Package com.yahoo.vespa.athenz.client.zms

Class DefaultZmsClient

java.lang.Object

com.yahoo.vespa.athenz.client.common.ClientBase

com.yahoo.vespa.athenz.client.zms.DefaultZmsClient

All Implemented Interfaces:

ZmsClient, AutoCloseable

public class DefaultZmsClient
extends ClientBase
implements ZmsClient

Author:

bjorncs

Nested Class Summary

Nested classes/interfaces inherited from class com.yahoo.vespa.athenz.client.common.ClientBase

ClientBase.ClientExceptionFactory

Field Summary

Fields inherited from class com.yahoo.vespa.athenz.client.common.ClientBase

logger

Constructor Summary

Constructors

Constructor	Description
DefaultZmsClient(URI zmsUrl, AthenzIdentity identity, SSLContext sslContext, ErrorHandler errorHandler)
DefaultZmsClient(URI zmsUrl, ServiceIdentityProvider identityProvider, ErrorHandler errorHandler)

Method Summary

Modifier and Type	Method	Description
void	addPolicyRule(AthenzDomain athenzDomain, String athenzPolicy, String action, AthenzResourceName resourceName, AthenzRole athenzRole)
void	addRoleMember(AthenzRole role, AthenzIdentity member, Optional<String> reason)
void	approvePendingRoleMembership(AthenzRole athenzRole, AthenzUser athenzUser, Instant expiry, Optional<String> reason)
void	createOrUpdateService(AthenzService athenzService)
void	createPolicy(AthenzDomain athenzDomain, String athenzPolicy)
void	createProviderResourceGroup(AthenzDomain tenantDomain, AthenzIdentity providerService, String resourceGroup, Set<RoleAction> roleActions, OktaIdentityToken identityToken, OktaAccessToken accessToken)
void	createRole(AthenzRole role, Map<String,Object> attributes)
void	createTenancy(AthenzDomain tenantDomain, AthenzIdentity providerService, OktaIdentityToken identityToken, OktaAccessToken accessToken)
void	createTenantResourceGroup(AthenzDomain tenantDomain, AthenzIdentity provider, String resourceGroup, Set<RoleAction> roleActions)	For manual tenancy provisioning - only creates roles/policies on provider domain
boolean	deletePolicyRule(AthenzDomain athenzDomain, String athenzPolicy, String action, AthenzResourceName resourceName, AthenzRole athenzRole)
void	deleteProviderResourceGroup(AthenzDomain tenantDomain, AthenzIdentity providerService, String resourceGroup, OktaIdentityToken identityToken, OktaAccessToken accessToken)
void	deleteRole(AthenzRole role)
void	deleteRoleMember(AthenzRole role, AthenzIdentity member)
void	deleteService(AthenzService athenzService)
void	deleteTenancy(AthenzDomain tenantDomain, AthenzIdentity providerService, OktaIdentityToken identityToken, OktaAccessToken accessToken)
List<AthenzDomain>	getDomainList(String prefix)
boolean	getGroupMembership(AthenzGroup group, AthenzIdentity identity)
boolean	getMembership(AthenzRole role, AthenzIdentity identity)
Optional<AthenzPolicy>	getPolicy(AthenzDomain domain, String name)
Set<RoleAction>	getTenantResourceGroups(AthenzDomain tenantDomain, AthenzIdentity provider, String resourceGroup)
boolean	hasAccess(AthenzResourceName resource, String action, AthenzIdentity identity)
List<AthenzIdentity>	listMembers(AthenzRole athenzRole)
Map<AthenzUser,String>	listPendingRoleApprovals(AthenzRole athenzRole)
Set<String>	listPolicies(AthenzDomain domain)
Set<AthenzRole>	listRoles(AthenzDomain domain)
List<AthenzService>	listServices(AthenzDomain athenzDomain)

Methods inherited from class com.yahoo.vespa.athenz.client.common.ClientBase

close, execute, readEntity, toJsonStringEntity

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface com.yahoo.vespa.athenz.client.zms.ZmsClient

close

Constructor Detail

DefaultZmsClient

public DefaultZmsClient(URI zmsUrl,
                        AthenzIdentity identity,
                        SSLContext sslContext,
                        ErrorHandler errorHandler)

DefaultZmsClient

public DefaultZmsClient(URI zmsUrl,
                        ServiceIdentityProvider identityProvider,
                        ErrorHandler errorHandler)

Method Detail

createTenancy

public void createTenancy(AthenzDomain tenantDomain,
                          AthenzIdentity providerService,
                          OktaIdentityToken identityToken,
                          OktaAccessToken accessToken)

Specified by:

createTenancy in interface ZmsClient

deleteTenancy

public void deleteTenancy(AthenzDomain tenantDomain,
                          AthenzIdentity providerService,
                          OktaIdentityToken identityToken,
                          OktaAccessToken accessToken)

Specified by:

deleteTenancy in interface ZmsClient

createProviderResourceGroup

public void createProviderResourceGroup(AthenzDomain tenantDomain,
                                        AthenzIdentity providerService,
                                        String resourceGroup,
                                        Set<RoleAction> roleActions,
                                        OktaIdentityToken identityToken,
                                        OktaAccessToken accessToken)

Specified by:

createProviderResourceGroup in interface ZmsClient

deleteProviderResourceGroup

public void deleteProviderResourceGroup(AthenzDomain tenantDomain,
                                        AthenzIdentity providerService,
                                        String resourceGroup,
                                        OktaIdentityToken identityToken,
                                        OktaAccessToken accessToken)

Specified by:

deleteProviderResourceGroup in interface ZmsClient

createTenantResourceGroup

public void createTenantResourceGroup(AthenzDomain tenantDomain,
                                      AthenzIdentity provider,
                                      String resourceGroup,
                                      Set<RoleAction> roleActions)

Description copied from interface: ZmsClient

For manual tenancy provisioning - only creates roles/policies on provider domain

Specified by:

createTenantResourceGroup in interface ZmsClient

getTenantResourceGroups

public Set<RoleAction> getTenantResourceGroups(AthenzDomain tenantDomain,
                                               AthenzIdentity provider,
                                               String resourceGroup)

Specified by:

getTenantResourceGroups in interface ZmsClient

addRoleMember

public void addRoleMember(AthenzRole role,
                          AthenzIdentity member,
                          Optional<String> reason)

Specified by:

addRoleMember in interface ZmsClient

deleteRoleMember

public void deleteRoleMember(AthenzRole role,
                             AthenzIdentity member)

Specified by:

deleteRoleMember in interface ZmsClient

getMembership

public boolean getMembership(AthenzRole role,
                             AthenzIdentity identity)

Specified by:

getMembership in interface ZmsClient

getGroupMembership

public boolean getGroupMembership(AthenzGroup group,
                                  AthenzIdentity identity)

Specified by:

getGroupMembership in interface ZmsClient

getDomainList

public List<AthenzDomain> getDomainList(String prefix)

Specified by:

getDomainList in interface ZmsClient

hasAccess

public boolean hasAccess(AthenzResourceName resource,
                         String action,
                         AthenzIdentity identity)

Specified by:

hasAccess in interface ZmsClient

createPolicy

public void createPolicy(AthenzDomain athenzDomain,
                         String athenzPolicy)

Specified by:

createPolicy in interface ZmsClient

addPolicyRule

public void addPolicyRule(AthenzDomain athenzDomain,
                          String athenzPolicy,
                          String action,
                          AthenzResourceName resourceName,
                          AthenzRole athenzRole)

Specified by:

addPolicyRule in interface ZmsClient

deletePolicyRule

public boolean deletePolicyRule(AthenzDomain athenzDomain,
                                String athenzPolicy,
                                String action,
                                AthenzResourceName resourceName,
                                AthenzRole athenzRole)

Specified by:

deletePolicyRule in interface ZmsClient

getPolicy

public Optional<AthenzPolicy> getPolicy(AthenzDomain domain,
                                        String name)

Specified by:

getPolicy in interface ZmsClient

listPendingRoleApprovals

public Map<AthenzUser,String> listPendingRoleApprovals(AthenzRole athenzRole)

Specified by:

listPendingRoleApprovals in interface ZmsClient

approvePendingRoleMembership

public void approvePendingRoleMembership(AthenzRole athenzRole,
                                         AthenzUser athenzUser,
                                         Instant expiry,
                                         Optional<String> reason)

Specified by:

approvePendingRoleMembership in interface ZmsClient

listMembers

public List<AthenzIdentity> listMembers(AthenzRole athenzRole)

Specified by:

listMembers in interface ZmsClient

listServices

public List<AthenzService> listServices(AthenzDomain athenzDomain)

Specified by:

listServices in interface ZmsClient

createOrUpdateService

public void createOrUpdateService(AthenzService athenzService)

Specified by:

createOrUpdateService in interface ZmsClient

deleteService

public void deleteService(AthenzService athenzService)

Specified by:

deleteService in interface ZmsClient

createRole

public void createRole(AthenzRole role,
                       Map<String,Object> attributes)

Specified by:

createRole in interface ZmsClient

listRoles

public Set<AthenzRole> listRoles(AthenzDomain domain)

Specified by:

listRoles in interface ZmsClient

listPolicies

public Set<String> listPolicies(AthenzDomain domain)

Specified by:

listPolicies in interface ZmsClient

deleteRole

public void deleteRole(AthenzRole role)

Specified by:

deleteRole in interface ZmsClient