in sources/src/main/java/com/google/solutions/jitaccess/catalog/legacy/LegacyPolicy.java [228:271]
private void initializeLazily() {
synchronized (this.initialized) {
if (!this.initialized.get()) {
this.initialized.set(true);
var roles = new HashMap<String, RolePolicy>();
for (var binding : this.loadBindings.get()) {
try {
var role = RolePolicy.fromBinding(this.projectId, binding);
if (role.isEmpty()) {
//
// Not a JIT- or MPA eligible role, ignore.
//
}
else if (roles.containsKey(role.get().name())) {
//
// Role added already. This can happen if the same IAM role
// is JIt-eligible to some users, and MPA-eligible to others.
// In this case, we need to merge the two ACLs.
//
roles.put(role.get().name(), RolePolicy.merge(roles.get(role.get().name()), role.get()));
}
else {
roles.put(role.get().name(), role.get());
}
}
catch (Exception e) {
this.incompatibilities.add(new JitGroupCompliance(
new JitGroupId(
LegacyPolicy.NAME,
this.displayName(),
RolePolicy.createName(new IamRole(binding.getRole()))) ,
null,
null,
new UnsupportedOperationException(
String.format("The role '%s' cannot be mapped to a JIT Group", binding.getRole()),
e)));
}
}
roles.values().forEach(super::add);
}
}
}