Package com.yahoo.vespa.hosted.controller.api.integration.athenz

Class AthenzAccessControlService

java.lang.Object

com.yahoo.vespa.hosted.controller.api.integration.athenz.AthenzAccessControlService

All Implemented Interfaces:

AccessControlService

public class AthenzAccessControlService
extends Object
implements AccessControlService

Constructor Summary

Constructors

Constructor	Description
AthenzAccessControlService(com.yahoo.vespa.athenz.client.zms.ZmsClient zmsClient, com.yahoo.vespa.athenz.api.AthenzDomain domain, Optional<com.yahoo.vespa.athenz.client.zms.ZmsClient> vespaZmsClient, AthenzInstanceSynchronizer athenzInstanceSynchronizer)

Method Summary

Modifier and Type	Method	Description
boolean	approveDataPlaneAccess(com.yahoo.vespa.athenz.api.AthenzUser user, Instant expiry)
boolean	decideSshAccess(com.yahoo.config.provision.TenantName tenantName, Instant expiry, com.yahoo.vespa.athenz.api.OAuthCredentials oAuthCredentials, boolean approve)
com.yahoo.vespa.athenz.api.AthenzRoleInformation	getAccessRoleInformation(com.yahoo.config.provision.TenantName tenantName)
boolean	getManagedAccess(com.yahoo.config.provision.TenantName tenantName)
boolean	isVespaTeamMember(com.yahoo.vespa.athenz.api.AthenzUser user)
Collection<com.yahoo.vespa.athenz.api.AthenzUser>	listMembers()
boolean	requestSshAccess(com.yahoo.config.provision.TenantName tenantName)
void	setManagedAccess(com.yahoo.config.provision.TenantName tenantName, boolean managedAccess)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

AthenzAccessControlService

public AthenzAccessControlService(com.yahoo.vespa.athenz.client.zms.ZmsClient zmsClient,
 com.yahoo.vespa.athenz.api.AthenzDomain domain,
 Optional<com.yahoo.vespa.athenz.client.zms.ZmsClient> vespaZmsClient,
 AthenzInstanceSynchronizer athenzInstanceSynchronizer)

Method Details

approveDataPlaneAccess

public boolean approveDataPlaneAccess(com.yahoo.vespa.athenz.api.AthenzUser user,
 Instant expiry)

Specified by:

approveDataPlaneAccess in interface AccessControlService

listMembers

public Collection<com.yahoo.vespa.athenz.api.AthenzUser> listMembers()

Specified by:

listMembers in interface AccessControlService

getAccessRoleInformation

public com.yahoo.vespa.athenz.api.AthenzRoleInformation getAccessRoleInformation(com.yahoo.config.provision.TenantName tenantName)

Specified by:

getAccessRoleInformation in interface AccessControlService

Returns:

Whether the ssh access role has any pending role membership requests

decideSshAccess

public boolean decideSshAccess(com.yahoo.config.provision.TenantName tenantName,
 Instant expiry,
 com.yahoo.vespa.athenz.api.OAuthCredentials oAuthCredentials,
 boolean approve)

Specified by:

decideSshAccess in interface AccessControlService

Returns:

true if access has been granted - false if already member

requestSshAccess

public boolean requestSshAccess(com.yahoo.config.provision.TenantName tenantName)

Specified by:

requestSshAccess in interface AccessControlService

Returns:

true if access has been requested - false if already member

setManagedAccess

public void setManagedAccess(com.yahoo.config.provision.TenantName tenantName,
 boolean managedAccess)

Specified by:

setManagedAccess in interface AccessControlService

getManagedAccess

public boolean getManagedAccess(com.yahoo.config.provision.TenantName tenantName)

Specified by:

getManagedAccess in interface AccessControlService

isVespaTeamMember

public boolean isVespaTeamMember(com.yahoo.vespa.athenz.api.AthenzUser user)