Skip to content

Commit c28450c

Browse files
minchen07minchen07
committed
CLOUDSTACK-5920: IAM service plugin.
1 parent adb29b2 commit c28450c

27 files changed

Lines changed: 4321 additions & 0 deletions

‎services/iam/plugin/pom.xml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
<!--
2+
Licensed to the Apache Software Foundation (ASF) under one
3+
or more contributor license agreements. See the NOTICE file
4+
distributed with this work for additional information
5+
regarding copyright ownership. The ASF licenses this file
6+
to you under the Apache License, Version 2.0 (the
7+
"License"); you may not use this file except in compliance
8+
with the License. You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing,
13+
software distributed under the License is distributed on an
14+
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15+
KIND, either express or implied. See the License for the
16+
specific language governing permissions and limitations
17+
under the License.
18+
-->
19+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
20+
<modelVersion>4.0.0</modelVersion>
21+
<artifactId>cloud-plugin-iam</artifactId>
22+
<name>Apache CloudStack IAM - Plugin</name>
23+
<parent>
24+
<groupId>org.apache.cloudstack</groupId>
25+
<artifactId>cloudstack-service-iam</artifactId>
26+
<version>4.4.0-SNAPSHOT</version>
27+
<relativePath>../pom.xml</relativePath>
28+
</parent>
29+
<dependencies>
30+
<dependency>
31+
<groupId>org.apache.cloudstack</groupId>
32+
<artifactId>cloud-api</artifactId>
33+
<version>${project.version}</version>
34+
</dependency>
35+
<dependency>
36+
<groupId>org.apache.cloudstack</groupId>
37+
<artifactId>cloud-engine-schema</artifactId>
38+
<version>${project.version}</version>
39+
</dependency>
40+
<dependency>
41+
<groupId>org.apache.cloudstack</groupId>
42+
<artifactId>cloud-server</artifactId>
43+
<version>${project.version}</version>
44+
</dependency>
45+
<dependency>
46+
<groupId>org.apache.cloudstack</groupId>
47+
<artifactId>cloud-iam</artifactId>
48+
<version>${project.version}</version>
49+
</dependency>
50+
<dependency>
51+
<groupId>org.apache.cloudstack</groupId>
52+
<artifactId>cloud-api</artifactId>
53+
<version>${project.version}</version>
54+
<type>test-jar</type>
55+
<scope>test</scope>
56+
</dependency>
57+
</dependencies>
58+
</project>

‎services/iam/plugin/resources/META-INF/cloudstack/iam-access-checkers/module.properties‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Licensed to the Apache Software Foundation (ASF) under one
2+
# or more contributor license agreements. See the NOTICE file
3+
# distributed with this work for additional information
4+
# regarding copyright ownership. The ASF licenses this file
5+
# to you under the Apache License, Version 2.0 (the
6+
# "License"); you may not use this file except in compliance
7+
# with the License. You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing,
12+
# software distributed under the License is distributed on an
13+
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
# KIND, either express or implied. See the License for the
15+
# specific language governing permissions and limitations
16+
# under the License.
17+
name=iam-access-checkers
18+
parent=api

‎services/iam/plugin/resources/META-INF/cloudstack/iam-access-checkers/spring-iam-access-checkers-context.xml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
<!--
2+
Licensed to the Apache Software Foundation (ASF) under one
3+
or more contributor license agreements. See the NOTICE file
4+
distributed with this work for additional information
5+
regarding copyright ownership. The ASF licenses this file
6+
to you under the Apache License, Version 2.0 (the
7+
"License"); you may not use this file except in compliance
8+
with the License. You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing,
13+
software distributed under the License is distributed on an
14+
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15+
KIND, either express or implied. See the License for the
16+
specific language governing permissions and limitations
17+
under the License.
18+
-->
19+
<beans xmlns="http://www.springframework.org/schema/beans"
20+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
21+
xmlns:context="http://www.springframework.org/schema/context"
22+
xmlns:aop="http://www.springframework.org/schema/aop"
23+
xsi:schemaLocation="http://www.springframework.org/schema/beans
24+
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
25+
http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.0.xsd
26+
http://www.springframework.org/schema/context
27+
http://www.springframework.org/schema/context/spring-context-3.0.xsd"
28+
>
29+
30+
<bean id="RoleBasedAPIAccessChecker" class="org.apache.cloudstack.iam.RoleBasedAPIAccessChecker" />
31+
<bean id="RoleBasedEntityAccessChecker" class="org.apache.cloudstack.iam.RoleBasedEntityAccessChecker" />
32+
<bean id="RoleBasedEntityQuerySelector" class="org.apache.cloudstack.iam.RoleBasedEntityQuerySelector" />
33+
<bean id="IAMApiServiceImpl" class="org.apache.cloudstack.iam.IAMApiServiceImpl" />
34+
35+
</beans>

‎services/iam/plugin/src/org/apache/cloudstack/api/command/iam/AddAccountToIAMGroupCmd.java‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
// Licensed to the Apache Software Foundation (ASF) under one
2+
// or more contributor license agreements. See the NOTICE file
3+
// distributed with this work for additional information
4+
// regarding copyright ownership. The ASF licenses this file
5+
// to you under the Apache License, Version 2.0 (the
6+
// "License"); you may not use this file except in compliance
7+
// with the License. You may obtain a copy of the License at
8+
//
9+
// http://www.apache.org/licenses/LICENSE-2.0
10+
//
11+
// Unless required by applicable law or agreed to in writing,
12+
// software distributed under the License is distributed on an
13+
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
// KIND, either express or implied. See the License for the
15+
// specific language governing permissions and limitations
16+
// under the License.
17+
package org.apache.cloudstack.api.command.iam;
18+
19+
import java.util.List;
20+
21+
import javax.inject.Inject;
22+
23+
import org.apache.log4j.Logger;
24+
25+
import org.apache.cloudstack.iam.IAMApiService;
26+
import org.apache.cloudstack.api.ACL;
27+
import org.apache.cloudstack.api.APICommand;
28+
import org.apache.cloudstack.api.ApiCommandJobType;
29+
import org.apache.cloudstack.api.ApiConstants;
30+
import org.apache.cloudstack.api.ApiErrorCode;
31+
import org.apache.cloudstack.api.BaseAsyncCmd;
32+
import org.apache.cloudstack.api.Parameter;
33+
import org.apache.cloudstack.api.ServerApiException;
34+
import org.apache.cloudstack.api.response.AccountResponse;
35+
import org.apache.cloudstack.api.response.iam.IAMGroupResponse;
36+
import org.apache.cloudstack.context.CallContext;
37+
import org.apache.cloudstack.iam.api.IAMGroup;
38+
39+
import com.cloud.event.EventTypes;
40+
import com.cloud.exception.InsufficientCapacityException;
41+
import com.cloud.exception.ResourceUnavailableException;
42+
import com.cloud.user.Account;
43+
44+
45+
@APICommand(name = "addAccountToIAMGroup", description = "add account to an iam group", responseObject = IAMGroupResponse.class)
46+
public class AddAccountToIAMGroupCmd extends BaseAsyncCmd {
47+
public static final Logger s_logger = Logger.getLogger(AddAccountToIAMGroupCmd.class.getName());
48+
private static final String s_name = "addaccounttoiamgroupresponse";
49+
50+
@Inject
51+
public IAMApiService _iamApiSrv;
52+
53+
/////////////////////////////////////////////////////
54+
//////////////// API parameters /////////////////////
55+
/////////////////////////////////////////////////////
56+
57+
58+
@ACL
59+
@Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = IAMGroupResponse.class,
60+
required = true, description = "The ID of the iam group")
61+
private Long id;
62+
63+
@ACL
64+
@Parameter(name = ApiConstants.ACCOUNTS, type = CommandType.LIST, collectionType = CommandType.UUID, entityType = AccountResponse.class, description = "comma separated list of account id that are going to be assigned to the iam group.")
65+
private List<Long> accountIdList;
66+
67+
68+
/////////////////////////////////////////////////////
69+
/////////////////// Accessors ///////////////////////
70+
/////////////////////////////////////////////////////
71+
72+
73+
public Long getId() {
74+
return id;
75+
}
76+
77+
78+
public List<Long> getAccountIdList() {
79+
return accountIdList;
80+
}
81+
82+
/////////////////////////////////////////////////////
83+
/////////////// API Implementation///////////////////
84+
/////////////////////////////////////////////////////
85+
86+
87+
@Override
88+
public String getCommandName() {
89+
return s_name;
90+
}
91+
92+
93+
@Override
94+
public long getEntityOwnerId() {
95+
return Account.ACCOUNT_ID_SYSTEM; // no account info given, parent this command to SYSTEM so ERROR events are tracked
96+
}
97+
98+
@Override
99+
public void execute() throws ResourceUnavailableException,
100+
InsufficientCapacityException, ServerApiException {
101+
CallContext.current().setEventDetails("IAM group Id: " + getId());
102+
IAMGroup result = _iamApiSrv.addAccountsToGroup(accountIdList, id);
103+
if (result != null){
104+
IAMGroupResponse response = _iamApiSrv.createIAMGroupResponse(result);
105+
response.setResponseName(getCommandName());
106+
setResponseObject(response);
107+
} else {
108+
throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, "Failed to add accounts to iam group");
109+
}
110+
}
111+
112+
@Override
113+
public String getEventType() {
114+
return EventTypes.EVENT_IAM_GROUP_UPDATE;
115+
}
116+
117+
@Override
118+
public String getEventDescription() {
119+
return "adding accounts to iam group";
120+
}
121+
122+
@Override
123+
public ApiCommandJobType getInstanceType() {
124+
return ApiCommandJobType.IAMGroup;
125+
}
126+
127+
}

‎services/iam/plugin/src/org/apache/cloudstack/api/command/iam/AddIAMPermissionToIAMPolicyCmd.java‎

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
// Licensed to the Apache Software Foundation (ASF) under one
2+
// or more contributor license agreements. See the NOTICE file
3+
// distributed with this work for additional information
4+
// regarding copyright ownership. The ASF licenses this file
5+
// to you under the Apache License, Version 2.0 (the
6+
// "License"); you may not use this file except in compliance
7+
// with the License. You may obtain a copy of the License at
8+
//
9+
// http://www.apache.org/licenses/LICENSE-2.0
10+
//
11+
// Unless required by applicable law or agreed to in writing,
12+
// software distributed under the License is distributed on an
13+
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
// KIND, either express or implied. See the License for the
15+
// specific language governing permissions and limitations
16+
// under the License.
17+
package org.apache.cloudstack.api.command.iam;
18+
19+
import javax.inject.Inject;
20+
21+
import org.apache.log4j.Logger;
22+
23+
import org.apache.cloudstack.acl.PermissionScope;
24+
import org.apache.cloudstack.api.ACL;
25+
import org.apache.cloudstack.api.APICommand;
26+
import org.apache.cloudstack.api.ApiCommandJobType;
27+
import org.apache.cloudstack.api.ApiConstants;
28+
import org.apache.cloudstack.api.ApiErrorCode;
29+
import org.apache.cloudstack.api.BaseAsyncCmd;
30+
import org.apache.cloudstack.api.Parameter;
31+
import org.apache.cloudstack.api.ServerApiException;
32+
import org.apache.cloudstack.api.response.iam.IAMPolicyResponse;
33+
import org.apache.cloudstack.context.CallContext;
34+
import org.apache.cloudstack.iam.IAMApiService;
35+
import org.apache.cloudstack.iam.api.IAMPolicy;
36+
import org.apache.cloudstack.iam.api.IAMPolicyPermission.Permission;
37+
38+
import com.cloud.event.EventTypes;
39+
import com.cloud.exception.InsufficientCapacityException;
40+
import com.cloud.exception.ResourceUnavailableException;
41+
import com.cloud.user.Account;
42+
import com.cloud.utils.db.EntityManager;
43+
44+
45+
@APICommand(name = "addIAMPermissionToIAMPolicy", description = "Add IAM permission to an iam policy", responseObject = IAMPolicyResponse.class)
46+
public class AddIAMPermissionToIAMPolicyCmd extends BaseAsyncCmd {
47+
public static final Logger s_logger = Logger.getLogger(AddIAMPermissionToIAMPolicyCmd.class.getName());
48+
private static final String s_name = "addiampermissiontoiampolicyresponse";
49+
50+
@Inject
51+
public IAMApiService _iamApiSrv;
52+
@Inject
53+
public EntityManager _entityMgr;
54+
55+
/////////////////////////////////////////////////////
56+
//////////////// API parameters /////////////////////
57+
/////////////////////////////////////////////////////
58+
59+
60+
@ACL
61+
@Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = IAMPolicyResponse.class,
62+
required = true, description = "The ID of the iam policy")
63+
private Long id;
64+
65+
@Parameter(name = ApiConstants.IAM_ACTION, type = CommandType.STRING, required = true, description = "action api name.")
66+
private String action;
67+
68+
@Parameter(name = ApiConstants.ENTITY_TYPE, type = CommandType.STRING, required = false, description = "entity class simple name.")
69+
private String entityType;
70+
71+
@Parameter(name = ApiConstants.IAM_SCOPE, type = CommandType.STRING,
72+
required = false, description = "iam permission scope")
73+
private String scope;
74+
75+
@Parameter(name = ApiConstants.IAM_SCOPE_ID, type = CommandType.STRING, required = false, description = "The UUID of the permission scope id")
76+
private String scopeId;
77+
78+
79+
/////////////////////////////////////////////////////
80+
/////////////////// Accessors ///////////////////////
81+
/////////////////////////////////////////////////////
82+
83+
84+
public Long getId() {
85+
return id;
86+
}
87+
88+
89+
public String getAction() {
90+
return action;
91+
}
92+
93+
public String getEntityType() {
94+
return entityType;
95+
}
96+
97+
public String getScope() {
98+
return scope;
99+
}
100+
101+
public Long getScopeId() {
102+
// here we will convert the passed String UUID to Long ID since internally we store it as entity internal ID.
103+
return _iamApiSrv.getPermissionScopeId(scope, entityType, scopeId);
104+
}
105+
106+
/////////////////////////////////////////////////////
107+
/////////////// API Implementation///////////////////
108+
/////////////////////////////////////////////////////
109+
110+
111+
112+
@Override
113+
public String getCommandName() {
114+
return s_name;
115+
}
116+
117+
118+
@Override
119+
public long getEntityOwnerId() {
120+
return Account.ACCOUNT_ID_SYSTEM; // no account info given, parent this command to SYSTEM so ERROR events are tracked
121+
}
122+
123+
@Override
124+
public void execute() throws ResourceUnavailableException,
125+
InsufficientCapacityException, ServerApiException {
126+
CallContext.current().setEventDetails("IAM policy Id: " + getId());
127+
// Only explicit ALLOW is supported for this release, no explicit deny
128+
IAMPolicy result = _iamApiSrv.addIAMPermissionToIAMPolicy(id, entityType, PermissionScope.valueOf(scope),
129+
getScopeId(), action, Permission.Allow, false);
130+
if (result != null) {
131+
IAMPolicyResponse response = _iamApiSrv.createIAMPolicyResponse(result);
132+
response.setResponseName(getCommandName());
133+
setResponseObject(response);
134+
} else {
135+
throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, "Failed to grant permission to iam policy "
136+
+ getId());
137+
}
138+
}
139+
140+
@Override
141+
public String getEventType() {
142+
return EventTypes.EVENT_IAM_POLICY_GRANT;
143+
}
144+
145+
@Override
146+
public String getEventDescription() {
147+
return "granting permission to iam policy";
148+
}
149+
150+
@Override
151+
public ApiCommandJobType getInstanceType() {
152+
return ApiCommandJobType.IAMPolicy;
153+
}
154+
155+
}

0 commit comments

Comments
 (0)