Skip to content

Commit 8cd3e25

Browse files
HarryRybacki-zzHarryRybacki-zz
committed
Implied Roles
Allow the user to create an inference rule between two roles. The first, called the prior role is the role explicitly assigned to an individual. The second, called the implied role, is one that the user gets implicitly. For example: Role B implies Role A. User X is assigned Role B. Therefore User X also assigned Role A. The management and maintenance of the rules is performed in the Keystone server. Change-Id: If547c2f16e812bc7fffd742ec37e6a26011f3185
1 parent 5cc4d5b commit 8cd3e25

File tree

6 files changed

+411
-0
lines changed

6 files changed

+411
-0
lines changed

‎doc/source/cli/command-objects/implied_role.rst‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
============
2+
implied role
3+
============
4+
5+
Identity v3
6+
7+
8+
implied role create
9+
-------------------
10+
11+
Creates an association between prior and implied roles
12+
13+
.. program:: implied role create
14+
.. code:: bash
15+
16+
openstack implied role create
17+
<role>
18+
--implied-role <role>
19+
20+
.. option:: <role>
21+
22+
Prior role <role> (name or ID) implies another role
23+
24+
.. option:: --implied-role <role>
25+
26+
<role> (name or ID) implied by another role
27+
28+
29+
implied role delete
30+
-------------------
31+
32+
Deletes an association between prior and implied roles
33+
34+
.. program:: implied role delete
35+
.. code:: bash
36+
37+
openstack implied role delete
38+
<role>
39+
--implied-role <role>
40+
41+
.. option:: <role>
42+
43+
Prior role <role> (name or ID) implies another role
44+
45+
.. option:: --implied-role <role>
46+
47+
<role> (name or ID) implied by another role
48+
49+
implied role list
50+
-----------------
51+
52+
List implied roles
53+
54+
.. program:: implied role list
55+
.. code:: bash
56+
57+
openstack implied role list

‎openstackclient/identity/v3/implied_role.py‎

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
# Copyright 2012-2013 OpenStack Foundation
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
4+
# not use this file except in compliance with the License. You may obtain
5+
# a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
11+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
12+
# License for the specific language governing permissions and limitations
13+
# under the License.
14+
#
15+
16+
"""Identity v3 Implied Role action implementations"""
17+
18+
import logging
19+
20+
from osc_lib.command import command
21+
import six
22+
23+
from openstackclient.i18n import _
24+
25+
26+
LOG = logging.getLogger(__name__)
27+
28+
29+
def _get_role_ids(identity_client, parsed_args):
30+
"""Return prior and implied role id(s)
31+
32+
If prior and implied role id(s) are retrievable from identity
33+
client, return tuple containing them.
34+
"""
35+
role_id = None
36+
implied_role_id = None
37+
38+
roles = identity_client.roles.list()
39+
40+
for role in roles:
41+
role_id_or_name = (role.name, role.id)
42+
43+
if parsed_args.role in role_id_or_name:
44+
role_id = role.id
45+
elif parsed_args.implied_role in role_id_or_name:
46+
implied_role_id = role.id
47+
48+
return (role_id, implied_role_id)
49+
50+
51+
class CreateImpliedRole(command.ShowOne):
52+
53+
_description = _("Creates an association between prior and implied roles")
54+
55+
def get_parser(self, prog_name):
56+
parser = super(CreateImpliedRole, self).get_parser(prog_name)
57+
parser.add_argument(
58+
'role',
59+
metavar='<role>',
60+
help=_('Role (name or ID) that implies another role'),
61+
)
62+
parser.add_argument(
63+
'--implied-role',
64+
metavar='<role>',
65+
help='<role> (name or ID) implied by another role',
66+
required=True,
67+
)
68+
return parser
69+
70+
def take_action(self, parsed_args):
71+
identity_client = self.app.client_manager.identity
72+
(prior_role_id, implied_role_id) = _get_role_ids(
73+
identity_client, parsed_args)
74+
response = identity_client.roles.create_implied(
75+
prior_role_id, implied_role_id)
76+
response._info.pop('links', None)
77+
return zip(*sorted([(k, v['id'])
78+
for k, v in six.iteritems(response._info)]))
79+
80+
81+
class DeleteImpliedRole(command.Command):
82+
83+
_description = _("Deletes an association between prior and implied roles")
84+
85+
def get_parser(self, prog_name):
86+
parser = super(DeleteImpliedRole, self).get_parser(prog_name)
87+
parser.add_argument(
88+
'role',
89+
metavar='<role>',
90+
help=_('Role (name or ID) that implies another role'),
91+
)
92+
parser.add_argument(
93+
'--implied-role',
94+
metavar='<role>',
95+
help='<role> (name or ID) implied by another role',
96+
required=True,
97+
)
98+
return parser
99+
100+
def take_action(self, parsed_args):
101+
identity_client = self.app.client_manager.identity
102+
(prior_role_id, implied_role_id) = _get_role_ids(
103+
identity_client, parsed_args)
104+
identity_client.roles.delete_implied(
105+
prior_role_id, implied_role_id)
106+
107+
108+
class ListImpliedRole(command.Lister):
109+
110+
_description = _("List implied roles")
111+
_COLUMNS = ['Prior Role ID', 'Prior Role Name',
112+
'Implied Role ID', 'Implied Role Name']
113+
114+
def get_parser(self, prog_name):
115+
parser = super(ListImpliedRole, self).get_parser(prog_name)
116+
return parser
117+
118+
def take_action(self, parsed_args):
119+
def _list_implied(response):
120+
for rule in response:
121+
for implies in rule.implies:
122+
yield (rule.prior_role['id'],
123+
rule.prior_role['name'],
124+
implies['id'],
125+
implies['name'])
126+
127+
identity_client = self.app.client_manager.identity
128+
response = identity_client.roles.list_inference_roles()
129+
return (self._COLUMNS, _list_implied(response))

‎openstackclient/tests/unit/identity/v3/fakes.py‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -184,6 +184,8 @@
184184
'links': base_url + 'roles/' + 'r2',
185185
}
186186

187+
ROLES = [ROLE, ROLE_2]
188+
187189
service_id = 's-123'
188190
service_name = 'Texaco'
189191
service_type = 'gas'
@@ -968,3 +970,25 @@ def create_one_role_assignment(attrs=None):
968970
info=copy.deepcopy(role_assignment_info), loaded=True)
969971

970972
return role_assignment
973+
974+
975+
class FakeImpliedRoleResponse(object):
976+
"""Fake one or more role assignment."""
977+
def __init__(self, prior_role, implied_roles):
978+
self.prior_role = prior_role
979+
self.implies = [role for role in implied_roles]
980+
981+
@staticmethod
982+
def create_list():
983+
"""Create a fake implied role list response.
984+
985+
:return:
986+
A list of FakeImpliedRoleResponse objects
987+
"""
988+
989+
# set default attributes.
990+
implied_roles = [
991+
FakeImpliedRoleResponse(ROLES[0], [ROLES[1]])
992+
]
993+
994+
return implied_roles

0 commit comments

Comments
 (0)