tvaultapi/src/main/java/com/tmobile/cso/vault/api/service/IAMServiceAccountsService.java
public ResponseEntity<String> removeUserFromIAMServiceAccount(String token, IAMServiceAccountUser iamServiceAccountUser, UserDetails userDetails) {
		iamServiceAccountUser.setIamSvcAccName(iamServiceAccountUser.getIamSvcAccName().toLowerCase());
		OIDCEntityResponse oidcEntityResponse = new OIDCEntityResponse();
		
		log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder()
				.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
				.put(LogMessage.ACTION, IAMServiceAccountConstants.REMOVE_USER_FROM_IAMSVCACC_MSG)
				.put(LogMessage.MESSAGE,
						String.format("Trying to remove user from Service Account [%s]",
								iamServiceAccountUser.getIamSvcAccName()))
				.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).build()));
		
		if (!userDetails.isAdmin()) {
            token = tokenUtils.getSelfServiceToken();
        }
		if (!isIamSvcaccPermissionInputValid(iamServiceAccountUser.getAccess())) {
			log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder()
					.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
					.put(LogMessage.ACTION, IAMServiceAccountConstants.REMOVE_USER_FROM_IAMSVCACC_MSG)
					.put(LogMessage.MESSAGE,
							"Access denied. Not authorized to remove user from the IAM Service Accounts.")
					.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).build()));

			return ResponseEntity.status(HttpStatus.BAD_REQUEST)
					.body(INVALIDVALUEERROR);
		}

		String uniqueIAMSvcaccName = iamServiceAccountUser.getAwsAccountId() + "_" + iamServiceAccountUser.getIamSvcAccName();

		boolean isAuthorized = isAuthorizedToAddPermissionInIAMSvcAcc(userDetails, uniqueIAMSvcaccName, token, false);

		if(isAuthorized){
			// Deleting owner permission is not allowed
			if (iamServiceAccountUser.getUsername().equalsIgnoreCase(getOwnerNTIdFromMetadata(token, uniqueIAMSvcaccName ))) {
				log.error(
						JSONUtil.getJSON(ImmutableMap.<String, String>builder()
								.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
								.put(LogMessage.ACTION, IAMServiceAccountConstants.REMOVE_USER_FROM_IAMSVCACC_MSG)
								.put(LogMessage.MESSAGE, "Failed to remove user permission to IAM Service account. Owner permission cannot be changed..")
								.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL))
								.build()));
				return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(
						"{\"errors\":[\"Failed to remove user permission from IAM Service account. Owner permission cannot be changed.\"]}");
			}

			String readPolicy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.READ_POLICY)).append(IAMServiceAccountConstants.IAMSVCACC_POLICY_PREFIX).append(uniqueIAMSvcaccName).toString();
			String writePolicy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.WRITE_POLICY)).append(IAMServiceAccountConstants.IAMSVCACC_POLICY_PREFIX).append(uniqueIAMSvcaccName).toString();
			String denyPolicy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.DENY_POLICY)).append(IAMServiceAccountConstants.IAMSVCACC_POLICY_PREFIX).append(uniqueIAMSvcaccName).toString();

			List<String> policiesToRemove = new ArrayList<>();
			policiesToRemove.add(readPolicy);
			policiesToRemove.add(writePolicy);
			policiesToRemove.add(denyPolicy);

			return processAndRemoveUserPermissionFromIAMSvcAcc(token, iamServiceAccountUser, userDetails,
					oidcEntityResponse, uniqueIAMSvcaccName, policiesToRemove);
		}
		else {
			return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Access denied: No permission to remove user from this IAM service account\"]}");
		}
	}
/**
	 * Removes user from IAM service account
	 * @param token
	 * @param iamServiceAccountUser
	 * @param userDetails
	 * @return
	 */
Removes user from IAM service account
@param token
@param iamServiceAccountUser
@param userDetails
@return
Removes user from IAM service account @param token @param iamServiceAccountUser @param userDetails @return
public ResponseEntity<String> removeUserFromIAMServiceAccount(String token, IAMServiceAccountUser iamServiceAccountUser, UserDetails userDetails) {
		iamServiceAccountUser.setIamSvcAccName(iamServiceAccountUser.getIamSvcAccName().toLowerCase());
		OIDCEntityResponse oidcEntityResponse = new OIDCEntityResponse();
		log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder()
				.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
				.put(LogMessage.ACTION, IAMServiceAccountConstants.REMOVE_USER_FROM_IAMSVCACC_MSG)
				.put(LogMessage.MESSAGE,
						String.format("Trying to remove user from Service Account [%s]",
								iamServiceAccountUser.getIamSvcAccName()))
				.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).build()));
		if (!userDetails.isAdmin()) {
            token = tokenUtils.getSelfServiceToken();
        }
		if (!isIamSvcaccPermissionInputValid(iamServiceAccountUser.getAccess())) {
			log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder()
					.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
					.put(LogMessage.ACTION, IAMServiceAccountConstants.REMOVE_USER_FROM_IAMSVCACC_MSG)
					.put(LogMessage.MESSAGE,
							"Access denied. Not authorized to remove user from the IAM Service Accounts.")
					.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).build()));
			return ResponseEntity.status(HttpStatus.BAD_REQUEST)
					.body(INVALIDVALUEERROR);
		}
		String uniqueIAMSvcaccName = iamServiceAccountUser.getAwsAccountId() + "_" + iamServiceAccountUser.getIamSvcAccName();
		boolean isAuthorized = isAuthorizedToAddPermissionInIAMSvcAcc(userDetails, uniqueIAMSvcaccName, token, false);
		if(isAuthorized){
			if (iamServiceAccountUser.getUsername().equalsIgnoreCase(getOwnerNTIdFromMetadata(token, uniqueIAMSvcaccName ))) {
				log.error(
						JSONUtil.getJSON(ImmutableMap.<String, String>builder()
								.put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER))
								.put(LogMessage.ACTION, IAMServiceAccountConstants.REMOVE_USER_FROM_IAMSVCACC_MSG)
								.put(LogMessage.MESSAGE, "Failed to remove user permission to IAM Service account. Owner permission cannot be changed..")
								.put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL))
								.build()));
				return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(
						"{\"errors\":[\"Failed to remove user permission from IAM Service account. Owner permission cannot be changed.\"]}");
			}
			String readPolicy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.READ_POLICY)).append(IAMServiceAccountConstants.IAMSVCACC_POLICY_PREFIX).append(uniqueIAMSvcaccName).toString();
			String writePolicy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.WRITE_POLICY)).append(IAMServiceAccountConstants.IAMSVCACC_POLICY_PREFIX).append(uniqueIAMSvcaccName).toString();
			String denyPolicy = new StringBuffer().append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.DENY_POLICY)).append(IAMServiceAccountConstants.IAMSVCACC_POLICY_PREFIX).append(uniqueIAMSvcaccName).toString();
			List<String> policiesToRemove = new ArrayList<>();
			policiesToRemove.add(readPolicy);
			policiesToRemove.add(writePolicy);
			policiesToRemove.add(denyPolicy);
			return processAndRemoveUserPermissionFromIAMSvcAcc(token, iamServiceAccountUser, userDetails,
					oidcEntityResponse, uniqueIAMSvcaccName, policiesToRemove);
		}
		else {
			return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Access denied: No permission to remove user from this IAM service account\"]}");
		}
	}
public ResponseEntity < String > removeUserFromIAMServiceAccount ( String token , IAMServiceAccountUser iamServiceAccountUser , UserDetails userDetails ) { iamServiceAccountUser . setIamSvcAccName ( iamServiceAccountUser . getIamSvcAccName ( ) . toLowerCase ( ) ) ; OIDCEntityResponse oidcEntityResponse = new OIDCEntityResponse ( ) ; log . debug ( JSONUtil . getJSON ( ImmutableMap . < String , String > builder ( ) . put ( LogMessage . USER , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . USER ) ) . put ( LogMessage . ACTION , IAMServiceAccountConstants . REMOVE_USER_FROM_IAMSVCACC_MSG ) . put ( LogMessage . MESSAGE , String . format ( "Trying to remove user from Service Account [%s]" , iamServiceAccountUser . getIamSvcAccName ( ) ) ) . put ( LogMessage . APIURL , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . APIURL ) ) . build ( ) ) ) ; if ( ! userDetails . isAdmin ( ) ) { token = tokenUtils . getSelfServiceToken ( ) ; } if ( ! isIamSvcaccPermissionInputValid ( iamServiceAccountUser . getAccess ( ) ) ) { log . error ( JSONUtil . getJSON ( ImmutableMap . < String , String > builder ( ) . put ( LogMessage . USER , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . USER ) ) . put ( LogMessage . ACTION , IAMServiceAccountConstants . REMOVE_USER_FROM_IAMSVCACC_MSG ) . put ( LogMessage . MESSAGE , "Access denied. Not authorized to remove user from the IAM Service Accounts." ) . put ( LogMessage . APIURL , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . APIURL ) ) . build ( ) ) ) ; return ResponseEntity . status ( HttpStatus . BAD_REQUEST ) . body ( INVALIDVALUEERROR ) ; } String uniqueIAMSvcaccName = iamServiceAccountUser . getAwsAccountId ( ) + "_" + iamServiceAccountUser . getIamSvcAccName ( ) ; boolean isAuthorized = isAuthorizedToAddPermissionInIAMSvcAcc ( userDetails , uniqueIAMSvcaccName , token , false ) ; if ( isAuthorized ) { if ( iamServiceAccountUser . getUsername ( ) . equalsIgnoreCase ( getOwnerNTIdFromMetadata ( token , uniqueIAMSvcaccName ) ) ) { log . error ( JSONUtil . getJSON ( ImmutableMap . < String , String > builder ( ) . put ( LogMessage . USER , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . USER ) ) . put ( LogMessage . ACTION , IAMServiceAccountConstants . REMOVE_USER_FROM_IAMSVCACC_MSG ) . put ( LogMessage . MESSAGE , "Failed to remove user permission to IAM Service account. Owner permission cannot be changed.." ) . put ( LogMessage . APIURL , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . APIURL ) ) . build ( ) ) ) ; return ResponseEntity . status ( HttpStatus . BAD_REQUEST ) . body ( "{\"errors\":[\"Failed to remove user permission from IAM Service account. Owner permission cannot be changed.\"]}" ) ; } String readPolicy = new StringBuffer ( ) . append ( TVaultConstants . SVC_ACC_POLICIES_PREFIXES . getKey ( TVaultConstants . READ_POLICY ) ) . append ( IAMServiceAccountConstants . IAMSVCACC_POLICY_PREFIX ) . append ( uniqueIAMSvcaccName ) . toString ( ) ; String writePolicy = new StringBuffer ( ) . append ( TVaultConstants . SVC_ACC_POLICIES_PREFIXES . getKey ( TVaultConstants . WRITE_POLICY ) ) . append ( IAMServiceAccountConstants . IAMSVCACC_POLICY_PREFIX ) . append ( uniqueIAMSvcaccName ) . toString ( ) ; String denyPolicy = new StringBuffer ( ) . append ( TVaultConstants . SVC_ACC_POLICIES_PREFIXES . getKey ( TVaultConstants . DENY_POLICY ) ) . append ( IAMServiceAccountConstants . IAMSVCACC_POLICY_PREFIX ) . append ( uniqueIAMSvcaccName ) . toString ( ) ; List < String > policiesToRemove = new ArrayList < > ( ) ; policiesToRemove . add ( readPolicy ) ; policiesToRemove . add ( writePolicy ) ; policiesToRemove . add ( denyPolicy ) ; return processAndRemoveUserPermissionFromIAMSvcAcc ( token , iamServiceAccountUser , userDetails , oidcEntityResponse , uniqueIAMSvcaccName , policiesToRemove ) ; } else { return ResponseEntity . status ( HttpStatus . BAD_REQUEST ) . body ( "{\"errors\":[\"Access denied: No permission to remove user from this IAM service account\"]}" ) ; } }
Removes user from IAM service account
 @param token
 @param iamServiceAccountUser
 @param userDetails
 @return
Removes user from IAM service account @param token @param iamServiceAccountUser @param userDetails @return
// Deleting owner permission is not allowed