Examples with ApiException org.broadinstitute.dsde.workbench.client.sam.ApiException used on opensource projects

Example 1 with ApiException

use of org.broadinstitute.dsde.workbench.client.sam.ApiException in project jade-data-repo by DataBiosphere.

the class SamIam method listAuthorizedResourcesInner.

private List<UUID> listAuthorizedResourcesInner(AuthenticatedUserRequest userReq, IamResourceType iamResourceType) throws ApiException {
    ResourcesApi samResourceApi = samResourcesApi(userReq.getRequiredToken());
    List<ResourceAndAccessPolicy> resources = samResourceApi.listResourcesAndPolicies(iamResourceType.toString());
    return resources.stream().map(resource -> UUID.fromString(resource.getResourceId())).collect(Collectors.toList());
}

Example 2 with ApiException

use of org.broadinstitute.dsde.workbench.client.sam.ApiException in project jade-data-repo by DataBiosphere.

the class SamRetry method perform.

<T> T perform(SamFunction<T> function) throws InterruptedException {
    while (true) {
        try {
            // Simulate a socket timeout for testing
            configService.fault(ConfigEnum.SAM_TIMEOUT_FAULT, () -> {
                throw new ApiException("fault insertion", HttpStatusCodes.STATUS_CODE_SERVER_ERROR, null, null);
            });
            return function.apply();
        } catch (ApiException ex) {
            RuntimeException rex = SamIam.convertSAMExToDataRepoEx((ApiException) ex);
            if (!(rex instanceof IamInternalServerErrorException)) {
                throw rex;
            }
            logger.info("SamRetry: caught retry-able exception: " + ex);
            // sleep, then we give up and re-throw.
            if (operationTimeout.minusSeconds(retrySeconds).isBefore(now())) {
                logger.error("SamRetry: operation timed out after " + operationTimeout.toString());
                throw rex;
            }
        } catch (Exception ex) {
            throw new IamInternalServerErrorException("Unexpected exception type: " + ex.toString(), ex);
        }
        // Retry
        logger.info("SamRetry: sleeping " + retrySeconds + " seconds");
        TimeUnit.SECONDS.sleep(retrySeconds);
        retrySeconds = retrySeconds + retrySeconds;
        if (retrySeconds > retryMaxWait) {
            retrySeconds = retryMaxWait;
        }
    }
}

Example 3 with ApiException

use of org.broadinstitute.dsde.workbench.client.sam.ApiException in project terra-external-credentials-manager by DataBiosphere.

the class OidcApiControllerTest method mockSamUserError.

private void mockSamUserError(String accessToken, HttpStatus notFound) throws ApiException {
    var usersApiMock = mock(UsersApi.class);
    when(samServiceMock.samUsersApi(accessToken)).thenReturn(usersApiMock);
    when(usersApiMock.getUserStatusInfo()).thenThrow(new ApiException(notFound.value(), "Not Found"));
}

Example 4 with ApiException

use of org.broadinstitute.dsde.workbench.client.sam.ApiException in project terra-workspace-manager by DataBiosphere.

the class SamService method removeResourceRole.

/**
 * Wrapper around the Sam client to remove a role from the provided user on a controlled resource.
 *
 * <p>Similar to {@removeWorkspaceRole}, but for controlled resources. This should only be
 * necessary for private resources, as users do not have individual roles on shared resources.
 *
 * <p>This call to Sam is made as the WSM SA, as users do not have permission to directly modify
 * IAM on resources. This method still requires user credentials to validate as a safeguard, but
 * they are not used in the role removal call.
 *
 * @param resource The resource to remove a role from
 * @param userRequest User credentials. These are not used for the call to Sam, but must belong to
 *     a workspace owner to ensure the WSM SA is being used on a user's behalf correctly.
 * @param role The role to remove
 * @param email Email identifier of the user whose role is being removed.
 */
@Traced
public void removeResourceRole(ControlledResource resource, AuthenticatedUserRequest userRequest, ControlledResourceIamRole role, String email) throws InterruptedException {
    // Validate that the provided user credentials can modify the owners of the resource's
    // workspace.
    // Although the Sam call to revoke a resource role must use WSM SA credentials instead, this
    // is a safeguard against accidentally invoking these credentials for unauthorized users.
    checkAuthz(userRequest, SamConstants.SamResource.WORKSPACE, resource.getWorkspaceId().toString(), samActionToModifyRole(WsmIamRole.OWNER));
    try {
        ResourcesApi wsmSaResourceApi = samResourcesApi(getWsmServiceAccountToken());
        SamRetry.retry(() -> wsmSaResourceApi.removeUserFromPolicyV2(resource.getCategory().getSamResourceName(), resource.getResourceId().toString(), role.toSamRole(), email));
        logger.info("Removed role {} from user {} on resource {}", role.toSamRole(), email, resource.getResourceId());
    } catch (ApiException apiException) {
        throw SamExceptionFactory.create("Sam error removing resource role in Sam", apiException);
    }
}

Example 5 with ApiException

use of org.broadinstitute.dsde.workbench.client.sam.ApiException in project terra-workspace-manager by DataBiosphere.

the class SamService method removeWorkspaceRole.

/**
 * Wrapper around Sam client to remove a role from the provided user.
 *
 * <p>This operation is only available to MC_WORKSPACE stage workspaces, as Rawls manages
 * permissions directly on other workspaces. Trying to remove a role that a user does not have
 * will succeed, though Sam will error if the email is not a registered user.
 */
@Traced
public void removeWorkspaceRole(UUID workspaceId, AuthenticatedUserRequest userRequest, WsmIamRole role, String email) throws InterruptedException {
    stageService.assertMcWorkspace(workspaceId, "removeWorkspaceRole");
    checkAuthz(userRequest, SamConstants.SamResource.WORKSPACE, workspaceId.toString(), samActionToModifyRole(role));
    ResourcesApi resourceApi = samResourcesApi(userRequest.getRequiredToken());
    try {
        SamRetry.retry(() -> resourceApi.removeUserFromPolicy(SamConstants.SamResource.WORKSPACE, workspaceId.toString(), role.toSamRole(), email.toLowerCase()));
        logger.info("Removed role {} from user {} in workspace {}", role.toSamRole(), email, workspaceId);
    } catch (ApiException apiException) {
        throw SamExceptionFactory.create("Error removing workspace role in Sam", apiException);
    }
}