Package com.yahoo.vespa.athenz.client.zms

Class DefaultZmsClient

java.lang.Object

com.yahoo.vespa.athenz.client.common.ClientBase

com.yahoo.vespa.athenz.client.zms.DefaultZmsClient

All Implemented Interfaces:

ZmsClient, Closeable, AutoCloseable

public class DefaultZmsClient
extends ClientBase
implements ZmsClient

Author:

bjorncs

Nested Class Summary

Nested classes/interfaces inherited from class com.yahoo.vespa.athenz.client.common.ClientBase

ClientBase.ClientExceptionFactory

Field Summary

Fields inherited from class com.yahoo.vespa.athenz.client.common.ClientBase

logger

Constructor Summary

Constructors

Constructor	Description
DefaultZmsClient(URI zmsUrl, AthenzIdentity identity, SSLContext sslContext, ErrorHandler errorHandler)
DefaultZmsClient(URI zmsUrl, ServiceIdentityProvider identityProvider, ErrorHandler errorHandler)

Method Summary

Modifier and Type	Method	Description
void	addPolicyRule(AthenzDomain athenzDomain, String athenzPolicy, String action, AthenzResourceName resourceName, AthenzRole athenzRole)
void	addRoleMember(AthenzRole role, AthenzIdentity member, Optional<String> reason)
void	createOrUpdateService(AthenzService athenzService)
void	createPolicy(AthenzDomain athenzDomain, String athenzPolicy)
void	createProviderResourceGroup(AthenzDomain tenantDomain, AthenzIdentity providerService, String resourceGroup, Set<RoleAction> roleActions, OAuthCredentials oAuthCredentials)
void	createRole(AthenzRole role, Map<String,Object> attributes)
void	createSubdomain(AthenzDomain parent, String name, Map<String,Object> attributes)
void	createTenancy(AthenzDomain tenantDomain, AthenzIdentity providerService, OAuthCredentials oAuthCredentials)
void	createTenantResourceGroup(AthenzDomain tenantDomain, AthenzIdentity provider, String resourceGroup, Set<RoleAction> roleActions)	For manual tenancy provisioning - only creates roles/policies on provider domain
void	decidePendingRoleMembership(AthenzRole athenzRole, AthenzIdentity athenzIdentity, Instant expiry, Optional<String> reason, Optional<OAuthCredentials> oAuthCredentials, boolean approve)
void	deletePolicy(AthenzDomain domain, String athenzPolicy)
boolean	deletePolicyRule(AthenzDomain athenzDomain, String athenzPolicy, String action, AthenzResourceName resourceName, AthenzRole athenzRole)
void	deleteProviderResourceGroup(AthenzDomain tenantDomain, AthenzIdentity providerService, String resourceGroup, OAuthCredentials oAuthCredentials)
void	deleteRole(AthenzRole role)
void	deleteRoleMember(AthenzRole role, AthenzIdentity member)
void	deleteService(AthenzService athenzService)
void	deleteSubdomain(AthenzDomain parent, String name)
void	deleteTenancy(AthenzDomain tenantDomain, AthenzIdentity providerService, OAuthCredentials oAuthCredentials)
List<AthenzDomain>	getDomainList(String prefix)
List<AthenzDomain>	getDomainListByAccount(String account)
AthenzDomainMeta	getDomainMeta(AthenzDomain domain)
AthenzRoleInformation	getFullRoleInformation(AthenzRole role)
boolean	getGroupMembership(AthenzGroup group, AthenzIdentity identity)
boolean	getMembership(AthenzRole role, AthenzIdentity identity)
Optional<AthenzPolicy>	getPolicy(AthenzDomain domain, String name)
QuotaUsage	getQuotaUsage()
Set<RoleAction>	getTenantResourceGroups(AthenzDomain tenantDomain, AthenzIdentity provider, String resourceGroup)
boolean	hasAccess(AthenzResourceName resource, String action, AthenzIdentity identity)
List<AthenzIdentity>	listMembers(AthenzRole athenzRole)
Map<AthenzIdentity,String>	listPendingRoleApprovals(AthenzRole athenzRole)
Set<String>	listPolicies(AthenzDomain domain)
Set<AthenzRole>	listRoles(AthenzDomain domain)
List<AthenzService>	listServices(AthenzDomain athenzDomain)
void	updateDomain(AthenzDomain domain, Map<String,Object> attributes)
void	updateServicePublicKey(AthenzService athenzService, String publicKeyId, PublicKey publicKey)

Methods inherited from class com.yahoo.vespa.athenz.client.common.ClientBase

close, execute, readEntity, toJsonStringEntity

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface com.yahoo.vespa.athenz.client.zms.ZmsClient

close, createSubdomain

Constructor Details

DefaultZmsClient

public DefaultZmsClient(URI zmsUrl,
 AthenzIdentity identity,
 SSLContext sslContext,
 ErrorHandler errorHandler)

DefaultZmsClient

public DefaultZmsClient(URI zmsUrl,
 ServiceIdentityProvider identityProvider,
 ErrorHandler errorHandler)

Method Details

createTenancy

public void createTenancy(AthenzDomain tenantDomain,
 AthenzIdentity providerService,
 OAuthCredentials oAuthCredentials)

Specified by:

createTenancy in interface ZmsClient

deleteTenancy

public void deleteTenancy(AthenzDomain tenantDomain,
 AthenzIdentity providerService,
 OAuthCredentials oAuthCredentials)

Specified by:

deleteTenancy in interface ZmsClient

createProviderResourceGroup

public void createProviderResourceGroup(AthenzDomain tenantDomain,
 AthenzIdentity providerService,
 String resourceGroup,
 Set<RoleAction> roleActions,
 OAuthCredentials oAuthCredentials)

Specified by:

createProviderResourceGroup in interface ZmsClient

deleteProviderResourceGroup

public void deleteProviderResourceGroup(AthenzDomain tenantDomain,
 AthenzIdentity providerService,
 String resourceGroup,
 OAuthCredentials oAuthCredentials)

Specified by:

deleteProviderResourceGroup in interface ZmsClient

createTenantResourceGroup

public void createTenantResourceGroup(AthenzDomain tenantDomain,
 AthenzIdentity provider,
 String resourceGroup,
 Set<RoleAction> roleActions)

Description copied from interface: ZmsClient

For manual tenancy provisioning - only creates roles/policies on provider domain

Specified by:

createTenantResourceGroup in interface ZmsClient

getTenantResourceGroups

public Set<RoleAction> getTenantResourceGroups(AthenzDomain tenantDomain,
 AthenzIdentity provider,
 String resourceGroup)

Specified by:

getTenantResourceGroups in interface ZmsClient

addRoleMember

public void addRoleMember(AthenzRole role,
 AthenzIdentity member,
 Optional<String> reason)

Specified by:

addRoleMember in interface ZmsClient

deleteRoleMember

public void deleteRoleMember(AthenzRole role,
 AthenzIdentity member)

Specified by:

deleteRoleMember in interface ZmsClient

getMembership

public boolean getMembership(AthenzRole role,
 AthenzIdentity identity)

Specified by:

getMembership in interface ZmsClient

getGroupMembership

public boolean getGroupMembership(AthenzGroup group,
 AthenzIdentity identity)

Specified by:

getGroupMembership in interface ZmsClient

getDomainList

public List<AthenzDomain> getDomainList(String prefix)

Specified by:

getDomainList in interface ZmsClient

getDomainListByAccount

public List<AthenzDomain> getDomainListByAccount(String account)

Specified by:

getDomainListByAccount in interface ZmsClient

getDomainMeta

public AthenzDomainMeta getDomainMeta(AthenzDomain domain)

Specified by:

getDomainMeta in interface ZmsClient

updateDomain

public void updateDomain(AthenzDomain domain,
 Map<String,Object> attributes)

Specified by:

updateDomain in interface ZmsClient

hasAccess

public boolean hasAccess(AthenzResourceName resource,
 String action,
 AthenzIdentity identity)

Specified by:

hasAccess in interface ZmsClient

createPolicy

public void createPolicy(AthenzDomain athenzDomain,
 String athenzPolicy)

Specified by:

createPolicy in interface ZmsClient

addPolicyRule

public void addPolicyRule(AthenzDomain athenzDomain,
 String athenzPolicy,
 String action,
 AthenzResourceName resourceName,
 AthenzRole athenzRole)

Specified by:

addPolicyRule in interface ZmsClient

deletePolicyRule

public boolean deletePolicyRule(AthenzDomain athenzDomain,
 String athenzPolicy,
 String action,
 AthenzResourceName resourceName,
 AthenzRole athenzRole)

Specified by:

deletePolicyRule in interface ZmsClient

getPolicy

public Optional<AthenzPolicy> getPolicy(AthenzDomain domain,
 String name)

Specified by:

getPolicy in interface ZmsClient

listPendingRoleApprovals

public Map<AthenzIdentity,String> listPendingRoleApprovals(AthenzRole athenzRole)

Specified by:

listPendingRoleApprovals in interface ZmsClient

decidePendingRoleMembership

public void decidePendingRoleMembership(AthenzRole athenzRole,
 AthenzIdentity athenzIdentity,
 Instant expiry,
 Optional<String> reason,
 Optional<OAuthCredentials> oAuthCredentials,
 boolean approve)

Specified by:

decidePendingRoleMembership in interface ZmsClient

listMembers

public List<AthenzIdentity> listMembers(AthenzRole athenzRole)

Specified by:

listMembers in interface ZmsClient

listServices

public List<AthenzService> listServices(AthenzDomain athenzDomain)

Specified by:

listServices in interface ZmsClient

createOrUpdateService

public void createOrUpdateService(AthenzService athenzService)

Specified by:

createOrUpdateService in interface ZmsClient

updateServicePublicKey

public void updateServicePublicKey(AthenzService athenzService,
 String publicKeyId,
 PublicKey publicKey)

Specified by:

updateServicePublicKey in interface ZmsClient

deleteService

public void deleteService(AthenzService athenzService)

Specified by:

deleteService in interface ZmsClient

createRole

public void createRole(AthenzRole role,
 Map<String,Object> attributes)

Specified by:

createRole in interface ZmsClient

listRoles

public Set<AthenzRole> listRoles(AthenzDomain domain)

Specified by:

listRoles in interface ZmsClient

listPolicies

public Set<String> listPolicies(AthenzDomain domain)

Specified by:

listPolicies in interface ZmsClient

deleteRole

public void deleteRole(AthenzRole role)

Specified by:

deleteRole in interface ZmsClient

createSubdomain

public void createSubdomain(AthenzDomain parent,
 String name,
 Map<String,Object> attributes)

Specified by:

createSubdomain in interface ZmsClient

getQuotaUsage

public QuotaUsage getQuotaUsage()

Specified by:

getQuotaUsage in interface ZmsClient

deleteSubdomain

public void deleteSubdomain(AthenzDomain parent,
 String name)

Specified by:

deleteSubdomain in interface ZmsClient

deletePolicy

public void deletePolicy(AthenzDomain domain,
 String athenzPolicy)

Specified by:

deletePolicy in interface ZmsClient

getFullRoleInformation

public AthenzRoleInformation getFullRoleInformation(AthenzRole role)

Specified by:

getFullRoleInformation in interface ZmsClient