strongdm 1.0.0 → 1.0.7
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/doc/LICENSE.html +45 -136
- data/doc/Object.html +623 -105
- data/doc/README_md.html +15 -7
- data/doc/SDM.html +16 -24
- data/doc/SDM/AKS.html +150 -52
- data/doc/SDM/AKSBasicAuth.html +130 -36
- data/doc/SDM/AKSServiceAccount.html +125 -32
- data/doc/SDM/AccountAttachment.html +77 -27
- data/doc/SDM/AccountAttachmentCreateOptions.html +62 -13
- data/doc/SDM/AccountAttachmentCreateResponse.html +75 -24
- data/doc/SDM/AccountAttachmentDeleteResponse.html +69 -19
- data/doc/SDM/AccountAttachmentGetResponse.html +75 -23
- data/doc/SDM/AccountAttachments.html +62 -61
- data/doc/SDM/AccountCreateResponse.html +80 -27
- data/doc/SDM/AccountDeleteResponse.html +69 -17
- data/doc/SDM/AccountGetResponse.html +74 -21
- data/doc/SDM/AccountGrant.html +89 -39
- data/doc/SDM/AccountGrantCreateResponse.html +75 -23
- data/doc/SDM/AccountGrantDeleteResponse.html +69 -18
- data/doc/SDM/AccountGrantGetResponse.html +75 -22
- data/doc/SDM/AccountGrants.html +63 -58
- data/doc/SDM/AccountUpdateResponse.html +74 -21
- data/doc/SDM/Accounts.html +74 -68
- data/doc/SDM/AlreadyExistsError.html +13 -10
- data/doc/SDM/AmazonEKS.html +163 -48
- data/doc/SDM/AmazonES.html +117 -40
- data/doc/SDM/Athena.html +117 -40
- data/doc/SDM/AuroraMysql.html +122 -44
- data/doc/SDM/AuroraPostgres.html +127 -48
- data/doc/SDM/AuthenticationError.html +13 -10
- data/doc/SDM/BadRequestError.html +13 -10
- data/doc/SDM/BigQuery.html +117 -40
- data/doc/SDM/Cassandra.html +122 -44
- data/doc/SDM/Citus.html +409 -0
- data/doc/SDM/Client.html +29 -48
- data/doc/SDM/Clustrix.html +122 -44
- data/doc/SDM/Cockroach.html +127 -48
- data/doc/SDM/CreateResponseMetadata.html +59 -9
- data/doc/SDM/DB2.html +391 -0
- data/doc/SDM/DeadlineExceededError.html +13 -10
- data/doc/SDM/DeleteResponseMetadata.html +60 -10
- data/doc/SDM/Druid.html +117 -40
- data/doc/SDM/DynamoDB.html +117 -40
- data/doc/SDM/Elastic.html +122 -44
- data/doc/SDM/ElasticacheRedis.html +117 -40
- data/doc/SDM/Gateway.html +108 -39
- data/doc/SDM/GetResponseMetadata.html +60 -10
- data/doc/SDM/GoogleGKE.html +135 -40
- data/doc/SDM/Greenplum.html +127 -48
- data/doc/SDM/HTTPAuth.html +122 -44
- data/doc/SDM/HTTPBasicAuth.html +127 -48
- data/doc/SDM/HTTPNoAuth.html +117 -40
- data/doc/SDM/InternalError.html +13 -10
- data/doc/SDM/Kubernetes.html +150 -52
- data/doc/SDM/KubernetesBasicAuth.html +130 -36
- data/doc/SDM/KubernetesServiceAccount.html +125 -32
- data/doc/SDM/Maria.html +122 -44
- data/doc/SDM/Memcached.html +107 -32
- data/doc/SDM/Memsql.html +122 -44
- data/doc/SDM/MongoHost.html +127 -48
- data/doc/SDM/MongoLegacyHost.html +132 -52
- data/doc/SDM/MongoLegacyReplicaset.html +137 -56
- data/doc/SDM/MongoReplicaSet.html +137 -56
- data/doc/SDM/Mysql.html +122 -44
- data/doc/SDM/NodeCreateResponse.html +80 -27
- data/doc/SDM/NodeDeleteResponse.html +69 -17
- data/doc/SDM/NodeGetResponse.html +74 -21
- data/doc/SDM/NodeUpdateResponse.html +74 -21
- data/doc/SDM/Nodes.html +75 -70
- data/doc/SDM/NotFoundError.html +13 -10
- data/doc/SDM/Oracle.html +127 -48
- data/doc/SDM/PermissionError.html +13 -10
- data/doc/SDM/Plumbing.html +4177 -3576
- data/doc/SDM/Postgres.html +127 -48
- data/doc/SDM/Presto.html +127 -48
- data/doc/SDM/RDP.html +117 -40
- data/doc/SDM/RPCError.html +12 -8
- data/doc/SDM/RateLimitError.html +13 -10
- data/doc/SDM/RateLimitMetadata.html +81 -29
- data/doc/SDM/Redis.html +112 -36
- data/doc/SDM/Redshift.html +127 -48
- data/doc/SDM/Relay.html +96 -27
- data/doc/SDM/ResourceCreateResponse.html +74 -21
- data/doc/SDM/ResourceDeleteResponse.html +69 -17
- data/doc/SDM/ResourceGetResponse.html +74 -21
- data/doc/SDM/ResourceUpdateResponse.html +74 -22
- data/doc/SDM/Resources.html +71 -63
- data/doc/SDM/Role.html +96 -27
- data/doc/SDM/RoleAttachment.html +77 -26
- data/doc/SDM/RoleAttachmentCreateResponse.html +75 -24
- data/doc/SDM/RoleAttachmentDeleteResponse.html +69 -19
- data/doc/SDM/RoleAttachmentGetResponse.html +75 -22
- data/doc/SDM/RoleAttachments.html +63 -60
- data/doc/SDM/RoleCreateResponse.html +75 -23
- data/doc/SDM/RoleDeleteResponse.html +69 -17
- data/doc/SDM/RoleGetResponse.html +75 -22
- data/doc/SDM/RoleGrant.html +77 -24
- data/doc/SDM/RoleGrantCreateResponse.html +75 -23
- data/doc/SDM/RoleGrantDeleteResponse.html +69 -18
- data/doc/SDM/RoleGrantGetResponse.html +75 -22
- data/doc/SDM/RoleGrants.html +63 -60
- data/doc/SDM/RoleUpdateResponse.html +75 -23
- data/doc/SDM/Roles.html +76 -74
- data/doc/SDM/SQLServer.html +132 -52
- data/doc/SDM/SSH.html +135 -40
- data/doc/SDM/SSHCert.html +373 -0
- data/doc/SDM/Service.html +95 -25
- data/doc/SDM/Snowflake.html +122 -44
- data/doc/SDM/Sybase.html +117 -40
- data/doc/SDM/SybaseIQ.html +117 -40
- data/doc/SDM/Teradata.html +117 -40
- data/doc/SDM/UpdateResponseMetadata.html +60 -10
- data/doc/SDM/User.html +104 -31
- data/doc/V1.html +35 -11
- data/doc/V1/AccountAttachments.html +10 -6
- data/doc/V1/AccountAttachments/Service.html +11 -8
- data/doc/V1/AccountGrants.html +10 -6
- data/doc/V1/AccountGrants/Service.html +11 -9
- data/doc/V1/Accounts.html +10 -6
- data/doc/V1/Accounts/Service.html +12 -10
- data/doc/V1/Nodes.html +10 -6
- data/doc/V1/Nodes/Service.html +13 -13
- data/doc/V1/Resources.html +10 -6
- data/doc/V1/Resources/Service.html +10 -6
- data/doc/V1/RoleAttachments.html +10 -6
- data/doc/V1/RoleAttachments/Service.html +11 -11
- data/doc/V1/RoleGrants.html +10 -6
- data/doc/V1/RoleGrants/Service.html +11 -11
- data/doc/V1/Roles.html +10 -6
- data/doc/V1/Roles/Service.html +11 -12
- data/doc/V1/Tags.html +113 -0
- data/doc/created.rid +45 -37
- data/doc/css/fonts.css +6 -6
- data/doc/css/rdoc.css +22 -1
- data/doc/examples/Gemfile.html +14 -4
- data/doc/examples/Gemfile_lock.html +14 -4
- data/doc/examples/README_md.html +14 -4
- data/doc/examples/okta-sync/Gemfile.html +105 -0
- data/doc/examples/okta-sync/Gemfile_lock.html +146 -0
- data/doc/index.html +23 -10
- data/doc/js/darkfish.js +23 -100
- data/doc/js/navigation.js +4 -41
- data/doc/js/navigation.js.gz +0 -0
- data/doc/js/search.js +32 -31
- data/doc/js/search_index.js +1 -1
- data/doc/js/search_index.js.gz +0 -0
- data/doc/js/searcher.js +7 -6
- data/doc/js/searcher.js.gz +0 -0
- data/doc/lib/version.html +16 -6
- data/doc/strongdm_gemspec.html +15 -5
- data/doc/table_of_contents.html +1587 -771
- data/examples/Gemfile +2 -2
- data/examples/ldap-sync/ldapSync.rb +290 -0
- data/examples/listUsers.rb +8 -8
- data/examples/okta-sync/Gemfile +4 -0
- data/examples/okta-sync/Gemfile.lock +38 -0
- data/examples/okta-sync/matchers.yml +11 -0
- data/examples/okta-sync/oktaSync.rb +173 -0
- data/examples/panicButton.rb +103 -119
- data/lib/errors/errors.rb +55 -53
- data/lib/grpc/account_attachments_pb.rb +9 -14
- data/lib/grpc/account_attachments_services_pb.rb +7 -8
- data/lib/grpc/account_grants_pb.rb +10 -10
- data/lib/grpc/account_grants_services_pb.rb +8 -9
- data/lib/grpc/accounts_pb.rb +12 -9
- data/lib/grpc/accounts_services_pb.rb +7 -8
- data/lib/grpc/drivers_pb.rb +104 -7
- data/lib/grpc/nodes_pb.rb +12 -9
- data/lib/grpc/nodes_services_pb.rb +7 -8
- data/lib/grpc/options_pb.rb +16 -5
- data/lib/grpc/plumbing.rb +4367 -4084
- data/lib/grpc/protoc-gen-swagger/options/annotations_pb.rb +4 -4
- data/lib/grpc/resources_pb.rb +9 -9
- data/lib/grpc/resources_services_pb.rb +7 -8
- data/lib/grpc/role_attachments_pb.rb +9 -9
- data/lib/grpc/role_attachments_services_pb.rb +7 -8
- data/lib/grpc/role_grants_pb.rb +9 -9
- data/lib/grpc/role_grants_services_pb.rb +7 -8
- data/lib/grpc/roles_pb.rb +11 -9
- data/lib/grpc/roles_services_pb.rb +7 -8
- data/lib/grpc/spec_pb.rb +7 -8
- data/lib/grpc/tags_pb.rb +36 -0
- data/lib/models/porcelain.rb +4966 -4017
- data/lib/strongdm.rb +94 -95
- data/lib/svc.rb +1200 -1224
- data/lib/version +16 -2
- data/lib/version.rb +6 -6
- data/strongdm.gemspec +10 -10
- metadata +27 -15
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 86cc4d6b9580c2ea725286eaf30a140a051f8b035f50a3728b16dd90eb777ff0
|
|
4
|
+
data.tar.gz: 06c32258d35b6952710addf5cfd4566f99b632d1f989e85264cbffa5fcfa63d2
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 98e2c20ee4168b3948210c0d0313ba20f25e4055e81210aac9cda3c2974669c514dd2d6830b581e62e2f2d826802409ef316cdd94f9bd6bb8cd537a7db72f281
|
|
7
|
+
data.tar.gz: bc46ed7ffed5c9ea0b993631f62c52e1d1577a3c52b8b28455dbef97a9d7ac2d8e5e4c492397852dee580d5c3b9e3388cc2a053a7308b66e77fcca34bb25ab61
|
data/doc/LICENSE.html
CHANGED
|
@@ -8,16 +8,21 @@
|
|
|
8
8
|
|
|
9
9
|
<script type="text/javascript">
|
|
10
10
|
var rdoc_rel_prefix = "./";
|
|
11
|
+
var index_rel_prefix = "./";
|
|
11
12
|
</script>
|
|
12
13
|
|
|
13
|
-
<script src="./js/
|
|
14
|
-
<script src="./js/
|
|
14
|
+
<script src="./js/navigation.js" defer></script>
|
|
15
|
+
<script src="./js/search.js" defer></script>
|
|
16
|
+
<script src="./js/search_index.js" defer></script>
|
|
17
|
+
<script src="./js/searcher.js" defer></script>
|
|
18
|
+
<script src="./js/darkfish.js" defer></script>
|
|
15
19
|
|
|
16
20
|
<link href="./css/fonts.css" rel="stylesheet">
|
|
17
21
|
<link href="./css/rdoc.css" rel="stylesheet">
|
|
18
22
|
|
|
19
23
|
|
|
20
24
|
|
|
25
|
+
|
|
21
26
|
<body id="top" role="document" class="file">
|
|
22
27
|
<nav role="navigation">
|
|
23
28
|
<div id="project-navigation">
|
|
@@ -68,6 +73,10 @@
|
|
|
68
73
|
|
|
69
74
|
<li><a href="./examples/README_md.html">README</a>
|
|
70
75
|
|
|
76
|
+
<li><a href="./examples/okta-sync/Gemfile.html">Gemfile</a>
|
|
77
|
+
|
|
78
|
+
<li><a href="./examples/okta-sync/Gemfile_lock.html">Gemfile.lock</a>
|
|
79
|
+
|
|
71
80
|
<li><a href="./lib/version.html">version</a>
|
|
72
81
|
|
|
73
82
|
<li><a href="./strongdm_gemspec.html">strongdm.gemspec</a>
|
|
@@ -88,88 +97,31 @@ http://www.apache.org/licenses/
|
|
|
88
97
|
<ol><li>
|
|
89
98
|
<p>Definitions.</p>
|
|
90
99
|
|
|
91
|
-
<p>“License” shall mean the terms and conditions for use, reproduction, and
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
<p>“
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
<p>“
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
and configuration files.</p>
|
|
111
|
-
|
|
112
|
-
<p>“Object” form shall mean any form resulting from mechanical transformation
|
|
113
|
-
or translation of a Source form, including but not limited to compiled
|
|
114
|
-
object code, generated documentation, and conversions to other media types.</p>
|
|
115
|
-
|
|
116
|
-
<p>“Work” shall mean the work of authorship, whether in Source or <a
|
|
117
|
-
href="Object.html">Object</a> form, made available under the License, as
|
|
118
|
-
indicated by a copyright notice that is included in or attached to the work
|
|
119
|
-
(an example is provided in the Appendix below).</p>
|
|
120
|
-
|
|
121
|
-
<p>“Derivative Works” shall mean any work, whether in Source or <a
|
|
122
|
-
href="Object.html">Object</a> form, that is based on (or derived from) the
|
|
123
|
-
Work and for which the editorial revisions, annotations, elaborations, or
|
|
124
|
-
other modifications represent, as a whole, an original work of authorship.
|
|
125
|
-
For the purposes of this License, Derivative Works shall not include works
|
|
126
|
-
that remain separable from, or merely link (or bind by name) to the
|
|
127
|
-
interfaces of, the Work and Derivative Works thereof.</p>
|
|
128
|
-
|
|
129
|
-
<p>“Contribution” shall mean any work of authorship, including the original
|
|
130
|
-
version of the Work and any modifications or additions to that Work or
|
|
131
|
-
Derivative Works thereof, that is intentionally submitted to Licensor for
|
|
132
|
-
inclusion in the Work by the copyright owner or by an individual or Legal
|
|
133
|
-
Entity authorized to submit on behalf of the copyright owner. For the
|
|
134
|
-
purposes of this definition, “submitted” means any form of electronic,
|
|
135
|
-
verbal, or written communication sent to the Licensor or its
|
|
136
|
-
representatives, including but not limited to communication on electronic
|
|
137
|
-
mailing lists, source code control systems, and issue tracking systems that
|
|
138
|
-
are managed by, or on behalf of, the Licensor for the purpose of discussing
|
|
139
|
-
and improving the Work, but excluding communication that is conspicuously
|
|
140
|
-
marked or otherwise designated in writing by the copyright owner as “Not a
|
|
141
|
-
Contribution.”</p>
|
|
142
|
-
|
|
143
|
-
<p>“Contributor” shall mean Licensor and any individual or Legal Entity on
|
|
144
|
-
behalf of whom a Contribution has been received by Licensor and
|
|
145
|
-
subsequently incorporated within the Work.</p>
|
|
100
|
+
<p>“License” shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document.</p>
|
|
101
|
+
|
|
102
|
+
<p>“Licensor” shall mean the copyright owner or entity authorized by the copyright owner that is granting the License.</p>
|
|
103
|
+
|
|
104
|
+
<p>“Legal Entity” shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, “control” means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity.</p>
|
|
105
|
+
|
|
106
|
+
<p>“You” (or “Your”) shall mean an individual or Legal Entity exercising permissions granted by this License.</p>
|
|
107
|
+
|
|
108
|
+
<p>“Source” form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files.</p>
|
|
109
|
+
|
|
110
|
+
<p>“Object” form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types.</p>
|
|
111
|
+
|
|
112
|
+
<p>“Work” shall mean the work of authorship, whether in Source or <a href="Object.html"><code>Object</code></a> form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below).</p>
|
|
113
|
+
|
|
114
|
+
<p>“Derivative Works” shall mean any work, whether in Source or <a href="Object.html"><code>Object</code></a> form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof.</p>
|
|
115
|
+
|
|
116
|
+
<p>“Contribution” shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, “submitted” means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as “Not a Contribution.”</p>
|
|
117
|
+
|
|
118
|
+
<p>“Contributor” shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work.</p>
|
|
146
119
|
</li><li>
|
|
147
|
-
<p>Grant of Copyright License. Subject to the terms and conditions of this
|
|
148
|
-
License, each Contributor hereby grants to You a perpetual, worldwide,
|
|
149
|
-
non-exclusive, no-charge, royalty-free, irrevocable copyright license to
|
|
150
|
-
reproduce, prepare Derivative Works of, publicly display, publicly perform,
|
|
151
|
-
sublicense, and distribute the Work and such Derivative Works in Source or
|
|
152
|
-
<a href="Object.html">Object</a> form.</p>
|
|
120
|
+
<p>Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or <a href="Object.html"><code>Object</code></a> form.</p>
|
|
153
121
|
</li><li>
|
|
154
|
-
<p>Grant of Patent License. Subject to the terms and conditions of this
|
|
155
|
-
License, each Contributor hereby grants to You a perpetual, worldwide,
|
|
156
|
-
non-exclusive, no-charge, royalty-free, irrevocable (except as stated in
|
|
157
|
-
this section) patent license to make, have made, use, offer to sell, sell,
|
|
158
|
-
import, and otherwise transfer the Work, where such license applies only to
|
|
159
|
-
those patent claims licensable by such Contributor that are necessarily
|
|
160
|
-
infringed by their Contribution(s) alone or by combination of their
|
|
161
|
-
Contribution(s) with the Work to which such Contribution(s) was submitted.
|
|
162
|
-
If You institute patent litigation against any entity (including a
|
|
163
|
-
cross-claim or counterclaim in a lawsuit) alleging that the Work or a
|
|
164
|
-
Contribution incorporated within the Work constitutes direct or
|
|
165
|
-
contributory patent infringement, then any patent licenses granted to You
|
|
166
|
-
under this License for that Work shall terminate as of the date such
|
|
167
|
-
litigation is filed.</p>
|
|
122
|
+
<p>Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed.</p>
|
|
168
123
|
</li><li>
|
|
169
|
-
<p>Redistribution. You may reproduce and distribute copies of the Work or
|
|
170
|
-
Derivative Works thereof in any medium, with or without modifications, and
|
|
171
|
-
in Source or <a href="Object.html">Object</a> form, provided that You meet
|
|
172
|
-
the following conditions:</p>
|
|
124
|
+
<p>Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or <a href="Object.html"><code>Object</code></a> form, provided that You meet the following conditions:</p>
|
|
173
125
|
|
|
174
126
|
<p>(a) You must give any other recipients of the Work or</p>
|
|
175
127
|
|
|
@@ -204,55 +156,17 @@ or as an addendum to the NOTICE text from the Work, provided
|
|
|
204
156
|
that such additional attribution notices cannot be construed
|
|
205
157
|
as modifying the License.</pre>
|
|
206
158
|
|
|
207
|
-
<p>You may add Your own copyright statement to Your modifications and may
|
|
208
|
-
provide additional or different license terms and conditions for use,
|
|
209
|
-
reproduction, or distribution of Your modifications, or for any such
|
|
210
|
-
Derivative Works as a whole, provided Your use, reproduction, and
|
|
211
|
-
distribution of the Work otherwise complies with the conditions stated in
|
|
212
|
-
this License.</p>
|
|
159
|
+
<p>You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License.</p>
|
|
213
160
|
</li><li>
|
|
214
|
-
<p>Submission of Contributions. Unless You explicitly state otherwise, any
|
|
215
|
-
Contribution intentionally submitted for inclusion in the Work by You to
|
|
216
|
-
the Licensor shall be under the terms and conditions of this License,
|
|
217
|
-
without any additional terms or conditions. Notwithstanding the above,
|
|
218
|
-
nothing herein shall supersede or modify the terms of any separate license
|
|
219
|
-
agreement you may have executed with Licensor regarding such Contributions.</p>
|
|
161
|
+
<p>Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions.</p>
|
|
220
162
|
</li><li>
|
|
221
|
-
<p>Trademarks. This License does not grant permission to use the trade names,
|
|
222
|
-
trademarks, service marks, or product names of the Licensor, except as
|
|
223
|
-
required for reasonable and customary use in describing the origin of the
|
|
224
|
-
Work and reproducing the content of the NOTICE file.</p>
|
|
163
|
+
<p>Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file.</p>
|
|
225
164
|
</li><li>
|
|
226
|
-
<p>Disclaimer of Warranty. Unless required by applicable law or agreed to in
|
|
227
|
-
writing, Licensor provides the Work (and each Contributor provides its
|
|
228
|
-
Contributions) on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
229
|
-
KIND, either express or implied, including, without limitation, any
|
|
230
|
-
warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or
|
|
231
|
-
FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for
|
|
232
|
-
determining the appropriateness of using or redistributing the Work and
|
|
233
|
-
assume any risks associated with Your exercise of permissions under this
|
|
234
|
-
License.</p>
|
|
165
|
+
<p>Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License.</p>
|
|
235
166
|
</li><li>
|
|
236
|
-
<p>Limitation of Liability. In no event and under no legal theory, whether in
|
|
237
|
-
tort (including negligence), contract, or otherwise, unless required by
|
|
238
|
-
applicable law (such as deliberate and grossly negligent acts) or agreed to
|
|
239
|
-
in writing, shall any Contributor be liable to You for damages, including
|
|
240
|
-
any direct, indirect, special, incidental, or consequential damages of any
|
|
241
|
-
character arising as a result of this License or out of the use or
|
|
242
|
-
inability to use the Work (including but not limited to damages for loss of
|
|
243
|
-
goodwill, work stoppage, computer failure or malfunction, or any and all
|
|
244
|
-
other commercial damages or losses), even if such Contributor has been
|
|
245
|
-
advised of the possibility of such damages.</p>
|
|
167
|
+
<p>Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages.</p>
|
|
246
168
|
</li><li>
|
|
247
|
-
<p>Accepting Warranty or Additional Liability. While redistributing the Work
|
|
248
|
-
or Derivative Works thereof, You may choose to offer, and charge a fee for,
|
|
249
|
-
acceptance of support, warranty, indemnity, or other liability obligations
|
|
250
|
-
and/or rights consistent with this License. However, in accepting such
|
|
251
|
-
obligations, You may act only on Your own behalf and on Your sole
|
|
252
|
-
responsibility, not on behalf of any other Contributor, and only if You
|
|
253
|
-
agree to indemnify, defend, and hold each Contributor harmless for any
|
|
254
|
-
liability incurred by, or claims asserted against, such Contributor by
|
|
255
|
-
reason of your accepting any such warranty or additional liability.</p>
|
|
169
|
+
<p>Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability.</p>
|
|
256
170
|
</li></ol>
|
|
257
171
|
|
|
258
172
|
<p>END OF TERMS AND CONDITIONS</p>
|
|
@@ -270,25 +184,20 @@ identification within third-party archives.
|
|
|
270
184
|
|
|
271
185
|
<p>Copyright 2020 StrongDM Inc</p>
|
|
272
186
|
|
|
273
|
-
<p>Licensed under the Apache License, Version 2.0 (the “License”); you may not
|
|
274
|
-
use this file except in compliance with the License. You may obtain a copy
|
|
275
|
-
of the License at</p>
|
|
187
|
+
<p>Licensed under the Apache License, Version 2.0 (the “License”); you may not use this file except in compliance with the License. You may obtain a copy of the License at</p>
|
|
276
188
|
|
|
277
|
-
<pre class="ruby"><span class="ruby-identifier">http</span
|
|
189
|
+
<pre class="ruby"><span class="ruby-identifier">http</span><span class="ruby-value">:/</span><span class="ruby-operator">/</span><span class="ruby-identifier">www</span>.<span class="ruby-identifier">apache</span>.<span class="ruby-identifier">org</span><span class="ruby-operator">/</span><span class="ruby-identifier">licenses</span><span class="ruby-operator">/</span><span class="ruby-constant">LICENSE</span><span class="ruby-value">-2.0</span>
|
|
278
190
|
</pre>
|
|
279
191
|
|
|
280
|
-
<p>Unless required by applicable law or agreed to in writing, software
|
|
281
|
-
|
|
282
|
-
WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
283
|
-
License for the specific language governing permissions and limitations
|
|
284
|
-
under the License.</p>
|
|
192
|
+
<p>Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.</p>
|
|
193
|
+
|
|
285
194
|
</main>
|
|
286
195
|
|
|
287
196
|
|
|
288
197
|
|
|
289
198
|
<footer id="validator-badges" role="contentinfo">
|
|
290
|
-
<p><a href="
|
|
291
|
-
<p>Generated by <a href="
|
|
199
|
+
<p><a href="https://validator.w3.org/check/referer">Validate</a>
|
|
200
|
+
<p>Generated by <a href="https://ruby.github.io/rdoc/">RDoc</a> 6.1.2.
|
|
292
201
|
<p>Based on <a href="http://deveiate.org/projects/Darkfish-RDoc/">Darkfish</a> by <a href="http://deveiate.org">Michael Granger</a>.
|
|
293
202
|
</footer>
|
|
294
203
|
|
data/doc/Object.html
CHANGED
|
@@ -8,16 +8,21 @@
|
|
|
8
8
|
|
|
9
9
|
<script type="text/javascript">
|
|
10
10
|
var rdoc_rel_prefix = "./";
|
|
11
|
+
var index_rel_prefix = "./";
|
|
11
12
|
</script>
|
|
12
13
|
|
|
13
|
-
<script src="./js/
|
|
14
|
-
<script src="./js/
|
|
14
|
+
<script src="./js/navigation.js" defer></script>
|
|
15
|
+
<script src="./js/search.js" defer></script>
|
|
16
|
+
<script src="./js/search_index.js" defer></script>
|
|
17
|
+
<script src="./js/searcher.js" defer></script>
|
|
18
|
+
<script src="./js/darkfish.js" defer></script>
|
|
15
19
|
|
|
16
20
|
<link href="./css/fonts.css" rel="stylesheet">
|
|
17
21
|
<link href="./css/rdoc.css" rel="stylesheet">
|
|
18
22
|
|
|
19
23
|
|
|
20
24
|
|
|
25
|
+
|
|
21
26
|
<body id="top" role="document" class="class">
|
|
22
27
|
<nav role="navigation">
|
|
23
28
|
<div id="project-navigation">
|
|
@@ -70,8 +75,14 @@
|
|
|
70
75
|
|
|
71
76
|
<ul class="link-list" role="directory">
|
|
72
77
|
|
|
78
|
+
<li ><a href="#method-i-first">#first</a>
|
|
79
|
+
|
|
80
|
+
<li ><a href="#method-i-ldap_sync">#ldap_sync</a>
|
|
81
|
+
|
|
73
82
|
<li ><a href="#method-i-main">#main</a>
|
|
74
83
|
|
|
84
|
+
<li ><a href="#method-i-okta_sync">#okta_sync</a>
|
|
85
|
+
|
|
75
86
|
</ul>
|
|
76
87
|
</div>
|
|
77
88
|
|
|
@@ -88,8 +99,6 @@
|
|
|
88
99
|
</section>
|
|
89
100
|
|
|
90
101
|
|
|
91
|
-
|
|
92
|
-
|
|
93
102
|
<section id="5Buntitled-5D" class="documentation-section">
|
|
94
103
|
|
|
95
104
|
|
|
@@ -117,6 +126,55 @@
|
|
|
117
126
|
<dd>
|
|
118
127
|
|
|
119
128
|
|
|
129
|
+
<dt id="LDAP_BIND_DN">LDAP_BIND_DN
|
|
130
|
+
|
|
131
|
+
<dd>
|
|
132
|
+
|
|
133
|
+
|
|
134
|
+
<dt id="LDAP_HOST">LDAP_HOST
|
|
135
|
+
|
|
136
|
+
<dd>
|
|
137
|
+
|
|
138
|
+
|
|
139
|
+
<dt id="LDAP_PASSWORD">LDAP_PASSWORD
|
|
140
|
+
|
|
141
|
+
<dd>
|
|
142
|
+
|
|
143
|
+
|
|
144
|
+
<dt id="OKTA_CLIENT_ORGURL">OKTA_CLIENT_ORGURL
|
|
145
|
+
|
|
146
|
+
<dd>
|
|
147
|
+
|
|
148
|
+
|
|
149
|
+
<dt id="OKTA_CLIENT_TOKEN">OKTA_CLIENT_TOKEN
|
|
150
|
+
|
|
151
|
+
<dd>
|
|
152
|
+
|
|
153
|
+
|
|
154
|
+
<dt id="SDM_API_ACCESS_KEY">SDM_API_ACCESS_KEY
|
|
155
|
+
|
|
156
|
+
<dd><p>organizationalUnits:</p>
|
|
157
|
+
|
|
158
|
+
<pre>- dn: OU=Other-OU,DC=j42,DC=xyz
|
|
159
|
+
role: Other-OU
|
|
160
|
+
resources:
|
|
161
|
+
- name:*Other-OU*
|
|
162
|
+
- name:*Multi*
|
|
163
|
+
- dn: OU=admins,DC=j42,DC=xyz
|
|
164
|
+
role: admins
|
|
165
|
+
resources:
|
|
166
|
+
- name:*admins*
|
|
167
|
+
- dn: OU=People,DC=j42,DC=xyz
|
|
168
|
+
role: People
|
|
169
|
+
resources:
|
|
170
|
+
- name:*People*</pre>
|
|
171
|
+
|
|
172
|
+
|
|
173
|
+
<dt id="SDM_API_SECRET_KEY">SDM_API_SECRET_KEY
|
|
174
|
+
|
|
175
|
+
<dd>
|
|
176
|
+
|
|
177
|
+
|
|
120
178
|
</dl>
|
|
121
179
|
</section>
|
|
122
180
|
|
|
@@ -130,10 +188,49 @@
|
|
|
130
188
|
</header>
|
|
131
189
|
|
|
132
190
|
|
|
133
|
-
<div id="method-i-
|
|
191
|
+
<div id="method-i-first" class="method-detail ">
|
|
134
192
|
|
|
135
193
|
<div class="method-heading">
|
|
136
|
-
<span class="method-name">
|
|
194
|
+
<span class="method-name">first</span><span
|
|
195
|
+
class="method-args">(attrib)</span>
|
|
196
|
+
|
|
197
|
+
<span class="method-click-advice">click to toggle source</span>
|
|
198
|
+
|
|
199
|
+
</div>
|
|
200
|
+
|
|
201
|
+
|
|
202
|
+
<div class="method-description">
|
|
203
|
+
|
|
204
|
+
<p>gets the first item in a list or generator</p>
|
|
205
|
+
|
|
206
|
+
|
|
207
|
+
|
|
208
|
+
|
|
209
|
+
<div class="method-source-code" id="first-source">
|
|
210
|
+
<pre><span class="ruby-comment"># File examples/ldap-sync/ldapSync.rb, line 58</span>
|
|
211
|
+
<span class="ruby-keyword">def</span> <span class="ruby-identifier ruby-title">first</span>(<span class="ruby-identifier">attrib</span>)
|
|
212
|
+
<span class="ruby-identifier">result</span> = <span class="ruby-keyword">nil</span>
|
|
213
|
+
<span class="ruby-identifier">attrib</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">item</span><span class="ruby-operator">|</span>
|
|
214
|
+
<span class="ruby-keyword">if</span> <span class="ruby-identifier">result</span> <span class="ruby-operator">==</span> <span class="ruby-keyword">nil</span>
|
|
215
|
+
<span class="ruby-identifier">result</span> = <span class="ruby-identifier">item</span>
|
|
216
|
+
<span class="ruby-keyword">end</span>
|
|
217
|
+
<span class="ruby-keyword">end</span>
|
|
218
|
+
<span class="ruby-identifier">result</span>
|
|
219
|
+
<span class="ruby-keyword">end</span></pre>
|
|
220
|
+
</div>
|
|
221
|
+
|
|
222
|
+
</div>
|
|
223
|
+
|
|
224
|
+
|
|
225
|
+
|
|
226
|
+
|
|
227
|
+
</div>
|
|
228
|
+
|
|
229
|
+
|
|
230
|
+
<div id="method-i-ldap_sync" class="method-detail ">
|
|
231
|
+
|
|
232
|
+
<div class="method-heading">
|
|
233
|
+
<span class="method-name">ldap_sync</span><span
|
|
137
234
|
class="method-args">()</span>
|
|
138
235
|
|
|
139
236
|
<span class="method-click-advice">click to toggle source</span>
|
|
@@ -143,128 +240,548 @@
|
|
|
143
240
|
|
|
144
241
|
<div class="method-description">
|
|
145
242
|
|
|
146
|
-
|
|
147
|
-
case of a critical break in or something usage: ruby panicButton.rb
|
|
148
|
-
adminuser@email.com to revert back to pre-panic state: ruby panicButton.rb
|
|
149
|
-
revert</p>
|
|
243
|
+
|
|
150
244
|
|
|
151
245
|
|
|
152
246
|
|
|
153
247
|
|
|
154
|
-
<div class="method-source-code" id="
|
|
155
|
-
<pre><span class="ruby-comment"># File examples/
|
|
156
|
-
<span class="ruby-keyword">def</span> <span class="ruby-identifier">
|
|
157
|
-
|
|
158
|
-
<span class="ruby-identifier">
|
|
159
|
-
<span class="ruby-
|
|
160
|
-
|
|
161
|
-
|
|
248
|
+
<div class="method-source-code" id="ldap_sync-source">
|
|
249
|
+
<pre><span class="ruby-comment"># File examples/ldap-sync/ldapSync.rb, line 68</span>
|
|
250
|
+
<span class="ruby-keyword">def</span> <span class="ruby-identifier ruby-title">ldap_sync</span>
|
|
251
|
+
<span class="ruby-keyword">if</span> <span class="ruby-constant">SDM_API_ACCESS_KEY</span> <span class="ruby-operator">==</span> <span class="ruby-string">''</span> <span class="ruby-operator">||</span> <span class="ruby-constant">SDM_API_SECRET_KEY</span> <span class="ruby-operator">==</span> <span class="ruby-string">''</span> <span class="ruby-operator">||</span> <span class="ruby-constant">LDAP_BIND_DN</span> <span class="ruby-operator">==</span> <span class="ruby-string">''</span>
|
|
252
|
+
<span class="ruby-identifier">puts</span> <span class="ruby-string">'SDM_API_ACCESS_KEY, SDM_API_SECRET_KEY, and LDAP_BIND_DN must be set'</span>
|
|
253
|
+
<span class="ruby-identifier">exit</span> <span class="ruby-value">1</span>
|
|
254
|
+
<span class="ruby-keyword">end</span>
|
|
255
|
+
|
|
256
|
+
<span class="ruby-identifier">plan</span> = <span class="ruby-keyword">false</span>
|
|
257
|
+
<span class="ruby-identifier">verbose</span> = <span class="ruby-keyword">false</span>
|
|
258
|
+
<span class="ruby-identifier">configPath</span> = <span class="ruby-string">'config.yml'</span>
|
|
259
|
+
<span class="ruby-constant">OptionParser</span>.<span class="ruby-identifier">new</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">opts</span><span class="ruby-operator">|</span>
|
|
260
|
+
<span class="ruby-identifier">opts</span>.<span class="ruby-identifier">banner</span> = <span class="ruby-string">"Usage ldapSync.rb [options]"</span>
|
|
261
|
+
<span class="ruby-identifier">opts</span>.<span class="ruby-identifier">on</span>(<span class="ruby-string">"-p"</span>, <span class="ruby-string">"--plan"</span>, <span class="ruby-string">"calculate changes but do not apply them"</span>) <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">p</span><span class="ruby-operator">|</span>
|
|
262
|
+
<span class="ruby-identifier">plan</span> = <span class="ruby-identifier">p</span>
|
|
263
|
+
<span class="ruby-keyword">end</span>
|
|
264
|
+
<span class="ruby-identifier">opts</span>.<span class="ruby-identifier">on</span>(<span class="ruby-string">"-v"</span>, <span class="ruby-string">"--verbose"</span>, <span class="ruby-string">"print detailed report"</span>) <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">v</span><span class="ruby-operator">|</span>
|
|
265
|
+
<span class="ruby-identifier">verbose</span> = <span class="ruby-identifier">v</span>
|
|
266
|
+
<span class="ruby-keyword">end</span>
|
|
267
|
+
<span class="ruby-identifier">opts</span>.<span class="ruby-identifier">on</span>(<span class="ruby-string">"-c"</span>, <span class="ruby-string">"--config FILE"</span>, <span class="ruby-string">"specify path to config YAML file (default: 'config.yml')"</span>) <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">v</span><span class="ruby-operator">|</span>
|
|
268
|
+
<span class="ruby-identifier">configPath</span> = <span class="ruby-identifier">v</span>
|
|
269
|
+
<span class="ruby-keyword">end</span>
|
|
270
|
+
<span class="ruby-keyword">end</span>.<span class="ruby-identifier">parse!</span>
|
|
271
|
+
|
|
272
|
+
<span class="ruby-keyword">begin</span>
|
|
273
|
+
<span class="ruby-identifier">config</span> = <span class="ruby-constant">YAML</span>.<span class="ruby-identifier">load</span>(<span class="ruby-constant">File</span>.<span class="ruby-identifier">read</span>(<span class="ruby-identifier">configPath</span>))
|
|
274
|
+
<span class="ruby-keyword">rescue</span> <span class="ruby-constant">StandardError</span> <span class="ruby-operator">=></span> <span class="ruby-identifier">ex</span>
|
|
275
|
+
<span class="ruby-identifier">raise</span> <span class="ruby-identifier">ex</span>, <span class="ruby-node">"failed to parse #{configPath}"</span>
|
|
276
|
+
<span class="ruby-keyword">end</span>
|
|
277
|
+
|
|
278
|
+
<span class="ruby-keyword">begin</span>
|
|
279
|
+
<span class="ruby-identifier">sdmClient</span> = <span class="ruby-constant">SDM</span><span class="ruby-operator">::</span><span class="ruby-constant">Client</span>.<span class="ruby-identifier">new</span>(<span class="ruby-constant">SDM_API_ACCESS_KEY</span>, <span class="ruby-constant">SDM_API_SECRET_KEY</span>, <span class="ruby-value">host:</span> <span class="ruby-string">'api.strongdmdev.com:443'</span>)
|
|
280
|
+
<span class="ruby-keyword">rescue</span> <span class="ruby-constant">SDM</span><span class="ruby-operator">::</span><span class="ruby-constant">RPCError</span> <span class="ruby-operator">=></span> <span class="ruby-identifier">ex</span>
|
|
281
|
+
<span class="ruby-identifier">raise</span> <span class="ruby-identifier">ex</span>, <span class="ruby-string">'failed to create StrongDM client'</span>
|
|
282
|
+
<span class="ruby-keyword">end</span>
|
|
283
|
+
|
|
284
|
+
<span class="ruby-identifier">ldap</span> = <span class="ruby-constant">Net</span><span class="ruby-operator">::</span><span class="ruby-constant">LDAP</span>.<span class="ruby-identifier">new</span>
|
|
285
|
+
<span class="ruby-identifier">ldap</span>.<span class="ruby-identifier">host</span> = <span class="ruby-constant">LDAP_HOST</span>
|
|
286
|
+
<span class="ruby-identifier">ldap</span>.<span class="ruby-identifier">auth</span> <span class="ruby-constant">LDAP_BIND_DN</span>, <span class="ruby-constant">LDAP_PASSWORD</span>
|
|
287
|
+
<span class="ruby-keyword">if</span> <span class="ruby-keyword">not</span> <span class="ruby-identifier">ldap</span>.<span class="ruby-identifier">bind</span>
|
|
288
|
+
<span class="ruby-identifier">puts</span> <span class="ruby-string">'failed to bind LDAP connection - authentication error'</span>
|
|
289
|
+
<span class="ruby-identifier">exit</span> <span class="ruby-value">1</span>
|
|
290
|
+
<span class="ruby-keyword">end</span>
|
|
291
|
+
|
|
292
|
+
<span class="ruby-identifier">sdmRoles</span> = { } <span class="ruby-comment"># map of name to ID</span>
|
|
293
|
+
<span class="ruby-identifier">sdmAccounts</span> = { } <span class="ruby-comment"># map of email to id</span>
|
|
294
|
+
<span class="ruby-identifier">sdmResources</span> = { } <span class="ruby-comment"># map of ID to name</span>
|
|
295
|
+
<span class="ruby-identifier">sdmAccountsById</span> = { } <span class="ruby-comment"># map of id to { :email, :firstName, :lastName }</span>
|
|
296
|
+
<span class="ruby-identifier">sdmAccountsWithAttachments</span> = { } <span class="ruby-comment"># map of email to id of all accounts that are in the roles we're interested in</span>
|
|
297
|
+
<span class="ruby-identifier">sdmAccountAttachments</span> = { } <span class="ruby-comment"># map of role name to list of emails</span>
|
|
298
|
+
<span class="ruby-identifier">sdmRoleGrants</span> = { } <span class="ruby-comment"># map of role name to list of { :resourceId, :grantId }</span>
|
|
299
|
+
<span class="ruby-identifier">ldapRoles</span> = [] <span class="ruby-comment"># list of names</span>
|
|
300
|
+
<span class="ruby-identifier">ldapAccounts</span> = { } <span class="ruby-comment"># map of email to { :firstName, :lastName }</span>
|
|
301
|
+
<span class="ruby-identifier">ldapAccountAttachments</span> = { } <span class="ruby-comment"># map of role name to list of emails</span>
|
|
302
|
+
<span class="ruby-identifier">desiredRoleGrants</span> = { } <span class="ruby-comment"># map of role name to list of resource IDs</span>
|
|
303
|
+
|
|
304
|
+
<span class="ruby-comment"># get SDM accounts</span>
|
|
305
|
+
<span class="ruby-identifier">sdmClient</span>.<span class="ruby-identifier">accounts</span>.<span class="ruby-identifier">list</span>(<span class="ruby-string">''</span>).<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">account</span><span class="ruby-operator">|</span>
|
|
306
|
+
<span class="ruby-identifier">sdmAccounts</span>[<span class="ruby-identifier">account</span>.<span class="ruby-identifier">email</span>] = <span class="ruby-identifier">account</span>.<span class="ruby-identifier">id</span>
|
|
307
|
+
<span class="ruby-identifier">sdmAccountsById</span>[<span class="ruby-identifier">account</span>.<span class="ruby-identifier">id</span>] = { <span class="ruby-value">:email</span> <span class="ruby-operator">=></span> <span class="ruby-identifier">account</span>.<span class="ruby-identifier">email</span>, <span class="ruby-value">:firstName</span> <span class="ruby-operator">=></span> <span class="ruby-identifier">account</span>.<span class="ruby-identifier">first_name</span>, <span class="ruby-value">:lastName</span> <span class="ruby-operator">=></span> <span class="ruby-identifier">account</span>.<span class="ruby-identifier">last_name</span> }
|
|
308
|
+
<span class="ruby-keyword">end</span>
|
|
309
|
+
|
|
310
|
+
<span class="ruby-comment"># get SDM resources</span>
|
|
311
|
+
<span class="ruby-identifier">sdmClient</span>.<span class="ruby-identifier">resources</span>.<span class="ruby-identifier">list</span>(<span class="ruby-string">''</span>).<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">resource</span><span class="ruby-operator">|</span>
|
|
312
|
+
<span class="ruby-identifier">sdmResources</span>[<span class="ruby-identifier">resource</span>.<span class="ruby-identifier">id</span>] = <span class="ruby-identifier">resource</span>.<span class="ruby-identifier">name</span>
|
|
313
|
+
<span class="ruby-keyword">end</span>
|
|
314
|
+
|
|
315
|
+
<span class="ruby-comment"># loop through OUs</span>
|
|
316
|
+
<span class="ruby-identifier">config</span>[<span class="ruby-string">'organizationalUnits'</span>].<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">ou</span><span class="ruby-operator">|</span>
|
|
317
|
+
|
|
318
|
+
<span class="ruby-comment"># get SDM state for this OU</span>
|
|
319
|
+
<span class="ruby-identifier">role</span> = <span class="ruby-identifier">first</span>(<span class="ruby-identifier">sdmClient</span>.<span class="ruby-identifier">roles</span>.<span class="ruby-identifier">list</span>(<span class="ruby-string">'name:?'</span>, <span class="ruby-identifier">ou</span>[<span class="ruby-string">'role'</span>]))
|
|
320
|
+
<span class="ruby-keyword">if</span> <span class="ruby-identifier">role</span>
|
|
321
|
+
<span class="ruby-identifier">sdmRoles</span>[<span class="ruby-identifier">role</span>.<span class="ruby-identifier">name</span>] = <span class="ruby-identifier">role</span>.<span class="ruby-identifier">id</span>
|
|
322
|
+
|
|
323
|
+
<span class="ruby-comment"># get accounts attached to this role</span>
|
|
324
|
+
<span class="ruby-identifier">accountEmails</span> = []
|
|
325
|
+
<span class="ruby-identifier">sdmClient</span>.<span class="ruby-identifier">account_attachments</span>.<span class="ruby-identifier">list</span>(<span class="ruby-string">'roleid:?'</span>, <span class="ruby-identifier">role</span>.<span class="ruby-identifier">id</span>).<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">attachment</span><span class="ruby-operator">|</span>
|
|
326
|
+
<span class="ruby-identifier">sdmAccount</span> = <span class="ruby-identifier">sdmAccountsById</span>[<span class="ruby-identifier">attachment</span>.<span class="ruby-identifier">account_id</span>]
|
|
327
|
+
<span class="ruby-identifier">email</span> = <span class="ruby-identifier">sdmAccount</span>[<span class="ruby-value">:email</span>]
|
|
328
|
+
<span class="ruby-identifier">sdmAccountsWithAttachments</span>[<span class="ruby-identifier">email</span>] = <span class="ruby-identifier">attachment</span>.<span class="ruby-identifier">account_id</span>
|
|
329
|
+
<span class="ruby-identifier">accountEmails</span>.<span class="ruby-identifier">push</span>(<span class="ruby-identifier">email</span>)
|
|
330
|
+
<span class="ruby-keyword">end</span>
|
|
331
|
+
<span class="ruby-identifier">sdmAccountAttachments</span>[<span class="ruby-identifier">role</span>.<span class="ruby-identifier">name</span>] = <span class="ruby-identifier">accountEmails</span>
|
|
332
|
+
|
|
333
|
+
<span class="ruby-comment"># get resources granted to this role</span>
|
|
334
|
+
<span class="ruby-identifier">roleGrants</span> = []
|
|
335
|
+
<span class="ruby-identifier">sdmClient</span>.<span class="ruby-identifier">role_grants</span>.<span class="ruby-identifier">list</span>(<span class="ruby-string">'roleid:?'</span>, <span class="ruby-identifier">role</span>.<span class="ruby-identifier">id</span>).<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">grant</span><span class="ruby-operator">|</span>
|
|
336
|
+
<span class="ruby-identifier">roleGrants</span>.<span class="ruby-identifier">push</span>({ <span class="ruby-value">:resourceId</span> <span class="ruby-operator">=></span> <span class="ruby-identifier">grant</span>.<span class="ruby-identifier">resource_id</span>, <span class="ruby-value">:grantId</span> <span class="ruby-operator">=></span> <span class="ruby-identifier">grant</span>.<span class="ruby-identifier">id</span> })
|
|
337
|
+
<span class="ruby-keyword">end</span>
|
|
338
|
+
<span class="ruby-identifier">sdmRoleGrants</span>[<span class="ruby-identifier">role</span>.<span class="ruby-identifier">name</span>] = <span class="ruby-identifier">roleGrants</span>
|
|
339
|
+
|
|
340
|
+
<span class="ruby-comment"># get resources that we want to grant to this role</span>
|
|
341
|
+
<span class="ruby-identifier">filteredResources</span> = { } <span class="ruby-comment"># map of resource ID to true (to prevent duplicates)</span>
|
|
342
|
+
<span class="ruby-identifier">filters</span> = <span class="ruby-identifier">ou</span>[<span class="ruby-string">'resources'</span>] <span class="ruby-comment"># list of filter strings</span>
|
|
343
|
+
<span class="ruby-keyword">if</span> <span class="ruby-identifier">filters</span>
|
|
344
|
+
<span class="ruby-identifier">filters</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">filter</span><span class="ruby-operator">|</span>
|
|
345
|
+
<span class="ruby-identifier">sdmClient</span>.<span class="ruby-identifier">resources</span>.<span class="ruby-identifier">list</span>(<span class="ruby-identifier">filter</span>).<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">resource</span><span class="ruby-operator">|</span>
|
|
346
|
+
<span class="ruby-identifier">filteredResources</span>[<span class="ruby-identifier">resource</span>.<span class="ruby-identifier">id</span>] = <span class="ruby-keyword">true</span>
|
|
347
|
+
<span class="ruby-keyword">end</span>
|
|
348
|
+
<span class="ruby-keyword">end</span>
|
|
349
|
+
<span class="ruby-identifier">desiredRoleGrants</span>[<span class="ruby-identifier">role</span>.<span class="ruby-identifier">name</span>] = <span class="ruby-identifier">filteredResources</span>.<span class="ruby-identifier">keys</span>
|
|
350
|
+
<span class="ruby-keyword">end</span>
|
|
162
351
|
<span class="ruby-keyword">end</span>
|
|
163
|
-
<span class="ruby-identifier">client</span> = <span class="ruby-constant">SDM</span><span class="ruby-operator">::</span><span class="ruby-constant">Client</span>.<span class="ruby-identifier">new</span>(<span class="ruby-identifier">access_key</span>, <span class="ruby-identifier">secret_key</span>)
|
|
164
352
|
|
|
165
|
-
<span class="ruby-
|
|
166
|
-
|
|
167
|
-
|
|
353
|
+
<span class="ruby-comment"># get LDAP state for this OU</span>
|
|
354
|
+
<span class="ruby-identifier">ldapRoles</span>.<span class="ruby-identifier">push</span>(<span class="ruby-identifier">ou</span>[<span class="ruby-string">'role'</span>].<span class="ruby-identifier">to_s</span>)
|
|
355
|
+
<span class="ruby-identifier">roleAccounts</span> = []
|
|
356
|
+
<span class="ruby-identifier">ldap</span>.<span class="ruby-identifier">search</span>(<span class="ruby-value">:base</span> <span class="ruby-operator">=></span> <span class="ruby-identifier">ou</span>[<span class="ruby-string">'dn'</span>], <span class="ruby-value">:filter</span> <span class="ruby-operator">=></span> <span class="ruby-constant">Net</span><span class="ruby-operator">::</span><span class="ruby-constant">LDAP</span><span class="ruby-operator">::</span><span class="ruby-constant">Filter</span>.<span class="ruby-identifier">eq</span>(<span class="ruby-string">'objectclass'</span>, <span class="ruby-string">'user'</span>), <span class="ruby-value">:return_result</span> <span class="ruby-operator">=></span> <span class="ruby-keyword">false</span>) <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">entry</span><span class="ruby-operator">|</span>
|
|
357
|
+
<span class="ruby-identifier">ldapAccounts</span>[<span class="ruby-identifier">first</span>(<span class="ruby-identifier">entry</span>.<span class="ruby-identifier">mail</span>).<span class="ruby-identifier">to_s</span>] = {
|
|
358
|
+
<span class="ruby-value">:firstName</span> <span class="ruby-operator">=></span> <span class="ruby-identifier">first</span>(<span class="ruby-identifier">entry</span>.<span class="ruby-identifier">givenname</span>).<span class="ruby-identifier">to_s</span>,
|
|
359
|
+
<span class="ruby-value">:lastName</span> <span class="ruby-operator">=></span> <span class="ruby-identifier">first</span>(<span class="ruby-identifier">entry</span>.<span class="ruby-identifier">sn</span>).<span class="ruby-identifier">to_s</span>,
|
|
360
|
+
}
|
|
361
|
+
<span class="ruby-identifier">roleAccounts</span>.<span class="ruby-identifier">push</span>(<span class="ruby-identifier">first</span>(<span class="ruby-identifier">entry</span>.<span class="ruby-identifier">mail</span>).<span class="ruby-identifier">to_s</span>)
|
|
362
|
+
<span class="ruby-keyword">end</span>
|
|
363
|
+
<span class="ruby-identifier">ldapAccountAttachments</span>[<span class="ruby-identifier">ou</span>[<span class="ruby-string">'role'</span>].<span class="ruby-identifier">to_s</span>] = <span class="ruby-identifier">roleAccounts</span>
|
|
364
|
+
<span class="ruby-keyword">end</span>
|
|
365
|
+
|
|
366
|
+
<span class="ruby-comment"># compute diff</span>
|
|
367
|
+
<span class="ruby-identifier">report</span> = {
|
|
368
|
+
<span class="ruby-value">:createRoles</span> <span class="ruby-operator">=></span> [],
|
|
369
|
+
<span class="ruby-value">:deleteAccounts</span> <span class="ruby-operator">=></span> [],
|
|
370
|
+
<span class="ruby-value">:updateAccounts</span> <span class="ruby-operator">=></span> [],
|
|
371
|
+
<span class="ruby-value">:createAccounts</span> <span class="ruby-operator">=></span> [],
|
|
372
|
+
<span class="ruby-value">:createAccountAttachments</span> <span class="ruby-operator">=></span> [],
|
|
373
|
+
<span class="ruby-value">:deleteAccountAttachments</span> <span class="ruby-operator">=></span> [],
|
|
374
|
+
<span class="ruby-value">:deleteRoleGrants</span> <span class="ruby-operator">=></span> [],
|
|
375
|
+
<span class="ruby-value">:createRoleGrants</span> <span class="ruby-operator">=></span> [],
|
|
376
|
+
}
|
|
377
|
+
<span class="ruby-comment"># createRoles</span>
|
|
378
|
+
<span class="ruby-identifier">ldapRoles</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">roleName</span><span class="ruby-operator">|</span>
|
|
379
|
+
<span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">sdmRoles</span>[<span class="ruby-identifier">roleName</span>]
|
|
380
|
+
<span class="ruby-identifier">report</span>[<span class="ruby-value">:createRoles</span>].<span class="ruby-identifier">push</span>(<span class="ruby-identifier">roleName</span>)
|
|
381
|
+
<span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">plan</span>
|
|
382
|
+
<span class="ruby-identifier">response</span> = <span class="ruby-identifier">sdmClient</span>.<span class="ruby-identifier">roles</span>.<span class="ruby-identifier">create</span>(<span class="ruby-constant">SDM</span><span class="ruby-operator">::</span><span class="ruby-constant">Role</span>.<span class="ruby-identifier">new</span>(<span class="ruby-value">name:</span> <span class="ruby-identifier">roleName</span>))
|
|
383
|
+
<span class="ruby-identifier">sdmRoles</span>[<span class="ruby-identifier">roleName</span>] = <span class="ruby-identifier">response</span>.<span class="ruby-identifier">role</span>.<span class="ruby-identifier">id</span>
|
|
384
|
+
<span class="ruby-keyword">end</span>
|
|
385
|
+
<span class="ruby-comment"># deleteAccounts</span>
|
|
386
|
+
<span class="ruby-identifier">sdmAccountsWithAttachments</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">email</span>, <span class="ruby-identifier">id</span><span class="ruby-operator">|</span>
|
|
387
|
+
<span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">ldapAccounts</span>[<span class="ruby-identifier">email</span>]
|
|
388
|
+
<span class="ruby-identifier">report</span>[<span class="ruby-value">:deleteAccounts</span>].<span class="ruby-identifier">push</span>(<span class="ruby-identifier">email</span>)
|
|
389
|
+
<span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">plan</span>
|
|
390
|
+
<span class="ruby-identifier">sdmClient</span>.<span class="ruby-identifier">accounts</span>.<span class="ruby-identifier">delete</span>(<span class="ruby-identifier">id</span>)
|
|
391
|
+
<span class="ruby-keyword">end</span>
|
|
392
|
+
<span class="ruby-comment"># updateAccounts</span>
|
|
393
|
+
<span class="ruby-identifier">sdmAccountsWithAttachments</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">email</span>, <span class="ruby-identifier">id</span><span class="ruby-operator">|</span>
|
|
394
|
+
<span class="ruby-identifier">ldapAccount</span> = <span class="ruby-identifier">ldapAccounts</span>[<span class="ruby-identifier">email</span>]
|
|
395
|
+
<span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-keyword">not</span> <span class="ruby-identifier">ldapAccount</span>
|
|
396
|
+
<span class="ruby-identifier">sdmAccount</span> = <span class="ruby-identifier">sdmAccountsById</span>[<span class="ruby-identifier">id</span>]
|
|
397
|
+
<span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">sdmAccount</span>[<span class="ruby-value">:firstName</span>] <span class="ruby-operator">==</span> <span class="ruby-identifier">ldapAccount</span>[<span class="ruby-value">:firstName</span>] <span class="ruby-keyword">and</span> <span class="ruby-identifier">sdmAccount</span>[<span class="ruby-value">:lastName</span>] <span class="ruby-operator">==</span> <span class="ruby-identifier">ldapAccount</span>[<span class="ruby-value">:lastName</span>]
|
|
398
|
+
<span class="ruby-identifier">report</span>[<span class="ruby-value">:updateAccounts</span>].<span class="ruby-identifier">push</span>(<span class="ruby-identifier">email</span>)
|
|
399
|
+
<span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">plan</span>
|
|
400
|
+
<span class="ruby-identifier">sdmClient</span>.<span class="ruby-identifier">accounts</span>.<span class="ruby-identifier">update</span>(<span class="ruby-constant">SDM</span><span class="ruby-operator">::</span><span class="ruby-constant">User</span>.<span class="ruby-identifier">new</span>(<span class="ruby-value">id:</span> <span class="ruby-identifier">id</span>, <span class="ruby-value">first_name:</span> <span class="ruby-identifier">ldapAccount</span>[<span class="ruby-value">:firstName</span>], <span class="ruby-value">last_name:</span> <span class="ruby-identifier">ldapAccount</span>[<span class="ruby-value">:lastName</span>]))
|
|
401
|
+
<span class="ruby-keyword">end</span>
|
|
402
|
+
<span class="ruby-comment"># createAccounts</span>
|
|
403
|
+
<span class="ruby-identifier">ldapAccounts</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">email</span>, <span class="ruby-identifier">account</span><span class="ruby-operator">|</span>
|
|
404
|
+
<span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">sdmAccounts</span>[<span class="ruby-identifier">email</span>]
|
|
405
|
+
<span class="ruby-identifier">report</span>[<span class="ruby-value">:createAccounts</span>].<span class="ruby-identifier">push</span>(<span class="ruby-identifier">email</span>)
|
|
406
|
+
<span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">plan</span>
|
|
407
|
+
<span class="ruby-identifier">response</span> = <span class="ruby-identifier">sdmClient</span>.<span class="ruby-identifier">accounts</span>.<span class="ruby-identifier">create</span>(<span class="ruby-constant">SDM</span><span class="ruby-operator">::</span><span class="ruby-constant">User</span>.<span class="ruby-identifier">new</span>(<span class="ruby-value">email:</span> <span class="ruby-identifier">email</span>, <span class="ruby-value">first_name:</span> <span class="ruby-identifier">account</span>[<span class="ruby-value">:firstName</span>], <span class="ruby-value">last_name:</span> <span class="ruby-identifier">account</span>[<span class="ruby-value">:lastName</span>]))
|
|
408
|
+
<span class="ruby-identifier">sdmAccounts</span>[<span class="ruby-identifier">response</span>.<span class="ruby-identifier">account</span>.<span class="ruby-identifier">email</span>] = <span class="ruby-identifier">response</span>.<span class="ruby-identifier">account</span>.<span class="ruby-identifier">id</span>
|
|
409
|
+
<span class="ruby-keyword">end</span>
|
|
410
|
+
<span class="ruby-comment"># deleteAccountAttachments</span>
|
|
411
|
+
<span class="ruby-identifier">sdmAccountAttachments</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">roleName</span>, <span class="ruby-identifier">accounts</span><span class="ruby-operator">|</span>
|
|
412
|
+
<span class="ruby-identifier">roleId</span> = <span class="ruby-identifier">sdmRoles</span>[<span class="ruby-identifier">roleName</span>]
|
|
413
|
+
<span class="ruby-identifier">ldapAccountsInRole</span> = <span class="ruby-identifier">ldapAccountAttachments</span>[<span class="ruby-identifier">roleName</span>]
|
|
414
|
+
<span class="ruby-identifier">accounts</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">email</span><span class="ruby-operator">|</span>
|
|
415
|
+
<span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">ldapAccountsInRole</span> <span class="ruby-keyword">and</span> <span class="ruby-identifier">ldapAccountsInRole</span>.<span class="ruby-identifier">include?</span> <span class="ruby-identifier">email</span>
|
|
416
|
+
<span class="ruby-identifier">report</span>[<span class="ruby-value">:deleteAccountAttachments</span>].<span class="ruby-identifier">push</span>({ <span class="ruby-value">:role</span> <span class="ruby-operator">=></span> <span class="ruby-identifier">roleName</span>, <span class="ruby-value">:account</span> <span class="ruby-operator">=></span> <span class="ruby-identifier">email</span> })
|
|
417
|
+
<span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">plan</span>
|
|
418
|
+
<span class="ruby-identifier">accountId</span> = <span class="ruby-identifier">sdmAccounts</span>[<span class="ruby-identifier">email</span>]
|
|
419
|
+
<span class="ruby-identifier">attachment</span> = <span class="ruby-identifier">first</span>(<span class="ruby-identifier">sdmClient</span>.<span class="ruby-identifier">account_attachments</span>.<span class="ruby-identifier">list</span>(<span class="ruby-string">'accountid:? roleid:?'</span>, <span class="ruby-identifier">accountId</span>, <span class="ruby-identifier">roleId</span>))
|
|
420
|
+
<span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-keyword">not</span> <span class="ruby-identifier">attachment</span> <span class="ruby-comment"># already deleted by the deleteAccounts step</span>
|
|
421
|
+
<span class="ruby-identifier">sdmClient</span>.<span class="ruby-identifier">account_attachments</span>.<span class="ruby-identifier">delete</span>(<span class="ruby-identifier">attachment</span>.<span class="ruby-identifier">id</span>)
|
|
422
|
+
<span class="ruby-keyword">end</span>
|
|
423
|
+
<span class="ruby-keyword">end</span>
|
|
424
|
+
<span class="ruby-comment"># createAccountAttachments</span>
|
|
425
|
+
<span class="ruby-identifier">ldapAccountAttachments</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">roleName</span>, <span class="ruby-identifier">accounts</span><span class="ruby-operator">|</span>
|
|
426
|
+
<span class="ruby-identifier">roleId</span> = <span class="ruby-identifier">sdmRoles</span>[<span class="ruby-identifier">roleName</span>]
|
|
427
|
+
<span class="ruby-identifier">sdmAccountsInRole</span> = <span class="ruby-identifier">sdmAccountAttachments</span>[<span class="ruby-identifier">roleName</span>]
|
|
428
|
+
<span class="ruby-identifier">accounts</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">email</span><span class="ruby-operator">|</span>
|
|
429
|
+
<span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">sdmAccountsInRole</span> <span class="ruby-keyword">and</span> <span class="ruby-identifier">sdmAccountsInRole</span>.<span class="ruby-identifier">include?</span> <span class="ruby-identifier">email</span>
|
|
430
|
+
<span class="ruby-identifier">report</span>[<span class="ruby-value">:createAccountAttachments</span>].<span class="ruby-identifier">push</span>({ <span class="ruby-value">:role</span> <span class="ruby-operator">=></span> <span class="ruby-identifier">roleName</span>, <span class="ruby-value">:account</span> <span class="ruby-operator">=></span> <span class="ruby-identifier">email</span> })
|
|
431
|
+
<span class="ruby-identifier">accountId</span> = <span class="ruby-identifier">sdmAccounts</span>[<span class="ruby-identifier">email</span>]
|
|
432
|
+
<span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">plan</span>
|
|
433
|
+
<span class="ruby-identifier">sdmClient</span>.<span class="ruby-identifier">account_attachments</span>.<span class="ruby-identifier">create</span>(<span class="ruby-constant">SDM</span><span class="ruby-operator">::</span><span class="ruby-constant">AccountAttachment</span>.<span class="ruby-identifier">new</span>(<span class="ruby-value">account_id:</span> <span class="ruby-identifier">accountId</span>, <span class="ruby-value">role_id:</span> <span class="ruby-identifier">roleId</span>))
|
|
434
|
+
<span class="ruby-keyword">end</span>
|
|
435
|
+
<span class="ruby-keyword">end</span>
|
|
436
|
+
<span class="ruby-comment"># deleteRoleGrants</span>
|
|
437
|
+
<span class="ruby-identifier">sdmRoleGrants</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">roleName</span>, <span class="ruby-identifier">roleGrants</span><span class="ruby-operator">|</span>
|
|
438
|
+
<span class="ruby-identifier">desired</span> = <span class="ruby-identifier">desiredRoleGrants</span>[<span class="ruby-identifier">roleName</span>]
|
|
439
|
+
<span class="ruby-identifier">roleGrants</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">grant</span><span class="ruby-operator">|</span>
|
|
440
|
+
<span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">desired</span> <span class="ruby-keyword">and</span> <span class="ruby-identifier">desired</span>.<span class="ruby-identifier">include?</span> <span class="ruby-identifier">grant</span>[<span class="ruby-value">:resourceId</span>]
|
|
441
|
+
<span class="ruby-identifier">resourceName</span> = <span class="ruby-identifier">sdmResources</span>[<span class="ruby-identifier">grant</span>[<span class="ruby-value">:resourceId</span>]]
|
|
442
|
+
<span class="ruby-identifier">report</span>[<span class="ruby-value">:deleteRoleGrants</span>].<span class="ruby-identifier">push</span>({ <span class="ruby-value">:role</span> <span class="ruby-operator">=></span> <span class="ruby-identifier">roleName</span>, <span class="ruby-value">:resource</span> <span class="ruby-operator">=></span> <span class="ruby-identifier">resourceName</span>})
|
|
443
|
+
<span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">plan</span>
|
|
444
|
+
<span class="ruby-identifier">sdmClient</span>.<span class="ruby-identifier">role_grants</span>.<span class="ruby-identifier">delete</span>(<span class="ruby-identifier">grant</span>[<span class="ruby-value">:grantId</span>])
|
|
445
|
+
<span class="ruby-keyword">end</span>
|
|
446
|
+
<span class="ruby-keyword">end</span>
|
|
447
|
+
<span class="ruby-comment"># createRoleGrants</span>
|
|
448
|
+
<span class="ruby-identifier">desiredRoleGrants</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">roleName</span>, <span class="ruby-identifier">roleGrants</span><span class="ruby-operator">|</span>
|
|
449
|
+
<span class="ruby-identifier">roleId</span> = <span class="ruby-identifier">sdmRoles</span>[<span class="ruby-identifier">roleName</span>]
|
|
450
|
+
<span class="ruby-identifier">existing</span> = <span class="ruby-identifier">sdmRoleGrants</span>[<span class="ruby-identifier">roleName</span>]
|
|
451
|
+
<span class="ruby-identifier">roleGrants</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">resourceId</span><span class="ruby-operator">|</span>
|
|
452
|
+
<span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">existing</span> <span class="ruby-keyword">and</span> <span class="ruby-identifier">existing</span>.<span class="ruby-identifier">find</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">existingGrant</span><span class="ruby-operator">|</span> <span class="ruby-identifier">existingGrant</span>[<span class="ruby-value">:resourceId</span>] <span class="ruby-operator">==</span> <span class="ruby-identifier">resourceId</span> }
|
|
453
|
+
<span class="ruby-identifier">resourceName</span> = <span class="ruby-identifier">sdmResources</span>[<span class="ruby-identifier">resourceId</span>]
|
|
454
|
+
<span class="ruby-identifier">report</span>[<span class="ruby-value">:createRoleGrants</span>].<span class="ruby-identifier">push</span>({ <span class="ruby-value">:role</span> <span class="ruby-operator">=></span> <span class="ruby-identifier">roleName</span>, <span class="ruby-value">:resource</span> <span class="ruby-operator">=></span> <span class="ruby-identifier">resourceName</span> })
|
|
455
|
+
<span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">plan</span>
|
|
456
|
+
<span class="ruby-identifier">sdmClient</span>.<span class="ruby-identifier">role_grants</span>.<span class="ruby-identifier">create</span>(<span class="ruby-constant">SDM</span><span class="ruby-operator">::</span><span class="ruby-constant">RoleGrant</span>.<span class="ruby-identifier">new</span>(<span class="ruby-value">role_id:</span> <span class="ruby-identifier">roleId</span>, <span class="ruby-value">resource_id:</span> <span class="ruby-identifier">resourceId</span>))
|
|
457
|
+
<span class="ruby-keyword">end</span>
|
|
458
|
+
<span class="ruby-keyword">end</span>
|
|
459
|
+
<span class="ruby-keyword">if</span> <span class="ruby-identifier">verbose</span>
|
|
460
|
+
<span class="ruby-identifier">puts</span> <span class="ruby-constant">JSON</span>.<span class="ruby-identifier">pretty_generate</span>(<span class="ruby-identifier">report</span>)
|
|
461
|
+
<span class="ruby-keyword">else</span>
|
|
462
|
+
<span class="ruby-identifier">puts</span> <span class="ruby-node">"Create #{report[:createRoles].length} roles"</span>
|
|
463
|
+
<span class="ruby-identifier">puts</span> <span class="ruby-node">"Delete #{report[:deleteAccounts].length} accounts"</span>
|
|
464
|
+
<span class="ruby-identifier">puts</span> <span class="ruby-node">"Create #{report[:createAccounts].length} accounts"</span>
|
|
465
|
+
<span class="ruby-identifier">puts</span> <span class="ruby-node">"Delete #{report[:deleteAccountAttachments].length} account attachments"</span>
|
|
466
|
+
<span class="ruby-identifier">puts</span> <span class="ruby-node">"Create #{report[:createAccountAttachments].length} account attachments"</span>
|
|
467
|
+
<span class="ruby-identifier">puts</span> <span class="ruby-node">"Delete #{report[:deleteRoleGrants].length} role grants"</span>
|
|
468
|
+
<span class="ruby-identifier">puts</span> <span class="ruby-node">"Create #{report[:createRoleGrants].length} role grants"</span>
|
|
469
|
+
<span class="ruby-keyword">end</span>
|
|
470
|
+
<span class="ruby-keyword">end</span></pre>
|
|
471
|
+
</div>
|
|
472
|
+
|
|
473
|
+
</div>
|
|
168
474
|
|
|
169
|
-
|
|
475
|
+
|
|
170
476
|
|
|
171
|
-
|
|
172
|
-
|
|
173
|
-
|
|
174
|
-
|
|
175
|
-
|
|
176
|
-
|
|
177
|
-
|
|
178
|
-
|
|
179
|
-
|
|
180
|
-
|
|
181
|
-
|
|
182
|
-
|
|
183
|
-
|
|
184
|
-
|
|
185
|
-
|
|
186
|
-
|
|
187
|
-
|
|
188
|
-
|
|
477
|
+
|
|
478
|
+
</div>
|
|
479
|
+
|
|
480
|
+
|
|
481
|
+
<div id="method-i-main" class="method-detail ">
|
|
482
|
+
|
|
483
|
+
<div class="method-heading">
|
|
484
|
+
<span class="method-name">main</span><span
|
|
485
|
+
class="method-args">()</span>
|
|
486
|
+
|
|
487
|
+
<span class="method-click-advice">click to toggle source</span>
|
|
488
|
+
|
|
489
|
+
</div>
|
|
490
|
+
|
|
491
|
+
|
|
492
|
+
<div class="method-description">
|
|
493
|
+
|
|
494
|
+
<p>panicButton.rb suspends all users except for one admin, in the fake use case of a critical break in or something usage: ruby panicButton.rb adminuser@email.com to revert back to pre-panic state: ruby panicButton.rb revert</p>
|
|
495
|
+
|
|
496
|
+
|
|
497
|
+
|
|
498
|
+
|
|
499
|
+
<div class="method-source-code" id="main-source">
|
|
500
|
+
<pre><span class="ruby-comment"># File examples/panicButton.rb, line 25</span>
|
|
501
|
+
<span class="ruby-keyword">def</span> <span class="ruby-identifier ruby-title">main</span>
|
|
502
|
+
<span class="ruby-identifier">access_key</span> = <span class="ruby-constant">ENV</span>[<span class="ruby-string">"SDM_API_ACCESS_KEY"</span>]
|
|
503
|
+
<span class="ruby-identifier">secret_key</span> = <span class="ruby-constant">ENV</span>[<span class="ruby-string">"SDM_API_SECRET_KEY"</span>]
|
|
504
|
+
<span class="ruby-keyword">if</span> <span class="ruby-identifier">access_key</span> <span class="ruby-operator">==</span> <span class="ruby-keyword">nil</span> <span class="ruby-keyword">or</span> <span class="ruby-identifier">secret_key</span> <span class="ruby-operator">==</span> <span class="ruby-keyword">nil</span>
|
|
505
|
+
<span class="ruby-identifier">puts</span> <span class="ruby-string">"SDM_API_ACCESS_KEY and SDM_API_SECRET_KEY must be provided"</span>
|
|
506
|
+
<span class="ruby-keyword">return</span>
|
|
507
|
+
<span class="ruby-keyword">end</span>
|
|
508
|
+
<span class="ruby-identifier">client</span> = <span class="ruby-constant">SDM</span><span class="ruby-operator">::</span><span class="ruby-constant">Client</span>.<span class="ruby-identifier">new</span>(<span class="ruby-identifier">access_key</span>, <span class="ruby-identifier">secret_key</span>)
|
|
509
|
+
|
|
510
|
+
<span class="ruby-keyword">if</span> <span class="ruby-constant">ARGV</span>.<span class="ruby-identifier">size</span> <span class="ruby-operator">==</span> <span class="ruby-value">1</span> <span class="ruby-keyword">and</span> <span class="ruby-constant">ARGV</span>[<span class="ruby-value">0</span>] <span class="ruby-operator">==</span> <span class="ruby-string">"revert"</span>
|
|
511
|
+
<span class="ruby-identifier">state_file</span> = <span class="ruby-constant">File</span>.<span class="ruby-identifier">open</span>(<span class="ruby-string">"state.json"</span>)
|
|
512
|
+
<span class="ruby-identifier">state</span> = <span class="ruby-constant">JSON</span>.<span class="ruby-identifier">load</span>(<span class="ruby-identifier">state_file</span>)
|
|
513
|
+
|
|
514
|
+
<span class="ruby-identifier">reinstated_count</span> = <span class="ruby-value">0</span>
|
|
515
|
+
|
|
516
|
+
<span class="ruby-identifier">users</span> = <span class="ruby-identifier">client</span>.<span class="ruby-identifier">accounts</span>.<span class="ruby-identifier">list</span>(<span class="ruby-string">""</span>)
|
|
517
|
+
<span class="ruby-identifier">users</span>.<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">user</span><span class="ruby-operator">|</span>
|
|
518
|
+
<span class="ruby-keyword">if</span> <span class="ruby-identifier">user</span>.<span class="ruby-identifier">suspended</span>
|
|
519
|
+
<span class="ruby-identifier">reinstated_count</span> <span class="ruby-operator">+=</span> <span class="ruby-value">1</span>
|
|
520
|
+
<span class="ruby-identifier">user</span>.<span class="ruby-identifier">suspended</span> = <span class="ruby-keyword">false</span>
|
|
521
|
+
<span class="ruby-identifier">client</span>.<span class="ruby-identifier">accounts</span>.<span class="ruby-identifier">update</span>(<span class="ruby-identifier">user</span>)
|
|
522
|
+
<span class="ruby-keyword">end</span>
|
|
523
|
+
}
|
|
524
|
+
<span class="ruby-identifier">state</span>[<span class="ruby-string">"attachments"</span>].<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">attachment</span><span class="ruby-operator">|</span>
|
|
525
|
+
<span class="ruby-keyword">begin</span>
|
|
526
|
+
<span class="ruby-identifier">a</span> = <span class="ruby-constant">SDM</span><span class="ruby-operator">::</span><span class="ruby-constant">AccountAttachment</span>.<span class="ruby-identifier">new</span>()
|
|
527
|
+
<span class="ruby-identifier">a</span>.<span class="ruby-identifier">account_id</span> = <span class="ruby-identifier">attachment</span>[<span class="ruby-string">"account_id"</span>]
|
|
528
|
+
<span class="ruby-identifier">a</span>.<span class="ruby-identifier">role_id</span> = <span class="ruby-identifier">attachment</span>[<span class="ruby-string">"role_id"</span>]
|
|
529
|
+
<span class="ruby-identifier">client</span>.<span class="ruby-identifier">account_attachments</span>.<span class="ruby-identifier">create</span>(<span class="ruby-identifier">a</span>)
|
|
530
|
+
<span class="ruby-keyword">rescue</span> <span class="ruby-constant">SDM</span><span class="ruby-operator">::</span><span class="ruby-constant">AlreadyExistsError</span>
|
|
531
|
+
<span class="ruby-keyword">rescue</span> <span class="ruby-operator">=></span> <span class="ruby-identifier">ex</span>
|
|
532
|
+
<span class="ruby-identifier">puts</span> <span class="ruby-string">"skipping creation of attachment due to error: "</span> <span class="ruby-operator">+</span> <span class="ruby-identifier">ex</span>.<span class="ruby-identifier">to_s</span>
|
|
533
|
+
<span class="ruby-keyword">end</span>
|
|
534
|
+
}
|
|
535
|
+
<span class="ruby-identifier">state</span>[<span class="ruby-string">"grants"</span>].<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">attachment</span><span class="ruby-operator">|</span>
|
|
536
|
+
<span class="ruby-keyword">begin</span>
|
|
537
|
+
<span class="ruby-identifier">g</span> = <span class="ruby-constant">SDM</span><span class="ruby-operator">::</span><span class="ruby-constant">AccountGrant</span>.<span class="ruby-identifier">new</span>()
|
|
538
|
+
<span class="ruby-identifier">g</span>.<span class="ruby-identifier">account_id</span> = <span class="ruby-identifier">attachment</span>[<span class="ruby-string">"account_id"</span>]
|
|
539
|
+
<span class="ruby-identifier">g</span>.<span class="ruby-identifier">resource_id</span> = <span class="ruby-identifier">attachment</span>[<span class="ruby-string">"resource_id"</span>]
|
|
540
|
+
<span class="ruby-identifier">client</span>.<span class="ruby-identifier">account_grants</span>.<span class="ruby-identifier">create</span>(<span class="ruby-identifier">g</span>)
|
|
541
|
+
<span class="ruby-keyword">rescue</span> <span class="ruby-constant">SDM</span><span class="ruby-operator">::</span><span class="ruby-constant">AlreadyExistsError</span>
|
|
542
|
+
<span class="ruby-keyword">rescue</span> <span class="ruby-operator">=></span> <span class="ruby-identifier">ex</span>
|
|
543
|
+
<span class="ruby-identifier">puts</span> <span class="ruby-string">"skipping creation of grant due to error: "</span> <span class="ruby-operator">+</span> <span class="ruby-identifier">ex</span>.<span class="ruby-identifier">to_s</span>
|
|
544
|
+
<span class="ruby-keyword">end</span>
|
|
545
|
+
}
|
|
546
|
+
|
|
547
|
+
<span class="ruby-identifier">puts</span> <span class="ruby-string">"reinstated "</span> <span class="ruby-operator">+</span> <span class="ruby-identifier">reinstated_count</span>.<span class="ruby-identifier">to_s</span> <span class="ruby-operator">+</span> <span class="ruby-string">" users"</span>
|
|
548
|
+
<span class="ruby-identifier">puts</span> <span class="ruby-string">"recreated "</span> <span class="ruby-operator">+</span> <span class="ruby-identifier">state</span>[<span class="ruby-string">"attachments"</span>].<span class="ruby-identifier">size</span>.<span class="ruby-identifier">to_s</span> <span class="ruby-operator">+</span> <span class="ruby-string">" account attachments"</span>
|
|
549
|
+
<span class="ruby-identifier">puts</span> <span class="ruby-string">"recreated "</span> <span class="ruby-operator">+</span> <span class="ruby-identifier">state</span>[<span class="ruby-string">"grants"</span>].<span class="ruby-identifier">size</span>.<span class="ruby-identifier">to_s</span> <span class="ruby-operator">+</span> <span class="ruby-string">" account grants"</span>
|
|
550
|
+
|
|
551
|
+
<span class="ruby-keyword">return</span>
|
|
552
|
+
<span class="ruby-keyword">end</span>
|
|
553
|
+
|
|
554
|
+
<span class="ruby-identifier">admin_email</span> = <span class="ruby-string">""</span>
|
|
555
|
+
<span class="ruby-keyword">if</span> <span class="ruby-constant">ARGV</span>.<span class="ruby-identifier">size</span> <span class="ruby-operator">==</span> <span class="ruby-value">1</span>
|
|
556
|
+
<span class="ruby-identifier">admin_email</span> = <span class="ruby-constant">ARGV</span>[<span class="ruby-value">0</span>]
|
|
557
|
+
<span class="ruby-keyword">else</span>
|
|
558
|
+
<span class="ruby-identifier">puts</span> <span class="ruby-string">"please provide an admin email to preserve"</span>
|
|
559
|
+
<span class="ruby-keyword">return</span> <span class="ruby-value">1</span>
|
|
560
|
+
<span class="ruby-keyword">end</span>
|
|
561
|
+
|
|
562
|
+
<span class="ruby-identifier">admin_user_id</span> = <span class="ruby-string">""</span>
|
|
563
|
+
<span class="ruby-identifier">users</span> = <span class="ruby-identifier">client</span>.<span class="ruby-identifier">accounts</span>.<span class="ruby-identifier">list</span>(<span class="ruby-string">"email:?"</span>, <span class="ruby-identifier">admin_email</span>)
|
|
564
|
+
<span class="ruby-identifier">users</span>.<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">user</span><span class="ruby-operator">|</span>
|
|
565
|
+
<span class="ruby-identifier">admin_user_id</span> = <span class="ruby-identifier">user</span>.<span class="ruby-identifier">id</span>
|
|
566
|
+
}
|
|
567
|
+
|
|
568
|
+
<span class="ruby-identifier">account_attachments</span> = <span class="ruby-identifier">client</span>.<span class="ruby-identifier">account_attachments</span>.<span class="ruby-identifier">list</span>(<span class="ruby-string">""</span>)
|
|
569
|
+
<span class="ruby-identifier">account_grants</span> = <span class="ruby-identifier">client</span>.<span class="ruby-identifier">account_grants</span>.<span class="ruby-identifier">list</span>(<span class="ruby-string">""</span>)
|
|
570
|
+
|
|
571
|
+
<span class="ruby-identifier">state</span> = {
|
|
572
|
+
<span class="ruby-value">'attachments':</span> <span class="ruby-identifier">account_attachments</span>.<span class="ruby-identifier">map</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">x</span><span class="ruby-operator">|</span>
|
|
573
|
+
<span class="ruby-keyword">if</span> <span class="ruby-identifier">x</span>.<span class="ruby-identifier">account_id</span> <span class="ruby-operator">!=</span> <span class="ruby-identifier">admin_user_id</span>
|
|
574
|
+
<span class="ruby-identifier">out</span> = {
|
|
575
|
+
<span class="ruby-value">'account_id':</span> <span class="ruby-identifier">x</span>.<span class="ruby-identifier">account_id</span>,
|
|
576
|
+
<span class="ruby-value">'role_id':</span> <span class="ruby-identifier">x</span>.<span class="ruby-identifier">role_id</span>,
|
|
189
577
|
}
|
|
190
|
-
|
|
191
|
-
|
|
192
|
-
|
|
193
|
-
|
|
194
|
-
|
|
195
|
-
|
|
196
|
-
|
|
197
|
-
<span class="ruby-keyword">rescue</span> =<span class="ruby-operator">></span> <span class="ruby-identifier">ex</span>
|
|
198
|
-
<span class="ruby-identifier">puts</span> <span class="ruby-string">"skipping creation of grant due to error: "</span> <span class="ruby-operator">+</span> <span class="ruby-identifier">ex</span>.<span class="ruby-identifier">to_s</span>
|
|
199
|
-
<span class="ruby-keyword">end</span>
|
|
578
|
+
<span class="ruby-keyword">end</span>
|
|
579
|
+
}.<span class="ruby-identifier">reject</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">x</span><span class="ruby-operator">|</span> <span class="ruby-identifier">x</span> <span class="ruby-operator">==</span> <span class="ruby-keyword">nil</span> },
|
|
580
|
+
<span class="ruby-value">'grants':</span> <span class="ruby-identifier">account_grants</span>.<span class="ruby-identifier">map</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">x</span><span class="ruby-operator">|</span>
|
|
581
|
+
<span class="ruby-keyword">if</span> <span class="ruby-identifier">x</span>.<span class="ruby-identifier">account_id</span> <span class="ruby-operator">!=</span> <span class="ruby-identifier">admin_user_id</span> <span class="ruby-keyword">and</span> <span class="ruby-identifier">x</span>.<span class="ruby-identifier">valid_until</span> <span class="ruby-operator">==</span> <span class="ruby-keyword">nil</span>
|
|
582
|
+
<span class="ruby-identifier">out</span> = {
|
|
583
|
+
<span class="ruby-value">'account_id':</span> <span class="ruby-identifier">x</span>.<span class="ruby-identifier">account_id</span>,
|
|
584
|
+
<span class="ruby-value">'resource_id':</span> <span class="ruby-identifier">x</span>.<span class="ruby-identifier">resource_id</span>,
|
|
200
585
|
}
|
|
586
|
+
<span class="ruby-keyword">end</span>
|
|
587
|
+
}.<span class="ruby-identifier">reject</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">x</span><span class="ruby-operator">|</span> <span class="ruby-identifier">x</span> <span class="ruby-operator">==</span> <span class="ruby-keyword">nil</span> },
|
|
588
|
+
}
|
|
201
589
|
|
|
202
|
-
|
|
203
|
-
|
|
204
|
-
<span class="ruby-identifier">puts</span> <span class="ruby-string">"recreated "</span> <span class="ruby-operator">+</span> <span class="ruby-identifier">state</span>[<span class="ruby-string">"grants"</span>].<span class="ruby-identifier">size</span>.<span class="ruby-identifier">to_s</span> <span class="ruby-operator">+</span> <span class="ruby-string">" account grants"</span>
|
|
590
|
+
<span class="ruby-identifier">puts</span> <span class="ruby-string">"storing "</span> <span class="ruby-operator">+</span> <span class="ruby-identifier">state</span>[<span class="ruby-value">:attachments</span>].<span class="ruby-identifier">size</span>.<span class="ruby-identifier">to_s</span> <span class="ruby-operator">+</span> <span class="ruby-string">" account attachments in state"</span>
|
|
591
|
+
<span class="ruby-identifier">puts</span> <span class="ruby-string">"storing "</span> <span class="ruby-operator">+</span> <span class="ruby-identifier">state</span>[<span class="ruby-value">:grants</span>].<span class="ruby-identifier">size</span>.<span class="ruby-identifier">to_s</span> <span class="ruby-operator">+</span> <span class="ruby-string">" account grants in state"</span>
|
|
205
592
|
|
|
206
|
-
|
|
207
|
-
|
|
593
|
+
<span class="ruby-identifier">state_file</span> = <span class="ruby-constant">File</span>.<span class="ruby-identifier">open</span>(<span class="ruby-string">"state.json"</span>, <span class="ruby-string">"w"</span>)
|
|
594
|
+
<span class="ruby-identifier">state_file</span>.<span class="ruby-identifier">write</span>(<span class="ruby-identifier">state</span>.<span class="ruby-identifier">to_json</span>)
|
|
208
595
|
|
|
209
|
-
|
|
210
|
-
|
|
211
|
-
|
|
212
|
-
<span class="ruby-keyword">
|
|
213
|
-
|
|
214
|
-
<span class="ruby-keyword">return</span> <span class="ruby-value">1</span>
|
|
596
|
+
<span class="ruby-identifier">suspended_count</span> = <span class="ruby-value">0</span>
|
|
597
|
+
<span class="ruby-identifier">users</span> = <span class="ruby-identifier">client</span>.<span class="ruby-identifier">accounts</span>.<span class="ruby-identifier">list</span>(<span class="ruby-string">""</span>)
|
|
598
|
+
<span class="ruby-identifier">users</span>.<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">user</span><span class="ruby-operator">|</span>
|
|
599
|
+
<span class="ruby-keyword">if</span> <span class="ruby-identifier">user</span>.<span class="ruby-identifier">instance_of?</span> <span class="ruby-constant">SDM</span><span class="ruby-operator">::</span><span class="ruby-constant">User</span> <span class="ruby-keyword">and</span> <span class="ruby-identifier">user</span>.<span class="ruby-identifier">email</span> <span class="ruby-operator">==</span> <span class="ruby-identifier">admin_email</span>
|
|
600
|
+
<span class="ruby-keyword">next</span>
|
|
215
601
|
<span class="ruby-keyword">end</span>
|
|
602
|
+
<span class="ruby-identifier">user</span>.<span class="ruby-identifier">suspended</span> = <span class="ruby-keyword">true</span>
|
|
603
|
+
<span class="ruby-keyword">begin</span>
|
|
604
|
+
<span class="ruby-identifier">client</span>.<span class="ruby-identifier">accounts</span>.<span class="ruby-identifier">update</span>(<span class="ruby-identifier">user</span>)
|
|
605
|
+
<span class="ruby-identifier">suspended_count</span> <span class="ruby-operator">+=</span> <span class="ruby-value">1</span>
|
|
606
|
+
<span class="ruby-keyword">rescue</span> <span class="ruby-constant">StandardError</span> <span class="ruby-operator">=></span> <span class="ruby-identifier">ex</span>
|
|
607
|
+
<span class="ruby-identifier">puts</span> <span class="ruby-string">"skipping user "</span> <span class="ruby-operator">+</span> <span class="ruby-identifier">user</span>.<span class="ruby-identifier">id</span> <span class="ruby-operator">+</span> <span class="ruby-string">" on account of error: "</span> <span class="ruby-operator">+</span> <span class="ruby-identifier">ex</span>.<span class="ruby-identifier">to_s</span>
|
|
608
|
+
<span class="ruby-keyword">end</span>
|
|
609
|
+
}
|
|
216
610
|
|
|
217
|
-
|
|
218
|
-
|
|
219
|
-
|
|
220
|
-
|
|
221
|
-
|
|
611
|
+
<span class="ruby-identifier">puts</span> <span class="ruby-string">"suspended "</span> <span class="ruby-operator">+</span> <span class="ruby-identifier">suspended_count</span>.<span class="ruby-identifier">to_s</span> <span class="ruby-operator">+</span> <span class="ruby-string">" users"</span>
|
|
612
|
+
<span class="ruby-keyword">end</span></pre>
|
|
613
|
+
</div>
|
|
614
|
+
|
|
615
|
+
</div>
|
|
222
616
|
|
|
223
|
-
|
|
224
|
-
<span class="ruby-identifier">account_grants</span> = <span class="ruby-identifier">client</span>.<span class="ruby-identifier">account_grants</span>.<span class="ruby-identifier">list</span>(<span class="ruby-string">''</span>)
|
|
617
|
+
|
|
225
618
|
|
|
226
|
-
|
|
227
|
-
|
|
228
|
-
<span class="ruby-keyword">if</span> <span class="ruby-identifier">x</span>.<span class="ruby-identifier">account_id</span> <span class="ruby-operator">!=</span> <span class="ruby-identifier">admin_user_id</span>
|
|
229
|
-
<span class="ruby-identifier">out</span> = {
|
|
230
|
-
<span class="ruby-string">'account_id'</span><span class="ruby-operator">:</span> <span class="ruby-identifier">x</span>.<span class="ruby-identifier">account_id</span>,
|
|
231
|
-
<span class="ruby-string">'role_id'</span><span class="ruby-operator">:</span> <span class="ruby-identifier">x</span>.<span class="ruby-identifier">role_id</span>,
|
|
232
|
-
}
|
|
233
|
-
<span class="ruby-keyword">end</span>
|
|
234
|
-
}.<span class="ruby-identifier">reject</span>{<span class="ruby-operator">|</span><span class="ruby-identifier">x</span><span class="ruby-operator">|</span> <span class="ruby-identifier">x</span> <span class="ruby-operator">==</span> <span class="ruby-keyword">nil</span>},
|
|
235
|
-
<span class="ruby-string">'grants'</span><span class="ruby-operator">:</span> <span class="ruby-identifier">account_grants</span>.<span class="ruby-identifier">map</span>{<span class="ruby-operator">|</span><span class="ruby-identifier">x</span><span class="ruby-operator">|</span>
|
|
236
|
-
<span class="ruby-keyword">if</span> <span class="ruby-identifier">x</span>.<span class="ruby-identifier">account_id</span> <span class="ruby-operator">!=</span> <span class="ruby-identifier">admin_user_id</span> <span class="ruby-keyword">and</span> <span class="ruby-identifier">x</span>.<span class="ruby-identifier">valid_until</span> <span class="ruby-operator">==</span> <span class="ruby-keyword">nil</span>
|
|
237
|
-
<span class="ruby-identifier">out</span> = {
|
|
238
|
-
<span class="ruby-string">'account_id'</span><span class="ruby-operator">:</span> <span class="ruby-identifier">x</span>.<span class="ruby-identifier">account_id</span>,
|
|
239
|
-
<span class="ruby-string">'resource_id'</span><span class="ruby-operator">:</span> <span class="ruby-identifier">x</span>.<span class="ruby-identifier">resource_id</span>,
|
|
240
|
-
}
|
|
241
|
-
<span class="ruby-keyword">end</span>
|
|
242
|
-
}.<span class="ruby-identifier">reject</span>{<span class="ruby-operator">|</span><span class="ruby-identifier">x</span><span class="ruby-operator">|</span> <span class="ruby-identifier">x</span> <span class="ruby-operator">==</span> <span class="ruby-keyword">nil</span>},
|
|
243
|
-
}
|
|
619
|
+
|
|
620
|
+
</div>
|
|
244
621
|
|
|
245
|
-
|
|
246
|
-
|
|
622
|
+
|
|
623
|
+
<div id="method-i-okta_sync" class="method-detail ">
|
|
624
|
+
|
|
625
|
+
<div class="method-heading">
|
|
626
|
+
<span class="method-name">okta_sync</span><span
|
|
627
|
+
class="method-args">()</span>
|
|
628
|
+
|
|
629
|
+
<span class="method-click-advice">click to toggle source</span>
|
|
630
|
+
|
|
631
|
+
</div>
|
|
632
|
+
|
|
247
633
|
|
|
248
|
-
|
|
249
|
-
|
|
634
|
+
<div class="method-description">
|
|
635
|
+
|
|
636
|
+
|
|
637
|
+
|
|
638
|
+
|
|
250
639
|
|
|
251
|
-
|
|
252
|
-
|
|
253
|
-
|
|
254
|
-
|
|
255
|
-
|
|
640
|
+
|
|
641
|
+
<div class="method-source-code" id="okta_sync-source">
|
|
642
|
+
<pre><span class="ruby-comment"># File examples/okta-sync/oktaSync.rb, line 25</span>
|
|
643
|
+
<span class="ruby-keyword">def</span> <span class="ruby-identifier ruby-title">okta_sync</span>
|
|
644
|
+
<span class="ruby-keyword">if</span> <span class="ruby-constant">SDM_API_ACCESS_KEY</span> <span class="ruby-operator">==</span> <span class="ruby-string">""</span> <span class="ruby-operator">||</span> <span class="ruby-constant">SDM_API_SECRET_KEY</span> <span class="ruby-operator">==</span> <span class="ruby-string">""</span> <span class="ruby-operator">||</span> <span class="ruby-constant">OKTA_CLIENT_TOKEN</span> <span class="ruby-operator">==</span> <span class="ruby-string">""</span> <span class="ruby-operator">||</span> <span class="ruby-constant">OKTA_CLIENT_ORGURL</span> <span class="ruby-operator">==</span> <span class="ruby-string">""</span>
|
|
645
|
+
<span class="ruby-identifier">puts</span> <span class="ruby-string">"SDM_API_ACCESS_KEY, SDM_API_SECRET_KEY, OKTA_CLIENT_TOKEN, and OKTA_CLIENT_ORGURL must be set"</span>
|
|
646
|
+
<span class="ruby-identifier">exit</span>
|
|
647
|
+
<span class="ruby-keyword">end</span>
|
|
648
|
+
|
|
649
|
+
<span class="ruby-identifier">report</span> = {
|
|
650
|
+
<span class="ruby-value">:start</span> <span class="ruby-operator">=></span> <span class="ruby-constant">Time</span>.<span class="ruby-identifier">now</span>,
|
|
651
|
+
|
|
652
|
+
<span class="ruby-value">:oktaUsersCount</span> <span class="ruby-operator">=></span> <span class="ruby-value">0</span>,
|
|
653
|
+
<span class="ruby-value">:oktaUsers</span> <span class="ruby-operator">=></span> [],
|
|
654
|
+
|
|
655
|
+
<span class="ruby-value">:sdmUsersCount</span> <span class="ruby-operator">=></span> <span class="ruby-value">0</span>,
|
|
656
|
+
<span class="ruby-value">:sdmUsers</span> <span class="ruby-operator">=></span> [],
|
|
657
|
+
|
|
658
|
+
<span class="ruby-value">:bothUsersCount</span> <span class="ruby-operator">=></span> <span class="ruby-value">0</span>,
|
|
659
|
+
|
|
660
|
+
<span class="ruby-value">:sdmResourcesCount</span> <span class="ruby-operator">=></span> <span class="ruby-value">0</span>,
|
|
661
|
+
<span class="ruby-value">:sdmResources</span> <span class="ruby-operator">=></span> {},
|
|
662
|
+
|
|
663
|
+
<span class="ruby-value">:permissionsGranted</span> <span class="ruby-operator">=></span> <span class="ruby-value">0</span>,
|
|
664
|
+
<span class="ruby-value">:permissionsRevoked</span> <span class="ruby-operator">=></span> <span class="ruby-value">0</span>,
|
|
665
|
+
<span class="ruby-value">:grants</span> <span class="ruby-operator">=></span> [],
|
|
666
|
+
<span class="ruby-value">:revocations</span> <span class="ruby-operator">=></span> [],
|
|
667
|
+
|
|
668
|
+
<span class="ruby-value">:matchers</span> <span class="ruby-operator">=></span> {},
|
|
669
|
+
}
|
|
670
|
+
|
|
671
|
+
<span class="ruby-identifier">plan</span> = <span class="ruby-keyword">false</span>
|
|
672
|
+
<span class="ruby-identifier">verbose</span> = <span class="ruby-keyword">false</span>
|
|
673
|
+
<span class="ruby-constant">OptionParser</span>.<span class="ruby-identifier">new</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">opts</span><span class="ruby-operator">|</span>
|
|
674
|
+
<span class="ruby-identifier">opts</span>.<span class="ruby-identifier">banner</span> = <span class="ruby-string">"Usage oktaSync.rb [options]"</span>
|
|
675
|
+
<span class="ruby-identifier">opts</span>.<span class="ruby-identifier">on</span>(<span class="ruby-string">"-p"</span>, <span class="ruby-string">"--plan"</span>, <span class="ruby-string">"calculate changes but do not apply them"</span>) <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">p</span><span class="ruby-operator">|</span>
|
|
676
|
+
<span class="ruby-identifier">plan</span> = <span class="ruby-identifier">p</span>
|
|
677
|
+
<span class="ruby-keyword">end</span>
|
|
678
|
+
<span class="ruby-identifier">opts</span>.<span class="ruby-identifier">on</span>(<span class="ruby-string">"-v"</span>, <span class="ruby-string">"--verbose"</span>, <span class="ruby-string">"print detailed report"</span>) <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">v</span><span class="ruby-operator">|</span>
|
|
679
|
+
<span class="ruby-identifier">verbose</span> = <span class="ruby-identifier">v</span>
|
|
680
|
+
<span class="ruby-keyword">end</span>
|
|
681
|
+
<span class="ruby-keyword">end</span>.<span class="ruby-identifier">parse!</span>
|
|
682
|
+
|
|
683
|
+
<span class="ruby-identifier">client</span> = <span class="ruby-constant">SDM</span><span class="ruby-operator">::</span><span class="ruby-constant">Client</span>.<span class="ruby-identifier">new</span>(<span class="ruby-constant">SDM_API_ACCESS_KEY</span>, <span class="ruby-constant">SDM_API_SECRET_KEY</span>)
|
|
684
|
+
<span class="ruby-identifier">okta_client</span> = <span class="ruby-constant">Oktakit</span>.<span class="ruby-identifier">new</span>(<span class="ruby-value">token:</span> <span class="ruby-constant">OKTA_CLIENT_TOKEN</span>, <span class="ruby-value">api_endpoint:</span> <span class="ruby-constant">OKTA_CLIENT_ORGURL</span> <span class="ruby-operator">+</span> <span class="ruby-string">"/api/v1"</span>)
|
|
685
|
+
<span class="ruby-identifier">matchers</span> = <span class="ruby-constant">YAML</span>.<span class="ruby-identifier">load</span>(<span class="ruby-constant">File</span>.<span class="ruby-identifier">read</span>(<span class="ruby-string">"matchers.yml"</span>))
|
|
686
|
+
<span class="ruby-identifier">report</span>[<span class="ruby-value">:matchers</span>] = <span class="ruby-identifier">matchers</span>
|
|
687
|
+
|
|
688
|
+
<span class="ruby-identifier">all_users</span> = <span class="ruby-identifier">okta_client</span>.<span class="ruby-identifier">list_users</span>({
|
|
689
|
+
<span class="ruby-value">'query':</span> {
|
|
690
|
+
<span class="ruby-value">'search':</span> <span class="ruby-string">"profile.department eq \"Engineering\" and (status eq \"ACTIVE\")"</span>,
|
|
691
|
+
},
|
|
692
|
+
})
|
|
693
|
+
|
|
694
|
+
<span class="ruby-identifier">okta_users</span> = <span class="ruby-constant">Array</span>.<span class="ruby-identifier">new</span>()
|
|
695
|
+
<span class="ruby-identifier">all_users</span>[<span class="ruby-value">0</span>].<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">u</span><span class="ruby-operator">|</span>
|
|
696
|
+
<span class="ruby-identifier">groups</span> = <span class="ruby-identifier">okta_client</span>.<span class="ruby-identifier">get_member_groups</span>(<span class="ruby-identifier">u</span>.<span class="ruby-identifier">id</span>)
|
|
697
|
+
<span class="ruby-identifier">group_names</span> = <span class="ruby-constant">Array</span>.<span class="ruby-identifier">new</span>()
|
|
698
|
+
<span class="ruby-identifier">groups</span>[<span class="ruby-value">0</span>].<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">ug</span><span class="ruby-operator">|</span>
|
|
699
|
+
<span class="ruby-identifier">group_names</span>.<span class="ruby-identifier">push</span>(<span class="ruby-identifier">ug</span>.<span class="ruby-identifier">profile</span>.<span class="ruby-identifier">name</span>)
|
|
700
|
+
}
|
|
701
|
+
<span class="ruby-identifier">okta_users</span>.<span class="ruby-identifier">push</span>({ <span class="ruby-value">:login</span> <span class="ruby-operator">=></span> <span class="ruby-identifier">u</span>.<span class="ruby-identifier">profile</span>.<span class="ruby-identifier">login</span>, <span class="ruby-value">:first_name</span> <span class="ruby-operator">=></span> <span class="ruby-identifier">u</span>.<span class="ruby-identifier">profile</span>.<span class="ruby-identifier">firstName</span>, <span class="ruby-value">:last_name</span> <span class="ruby-operator">=></span> <span class="ruby-identifier">u</span>.<span class="ruby-identifier">profile</span>.<span class="ruby-constant">LastName</span>, <span class="ruby-value">:groups</span> <span class="ruby-operator">=></span> <span class="ruby-identifier">group_names</span> })
|
|
702
|
+
}
|
|
703
|
+
<span class="ruby-identifier">report</span>[<span class="ruby-value">:oktaUsers</span>] = <span class="ruby-identifier">okta_users</span>
|
|
704
|
+
<span class="ruby-identifier">report</span>[<span class="ruby-value">:oktaUsersCount</span>] = <span class="ruby-identifier">okta_users</span>.<span class="ruby-identifier">size</span>
|
|
705
|
+
|
|
706
|
+
<span class="ruby-identifier">accounts</span> = <span class="ruby-identifier">client</span>.<span class="ruby-identifier">accounts</span>.<span class="ruby-identifier">list</span>(<span class="ruby-string">"type:user"</span>).<span class="ruby-identifier">map</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">a</span><span class="ruby-operator">|</span> [<span class="ruby-identifier">a</span>.<span class="ruby-identifier">email</span>, <span class="ruby-identifier">a</span>] }.<span class="ruby-identifier">to_h</span>
|
|
707
|
+
<span class="ruby-identifier">report</span>[<span class="ruby-value">:sdmUsers</span>] = <span class="ruby-identifier">accounts</span>
|
|
708
|
+
<span class="ruby-identifier">report</span>[<span class="ruby-value">:sdmUsersCount</span>] = <span class="ruby-identifier">accounts</span>.<span class="ruby-identifier">size</span>
|
|
709
|
+
<span class="ruby-identifier">grants</span> = <span class="ruby-identifier">client</span>.<span class="ruby-identifier">account_grants</span>.<span class="ruby-identifier">list</span>(<span class="ruby-string">""</span>).<span class="ruby-identifier">map</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">ag</span><span class="ruby-operator">|</span> <span class="ruby-identifier">ag</span> }
|
|
710
|
+
|
|
711
|
+
<span class="ruby-identifier">current</span> = {}
|
|
712
|
+
<span class="ruby-identifier">grants</span>.<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">g</span><span class="ruby-operator">|</span>
|
|
713
|
+
<span class="ruby-identifier">current</span>[<span class="ruby-identifier">g</span>.<span class="ruby-identifier">account_id</span>] = [] <span class="ruby-keyword">if</span> <span class="ruby-keyword">not</span> <span class="ruby-identifier">current</span>[<span class="ruby-identifier">g</span>.<span class="ruby-identifier">account_id</span>]
|
|
714
|
+
<span class="ruby-identifier">current</span>[<span class="ruby-identifier">g</span>.<span class="ruby-identifier">account_id</span>].<span class="ruby-identifier">push</span>({ <span class="ruby-value">:resource_id</span> <span class="ruby-operator">=></span> <span class="ruby-identifier">g</span>.<span class="ruby-identifier">resource_id</span>, <span class="ruby-value">:id</span> <span class="ruby-operator">=></span> <span class="ruby-identifier">g</span>.<span class="ruby-identifier">id</span> })
|
|
715
|
+
}
|
|
716
|
+
|
|
717
|
+
<span class="ruby-identifier">desired</span> = {}
|
|
718
|
+
<span class="ruby-identifier">overlapping</span> = <span class="ruby-value">0</span>
|
|
719
|
+
<span class="ruby-identifier">matchers</span>[<span class="ruby-string">"groups"</span>].<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">group</span><span class="ruby-operator">|</span>
|
|
720
|
+
<span class="ruby-identifier">group</span>[<span class="ruby-string">"resources"</span>].<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">resourceQuery</span><span class="ruby-operator">|</span>
|
|
721
|
+
<span class="ruby-identifier">client</span>.<span class="ruby-identifier">resources</span>.<span class="ruby-identifier">list</span>(<span class="ruby-identifier">resourceQuery</span>).<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">res</span><span class="ruby-operator">|</span>
|
|
722
|
+
<span class="ruby-identifier">report</span>[<span class="ruby-value">:sdmResources</span>][<span class="ruby-identifier">res</span>.<span class="ruby-identifier">id</span>] = <span class="ruby-identifier">res</span>
|
|
723
|
+
<span class="ruby-identifier">okta_users</span>.<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">u</span><span class="ruby-operator">|</span>
|
|
724
|
+
<span class="ruby-keyword">if</span> <span class="ruby-identifier">u</span>[<span class="ruby-value">:groups</span>].<span class="ruby-identifier">include?</span> <span class="ruby-identifier">group</span>[<span class="ruby-string">"name"</span>]
|
|
725
|
+
<span class="ruby-identifier">account</span> = <span class="ruby-identifier">accounts</span>[<span class="ruby-identifier">u</span>[<span class="ruby-value">:login</span>]]
|
|
726
|
+
<span class="ruby-keyword">if</span> <span class="ruby-identifier">account</span> <span class="ruby-operator">!=</span> <span class="ruby-keyword">nil</span>
|
|
727
|
+
<span class="ruby-identifier">overlapping</span> <span class="ruby-operator">+=</span> <span class="ruby-value">1</span>
|
|
728
|
+
<span class="ruby-identifier">desired</span>[<span class="ruby-identifier">account</span>.<span class="ruby-identifier">id</span>] = [] <span class="ruby-keyword">if</span> <span class="ruby-keyword">not</span> <span class="ruby-identifier">desired</span>[<span class="ruby-identifier">account</span>.<span class="ruby-identifier">id</span>]
|
|
729
|
+
<span class="ruby-identifier">desired</span>[<span class="ruby-identifier">account</span>.<span class="ruby-identifier">id</span>].<span class="ruby-identifier">push</span>(<span class="ruby-identifier">res</span>.<span class="ruby-identifier">id</span>)
|
|
730
|
+
<span class="ruby-keyword">end</span>
|
|
731
|
+
<span class="ruby-keyword">end</span>
|
|
732
|
+
}
|
|
733
|
+
}
|
|
734
|
+
}
|
|
735
|
+
}
|
|
736
|
+
<span class="ruby-identifier">report</span>[<span class="ruby-value">:bothUsersCount</span>] = <span class="ruby-identifier">overlapping</span>
|
|
737
|
+
<span class="ruby-identifier">report</span>[<span class="ruby-value">:sdmResourcesCount</span>] = <span class="ruby-identifier">report</span>[<span class="ruby-value">:sdmResources</span>].<span class="ruby-identifier">size</span>
|
|
738
|
+
|
|
739
|
+
<span class="ruby-identifier">revocations</span> = <span class="ruby-value">0</span>
|
|
740
|
+
<span class="ruby-identifier">current</span>.<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">aid</span>, <span class="ruby-identifier">curRes</span><span class="ruby-operator">|</span>
|
|
741
|
+
<span class="ruby-identifier">desRes</span> = <span class="ruby-identifier">desired</span>[<span class="ruby-identifier">aid</span>]
|
|
742
|
+
<span class="ruby-identifier">desRes</span> = [] <span class="ruby-keyword">if</span> <span class="ruby-keyword">not</span> <span class="ruby-identifier">desired</span>[<span class="ruby-identifier">aid</span>]
|
|
743
|
+
<span class="ruby-identifier">curRes</span>.<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">r</span><span class="ruby-operator">|</span>
|
|
744
|
+
<span class="ruby-keyword">if</span> <span class="ruby-keyword">not</span>(<span class="ruby-identifier">desRes</span>.<span class="ruby-identifier">include?</span> <span class="ruby-identifier">r</span>[<span class="ruby-value">:resource_id</span>])
|
|
745
|
+
<span class="ruby-keyword">if</span> <span class="ruby-identifier">plan</span>
|
|
746
|
+
<span class="ruby-identifier">puts</span> <span class="ruby-string">"Plan: revoke %s from user %s\n"</span> <span class="ruby-operator">%</span> [<span class="ruby-identifier">r</span>[<span class="ruby-value">:resource_id</span>], <span class="ruby-identifier">aid</span>]
|
|
747
|
+
<span class="ruby-keyword">else</span>
|
|
748
|
+
<span class="ruby-identifier">client</span>.<span class="ruby-identifier">account_grants</span>.<span class="ruby-identifier">delete</span>(<span class="ruby-identifier">r</span>[<span class="ruby-value">:id</span>])
|
|
256
749
|
<span class="ruby-keyword">end</span>
|
|
257
|
-
<span class="ruby-identifier">
|
|
258
|
-
<span class="ruby-
|
|
259
|
-
|
|
260
|
-
|
|
261
|
-
|
|
262
|
-
|
|
750
|
+
<span class="ruby-identifier">report</span>[<span class="ruby-value">:revocations</span>].<span class="ruby-identifier">push</span>(<span class="ruby-identifier">r</span>[<span class="ruby-value">:id</span>])
|
|
751
|
+
<span class="ruby-identifier">revocations</span> <span class="ruby-operator">+=</span> <span class="ruby-value">1</span>
|
|
752
|
+
<span class="ruby-keyword">end</span>
|
|
753
|
+
}
|
|
754
|
+
}
|
|
755
|
+
<span class="ruby-identifier">report</span>[<span class="ruby-value">:permissionsRevoked</span>] = <span class="ruby-identifier">revocations</span>
|
|
756
|
+
|
|
757
|
+
<span class="ruby-identifier">grants</span> = <span class="ruby-value">0</span>
|
|
758
|
+
<span class="ruby-identifier">desired</span>.<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">aid</span>, <span class="ruby-identifier">desRes</span><span class="ruby-operator">|</span>
|
|
759
|
+
<span class="ruby-identifier">curRes</span> = <span class="ruby-identifier">current</span>[<span class="ruby-identifier">aid</span>]
|
|
760
|
+
<span class="ruby-identifier">curRes</span> = [] <span class="ruby-keyword">if</span> <span class="ruby-keyword">not</span> <span class="ruby-identifier">current</span>[<span class="ruby-identifier">aid</span>]
|
|
761
|
+
<span class="ruby-identifier">desRes</span>.<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">r</span><span class="ruby-operator">|</span>
|
|
762
|
+
<span class="ruby-keyword">if</span> <span class="ruby-keyword">not</span>(<span class="ruby-identifier">curRes</span>.<span class="ruby-identifier">map</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">c</span><span class="ruby-operator">|</span> <span class="ruby-identifier">c</span>[<span class="ruby-value">:resource_id</span>] }.<span class="ruby-identifier">include?</span> <span class="ruby-identifier">r</span>)
|
|
763
|
+
<span class="ruby-identifier">ag</span> = <span class="ruby-constant">SDM</span><span class="ruby-operator">::</span><span class="ruby-constant">AccountGrant</span>.<span class="ruby-identifier">new</span>()
|
|
764
|
+
<span class="ruby-identifier">ag</span>.<span class="ruby-identifier">account_id</span> = <span class="ruby-identifier">aid</span>
|
|
765
|
+
<span class="ruby-identifier">ag</span>.<span class="ruby-identifier">resource_id</span> = <span class="ruby-identifier">r</span>
|
|
766
|
+
<span class="ruby-keyword">if</span> <span class="ruby-identifier">plan</span>
|
|
767
|
+
<span class="ruby-identifier">puts</span> <span class="ruby-string">"Plan: grant %s to user %s\n"</span> <span class="ruby-operator">%</span> [<span class="ruby-identifier">r</span>, <span class="ruby-identifier">aid</span>]
|
|
768
|
+
<span class="ruby-keyword">else</span>
|
|
769
|
+
<span class="ruby-identifier">client</span>.<span class="ruby-identifier">account_grants</span>.<span class="ruby-identifier">create</span>(<span class="ruby-identifier">ag</span>)
|
|
263
770
|
<span class="ruby-keyword">end</span>
|
|
771
|
+
<span class="ruby-identifier">report</span>[<span class="ruby-value">:grants</span>].<span class="ruby-identifier">push</span>(<span class="ruby-identifier">ag</span>)
|
|
772
|
+
<span class="ruby-identifier">grants</span> <span class="ruby-operator">+=</span> <span class="ruby-value">1</span>
|
|
773
|
+
<span class="ruby-keyword">end</span>
|
|
264
774
|
}
|
|
775
|
+
}
|
|
776
|
+
<span class="ruby-identifier">report</span>[<span class="ruby-value">:permissionsGranted</span>] = <span class="ruby-identifier">grants</span>
|
|
265
777
|
|
|
266
|
-
|
|
778
|
+
<span class="ruby-identifier">report</span>[<span class="ruby-value">:complete</span>] = <span class="ruby-constant">Time</span>.<span class="ruby-identifier">now</span>
|
|
267
779
|
|
|
780
|
+
<span class="ruby-keyword">if</span> <span class="ruby-identifier">verbose</span>
|
|
781
|
+
<span class="ruby-identifier">puts</span> <span class="ruby-identifier">report</span>.<span class="ruby-identifier">to_json</span>
|
|
782
|
+
<span class="ruby-keyword">else</span>
|
|
783
|
+
<span class="ruby-identifier">puts</span> <span class="ruby-string">"%d Okta users, %d strongDM users, %d overlapping users, %d grants, %d revocations"</span> <span class="ruby-operator">%</span> [<span class="ruby-identifier">okta_users</span>.<span class="ruby-identifier">size</span>, <span class="ruby-identifier">accounts</span>.<span class="ruby-identifier">size</span>, <span class="ruby-identifier">overlapping</span>, <span class="ruby-identifier">grants</span>, <span class="ruby-identifier">revocations</span>]
|
|
784
|
+
<span class="ruby-keyword">end</span>
|
|
268
785
|
<span class="ruby-keyword">end</span></pre>
|
|
269
786
|
</div>
|
|
270
787
|
|
|
@@ -279,12 +796,13 @@ revert
|
|
|
279
796
|
</section>
|
|
280
797
|
|
|
281
798
|
</section>
|
|
799
|
+
|
|
282
800
|
</main>
|
|
283
801
|
|
|
284
802
|
|
|
285
803
|
<footer id="validator-badges" role="contentinfo">
|
|
286
|
-
<p><a href="
|
|
287
|
-
<p>Generated by <a href="
|
|
804
|
+
<p><a href="https://validator.w3.org/check/referer">Validate</a>
|
|
805
|
+
<p>Generated by <a href="https://ruby.github.io/rdoc/">RDoc</a> 6.1.2.
|
|
288
806
|
<p>Based on <a href="http://deveiate.org/projects/Darkfish-RDoc/">Darkfish</a> by <a href="http://deveiate.org">Michael Granger</a>.
|
|
289
807
|
</footer>
|
|
290
808
|
|