oneport-debug-iam 0.1.0__py3-none-any.whl

oneport_debug_iam/__init__.py

@@ -0,0 +1,23 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2024 OnePort Debug Contributors
+"""
+oneport-debug-iam: Enterprise IAM-aware debugger.
+
+Use case — The MNC problem:
+  A developer deploys a new microservice. It returns 403 on every request.
+  The error log says "insufficient_scope". But which scope? The service talks
+  to Okta, which enforces AD group membership, which maps to Azure AD roles.
+  No single person understands the full chain.
+
+  $ oneport-iam trace --user jsmith@corp.com --app payment-service --action write
+  → Fetches JWT from Okta for the user
+  → Inspects JWT scopes and group memberships
+  → Queries Active Directory for group membership chain
+  → Evaluates the app's RBAC policy against the user's actual token
+  → AI: "User jsmith is in AD group 'Engineering' but payment-service requires
+    'payments-write' scope, granted only to 'Finance-Approvers' group.
+    Add jsmith to 'Finance-Approvers' in Active Directory, or relax the
+    payment-service RBAC policy in config/rbac.yaml:L42."
+"""
+
+__version__ = "0.1.0"

oneport_debug_iam/cli.py

@@ -0,0 +1,252 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2024 OnePort Debug Contributors
+"""
+oneport-iam CLI
+
+Usage examples:
+  # Trace why user jsmith gets 403 on payment-service write endpoint
+  oneport-iam trace --user jsmith@corp.com --app payment-service --action write --resource /api/v1/charge
+
+  # Introspect a token and show what it's actually authorized to do
+  oneport-iam inspect-token --token eyJhbGci... --platform okta
+
+  # Simulate what token a user would receive from Okta + evaluate against app RBAC
+  oneport-iam simulate --user jsmith --platform okta --policy config/rbac.yaml --resource /api/v1/payments --action POST
+
+  # Find all users who CAN access a resource (blast radius analysis)
+  oneport-iam who-can --resource /api/v1/admin/users --action DELETE --policy config/rbac.yaml
+
+MNC use case:
+  Auditor asks: "Who can delete users in production?"
+  $ oneport-iam who-can --resource /api/v1/admin/users --action DELETE --policy rbac.yaml
+  → Lists every AD group + Okta group that has DELETE permission
+  → AI generates an access review report for compliance
+"""
+from __future__ import annotations
+
+import asyncio
+import json
+import sys
+from pathlib import Path
+
+import click
+import structlog
+
+from oneport_debug_core.config.settings import load_config
+from oneport_debug_core.cli.output import print_rca, print_error, print_step, console
+from oneport_debug_core.engine.orchestrator import Orchestrator
+from oneport_debug_core.models.rca import Evidence
+from oneport_debug_iam.simulators.rbac_policy_engine import RBACPolicyEngine, Decision
+
+log = structlog.get_logger(__name__)
+
+
+@click.group()
+@click.option("--config", default=None, type=click.Path())
+@click.pass_context
+def main(ctx: click.Context, config: str | None) -> None:
+    """oneport-debug-iam — Enterprise IAM-aware authorization failure debugger."""
+    from oneport_debug_core.cli.output import ensure_utf8_console
+    ensure_utf8_console()
+    ctx.ensure_object(dict)
+    ctx.obj["config"] = load_config(Path(config) if config else None)
+
+
+@main.command()
+@click.option("--format", "output_format", default="rich", type=click.Choice(["rich", "json"]), help="Output format")
+def demo(output_format: str) -> None:
+    """Run a zero-config demo on a bundled 403 scenario (no Okta/API key needed)."""
+    from oneport_debug_iam.demo import run_demo
+    run_demo(json_output=(output_format == "json"))
+
+
+@main.command()
+@click.option("--user", required=True, help="User email or sAMAccountName")
+@click.option("--app", required=True, help="Application / service name")
+@click.option("--action", required=True, help="HTTP verb or RBAC action (GET, write, delete, ...)")
+@click.option("--resource", default="/", help="Resource path being accessed")
+@click.option("--platform", multiple=True, type=click.Choice(["okta", "ad", "azure_ad", "ping"]),
+              default=["okta", "ad"], help="IAM platforms to query (can specify multiple)")
+@click.option("--policy", default=None, type=click.Path(exists=True), help="App RBAC policy YAML")
+@click.option("--format", "output_format", default="rich", type=click.Choice(["rich", "json"]))
+@click.pass_context
+def trace(
+    ctx: click.Context,
+    user: str,
+    app: str,
+    action: str,
+    resource: str,
+    platform: tuple[str, ...],
+    policy: str | None,
+    output_format: str,
+) -> None:
+    """Trace why a user is getting 403/401 — identify the exact missing permission."""
+    config = ctx.obj["config"]
+    print_step(f"Tracing IAM failure for {user} → {action} {resource} on {app}...")
+
+    try:
+        result = asyncio.run(_run_trace(config, user, app, action, resource, list(platform), policy))
+    except Exception as err:
+        print_error(str(err), hint="Check your IAM connector credentials in environment variables")
+        sys.exit(1)
+
+    print_rca(result, output_format)
+
+
+@main.command(name="inspect-token")
+@click.option("--token", required=True, help="JWT or opaque access token")
+@click.option("--platform", default="okta", type=click.Choice(["okta", "azure_ad"]))
+@click.option("--policy", default=None, type=click.Path(exists=True))
+@click.option("--resource", default="/", help="Resource to evaluate against")
+@click.option("--action", default="GET")
+@click.pass_context
+def inspect_token(
+    ctx: click.Context, token: str, platform: str, policy: str | None, resource: str, action: str
+) -> None:
+    """Decode and evaluate an access token — show what it IS and IS NOT authorized to do."""
+    import os, base64, json as _json
+
+    # JWT decode (without verification — for debugging purposes only)
+    try:
+        parts = token.split(".")
+        if len(parts) == 3:
+            payload_b64 = parts[1] + "=" * (-len(parts[1]) % 4)
+            claims = _json.loads(base64.urlsafe_b64decode(payload_b64))
+            console.print("\n[bold cyan]Token Claims:[/bold cyan]")
+            console.print_json(_json.dumps(claims, indent=2, default=str))
+
+            scopes = claims.get("scope", "").split() or claims.get("scp", [])
+            groups = claims.get("groups", []) or claims.get("roles", [])
+
+            if policy:
+                engine = RBACPolicyEngine()
+                engine.load_yaml(Path(policy))
+                result = engine.evaluate(groups, scopes, resource, action)
+                _print_eval_result(result, user="<token-subject>", resource=resource, action=action)
+        else:
+            console.print("[yellow]Opaque token — cannot decode without introspection endpoint.[/yellow]")
+    except Exception as err:
+        print_error(f"Token decode failed: {err}")
+
+
+@main.command(name="who-can")
+@click.option("--resource", required=True)
+@click.option("--action", required=True)
+@click.option("--policy", required=True, type=click.Path(exists=True))
+@click.pass_context
+def who_can(ctx: click.Context, resource: str, action: str, policy: str) -> None:
+    """List all groups/roles that have permission to perform an action on a resource."""
+    engine = RBACPolicyEngine()
+    engine.load_yaml(Path(policy))
+
+    allowed_groups: set[str] = set()
+    for rule in engine._rules:
+        if (
+            engine._matches_resource(rule.resources, resource)
+            and engine._matches_action(rule.actions, action)
+            and rule.effect == "allow"
+        ):
+            allowed_groups.update(rule.subjects)
+
+    console.print(f"\n[bold]Groups/roles with {action} on {resource}:[/bold]\n")
+    if allowed_groups:
+        for g in sorted(allowed_groups):
+            console.print(f"  [green]✔[/green] {g}")
+    else:
+        console.print("  [red]No rules grant this permission.[/red]")
+
+    console.print(f"\n[dim]Policy: {policy}[/dim]")
+
+
+async def _run_trace(config, user, app, action, resource, platforms, policy_path):
+    import os
+
+    orchestrator = Orchestrator(config)
+    evidence_data: dict = {"user": user, "app": app, "action": action, "resource": resource}
+
+    # Query IAM platforms. A platform that isn't configured is skipped silently;
+    # a configured platform that fails is logged but doesn't abort the trace
+    # (Okta up + AD down should still produce a partial analysis).
+    if "okta" in platforms and os.environ.get("OKTA_ORG_URL") and os.environ.get("OKTA_API_TOKEN"):
+        try:
+            from oneport_debug_iam.connectors.okta_connector import OktaConnector
+            okta = OktaConnector(
+                org_url=os.environ["OKTA_ORG_URL"],
+                api_token=os.environ["OKTA_API_TOKEN"],
+            )
+            okta_user = await okta.get_user(user)
+            if okta_user:
+                evidence_data["okta"] = {
+                    "status": okta_user.status,
+                    "groups": okta_user.groups,
+                    "apps": okta_user.app_assignments,
+                }
+        except Exception as err:
+            log.warning("iam.okta_query_failed", error=str(err))
+
+    ad_configured = all(os.environ.get(k) for k in ("AD_SERVER", "AD_BASE_DN", "AD_BIND_USER", "AD_BIND_PASSWORD"))
+    if "ad" in platforms and ad_configured:
+        try:
+            from oneport_debug_iam.connectors.active_directory import ActiveDirectoryConnector
+            ad = ActiveDirectoryConnector(
+                server=os.environ["AD_SERVER"],
+                base_dn=os.environ["AD_BASE_DN"],
+                bind_user=os.environ["AD_BIND_USER"],
+                bind_password=os.environ["AD_BIND_PASSWORD"],
+            )
+            ad_user = ad.get_user(user)
+            if ad_user:
+                evidence_data["active_directory"] = {
+                    "is_enabled": ad_user.is_enabled,
+                    "is_locked": ad_user.is_locked,
+                    "direct_groups": ad_user.groups,
+                    "all_groups_recursive": ad_user.all_groups,
+                    "attributes": ad_user.attributes,
+                }
+        except Exception as err:
+            log.warning("iam.ad_query_failed", error=str(err))
+
+    # Nothing to analyze? Tell the user exactly what to provide.
+    if not any(k in evidence_data for k in ("okta", "active_directory")) and not policy_path:
+        raise ValueError(
+            "Nothing to analyze: no IAM identity data and no policy provided.\n"
+            "  Set OKTA_ORG_URL + OKTA_API_TOKEN (and/or AD_SERVER, AD_BASE_DN, "
+            "AD_BIND_USER, AD_BIND_PASSWORD), and/or pass --policy <rbac.yaml>.\n"
+            "  To see it work right now with no setup, run:  oneport-iam demo"
+        )
+
+    # Evaluate RBAC policy locally
+    if policy_path:
+        engine = RBACPolicyEngine()
+        engine.load_yaml(Path(policy_path))
+        all_groups = (
+            evidence_data.get("okta", {}).get("groups", [])
+            + evidence_data.get("active_directory", {}).get("all_groups_recursive", [])
+        )
+        scopes = evidence_data.get("token_scopes", [])
+        eval_result = engine.evaluate(all_groups, scopes, resource, action)
+        evidence_data["rbac_evaluation"] = {
+            "decision": eval_result.decision.value,
+            "explanation": eval_result.explanation,
+            "missing_groups": eval_result.missing_groups,
+            "missing_scopes": eval_result.missing_scopes,
+            "blocking_rules": [{"id": r.rule_id, "file": r.source_file, "line": r.source_line} for r in eval_result.blocking_rules],
+        }
+
+    evidence = Evidence(source="iam-trace", raw=evidence_data)
+    return await orchestrator.analyze(
+        module="iam",
+        evidence=[evidence],
+        extra_context={"user": user, "app": app, "action": action, "resource": resource},
+    )
+
+
+def _print_eval_result(result, user: str, resource: str, action: str) -> None:
+    color = "green" if result.decision.value == "allow" else "red"
+    icon = "✔" if result.decision.value == "allow" else "✖"
+    console.print(f"\n[{color}]{icon} {result.decision.value.upper()}[/{color}]  {user} → {action} {resource}")
+    console.print(f"\n[dim]{result.explanation}[/dim]")
+    if result.missing_groups:
+        console.print(f"\n[yellow]Missing groups:[/yellow] {', '.join(result.missing_groups)}")
+    if result.missing_scopes:
+        console.print(f"[yellow]Missing scopes:[/yellow] {', '.join(result.missing_scopes)}")

oneport_debug_iam/connectors/__init__.py

@@ -0,0 +1,27 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2024 OnePort Debug Contributors
+"""
+IAM provider connectors.
+
+Imports are lazy so that pulling in one connector (e.g. Okta, httpx-based) does
+not force optional dependencies of another (e.g. Active Directory needs ldap3).
+"""
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from oneport_debug_iam.connectors.okta_connector import OktaConnector
+    from oneport_debug_iam.connectors.active_directory import ActiveDirectoryConnector
+
+__all__ = ["OktaConnector", "ActiveDirectoryConnector"]
+
+
+def __getattr__(name: str):
+    if name == "OktaConnector":
+        from oneport_debug_iam.connectors.okta_connector import OktaConnector
+        return OktaConnector
+    if name == "ActiveDirectoryConnector":
+        from oneport_debug_iam.connectors.active_directory import ActiveDirectoryConnector
+        return ActiveDirectoryConnector
+    raise AttributeError(f"module {__name__!r} has no attribute {name!r}")

oneport_debug_iam/connectors/active_directory.py

@@ -0,0 +1,169 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2024 OnePort Debug Contributors
+"""
+Active Directory connector via LDAP3.
+
+Reads:
+- User attributes (sAMAccountName, mail, memberOf, userAccountControl)
+- Group membership chain (recursive nested groups)
+- Applied Group Policy Objects (GPOs)
+- Password and account policy (for lockout debugging)
+
+Enterprise note: supports LDAPS (TLS) with corporate CA bundle,
+and NTLM/Kerberos authentication for environments where Basic auth is disabled.
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+
+import structlog
+
+try:
+    import ldap3
+except ImportError:  # pragma: no cover - optional dependency
+    ldap3 = None  # type: ignore[assignment]
+
+log = structlog.get_logger(__name__)
+
+_AD_INSTALL_HINT = (
+    "Active Directory support requires the 'ldap3' package. "
+    "Install it with:  pip install 'oneport-debug-iam[ad]'"
+)
+
+
+def _require_ldap3() -> None:
+    if ldap3 is None:
+        raise ImportError(_AD_INSTALL_HINT)
+
+
+@dataclass
+class ADUser:
+    sam_account_name: str
+    email: str
+    display_name: str
+    distinguished_name: str
+    is_enabled: bool
+    is_locked: bool
+    groups: list[str] = field(default_factory=list)      # Direct groups
+    all_groups: list[str] = field(default_factory=list)  # Recursive / transitive
+    attributes: dict = field(default_factory=dict)
+
+
+class ActiveDirectoryConnector:
+    def __init__(
+        self,
+        server: str,
+        base_dn: str,
+        bind_user: str,
+        bind_password: str,
+        port: int = 636,
+        use_tls: bool = True,
+        ca_certs_file: str | None = None,
+    ) -> None:
+        _require_ldap3()
+        tls = ldap3.Tls(
+            validate=ldap3.ssl.CERT_REQUIRED if ca_certs_file else ldap3.ssl.CERT_NONE,
+            ca_certs_file=ca_certs_file,
+        ) if use_tls else None
+
+        self._server = ldap3.Server(server, port=port, use_ssl=use_tls, tls=tls, get_info=ldap3.ALL)
+        self._bind_user = bind_user
+        self._bind_password = bind_password
+        self._base_dn = base_dn
+
+    def _connect(self) -> ldap3.Connection:
+        conn = ldap3.Connection(
+            self._server,
+            user=self._bind_user,
+            password=self._bind_password,
+            authentication=ldap3.SIMPLE,
+            auto_bind=ldap3.AUTO_BIND_TLS_BEFORE_BIND if self._server.ssl else ldap3.AUTO_BIND_NO_TLS,
+        )
+        if not conn.bind():
+            raise RuntimeError(f"LDAP bind failed: {conn.last_error}")
+        return conn
+
+    def get_user(self, username: str) -> ADUser | None:
+        """Fetch user by sAMAccountName or email."""
+        conn = self._connect()
+        filter_str = (
+            f"(&(objectClass=user)(|(sAMAccountName={username})(mail={username})))"
+        )
+        conn.search(
+            self._base_dn,
+            filter_str,
+            attributes=[
+                "sAMAccountName", "mail", "displayName", "distinguishedName",
+                "memberOf", "userAccountControl", "lockoutTime",
+                "pwdLastSet", "lastLogon", "department", "title",
+            ],
+        )
+        if not conn.entries:
+            log.warning("ad.user_not_found", username=username)
+            return None
+
+        entry = conn.entries[0]
+        uac = int(entry.userAccountControl.value or 0)
+        is_enabled = not bool(uac & 0x2)     # ADS_UF_ACCOUNTDISABLE
+        is_locked = bool(uac & 0x10)          # ADS_UF_LOCKOUT
+
+        direct_groups = [str(g) for g in (entry.memberOf.values or [])]
+        dn = str(entry.distinguishedName)
+
+        # Recursive group expansion
+        all_groups = self._expand_groups(conn, direct_groups)
+
+        return ADUser(
+            sam_account_name=str(entry.sAMAccountName),
+            email=str(entry.mail),
+            display_name=str(entry.displayName),
+            distinguished_name=dn,
+            is_enabled=is_enabled,
+            is_locked=is_locked,
+            groups=direct_groups,
+            all_groups=all_groups,
+            attributes={
+                "department": str(entry.department),
+                "title": str(entry.title),
+                "pwd_last_set": str(entry.pwdLastSet),
+                "last_logon": str(entry.lastLogon),
+            },
+        )
+
+    def _expand_groups(self, conn: ldap3.Connection, groups: list[str], depth: int = 0) -> list[str]:
+        """Recursively expand nested AD groups up to depth 5."""
+        if depth >= 5:
+            return groups
+        all_groups = list(groups)
+        for group_dn in groups:
+            conn.search(
+                group_dn,
+                "(objectClass=group)",
+                attributes=["memberOf"],
+                search_scope=ldap3.BASE,
+            )
+            if conn.entries:
+                nested = [str(g) for g in (conn.entries[0].memberOf.values or [])]
+                new_groups = [g for g in nested if g not in all_groups]
+                all_groups.extend(new_groups)
+                all_groups.extend(self._expand_groups(conn, new_groups, depth + 1))
+        return all_groups
+
+    def get_group_members(self, group_dn: str) -> list[str]:
+        """Return sAMAccountNames of all members of a group."""
+        conn = self._connect()
+        conn.search(
+            group_dn,
+            "(objectClass=group)",
+            attributes=["member"],
+            search_scope=ldap3.BASE,
+        )
+        if not conn.entries:
+            return []
+        members = conn.entries[0].member.values or []
+        result: list[str] = []
+        for member_dn in members:
+            conn.search(str(member_dn), "(objectClass=user)", attributes=["sAMAccountName"], search_scope=ldap3.BASE)
+            if conn.entries:
+                result.append(str(conn.entries[0].sAMAccountName))
+        return result

oneport_debug_iam/connectors/okta_connector.py

@@ -0,0 +1,124 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2024 OnePort Debug Contributors
+"""
+Okta connector — reads users, groups, app assignments, and token scopes via Okta API v1.
+
+Supports both API token auth and OAuth 2.0 service-to-service auth.
+Handles Okta rate limits automatically (429 + Retry-After header).
+Uses async sleep (not time.sleep) so the event loop isn't blocked.
+"""
+from __future__ import annotations
+
+import asyncio
+from dataclasses import dataclass, field
+
+import httpx
+import structlog
+
+log = structlog.get_logger(__name__)
+
+
+@dataclass
+class OktaUser:
+    id: str
+    login: str
+    email: str
+    status: str  # ACTIVE | STAGED | PROVISIONED | DEPROVISIONED | SUSPENDED | LOCKED_OUT
+    groups: list[str] = field(default_factory=list)        # Group names
+    app_assignments: list[str] = field(default_factory=list)  # App IDs
+    profile: dict = field(default_factory=dict)
+
+
+@dataclass
+class OktaTokenClaims:
+    subject: str
+    scopes: list[str]
+    groups: list[str]
+    client_id: str
+    issuer: str
+    expiry: int
+    raw_claims: dict = field(default_factory=dict)
+
+
+class OktaConnector:
+    def __init__(self, org_url: str, api_token: str, timeout: int = 20) -> None:
+        self._base = org_url.rstrip("/") + "/api/v1"
+        self._headers = {
+            "Authorization": f"SSWS {api_token}",
+            "Accept": "application/json",
+        }
+        self._timeout = timeout
+
+    async def get_user(self, login_or_id: str) -> OktaUser | None:
+        async with httpx.AsyncClient(headers=self._headers, timeout=self._timeout) as client:
+            r = await self._get(client, f"/users/{login_or_id}")
+            if r.status_code == 404:
+                return None
+            r.raise_for_status()
+            u = r.json()
+
+            groups_r = await self._get(client, f"/users/{u['id']}/groups")
+            groups = [g["profile"]["name"] for g in (groups_r.json() if groups_r.is_success else [])]
+
+            apps_r = await self._get(client, f"/users/{u['id']}/appLinks")
+            apps = [a["appName"] for a in (apps_r.json() if apps_r.is_success else [])]
+
+            return OktaUser(
+                id=u["id"],
+                login=u["profile"]["login"],
+                email=u["profile"]["email"],
+                status=u["status"],
+                groups=groups,
+                app_assignments=apps,
+                profile=u.get("profile", {}),
+            )
+
+    async def introspect_token(self, token: str, client_id: str, client_secret: str, server_id: str = "default") -> OktaTokenClaims:
+        """Introspect an opaque or JWT access token to get its actual claims."""
+        async with httpx.AsyncClient(timeout=self._timeout) as client:
+            r = await client.post(
+                f"{self._base.replace('/api/v1', '')}/oauth2/{server_id}/v1/introspect",
+                data={"token": token, "token_type_hint": "access_token"},
+                auth=(client_id, client_secret),
+                headers={"Accept": "application/json"},
+            )
+            r.raise_for_status()
+            claims = r.json()
+
+        scopes = claims.get("scope", "").split()
+        groups = claims.get("groups", [])
+
+        return OktaTokenClaims(
+            subject=claims.get("sub", ""),
+            scopes=scopes,
+            groups=groups,
+            client_id=claims.get("client_id", ""),
+            issuer=claims.get("iss", ""),
+            expiry=claims.get("exp", 0),
+            raw_claims=claims,
+        )
+
+    async def get_app_scopes(self, app_id: str, server_id: str = "default") -> list[str]:
+        """List all OAuth scopes configured for an authorization server."""
+        async with httpx.AsyncClient(headers=self._headers, timeout=self._timeout) as client:
+            r = await self._get(client, f"/authorizationServers/{server_id}/scopes")
+            r.raise_for_status()
+            return [s["name"] for s in r.json()]
+
+    async def _get(self, client: httpx.AsyncClient, path: str) -> httpx.Response:
+        backoff = 2.0
+        for attempt in range(4):
+            r = await client.get(f"{self._base}{path}")
+            if r.status_code == 429:
+                retry_after = float(r.headers.get("Retry-After", backoff))
+                log.warning("okta.rate_limited", retry_after=retry_after, path=path, attempt=attempt)
+                await asyncio.sleep(retry_after)
+                backoff *= 2
+                continue
+            if r.status_code == 503:
+                await asyncio.sleep(backoff)
+                backoff *= 2
+                continue
+            return r
+        # Return last response — caller decides whether to raise
+        return r

oneport_debug_iam/demo/__init__.py

@@ -0,0 +1,7 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2024 OnePort Debug Contributors
+"""Zero-config demo for oneport-iam — runs the real RBAC engine on bundled sample data."""
+
+from oneport_debug_iam.demo.runner import run_demo
+
+__all__ = ["run_demo"]

oneport_debug_iam/demo/runner.py

@@ -0,0 +1,163 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2024 OnePort Debug Contributors
+"""
+Runner for `oneport-iam demo`.
+
+Evaluates a bundled 403 scenario with the *real* RBACPolicyEngine (the same
+engine used against live Okta/AD identities), then renders the decision, the
+exact missing group/scope, and a root-cause analysis.
+
+No Okta tenant, no API key, no network. Someone who just ran
+`pip install oneport-debug-iam` sees the product work in ~2 seconds.
+"""
+from __future__ import annotations
+
+import tempfile
+from pathlib import Path
+
+from rich import box
+from rich.panel import Panel
+from rich.table import Table
+from rich.text import Text
+
+from oneport_debug_core.cli.output import console, print_rca
+from oneport_debug_core.models.rca import CodeLocation, RCAResult, Severity
+from oneport_debug_iam.demo import sample_data as sd
+from oneport_debug_iam.simulators.rbac_policy_engine import RBACPolicyEngine, Decision
+
+
+def _quiet_logs() -> None:
+    import logging
+    import structlog
+    structlog.configure(wrapper_class=structlog.make_filtering_bound_logger(logging.WARNING))
+
+
+def run_demo(json_output: bool = False) -> RCAResult:
+    """Run the bundled IAM 403 scenario end-to-end and render it."""
+    _quiet_logs()
+
+    tmp = Path(tempfile.mkdtemp(prefix="oneport-iam-demo-"))
+    try:
+        policy_path = tmp / "rbac.yaml"
+        policy_path.write_text(sd.POLICY_YAML, encoding="utf-8")
+
+        engine = RBACPolicyEngine()
+        engine.load_yaml(policy_path)
+
+        result = engine.evaluate(
+            user_groups=sd.USER["groups"],
+            user_scopes=sd.USER["scopes"],
+            resource=sd.REQUEST["resource"],
+            action=sd.REQUEST["action"],
+        )
+        governing = _governing_rule(engine, sd.REQUEST["resource"], sd.REQUEST["action"])
+        rca = _build_rca(result, governing)
+
+        if json_output:
+            console.print_json(rca.model_dump_json(indent=2))
+            return rca
+
+        _render_intro()
+        _render_identity()
+        _render_decision(result)
+        console.print()
+        print_rca(rca, output_format="rich")
+        _render_outro()
+        return rca
+    finally:
+        import shutil
+        shutil.rmtree(tmp, ignore_errors=True)
+
+
+def _governing_rule(engine: RBACPolicyEngine, resource: str, action: str):
+    """The allow rule that governs this resource+action (what the user failed to satisfy)."""
+    for rule in engine._rules:
+        if (engine._matches_resource(rule.resources, resource)
+                and engine._matches_action(rule.actions, action)
+                and rule.effect == "allow"):
+            return rule
+    return None
+
+
+def _build_rca(result, governing) -> RCAResult:
+    locations: list[CodeLocation] = []
+    if governing is not None:
+        locations.append(CodeLocation(
+            repo=sd.APP,
+            file_path="rbac.yaml",
+            line_number=governing.source_line,
+            function_name=governing.rule_id,
+        ))
+    return RCAResult(
+        module="iam",
+        severity=Severity(sd.CURATED_RCA["severity"]),
+        summary=sd.CURATED_RCA["summary"],
+        root_cause=sd.CURATED_RCA["root_cause"],
+        recommended_fix=sd.CURATED_RCA["recommended_fix"],
+        confidence=sd.CURATED_RCA["confidence"],
+        locations=locations,
+        affected_services=[sd.APP],
+        tags={
+            "user": sd.USER["login"],
+            "decision": result.decision.value,
+            "missing_groups": ",".join(result.missing_groups) or "—",
+            "missing_scopes": ",".join(result.missing_scopes) or "—",
+        },
+        model_used="bundled sample (offline demo)",
+    )
+
+
+def _render_intro() -> None:
+    body = Text()
+    body.append("Running on bundled sample data — no Okta tenant, no API key, no setup.\n\n", style="dim")
+    body.append("Scenario: ", style="bold")
+    body.append(f"{sd.USER['login']} gets a 403.\n")
+    body.append("Request ", style="bold")
+    body.append(f"{sd.REQUEST['action']} {sd.REQUEST['resource']}", style="cyan")
+    body.append(f"  on  {sd.APP}\n")
+    body.append("Evaluated locally against the app's RBAC policy.", style="dim")
+    console.print()
+    console.print(Panel(body, title="[bold]OnePort Debug — oneport-iam demo[/bold]",
+                        border_style="cyan", box=box.ROUNDED))
+
+
+def _render_identity() -> None:
+    table = Table(title="Identity (from Okta)", box=box.SIMPLE_HEAVY, title_style="bold")
+    table.add_column("Attribute", style="cyan", no_wrap=True)
+    table.add_column("Value", style="white")
+    table.add_row("Login", sd.USER["login"])
+    table.add_row("Status", f"[green]{sd.USER['okta_status']}[/green]")
+    table.add_row("Groups", ", ".join(sd.USER["groups"]))
+    table.add_row("Scopes", ", ".join(sd.USER["scopes"]))
+    console.print()
+    console.print(table)
+
+
+def _render_decision(result) -> None:
+    is_deny = result.decision != Decision.ALLOW
+    color = "red" if is_deny else "green"
+    icon = "✖" if is_deny else "✔"
+    body = Text()
+    body.append(f"{icon} {result.decision.value.upper()}\n\n", style=f"bold {color}")
+    if result.missing_groups:
+        body.append("Missing group(s):  ", style="yellow")
+        body.append(", ".join(result.missing_groups) + "\n")
+    if result.missing_scopes:
+        body.append("Missing scope(s):  ", style="yellow")
+        body.append(", ".join(result.missing_scopes) + "\n")
+    body.append("\n")
+    body.append(result.explanation, style="dim")
+    console.print()
+    console.print(Panel(body, title="[bold]Authorization decision[/bold]",
+                        border_style=color, box=box.ROUNDED))
+
+
+def _render_outro() -> None:
+    body = Text()
+    body.append("This ran the real RBAC engine on sample data.\n", style="dim")
+    body.append("Run it on your own identities:\n\n", style="dim")
+    body.append("  export OKTA_ORG_URL=…  OKTA_API_TOKEN=…\n", style="green")
+    body.append("  oneport-iam trace --user jsmith@corp.com --app payment-service \\\n", style="green")
+    body.append("      --action POST --resource /api/v1/payments/charge --policy rbac.yaml\n", style="green")
+    console.print()
+    console.print(Panel(body, title="[bold]Next[/bold]", border_style="dim", box=box.ROUNDED))

oneport_debug_iam/demo/sample_data.py

@@ -0,0 +1,70 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2024 OnePort Debug Contributors
+"""
+Bundled sample data for `oneport-iam demo`.
+
+A realistic 403: an engineer clicks "refund" in an internal tool and gets
+"Forbidden". They swear they have access. The truth, three systems deep:
+their Okta groups grant read-only access, but the charge endpoint's policy
+requires write privileges they were never granted.
+
+The RBAC evaluation is run by the REAL engine; only the AI narrative is curated
+so the demo needs no API key.
+"""
+from __future__ import annotations
+
+APP = "payment-service"
+
+# What Okta would return for this user (no Okta call in the demo).
+USER = {
+    "login": "jsmith@corp.com",
+    "okta_status": "ACTIVE",
+    "groups": ["payments-readonly", "engineering"],
+    "scopes": ["payments:read", "profile"],
+}
+
+# The request that 403'd.
+REQUEST = {"resource": "/api/v1/payments/charge", "action": "POST"}
+
+# The application's RBAC policy — exactly as a developer would write it.
+POLICY_YAML = """\
+rules:
+  - id: allow-charge
+    effect: allow
+    groups: [payments-admin]
+    scopes: [payments:write]
+    resources: ["/api/v1/payments/*"]
+    actions: [POST]
+    description: Only payments-admin with write scope may charge
+
+  - id: allow-readonly
+    effect: allow
+    groups: [payments-readonly]
+    scopes: [payments:read]
+    resources: ["/api/v1/payments/*"]
+    actions: [GET]
+    description: Read-only users may list charges
+"""
+
+# Curated AI narrative. The missing group/scope shown next to it are computed
+# live by the real RBAC engine, not hard-coded here.
+CURATED_RCA = {
+    "severity": "high",
+    "summary": (
+        "jsmith@corp.com gets 403 on POST /api/v1/payments/charge: their Okta "
+        "groups grant read-only access, but the charge endpoint requires write "
+        "privileges they don't have."
+    ),
+    "root_cause": (
+        "The user is in 'payments-readonly' with scope 'payments:read'. The charge "
+        "endpoint's allow rule 'allow-charge' requires the 'payments-admin' group "
+        "AND the 'payments:write' scope. No allow rule matches the user for "
+        "POST on this resource, so the request is denied (default-deny)."
+    ),
+    "recommended_fix": (
+        "If this user should be able to charge, add jsmith@corp.com to the "
+        "'payments-admin' Okta group (which carries the payments:write scope). "
+        "If read-only is intended, the client should call GET, not POST."
+    ),
+    "confidence": 0.9,
+}

oneport_debug_iam/py.typed

@@ -0,0 +1 @@
+# Marker file for PEP 561. This package ships inline type hints.

oneport_debug_iam/simulators/__init__.py

@@ -0,0 +1,5 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2024 OnePort Debug Contributors
+from oneport_debug_iam.simulators.rbac_policy_engine import RBACPolicyEngine, EvaluationResult, Decision
+
+__all__ = ["RBACPolicyEngine", "EvaluationResult", "Decision"]

oneport_debug_iam/simulators/rbac_policy_engine.py

@@ -0,0 +1,235 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2024 OnePort Debug Contributors
+"""
+RBACPolicyEngine — evaluates a user's effective permissions against an application's policy.
+
+Supports policy formats used by:
+- OPA (Open Policy Agent) Rego — the MNC standard
+- Casbin — common in Go/Java services
+- Custom YAML RBAC (e.g. Kubernetes-style rules)
+- AWS IAM policy documents
+
+The engine does NOT call OPA/Casbin servers — it re-evaluates the policy locally
+so developers can understand exactly which rule allowed or denied the request.
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from enum import Enum
+from pathlib import Path
+from typing import Any
+
+import yaml
+import structlog
+
+log = structlog.get_logger(__name__)
+
+
+class Decision(str, Enum):
+    ALLOW = "allow"
+    DENY = "deny"
+    NOT_APPLICABLE = "not_applicable"
+
+
+@dataclass
+class PolicyRule:
+    rule_id: str
+    subjects: list[str]   # groups / roles / user IDs required (OR semantics within this list)
+    resources: list[str]  # resource patterns (supports * wildcard)
+    actions: list[str]    # read, write, delete, * ...
+    effect: str           # allow | deny
+    required_scopes: list[str] = field(default_factory=list)  # OAuth scopes required (OR semantics)
+    conditions: dict = field(default_factory=dict)
+    source_file: str = ""
+    source_line: int = 0
+
+    @property
+    def is_blanket(self) -> bool:
+        """True if this rule has no subject/scope restriction — applies to everyone."""
+        return not self.subjects and not self.required_scopes
+
+
+@dataclass
+class EvaluationResult:
+    decision: Decision
+    matching_rules: list[PolicyRule]
+    blocking_rules: list[PolicyRule]
+    missing_groups: list[str]
+    missing_scopes: list[str]
+    explanation: str
+
+
+class RBACPolicyEngine:
+    def __init__(self) -> None:
+        self._rules: list[PolicyRule] = []
+
+    def load_yaml(self, path: Path) -> None:
+        """Load a Kubernetes-style RBAC YAML policy."""
+        with path.open() as f:
+            doc = yaml.safe_load(f)
+
+        source = str(path)
+        for i, rule in enumerate(doc.get("rules", []) or doc.get("policies", [])):
+            raw_subjects = self._to_list(rule.get("subjects") or rule.get("groups", []))
+            # Scopes may be expressed two ways: as `scope:`-prefixed entries in the
+            # subjects list (OAuth-style), or as a dedicated `scopes:` field. Normalise
+            # both into required_scopes so matching/missing-detection is uniform.
+            groups = [s for s in raw_subjects if not s.startswith("scope:")]
+            scope_subjects = [s.removeprefix("scope:") for s in raw_subjects if s.startswith("scope:")]
+            required_scopes = scope_subjects + self._to_list(rule.get("scopes", []))
+            self._rules.append(PolicyRule(
+                rule_id=rule.get("id", f"rule-{i}"),
+                subjects=groups,
+                resources=self._to_list(rule.get("resources", ["*"])),
+                actions=self._to_list(rule.get("verbs") or rule.get("actions", ["*"])),
+                effect=str(rule.get("effect", "allow")).lower(),
+                required_scopes=required_scopes,
+                conditions=rule.get("conditions", {}),
+                source_file=source,
+                source_line=i + 1,
+            ))
+        log.info("rbac.rules_loaded", count=len(self._rules), source=source)
+
+    def load_aws_iam(self, policy_doc: dict) -> None:
+        """Load an AWS IAM policy document."""
+        for i, stmt in enumerate(policy_doc.get("Statement", [])):
+            principals = self._to_list(stmt.get("Principal", {}).get("AWS", ["*"]))
+            resources = self._to_list(stmt.get("Resource", ["*"]))
+            actions = self._to_list(stmt.get("Action", ["*"]))
+            effect = str(stmt.get("Effect", "Allow")).lower()
+            self._rules.append(PolicyRule(
+                rule_id=stmt.get("Sid", f"stmt-{i}"),
+                subjects=principals,
+                resources=resources,
+                actions=actions,
+                effect=effect,
+                source_file="aws-iam",
+                source_line=i,
+            ))
+
+    def evaluate(
+        self,
+        user_groups: list[str],
+        user_scopes: list[str],
+        resource: str,
+        action: str,
+    ) -> EvaluationResult:
+        """
+        Evaluate whether a user (defined by their groups + scopes) can
+        perform `action` on `resource`.
+
+        Specific deny rules (with a group/scope restriction) always take precedence.
+        Blanket deny rules (no subject/scope restriction — i.e. "deny everyone")
+        act as a default-deny fallback: they only apply if no allow rule grants access.
+        """
+        matching: list[PolicyRule] = []
+        specific_denies: list[PolicyRule] = []
+        blanket_denies: list[PolicyRule] = []
+        applicable_allows: list[PolicyRule] = []
+
+        for rule in self._rules:
+            if not self._matches_resource(rule.resources, resource):
+                continue
+            if not self._matches_action(rule.actions, action):
+                continue
+
+            subject_match = self._matches_rule(rule, user_groups, user_scopes)
+
+            if rule.effect == "deny":
+                if rule.is_blanket:
+                    blanket_denies.append(rule)
+                elif subject_match:
+                    specific_denies.append(rule)
+            elif rule.effect == "allow":
+                if subject_match:
+                    applicable_allows.append(rule)
+                else:
+                    matching.append(rule)  # Rule matches resource+action but not this user
+
+        # Required groups/scopes: from allow rules the user matched resource+action on, but not subject
+        missing_groups: list[str] = []
+        missing_scopes: list[str] = []
+        for rule in matching:
+            for subj in rule.subjects:
+                if subj not in user_groups and subj != "*":
+                    missing_groups.append(subj)
+            for scope in rule.required_scopes:
+                if scope not in user_scopes:
+                    missing_scopes.append(scope)
+
+        if specific_denies:
+            decision = Decision.DENY
+            explanation = (
+                f"Request explicitly DENIED by rule(s): "
+                + ", ".join(f"'{r.rule_id}' ({r.source_file}:L{r.source_line})" for r in specific_denies)
+            )
+        elif applicable_allows:
+            decision = Decision.ALLOW
+            explanation = (
+                f"Request ALLOWED by rule(s): "
+                + ", ".join(f"'{r.rule_id}'" for r in applicable_allows)
+            )
+        elif blanket_denies:
+            decision = Decision.DENY
+            explanation = (
+                f"Request DENIED by default-deny rule(s): "
+                + ", ".join(f"'{r.rule_id}' ({r.source_file}:L{r.source_line})" for r in blanket_denies)
+            )
+        elif matching:
+            decision = Decision.DENY
+            group_hint = f"Missing groups: {missing_groups}" if missing_groups else ""
+            scope_hint = f"Missing scopes: {missing_scopes}" if missing_scopes else ""
+            explanation = (
+                f"No matching allow rule for this user. "
+                f"{group_hint} {scope_hint}. "
+                f"Relevant rules that apply to resource+action but not this user: "
+                + ", ".join(f"'{r.rule_id}' (requires groups={r.subjects}, scopes={r.required_scopes})" for r in matching[:3])
+            )
+        else:
+            decision = Decision.NOT_APPLICABLE
+            explanation = "No policy rules apply to this resource+action combination."
+
+        return EvaluationResult(
+            decision=decision,
+            matching_rules=applicable_allows,
+            blocking_rules=specific_denies or blanket_denies,
+            missing_groups=list(set(missing_groups)),
+            missing_scopes=list(set(missing_scopes)),
+            explanation=explanation,
+        )
+
+    @staticmethod
+    def _to_list(v: Any) -> list[str]:
+        if isinstance(v, list):
+            return [str(x) for x in v]
+        if v is None:
+            return []
+        return [str(v)]
+
+    @staticmethod
+    def _matches_resource(patterns: list[str], resource: str) -> bool:
+        import fnmatch
+        return any(fnmatch.fnmatch(resource, p) or p == "*" for p in patterns)
+
+    @staticmethod
+    def _matches_action(patterns: list[str], action: str) -> bool:
+        import fnmatch
+        return any(fnmatch.fnmatch(action, p) or p == "*" for p in patterns)
+
+    @staticmethod
+    def _matches_rule(rule: PolicyRule, user_groups: list[str], user_scopes: list[str]) -> bool:
+        """
+        A rule matches a user if the user has at least one of the rule's required
+        groups (OR within groups) AND at least one of the rule's required scopes
+        (OR within scopes). An unspecified (empty) group or scope list is treated
+        as "no restriction on that dimension".
+        """
+        group_ok = (
+            not rule.subjects
+            or any(s in user_groups or s == "*" for s in rule.subjects)
+        )
+        scope_ok = (
+            not rule.required_scopes
+            or any(s in user_scopes for s in rule.required_scopes)
+        )
+        return group_ok and scope_ok

oneport_debug_iam-0.1.0.dist-info/METADATA

@@ -0,0 +1,136 @@
+Metadata-Version: 2.4
+Name: oneport-debug-iam
+Version: 0.1.0
+Summary: Enterprise IAM-aware debugger: trace 403/401 failures through Okta, Active Directory, Ping Identity, and Azure AD — find the exact missing permission or policy block
+Project-URL: Homepage, https://github.com/oneport-debug/oneport-debug
+Project-URL: Repository, https://github.com/oneport-debug/oneport-debug
+Project-URL: Bug Tracker, https://github.com/oneport-debug/oneport-debug/issues
+Project-URL: Changelog, https://github.com/oneport-debug/oneport-debug/blob/main/CHANGELOG.md
+Author: OnePort Debug Contributors
+License: Apache-2.0
+Keywords: active-directory,auth,azure-ad,debugging,enterprise,iam,okta,rbac,rca
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Debuggers
+Classifier: Topic :: System :: Systems Administration :: Authentication/Directory
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Requires-Dist: click>=8.1.7
+Requires-Dist: httpx>=0.27.0
+Requires-Dist: oneport-debug-core>=0.1.0
+Requires-Dist: pydantic>=2.9.0
+Requires-Dist: pyyaml>=6.0.2
+Requires-Dist: rich>=13.8.0
+Provides-Extra: ad
+Requires-Dist: ldap3>=2.9.1; extra == 'ad'
+Provides-Extra: azure
+Requires-Dist: azure-identity>=1.19.0; extra == 'azure'
+Requires-Dist: msal>=1.31.0; extra == 'azure'
+Description-Content-Type: text/markdown
+
+# oneport-debug-iam
+
+**Enterprise IAM-aware authorization debugger.** When a user or service gets a
+`403`/`401`, this traces the failure through your identity provider (Okta,
+Active Directory, Azure AD) *and* re-evaluates the application's RBAC policy
+locally — then tells you the exact missing group, scope, or blocking rule, and
+how to fix it.
+
+Claude Code and Copilot run with your local privileges and have zero concept of
+corporate RBAC. This tool understands the permission matrix.
+
+## Try it in 60 seconds (no Okta, no API key)
+
+```bash
+pip install oneport-debug-iam
+oneport-iam demo
+```
+
+The demo runs the **real** RBAC engine on a bundled 403: an engineer is denied
+`POST /api/v1/payments/charge`. You'll see their Okta groups/scopes, the
+authorization decision, the **exact missing group and scope**, the policy rule
+that governs the endpoint, and a root-cause analysis.
+
+```
+✖ DENY
+Missing group(s):  payments-admin
+Missing scope(s):  payments:write
+```
+
+Add `--format json` for machine-readable output (Jira/SIEM/access-review pipelines).
+
+## Use it on your own identities
+
+```bash
+export OKTA_ORG_URL=https://corp.okta.com
+export OKTA_API_TOKEN=…
+
+oneport-iam trace \
+  --user jsmith@corp.com \
+  --app payment-service \
+  --action POST \
+  --resource /api/v1/payments/charge \
+  --policy rbac.yaml
+```
+
+Other commands:
+
+```bash
+# Who can do this? (blast-radius / access review)
+oneport-iam who-can --resource /api/v1/admin/users --action DELETE --policy rbac.yaml
+
+# Decode a token and evaluate what it's actually authorized to do
+oneport-iam inspect-token --token eyJhbGci... --policy rbac.yaml --resource /api/v1/payments/charge --action POST
+```
+
+### RBAC policy format
+
+```yaml
+rules:
+  - id: allow-charge
+    effect: allow                       # allow | deny (deny wins)
+    groups: [payments-admin]            # OR within the list
+    scopes: [payments:write]            # OAuth scopes (OR); also accepts scope: entries in groups
+    resources: ["/api/v1/payments/*"]   # glob
+    actions: [POST]
+```
+
+### Environment variables
+
+| Provider | Variables |
+|---|---|
+| Okta | `OKTA_ORG_URL`, `OKTA_API_TOKEN` |
+| Active Directory | `AD_SERVER`, `AD_BASE_DN`, `AD_BIND_USER`, `AD_BIND_PASSWORD` (needs the `ad` extra) |
+
+A provider that isn't configured is skipped; one that fails is logged but doesn't
+abort the trace (Okta up + AD down still yields a partial analysis).
+
+## Optional dependencies
+
+```bash
+pip install 'oneport-debug-iam[ad]'      # Active Directory (LDAP) support
+pip install 'oneport-debug-iam[azure]'   # Azure AD / Entra ID
+```
+
+The default install is httpx-based (Okta + RBAC) and pulls no LDAP/Azure stack.
+
+## Air-gapped / on-prem AI
+
+Set `ONEPORT_MODE=local` to run the AI analysis against a local model (Ollama /
+vLLM) — no data leaves your network. See `oneport-debug-local`.
+
+## Notes
+
+- On **Git Bash (Windows)**, a `--resource /api/...` argument may get path-mangled
+  by MSYS. Prefix with `//` or run `MSYS_NO_PATHCONV=1 oneport-iam ...`. PowerShell,
+  cmd, and Linux/macOS shells are unaffected.
+
+## License
+
+Apache-2.0

oneport_debug_iam-0.1.0.dist-info/RECORD

@@ -0,0 +1,15 @@
+oneport_debug_iam/__init__.py,sha256=_LvyZHLBfW4SPlWJLtkFcIIpCMVLsHvTrJQf3uLlxEQ,1076
+oneport_debug_iam/cli.py,sha256=RGX74C9af2ZW6-kn4gjVr4Fo7yS2K5Uxe0cB4E06dCg,11408
+oneport_debug_iam/py.typed,sha256=lgCyp9gZfAMplkwv75pxHXKdO1FqRCF61SzGRi14E-M,65
+oneport_debug_iam/connectors/__init__.py,sha256=uP5GOYTAylhEJ7GaHM_1BHFSPplziBZJGlfIS9E97FI,1000
+oneport_debug_iam/connectors/active_directory.py,sha256=cLLnFxotPd7GQylLaXzeC7EFv-Eh7MwlPudvU_SX-pk,5947
+oneport_debug_iam/connectors/okta_connector.py,sha256=mxsuOALpMVlV0CdQfPQGJ1Fd34c1kIzpxtq1AePHB7o,4663
+oneport_debug_iam/demo/__init__.py,sha256=bZY7JiPfnrz7GCwAibdmygrrB1Vzf_3snT8MFDak89c,251
+oneport_debug_iam/demo/runner.py,sha256=biSziYJ3otB_Nm21a47JfruDmfUqA7vnPl05lSELNGU,6216
+oneport_debug_iam/demo/sample_data.py,sha256=44hDxFY65e54J-14bwuVeTIP7E3uZDTEUgFQD9Dmbxc,2477
+oneport_debug_iam/simulators/__init__.py,sha256=9zMc7j_LgjoBYAwibR_-6OU3XX7yKELIJWbmbyttYO8,256
+oneport_debug_iam/simulators/rbac_policy_engine.py,sha256=dT8MbKPAw192fKZ_El0aH7rVjNbFoLzGVhLude_Ia-E,9551
+oneport_debug_iam-0.1.0.dist-info/METADATA,sha256=CXn3maSU8LpcT2B9Rdlh3cN2M5iVQP4pENh0F4kDxW8,4773
+oneport_debug_iam-0.1.0.dist-info/WHEEL,sha256=mffPy8wBnZQn2VnJUU5jE99KsxaSfiyMHV9Yt0aLVxs,87
+oneport_debug_iam-0.1.0.dist-info/entry_points.txt,sha256=apwKWRGOLDg_A-dVPhT5V55st9WWV5tbuJWJc5WGvU4,59
+oneport_debug_iam-0.1.0.dist-info/RECORD,,

oneport_debug_iam-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.30.1
+Root-Is-Purelib: true
+Tag: py3-none-any

oneport_debug_iam-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+oneport-iam = oneport_debug_iam.cli:main