strongdm 1.0.2 → 1.0.3
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/doc/LICENSE.html +6 -5
- data/doc/Object.html +16 -16
- data/doc/README_md.html +6 -5
- data/doc/SDM/AKS.html +27 -6
- data/doc/SDM/AKSBasicAuth.html +27 -6
- data/doc/SDM/AKSServiceAccount.html +27 -6
- data/doc/SDM/AccountAttachment.html +6 -3
- data/doc/SDM/AccountAttachmentCreateOptions.html +6 -3
- data/doc/SDM/AccountAttachmentCreateResponse.html +6 -3
- data/doc/SDM/AccountAttachmentDeleteResponse.html +6 -3
- data/doc/SDM/AccountAttachmentGetResponse.html +6 -3
- data/doc/SDM/AccountAttachments.html +24 -21
- data/doc/SDM/AccountCreateResponse.html +6 -3
- data/doc/SDM/AccountDeleteResponse.html +6 -3
- data/doc/SDM/AccountGetResponse.html +6 -3
- data/doc/SDM/AccountGrant.html +6 -3
- data/doc/SDM/AccountGrantCreateResponse.html +6 -3
- data/doc/SDM/AccountGrantDeleteResponse.html +6 -3
- data/doc/SDM/AccountGrantGetResponse.html +6 -3
- data/doc/SDM/AccountGrants.html +24 -21
- data/doc/SDM/AccountUpdateResponse.html +6 -3
- data/doc/SDM/Accounts.html +29 -26
- data/doc/SDM/AlreadyExistsError.html +6 -3
- data/doc/SDM/AmazonEKS.html +27 -6
- data/doc/SDM/AmazonES.html +27 -6
- data/doc/SDM/Athena.html +27 -6
- data/doc/SDM/AuroraMysql.html +27 -6
- data/doc/SDM/AuroraPostgres.html +27 -6
- data/doc/SDM/AuthenticationError.html +6 -3
- data/doc/SDM/BadRequestError.html +6 -3
- data/doc/SDM/BigQuery.html +27 -6
- data/doc/SDM/Cassandra.html +27 -6
- data/doc/SDM/Client.html +7 -4
- data/doc/SDM/Clustrix.html +27 -6
- data/doc/SDM/Cockroach.html +27 -6
- data/doc/SDM/CreateResponseMetadata.html +6 -3
- data/doc/SDM/DeadlineExceededError.html +6 -3
- data/doc/SDM/DeleteResponseMetadata.html +6 -3
- data/doc/SDM/Druid.html +27 -6
- data/doc/SDM/DynamoDB.html +27 -6
- data/doc/SDM/Elastic.html +27 -6
- data/doc/SDM/ElasticacheRedis.html +27 -6
- data/doc/SDM/Gateway.html +8 -5
- data/doc/SDM/GetResponseMetadata.html +6 -3
- data/doc/SDM/GoogleGKE.html +27 -6
- data/doc/SDM/Greenplum.html +27 -6
- data/doc/SDM/HTTPAuth.html +27 -6
- data/doc/SDM/HTTPBasicAuth.html +27 -6
- data/doc/SDM/HTTPNoAuth.html +27 -6
- data/doc/SDM/InternalError.html +6 -3
- data/doc/SDM/Kubernetes.html +27 -6
- data/doc/SDM/KubernetesBasicAuth.html +27 -6
- data/doc/SDM/KubernetesServiceAccount.html +27 -6
- data/doc/SDM/Maria.html +27 -6
- data/doc/SDM/Memcached.html +27 -6
- data/doc/SDM/Memsql.html +27 -6
- data/doc/SDM/MongoHost.html +27 -6
- data/doc/SDM/MongoLegacyHost.html +27 -6
- data/doc/SDM/MongoLegacyReplicaset.html +27 -6
- data/doc/SDM/MongoReplicaSet.html +27 -6
- data/doc/SDM/Mysql.html +27 -6
- data/doc/SDM/NodeCreateResponse.html +8 -5
- data/doc/SDM/NodeDeleteResponse.html +8 -5
- data/doc/SDM/NodeGetResponse.html +8 -5
- data/doc/SDM/NodeUpdateResponse.html +8 -5
- data/doc/SDM/Nodes.html +29 -26
- data/doc/SDM/NotFoundError.html +6 -3
- data/doc/SDM/Oracle.html +27 -6
- data/doc/SDM/PermissionError.html +6 -3
- data/doc/SDM/Plumbing.html +3701 -3523
- data/doc/SDM/Postgres.html +27 -6
- data/doc/SDM/Presto.html +27 -6
- data/doc/SDM/RDP.html +27 -6
- data/doc/SDM/RPCError.html +6 -3
- data/doc/SDM/RateLimitError.html +6 -3
- data/doc/SDM/RateLimitMetadata.html +6 -3
- data/doc/SDM/Redis.html +27 -6
- data/doc/SDM/Redshift.html +27 -6
- data/doc/SDM/Relay.html +8 -5
- data/doc/SDM/ResourceCreateResponse.html +8 -5
- data/doc/SDM/ResourceDeleteResponse.html +8 -5
- data/doc/SDM/ResourceGetResponse.html +8 -5
- data/doc/SDM/ResourceUpdateResponse.html +8 -5
- data/doc/SDM/Resources.html +28 -25
- data/doc/SDM/Role.html +8 -5
- data/doc/SDM/RoleAttachment.html +8 -5
- data/doc/SDM/RoleAttachmentCreateResponse.html +8 -5
- data/doc/SDM/RoleAttachmentDeleteResponse.html +8 -5
- data/doc/SDM/RoleAttachmentGetResponse.html +8 -5
- data/doc/SDM/RoleAttachments.html +23 -20
- data/doc/SDM/RoleCreateResponse.html +8 -5
- data/doc/SDM/RoleDeleteResponse.html +8 -5
- data/doc/SDM/RoleGetResponse.html +8 -5
- data/doc/SDM/RoleGrant.html +8 -5
- data/doc/SDM/RoleGrantCreateResponse.html +8 -5
- data/doc/SDM/RoleGrantDeleteResponse.html +8 -5
- data/doc/SDM/RoleGrantGetResponse.html +8 -5
- data/doc/SDM/RoleGrants.html +23 -20
- data/doc/SDM/RoleUpdateResponse.html +8 -5
- data/doc/SDM/Roles.html +28 -25
- data/doc/SDM/SQLServer.html +27 -6
- data/doc/SDM/SSH.html +27 -6
- data/doc/SDM/Service.html +6 -3
- data/doc/SDM/Snowflake.html +27 -6
- data/doc/SDM/Sybase.html +27 -6
- data/doc/SDM/SybaseIQ.html +27 -6
- data/doc/SDM/Teradata.html +27 -6
- data/doc/SDM/UpdateResponseMetadata.html +6 -3
- data/doc/SDM/User.html +6 -3
- data/doc/SDM.html +6 -3
- data/doc/V1/AccountAttachments/Service.html +6 -3
- data/doc/V1/AccountAttachments.html +6 -3
- data/doc/V1/AccountGrants/Service.html +7 -4
- data/doc/V1/AccountGrants.html +6 -3
- data/doc/V1/Accounts/Service.html +6 -3
- data/doc/V1/Accounts.html +6 -3
- data/doc/V1/Nodes/Service.html +6 -3
- data/doc/V1/Nodes.html +6 -3
- data/doc/V1/Resources/Service.html +6 -3
- data/doc/V1/Resources.html +6 -3
- data/doc/V1/RoleAttachments/Service.html +6 -3
- data/doc/V1/RoleAttachments.html +6 -3
- data/doc/V1/RoleGrants/Service.html +6 -3
- data/doc/V1/RoleGrants.html +6 -3
- data/doc/V1/Roles/Service.html +6 -3
- data/doc/V1/Roles.html +6 -3
- data/doc/V1/Tags.html +113 -0
- data/doc/V1.html +16 -3
- data/doc/created.rid +34 -35
- data/doc/css/rdoc.css +35 -6
- data/doc/examples/Gemfile.html +6 -5
- data/doc/examples/Gemfile_lock.html +6 -5
- data/doc/examples/README_md.html +6 -5
- data/doc/examples/okta-sync/Gemfile.html +6 -5
- data/doc/examples/okta-sync/Gemfile_lock.html +6 -5
- data/doc/index.html +8 -5
- data/doc/js/darkfish.js +22 -99
- data/doc/js/navigation.js +4 -40
- data/doc/js/navigation.js.gz +0 -0
- data/doc/js/search.js +32 -31
- data/doc/js/search_index.js +1 -1
- data/doc/js/search_index.js.gz +0 -0
- data/doc/js/searcher.js +6 -6
- data/doc/js/searcher.js.gz +0 -0
- data/doc/lib/version.html +6 -5
- data/doc/table_of_contents.html +927 -914
- data/examples/Gemfile +2 -2
- data/examples/listUsers.rb +4 -4
- data/examples/okta-sync/oktaSync.rb +17 -59
- data/examples/panicButton.rb +4 -46
- data/lib/errors/errors.rb +53 -55
- data/lib/grpc/account_attachments_pb.rb +9 -9
- data/lib/grpc/account_attachments_services_pb.rb +8 -7
- data/lib/grpc/account_grants_pb.rb +10 -10
- data/lib/grpc/account_grants_services_pb.rb +9 -8
- data/lib/grpc/accounts_pb.rb +9 -9
- data/lib/grpc/accounts_services_pb.rb +8 -7
- data/lib/grpc/drivers_pb.rb +52 -7
- data/lib/grpc/nodes_pb.rb +9 -9
- data/lib/grpc/nodes_services_pb.rb +8 -7
- data/lib/grpc/options_pb.rb +14 -5
- data/lib/grpc/plumbing.rb +4200 -4085
- data/lib/grpc/protoc-gen-swagger/options/annotations_pb.rb +4 -4
- data/lib/grpc/resources_pb.rb +9 -9
- data/lib/grpc/resources_services_pb.rb +8 -7
- data/lib/grpc/role_attachments_pb.rb +9 -9
- data/lib/grpc/role_attachments_services_pb.rb +8 -7
- data/lib/grpc/role_grants_pb.rb +9 -9
- data/lib/grpc/role_grants_services_pb.rb +8 -7
- data/lib/grpc/roles_pb.rb +9 -9
- data/lib/grpc/roles_services_pb.rb +8 -7
- data/lib/grpc/spec_pb.rb +8 -8
- data/lib/grpc/tags_pb.rb +36 -0
- data/lib/models/porcelain.rb +4941 -4415
- data/lib/strongdm.rb +95 -94
- data/lib/svc.rb +1224 -1202
- data/lib/version.rb +5 -5
- data/strongdm.gemspec +10 -10
- metadata +4 -2
data/lib/strongdm.rb
CHANGED
@@ -1,17 +1,17 @@
|
|
1
1
|
# Copyright 2020 StrongDM Inc
|
2
|
-
#
|
2
|
+
#
|
3
3
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
4
4
|
# you may not use this file except in compliance with the License.
|
5
5
|
# You may obtain a copy of the License at
|
6
|
-
#
|
6
|
+
#
|
7
7
|
# http://www.apache.org/licenses/LICENSE-2.0
|
8
|
-
#
|
8
|
+
#
|
9
9
|
# Unless required by applicable law or agreed to in writing, software
|
10
10
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
11
11
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
12
12
|
# See the License for the specific language governing permissions and
|
13
13
|
# limitations under the License.
|
14
|
-
#
|
14
|
+
#
|
15
15
|
|
16
16
|
# This file was generated by protogen. DO NOT EDIT.
|
17
17
|
|
@@ -25,103 +25,104 @@ DEFAULT_MAX_RETRY_DELAY = 300 # 300 seconds
|
|
25
25
|
|
26
26
|
module SDM
|
27
27
|
|
28
|
-
|
29
|
-
|
30
|
-
|
31
|
-
|
32
|
-
|
33
|
-
|
34
|
-
|
35
|
-
|
36
|
-
|
37
|
-
|
38
|
-
|
39
|
-
|
40
|
-
|
41
|
-
|
42
|
-
|
43
|
-
|
44
|
-
|
45
|
-
|
46
|
-
|
28
|
+
# Client bundles all the services together and initializes them.
|
29
|
+
class Client
|
30
|
+
# Creates a new strongDM API client.
|
31
|
+
def initialize(api_access_key, api_secret_key, host:"api.strongdm.com:443", insecure:false)
|
32
|
+
@api_access_key = api_access_key
|
33
|
+
@api_secret_key = Base64.strict_decode64(api_secret_key)
|
34
|
+
@max_retries = DEFAULT_MAX_RETRIES
|
35
|
+
@base_retry_delay = DEFAULT_BASE_RETRY_DELAY
|
36
|
+
@max_retry_delay = DEFAULT_MAX_RETRY_DELAY
|
37
|
+
@account_attachments = AccountAttachments.new(host, insecure, self)
|
38
|
+
@account_grants = AccountGrants.new(host, insecure, self)
|
39
|
+
@accounts = Accounts.new(host, insecure, self)
|
40
|
+
@nodes = Nodes.new(host, insecure, self)
|
41
|
+
@resources = Resources.new(host, insecure, self)
|
42
|
+
@role_attachments = RoleAttachments.new(host, insecure, self)
|
43
|
+
@role_grants = RoleGrants.new(host, insecure, self)
|
44
|
+
@roles = Roles.new(host, insecure, self)
|
45
|
+
@_test_options = Hash.new
|
46
|
+
end
|
47
47
|
|
48
|
-
|
49
|
-
|
50
|
-
|
48
|
+
def get_metadata(method_name, req)
|
49
|
+
return { 'x-sdm-authentication': @api_access_key,'x-sdm-signature': self.sign(method_name, req.to_proto)}
|
50
|
+
end
|
51
51
|
|
52
|
-
|
53
|
-
|
54
|
-
|
52
|
+
def sign(method_name, msg_bytes)
|
53
|
+
current_utc_date = Time.now.utc
|
54
|
+
date = sprintf("%04d-%02d-%02d",current_utc_date.year, current_utc_date.month, current_utc_date.day)
|
55
55
|
|
56
|
-
|
57
|
-
|
56
|
+
signing_key = OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, @api_secret_key, date)
|
57
|
+
signing_key = OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, signing_key, 'sdm_api_v1')
|
58
58
|
|
59
|
-
|
60
|
-
|
61
|
-
|
62
|
-
|
63
|
-
|
59
|
+
sha_req = Digest::SHA256.new
|
60
|
+
sha_req << method_name
|
61
|
+
sha_req << "\n"
|
62
|
+
sha_req << msg_bytes
|
63
|
+
request_hash = sha_req.digest
|
64
64
|
|
65
|
-
|
66
|
-
|
65
|
+
return Base64.strict_encode64(OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, signing_key, request_hash))
|
66
|
+
end
|
67
67
|
|
68
|
-
|
69
|
-
|
70
|
-
|
71
|
-
|
72
|
-
|
73
|
-
|
74
|
-
|
75
|
-
|
68
|
+
def jitterSleep(iter)
|
69
|
+
dur_max = @base_retry_delay * 2**iter
|
70
|
+
if (dur_max > @max_retry_delay)
|
71
|
+
dur_max = @max_retry_delay
|
72
|
+
end
|
73
|
+
dur = rand() * dur_max
|
74
|
+
sleep(dur)
|
75
|
+
end
|
76
|
+
|
77
|
+
def shouldRetry(iter, err)
|
78
|
+
if (iter >= @max_retries-1)
|
79
|
+
return false
|
80
|
+
end
|
81
|
+
if not err .is_a? GRPC::BadStatus
|
82
|
+
return true
|
83
|
+
end
|
84
|
+
return err.code() == 13
|
85
|
+
end
|
86
|
+
|
87
|
+
attr_reader :max_retries
|
88
|
+
attr_reader :base_retry_delay
|
89
|
+
attr_reader :max_retry_delay
|
90
|
+
|
91
|
+
# API authentication token (read-only).
|
92
|
+
attr_reader :api_access_key
|
93
|
+
# AccountAttachments assign an account to a role.
|
94
|
+
attr_reader :account_attachments
|
95
|
+
# AccountGrants assign a resource directly to an account, giving the account the permission to connect to that resource.
|
96
|
+
attr_reader :account_grants
|
97
|
+
# Accounts are users that have access to strongDM.
|
98
|
+
# There are two types of accounts:
|
99
|
+
# 1. **Regular users:** humans who are authenticated through username and password or SSO
|
100
|
+
# 2. **Service users:** machines that are authneticated using a service token
|
101
|
+
attr_reader :accounts
|
102
|
+
# Nodes make up the strongDM network, and allow your users to connect securely to your resources.
|
103
|
+
# There are two types of nodes:
|
104
|
+
# 1. **Relay:** creates connectivity to your datasources, while maintaining the egress-only nature of your firewall
|
105
|
+
# 1. **Gateways:** a relay that also listens for connections from strongDM clients
|
106
|
+
attr_reader :nodes
|
76
107
|
|
77
|
-
|
78
|
-
|
79
|
-
|
80
|
-
|
81
|
-
|
82
|
-
|
83
|
-
|
84
|
-
|
108
|
+
attr_reader :resources
|
109
|
+
# RoleAttachments represent relationships between composite roles and the roles
|
110
|
+
# that make up those composite roles. When a composite role is attached to another
|
111
|
+
# role, the permissions granted to members of the composite role are augmented to
|
112
|
+
# include the permissions granted to members of the attached role.
|
113
|
+
attr_reader :role_attachments
|
114
|
+
# RoleGrants represent relationships between composite roles and the roles
|
115
|
+
# that make up those composite roles. When a composite role is attached to another
|
116
|
+
# role, the permissions granted to members of the composite role are augmented to
|
117
|
+
# include the permissions granted to members of the attached role.
|
118
|
+
attr_reader :role_grants
|
119
|
+
# Roles are tools for controlling user access to resources. Each Role holds a
|
120
|
+
# list of resources which they grant access to. Composite roles are a special
|
121
|
+
# type of Role which have no resource associations of their own, but instead
|
122
|
+
# grant access to the combined resources associated with a set of child roles.
|
123
|
+
# Each user can be a member of one Role or composite role.
|
124
|
+
attr_reader :roles
|
125
|
+
attr_reader :_test_options
|
85
126
|
end
|
86
127
|
|
87
|
-
attr_reader :max_retries
|
88
|
-
attr_reader :base_retry_delay
|
89
|
-
attr_reader :max_retry_delay
|
90
|
-
|
91
|
-
# API authentication token (read-only).
|
92
|
-
attr_reader :api_access_key
|
93
|
-
# AccountAttachments assign an account to a role.
|
94
|
-
attr_reader :account_attachments
|
95
|
-
# AccountGrants connect a resource directly to an account, giving the account the permission to connect to that resource.
|
96
|
-
attr_reader :account_grants
|
97
|
-
# Accounts are users that have access to strongDM.
|
98
|
-
# There are two types of accounts:
|
99
|
-
# 1. **Regular users:** humans who are authenticated through username and password or SSO
|
100
|
-
# 2. **Service users:** machines that are authneticated using a service token
|
101
|
-
attr_reader :accounts
|
102
|
-
# Nodes make up the strongDM network, and allow your users to connect securely to your resources.
|
103
|
-
# There are two types of nodes:
|
104
|
-
# 1. **Relay:** creates connectivity to your datasources, while maintaining the egress-only nature of your firewall
|
105
|
-
# 1. **Gateways:** a relay that also listens for connections from strongDM clients
|
106
|
-
attr_reader :nodes
|
107
|
-
|
108
|
-
attr_reader :resources
|
109
|
-
# RoleAttachments represent relationships between composite roles and the roles
|
110
|
-
# that make up those composite roles. When a composite role is attached to another
|
111
|
-
# role, the permissions granted to members of the composite role are augmented to
|
112
|
-
# include the permissions granted to members of the attached role.
|
113
|
-
attr_reader :role_attachments
|
114
|
-
# RoleGrants represent relationships between composite roles and the roles
|
115
|
-
# that make up those composite roles. When a composite role is attached to another
|
116
|
-
# role, the permissions granted to members of the composite role are augmented to
|
117
|
-
# include the permissions granted to members of the attached role.
|
118
|
-
attr_reader :role_grants
|
119
|
-
# Roles are tools for controlling user access to resources. Each Role holds a
|
120
|
-
# list of resources which they grant access to. Composite roles are a special
|
121
|
-
# type of Role which have no resource associations of their own, but instead
|
122
|
-
# grant access to the combined resources associated with a set of child roles.
|
123
|
-
# Each user can be a member of one Role or composite role.
|
124
|
-
attr_reader :roles
|
125
|
-
attr_reader :_test_options
|
126
|
-
end
|
127
128
|
end
|