Examples with AccessPolicyResponseEntryV2 org.broadinstitute.dsde.workbench.client.sam.model.AccessPolicyResponseEntryV2 used on opensource projects

Example 1 with AccessPolicyResponseEntryV2

use of org.broadinstitute.dsde.workbench.client.sam.model.AccessPolicyResponseEntryV2 in project terra-workspace-manager by DataBiosphere.

the class SamService method dumpRoleBindings.

// Add code to retrieve and dump the role assignments for WSM controlled resources
// for debugging. No permission check outside of Sam.
public void dumpRoleBindings(String samResourceType, String resourceId, String token) {
    logger.debug("DUMP ROLE BINDING - resourceType {} resourceId {}", samResourceType, resourceId);
    ResourcesApi resourceApi = samResourcesApi(token);
    try {
        List<AccessPolicyResponseEntryV2> samResult = SamRetry.retry(() -> resourceApi.listResourcePoliciesV2(samResourceType, resourceId));
        for (AccessPolicyResponseEntryV2 entry : samResult) {
            logger.debug("  samPolicy: {}", entry);
        }
    } catch (ApiException apiException) {
        throw SamExceptionFactory.create("Error listing role bindings in Sam", apiException);
    } catch (InterruptedException e) {
        logger.warn("dump role binding was interrupted");
    }
}

Example 2 with AccessPolicyResponseEntryV2

use of org.broadinstitute.dsde.workbench.client.sam.model.AccessPolicyResponseEntryV2 in project terra-workspace-manager by DataBiosphere.

the class SamClientUtils method dumpResourcePolicy.

// dump the Sam policy on a resource - assuming you have permission
public static void dumpResourcePolicy(TestUserSpecification testUser, ServerSpecification server, String resourceTypeName, String resourceId) throws Exception {
    ResourcesApi samApi = new ResourcesApi(getSamApiClient(testUser, server));
    List<AccessPolicyResponseEntryV2> policies = SamRetry.retry(() -> samApi.listResourcePoliciesV2(resourceTypeName, resourceId));
    logger.info("SAM POLICY DUMP for {} id {}", resourceTypeName, resourceId);
    for (AccessPolicyResponseEntryV2 entry : policies) {
        logger.info("  policy: {}", entry);
    }
}

Example 3 with AccessPolicyResponseEntryV2

use of org.broadinstitute.dsde.workbench.client.sam.model.AccessPolicyResponseEntryV2 in project terra-workspace-manager by DataBiosphere.

the class SamService method getUserRolesOnPrivateResource.

/**
 * Return the list of roles a user has directly on a private, user-managed controlled resource.
 * This will not return roles that a user holds via group membership.
 *
 * <p>This call to Sam is made as the WSM SA, as users do not have permission to directly modify
 * IAM on resources. This method still requires user credentials to validate as a safeguard, but
 * they are not used in the role removal call.
 *
 * @param resource The resource to fetch roles on
 * @param userEmail Email identifier of the user whose role is being removed.
 * @param userRequest User credentials. These are not used for the call to Sam, but must belong to
 *     a workspace owner to ensure the WSM SA is being used on a user's behalf correctly.
 */
public List<ControlledResourceIamRole> getUserRolesOnPrivateResource(ControlledResource resource, String userEmail, AuthenticatedUserRequest userRequest) throws InterruptedException {
    // Validate that the provided user credentials can modify the owners of the resource's
    // workspace.
    // Although the Sam call to revoke a resource role must use WSM SA credentials instead, this
    // is a safeguard against accidentally invoking these credentials for unauthorized users.
    checkAuthz(userRequest, SamConstants.SamResource.WORKSPACE, resource.getWorkspaceId().toString(), samActionToModifyRole(WsmIamRole.OWNER));
    try {
        ResourcesApi wsmSaResourceApi = samResourcesApi(getWsmServiceAccountToken());
        List<AccessPolicyResponseEntryV2> policyList = wsmSaResourceApi.listResourcePoliciesV2(resource.getCategory().getSamResourceName(), resource.getResourceId().toString());
        return policyList.stream().filter(policyEntry -> policyEntry.getPolicy().getMemberEmails().contains(userEmail)).map(AccessPolicyResponseEntryV2::getPolicyName).map(ControlledResourceIamRole::fromSamRole).collect(Collectors.toList());
    } catch (ApiException apiException) {
        throw SamExceptionFactory.create("Sam error removing resource role in Sam", apiException);
    }
}