Skip to content

fix: clear role members when set to trust role #3087

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
TakuyaMatsu wants to merge 2 commits into
base: master
Choose a base branch
from
Open

fix: clear role members when set to trust role #3087

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
930febd
fix: clear role members when set to trust role
TakuyaMatsu Oct 3, 2025
518bd76
Update servers/zms/src/test/java/com/yahoo/athenz/zms/DBServiceTest.java
TakuyaMatsu Oct 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions servers/zms/src/main/java/com/yahoo/athenz/zms/DBService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5168,7 +5168,7 @@ boolean addSolutionTemplate(ResourceContext ctx, ObjectStoreConnection con, Stri
firstEntry = auditLogSeparator(auditDetails, firstEntry);
auditDetails.append(" \"add-role\": ");
if (!processRole(con, originalRole, domainName, roleName, templateRole,
admin, null, auditRef, true, auditDetails)) {
admin, null, auditRef, StringUtil.isEmpty(templateRole.getTrust()), auditDetails)) {
return false;
}

Expand Down Expand Up @@ -5460,7 +5460,7 @@ Role updateTemplateRole(ObjectStoreConnection con, Role role, String domainName,

List<RoleMember> roleMembers = role.getRoleMembers();
List<RoleMember> newMembers = new ArrayList<>();
if (roleMembers != null && !roleMembers.isEmpty()) {
if (StringUtil.isEmpty(templateRoleTrust) && roleMembers != null && !roleMembers.isEmpty()) {
for (RoleMember roleMember : roleMembers) {
RoleMember newRoleMember = new RoleMember();

Expand Down
115 changes: 115 additions & 0 deletions servers/zms/src/test/java/com/yahoo/athenz/zms/DBServiceTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4034,6 +4034,121 @@ public void testApplySolutionTemplateExistingRoles() throws ServerResourceExcept
zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef, null);
}

@Test
public void testApplySolutionTemplateRoleWithBothTrustAndMembers() throws ServerResourceException {

String caller = "testApplySolutionTemplateRoleWithBothTrustAndMembers";
String domainName = "solutiontemplate-withtrustrole";
TopLevelDomain dom1 = createTopLevelDomainObject(domainName,
"Test Domain1", "testOrg", adminUser);
zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, null, dom1);

SubDomain domSysNetwork = createSubDomainObject("network", "sys", "Test Domain", "testOrg",
adminUser, mockDomRsrcCtx.principal().getFullName());
zms.postSubDomain(mockDomRsrcCtx, "sys", auditRef, null, domSysNetwork);

// apply the template

List<String> templates = new ArrayList<>();
templates.add("template_role_with_both_trust_and_members");
DomainTemplate domainTemplate = new DomainTemplate().setTemplateNames(templates);
zms.dbService.executePutDomainTemplate(mockDomRsrcCtx, domainName, domainTemplate, auditRef, caller);

DomainTemplateList domainTemplateList = zms.dbService.listDomainTemplates(domainName);
assertEquals(domainTemplateList.getTemplateNames().size(), 1);

// verify that our role collection includes the expected roles

List<String> names = zms.dbService.listRoles(domainName);
assertEquals(names.size(), 2);
assertTrue(names.contains("trust-and-members"));

// this should be our own role that we created previously

Role role = zms.dbService.getRole(domainName, "trust-and-members", false, false, false);
assertEquals(role.getName(), domainName + ":role.trust-and-members");
assertEquals(role.getTrust(), "sys.network");
assertNull(role.getRoleMembers());

// remove the template_role_with_both_trust_and_members template

zms.dbService.executeDeleteDomainTemplate(mockDomRsrcCtx, domainName, "template_role_with_both_trust_and_members",
auditRef, caller);
assertNull(zms.dbService.getRole(domainName, "trust-and-members", false, false, false));

domainTemplateList = zms.dbService.listDomainTemplates(domainName);
assertTrue(domainTemplateList.getTemplateNames().isEmpty());

zms.deleteSubDomain(mockDomRsrcCtx, "sys", "network", auditRef, null);
zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef, null);
}

@Test
public void testApplySolutionTemplateUpdateRoleByTrustRole() throws ServerResourceException {

String caller = "testApplySolutionTemplateUpdateRoleByTrustRole";
String domainName = "solutiontemplate-updatetrustrole";
TopLevelDomain dom1 = createTopLevelDomainObject(domainName,
"Test Domain1", "testOrg", adminUser);
zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, null, dom1);

SubDomain domSysNetwork = createSubDomainObject("network", "sys", "Test Domain", "testOrg",
adminUser, mockDomRsrcCtx.principal().getFullName());
zms.postSubDomain(mockDomRsrcCtx, "sys", auditRef, null, domSysNetwork);

Role role1 = createRoleObject(domainName, "target-role", null, "user.joe",
"user.jane");
zms.putRole(mockDomRsrcCtx, domainName, "target-role", auditRef, false, null, role1);

// apply the template

List<String> templates = new ArrayList<>();
templates.add("template_trust_role");
DomainTemplate domainTemplate = new DomainTemplate().setTemplateNames(templates);
zms.dbService.executePutDomainTemplate(mockDomRsrcCtx, domainName, domainTemplate, auditRef, caller);

DomainTemplateList domainTemplateList = zms.dbService.listDomainTemplates(domainName);
assertEquals(domainTemplateList.getTemplateNames().size(), 1);

// verify that our role collection includes the expected roles

List<String> names = zms.dbService.listRoles(domainName);
assertEquals(names.size(), 2);
assertTrue(names.contains("target-role"));

// this should be our own role that we created previously

Role role = zms.dbService.getRole(domainName, "target-role", false, false, false);
assertEquals(role.getName(), domainName + ":role.target-role");
assertEquals(role.getTrust(), "sys.network");
assertNull(role.getRoleMembers());

// check the response from the modified_domains API

AthenzDomain athenzDomain = zms.dbService.getAthenzDomain(domainName, true);
List<Role> roles = athenzDomain.getRoles();
Role targetRole = roles.stream()
.filter(r -> r.getName().equals(domainName + ":role.target-role"))
.findFirst()
.orElseGet(() -> {
fail("Role not found: target-role");
return null;
});
assertNull(targetRole.getRoleMembers());

// remove the template_role_with_both_trust_and_members template

zms.dbService.executeDeleteDomainTemplate(mockDomRsrcCtx, domainName, "template_trust_role",
auditRef, caller);
assertNull(zms.dbService.getRole(domainName, "target-role", false, false, false));

domainTemplateList = zms.dbService.listDomainTemplates(domainName);
assertTrue(domainTemplateList.getTemplateNames().isEmpty());

zms.deleteSubDomain(mockDomRsrcCtx, "sys", "network", auditRef, null);
zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef, null);
}

@Test
public void testApplySolutionTemplateExistingGroups() throws ServerResourceException {

Expand Down
4 changes: 2 additions & 2 deletions servers/zms/src/test/java/com/yahoo/athenz/zms/ZMSImplTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23821,7 +23821,7 @@ public void testGetServerTemplateDetailsList() {
RsrcCtxWrapper ctx = zmsTestInitializer.getMockDomRsrcCtx();

DomainTemplateDetailsList serverTemplateDetailsList = zmsImpl.getServerTemplateDetailsList(ctx);
assertEquals(serverTemplateDetailsList.getMetaData().size(), 15);
assertEquals(serverTemplateDetailsList.getMetaData().size(), 17);
TemplateMetaData vipTemplateMetaData = null;
for (TemplateMetaData templateMetaData : serverTemplateDetailsList.getMetaData()) {
if (templateMetaData.getTemplateName().equals("vipng")) {
Expand All @@ -23840,7 +23840,7 @@ public void testGetServerTemplateDetailsListSorted() {
RsrcCtxWrapper ctx = zmsTestInitializer.getMockDomRsrcCtx();

DomainTemplateDetailsList serverTemplateDetailsList = zmsImpl.getServerTemplateDetailsList(ctx);
assertEquals(serverTemplateDetailsList.getMetaData().size(), 15);
assertEquals(serverTemplateDetailsList.getMetaData().size(), 17);
List<TemplateMetaData> templates = serverTemplateDetailsList.getMetaData();

String previousTemplateName = "";
Expand Down
37 changes: 37 additions & 0 deletions servers/zms/src/test/resources/solution_templates.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -657,6 +657,43 @@
],
"policies": [
]
},
"template_role_with_both_trust_and_members": {
"metadata":
{
"latestVersion": 1,
"timestamp": "2024-02-15T00:00:00.000Z",
"description": "TemplateRoleTest",
"autoUpdate": false
},
"roles": [
{
"name": "_domain_:role.trust-and-members",
"description": "Role for Testing",
"trust": "sys.network",
"roleMembers": [
{
"memberName": "sys.builder"
}
]
}
]
},
"template_trust_role": {
"metadata":
{
"latestVersion": 1,
"timestamp": "2024-02-15T00:00:00.000Z",
"description": "TemplateRoleTest",
"autoUpdate": false
},
"roles": [
{
"name": "_domain_:role.target-role",
"description": "Role for Testing",
"trust": "sys.network"
}
]
}
}
}