strongdm 1.0.7 → 1.0.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 86cc4d6b9580c2ea725286eaf30a140a051f8b035f50a3728b16dd90eb777ff0
-  data.tar.gz: 06c32258d35b6952710addf5cfd4566f99b632d1f989e85264cbffa5fcfa63d2
+  metadata.gz: 5aaee007fbddd2f157fa3ef68da1d3909e76b904c34fc09076f89dc7a42d4b56
+  data.tar.gz: b88f7eb1c6b52611179d21ceb71df3f745ad3e8b1cf49c0722783638584be0bd
 SHA512:
-  metadata.gz: 98e2c20ee4168b3948210c0d0313ba20f25e4055e81210aac9cda3c2974669c514dd2d6830b581e62e2f2d826802409ef316cdd94f9bd6bb8cd537a7db72f281
-  data.tar.gz: bc46ed7ffed5c9ea0b993631f62c52e1d1577a3c52b8b28455dbef97a9d7ac2d8e5e4c492397852dee580d5c3b9e3388cc2a053a7308b66e77fcca34bb25ab61
+  metadata.gz: 4dfddf1ccb527a371e08e455c456353d84fa0c45a9b1259487aa1163d54fa2429fecc4e7a377d3f24ccc6b4555ed793ffa204e4d5b18f085732b5c989b059b73
+  data.tar.gz: 916c4ad7ca06d80cfc58fda32c7093f6729809f6e413653b96fac02d2e9765f6a92adfcdb2f05711ca460462cf172bb848ca3c1618df98db09eb5bf6bb99f880

data/README.md

@@ -1,23 +1,25 @@
 # strongDM SDK for Ruby
 
-The official strongDM SDK for the Ruby programming language.
+This is the official [strongDM](https://www.strongdm.com/) SDK for the Ruby programming language.
 
-## Quick Start
-
-First, install the gem:
+## Installation
 
 ```bash
 $ gem install strongdm
 ```
 
-Next, go to https://app.strongdm.com and create an API key. Set the `SDM_API_ACCESS_KEY` and `SDM_API_SECRET_KEY` environment variables.
+## Authentication
+
+If you don't already have them you will need to generate a set of API keys, instructions are here: [API Credentials](https://www.strongdm.com/docs/admin-guide/api-credentials/)
 
+Add the keys as environment variables; the SDK will need to access these keys for every request.
 ```bash
 $ export SDM_API_ACCESS_KEY=<YOUR ACCESS KEY>
 $ export SDM_API_SECRET_KEY=<YOUR SECRET KEY>
 ```
 
-Run some example code.
+## List Users
+The following code lists all registered users:
 
 ```ruby
 require "strongdm"
@@ -27,4 +29,21 @@ users = client.accounts.list('')
 users.each do |user|
 	p user
 end
-```
+```
+
+## Useful Links
+
+* Documentation:  [strongdm gem](https://www.rubydoc.info/gems/strongdm)
+* Examples: [GitHub - strongdm/strongdm-sdk-ruby-examples](https://github.com/strongdm/strongdm-sdk-ruby-examples)
+	1. [Managing Resources](https://github.com/strongdm/strongdm-sdk-ruby-examples/tree/master/1_managing_resources)
+	2. [Managing Accounts](https://github.com/strongdm/strongdm-sdk-ruby-examples/tree/master/2_managing_accounts)
+	3. [Managing Roles](https://github.com/strongdm/strongdm-sdk-ruby-examples/tree/master/3_managing_roles)
+	4. [Managing Gateways](https://github.com/strongdm/strongdm-sdk-ruby-examples/tree/master/4_managing_gateways)
+
+## License
+
+[Apache 2](https://github.com/strongdm/strongdm-sdk-ruby/blob/master/LICENSE)
+
+## Contributing 
+
+Currently, we are not accepting pull requests directly to this repository, but our users are some of the most resourceful and ambitious folks out there. So, if you have something to contribute, find a bug, or just want to give us some feedback, please email <support@strongdm.com>.

data/doc/LICENSE.html

@@ -69,18 +69,8 @@
   
     <li><a href="./examples/Gemfile.html">Gemfile</a>
   
-    <li><a href="./examples/Gemfile_lock.html">Gemfile.lock</a>
-  
-    <li><a href="./examples/README_md.html">README</a>
-  
-    <li><a href="./examples/okta-sync/Gemfile.html">Gemfile</a>
-  
-    <li><a href="./examples/okta-sync/Gemfile_lock.html">Gemfile.lock</a>
-  
     <li><a href="./lib/version.html">version</a>
   
-    <li><a href="./strongdm_gemspec.html">strongdm.gemspec</a>
-  
   </ul>
 </div>
 
@@ -197,7 +187,7 @@ identification within third-party archives.
 
 <footer id="validator-badges" role="contentinfo">
   <p><a href="https://validator.w3.org/check/referer">Validate</a>
-  <p>Generated by <a href="https://ruby.github.io/rdoc/">RDoc</a> 6.1.2.
+  <p>Generated by <a href="https://ruby.github.io/rdoc/">RDoc</a> 6.2.1.
   <p>Based on <a href="http://deveiate.org/projects/Darkfish-RDoc/">Darkfish</a> by <a href="http://deveiate.org">Michael Granger</a>.
 </footer>
 

data/doc/Object.html

@@ -69,23 +69,7 @@
 
     
     
-    <!-- Method Quickref -->
-<div id="method-list-section" class="nav-section">
-  <h3>Methods</h3>
-
-  <ul class="link-list" role="directory">
-    
-    <li ><a href="#method-i-first">#first</a>
-    
-    <li ><a href="#method-i-ldap_sync">#ldap_sync</a>
-    
-    <li ><a href="#method-i-main">#main</a>
     
-    <li ><a href="#method-i-okta_sync">#okta_sync</a>
-    
-  </ul>
-</div>
-
   </div>
 </nav>
 
@@ -126,55 +110,6 @@
         <dd>
         
       
-        <dt id="LDAP_BIND_DN">LDAP_BIND_DN
-        
-        <dd>
-        
-      
-        <dt id="LDAP_HOST">LDAP_HOST
-        
-        <dd>
-        
-      
-        <dt id="LDAP_PASSWORD">LDAP_PASSWORD
-        
-        <dd>
-        
-      
-        <dt id="OKTA_CLIENT_ORGURL">OKTA_CLIENT_ORGURL
-        
-        <dd>
-        
-      
-        <dt id="OKTA_CLIENT_TOKEN">OKTA_CLIENT_TOKEN
-        
-        <dd>
-        
-      
-        <dt id="SDM_API_ACCESS_KEY">SDM_API_ACCESS_KEY
-        
-        <dd><p>organizationalUnits:</p>
-
-<pre>- dn: OU=Other-OU,DC=j42,DC=xyz
-  role: Other-OU
-  resources:
-    - name:*Other-OU*
-    - name:*Multi*
-- dn: OU=admins,DC=j42,DC=xyz
-  role: admins
-  resources:
-    - name:*admins*
-- dn: OU=People,DC=j42,DC=xyz
-  role: People
-  resources:
-    - name:*People*</pre>
-        
-      
-        <dt id="SDM_API_SECRET_KEY">SDM_API_SECRET_KEY
-        
-        <dd>
-        
-      
       </dl>
     </section>
     
@@ -182,619 +117,6 @@
     
 
     
-     <section id="public-instance-5Buntitled-5D-method-details" class="method-section">
-       <header>
-         <h3>Public Instance Methods</h3>
-       </header>
-
-    
-      <div id="method-i-first" class="method-detail ">
-        
-        <div class="method-heading">
-          <span class="method-name">first</span><span
-            class="method-args">(attrib)</span>
-          
-          <span class="method-click-advice">click to toggle source</span>
-          
-        </div>
-        
-
-        <div class="method-description">
-          
-          <p>gets the first item in a list or generator</p>
-          
-          
-
-          
-          <div class="method-source-code" id="first-source">
-            <pre><span class="ruby-comment"># File examples/ldap-sync/ldapSync.rb, line 58</span>
-<span class="ruby-keyword">def</span> <span class="ruby-identifier ruby-title">first</span>(<span class="ruby-identifier">attrib</span>)
-  <span class="ruby-identifier">result</span> = <span class="ruby-keyword">nil</span>
-  <span class="ruby-identifier">attrib</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">item</span><span class="ruby-operator">|</span>
-    <span class="ruby-keyword">if</span> <span class="ruby-identifier">result</span> <span class="ruby-operator">==</span> <span class="ruby-keyword">nil</span>
-      <span class="ruby-identifier">result</span> = <span class="ruby-identifier">item</span>
-    <span class="ruby-keyword">end</span>
-  <span class="ruby-keyword">end</span>
-  <span class="ruby-identifier">result</span>
-<span class="ruby-keyword">end</span></pre>
-          </div>
-          
-        </div>
-
-        
-
-        
-      </div>
-
-    
-      <div id="method-i-ldap_sync" class="method-detail ">
-        
-        <div class="method-heading">
-          <span class="method-name">ldap_sync</span><span
-            class="method-args">()</span>
-          
-          <span class="method-click-advice">click to toggle source</span>
-          
-        </div>
-        
-
-        <div class="method-description">
-          
-          
-          
-          
-
-          
-          <div class="method-source-code" id="ldap_sync-source">
-            <pre><span class="ruby-comment"># File examples/ldap-sync/ldapSync.rb, line 68</span>
-<span class="ruby-keyword">def</span> <span class="ruby-identifier ruby-title">ldap_sync</span>
-  <span class="ruby-keyword">if</span> <span class="ruby-constant">SDM_API_ACCESS_KEY</span> <span class="ruby-operator">==</span> <span class="ruby-string">&#39;&#39;</span> <span class="ruby-operator">||</span> <span class="ruby-constant">SDM_API_SECRET_KEY</span> <span class="ruby-operator">==</span> <span class="ruby-string">&#39;&#39;</span> <span class="ruby-operator">||</span> <span class="ruby-constant">LDAP_BIND_DN</span> <span class="ruby-operator">==</span> <span class="ruby-string">&#39;&#39;</span>
-    <span class="ruby-identifier">puts</span> <span class="ruby-string">&#39;SDM_API_ACCESS_KEY, SDM_API_SECRET_KEY, and LDAP_BIND_DN must be set&#39;</span>
-    <span class="ruby-identifier">exit</span> <span class="ruby-value">1</span>
-  <span class="ruby-keyword">end</span>
-
-  <span class="ruby-identifier">plan</span> = <span class="ruby-keyword">false</span>
-  <span class="ruby-identifier">verbose</span> = <span class="ruby-keyword">false</span>
-  <span class="ruby-identifier">configPath</span> = <span class="ruby-string">&#39;config.yml&#39;</span>
-  <span class="ruby-constant">OptionParser</span>.<span class="ruby-identifier">new</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">opts</span><span class="ruby-operator">|</span>
-    <span class="ruby-identifier">opts</span>.<span class="ruby-identifier">banner</span> = <span class="ruby-string">&quot;Usage ldapSync.rb [options]&quot;</span>
-    <span class="ruby-identifier">opts</span>.<span class="ruby-identifier">on</span>(<span class="ruby-string">&quot;-p&quot;</span>, <span class="ruby-string">&quot;--plan&quot;</span>, <span class="ruby-string">&quot;calculate changes but do not apply them&quot;</span>) <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">p</span><span class="ruby-operator">|</span>
-      <span class="ruby-identifier">plan</span> = <span class="ruby-identifier">p</span>
-    <span class="ruby-keyword">end</span>
-    <span class="ruby-identifier">opts</span>.<span class="ruby-identifier">on</span>(<span class="ruby-string">&quot;-v&quot;</span>, <span class="ruby-string">&quot;--verbose&quot;</span>, <span class="ruby-string">&quot;print detailed report&quot;</span>) <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">v</span><span class="ruby-operator">|</span>
-      <span class="ruby-identifier">verbose</span> = <span class="ruby-identifier">v</span>
-    <span class="ruby-keyword">end</span>
-    <span class="ruby-identifier">opts</span>.<span class="ruby-identifier">on</span>(<span class="ruby-string">&quot;-c&quot;</span>, <span class="ruby-string">&quot;--config FILE&quot;</span>, <span class="ruby-string">&quot;specify path to config YAML file (default: &#39;config.yml&#39;)&quot;</span>) <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">v</span><span class="ruby-operator">|</span>
-      <span class="ruby-identifier">configPath</span> = <span class="ruby-identifier">v</span>
-    <span class="ruby-keyword">end</span>
-  <span class="ruby-keyword">end</span>.<span class="ruby-identifier">parse!</span>
-
-  <span class="ruby-keyword">begin</span>
-    <span class="ruby-identifier">config</span> = <span class="ruby-constant">YAML</span>.<span class="ruby-identifier">load</span>(<span class="ruby-constant">File</span>.<span class="ruby-identifier">read</span>(<span class="ruby-identifier">configPath</span>))
-  <span class="ruby-keyword">rescue</span> <span class="ruby-constant">StandardError</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-identifier">ex</span>
-    <span class="ruby-identifier">raise</span> <span class="ruby-identifier">ex</span>, <span class="ruby-node">&quot;failed to parse #{configPath}&quot;</span>
-  <span class="ruby-keyword">end</span>
-
-  <span class="ruby-keyword">begin</span>
-    <span class="ruby-identifier">sdmClient</span> = <span class="ruby-constant">SDM</span><span class="ruby-operator">::</span><span class="ruby-constant">Client</span>.<span class="ruby-identifier">new</span>(<span class="ruby-constant">SDM_API_ACCESS_KEY</span>, <span class="ruby-constant">SDM_API_SECRET_KEY</span>, <span class="ruby-value">host:</span> <span class="ruby-string">&#39;api.strongdmdev.com:443&#39;</span>)
-  <span class="ruby-keyword">rescue</span> <span class="ruby-constant">SDM</span><span class="ruby-operator">::</span><span class="ruby-constant">RPCError</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-identifier">ex</span>
-    <span class="ruby-identifier">raise</span> <span class="ruby-identifier">ex</span>, <span class="ruby-string">&#39;failed to create StrongDM client&#39;</span>
-  <span class="ruby-keyword">end</span>
-
-  <span class="ruby-identifier">ldap</span> = <span class="ruby-constant">Net</span><span class="ruby-operator">::</span><span class="ruby-constant">LDAP</span>.<span class="ruby-identifier">new</span>
-  <span class="ruby-identifier">ldap</span>.<span class="ruby-identifier">host</span> = <span class="ruby-constant">LDAP_HOST</span>
-  <span class="ruby-identifier">ldap</span>.<span class="ruby-identifier">auth</span> <span class="ruby-constant">LDAP_BIND_DN</span>, <span class="ruby-constant">LDAP_PASSWORD</span>
-  <span class="ruby-keyword">if</span> <span class="ruby-keyword">not</span> <span class="ruby-identifier">ldap</span>.<span class="ruby-identifier">bind</span>
-    <span class="ruby-identifier">puts</span> <span class="ruby-string">&#39;failed to bind LDAP connection - authentication error&#39;</span>
-    <span class="ruby-identifier">exit</span> <span class="ruby-value">1</span>
-  <span class="ruby-keyword">end</span>
-
-  <span class="ruby-identifier">sdmRoles</span> = { } <span class="ruby-comment"># map of name to ID</span>
-  <span class="ruby-identifier">sdmAccounts</span> = { } <span class="ruby-comment"># map of email to id</span>
-  <span class="ruby-identifier">sdmResources</span> = { } <span class="ruby-comment"># map of ID to name</span>
-  <span class="ruby-identifier">sdmAccountsById</span> = { } <span class="ruby-comment"># map of id to { :email, :firstName, :lastName }</span>
-  <span class="ruby-identifier">sdmAccountsWithAttachments</span> = { } <span class="ruby-comment"># map of email to id of all accounts that are in the roles we&#39;re interested in</span>
-  <span class="ruby-identifier">sdmAccountAttachments</span> = { } <span class="ruby-comment"># map of role name to list of emails</span>
-  <span class="ruby-identifier">sdmRoleGrants</span> = { } <span class="ruby-comment"># map of role name to list of { :resourceId, :grantId }</span>
-  <span class="ruby-identifier">ldapRoles</span> = [] <span class="ruby-comment"># list of names</span>
-  <span class="ruby-identifier">ldapAccounts</span> = { } <span class="ruby-comment"># map of email to { :firstName, :lastName }</span>
-  <span class="ruby-identifier">ldapAccountAttachments</span> = { } <span class="ruby-comment"># map of role name to list of emails</span>
-  <span class="ruby-identifier">desiredRoleGrants</span> = { } <span class="ruby-comment"># map of role name to list of resource IDs</span>
-
-  <span class="ruby-comment"># get SDM accounts</span>
-  <span class="ruby-identifier">sdmClient</span>.<span class="ruby-identifier">accounts</span>.<span class="ruby-identifier">list</span>(<span class="ruby-string">&#39;&#39;</span>).<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">account</span><span class="ruby-operator">|</span>
-    <span class="ruby-identifier">sdmAccounts</span>[<span class="ruby-identifier">account</span>.<span class="ruby-identifier">email</span>] = <span class="ruby-identifier">account</span>.<span class="ruby-identifier">id</span>
-    <span class="ruby-identifier">sdmAccountsById</span>[<span class="ruby-identifier">account</span>.<span class="ruby-identifier">id</span>] = { <span class="ruby-value">:email</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-identifier">account</span>.<span class="ruby-identifier">email</span>, <span class="ruby-value">:firstName</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-identifier">account</span>.<span class="ruby-identifier">first_name</span>, <span class="ruby-value">:lastName</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-identifier">account</span>.<span class="ruby-identifier">last_name</span> }
-  <span class="ruby-keyword">end</span>
-
-  <span class="ruby-comment"># get SDM resources</span>
-  <span class="ruby-identifier">sdmClient</span>.<span class="ruby-identifier">resources</span>.<span class="ruby-identifier">list</span>(<span class="ruby-string">&#39;&#39;</span>).<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">resource</span><span class="ruby-operator">|</span>
-    <span class="ruby-identifier">sdmResources</span>[<span class="ruby-identifier">resource</span>.<span class="ruby-identifier">id</span>] = <span class="ruby-identifier">resource</span>.<span class="ruby-identifier">name</span>
-  <span class="ruby-keyword">end</span>
-
-  <span class="ruby-comment"># loop through OUs</span>
-  <span class="ruby-identifier">config</span>[<span class="ruby-string">&#39;organizationalUnits&#39;</span>].<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">ou</span><span class="ruby-operator">|</span>
-
-    <span class="ruby-comment"># get SDM state for this OU</span>
-    <span class="ruby-identifier">role</span> = <span class="ruby-identifier">first</span>(<span class="ruby-identifier">sdmClient</span>.<span class="ruby-identifier">roles</span>.<span class="ruby-identifier">list</span>(<span class="ruby-string">&#39;name:?&#39;</span>, <span class="ruby-identifier">ou</span>[<span class="ruby-string">&#39;role&#39;</span>]))
-    <span class="ruby-keyword">if</span> <span class="ruby-identifier">role</span>
-      <span class="ruby-identifier">sdmRoles</span>[<span class="ruby-identifier">role</span>.<span class="ruby-identifier">name</span>] = <span class="ruby-identifier">role</span>.<span class="ruby-identifier">id</span>
-
-      <span class="ruby-comment"># get accounts attached to this role</span>
-      <span class="ruby-identifier">accountEmails</span> = []
-      <span class="ruby-identifier">sdmClient</span>.<span class="ruby-identifier">account_attachments</span>.<span class="ruby-identifier">list</span>(<span class="ruby-string">&#39;roleid:?&#39;</span>, <span class="ruby-identifier">role</span>.<span class="ruby-identifier">id</span>).<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">attachment</span><span class="ruby-operator">|</span>
-        <span class="ruby-identifier">sdmAccount</span> = <span class="ruby-identifier">sdmAccountsById</span>[<span class="ruby-identifier">attachment</span>.<span class="ruby-identifier">account_id</span>]
-        <span class="ruby-identifier">email</span> = <span class="ruby-identifier">sdmAccount</span>[<span class="ruby-value">:email</span>]
-        <span class="ruby-identifier">sdmAccountsWithAttachments</span>[<span class="ruby-identifier">email</span>] = <span class="ruby-identifier">attachment</span>.<span class="ruby-identifier">account_id</span>
-        <span class="ruby-identifier">accountEmails</span>.<span class="ruby-identifier">push</span>(<span class="ruby-identifier">email</span>)
-      <span class="ruby-keyword">end</span>
-      <span class="ruby-identifier">sdmAccountAttachments</span>[<span class="ruby-identifier">role</span>.<span class="ruby-identifier">name</span>] = <span class="ruby-identifier">accountEmails</span>
-
-      <span class="ruby-comment"># get resources granted to this role</span>
-      <span class="ruby-identifier">roleGrants</span> = []
-      <span class="ruby-identifier">sdmClient</span>.<span class="ruby-identifier">role_grants</span>.<span class="ruby-identifier">list</span>(<span class="ruby-string">&#39;roleid:?&#39;</span>, <span class="ruby-identifier">role</span>.<span class="ruby-identifier">id</span>).<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">grant</span><span class="ruby-operator">|</span>
-        <span class="ruby-identifier">roleGrants</span>.<span class="ruby-identifier">push</span>({ <span class="ruby-value">:resourceId</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-identifier">grant</span>.<span class="ruby-identifier">resource_id</span>, <span class="ruby-value">:grantId</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-identifier">grant</span>.<span class="ruby-identifier">id</span> })
-      <span class="ruby-keyword">end</span>
-      <span class="ruby-identifier">sdmRoleGrants</span>[<span class="ruby-identifier">role</span>.<span class="ruby-identifier">name</span>] = <span class="ruby-identifier">roleGrants</span>
-
-      <span class="ruby-comment"># get resources that we want to grant to this role</span>
-      <span class="ruby-identifier">filteredResources</span> = { } <span class="ruby-comment"># map of resource ID to true (to prevent duplicates)</span>
-      <span class="ruby-identifier">filters</span> = <span class="ruby-identifier">ou</span>[<span class="ruby-string">&#39;resources&#39;</span>] <span class="ruby-comment"># list of filter strings</span>
-      <span class="ruby-keyword">if</span> <span class="ruby-identifier">filters</span>
-        <span class="ruby-identifier">filters</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">filter</span><span class="ruby-operator">|</span>
-          <span class="ruby-identifier">sdmClient</span>.<span class="ruby-identifier">resources</span>.<span class="ruby-identifier">list</span>(<span class="ruby-identifier">filter</span>).<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">resource</span><span class="ruby-operator">|</span>
-            <span class="ruby-identifier">filteredResources</span>[<span class="ruby-identifier">resource</span>.<span class="ruby-identifier">id</span>] = <span class="ruby-keyword">true</span>
-          <span class="ruby-keyword">end</span>
-        <span class="ruby-keyword">end</span>
-        <span class="ruby-identifier">desiredRoleGrants</span>[<span class="ruby-identifier">role</span>.<span class="ruby-identifier">name</span>] = <span class="ruby-identifier">filteredResources</span>.<span class="ruby-identifier">keys</span>
-      <span class="ruby-keyword">end</span>
-    <span class="ruby-keyword">end</span>
-
-    <span class="ruby-comment"># get LDAP state for this OU</span>
-    <span class="ruby-identifier">ldapRoles</span>.<span class="ruby-identifier">push</span>(<span class="ruby-identifier">ou</span>[<span class="ruby-string">&#39;role&#39;</span>].<span class="ruby-identifier">to_s</span>)
-    <span class="ruby-identifier">roleAccounts</span> = []
-    <span class="ruby-identifier">ldap</span>.<span class="ruby-identifier">search</span>(<span class="ruby-value">:base</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-identifier">ou</span>[<span class="ruby-string">&#39;dn&#39;</span>], <span class="ruby-value">:filter</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-constant">Net</span><span class="ruby-operator">::</span><span class="ruby-constant">LDAP</span><span class="ruby-operator">::</span><span class="ruby-constant">Filter</span>.<span class="ruby-identifier">eq</span>(<span class="ruby-string">&#39;objectclass&#39;</span>, <span class="ruby-string">&#39;user&#39;</span>), <span class="ruby-value">:return_result</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-keyword">false</span>) <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">entry</span><span class="ruby-operator">|</span>
-      <span class="ruby-identifier">ldapAccounts</span>[<span class="ruby-identifier">first</span>(<span class="ruby-identifier">entry</span>.<span class="ruby-identifier">mail</span>).<span class="ruby-identifier">to_s</span>] = {
-        <span class="ruby-value">:firstName</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-identifier">first</span>(<span class="ruby-identifier">entry</span>.<span class="ruby-identifier">givenname</span>).<span class="ruby-identifier">to_s</span>,
-        <span class="ruby-value">:lastName</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-identifier">first</span>(<span class="ruby-identifier">entry</span>.<span class="ruby-identifier">sn</span>).<span class="ruby-identifier">to_s</span>,
-      }
-      <span class="ruby-identifier">roleAccounts</span>.<span class="ruby-identifier">push</span>(<span class="ruby-identifier">first</span>(<span class="ruby-identifier">entry</span>.<span class="ruby-identifier">mail</span>).<span class="ruby-identifier">to_s</span>)
-    <span class="ruby-keyword">end</span>
-    <span class="ruby-identifier">ldapAccountAttachments</span>[<span class="ruby-identifier">ou</span>[<span class="ruby-string">&#39;role&#39;</span>].<span class="ruby-identifier">to_s</span>] = <span class="ruby-identifier">roleAccounts</span>
-  <span class="ruby-keyword">end</span>
-
-  <span class="ruby-comment"># compute diff</span>
-  <span class="ruby-identifier">report</span> = {
-    <span class="ruby-value">:createRoles</span> <span class="ruby-operator">=&gt;</span> [],
-    <span class="ruby-value">:deleteAccounts</span> <span class="ruby-operator">=&gt;</span> [],
-    <span class="ruby-value">:updateAccounts</span> <span class="ruby-operator">=&gt;</span> [],
-    <span class="ruby-value">:createAccounts</span> <span class="ruby-operator">=&gt;</span> [],
-    <span class="ruby-value">:createAccountAttachments</span> <span class="ruby-operator">=&gt;</span> [],
-    <span class="ruby-value">:deleteAccountAttachments</span> <span class="ruby-operator">=&gt;</span> [],
-    <span class="ruby-value">:deleteRoleGrants</span> <span class="ruby-operator">=&gt;</span> [],
-    <span class="ruby-value">:createRoleGrants</span> <span class="ruby-operator">=&gt;</span> [],
-  }
-  <span class="ruby-comment"># createRoles</span>
-  <span class="ruby-identifier">ldapRoles</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">roleName</span><span class="ruby-operator">|</span>
-    <span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">sdmRoles</span>[<span class="ruby-identifier">roleName</span>]
-    <span class="ruby-identifier">report</span>[<span class="ruby-value">:createRoles</span>].<span class="ruby-identifier">push</span>(<span class="ruby-identifier">roleName</span>)
-    <span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">plan</span>
-    <span class="ruby-identifier">response</span> = <span class="ruby-identifier">sdmClient</span>.<span class="ruby-identifier">roles</span>.<span class="ruby-identifier">create</span>(<span class="ruby-constant">SDM</span><span class="ruby-operator">::</span><span class="ruby-constant">Role</span>.<span class="ruby-identifier">new</span>(<span class="ruby-value">name:</span> <span class="ruby-identifier">roleName</span>))
-    <span class="ruby-identifier">sdmRoles</span>[<span class="ruby-identifier">roleName</span>] = <span class="ruby-identifier">response</span>.<span class="ruby-identifier">role</span>.<span class="ruby-identifier">id</span>
-  <span class="ruby-keyword">end</span>
-  <span class="ruby-comment"># deleteAccounts</span>
-  <span class="ruby-identifier">sdmAccountsWithAttachments</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">email</span>, <span class="ruby-identifier">id</span><span class="ruby-operator">|</span>
-    <span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">ldapAccounts</span>[<span class="ruby-identifier">email</span>]
-    <span class="ruby-identifier">report</span>[<span class="ruby-value">:deleteAccounts</span>].<span class="ruby-identifier">push</span>(<span class="ruby-identifier">email</span>)
-    <span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">plan</span>
-    <span class="ruby-identifier">sdmClient</span>.<span class="ruby-identifier">accounts</span>.<span class="ruby-identifier">delete</span>(<span class="ruby-identifier">id</span>)
-  <span class="ruby-keyword">end</span>
-  <span class="ruby-comment"># updateAccounts</span>
-  <span class="ruby-identifier">sdmAccountsWithAttachments</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">email</span>, <span class="ruby-identifier">id</span><span class="ruby-operator">|</span>
-    <span class="ruby-identifier">ldapAccount</span> = <span class="ruby-identifier">ldapAccounts</span>[<span class="ruby-identifier">email</span>]
-    <span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-keyword">not</span> <span class="ruby-identifier">ldapAccount</span>
-    <span class="ruby-identifier">sdmAccount</span> = <span class="ruby-identifier">sdmAccountsById</span>[<span class="ruby-identifier">id</span>]
-    <span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">sdmAccount</span>[<span class="ruby-value">:firstName</span>] <span class="ruby-operator">==</span> <span class="ruby-identifier">ldapAccount</span>[<span class="ruby-value">:firstName</span>] <span class="ruby-keyword">and</span> <span class="ruby-identifier">sdmAccount</span>[<span class="ruby-value">:lastName</span>] <span class="ruby-operator">==</span> <span class="ruby-identifier">ldapAccount</span>[<span class="ruby-value">:lastName</span>]
-    <span class="ruby-identifier">report</span>[<span class="ruby-value">:updateAccounts</span>].<span class="ruby-identifier">push</span>(<span class="ruby-identifier">email</span>)
-    <span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">plan</span>
-    <span class="ruby-identifier">sdmClient</span>.<span class="ruby-identifier">accounts</span>.<span class="ruby-identifier">update</span>(<span class="ruby-constant">SDM</span><span class="ruby-operator">::</span><span class="ruby-constant">User</span>.<span class="ruby-identifier">new</span>(<span class="ruby-value">id:</span> <span class="ruby-identifier">id</span>, <span class="ruby-value">first_name:</span> <span class="ruby-identifier">ldapAccount</span>[<span class="ruby-value">:firstName</span>], <span class="ruby-value">last_name:</span> <span class="ruby-identifier">ldapAccount</span>[<span class="ruby-value">:lastName</span>]))
-  <span class="ruby-keyword">end</span>
-  <span class="ruby-comment"># createAccounts</span>
-  <span class="ruby-identifier">ldapAccounts</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">email</span>, <span class="ruby-identifier">account</span><span class="ruby-operator">|</span>
-    <span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">sdmAccounts</span>[<span class="ruby-identifier">email</span>]
-    <span class="ruby-identifier">report</span>[<span class="ruby-value">:createAccounts</span>].<span class="ruby-identifier">push</span>(<span class="ruby-identifier">email</span>)
-    <span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">plan</span>
-    <span class="ruby-identifier">response</span> = <span class="ruby-identifier">sdmClient</span>.<span class="ruby-identifier">accounts</span>.<span class="ruby-identifier">create</span>(<span class="ruby-constant">SDM</span><span class="ruby-operator">::</span><span class="ruby-constant">User</span>.<span class="ruby-identifier">new</span>(<span class="ruby-value">email:</span> <span class="ruby-identifier">email</span>, <span class="ruby-value">first_name:</span> <span class="ruby-identifier">account</span>[<span class="ruby-value">:firstName</span>], <span class="ruby-value">last_name:</span> <span class="ruby-identifier">account</span>[<span class="ruby-value">:lastName</span>]))
-    <span class="ruby-identifier">sdmAccounts</span>[<span class="ruby-identifier">response</span>.<span class="ruby-identifier">account</span>.<span class="ruby-identifier">email</span>] = <span class="ruby-identifier">response</span>.<span class="ruby-identifier">account</span>.<span class="ruby-identifier">id</span>
-  <span class="ruby-keyword">end</span>
-  <span class="ruby-comment"># deleteAccountAttachments</span>
-  <span class="ruby-identifier">sdmAccountAttachments</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">roleName</span>, <span class="ruby-identifier">accounts</span><span class="ruby-operator">|</span>
-    <span class="ruby-identifier">roleId</span> = <span class="ruby-identifier">sdmRoles</span>[<span class="ruby-identifier">roleName</span>]
-    <span class="ruby-identifier">ldapAccountsInRole</span> = <span class="ruby-identifier">ldapAccountAttachments</span>[<span class="ruby-identifier">roleName</span>]
-    <span class="ruby-identifier">accounts</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">email</span><span class="ruby-operator">|</span>
-      <span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">ldapAccountsInRole</span> <span class="ruby-keyword">and</span> <span class="ruby-identifier">ldapAccountsInRole</span>.<span class="ruby-identifier">include?</span> <span class="ruby-identifier">email</span>
-      <span class="ruby-identifier">report</span>[<span class="ruby-value">:deleteAccountAttachments</span>].<span class="ruby-identifier">push</span>({ <span class="ruby-value">:role</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-identifier">roleName</span>, <span class="ruby-value">:account</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-identifier">email</span> })
-      <span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">plan</span>
-      <span class="ruby-identifier">accountId</span> = <span class="ruby-identifier">sdmAccounts</span>[<span class="ruby-identifier">email</span>]
-      <span class="ruby-identifier">attachment</span> = <span class="ruby-identifier">first</span>(<span class="ruby-identifier">sdmClient</span>.<span class="ruby-identifier">account_attachments</span>.<span class="ruby-identifier">list</span>(<span class="ruby-string">&#39;accountid:? roleid:?&#39;</span>, <span class="ruby-identifier">accountId</span>, <span class="ruby-identifier">roleId</span>))
-      <span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-keyword">not</span> <span class="ruby-identifier">attachment</span> <span class="ruby-comment"># already deleted by the deleteAccounts step</span>
-      <span class="ruby-identifier">sdmClient</span>.<span class="ruby-identifier">account_attachments</span>.<span class="ruby-identifier">delete</span>(<span class="ruby-identifier">attachment</span>.<span class="ruby-identifier">id</span>)
-    <span class="ruby-keyword">end</span>
-  <span class="ruby-keyword">end</span>
-  <span class="ruby-comment"># createAccountAttachments</span>
-  <span class="ruby-identifier">ldapAccountAttachments</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">roleName</span>, <span class="ruby-identifier">accounts</span><span class="ruby-operator">|</span>
-    <span class="ruby-identifier">roleId</span> = <span class="ruby-identifier">sdmRoles</span>[<span class="ruby-identifier">roleName</span>]
-    <span class="ruby-identifier">sdmAccountsInRole</span> = <span class="ruby-identifier">sdmAccountAttachments</span>[<span class="ruby-identifier">roleName</span>]
-    <span class="ruby-identifier">accounts</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">email</span><span class="ruby-operator">|</span>
-      <span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">sdmAccountsInRole</span> <span class="ruby-keyword">and</span> <span class="ruby-identifier">sdmAccountsInRole</span>.<span class="ruby-identifier">include?</span> <span class="ruby-identifier">email</span>
-      <span class="ruby-identifier">report</span>[<span class="ruby-value">:createAccountAttachments</span>].<span class="ruby-identifier">push</span>({ <span class="ruby-value">:role</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-identifier">roleName</span>, <span class="ruby-value">:account</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-identifier">email</span> })
-      <span class="ruby-identifier">accountId</span> = <span class="ruby-identifier">sdmAccounts</span>[<span class="ruby-identifier">email</span>]
-      <span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">plan</span>
-      <span class="ruby-identifier">sdmClient</span>.<span class="ruby-identifier">account_attachments</span>.<span class="ruby-identifier">create</span>(<span class="ruby-constant">SDM</span><span class="ruby-operator">::</span><span class="ruby-constant">AccountAttachment</span>.<span class="ruby-identifier">new</span>(<span class="ruby-value">account_id:</span> <span class="ruby-identifier">accountId</span>, <span class="ruby-value">role_id:</span> <span class="ruby-identifier">roleId</span>))
-    <span class="ruby-keyword">end</span>
-  <span class="ruby-keyword">end</span>
-  <span class="ruby-comment"># deleteRoleGrants</span>
-  <span class="ruby-identifier">sdmRoleGrants</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">roleName</span>, <span class="ruby-identifier">roleGrants</span><span class="ruby-operator">|</span>
-    <span class="ruby-identifier">desired</span> = <span class="ruby-identifier">desiredRoleGrants</span>[<span class="ruby-identifier">roleName</span>]
-    <span class="ruby-identifier">roleGrants</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">grant</span><span class="ruby-operator">|</span>
-      <span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">desired</span> <span class="ruby-keyword">and</span> <span class="ruby-identifier">desired</span>.<span class="ruby-identifier">include?</span> <span class="ruby-identifier">grant</span>[<span class="ruby-value">:resourceId</span>]
-      <span class="ruby-identifier">resourceName</span> = <span class="ruby-identifier">sdmResources</span>[<span class="ruby-identifier">grant</span>[<span class="ruby-value">:resourceId</span>]]
-      <span class="ruby-identifier">report</span>[<span class="ruby-value">:deleteRoleGrants</span>].<span class="ruby-identifier">push</span>({ <span class="ruby-value">:role</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-identifier">roleName</span>, <span class="ruby-value">:resource</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-identifier">resourceName</span>})
-      <span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">plan</span>
-      <span class="ruby-identifier">sdmClient</span>.<span class="ruby-identifier">role_grants</span>.<span class="ruby-identifier">delete</span>(<span class="ruby-identifier">grant</span>[<span class="ruby-value">:grantId</span>])
-    <span class="ruby-keyword">end</span>
-  <span class="ruby-keyword">end</span>
-  <span class="ruby-comment"># createRoleGrants</span>
-  <span class="ruby-identifier">desiredRoleGrants</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">roleName</span>, <span class="ruby-identifier">roleGrants</span><span class="ruby-operator">|</span>
-    <span class="ruby-identifier">roleId</span>  = <span class="ruby-identifier">sdmRoles</span>[<span class="ruby-identifier">roleName</span>]
-    <span class="ruby-identifier">existing</span> = <span class="ruby-identifier">sdmRoleGrants</span>[<span class="ruby-identifier">roleName</span>]
-    <span class="ruby-identifier">roleGrants</span>.<span class="ruby-identifier">each</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">resourceId</span><span class="ruby-operator">|</span>
-      <span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">existing</span> <span class="ruby-keyword">and</span> <span class="ruby-identifier">existing</span>.<span class="ruby-identifier">find</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">existingGrant</span><span class="ruby-operator">|</span> <span class="ruby-identifier">existingGrant</span>[<span class="ruby-value">:resourceId</span>] <span class="ruby-operator">==</span> <span class="ruby-identifier">resourceId</span> }
-      <span class="ruby-identifier">resourceName</span> = <span class="ruby-identifier">sdmResources</span>[<span class="ruby-identifier">resourceId</span>]
-      <span class="ruby-identifier">report</span>[<span class="ruby-value">:createRoleGrants</span>].<span class="ruby-identifier">push</span>({ <span class="ruby-value">:role</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-identifier">roleName</span>, <span class="ruby-value">:resource</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-identifier">resourceName</span> })
-      <span class="ruby-keyword">next</span> <span class="ruby-keyword">if</span> <span class="ruby-identifier">plan</span>
-      <span class="ruby-identifier">sdmClient</span>.<span class="ruby-identifier">role_grants</span>.<span class="ruby-identifier">create</span>(<span class="ruby-constant">SDM</span><span class="ruby-operator">::</span><span class="ruby-constant">RoleGrant</span>.<span class="ruby-identifier">new</span>(<span class="ruby-value">role_id:</span> <span class="ruby-identifier">roleId</span>, <span class="ruby-value">resource_id:</span> <span class="ruby-identifier">resourceId</span>))
-    <span class="ruby-keyword">end</span>
-  <span class="ruby-keyword">end</span>
-  <span class="ruby-keyword">if</span> <span class="ruby-identifier">verbose</span>
-    <span class="ruby-identifier">puts</span> <span class="ruby-constant">JSON</span>.<span class="ruby-identifier">pretty_generate</span>(<span class="ruby-identifier">report</span>)
-  <span class="ruby-keyword">else</span>
-    <span class="ruby-identifier">puts</span> <span class="ruby-node">&quot;Create #{report[:createRoles].length} roles&quot;</span>
-    <span class="ruby-identifier">puts</span> <span class="ruby-node">&quot;Delete #{report[:deleteAccounts].length} accounts&quot;</span>
-    <span class="ruby-identifier">puts</span> <span class="ruby-node">&quot;Create #{report[:createAccounts].length} accounts&quot;</span>
-    <span class="ruby-identifier">puts</span> <span class="ruby-node">&quot;Delete #{report[:deleteAccountAttachments].length} account attachments&quot;</span>
-    <span class="ruby-identifier">puts</span> <span class="ruby-node">&quot;Create #{report[:createAccountAttachments].length} account attachments&quot;</span>
-    <span class="ruby-identifier">puts</span> <span class="ruby-node">&quot;Delete #{report[:deleteRoleGrants].length} role grants&quot;</span>
-    <span class="ruby-identifier">puts</span> <span class="ruby-node">&quot;Create #{report[:createRoleGrants].length} role grants&quot;</span>
-  <span class="ruby-keyword">end</span>
-<span class="ruby-keyword">end</span></pre>
-          </div>
-          
-        </div>
-
-        
-
-        
-      </div>
-
-    
-      <div id="method-i-main" class="method-detail ">
-        
-        <div class="method-heading">
-          <span class="method-name">main</span><span
-            class="method-args">()</span>
-          
-          <span class="method-click-advice">click to toggle source</span>
-          
-        </div>
-        
-
-        <div class="method-description">
-          
-          <p>panicButton.rb suspends all users except for one admin, in the fake use case of a critical break in or something usage: ruby panicButton.rb adminuser@email.com to revert back to pre-panic state: ruby panicButton.rb revert</p>
-          
-          
-
-          
-          <div class="method-source-code" id="main-source">
-            <pre><span class="ruby-comment"># File examples/panicButton.rb, line 25</span>
-<span class="ruby-keyword">def</span> <span class="ruby-identifier ruby-title">main</span>
-  <span class="ruby-identifier">access_key</span> = <span class="ruby-constant">ENV</span>[<span class="ruby-string">&quot;SDM_API_ACCESS_KEY&quot;</span>]
-  <span class="ruby-identifier">secret_key</span> = <span class="ruby-constant">ENV</span>[<span class="ruby-string">&quot;SDM_API_SECRET_KEY&quot;</span>]
-  <span class="ruby-keyword">if</span> <span class="ruby-identifier">access_key</span> <span class="ruby-operator">==</span> <span class="ruby-keyword">nil</span> <span class="ruby-keyword">or</span> <span class="ruby-identifier">secret_key</span> <span class="ruby-operator">==</span> <span class="ruby-keyword">nil</span>
-    <span class="ruby-identifier">puts</span> <span class="ruby-string">&quot;SDM_API_ACCESS_KEY and SDM_API_SECRET_KEY must be provided&quot;</span>
-    <span class="ruby-keyword">return</span>
-  <span class="ruby-keyword">end</span>
-  <span class="ruby-identifier">client</span> = <span class="ruby-constant">SDM</span><span class="ruby-operator">::</span><span class="ruby-constant">Client</span>.<span class="ruby-identifier">new</span>(<span class="ruby-identifier">access_key</span>, <span class="ruby-identifier">secret_key</span>)
-
-  <span class="ruby-keyword">if</span> <span class="ruby-constant">ARGV</span>.<span class="ruby-identifier">size</span> <span class="ruby-operator">==</span> <span class="ruby-value">1</span> <span class="ruby-keyword">and</span> <span class="ruby-constant">ARGV</span>[<span class="ruby-value">0</span>] <span class="ruby-operator">==</span> <span class="ruby-string">&quot;revert&quot;</span>
-    <span class="ruby-identifier">state_file</span> = <span class="ruby-constant">File</span>.<span class="ruby-identifier">open</span>(<span class="ruby-string">&quot;state.json&quot;</span>)
-    <span class="ruby-identifier">state</span> = <span class="ruby-constant">JSON</span>.<span class="ruby-identifier">load</span>(<span class="ruby-identifier">state_file</span>)
-
-    <span class="ruby-identifier">reinstated_count</span> = <span class="ruby-value">0</span>
-
-    <span class="ruby-identifier">users</span> = <span class="ruby-identifier">client</span>.<span class="ruby-identifier">accounts</span>.<span class="ruby-identifier">list</span>(<span class="ruby-string">&quot;&quot;</span>)
-    <span class="ruby-identifier">users</span>.<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">user</span><span class="ruby-operator">|</span>
-      <span class="ruby-keyword">if</span> <span class="ruby-identifier">user</span>.<span class="ruby-identifier">suspended</span>
-        <span class="ruby-identifier">reinstated_count</span> <span class="ruby-operator">+=</span> <span class="ruby-value">1</span>
-        <span class="ruby-identifier">user</span>.<span class="ruby-identifier">suspended</span> = <span class="ruby-keyword">false</span>
-        <span class="ruby-identifier">client</span>.<span class="ruby-identifier">accounts</span>.<span class="ruby-identifier">update</span>(<span class="ruby-identifier">user</span>)
-      <span class="ruby-keyword">end</span>
-    }
-    <span class="ruby-identifier">state</span>[<span class="ruby-string">&quot;attachments&quot;</span>].<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">attachment</span><span class="ruby-operator">|</span>
-      <span class="ruby-keyword">begin</span>
-        <span class="ruby-identifier">a</span> = <span class="ruby-constant">SDM</span><span class="ruby-operator">::</span><span class="ruby-constant">AccountAttachment</span>.<span class="ruby-identifier">new</span>()
-        <span class="ruby-identifier">a</span>.<span class="ruby-identifier">account_id</span> = <span class="ruby-identifier">attachment</span>[<span class="ruby-string">&quot;account_id&quot;</span>]
-        <span class="ruby-identifier">a</span>.<span class="ruby-identifier">role_id</span> = <span class="ruby-identifier">attachment</span>[<span class="ruby-string">&quot;role_id&quot;</span>]
-        <span class="ruby-identifier">client</span>.<span class="ruby-identifier">account_attachments</span>.<span class="ruby-identifier">create</span>(<span class="ruby-identifier">a</span>)
-      <span class="ruby-keyword">rescue</span> <span class="ruby-constant">SDM</span><span class="ruby-operator">::</span><span class="ruby-constant">AlreadyExistsError</span>
-      <span class="ruby-keyword">rescue</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-identifier">ex</span>
-        <span class="ruby-identifier">puts</span> <span class="ruby-string">&quot;skipping creation of attachment due to error: &quot;</span> <span class="ruby-operator">+</span> <span class="ruby-identifier">ex</span>.<span class="ruby-identifier">to_s</span>
-      <span class="ruby-keyword">end</span>
-    }
-    <span class="ruby-identifier">state</span>[<span class="ruby-string">&quot;grants&quot;</span>].<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">attachment</span><span class="ruby-operator">|</span>
-      <span class="ruby-keyword">begin</span>
-        <span class="ruby-identifier">g</span> = <span class="ruby-constant">SDM</span><span class="ruby-operator">::</span><span class="ruby-constant">AccountGrant</span>.<span class="ruby-identifier">new</span>()
-        <span class="ruby-identifier">g</span>.<span class="ruby-identifier">account_id</span> = <span class="ruby-identifier">attachment</span>[<span class="ruby-string">&quot;account_id&quot;</span>]
-        <span class="ruby-identifier">g</span>.<span class="ruby-identifier">resource_id</span> = <span class="ruby-identifier">attachment</span>[<span class="ruby-string">&quot;resource_id&quot;</span>]
-        <span class="ruby-identifier">client</span>.<span class="ruby-identifier">account_grants</span>.<span class="ruby-identifier">create</span>(<span class="ruby-identifier">g</span>)
-      <span class="ruby-keyword">rescue</span> <span class="ruby-constant">SDM</span><span class="ruby-operator">::</span><span class="ruby-constant">AlreadyExistsError</span>
-      <span class="ruby-keyword">rescue</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-identifier">ex</span>
-        <span class="ruby-identifier">puts</span> <span class="ruby-string">&quot;skipping creation of grant due to error: &quot;</span> <span class="ruby-operator">+</span> <span class="ruby-identifier">ex</span>.<span class="ruby-identifier">to_s</span>
-      <span class="ruby-keyword">end</span>
-    }
-
-    <span class="ruby-identifier">puts</span> <span class="ruby-string">&quot;reinstated &quot;</span> <span class="ruby-operator">+</span> <span class="ruby-identifier">reinstated_count</span>.<span class="ruby-identifier">to_s</span> <span class="ruby-operator">+</span> <span class="ruby-string">&quot; users&quot;</span>
-    <span class="ruby-identifier">puts</span> <span class="ruby-string">&quot;recreated &quot;</span> <span class="ruby-operator">+</span> <span class="ruby-identifier">state</span>[<span class="ruby-string">&quot;attachments&quot;</span>].<span class="ruby-identifier">size</span>.<span class="ruby-identifier">to_s</span> <span class="ruby-operator">+</span> <span class="ruby-string">&quot; account attachments&quot;</span>
-    <span class="ruby-identifier">puts</span> <span class="ruby-string">&quot;recreated &quot;</span> <span class="ruby-operator">+</span> <span class="ruby-identifier">state</span>[<span class="ruby-string">&quot;grants&quot;</span>].<span class="ruby-identifier">size</span>.<span class="ruby-identifier">to_s</span> <span class="ruby-operator">+</span> <span class="ruby-string">&quot; account grants&quot;</span>
-
-    <span class="ruby-keyword">return</span>
-  <span class="ruby-keyword">end</span>
-
-  <span class="ruby-identifier">admin_email</span> = <span class="ruby-string">&quot;&quot;</span>
-  <span class="ruby-keyword">if</span> <span class="ruby-constant">ARGV</span>.<span class="ruby-identifier">size</span> <span class="ruby-operator">==</span> <span class="ruby-value">1</span>
-    <span class="ruby-identifier">admin_email</span> = <span class="ruby-constant">ARGV</span>[<span class="ruby-value">0</span>]
-  <span class="ruby-keyword">else</span>
-    <span class="ruby-identifier">puts</span> <span class="ruby-string">&quot;please provide an admin email to preserve&quot;</span>
-    <span class="ruby-keyword">return</span> <span class="ruby-value">1</span>
-  <span class="ruby-keyword">end</span>
-
-  <span class="ruby-identifier">admin_user_id</span> = <span class="ruby-string">&quot;&quot;</span>
-  <span class="ruby-identifier">users</span> = <span class="ruby-identifier">client</span>.<span class="ruby-identifier">accounts</span>.<span class="ruby-identifier">list</span>(<span class="ruby-string">&quot;email:?&quot;</span>, <span class="ruby-identifier">admin_email</span>)
-  <span class="ruby-identifier">users</span>.<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">user</span><span class="ruby-operator">|</span>
-    <span class="ruby-identifier">admin_user_id</span> = <span class="ruby-identifier">user</span>.<span class="ruby-identifier">id</span>
-  }
-
-  <span class="ruby-identifier">account_attachments</span> = <span class="ruby-identifier">client</span>.<span class="ruby-identifier">account_attachments</span>.<span class="ruby-identifier">list</span>(<span class="ruby-string">&quot;&quot;</span>)
-  <span class="ruby-identifier">account_grants</span> = <span class="ruby-identifier">client</span>.<span class="ruby-identifier">account_grants</span>.<span class="ruby-identifier">list</span>(<span class="ruby-string">&quot;&quot;</span>)
-
-  <span class="ruby-identifier">state</span> = {
-    <span class="ruby-value">&#39;attachments&#39;:</span> <span class="ruby-identifier">account_attachments</span>.<span class="ruby-identifier">map</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">x</span><span class="ruby-operator">|</span>
-      <span class="ruby-keyword">if</span> <span class="ruby-identifier">x</span>.<span class="ruby-identifier">account_id</span> <span class="ruby-operator">!=</span> <span class="ruby-identifier">admin_user_id</span>
-        <span class="ruby-identifier">out</span> = {
-          <span class="ruby-value">&#39;account_id&#39;:</span> <span class="ruby-identifier">x</span>.<span class="ruby-identifier">account_id</span>,
-          <span class="ruby-value">&#39;role_id&#39;:</span> <span class="ruby-identifier">x</span>.<span class="ruby-identifier">role_id</span>,
-        }
-      <span class="ruby-keyword">end</span>
-    }.<span class="ruby-identifier">reject</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">x</span><span class="ruby-operator">|</span> <span class="ruby-identifier">x</span> <span class="ruby-operator">==</span> <span class="ruby-keyword">nil</span> },
-    <span class="ruby-value">&#39;grants&#39;:</span> <span class="ruby-identifier">account_grants</span>.<span class="ruby-identifier">map</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">x</span><span class="ruby-operator">|</span>
-      <span class="ruby-keyword">if</span> <span class="ruby-identifier">x</span>.<span class="ruby-identifier">account_id</span> <span class="ruby-operator">!=</span> <span class="ruby-identifier">admin_user_id</span> <span class="ruby-keyword">and</span> <span class="ruby-identifier">x</span>.<span class="ruby-identifier">valid_until</span> <span class="ruby-operator">==</span> <span class="ruby-keyword">nil</span>
-        <span class="ruby-identifier">out</span> = {
-          <span class="ruby-value">&#39;account_id&#39;:</span> <span class="ruby-identifier">x</span>.<span class="ruby-identifier">account_id</span>,
-          <span class="ruby-value">&#39;resource_id&#39;:</span> <span class="ruby-identifier">x</span>.<span class="ruby-identifier">resource_id</span>,
-        }
-      <span class="ruby-keyword">end</span>
-    }.<span class="ruby-identifier">reject</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">x</span><span class="ruby-operator">|</span> <span class="ruby-identifier">x</span> <span class="ruby-operator">==</span> <span class="ruby-keyword">nil</span> },
-  }
-
-  <span class="ruby-identifier">puts</span> <span class="ruby-string">&quot;storing &quot;</span> <span class="ruby-operator">+</span> <span class="ruby-identifier">state</span>[<span class="ruby-value">:attachments</span>].<span class="ruby-identifier">size</span>.<span class="ruby-identifier">to_s</span> <span class="ruby-operator">+</span> <span class="ruby-string">&quot; account attachments in state&quot;</span>
-  <span class="ruby-identifier">puts</span> <span class="ruby-string">&quot;storing &quot;</span> <span class="ruby-operator">+</span> <span class="ruby-identifier">state</span>[<span class="ruby-value">:grants</span>].<span class="ruby-identifier">size</span>.<span class="ruby-identifier">to_s</span> <span class="ruby-operator">+</span> <span class="ruby-string">&quot; account grants in state&quot;</span>
-
-  <span class="ruby-identifier">state_file</span> = <span class="ruby-constant">File</span>.<span class="ruby-identifier">open</span>(<span class="ruby-string">&quot;state.json&quot;</span>, <span class="ruby-string">&quot;w&quot;</span>)
-  <span class="ruby-identifier">state_file</span>.<span class="ruby-identifier">write</span>(<span class="ruby-identifier">state</span>.<span class="ruby-identifier">to_json</span>)
-
-  <span class="ruby-identifier">suspended_count</span> = <span class="ruby-value">0</span>
-  <span class="ruby-identifier">users</span> = <span class="ruby-identifier">client</span>.<span class="ruby-identifier">accounts</span>.<span class="ruby-identifier">list</span>(<span class="ruby-string">&quot;&quot;</span>)
-  <span class="ruby-identifier">users</span>.<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">user</span><span class="ruby-operator">|</span>
-    <span class="ruby-keyword">if</span> <span class="ruby-identifier">user</span>.<span class="ruby-identifier">instance_of?</span> <span class="ruby-constant">SDM</span><span class="ruby-operator">::</span><span class="ruby-constant">User</span> <span class="ruby-keyword">and</span> <span class="ruby-identifier">user</span>.<span class="ruby-identifier">email</span> <span class="ruby-operator">==</span> <span class="ruby-identifier">admin_email</span>
-      <span class="ruby-keyword">next</span>
-    <span class="ruby-keyword">end</span>
-    <span class="ruby-identifier">user</span>.<span class="ruby-identifier">suspended</span> = <span class="ruby-keyword">true</span>
-    <span class="ruby-keyword">begin</span>
-      <span class="ruby-identifier">client</span>.<span class="ruby-identifier">accounts</span>.<span class="ruby-identifier">update</span>(<span class="ruby-identifier">user</span>)
-      <span class="ruby-identifier">suspended_count</span> <span class="ruby-operator">+=</span> <span class="ruby-value">1</span>
-    <span class="ruby-keyword">rescue</span> <span class="ruby-constant">StandardError</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-identifier">ex</span>
-      <span class="ruby-identifier">puts</span> <span class="ruby-string">&quot;skipping user &quot;</span> <span class="ruby-operator">+</span> <span class="ruby-identifier">user</span>.<span class="ruby-identifier">id</span> <span class="ruby-operator">+</span> <span class="ruby-string">&quot; on account of error: &quot;</span> <span class="ruby-operator">+</span> <span class="ruby-identifier">ex</span>.<span class="ruby-identifier">to_s</span>
-    <span class="ruby-keyword">end</span>
-  }
-
-  <span class="ruby-identifier">puts</span> <span class="ruby-string">&quot;suspended &quot;</span> <span class="ruby-operator">+</span> <span class="ruby-identifier">suspended_count</span>.<span class="ruby-identifier">to_s</span> <span class="ruby-operator">+</span> <span class="ruby-string">&quot; users&quot;</span>
-<span class="ruby-keyword">end</span></pre>
-          </div>
-          
-        </div>
-
-        
-
-        
-      </div>
-
-    
-      <div id="method-i-okta_sync" class="method-detail ">
-        
-        <div class="method-heading">
-          <span class="method-name">okta_sync</span><span
-            class="method-args">()</span>
-          
-          <span class="method-click-advice">click to toggle source</span>
-          
-        </div>
-        
-
-        <div class="method-description">
-          
-          
-          
-          
-
-          
-          <div class="method-source-code" id="okta_sync-source">
-            <pre><span class="ruby-comment"># File examples/okta-sync/oktaSync.rb, line 25</span>
-<span class="ruby-keyword">def</span> <span class="ruby-identifier ruby-title">okta_sync</span>
-  <span class="ruby-keyword">if</span> <span class="ruby-constant">SDM_API_ACCESS_KEY</span> <span class="ruby-operator">==</span> <span class="ruby-string">&quot;&quot;</span> <span class="ruby-operator">||</span> <span class="ruby-constant">SDM_API_SECRET_KEY</span> <span class="ruby-operator">==</span> <span class="ruby-string">&quot;&quot;</span> <span class="ruby-operator">||</span> <span class="ruby-constant">OKTA_CLIENT_TOKEN</span> <span class="ruby-operator">==</span> <span class="ruby-string">&quot;&quot;</span> <span class="ruby-operator">||</span> <span class="ruby-constant">OKTA_CLIENT_ORGURL</span> <span class="ruby-operator">==</span> <span class="ruby-string">&quot;&quot;</span>
-    <span class="ruby-identifier">puts</span> <span class="ruby-string">&quot;SDM_API_ACCESS_KEY, SDM_API_SECRET_KEY, OKTA_CLIENT_TOKEN, and OKTA_CLIENT_ORGURL must be set&quot;</span>
-    <span class="ruby-identifier">exit</span>
-  <span class="ruby-keyword">end</span>
-
-  <span class="ruby-identifier">report</span> = {
-    <span class="ruby-value">:start</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-constant">Time</span>.<span class="ruby-identifier">now</span>,
-
-    <span class="ruby-value">:oktaUsersCount</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-value">0</span>,
-    <span class="ruby-value">:oktaUsers</span> <span class="ruby-operator">=&gt;</span> [],
-
-    <span class="ruby-value">:sdmUsersCount</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-value">0</span>,
-    <span class="ruby-value">:sdmUsers</span> <span class="ruby-operator">=&gt;</span> [],
-
-    <span class="ruby-value">:bothUsersCount</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-value">0</span>,
-
-    <span class="ruby-value">:sdmResourcesCount</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-value">0</span>,
-    <span class="ruby-value">:sdmResources</span> <span class="ruby-operator">=&gt;</span> {},
-
-    <span class="ruby-value">:permissionsGranted</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-value">0</span>,
-    <span class="ruby-value">:permissionsRevoked</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-value">0</span>,
-    <span class="ruby-value">:grants</span> <span class="ruby-operator">=&gt;</span> [],
-    <span class="ruby-value">:revocations</span> <span class="ruby-operator">=&gt;</span> [],
-
-    <span class="ruby-value">:matchers</span> <span class="ruby-operator">=&gt;</span> {},
-  }
-
-  <span class="ruby-identifier">plan</span> = <span class="ruby-keyword">false</span>
-  <span class="ruby-identifier">verbose</span> = <span class="ruby-keyword">false</span>
-  <span class="ruby-constant">OptionParser</span>.<span class="ruby-identifier">new</span> <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">opts</span><span class="ruby-operator">|</span>
-    <span class="ruby-identifier">opts</span>.<span class="ruby-identifier">banner</span> = <span class="ruby-string">&quot;Usage oktaSync.rb [options]&quot;</span>
-    <span class="ruby-identifier">opts</span>.<span class="ruby-identifier">on</span>(<span class="ruby-string">&quot;-p&quot;</span>, <span class="ruby-string">&quot;--plan&quot;</span>, <span class="ruby-string">&quot;calculate changes but do not apply them&quot;</span>) <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">p</span><span class="ruby-operator">|</span>
-      <span class="ruby-identifier">plan</span> = <span class="ruby-identifier">p</span>
-    <span class="ruby-keyword">end</span>
-    <span class="ruby-identifier">opts</span>.<span class="ruby-identifier">on</span>(<span class="ruby-string">&quot;-v&quot;</span>, <span class="ruby-string">&quot;--verbose&quot;</span>, <span class="ruby-string">&quot;print detailed report&quot;</span>) <span class="ruby-keyword">do</span> <span class="ruby-operator">|</span><span class="ruby-identifier">v</span><span class="ruby-operator">|</span>
-      <span class="ruby-identifier">verbose</span> = <span class="ruby-identifier">v</span>
-    <span class="ruby-keyword">end</span>
-  <span class="ruby-keyword">end</span>.<span class="ruby-identifier">parse!</span>
-
-  <span class="ruby-identifier">client</span> = <span class="ruby-constant">SDM</span><span class="ruby-operator">::</span><span class="ruby-constant">Client</span>.<span class="ruby-identifier">new</span>(<span class="ruby-constant">SDM_API_ACCESS_KEY</span>, <span class="ruby-constant">SDM_API_SECRET_KEY</span>)
-  <span class="ruby-identifier">okta_client</span> = <span class="ruby-constant">Oktakit</span>.<span class="ruby-identifier">new</span>(<span class="ruby-value">token:</span> <span class="ruby-constant">OKTA_CLIENT_TOKEN</span>, <span class="ruby-value">api_endpoint:</span> <span class="ruby-constant">OKTA_CLIENT_ORGURL</span> <span class="ruby-operator">+</span> <span class="ruby-string">&quot;/api/v1&quot;</span>)
-  <span class="ruby-identifier">matchers</span> = <span class="ruby-constant">YAML</span>.<span class="ruby-identifier">load</span>(<span class="ruby-constant">File</span>.<span class="ruby-identifier">read</span>(<span class="ruby-string">&quot;matchers.yml&quot;</span>))
-  <span class="ruby-identifier">report</span>[<span class="ruby-value">:matchers</span>] = <span class="ruby-identifier">matchers</span>
-
-  <span class="ruby-identifier">all_users</span> = <span class="ruby-identifier">okta_client</span>.<span class="ruby-identifier">list_users</span>({
-    <span class="ruby-value">&#39;query&#39;:</span> {
-      <span class="ruby-value">&#39;search&#39;:</span> <span class="ruby-string">&quot;profile.department eq \&quot;Engineering\&quot; and (status eq \&quot;ACTIVE\&quot;)&quot;</span>,
-    },
-  })
-
-  <span class="ruby-identifier">okta_users</span> = <span class="ruby-constant">Array</span>.<span class="ruby-identifier">new</span>()
-  <span class="ruby-identifier">all_users</span>[<span class="ruby-value">0</span>].<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">u</span><span class="ruby-operator">|</span>
-    <span class="ruby-identifier">groups</span> = <span class="ruby-identifier">okta_client</span>.<span class="ruby-identifier">get_member_groups</span>(<span class="ruby-identifier">u</span>.<span class="ruby-identifier">id</span>)
-    <span class="ruby-identifier">group_names</span> = <span class="ruby-constant">Array</span>.<span class="ruby-identifier">new</span>()
-    <span class="ruby-identifier">groups</span>[<span class="ruby-value">0</span>].<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">ug</span><span class="ruby-operator">|</span>
-      <span class="ruby-identifier">group_names</span>.<span class="ruby-identifier">push</span>(<span class="ruby-identifier">ug</span>.<span class="ruby-identifier">profile</span>.<span class="ruby-identifier">name</span>)
-    }
-    <span class="ruby-identifier">okta_users</span>.<span class="ruby-identifier">push</span>({ <span class="ruby-value">:login</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-identifier">u</span>.<span class="ruby-identifier">profile</span>.<span class="ruby-identifier">login</span>, <span class="ruby-value">:first_name</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-identifier">u</span>.<span class="ruby-identifier">profile</span>.<span class="ruby-identifier">firstName</span>, <span class="ruby-value">:last_name</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-identifier">u</span>.<span class="ruby-identifier">profile</span>.<span class="ruby-constant">LastName</span>, <span class="ruby-value">:groups</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-identifier">group_names</span> })
-  }
-  <span class="ruby-identifier">report</span>[<span class="ruby-value">:oktaUsers</span>] = <span class="ruby-identifier">okta_users</span>
-  <span class="ruby-identifier">report</span>[<span class="ruby-value">:oktaUsersCount</span>] = <span class="ruby-identifier">okta_users</span>.<span class="ruby-identifier">size</span>
-
-  <span class="ruby-identifier">accounts</span> = <span class="ruby-identifier">client</span>.<span class="ruby-identifier">accounts</span>.<span class="ruby-identifier">list</span>(<span class="ruby-string">&quot;type:user&quot;</span>).<span class="ruby-identifier">map</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">a</span><span class="ruby-operator">|</span> [<span class="ruby-identifier">a</span>.<span class="ruby-identifier">email</span>, <span class="ruby-identifier">a</span>] }.<span class="ruby-identifier">to_h</span>
-  <span class="ruby-identifier">report</span>[<span class="ruby-value">:sdmUsers</span>] = <span class="ruby-identifier">accounts</span>
-  <span class="ruby-identifier">report</span>[<span class="ruby-value">:sdmUsersCount</span>] = <span class="ruby-identifier">accounts</span>.<span class="ruby-identifier">size</span>
-  <span class="ruby-identifier">grants</span> = <span class="ruby-identifier">client</span>.<span class="ruby-identifier">account_grants</span>.<span class="ruby-identifier">list</span>(<span class="ruby-string">&quot;&quot;</span>).<span class="ruby-identifier">map</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">ag</span><span class="ruby-operator">|</span> <span class="ruby-identifier">ag</span> }
-
-  <span class="ruby-identifier">current</span> = {}
-  <span class="ruby-identifier">grants</span>.<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">g</span><span class="ruby-operator">|</span>
-    <span class="ruby-identifier">current</span>[<span class="ruby-identifier">g</span>.<span class="ruby-identifier">account_id</span>] = [] <span class="ruby-keyword">if</span> <span class="ruby-keyword">not</span> <span class="ruby-identifier">current</span>[<span class="ruby-identifier">g</span>.<span class="ruby-identifier">account_id</span>]
-    <span class="ruby-identifier">current</span>[<span class="ruby-identifier">g</span>.<span class="ruby-identifier">account_id</span>].<span class="ruby-identifier">push</span>({ <span class="ruby-value">:resource_id</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-identifier">g</span>.<span class="ruby-identifier">resource_id</span>, <span class="ruby-value">:id</span> <span class="ruby-operator">=&gt;</span> <span class="ruby-identifier">g</span>.<span class="ruby-identifier">id</span> })
-  }
-
-  <span class="ruby-identifier">desired</span> = {}
-  <span class="ruby-identifier">overlapping</span> = <span class="ruby-value">0</span>
-  <span class="ruby-identifier">matchers</span>[<span class="ruby-string">&quot;groups&quot;</span>].<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">group</span><span class="ruby-operator">|</span>
-    <span class="ruby-identifier">group</span>[<span class="ruby-string">&quot;resources&quot;</span>].<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">resourceQuery</span><span class="ruby-operator">|</span>
-      <span class="ruby-identifier">client</span>.<span class="ruby-identifier">resources</span>.<span class="ruby-identifier">list</span>(<span class="ruby-identifier">resourceQuery</span>).<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">res</span><span class="ruby-operator">|</span>
-        <span class="ruby-identifier">report</span>[<span class="ruby-value">:sdmResources</span>][<span class="ruby-identifier">res</span>.<span class="ruby-identifier">id</span>] = <span class="ruby-identifier">res</span>
-        <span class="ruby-identifier">okta_users</span>.<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">u</span><span class="ruby-operator">|</span>
-          <span class="ruby-keyword">if</span> <span class="ruby-identifier">u</span>[<span class="ruby-value">:groups</span>].<span class="ruby-identifier">include?</span> <span class="ruby-identifier">group</span>[<span class="ruby-string">&quot;name&quot;</span>]
-            <span class="ruby-identifier">account</span> = <span class="ruby-identifier">accounts</span>[<span class="ruby-identifier">u</span>[<span class="ruby-value">:login</span>]]
-            <span class="ruby-keyword">if</span> <span class="ruby-identifier">account</span> <span class="ruby-operator">!=</span> <span class="ruby-keyword">nil</span>
-              <span class="ruby-identifier">overlapping</span> <span class="ruby-operator">+=</span> <span class="ruby-value">1</span>
-              <span class="ruby-identifier">desired</span>[<span class="ruby-identifier">account</span>.<span class="ruby-identifier">id</span>] = [] <span class="ruby-keyword">if</span> <span class="ruby-keyword">not</span> <span class="ruby-identifier">desired</span>[<span class="ruby-identifier">account</span>.<span class="ruby-identifier">id</span>]
-              <span class="ruby-identifier">desired</span>[<span class="ruby-identifier">account</span>.<span class="ruby-identifier">id</span>].<span class="ruby-identifier">push</span>(<span class="ruby-identifier">res</span>.<span class="ruby-identifier">id</span>)
-            <span class="ruby-keyword">end</span>
-          <span class="ruby-keyword">end</span>
-        }
-      }
-    }
-  }
-  <span class="ruby-identifier">report</span>[<span class="ruby-value">:bothUsersCount</span>] = <span class="ruby-identifier">overlapping</span>
-  <span class="ruby-identifier">report</span>[<span class="ruby-value">:sdmResourcesCount</span>] = <span class="ruby-identifier">report</span>[<span class="ruby-value">:sdmResources</span>].<span class="ruby-identifier">size</span>
-
-  <span class="ruby-identifier">revocations</span> = <span class="ruby-value">0</span>
-  <span class="ruby-identifier">current</span>.<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">aid</span>, <span class="ruby-identifier">curRes</span><span class="ruby-operator">|</span>
-    <span class="ruby-identifier">desRes</span> = <span class="ruby-identifier">desired</span>[<span class="ruby-identifier">aid</span>]
-    <span class="ruby-identifier">desRes</span> = [] <span class="ruby-keyword">if</span> <span class="ruby-keyword">not</span> <span class="ruby-identifier">desired</span>[<span class="ruby-identifier">aid</span>]
-    <span class="ruby-identifier">curRes</span>.<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">r</span><span class="ruby-operator">|</span>
-      <span class="ruby-keyword">if</span> <span class="ruby-keyword">not</span>(<span class="ruby-identifier">desRes</span>.<span class="ruby-identifier">include?</span> <span class="ruby-identifier">r</span>[<span class="ruby-value">:resource_id</span>])
-        <span class="ruby-keyword">if</span> <span class="ruby-identifier">plan</span>
-          <span class="ruby-identifier">puts</span> <span class="ruby-string">&quot;Plan: revoke %s from user %s\n&quot;</span> <span class="ruby-operator">%</span> [<span class="ruby-identifier">r</span>[<span class="ruby-value">:resource_id</span>], <span class="ruby-identifier">aid</span>]
-        <span class="ruby-keyword">else</span>
-          <span class="ruby-identifier">client</span>.<span class="ruby-identifier">account_grants</span>.<span class="ruby-identifier">delete</span>(<span class="ruby-identifier">r</span>[<span class="ruby-value">:id</span>])
-        <span class="ruby-keyword">end</span>
-        <span class="ruby-identifier">report</span>[<span class="ruby-value">:revocations</span>].<span class="ruby-identifier">push</span>(<span class="ruby-identifier">r</span>[<span class="ruby-value">:id</span>])
-        <span class="ruby-identifier">revocations</span> <span class="ruby-operator">+=</span> <span class="ruby-value">1</span>
-      <span class="ruby-keyword">end</span>
-    }
-  }
-  <span class="ruby-identifier">report</span>[<span class="ruby-value">:permissionsRevoked</span>] = <span class="ruby-identifier">revocations</span>
-
-  <span class="ruby-identifier">grants</span> = <span class="ruby-value">0</span>
-  <span class="ruby-identifier">desired</span>.<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">aid</span>, <span class="ruby-identifier">desRes</span><span class="ruby-operator">|</span>
-    <span class="ruby-identifier">curRes</span> = <span class="ruby-identifier">current</span>[<span class="ruby-identifier">aid</span>]
-    <span class="ruby-identifier">curRes</span> = [] <span class="ruby-keyword">if</span> <span class="ruby-keyword">not</span> <span class="ruby-identifier">current</span>[<span class="ruby-identifier">aid</span>]
-    <span class="ruby-identifier">desRes</span>.<span class="ruby-identifier">each</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">r</span><span class="ruby-operator">|</span>
-      <span class="ruby-keyword">if</span> <span class="ruby-keyword">not</span>(<span class="ruby-identifier">curRes</span>.<span class="ruby-identifier">map</span> { <span class="ruby-operator">|</span><span class="ruby-identifier">c</span><span class="ruby-operator">|</span> <span class="ruby-identifier">c</span>[<span class="ruby-value">:resource_id</span>] }.<span class="ruby-identifier">include?</span> <span class="ruby-identifier">r</span>)
-        <span class="ruby-identifier">ag</span> = <span class="ruby-constant">SDM</span><span class="ruby-operator">::</span><span class="ruby-constant">AccountGrant</span>.<span class="ruby-identifier">new</span>()
-        <span class="ruby-identifier">ag</span>.<span class="ruby-identifier">account_id</span> = <span class="ruby-identifier">aid</span>
-        <span class="ruby-identifier">ag</span>.<span class="ruby-identifier">resource_id</span> = <span class="ruby-identifier">r</span>
-        <span class="ruby-keyword">if</span> <span class="ruby-identifier">plan</span>
-          <span class="ruby-identifier">puts</span> <span class="ruby-string">&quot;Plan: grant %s to user %s\n&quot;</span> <span class="ruby-operator">%</span> [<span class="ruby-identifier">r</span>, <span class="ruby-identifier">aid</span>]
-        <span class="ruby-keyword">else</span>
-          <span class="ruby-identifier">client</span>.<span class="ruby-identifier">account_grants</span>.<span class="ruby-identifier">create</span>(<span class="ruby-identifier">ag</span>)
-        <span class="ruby-keyword">end</span>
-        <span class="ruby-identifier">report</span>[<span class="ruby-value">:grants</span>].<span class="ruby-identifier">push</span>(<span class="ruby-identifier">ag</span>)
-        <span class="ruby-identifier">grants</span> <span class="ruby-operator">+=</span> <span class="ruby-value">1</span>
-      <span class="ruby-keyword">end</span>
-    }
-  }
-  <span class="ruby-identifier">report</span>[<span class="ruby-value">:permissionsGranted</span>] = <span class="ruby-identifier">grants</span>
-
-  <span class="ruby-identifier">report</span>[<span class="ruby-value">:complete</span>] = <span class="ruby-constant">Time</span>.<span class="ruby-identifier">now</span>
-
-  <span class="ruby-keyword">if</span> <span class="ruby-identifier">verbose</span>
-    <span class="ruby-identifier">puts</span> <span class="ruby-identifier">report</span>.<span class="ruby-identifier">to_json</span>
-  <span class="ruby-keyword">else</span>
-    <span class="ruby-identifier">puts</span> <span class="ruby-string">&quot;%d Okta users, %d strongDM users, %d overlapping users, %d grants, %d revocations&quot;</span> <span class="ruby-operator">%</span> [<span class="ruby-identifier">okta_users</span>.<span class="ruby-identifier">size</span>, <span class="ruby-identifier">accounts</span>.<span class="ruby-identifier">size</span>, <span class="ruby-identifier">overlapping</span>, <span class="ruby-identifier">grants</span>, <span class="ruby-identifier">revocations</span>]
-  <span class="ruby-keyword">end</span>
-<span class="ruby-keyword">end</span></pre>
-          </div>
-          
-        </div>
-
-        
-
-        
-      </div>
-
-    
-    </section>
-  
   </section>
 
 </main>
@@ -802,7 +124,7 @@
 
 <footer id="validator-badges" role="contentinfo">
   <p><a href="https://validator.w3.org/check/referer">Validate</a>
-  <p>Generated by <a href="https://ruby.github.io/rdoc/">RDoc</a> 6.1.2.
+  <p>Generated by <a href="https://ruby.github.io/rdoc/">RDoc</a> 6.2.1.
   <p>Based on <a href="http://deveiate.org/projects/Darkfish-RDoc/">Darkfish</a> by <a href="http://deveiate.org">Michael Granger</a>.
 </footer>