1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
|
// Copyright Yahoo. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
package com.yahoo.vespa.athenz.client.zms;
import com.yahoo.vespa.athenz.api.AthenzDomain;
import com.yahoo.vespa.athenz.api.AthenzDomainMeta;
import com.yahoo.vespa.athenz.api.AthenzGroup;
import com.yahoo.vespa.athenz.api.AthenzIdentity;
import com.yahoo.vespa.athenz.api.AthenzPolicy;
import com.yahoo.vespa.athenz.api.AthenzResourceName;
import com.yahoo.vespa.athenz.api.AthenzRole;
import com.yahoo.vespa.athenz.api.AthenzRoleInformation;
import com.yahoo.vespa.athenz.api.AthenzService;
import com.yahoo.vespa.athenz.api.OAuthCredentials;
import java.io.Closeable;
import java.security.PublicKey;
import java.time.Instant;
import java.util.List;
import java.util.Map;
import java.util.Optional;
import java.util.Set;
/**
* @author bjorncs
*/
public interface ZmsClient extends Closeable {
void createTenancy(AthenzDomain tenantDomain, AthenzIdentity providerService, OAuthCredentials oAuthCredentials);
void deleteTenancy(AthenzDomain tenantDomain, AthenzIdentity providerService, OAuthCredentials oAuthCredentials);
void createProviderResourceGroup(AthenzDomain tenantDomain, AthenzIdentity providerService, String resourceGroup,
Set<RoleAction> roleActions, OAuthCredentials oAuthCredentials);
void deleteProviderResourceGroup(AthenzDomain tenantDomain, AthenzIdentity providerService, String resourceGroup,
OAuthCredentials oAuthCredentials);
/** For manual tenancy provisioning - only creates roles/policies on provider domain */
void createTenantResourceGroup(AthenzDomain tenantDomain, AthenzIdentity provider, String resourceGroup,
Set<RoleAction> roleActions);
Set<RoleAction> getTenantResourceGroups(AthenzDomain tenantDomain, AthenzIdentity provider, String resourceGroup);
void addRoleMember(AthenzRole role, AthenzIdentity member, Optional<String> reason);
void deleteRoleMember(AthenzRole role, AthenzIdentity member);
boolean getMembership(AthenzRole role, AthenzIdentity identity);
boolean getGroupMembership(AthenzGroup group, AthenzIdentity identity);
List<AthenzDomain> getDomainList(String prefix);
List<AthenzDomain> getDomainListByAccount(String id);
AthenzDomainMeta getDomainMeta(AthenzDomain domain);
void updateDomain(AthenzDomain domain, String mainKey, Map<String, Object> attributes);
boolean hasAccess(AthenzResourceName resource, String action, AthenzIdentity identity);
void createPolicy(AthenzDomain athenzDomain, String athenzPolicy);
void addPolicyRule(AthenzDomain athenzDomain, String athenzPolicy, String action, AthenzResourceName resourceName, AthenzRole athenzRole);
boolean deletePolicyRule(AthenzDomain athenzDomain, String athenzPolicy, String action, AthenzResourceName resourceName, AthenzRole athenzRole);
Optional<AthenzPolicy> getPolicy(AthenzDomain domain, String name);
Map<AthenzIdentity, String> listPendingRoleApprovals(AthenzRole athenzRole);
void decidePendingRoleMembership(AthenzRole athenzRole, AthenzIdentity athenzIdentity, Instant expiry,
Optional<String> reason, Optional<OAuthCredentials> oAuthCredentials, boolean approve);
List<AthenzIdentity> listMembers(AthenzRole athenzRole);
List<AthenzService> listServices(AthenzDomain athenzDomain);
void createOrUpdateService(AthenzService athenzService);
void updateServicePublicKey(AthenzService athenzService, String publicKeyId, PublicKey publicKey);
void updateProviderEndpoint(AthenzService athenzService, String endpoint);
void deleteService(AthenzService athenzService);
void createRole(AthenzRole role, Map<String, Object> properties);
Set<AthenzRole> listRoles(AthenzDomain domain);
Set<String> listPolicies(AthenzDomain domain);
void deleteRole(AthenzRole athenzRole);
void createSubdomain(AthenzDomain parent, String name, Map<String, Object> attributes);
default void createSubdomain(AthenzDomain parent, String name) {
createSubdomain(parent, name, Map.of());
};
AthenzRoleInformation getFullRoleInformation(AthenzRole role);
QuotaUsage getQuotaUsage();
void deleteSubdomain(AthenzDomain parent, String name);
void deletePolicy(AthenzDomain domain, String athenzPolicy);
void close();
}
|
