strongdm 1.0.2 → 1.0.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/doc/LICENSE.html +6 -5
- data/doc/Object.html +16 -16
- data/doc/README_md.html +6 -5
- data/doc/SDM/AKS.html +27 -6
- data/doc/SDM/AKSBasicAuth.html +27 -6
- data/doc/SDM/AKSServiceAccount.html +27 -6
- data/doc/SDM/AccountAttachment.html +6 -3
- data/doc/SDM/AccountAttachmentCreateOptions.html +6 -3
- data/doc/SDM/AccountAttachmentCreateResponse.html +6 -3
- data/doc/SDM/AccountAttachmentDeleteResponse.html +6 -3
- data/doc/SDM/AccountAttachmentGetResponse.html +6 -3
- data/doc/SDM/AccountAttachments.html +24 -21
- data/doc/SDM/AccountCreateResponse.html +6 -3
- data/doc/SDM/AccountDeleteResponse.html +6 -3
- data/doc/SDM/AccountGetResponse.html +6 -3
- data/doc/SDM/AccountGrant.html +6 -3
- data/doc/SDM/AccountGrantCreateResponse.html +6 -3
- data/doc/SDM/AccountGrantDeleteResponse.html +6 -3
- data/doc/SDM/AccountGrantGetResponse.html +6 -3
- data/doc/SDM/AccountGrants.html +24 -21
- data/doc/SDM/AccountUpdateResponse.html +6 -3
- data/doc/SDM/Accounts.html +29 -26
- data/doc/SDM/AlreadyExistsError.html +6 -3
- data/doc/SDM/AmazonEKS.html +27 -6
- data/doc/SDM/AmazonES.html +27 -6
- data/doc/SDM/Athena.html +27 -6
- data/doc/SDM/AuroraMysql.html +27 -6
- data/doc/SDM/AuroraPostgres.html +27 -6
- data/doc/SDM/AuthenticationError.html +6 -3
- data/doc/SDM/BadRequestError.html +6 -3
- data/doc/SDM/BigQuery.html +27 -6
- data/doc/SDM/Cassandra.html +27 -6
- data/doc/SDM/Client.html +7 -4
- data/doc/SDM/Clustrix.html +27 -6
- data/doc/SDM/Cockroach.html +27 -6
- data/doc/SDM/CreateResponseMetadata.html +6 -3
- data/doc/SDM/DeadlineExceededError.html +6 -3
- data/doc/SDM/DeleteResponseMetadata.html +6 -3
- data/doc/SDM/Druid.html +27 -6
- data/doc/SDM/DynamoDB.html +27 -6
- data/doc/SDM/Elastic.html +27 -6
- data/doc/SDM/ElasticacheRedis.html +27 -6
- data/doc/SDM/Gateway.html +8 -5
- data/doc/SDM/GetResponseMetadata.html +6 -3
- data/doc/SDM/GoogleGKE.html +27 -6
- data/doc/SDM/Greenplum.html +27 -6
- data/doc/SDM/HTTPAuth.html +27 -6
- data/doc/SDM/HTTPBasicAuth.html +27 -6
- data/doc/SDM/HTTPNoAuth.html +27 -6
- data/doc/SDM/InternalError.html +6 -3
- data/doc/SDM/Kubernetes.html +27 -6
- data/doc/SDM/KubernetesBasicAuth.html +27 -6
- data/doc/SDM/KubernetesServiceAccount.html +27 -6
- data/doc/SDM/Maria.html +27 -6
- data/doc/SDM/Memcached.html +27 -6
- data/doc/SDM/Memsql.html +27 -6
- data/doc/SDM/MongoHost.html +27 -6
- data/doc/SDM/MongoLegacyHost.html +27 -6
- data/doc/SDM/MongoLegacyReplicaset.html +27 -6
- data/doc/SDM/MongoReplicaSet.html +27 -6
- data/doc/SDM/Mysql.html +27 -6
- data/doc/SDM/NodeCreateResponse.html +8 -5
- data/doc/SDM/NodeDeleteResponse.html +8 -5
- data/doc/SDM/NodeGetResponse.html +8 -5
- data/doc/SDM/NodeUpdateResponse.html +8 -5
- data/doc/SDM/Nodes.html +29 -26
- data/doc/SDM/NotFoundError.html +6 -3
- data/doc/SDM/Oracle.html +27 -6
- data/doc/SDM/PermissionError.html +6 -3
- data/doc/SDM/Plumbing.html +3701 -3523
- data/doc/SDM/Postgres.html +27 -6
- data/doc/SDM/Presto.html +27 -6
- data/doc/SDM/RDP.html +27 -6
- data/doc/SDM/RPCError.html +6 -3
- data/doc/SDM/RateLimitError.html +6 -3
- data/doc/SDM/RateLimitMetadata.html +6 -3
- data/doc/SDM/Redis.html +27 -6
- data/doc/SDM/Redshift.html +27 -6
- data/doc/SDM/Relay.html +8 -5
- data/doc/SDM/ResourceCreateResponse.html +8 -5
- data/doc/SDM/ResourceDeleteResponse.html +8 -5
- data/doc/SDM/ResourceGetResponse.html +8 -5
- data/doc/SDM/ResourceUpdateResponse.html +8 -5
- data/doc/SDM/Resources.html +28 -25
- data/doc/SDM/Role.html +8 -5
- data/doc/SDM/RoleAttachment.html +8 -5
- data/doc/SDM/RoleAttachmentCreateResponse.html +8 -5
- data/doc/SDM/RoleAttachmentDeleteResponse.html +8 -5
- data/doc/SDM/RoleAttachmentGetResponse.html +8 -5
- data/doc/SDM/RoleAttachments.html +23 -20
- data/doc/SDM/RoleCreateResponse.html +8 -5
- data/doc/SDM/RoleDeleteResponse.html +8 -5
- data/doc/SDM/RoleGetResponse.html +8 -5
- data/doc/SDM/RoleGrant.html +8 -5
- data/doc/SDM/RoleGrantCreateResponse.html +8 -5
- data/doc/SDM/RoleGrantDeleteResponse.html +8 -5
- data/doc/SDM/RoleGrantGetResponse.html +8 -5
- data/doc/SDM/RoleGrants.html +23 -20
- data/doc/SDM/RoleUpdateResponse.html +8 -5
- data/doc/SDM/Roles.html +28 -25
- data/doc/SDM/SQLServer.html +27 -6
- data/doc/SDM/SSH.html +27 -6
- data/doc/SDM/Service.html +6 -3
- data/doc/SDM/Snowflake.html +27 -6
- data/doc/SDM/Sybase.html +27 -6
- data/doc/SDM/SybaseIQ.html +27 -6
- data/doc/SDM/Teradata.html +27 -6
- data/doc/SDM/UpdateResponseMetadata.html +6 -3
- data/doc/SDM/User.html +6 -3
- data/doc/SDM.html +6 -3
- data/doc/V1/AccountAttachments/Service.html +6 -3
- data/doc/V1/AccountAttachments.html +6 -3
- data/doc/V1/AccountGrants/Service.html +7 -4
- data/doc/V1/AccountGrants.html +6 -3
- data/doc/V1/Accounts/Service.html +6 -3
- data/doc/V1/Accounts.html +6 -3
- data/doc/V1/Nodes/Service.html +6 -3
- data/doc/V1/Nodes.html +6 -3
- data/doc/V1/Resources/Service.html +6 -3
- data/doc/V1/Resources.html +6 -3
- data/doc/V1/RoleAttachments/Service.html +6 -3
- data/doc/V1/RoleAttachments.html +6 -3
- data/doc/V1/RoleGrants/Service.html +6 -3
- data/doc/V1/RoleGrants.html +6 -3
- data/doc/V1/Roles/Service.html +6 -3
- data/doc/V1/Roles.html +6 -3
- data/doc/V1/Tags.html +113 -0
- data/doc/V1.html +16 -3
- data/doc/created.rid +34 -35
- data/doc/css/rdoc.css +35 -6
- data/doc/examples/Gemfile.html +6 -5
- data/doc/examples/Gemfile_lock.html +6 -5
- data/doc/examples/README_md.html +6 -5
- data/doc/examples/okta-sync/Gemfile.html +6 -5
- data/doc/examples/okta-sync/Gemfile_lock.html +6 -5
- data/doc/index.html +8 -5
- data/doc/js/darkfish.js +22 -99
- data/doc/js/navigation.js +4 -40
- data/doc/js/navigation.js.gz +0 -0
- data/doc/js/search.js +32 -31
- data/doc/js/search_index.js +1 -1
- data/doc/js/search_index.js.gz +0 -0
- data/doc/js/searcher.js +6 -6
- data/doc/js/searcher.js.gz +0 -0
- data/doc/lib/version.html +6 -5
- data/doc/table_of_contents.html +927 -914
- data/examples/Gemfile +2 -2
- data/examples/listUsers.rb +4 -4
- data/examples/okta-sync/oktaSync.rb +17 -59
- data/examples/panicButton.rb +4 -46
- data/lib/errors/errors.rb +53 -55
- data/lib/grpc/account_attachments_pb.rb +9 -9
- data/lib/grpc/account_attachments_services_pb.rb +8 -7
- data/lib/grpc/account_grants_pb.rb +10 -10
- data/lib/grpc/account_grants_services_pb.rb +9 -8
- data/lib/grpc/accounts_pb.rb +9 -9
- data/lib/grpc/accounts_services_pb.rb +8 -7
- data/lib/grpc/drivers_pb.rb +52 -7
- data/lib/grpc/nodes_pb.rb +9 -9
- data/lib/grpc/nodes_services_pb.rb +8 -7
- data/lib/grpc/options_pb.rb +14 -5
- data/lib/grpc/plumbing.rb +4200 -4085
- data/lib/grpc/protoc-gen-swagger/options/annotations_pb.rb +4 -4
- data/lib/grpc/resources_pb.rb +9 -9
- data/lib/grpc/resources_services_pb.rb +8 -7
- data/lib/grpc/role_attachments_pb.rb +9 -9
- data/lib/grpc/role_attachments_services_pb.rb +8 -7
- data/lib/grpc/role_grants_pb.rb +9 -9
- data/lib/grpc/role_grants_services_pb.rb +8 -7
- data/lib/grpc/roles_pb.rb +9 -9
- data/lib/grpc/roles_services_pb.rb +8 -7
- data/lib/grpc/spec_pb.rb +8 -8
- data/lib/grpc/tags_pb.rb +36 -0
- data/lib/models/porcelain.rb +4941 -4415
- data/lib/strongdm.rb +95 -94
- data/lib/svc.rb +1224 -1202
- data/lib/version.rb +5 -5
- data/strongdm.gemspec +10 -10
- metadata +4 -2
data/lib/strongdm.rb
CHANGED
|
@@ -1,17 +1,17 @@
|
|
|
1
1
|
# Copyright 2020 StrongDM Inc
|
|
2
|
-
#
|
|
2
|
+
#
|
|
3
3
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
4
4
|
# you may not use this file except in compliance with the License.
|
|
5
5
|
# You may obtain a copy of the License at
|
|
6
|
-
#
|
|
6
|
+
#
|
|
7
7
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
8
|
-
#
|
|
8
|
+
#
|
|
9
9
|
# Unless required by applicable law or agreed to in writing, software
|
|
10
10
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
11
11
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
12
12
|
# See the License for the specific language governing permissions and
|
|
13
13
|
# limitations under the License.
|
|
14
|
-
#
|
|
14
|
+
#
|
|
15
15
|
|
|
16
16
|
# This file was generated by protogen. DO NOT EDIT.
|
|
17
17
|
|
|
@@ -25,103 +25,104 @@ DEFAULT_MAX_RETRY_DELAY = 300 # 300 seconds
|
|
|
25
25
|
|
|
26
26
|
module SDM
|
|
27
27
|
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
28
|
+
# Client bundles all the services together and initializes them.
|
|
29
|
+
class Client
|
|
30
|
+
# Creates a new strongDM API client.
|
|
31
|
+
def initialize(api_access_key, api_secret_key, host:"api.strongdm.com:443", insecure:false)
|
|
32
|
+
@api_access_key = api_access_key
|
|
33
|
+
@api_secret_key = Base64.strict_decode64(api_secret_key)
|
|
34
|
+
@max_retries = DEFAULT_MAX_RETRIES
|
|
35
|
+
@base_retry_delay = DEFAULT_BASE_RETRY_DELAY
|
|
36
|
+
@max_retry_delay = DEFAULT_MAX_RETRY_DELAY
|
|
37
|
+
@account_attachments = AccountAttachments.new(host, insecure, self)
|
|
38
|
+
@account_grants = AccountGrants.new(host, insecure, self)
|
|
39
|
+
@accounts = Accounts.new(host, insecure, self)
|
|
40
|
+
@nodes = Nodes.new(host, insecure, self)
|
|
41
|
+
@resources = Resources.new(host, insecure, self)
|
|
42
|
+
@role_attachments = RoleAttachments.new(host, insecure, self)
|
|
43
|
+
@role_grants = RoleGrants.new(host, insecure, self)
|
|
44
|
+
@roles = Roles.new(host, insecure, self)
|
|
45
|
+
@_test_options = Hash.new
|
|
46
|
+
end
|
|
47
47
|
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
48
|
+
def get_metadata(method_name, req)
|
|
49
|
+
return { 'x-sdm-authentication': @api_access_key,'x-sdm-signature': self.sign(method_name, req.to_proto)}
|
|
50
|
+
end
|
|
51
51
|
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
52
|
+
def sign(method_name, msg_bytes)
|
|
53
|
+
current_utc_date = Time.now.utc
|
|
54
|
+
date = sprintf("%04d-%02d-%02d",current_utc_date.year, current_utc_date.month, current_utc_date.day)
|
|
55
55
|
|
|
56
|
-
|
|
57
|
-
|
|
56
|
+
signing_key = OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, @api_secret_key, date)
|
|
57
|
+
signing_key = OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, signing_key, 'sdm_api_v1')
|
|
58
58
|
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
59
|
+
sha_req = Digest::SHA256.new
|
|
60
|
+
sha_req << method_name
|
|
61
|
+
sha_req << "\n"
|
|
62
|
+
sha_req << msg_bytes
|
|
63
|
+
request_hash = sha_req.digest
|
|
64
64
|
|
|
65
|
-
|
|
66
|
-
|
|
65
|
+
return Base64.strict_encode64(OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, signing_key, request_hash))
|
|
66
|
+
end
|
|
67
67
|
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
68
|
+
def jitterSleep(iter)
|
|
69
|
+
dur_max = @base_retry_delay * 2**iter
|
|
70
|
+
if (dur_max > @max_retry_delay)
|
|
71
|
+
dur_max = @max_retry_delay
|
|
72
|
+
end
|
|
73
|
+
dur = rand() * dur_max
|
|
74
|
+
sleep(dur)
|
|
75
|
+
end
|
|
76
|
+
|
|
77
|
+
def shouldRetry(iter, err)
|
|
78
|
+
if (iter >= @max_retries-1)
|
|
79
|
+
return false
|
|
80
|
+
end
|
|
81
|
+
if not err .is_a? GRPC::BadStatus
|
|
82
|
+
return true
|
|
83
|
+
end
|
|
84
|
+
return err.code() == 13
|
|
85
|
+
end
|
|
86
|
+
|
|
87
|
+
attr_reader :max_retries
|
|
88
|
+
attr_reader :base_retry_delay
|
|
89
|
+
attr_reader :max_retry_delay
|
|
90
|
+
|
|
91
|
+
# API authentication token (read-only).
|
|
92
|
+
attr_reader :api_access_key
|
|
93
|
+
# AccountAttachments assign an account to a role.
|
|
94
|
+
attr_reader :account_attachments
|
|
95
|
+
# AccountGrants assign a resource directly to an account, giving the account the permission to connect to that resource.
|
|
96
|
+
attr_reader :account_grants
|
|
97
|
+
# Accounts are users that have access to strongDM.
|
|
98
|
+
# There are two types of accounts:
|
|
99
|
+
# 1. **Regular users:** humans who are authenticated through username and password or SSO
|
|
100
|
+
# 2. **Service users:** machines that are authneticated using a service token
|
|
101
|
+
attr_reader :accounts
|
|
102
|
+
# Nodes make up the strongDM network, and allow your users to connect securely to your resources.
|
|
103
|
+
# There are two types of nodes:
|
|
104
|
+
# 1. **Relay:** creates connectivity to your datasources, while maintaining the egress-only nature of your firewall
|
|
105
|
+
# 1. **Gateways:** a relay that also listens for connections from strongDM clients
|
|
106
|
+
attr_reader :nodes
|
|
76
107
|
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
108
|
+
attr_reader :resources
|
|
109
|
+
# RoleAttachments represent relationships between composite roles and the roles
|
|
110
|
+
# that make up those composite roles. When a composite role is attached to another
|
|
111
|
+
# role, the permissions granted to members of the composite role are augmented to
|
|
112
|
+
# include the permissions granted to members of the attached role.
|
|
113
|
+
attr_reader :role_attachments
|
|
114
|
+
# RoleGrants represent relationships between composite roles and the roles
|
|
115
|
+
# that make up those composite roles. When a composite role is attached to another
|
|
116
|
+
# role, the permissions granted to members of the composite role are augmented to
|
|
117
|
+
# include the permissions granted to members of the attached role.
|
|
118
|
+
attr_reader :role_grants
|
|
119
|
+
# Roles are tools for controlling user access to resources. Each Role holds a
|
|
120
|
+
# list of resources which they grant access to. Composite roles are a special
|
|
121
|
+
# type of Role which have no resource associations of their own, but instead
|
|
122
|
+
# grant access to the combined resources associated with a set of child roles.
|
|
123
|
+
# Each user can be a member of one Role or composite role.
|
|
124
|
+
attr_reader :roles
|
|
125
|
+
attr_reader :_test_options
|
|
85
126
|
end
|
|
86
127
|
|
|
87
|
-
attr_reader :max_retries
|
|
88
|
-
attr_reader :base_retry_delay
|
|
89
|
-
attr_reader :max_retry_delay
|
|
90
|
-
|
|
91
|
-
# API authentication token (read-only).
|
|
92
|
-
attr_reader :api_access_key
|
|
93
|
-
# AccountAttachments assign an account to a role.
|
|
94
|
-
attr_reader :account_attachments
|
|
95
|
-
# AccountGrants connect a resource directly to an account, giving the account the permission to connect to that resource.
|
|
96
|
-
attr_reader :account_grants
|
|
97
|
-
# Accounts are users that have access to strongDM.
|
|
98
|
-
# There are two types of accounts:
|
|
99
|
-
# 1. **Regular users:** humans who are authenticated through username and password or SSO
|
|
100
|
-
# 2. **Service users:** machines that are authneticated using a service token
|
|
101
|
-
attr_reader :accounts
|
|
102
|
-
# Nodes make up the strongDM network, and allow your users to connect securely to your resources.
|
|
103
|
-
# There are two types of nodes:
|
|
104
|
-
# 1. **Relay:** creates connectivity to your datasources, while maintaining the egress-only nature of your firewall
|
|
105
|
-
# 1. **Gateways:** a relay that also listens for connections from strongDM clients
|
|
106
|
-
attr_reader :nodes
|
|
107
|
-
|
|
108
|
-
attr_reader :resources
|
|
109
|
-
# RoleAttachments represent relationships between composite roles and the roles
|
|
110
|
-
# that make up those composite roles. When a composite role is attached to another
|
|
111
|
-
# role, the permissions granted to members of the composite role are augmented to
|
|
112
|
-
# include the permissions granted to members of the attached role.
|
|
113
|
-
attr_reader :role_attachments
|
|
114
|
-
# RoleGrants represent relationships between composite roles and the roles
|
|
115
|
-
# that make up those composite roles. When a composite role is attached to another
|
|
116
|
-
# role, the permissions granted to members of the composite role are augmented to
|
|
117
|
-
# include the permissions granted to members of the attached role.
|
|
118
|
-
attr_reader :role_grants
|
|
119
|
-
# Roles are tools for controlling user access to resources. Each Role holds a
|
|
120
|
-
# list of resources which they grant access to. Composite roles are a special
|
|
121
|
-
# type of Role which have no resource associations of their own, but instead
|
|
122
|
-
# grant access to the combined resources associated with a set of child roles.
|
|
123
|
-
# Each user can be a member of one Role or composite role.
|
|
124
|
-
attr_reader :roles
|
|
125
|
-
attr_reader :_test_options
|
|
126
|
-
end
|
|
127
128
|
end
|