tvaultapi/src/main/java/com/tmobile/cso/vault/api/service/IAMServiceAccountsService.java
public ResponseEntity<String> addUserToIAMServiceAccount(String token, UserDetails userDetails,
			IAMServiceAccountUser iamServiceAccountUser, boolean isPartOfOnboard) {

		iamServiceAccountUser.setIamSvcAccName(iamServiceAccountUser.getIamSvcAccName().toLowerCase());
		OIDCEntityResponse oidcEntityResponse = new OIDCEntityResponse();
		if (!userDetails.isAdmin()) {
			token = tokenUtils.getSelfServiceToken();
		}
		log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder()
				.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
				.put(LogMessage.ACTION, IAMServiceAccountConstants.ADD_USER_TO_IAMSVCACC_MSG)
				.put(LogMessage.MESSAGE, String.format("Trying to add user to Service Account [%s]", iamServiceAccountUser.getIamSvcAccName()))
				.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).build()));

		if (!isIamSvcaccPermissionInputValid(iamServiceAccountUser.getAccess())) {
			log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder()
					.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
					.put(LogMessage.ACTION, IAMServiceAccountConstants.ADD_USER_TO_IAMSVCACC_MSG)
					.put(LogMessage.MESSAGE, "Access denied. Not authorized to add user to the IAM Service Accounts.")
					.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).build()));

			return ResponseEntity.status(HttpStatus.BAD_REQUEST)
					.body(INVALIDVALUEERROR);
		}
		String uniqueIAMSvcaccName = iamServiceAccountUser.getAwsAccountId() + "_" + iamServiceAccountUser.getIamSvcAccName();

		boolean isAuthorized = isAuthorizedToAddPermissionInIAMSvcAcc(userDetails, uniqueIAMSvcaccName, token, isPartOfOnboard);

		if (isAuthorized) {
			// Only Sudo & Write policy can be added (as part of onboard) before activation.
			if (isPartOfOnboard && !TVaultConstants.SUDO_POLICY.equals(iamServiceAccountUser.getAccess()) &&
					!TVaultConstants.WRITE_POLICY.equals(iamServiceAccountUser.getAccess())) {
				log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder()
						.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
						.put(LogMessage.ACTION, IAMServiceAccountConstants.ADD_USER_TO_IAMSVCACC_MSG)
						.put(LogMessage.MESSAGE, String.format("Failed to add user permission to IAM Service account. [%s] is not activated.", iamServiceAccountUser.getIamSvcAccName()))
						.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL))
						.build()));
				return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(
						"{\"errors\":[\"Failed to add user permission to IAM Service account. Only Sudo and Write permissions can be added as part of Onboard.\"]}");
			}

			if (isOwnerPemissionGettingChanged(iamServiceAccountUser, getOwnerNTIdFromMetadata(token, uniqueIAMSvcaccName), isPartOfOnboard)) {
				log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder()
						.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
						.put(LogMessage.ACTION, IAMServiceAccountConstants.ADD_USER_TO_IAMSVCACC_MSG)
						.put(LogMessage.MESSAGE, "Failed to add user permission to IAM Service account. Owner permission cannot be changed..")
						.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL))
						.build()));
				return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(
						"{\"errors\":[\"Failed to add user permission to IAM Service account. Owner permission cannot be changed.\"]}");
			}

			Response userResponse = getUserPolicies(token, userDetails, iamServiceAccountUser, oidcEntityResponse);

			String newPolicy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(iamServiceAccountUser.getAccess()))
					.append(IAMServiceAccountConstants.IAMSVCACC_POLICY_PREFIX).append(uniqueIAMSvcaccName).toString();
			if (userResponse.getHttpstatus().equals(HttpStatus.OK)) {
				log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder()
						.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
						.put(LogMessage.ACTION, IAMServiceAccountConstants.ADD_USER_TO_IAMSVCACC_MSG)
						.put(LogMessage.MESSAGE, String.format("Current policies for user [%s] are: [%s] -- Trying to add policy [%s]",
								iamServiceAccountUser.getUsername(), userResponse.getResponse(), newPolicy))
						.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).build()));

				return configurePoliciesAndUpdateMetadata(token, userDetails, iamServiceAccountUser, oidcEntityResponse,
						uniqueIAMSvcaccName, userResponse);
			} else {
				log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder()
						.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
						.put(LogMessage.ACTION, IAMServiceAccountConstants.ADD_USER_TO_IAMSVCACC_MSG)
						.put(LogMessage.MESSAGE, String.format("Failed to add policy [%s] for user [%s]",
								newPolicy, iamServiceAccountUser.getUsername()))
						.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).build()));
				return ResponseEntity.status(userResponse.getHttpstatus()).body(userResponse.getResponse());
			}
		} else {
			return ResponseEntity.status(HttpStatus.FORBIDDEN)
					.body("{\"errors\":[\"Access denied: No permission to add users to this IAM service account\"]}");
		}
	}
/**
	 * Add user to IAM Service account.
	 *
	 * @param token
	 * @param userDetails
	 * @param iamServiceAccountUser
	 * @param isPartOfOnboard
	 * @return
	 */
Add user to IAM Service account.
Add user to IAM Service account .
public ResponseEntity<String> addUserToIAMServiceAccount(String token, UserDetails userDetails,
			IAMServiceAccountUser iamServiceAccountUser, boolean isPartOfOnboard) {
		iamServiceAccountUser.setIamSvcAccName(iamServiceAccountUser.getIamSvcAccName().toLowerCase());
		OIDCEntityResponse oidcEntityResponse = new OIDCEntityResponse();
		if (!userDetails.isAdmin()) {
			token = tokenUtils.getSelfServiceToken();
		}
		log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder()
				.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
				.put(LogMessage.ACTION, IAMServiceAccountConstants.ADD_USER_TO_IAMSVCACC_MSG)
				.put(LogMessage.MESSAGE, String.format("Trying to add user to Service Account [%s]", iamServiceAccountUser.getIamSvcAccName()))
				.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).build()));
		if (!isIamSvcaccPermissionInputValid(iamServiceAccountUser.getAccess())) {
			log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder()
					.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
					.put(LogMessage.ACTION, IAMServiceAccountConstants.ADD_USER_TO_IAMSVCACC_MSG)
					.put(LogMessage.MESSAGE, "Access denied. Not authorized to add user to the IAM Service Accounts.")
					.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).build()));
			return ResponseEntity.status(HttpStatus.BAD_REQUEST)
					.body(INVALIDVALUEERROR);
		}
		String uniqueIAMSvcaccName = iamServiceAccountUser.getAwsAccountId() + "_" + iamServiceAccountUser.getIamSvcAccName();
		boolean isAuthorized = isAuthorizedToAddPermissionInIAMSvcAcc(userDetails, uniqueIAMSvcaccName, token, isPartOfOnboard);
		if (isAuthorized) {
			if (isPartOfOnboard && !TVaultConstants.SUDO_POLICY.equals(iamServiceAccountUser.getAccess()) &&
					!TVaultConstants.WRITE_POLICY.equals(iamServiceAccountUser.getAccess())) {
				log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder()
						.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
						.put(LogMessage.ACTION, IAMServiceAccountConstants.ADD_USER_TO_IAMSVCACC_MSG)
						.put(LogMessage.MESSAGE, String.format("Failed to add user permission to IAM Service account. [%s] is not activated.", iamServiceAccountUser.getIamSvcAccName()))
						.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL))
						.build()));
				return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(
						"{\"errors\":[\"Failed to add user permission to IAM Service account. Only Sudo and Write permissions can be added as part of Onboard.\"]}");
			}
			if (isOwnerPemissionGettingChanged(iamServiceAccountUser, getOwnerNTIdFromMetadata(token, uniqueIAMSvcaccName), isPartOfOnboard)) {
				log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder()
						.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
						.put(LogMessage.ACTION, IAMServiceAccountConstants.ADD_USER_TO_IAMSVCACC_MSG)
						.put(LogMessage.MESSAGE, "Failed to add user permission to IAM Service account. Owner permission cannot be changed..")
						.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL))
						.build()));
				return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(
						"{\"errors\":[\"Failed to add user permission to IAM Service account. Owner permission cannot be changed.\"]}");
			}
			Response userResponse = getUserPolicies(token, userDetails, iamServiceAccountUser, oidcEntityResponse);
			String newPolicy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(iamServiceAccountUser.getAccess()))
					.append(IAMServiceAccountConstants.IAMSVCACC_POLICY_PREFIX).append(uniqueIAMSvcaccName).toString();
			if (userResponse.getHttpstatus().equals(HttpStatus.OK)) {
				log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder()
						.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
						.put(LogMessage.ACTION, IAMServiceAccountConstants.ADD_USER_TO_IAMSVCACC_MSG)
						.put(LogMessage.MESSAGE, String.format("Current policies for user [%s] are: [%s] -- Trying to add policy [%s]",
								iamServiceAccountUser.getUsername(), userResponse.getResponse(), newPolicy))
						.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).build()));
				return configurePoliciesAndUpdateMetadata(token, userDetails, iamServiceAccountUser, oidcEntityResponse,
						uniqueIAMSvcaccName, userResponse);
			} else {
				log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder()
						.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
						.put(LogMessage.ACTION, IAMServiceAccountConstants.ADD_USER_TO_IAMSVCACC_MSG)
						.put(LogMessage.MESSAGE, String.format("Failed to add policy [%s] for user [%s]",
								newPolicy, iamServiceAccountUser.getUsername()))
						.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).build()));
				return ResponseEntity.status(userResponse.getHttpstatus()).body(userResponse.getResponse());
			}
		} else {
			return ResponseEntity.status(HttpStatus.FORBIDDEN)
					.body("{\"errors\":[\"Access denied: No permission to add users to this IAM service account\"]}");
		}
	}
public ResponseEntity < String > addUserToIAMServiceAccount ( String token , UserDetails userDetails , IAMServiceAccountUser iamServiceAccountUser , boolean isPartOfOnboard ) { iamServiceAccountUser . setIamSvcAccName ( iamServiceAccountUser . getIamSvcAccName ( ) . toLowerCase ( ) ) ; OIDCEntityResponse oidcEntityResponse = new OIDCEntityResponse ( ) ; if ( ! userDetails . isAdmin ( ) ) { token = tokenUtils . getSelfServiceToken ( ) ; } log . debug ( JSONUtil . getJSON ( ImmutableMap . < String , String > builder ( ) . put ( LogMessage . USER , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . USER ) ) . put ( LogMessage . ACTION , IAMServiceAccountConstants . ADD_USER_TO_IAMSVCACC_MSG ) . put ( LogMessage . MESSAGE , String . format ( "Trying to add user to Service Account [%s]" , iamServiceAccountUser . getIamSvcAccName ( ) ) ) . put ( LogMessage . APIURL , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . APIURL ) ) . build ( ) ) ) ; if ( ! isIamSvcaccPermissionInputValid ( iamServiceAccountUser . getAccess ( ) ) ) { log . error ( JSONUtil . getJSON ( ImmutableMap . < String , String > builder ( ) . put ( LogMessage . USER , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . USER ) ) . put ( LogMessage . ACTION , IAMServiceAccountConstants . ADD_USER_TO_IAMSVCACC_MSG ) . put ( LogMessage . MESSAGE , "Access denied. Not authorized to add user to the IAM Service Accounts." ) . put ( LogMessage . APIURL , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . APIURL ) ) . build ( ) ) ) ; return ResponseEntity . status ( HttpStatus . BAD_REQUEST ) . body ( INVALIDVALUEERROR ) ; } String uniqueIAMSvcaccName = iamServiceAccountUser . getAwsAccountId ( ) + "_" + iamServiceAccountUser . getIamSvcAccName ( ) ; boolean isAuthorized = isAuthorizedToAddPermissionInIAMSvcAcc ( userDetails , uniqueIAMSvcaccName , token , isPartOfOnboard ) ; if ( isAuthorized ) { if ( isPartOfOnboard && ! TVaultConstants . SUDO_POLICY . equals ( iamServiceAccountUser . getAccess ( ) ) && ! TVaultConstants . WRITE_POLICY . equals ( iamServiceAccountUser . getAccess ( ) ) ) { log . error ( JSONUtil . getJSON ( ImmutableMap . < String , String > builder ( ) . put ( LogMessage . USER , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . USER ) ) . put ( LogMessage . ACTION , IAMServiceAccountConstants . ADD_USER_TO_IAMSVCACC_MSG ) . put ( LogMessage . MESSAGE , String . format ( "Failed to add user permission to IAM Service account. [%s] is not activated." , iamServiceAccountUser . getIamSvcAccName ( ) ) ) . put ( LogMessage . APIURL , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . APIURL ) ) . build ( ) ) ) ; return ResponseEntity . status ( HttpStatus . BAD_REQUEST ) . body ( "{\"errors\":[\"Failed to add user permission to IAM Service account. Only Sudo and Write permissions can be added as part of Onboard.\"]}" ) ; } if ( isOwnerPemissionGettingChanged ( iamServiceAccountUser , getOwnerNTIdFromMetadata ( token , uniqueIAMSvcaccName ) , isPartOfOnboard ) ) { log . error ( JSONUtil . getJSON ( ImmutableMap . < String , String > builder ( ) . put ( LogMessage . USER , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . USER ) ) . put ( LogMessage . ACTION , IAMServiceAccountConstants . ADD_USER_TO_IAMSVCACC_MSG ) . put ( LogMessage . MESSAGE , "Failed to add user permission to IAM Service account. Owner permission cannot be changed.." ) . put ( LogMessage . APIURL , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . APIURL ) ) . build ( ) ) ) ; return ResponseEntity . status ( HttpStatus . BAD_REQUEST ) . body ( "{\"errors\":[\"Failed to add user permission to IAM Service account. Owner permission cannot be changed.\"]}" ) ; } Response userResponse = getUserPolicies ( token , userDetails , iamServiceAccountUser , oidcEntityResponse ) ; String newPolicy = new StringBuffer ( ) . append ( TVaultConstants . SVC_ACC_POLICIES_PREFIXES . getKey ( iamServiceAccountUser . getAccess ( ) ) ) . append ( IAMServiceAccountConstants . IAMSVCACC_POLICY_PREFIX ) . append ( uniqueIAMSvcaccName ) . toString ( ) ; if ( userResponse . getHttpstatus ( ) . equals ( HttpStatus . OK ) ) { log . debug ( JSONUtil . getJSON ( ImmutableMap . < String , String > builder ( ) . put ( LogMessage . USER , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . USER ) ) . put ( LogMessage . ACTION , IAMServiceAccountConstants . ADD_USER_TO_IAMSVCACC_MSG ) . put ( LogMessage . MESSAGE , String . format ( "Current policies for user [%s] are: [%s] -- Trying to add policy [%s]" , iamServiceAccountUser . getUsername ( ) , userResponse . getResponse ( ) , newPolicy ) ) . put ( LogMessage . APIURL , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . APIURL ) ) . build ( ) ) ) ; return configurePoliciesAndUpdateMetadata ( token , userDetails , iamServiceAccountUser , oidcEntityResponse , uniqueIAMSvcaccName , userResponse ) ; } else { log . debug ( JSONUtil . getJSON ( ImmutableMap . < String , String > builder ( ) . put ( LogMessage . USER , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . USER ) ) . put ( LogMessage . ACTION , IAMServiceAccountConstants . ADD_USER_TO_IAMSVCACC_MSG ) . put ( LogMessage . MESSAGE , String . format ( "Failed to add policy [%s] for user [%s]" , newPolicy , iamServiceAccountUser . getUsername ( ) ) ) . put ( LogMessage . APIURL , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . APIURL ) ) . build ( ) ) ) ; return ResponseEntity . status ( userResponse . getHttpstatus ( ) ) . body ( userResponse . getResponse ( ) ) ; } } else { return ResponseEntity . status ( HttpStatus . FORBIDDEN ) . body ( "{\"errors\":[\"Access denied: No permission to add users to this IAM service account\"]}" ) ; } }
Add user to IAM Service account.
Add user to IAM Service account .
// Only Sudo & Write policy can be added (as part of onboard) before activation.