bug4006: added test for dropping unqualified role

java/com.sap.sse.security.storemerging.test/src/com/sap/sse/security/storemerging/TestEffectsOfDroppingUsersAndGroups.java

@@ -59,17 +59,20 @@ public class TestEffectsOfDroppingUsersAndGroups extends AbstractStoreMergeTest
         assertNotNull(sourceSameEmail.getLocale());
         assertNotSame(sourceSameEmail, targetSameEmail);
         // the sailing_viewer role qualified for the admin user (which is merged with the target's admin user) is expected to be kept
-        assertNotNull(StreamSupport.stream(sourceSameEmail.getRoles().spliterator(), /* parallel */ false).
-            filter(rd->rd.getName().equals("sailing_viewer") && rd.getQualifiedForUser()!=null&&rd.getQualifiedForUser().getName().equals("admin")).findAny().get());
+        assertTrue(StreamSupport.stream(sourceSameEmail.getRoles().spliterator(), /* parallel */ false).
+            filter(rd->rd.getName().equals("sailing_viewer") && rd.getQualifiedForUser()!=null&&rd.getQualifiedForUser().getName().equals("admin")).findAny().isPresent());
         // the sailing_viewer role qualified for the admin-tenant group (which is merged with the target's admin-tenant group) is expected to be kept
-        assertNotNull(StreamSupport.stream(sourceSameEmail.getRoles().spliterator(), /* parallel */ false).
-            filter(rd->rd.getName().equals("sailing_viewer") && rd.getQualifiedForTenant()!=null&&rd.getQualifiedForTenant().getName().equals("admin-tenant")).findAny().get());
+        assertTrue(StreamSupport.stream(sourceSameEmail.getRoles().spliterator(), /* parallel */ false).
+            filter(rd->rd.getName().equals("sailing_viewer") && rd.getQualifiedForTenant()!=null&&rd.getQualifiedForTenant().getName().equals("admin-tenant")).findAny().isPresent());
         // the sailing_viewer role qualified for the aaa user (which is dropped) is expected to be dropped
-        assertNotNull(StreamSupport.stream(sourceSameEmail.getRoles().spliterator(), /* parallel */ false).
-            filter(rd->rd.getName().equals("sailing_viewer") && rd.getQualifiedForUser()!=null&&rd.getQualifiedForUser().getName().equals("aaa")).findAny().get());
+        assertTrue(StreamSupport.stream(sourceSameEmail.getRoles().spliterator(), /* parallel */ false).
+            filter(rd->rd.getName().equals("sailing_viewer") && rd.getQualifiedForUser()!=null&&rd.getQualifiedForUser().getName().equals("aaa")).findAny().isPresent());
         // the sailing_viewer role qualified for the aaa-tenant user (which is expected to be dropped because its user is dropped) is expected to be dropped
-        assertNotNull(StreamSupport.stream(sourceSameEmail.getRoles().spliterator(), /* parallel */ false).
-            filter(rd->rd.getName().equals("sailing_viewer") && rd.getQualifiedForTenant()!=null&&rd.getQualifiedForTenant().getName().equals("aaa-tenant")).findAny().get());
+        assertTrue(StreamSupport.stream(sourceSameEmail.getRoles().spliterator(), /* parallel */ false).
+            filter(rd->rd.getName().equals("sailing_viewer") && rd.getQualifiedForTenant()!=null&&rd.getQualifiedForTenant().getName().equals("aaa-tenant")).findAny().isPresent());
+        // the unqualified admin role is expected to be dropped
+        assertTrue(StreamSupport.stream(sourceSameEmail.getRoles().spliterator(), /* parallel */ false).
+            filter(rd->rd.getName().equals("admin") && rd.getQualifiedForTenant()==null && rd.getQualifiedForUser()==null).findAny().isPresent());
         final UserGroup sourceGroup1 = sourceUserStore.getUserGroupByName("Group1");
         assertNotSame(sourceGroup1, targetUserStore.getUserGroupByName("Group1"));
         final UUID sourceGroup1Id = sourceGroup1.getId();
@@ -101,17 +104,20 @@ public class TestEffectsOfDroppingUsersAndGroups extends AbstractStoreMergeTest
         assertFalse(targetAaaTenant.contains(targetSameEmail)); // expecting the group to have been dropped
         // If the sourceAaaTenant group was dropped then so have to be roles qualified by it
         // the sailing_viewer role qualified for the admin user (which is merged with the target's admin user) is expected to be kept
-        assertNotNull(StreamSupport.stream(targetSameEmail.getRoles().spliterator(), /* parallel */ false).
-                filter(rd->rd.getName().equals("sailing_viewer") && rd.getQualifiedForUser()!=null&&rd.getQualifiedForUser().getName().equals("admin")).findAny().get());
+        assertTrue(StreamSupport.stream(targetSameEmail.getRoles().spliterator(), /* parallel */ false).
+                filter(rd->rd.getName().equals("sailing_viewer") && rd.getQualifiedForUser()!=null&&rd.getQualifiedForUser().getName().equals("admin")).findAny().isPresent());
         // the sailing_viewer role qualified for the admin-tenant group (which is merged with the target's admin-tenant group) is expected to be kept
-        assertNotNull(StreamSupport.stream(targetSameEmail.getRoles().spliterator(), /* parallel */ false).
-            filter(rd->rd.getName().equals("sailing_viewer") && rd.getQualifiedForTenant()!=null&&rd.getQualifiedForTenant().getName().equals("admin-tenant")).findAny().get());
+        assertTrue(StreamSupport.stream(targetSameEmail.getRoles().spliterator(), /* parallel */ false).
+            filter(rd->rd.getName().equals("sailing_viewer") && rd.getQualifiedForTenant()!=null&&rd.getQualifiedForTenant().getName().equals("admin-tenant")).findAny().isPresent());
         // the sailing_viewer role qualified for the aaa user (which is dropped) is expected to be dropped
         assertFalse(StreamSupport.stream(targetSameEmail.getRoles().spliterator(), /* parallel */ false).
             filter(rd->rd.getName().equals("sailing_viewer") && rd.getQualifiedForUser()!=null&&rd.getQualifiedForUser().getName().equals("aaa")).findAny().isPresent());
         // the sailing_viewer role qualified for the aaa-tenant user (which is expected to be dropped because its user is dropped) is expected to be dropped
         assertFalse(StreamSupport.stream(targetSameEmail.getRoles().spliterator(), /* parallel */ false).
             filter(rd->rd.getName().equals("sailing_viewer") && rd.getQualifiedForTenant()!=null&&rd.getQualifiedForTenant().getName().equals("aaa-tenant")).findAny().isPresent());
+        // the unqualified admin role is expected to be dropped
+        assertFalse(StreamSupport.stream(sourceSameEmail.getRoles().spliterator(), /* parallel */ false).
+            filter(rd->rd.getName().equals("admin") && rd.getQualifiedForTenant()==null && rd.getQualifiedForUser()==null).findAny().isPresent());
         // validate preference handling:
         // the aaa user got dropped; so should its preference from the source
         assertNull(targetUserStore.getPreference(targetAaa.getName(), PREFERENCE_NAME));

java/com.sap.sse.security.storemerging.test/src/resources/ACCESS_CONTROL_LISTS_source_TestEffectsOfDroppingUsersAndGroups.json

@@ -12,3 +12,4 @@
 {"_id":{"$oid":"5e3145a09d7cdfdd30a6ff03"},"OBJECT_ID":"ROLE_ASSOCIATION/same-email\\/c42948df-517b-45cb-9fa9-d1e79f18e115\\/null\\/2116c23e-d740-45d8-b311-9b531ed68863","OBJECT_DISPLAY_NAME":null,"PERMISSION_MAP":[{"PERMISSION_MAP_USER_GROUP_ID":null,"PERMISSION_MAP_ACTIONS":["READ"]}]}
 {"_id":{"$oid":"5e3145ac9d7cdfdd30a6ff15"},"OBJECT_ID":"ROLE_ASSOCIATION/same-email\\/c42948df-517b-45cb-9fa9-d1e79f18e115\\/aaa\\/null","OBJECT_DISPLAY_NAME":null,"PERMISSION_MAP":[{"PERMISSION_MAP_USER_GROUP_ID":null,"PERMISSION_MAP_ACTIONS":["READ"]}]}
 {"_id":{"$oid":"5e3145b69d7cdfdd30a6ff25"},"OBJECT_ID":"ROLE_ASSOCIATION/same-email\\/c42948df-517b-45cb-9fa9-d1e79f18e115\\/null\\/04bd2b8a-4b05-41e5-9f15-d30de1c037f0","OBJECT_DISPLAY_NAME":null,"PERMISSION_MAP":[{"PERMISSION_MAP_USER_GROUP_ID":null,"PERMISSION_MAP_ACTIONS":["READ"]}]}
+{"_id":{"$oid":"5e3152c29d7cdfdd30a724ac"},"OBJECT_ID":"ROLE_ASSOCIATION/same-email\\/dc77e3d1-d405-435e-8699-ce7245f6fd7a\\/null\\/null","OBJECT_DISPLAY_NAME":null,"PERMISSION_MAP":[{"PERMISSION_MAP_USER_GROUP_ID":null,"PERMISSION_MAP_ACTIONS":["READ"]}]}

java/com.sap.sse.security.storemerging.test/src/resources/OWNERSHIPS_source_TestEffectsOfDroppingUsersAndGroups.json

@@ -28,3 +28,4 @@
 {"_id":{"$oid":"5e3145a09d7cdfdd30a6ff00"},"OBJECT_ID":"ROLE_ASSOCIATION/same-email\\/c42948df-517b-45cb-9fa9-d1e79f18e115\\/null\\/2116c23e-d740-45d8-b311-9b531ed68863","OWNER_USERNAME":"admin","TENANT_OWNER_ID":{"$binary":"Zk4UqpSz8FC8ANYEnZfNjA==","$type":"03"},"OBJECT_DISPLAY_NAME":"same-email\\/c42948df-517b-45cb-9fa9-d1e79f18e115\\/null\\/2116c23e-d740-45d8-b311-9b531ed68863"}
 {"_id":{"$oid":"5e3145ac9d7cdfdd30a6ff12"},"OBJECT_ID":"ROLE_ASSOCIATION/same-email\\/c42948df-517b-45cb-9fa9-d1e79f18e115\\/aaa\\/null","OWNER_USERNAME":"admin","TENANT_OWNER_ID":{"$binary":"Zk4UqpSz8FC8ANYEnZfNjA==","$type":"03"},"OBJECT_DISPLAY_NAME":"same-email\\/c42948df-517b-45cb-9fa9-d1e79f18e115\\/aaa\\/null"}
 {"_id":{"$oid":"5e3145b69d7cdfdd30a6ff22"},"OBJECT_ID":"ROLE_ASSOCIATION/same-email\\/c42948df-517b-45cb-9fa9-d1e79f18e115\\/null\\/04bd2b8a-4b05-41e5-9f15-d30de1c037f0","OWNER_USERNAME":"admin","TENANT_OWNER_ID":{"$binary":"Zk4UqpSz8FC8ANYEnZfNjA==","$type":"03"},"OBJECT_DISPLAY_NAME":"same-email\\/c42948df-517b-45cb-9fa9-d1e79f18e115\\/null\\/04bd2b8a-4b05-41e5-9f15-d30de1c037f0"}
+{"_id":{"$oid":"5e3152c29d7cdfdd30a724a9"},"OBJECT_ID":"ROLE_ASSOCIATION/same-email\\/dc77e3d1-d405-435e-8699-ce7245f6fd7a\\/null\\/null","OWNER_USERNAME":"admin","TENANT_OWNER_ID":{"$binary":"Zk4UqpSz8FC8ANYEnZfNjA==","$type":"03"},"OBJECT_DISPLAY_NAME":"same-email\\/dc77e3d1-d405-435e-8699-ce7245f6fd7a\\/null\\/null"}

java/com.sap.sse.security.storemerging.test/src/resources/USERS_source_TestEffectsOfDroppingUsersAndGroups.json

@@ -1,4 +1,4 @@
 {"_id":{"$oid":"5e306bb19d7cdfdd30a6e01e"},"NAME":"admin","EMAIL":"nobody@sapsailing.com","FULLNAME":null,"COMPANY":null,"LOCALE":"en","EMAIL_VALIDATED":false,"PASSWORD_RESET_SECRET":null,"VALIDATION_SECRET":"r1upfFfThf4D1ABAMlfmJTvMcc6apC1Hte8thIscJvw=","ACCOUNTS":{"USERNAME_PASSWORD":{"NAME":"admin","SALTED_PW":"UM/57Lu+hC8ssyUuL1rj/P6u4EdZo53sSsLecwcPYPM=","SALT":{"$binary":"f2cWdziZcOIcT8cEZvFO7Q==","$type":"00"}}},"ROLE_IDS":[{"ID":{"$binary":"ZEQ9sUhRHa0uTk1uOXzEkA==","$type":"03"},"NAME":"user","QUALIFYING_TENANT_ID":{"$binary":"2EVA1z7CFiFjiNYeU5sRsw==","$type":"03"},"QUALIFYING_TENANT_NAME":"admin-tenant","QUALIFYING_USERNAME":null},{"ID":{"$binary":"XkMF1NHjd9x6/fZFcs6Zhg==","$type":"03"},"NAME":"admin","QUALIFYING_TENANT_ID":null,"QUALIFYING_TENANT_NAME":null,"QUALIFYING_USERNAME":null},{"ID":{"$binary":"ZEQ9sUhRHa0uTk1uOXzEkA==","$type":"03"},"NAME":"user","QUALIFYING_TENANT_ID":{"$binary":"DkjzLHhVSiXsijw3fWO4vA==","$type":"03"},"QUALIFYING_TENANT_NAME":"Group1","QUALIFYING_USERNAME":null},{"ID":{"$binary":"ZEQ9sUhRHa0uTk1uOXzEkA==","$type":"03"},"NAME":"user","QUALIFYING_TENANT_ID":null,"QUALIFYING_TENANT_NAME":null,"QUALIFYING_USERNAME":"admin"}],"PERMISSIONS":[],"DEFAULT_TENANT_IDS":[{"DEFAULT_TENANT_SERVER":"unknown server name","DEFAULT_TENANT_GROUP":{"$binary":"Zk4UqpSz8FC8ANYEnZfNjA==","$type":"03"}}]}
 {"_id":{"$oid":"5e306bb19d7cdfdd30a6e045"},"NAME":"\u003call\u003e","EMAIL":null,"FULLNAME":null,"COMPANY":null,"LOCALE":null,"EMAIL_VALIDATED":false,"PASSWORD_RESET_SECRET":null,"VALIDATION_SECRET":null,"ACCOUNTS":{},"ROLE_IDS":[],"PERMISSIONS":["USER:CREATE"],"DEFAULT_TENANT_IDS":[]}
 {"_id":{"$oid":"5e306bfd9d7cdfdd30a6e266"},"NAME":"aaa","EMAIL":"aaa2@example.com","FULLNAME":null,"COMPANY":null,"LOCALE":null,"EMAIL_VALIDATED":false,"PASSWORD_RESET_SECRET":null,"VALIDATION_SECRET":null,"ACCOUNTS":{"USERNAME_PASSWORD":{"NAME":"aaa","SALTED_PW":"vsoVPWL29/zxdGLnmLwnNVA44/z4+CxR8+OQ1OGirCM=","SALT":{"$binary":"0x+50ojUf3taO3RFc4i0Zg==","$type":"00"}}},"ROLE_IDS":[{"ID":{"$binary":"ZEQ9sUhRHa0uTk1uOXzEkA==","$type":"03"},"NAME":"user","QUALIFYING_TENANT_ID":{"$binary":"5UEFS4orvQTwN8DhDdMVnw==","$type":"03"},"QUALIFYING_TENANT_NAME":"aaa-tenant","QUALIFYING_USERNAME":null},{"ID":{"$binary":"ZEQ9sUhRHa0uTk1uOXzEkA==","$type":"03"},"NAME":"user","QUALIFYING_TENANT_ID":null,"QUALIFYING_TENANT_NAME":null,"QUALIFYING_USERNAME":"aaa"}],"PERMISSIONS":[],"DEFAULT_TENANT_IDS":[{"DEFAULT_TENANT_SERVER":"unknown server name","DEFAULT_TENANT_GROUP":{"$binary":"5UEFS4orvQTwN8DhDdMVnw==","$type":"03"}}]}
-{"_id":{"$oid":"5e306c429d7cdfdd30a6e2b9"},"NAME":"same-email","EMAIL":"same-email@example.com","FULLNAME":"Same EMail","COMPANY":"Same Emails Company","LOCALE":"ja","EMAIL_VALIDATED":false,"PASSWORD_RESET_SECRET":null,"VALIDATION_SECRET":"yo/kfjQKuUuYlwI64wJTdGH+lpVXgxulUdqMP3BERFI=","ACCOUNTS":{"USERNAME_PASSWORD":{"NAME":"same-email","SALTED_PW":"VxBYjWTIy/sLLTVIj7sgfrg0WxhAuk4Mo4/q4WJm858=","SALT":{"$binary":"e0uN/mYLopoMxAY5SHGYeQ==","$type":"00"}}},"ROLE_IDS":[{"ID":{"$binary":"y0V7Ud9IKcQV4Rif59Gpnw==","$type":"03"},"NAME":"sailing_viewer","QUALIFYING_TENANT_ID":{"$binary":"5UEFS4orvQTwN8DhDdMVnw==","$type":"03"},"QUALIFYING_TENANT_NAME":"aaa-tenant","QUALIFYING_USERNAME":null},{"ID":{"$binary":"y0V7Ud9IKcQV4Rif59Gpnw==","$type":"03"},"NAME":"sailing_viewer","QUALIFYING_TENANT_ID":null,"QUALIFYING_TENANT_NAME":null,"QUALIFYING_USERNAME":"aaa"},{"ID":{"$binary":"ZEQ9sUhRHa0uTk1uOXzEkA==","$type":"03"},"NAME":"user","QUALIFYING_TENANT_ID":null,"QUALIFYING_TENANT_NAME":null,"QUALIFYING_USERNAME":"same-email"},{"ID":{"$binary":"ZEQ9sUhRHa0uTk1uOXzEkA==","$type":"03"},"NAME":"user","QUALIFYING_TENANT_ID":{"$binary":"MkYoodB2CTLb51gfcbGmog==","$type":"03"},"QUALIFYING_TENANT_NAME":"same-email-tenant","QUALIFYING_USERNAME":null},{"ID":{"$binary":"y0V7Ud9IKcQV4Rif59Gpnw==","$type":"03"},"NAME":"sailing_viewer","QUALIFYING_TENANT_ID":{"$binary":"2EVA1z7CFiFjiNYeU5sRsw==","$type":"03"},"QUALIFYING_TENANT_NAME":"admin-tenant","QUALIFYING_USERNAME":null},{"ID":{"$binary":"y0V7Ud9IKcQV4Rif59Gpnw==","$type":"03"},"NAME":"sailing_viewer","QUALIFYING_TENANT_ID":null,"QUALIFYING_TENANT_NAME":null,"QUALIFYING_USERNAME":"admin"}],"PERMISSIONS":[],"DEFAULT_TENANT_IDS":[{"DEFAULT_TENANT_SERVER":"unknown server name","DEFAULT_TENANT_GROUP":{"$binary":"MkYoodB2CTLb51gfcbGmog==","$type":"03"}}]}
+{"_id":{"$oid":"5e306c429d7cdfdd30a6e2b9"},"NAME":"same-email","EMAIL":"same-email@example.com","FULLNAME":"Same EMail","COMPANY":"Same Emails Company","LOCALE":"ja","EMAIL_VALIDATED":false,"PASSWORD_RESET_SECRET":null,"VALIDATION_SECRET":"yo/kfjQKuUuYlwI64wJTdGH+lpVXgxulUdqMP3BERFI=","ACCOUNTS":{"USERNAME_PASSWORD":{"NAME":"same-email","SALTED_PW":"VxBYjWTIy/sLLTVIj7sgfrg0WxhAuk4Mo4/q4WJm858=","SALT":{"$binary":"e0uN/mYLopoMxAY5SHGYeQ==","$type":"00"}}},"ROLE_IDS":[{"ID":{"$binary":"y0V7Ud9IKcQV4Rif59Gpnw==","$type":"03"},"NAME":"sailing_viewer","QUALIFYING_TENANT_ID":{"$binary":"5UEFS4orvQTwN8DhDdMVnw==","$type":"03"},"QUALIFYING_TENANT_NAME":"aaa-tenant","QUALIFYING_USERNAME":null},{"ID":{"$binary":"y0V7Ud9IKcQV4Rif59Gpnw==","$type":"03"},"NAME":"sailing_viewer","QUALIFYING_TENANT_ID":null,"QUALIFYING_TENANT_NAME":null,"QUALIFYING_USERNAME":"aaa"},{"ID":{"$binary":"ZEQ9sUhRHa0uTk1uOXzEkA==","$type":"03"},"NAME":"user","QUALIFYING_TENANT_ID":null,"QUALIFYING_TENANT_NAME":null,"QUALIFYING_USERNAME":"same-email"},{"ID":{"$binary":"ZEQ9sUhRHa0uTk1uOXzEkA==","$type":"03"},"NAME":"user","QUALIFYING_TENANT_ID":{"$binary":"MkYoodB2CTLb51gfcbGmog==","$type":"03"},"QUALIFYING_TENANT_NAME":"same-email-tenant","QUALIFYING_USERNAME":null},{"ID":{"$binary":"y0V7Ud9IKcQV4Rif59Gpnw==","$type":"03"},"NAME":"sailing_viewer","QUALIFYING_TENANT_ID":{"$binary":"2EVA1z7CFiFjiNYeU5sRsw==","$type":"03"},"QUALIFYING_TENANT_NAME":"admin-tenant","QUALIFYING_USERNAME":null},{"ID":{"$binary":"y0V7Ud9IKcQV4Rif59Gpnw==","$type":"03"},"NAME":"sailing_viewer","QUALIFYING_TENANT_ID":null,"QUALIFYING_TENANT_NAME":null,"QUALIFYING_USERNAME":"admin"},{"ID":{"$binary":"XkMF1NHjd9x6/fZFcs6Zhg==","$type":"03"},"NAME":"admin","QUALIFYING_TENANT_ID":null,"QUALIFYING_TENANT_NAME":null,"QUALIFYING_USERNAME":null}],"PERMISSIONS":[],"DEFAULT_TENANT_IDS":[{"DEFAULT_TENANT_SERVER":"unknown server name","DEFAULT_TENANT_GROUP":{"$binary":"MkYoodB2CTLb51gfcbGmog==","$type":"03"}}]}