) { for ( Map . Entry < String , Object > entry : appRoles . entrySet ( ) ) { AppRoleMetadata appRoleMetadata = appRoleService . readAppRoleMetadata ( selfSupportToken , entry . getKey ( ) ) ; if ( appRoleMetadata != null ) { AppRoleMetadataDetails arDetails = appRoleMetadata . getAppRoleMetadataDetails ( ) ; if ( arDetails . getCreatedBy ( ) . equals ( userDetails . getUsername ( ) ) || ( arDetails . getSharedTo ( ) != null && arDetails . getSharedTo ( ) . contains ( userDetails . getUsername ( ) ) ) ) { if ( entry . getValue ( ) . equals ( TVaultConstants . DENY_POLICY ) ) { log . debug ( JSONUtil . getJSON ( ImmutableMap . < String , String > builder ( ) . put ( LogMessage . USER , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . USER ) ) . put ( LogMessage . ACTION , "isAuthorizedToReadAccessKeys" ) . put ( LogMessage . MESSAGE , String . format ( "User %s is denied permission to read access keys because " + "of approle %s" , userDetails . getUsername ( ) , entry . getKey ( ) ) ) . put ( LogMessage . APIURL , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . APIURL ) ) . build ( ) ) ) ; return false ; } else { isAuthorized = true ; } } } } } if ( awsRoles != null ) { for ( Map . Entry < String , Object > entry : awsRoles . entrySet ( ) ) { String path = PATHSTR + "metadata/awsrole/" + entry . getKey ( ) + "\"}" ; Response awsMetaResponse = reqProcessor . process ( "/read" , path , selfSupportToken ) ; if ( awsMetaResponse . getHttpstatus ( ) . equals ( HttpStatus . OK ) ) { String createdBy = new ObjectMapper ( ) . readTree ( awsMetaResponse . getResponse ( ) ) . get ( "data" ) . get ( "createdBy" ) . textValue ( ) ; if ( createdBy . equals ( userDetails . getUsername ( ) ) ) { if ( entry . getValue ( ) . equals ( TVaultConstants . DENY_POLICY ) ) { return false ; } else { isAuthorized = true ; } } } } } Response response = reqProcessor . process ( "/auth/tvault/lookup" , "{}" , token ) ; if ( HttpStatus . OK . equals ( response . getHttpstatus ( ) ) ) { Response renewResponse = oidcUtil . renewUserToken ( token ) ; if ( renewResponse != null ) { Map < String , Object > responseMap ; responseMap = ControllerUtil . parseJson ( renewResponse . getResponse ( ) ) ; if ( responseMap . isEmpty ( ) ) { log . error ( JSONUtil . getJSON ( ImmutableMap . < String , String > builder ( ) . put ( LogMessage . USER , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . USER ) ) . put ( LogMessage . ACTION , "isAuthorizedToReadAccessKeys" ) . put ( LogMessage . MESSAGE , "Parsing Json for isAuthorizedToReadAccessKeys failed" ) . put ( LogMessage . APIURL , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . APIURL ) ) . build ( ) ) ) ; } else { String readPolicyName = "r_iamsvcacc_" + awsAccountId + "_" + iamSvcAccName ; String writePolicyName = "w_iamsvcacc_" + awsAccountId + "_" + iamSvcAccName ; String denyPolicyName = "d_iamsvcacc_" + awsAccountId + "_" + iamSvcAccName ; @ SuppressWarnings ( "unchecked" ) List < String > policies = ( List < String > ) responseMap . get ( "policies" ) ; if ( policies . contains ( denyPolicyName ) ) { return false ; } else if ( policies . contains ( iamSelfSupportAdminPolicyName ) || policies . stream ( ) . anyMatch ( ( policy ) -> policy . startsWith ( readPolicyName ) || policy . startsWith ( writePolicyName ) ) ) { log . debug ( JSONUtil . getJSON ( ImmutableMap . < String , String > builder ( ) . put ( LogMessage . USER , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . USER ) ) . put ( LogMessage . ACTION , "isAuthorizedToReadAccessKeys" ) . put ( LogMessage . MESSAGE , "The User/Token has required policies to read access keys for IAM Service Account." ) . put ( LogMessage . APIURL , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . APIURL ) ) . build ( ) ) ) ; isAuthorized = true ; } } } } return isAuthorized ; }
To check if the user/token has permission to read access keys for IAM service account.
To check if the user / token has permission to read access keys for IAM service account .