| // Licensed to the Apache Software Foundation (ASF) under one |
| // or more contributor license agreements. See the NOTICE file |
| // distributed with this work for additional information |
| // regarding copyright ownership. The ASF licenses this file |
| // to you under the Apache License, Version 2.0 (the |
| // "License"); you may not use this file except in compliance |
| // with the License. You may obtain a copy of the License at |
| // |
| // http://www.apache.org/licenses/LICENSE-2.0 |
| // |
| // Unless required by applicable law or agreed to in writing, |
| // software distributed under the License is distributed on an |
| // "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| // KIND, either express or implied. See the License for the |
| // specific language governing permissions and limitations |
| // under the License. |
| package org.apache.cloudstack.iam; |
| |
| import java.util.ArrayList; |
| import java.util.Collections; |
| import java.util.HashMap; |
| import java.util.List; |
| import java.util.Map; |
| |
| import javax.inject.Inject; |
| import javax.naming.ConfigurationException; |
| |
| import org.apache.log4j.Logger; |
| import org.bouncycastle.util.IPAddress; |
| |
| import com.amazonaws.auth.policy.Condition; |
| import com.amazonaws.services.ec2.model.SecurityGroup; |
| import com.amazonaws.services.ec2.model.Snapshot; |
| import com.amazonaws.services.ec2.model.Volume; |
| import com.amazonaws.services.ec2.model.Vpc; |
| import com.amazonaws.services.elasticache.model.Event; |
| |
| import org.apache.cloudstack.acl.PermissionScope; |
| import org.apache.cloudstack.acl.SecurityChecker.AccessType; |
| import org.apache.cloudstack.affinity.AffinityGroup; |
| import org.apache.cloudstack.api.ApiConstants; |
| import org.apache.cloudstack.api.BaseListCmd; |
| import org.apache.cloudstack.api.InternalIdentity; |
| import org.apache.cloudstack.api.command.iam.AddAccountToIAMGroupCmd; |
| import org.apache.cloudstack.api.command.iam.AddIAMPermissionToIAMPolicyCmd; |
| import org.apache.cloudstack.api.command.iam.AttachIAMPolicyToAccountCmd; |
| import org.apache.cloudstack.api.command.iam.AttachIAMPolicyToIAMGroupCmd; |
| import org.apache.cloudstack.api.command.iam.CreateIAMGroupCmd; |
| import org.apache.cloudstack.api.command.iam.CreateIAMPolicyCmd; |
| import org.apache.cloudstack.api.command.iam.DeleteIAMGroupCmd; |
| import org.apache.cloudstack.api.command.iam.DeleteIAMPolicyCmd; |
| import org.apache.cloudstack.api.command.iam.ListIAMGroupsCmd; |
| import org.apache.cloudstack.api.command.iam.ListIAMPoliciesCmd; |
| import org.apache.cloudstack.api.command.iam.RemoveAccountFromIAMGroupCmd; |
| import org.apache.cloudstack.api.command.iam.RemoveIAMPermissionFromIAMPolicyCmd; |
| import org.apache.cloudstack.api.command.iam.RemoveIAMPolicyFromAccountCmd; |
| import org.apache.cloudstack.api.command.iam.RemoveIAMPolicyFromIAMGroupCmd; |
| import org.apache.cloudstack.api.response.ListResponse; |
| import org.apache.cloudstack.api.response.iam.IAMGroupResponse; |
| import org.apache.cloudstack.api.response.iam.IAMPermissionResponse; |
| import org.apache.cloudstack.api.response.iam.IAMPolicyResponse; |
| import org.apache.cloudstack.context.CallContext; |
| import org.apache.cloudstack.framework.jobs.AsyncJob; |
| import org.apache.cloudstack.framework.messagebus.MessageBus; |
| import org.apache.cloudstack.framework.messagebus.MessageSubscriber; |
| import org.apache.cloudstack.iam.api.IAMGroup; |
| import org.apache.cloudstack.iam.api.IAMPolicy; |
| import org.apache.cloudstack.iam.api.IAMPolicyPermission; |
| import org.apache.cloudstack.iam.api.IAMPolicyPermission.Permission; |
| import org.apache.cloudstack.iam.api.IAMService; |
| |
| import com.cloud.api.ApiServerService; |
| import com.cloud.domain.Domain; |
| import com.cloud.domain.DomainVO; |
| import com.cloud.domain.dao.DomainDao; |
| import com.cloud.event.ActionEvent; |
| import com.cloud.event.EventTypes; |
| import com.cloud.exception.InvalidParameterValueException; |
| import com.cloud.network.IpAddress; |
| import com.cloud.network.MonitoringService; |
| import com.cloud.network.Network; |
| import com.cloud.network.RemoteAccessVpn; |
| import com.cloud.network.Site2SiteCustomerGateway; |
| import com.cloud.network.Site2SiteVpnConnection; |
| import com.cloud.network.Site2SiteVpnGateway; |
| import com.cloud.network.UserIpv6Address; |
| import com.cloud.network.VpnUser; |
| import com.cloud.network.as.AutoScalePolicy; |
| import com.cloud.network.as.AutoScaleVmGroup; |
| import com.cloud.network.as.AutoScaleVmProfile; |
| import com.cloud.network.lb.SslCert; |
| import com.cloud.network.rules.FirewallRule; |
| import com.cloud.network.rules.PortForwardingRule; |
| import com.cloud.network.vpc.StaticRoute; |
| import com.cloud.network.vpc.VpcGateway; |
| import com.cloud.projects.ProjectInvitation; |
| import com.cloud.region.ha.GlobalLoadBalancerRule; |
| import com.cloud.server.ResourceTag; |
| import com.cloud.template.TemplateManager; |
| import com.cloud.template.VirtualMachineTemplate; |
| import com.cloud.user.Account; |
| import com.cloud.user.AccountManager; |
| import com.cloud.user.AccountVO; |
| import com.cloud.user.DomainManager; |
| import com.cloud.user.SSHKeyPair; |
| import com.cloud.user.dao.AccountDao; |
| import com.cloud.utils.Pair; |
| import com.cloud.utils.component.Manager; |
| import com.cloud.utils.component.ManagerBase; |
| import com.cloud.utils.db.DB; |
| import com.cloud.utils.db.EntityManager; |
| import com.cloud.vm.InstanceGroup; |
| import com.cloud.vm.NicIpAlias; |
| import com.cloud.vm.NicSecondaryIp; |
| import com.cloud.vm.VirtualMachine; |
| import com.cloud.vm.snapshot.VMSnapshot; |
| |
| public class IAMApiServiceImpl extends ManagerBase implements IAMApiService, Manager { |
| |
| public static final Logger s_logger = Logger.getLogger(IAMApiServiceImpl.class); |
| private String _name; |
| |
| @Inject |
| ApiServerService _apiServer; |
| |
| @Inject |
| IAMService _iamSrv; |
| |
| @Inject |
| DomainDao _domainDao; |
| |
| @Inject |
| AccountDao _accountDao; |
| |
| @Inject |
| AccountManager _accountMgr; |
| |
| @Inject |
| MessageBus _messageBus; |
| |
| @Inject |
| EntityManager _entityMgr; |
| |
| private static final Map<String, Class<?>> s_typeMap = new HashMap<String, Class<?>>(); |
| static { |
| s_typeMap.put(VirtualMachine.class.getSimpleName(), VirtualMachine.class); |
| s_typeMap.put(Volume.class.getSimpleName(), Volume.class); |
| s_typeMap.put(ResourceTag.class.getSimpleName(), ResourceTag.class); |
| s_typeMap.put(Account.class.getSimpleName(), Account.class); |
| s_typeMap.put(AffinityGroup.class.getSimpleName(), AffinityGroup.class); |
| s_typeMap.put(AutoScalePolicy.class.getSimpleName(), AutoScalePolicy.class); |
| s_typeMap.put(AutoScaleVmProfile.class.getSimpleName(), AutoScaleVmProfile.class); |
| s_typeMap.put(AutoScaleVmGroup.class.getSimpleName(), AutoScaleVmGroup.class); |
| s_typeMap.put(Condition.class.getSimpleName(), Condition.class); |
| s_typeMap.put(Vpc.class.getSimpleName(), Vpc.class); |
| s_typeMap.put(VpcGateway.class.getSimpleName(), VpcGateway.class); |
| s_typeMap.put(VpnUser.class.getSimpleName(), VpnUser.class); |
| s_typeMap.put(VMSnapshot.class.getSimpleName(), VMSnapshot.class); |
| s_typeMap.put(VirtualMachineTemplate.class.getSimpleName(), VirtualMachineTemplate.class); |
| s_typeMap.put(UserIpv6Address.class.getSimpleName(), UserIpv6Address.class); |
| s_typeMap.put(StaticRoute.class.getSimpleName(), StaticRoute.class); |
| s_typeMap.put(SSHKeyPair.class.getSimpleName(), SSHKeyPair.class); |
| s_typeMap.put(Snapshot.class.getSimpleName(), Snapshot.class); |
| s_typeMap.put(Site2SiteVpnGateway.class.getSimpleName(), Site2SiteVpnGateway.class); |
| s_typeMap.put(Site2SiteCustomerGateway.class.getSimpleName(), Site2SiteCustomerGateway.class); |
| s_typeMap.put(Site2SiteVpnConnection.class.getSimpleName(), Site2SiteVpnConnection.class); |
| s_typeMap.put(SecurityGroup.class.getSimpleName(), SecurityGroup.class); |
| s_typeMap.put(RemoteAccessVpn.class.getSimpleName(), RemoteAccessVpn.class); |
| s_typeMap.put(ProjectInvitation.class.getSimpleName(), ProjectInvitation.class); |
| s_typeMap.put(NicSecondaryIp.class.getSimpleName(), NicSecondaryIp.class); |
| s_typeMap.put(NicIpAlias.class.getSimpleName(), NicIpAlias.class); |
| s_typeMap.put(Network.class.getSimpleName(), Network.class); |
| s_typeMap.put(IpAddress.class.getSimpleName(), IPAddress.class); |
| s_typeMap.put(InstanceGroup.class.getSimpleName(), InstanceGroup.class); |
| s_typeMap.put(GlobalLoadBalancerRule.class.getSimpleName(), GlobalLoadBalancerRule.class); |
| s_typeMap.put(FirewallRule.class.getSimpleName(), FirewallRule.class); |
| s_typeMap.put(PortForwardingRule.class.getSimpleName(), PortForwardingRule.class); |
| s_typeMap.put(Event.class.getSimpleName(), Event.class); |
| s_typeMap.put(AsyncJob.class.getSimpleName(), AsyncJob.class); |
| s_typeMap.put(IAMGroup.class.getSimpleName(), IAMGroup.class); |
| s_typeMap.put(IAMPolicy.class.getSimpleName(), IAMPolicy.class); |
| s_typeMap.put(MonitoringService.class.getSimpleName(), MonitoringService.class); |
| s_typeMap.put(SslCert.class.getSimpleName(), SslCert.class); |
| } |
| |
| @Override |
| public boolean configure(final String name, final Map<String, Object> params) throws ConfigurationException { |
| |
| _messageBus.subscribe(AccountManager.MESSAGE_ADD_ACCOUNT_EVENT, new MessageSubscriber() { |
| @Override |
| public void onPublishMessage(String senderAddress, String subject, Object obj) { |
| HashMap<Long, Long> acctGroupMap = (HashMap<Long, Long>) obj; |
| for (Long accountId : acctGroupMap.keySet()) { |
| Long groupId = acctGroupMap.get(accountId); |
| s_logger.debug("MessageBus message: new Account Added: " + accountId + ", adding it to groupId :" |
| + groupId); |
| addAccountToIAMGroup(accountId, groupId); |
| // add it to domain group too |
| AccountVO account = _accountDao.findById(accountId); |
| Domain domain = _domainDao.findById(account.getDomainId()); |
| if (domain != null) { |
| List<IAMGroup> domainGroups = listDomainGroup(domain); |
| |
| if (domainGroups != null) { |
| for (IAMGroup group : domainGroups) { |
| addAccountToIAMGroup(accountId, new Long(group.getId())); |
| } |
| } |
| } |
| } |
| } |
| }); |
| |
| _messageBus.subscribe(AccountManager.MESSAGE_REMOVE_ACCOUNT_EVENT, new MessageSubscriber() { |
| @Override |
| public void onPublishMessage(String senderAddress, String subject, Object obj) { |
| Long accountId = ((Long) obj); |
| if (accountId != null) { |
| s_logger.debug("MessageBus message: Account removed: " + accountId |
| + ", releasing the group associations"); |
| removeAccountFromIAMGroups(accountId); |
| } |
| } |
| }); |
| |
| _messageBus.subscribe(DomainManager.MESSAGE_ADD_DOMAIN_EVENT, new MessageSubscriber() { |
| @Override |
| public void onPublishMessage(String senderAddress, String subject, Object obj) { |
| Long domainId = ((Long) obj); |
| if (domainId != null) { |
| s_logger.debug("MessageBus message: new Domain created: " + domainId + ", creating a new group"); |
| Domain domain = _domainDao.findById(domainId); |
| _iamSrv.createIAMGroup("DomainGrp-" + domain.getUuid(), "Domain group", domain.getPath()); |
| } |
| } |
| }); |
| |
| _messageBus.subscribe(DomainManager.MESSAGE_REMOVE_DOMAIN_EVENT, new MessageSubscriber() { |
| @Override |
| public void onPublishMessage(String senderAddress, String subject, Object obj) { |
| Long domainId = ((Long) obj); |
| if (domainId != null) { |
| s_logger.debug("MessageBus message: Domain removed: " + domainId + ", removing the domain group"); |
| Domain domain = _domainDao.findById(domainId); |
| List<IAMGroup> groups = listDomainGroup(domain); |
| for (IAMGroup group : groups) { |
| _iamSrv.deleteIAMGroup(group.getId()); |
| } |
| } |
| } |
| }); |
| |
| _messageBus.subscribe(TemplateManager.MESSAGE_REGISTER_PUBLIC_TEMPLATE_EVENT, new MessageSubscriber() { |
| @Override |
| public void onPublishMessage(String senderAddress, String subject, Object obj) { |
| Long templateId = (Long)obj; |
| if (templateId != null) { |
| s_logger.debug("MessageBus message: new public template registered: " + templateId |
| + ", grant permission to default root admin, domain admin and normal user policies"); |
| _iamSrv.addIAMPermissionToIAMPolicy(new Long(Account.ACCOUNT_TYPE_ADMIN + 1), VirtualMachineTemplate.class.getSimpleName(), |
| PermissionScope.RESOURCE.toString(), templateId, "listTemplates", AccessType.UseEntry.toString(), Permission.Allow, false); |
| _iamSrv.addIAMPermissionToIAMPolicy(new Long(Account.ACCOUNT_TYPE_DOMAIN_ADMIN + 1), VirtualMachineTemplate.class.getSimpleName(), |
| PermissionScope.RESOURCE.toString(), templateId, "listTemplates", AccessType.UseEntry.toString(), Permission.Allow, false); |
| _iamSrv.addIAMPermissionToIAMPolicy(new Long(Account.ACCOUNT_TYPE_NORMAL + 1), VirtualMachineTemplate.class.getSimpleName(), |
| PermissionScope.RESOURCE.toString(), templateId, "listTemplates", AccessType.UseEntry.toString(), Permission.Allow, false); |
| } |
| } |
| }); |
| |
| _messageBus.subscribe(TemplateManager.MESSAGE_RESET_TEMPLATE_PERMISSION_EVENT, new MessageSubscriber() { |
| @Override |
| public void onPublishMessage(String senderAddress, String subject, Object obj) { |
| Long templateId = (Long)obj; |
| if (templateId != null) { |
| s_logger.debug("MessageBus message: reset template permission: " + templateId); |
| resetTemplatePermission(templateId); |
| } |
| } |
| }); |
| |
| _messageBus.subscribe(EntityManager.MESSAGE_REMOVE_ENTITY_EVENT, new MessageSubscriber() { |
| @Override |
| public void onPublishMessage(String senderAddress, String subject, Object obj) { |
| Pair<Class<?>, Long> entity = (Pair<Class<?>, Long>)obj; |
| if (entity != null) { |
| String entityType = entity.first().getSimpleName(); |
| Long entityId = entity.second(); |
| s_logger.debug("MessageBus message: delete an entity: (" + entityType + "," + entityId + "), remove its related permission"); |
| _iamSrv.removeIAMPermissionForEntity(entityType, entityId); |
| } |
| } |
| }); |
| |
| |
| _messageBus.subscribe(EntityManager.MESSAGE_GRANT_ENTITY_EVENT, new MessageSubscriber() { |
| @Override |
| public void onPublishMessage(String senderAddress, String subject, Object obj) { |
| Map<String, Object> permit = (Map<String, Object>)obj; |
| if (permit != null) { |
| Class<?> entityType = (Class<?>)permit.get(ApiConstants.ENTITY_TYPE); |
| Long entityId = (Long)permit.get(ApiConstants.ENTITY_ID); |
| AccessType accessType = (AccessType)permit.get(ApiConstants.ACCESS_TYPE); |
| String action = (String)permit.get(ApiConstants.IAM_ACTION); |
| List<Long> acctIds = (List<Long>)permit.get(ApiConstants.ACCOUNTS); |
| s_logger.debug("MessageBus message: grant accounts permission to an entity: (" + entityType + "," + entityId + ")"); |
| grantEntityPermissioinToAccounts(entityType.getSimpleName(), entityId, accessType, action, acctIds); |
| } |
| } |
| }); |
| |
| _messageBus.subscribe(EntityManager.MESSAGE_REVOKE_ENTITY_EVENT, new MessageSubscriber() { |
| @Override |
| public void onPublishMessage(String senderAddress, String subject, Object obj) { |
| Map<String, Object> permit = (Map<String, Object>)obj; |
| if (permit != null) { |
| Class<?> entityType = (Class<?>)permit.get(ApiConstants.ENTITY_TYPE); |
| Long entityId = (Long)permit.get(ApiConstants.ENTITY_ID); |
| AccessType accessType = (AccessType)permit.get(ApiConstants.ACCESS_TYPE); |
| String action = (String)permit.get(ApiConstants.IAM_ACTION); |
| List<Long> acctIds = (List<Long>)permit.get(ApiConstants.ACCOUNTS); |
| s_logger.debug("MessageBus message: revoke from accounts permission to an entity: (" + entityType + "," + entityId + ")"); |
| revokeEntityPermissioinFromAccounts(entityType.getSimpleName(), entityId, accessType, action, acctIds); |
| } |
| } |
| }); |
| |
| _messageBus.subscribe(EntityManager.MESSAGE_ADD_DOMAIN_WIDE_ENTITY_EVENT, new MessageSubscriber() { |
| @Override |
| public void onPublishMessage(String senderAddress, String subject, Object obj) { |
| Map<String, Object> params = (Map<String, Object>) obj; |
| if (params != null) { |
| addDomainWideResourceAccess(params); |
| } |
| } |
| }); |
| |
| return super.configure(name, params); |
| } |
| |
| @Override |
| public boolean start() { |
| s_logger.info("Populating IAM group and account association for default accounts..."); |
| |
| // populate group <-> account association if not present for CS admin |
| // and system accounts |
| populateIAMGroupAdminAccountMap(); |
| |
| return true; |
| } |
| |
| private void populateIAMGroupAdminAccountMap() { |
| List<Long> sysAccts = new ArrayList<Long>(); |
| sysAccts.add(Account.ACCOUNT_ID_SYSTEM); |
| sysAccts.add(Account.ACCOUNT_ID_SYSTEM + 1); |
| _iamSrv.addAccountsToGroup(sysAccts, new Long(Account.ACCOUNT_TYPE_ADMIN + 1)); |
| } |
| |
| private void addDomainWideResourceAccess(Map<String, Object> params) { |
| |
| Class<?> entityType = (Class<?>)params.get(ApiConstants.ENTITY_TYPE); |
| Long entityId = (Long) params.get(ApiConstants.ENTITY_ID); |
| Long domainId = (Long) params.get(ApiConstants.DOMAIN_ID); |
| Boolean isRecursive = (Boolean) params.get(ApiConstants.SUBDOMAIN_ACCESS); |
| |
| if (entityType == Network.class) { |
| createPolicyAndAddToDomainGroup("DomainWideNetwork-" + entityId, "domain wide network", entityType.toString(), |
| entityId, "listNetworks", AccessType.UseEntry, domainId, isRecursive); |
| } else if (entityType == AffinityGroup.class) { |
| createPolicyAndAddToDomainGroup("DomainWideNetwork-" + entityId, "domain wide affinityGroup", entityType.toString(), |
| entityId, "listAffinityGroups", AccessType.UseEntry, domainId, isRecursive); |
| } |
| |
| } |
| |
| private void createPolicyAndAddToDomainGroup(String policyName, String description, String entityType, |
| Long entityId, String action, AccessType accessType, Long domainId, Boolean recursive) { |
| |
| Domain domain = _domainDao.findById(domainId); |
| if (domain != null) { |
| IAMPolicy policy = _iamSrv.createIAMPolicy(policyName, description, null, domain.getPath()); |
| _iamSrv.addIAMPermissionToIAMPolicy(policy.getId(), entityType, PermissionScope.RESOURCE.toString(), |
| entityId, action, accessType.toString(), Permission.Allow, recursive); |
| List<Long> policyList = new ArrayList<Long>(); |
| policyList.add(new Long(policy.getId())); |
| |
| List<IAMGroup> domainGroups = listDomainGroup(domain); |
| if (domainGroups != null) { |
| for (IAMGroup group : domainGroups) { |
| _iamSrv.attachIAMPoliciesToGroup(policyList, group.getId()); |
| } |
| } |
| } |
| } |
| |
| @DB |
| @Override |
| @ActionEvent(eventType = EventTypes.EVENT_IAM_GROUP_CREATE, eventDescription = "Creating Acl Group", create = true) |
| public IAMGroup createIAMGroup(Account caller, String iamGroupName, String description) { |
| Long domainId = caller.getDomainId(); |
| Domain callerDomain = _domainDao.findById(domainId); |
| if (callerDomain == null) { |
| throw new InvalidParameterValueException("Caller does not have a domain"); |
| } |
| return _iamSrv.createIAMGroup(iamGroupName, description, callerDomain.getPath()); |
| } |
| |
| @DB |
| @Override |
| @ActionEvent(eventType = EventTypes.EVENT_IAM_GROUP_DELETE, eventDescription = "Deleting Acl Group") |
| public boolean deleteIAMGroup(final Long iamGroupId) { |
| return _iamSrv.deleteIAMGroup(iamGroupId); |
| } |
| |
| @Override |
| public List<IAMGroup> listIAMGroups(long accountId) { |
| return _iamSrv.listIAMGroups(accountId); |
| } |
| |
| |
| @DB |
| @Override |
| @ActionEvent(eventType = EventTypes.EVENT_IAM_GROUP_UPDATE, eventDescription = "Adding accounts to acl group") |
| public IAMGroup addAccountsToGroup(final List<Long> acctIds, final Long groupId) { |
| return _iamSrv.addAccountsToGroup(acctIds, groupId); |
| } |
| |
| |
| private void removeAccountFromIAMGroups(long accountId) { |
| List<IAMGroup> groups = listIAMGroups(accountId); |
| List<Long> accts = new ArrayList<Long>(); |
| accts.add(accountId); |
| if (groups != null) { |
| for (IAMGroup grp : groups) { |
| removeAccountsFromGroup(accts, grp.getId()); |
| } |
| } |
| } |
| |
| private void addAccountToIAMGroup(long accountId, long groupId) { |
| List<Long> accts = new ArrayList<Long>(); |
| accts.add(accountId); |
| addAccountsToGroup(accts, groupId); |
| } |
| |
| @DB |
| @Override |
| @ActionEvent(eventType = EventTypes.EVENT_IAM_GROUP_UPDATE, eventDescription = "Removing accounts from acl group") |
| public IAMGroup removeAccountsFromGroup(final List<Long> acctIds, final Long groupId) { |
| return _iamSrv.removeAccountsFromGroup(acctIds, groupId); |
| } |
| |
| @DB |
| @Override |
| @ActionEvent(eventType = EventTypes.EVENT_IAM_POLICY_CREATE, eventDescription = "Creating IAM Policy", create = true) |
| public IAMPolicy createIAMPolicy(Account caller, final String iamPolicyName, final String description, final Long parentPolicyId) { |
| Long domainId = caller.getDomainId(); |
| Domain callerDomain = _domainDao.findById(domainId); |
| if (callerDomain == null) { |
| throw new InvalidParameterValueException("Caller does not have a domain"); |
| } |
| return _iamSrv.createIAMPolicy(iamPolicyName, description, parentPolicyId, callerDomain.getPath()); |
| } |
| |
| @DB |
| @Override |
| @ActionEvent(eventType = EventTypes.EVENT_IAM_POLICY_DELETE, eventDescription = "Deleting IAM Policy") |
| public boolean deleteIAMPolicy(final long iamPolicyId) { |
| return _iamSrv.deleteIAMPolicy(iamPolicyId); |
| } |
| |
| |
| @Override |
| public List<IAMPolicy> listIAMPolicies(long accountId) { |
| return _iamSrv.listIAMPolicies(accountId); |
| } |
| |
| @DB |
| @Override |
| @ActionEvent(eventType = EventTypes.EVENT_IAM_GROUP_UPDATE, eventDescription = "Attaching policy to acl group") |
| public IAMGroup attachIAMPoliciesToGroup(final List<Long> policyIds, final Long groupId) { |
| return _iamSrv.attachIAMPoliciesToGroup(policyIds, groupId); |
| } |
| |
| @DB |
| @Override |
| @ActionEvent(eventType = EventTypes.EVENT_IAM_GROUP_UPDATE, eventDescription = "Removing policies from acl group") |
| public IAMGroup removeIAMPoliciesFromGroup(final List<Long> policyIds, final Long groupId) { |
| return _iamSrv.removeIAMPoliciesFromGroup(policyIds, groupId); |
| } |
| |
| |
| @DB |
| @Override |
| @ActionEvent(eventType = EventTypes.EVENT_IAM_ACCOUNT_POLICY_UPDATE, eventDescription = "Attaching policy to accounts") |
| public void attachIAMPolicyToAccounts(final Long policyId, final List<Long> accountIds) { |
| _iamSrv.attachIAMPolicyToAccounts(policyId, accountIds); |
| } |
| |
| @DB |
| @Override |
| @ActionEvent(eventType = EventTypes.EVENT_IAM_ACCOUNT_POLICY_UPDATE, eventDescription = "Removing policy from accounts") |
| public void removeIAMPolicyFromAccounts(final Long policyId, final List<Long> accountIds) { |
| _iamSrv.removeIAMPolicyFromAccounts(policyId, accountIds); |
| } |
| |
| @DB |
| @Override |
| @ActionEvent(eventType = EventTypes.EVENT_IAM_POLICY_GRANT, eventDescription = "Granting acl permission to IAM Policy") |
| public IAMPolicy addIAMPermissionToIAMPolicy(long iamPolicyId, String entityType, PermissionScope scope, |
| Long scopeId, String action, Permission perm, Boolean recursive, Boolean readOnly) { |
| Class<?> cmdClass = _apiServer.getCmdClass(action); |
| AccessType accessType = null; |
| if (BaseListCmd.class.isAssignableFrom(cmdClass)) { |
| if (readOnly) { |
| accessType = AccessType.ListEntry; |
| } else { |
| accessType = AccessType.UseEntry; |
| } |
| } else { |
| accessType = AccessType.OperateEntry; |
| } |
| String accessTypeStr = (accessType != null) ? accessType.toString() : null; |
| return _iamSrv.addIAMPermissionToIAMPolicy(iamPolicyId, entityType, scope.toString(), scopeId, action, |
| accessTypeStr, perm, recursive); |
| } |
| |
| @DB |
| @Override |
| @ActionEvent(eventType = EventTypes.EVENT_IAM_POLICY_REVOKE, eventDescription = "Revoking acl permission from IAM Policy") |
| public IAMPolicy removeIAMPermissionFromIAMPolicy(long iamPolicyId, String entityType, PermissionScope scope, Long scopeId, String action) { |
| return _iamSrv.removeIAMPermissionFromIAMPolicy(iamPolicyId, entityType, scope.toString(), scopeId, action); |
| } |
| |
| @Override |
| public IAMPolicyPermission getIAMPolicyPermission(long accountId, String entityType, String action) { |
| List<IAMPolicy> policies = _iamSrv.listIAMPolicies(accountId); |
| IAMPolicyPermission curPerm = null; |
| for (IAMPolicy policy : policies) { |
| List<IAMPolicyPermission> perms = _iamSrv.listPolicyPermissionByActionAndEntity(policy.getId(), action, |
| entityType); |
| if (perms == null || perms.size() == 0) |
| continue; |
| IAMPolicyPermission perm = perms.get(0); // just pick one |
| if (curPerm == null) { |
| curPerm = perm; |
| } else if (PermissionScope.valueOf(perm.getScope()).greaterThan(PermissionScope.valueOf(curPerm.getScope()))) { |
| // pick the more relaxed allowed permission |
| curPerm = perm; |
| } |
| } |
| |
| return curPerm; |
| } |
| |
| |
| @Override |
| public IAMPolicyResponse createIAMPolicyResponse(IAMPolicy policy) { |
| IAMPolicyResponse response = new IAMPolicyResponse(); |
| response.setId(policy.getUuid()); |
| response.setName(policy.getName()); |
| response.setDescription(policy.getDescription()); |
| String domainPath = policy.getPath(); |
| if (domainPath != null) { |
| DomainVO domain = _domainDao.findDomainByPath(domainPath); |
| if (domain != null) { |
| response.setDomainId(domain.getUuid()); |
| response.setDomainName(domain.getName()); |
| } |
| } |
| long accountId = policy.getAccountId(); |
| AccountVO owner = _accountDao.findById(accountId); |
| if (owner != null) { |
| response.setAccountName(owner.getAccountName()); |
| } |
| // find permissions associated with this policy |
| List<IAMPolicyPermission> permissions = _iamSrv.listPolicyPermissions(policy.getId()); |
| if (permissions != null && permissions.size() > 0) { |
| for (IAMPolicyPermission permission : permissions) { |
| IAMPermissionResponse perm = new IAMPermissionResponse(); |
| perm.setAction(permission.getAction()); |
| if (permission.getEntityType() != null) { |
| perm.setEntityType(permission.getEntityType()); |
| } |
| if (permission.getScope() != null) { |
| perm.setScope(PermissionScope.valueOf(permission.getScope())); |
| } |
| perm.setScopeId(permission.getScopeId()); |
| perm.setPermission(permission.getPermission()); |
| response.addPermission(perm); |
| } |
| } |
| response.setObjectName("aclpolicy"); |
| return response; |
| } |
| |
| @Override |
| public IAMGroupResponse createIAMGroupResponse(IAMGroup group) { |
| IAMGroupResponse response = new IAMGroupResponse(); |
| response.setId(group.getUuid()); |
| response.setName(group.getName()); |
| response.setDescription(group.getDescription()); |
| String domainPath = group.getPath(); |
| if (domainPath != null) { |
| DomainVO domain = _domainDao.findDomainByPath(domainPath); |
| if (domain != null) { |
| response.setDomainId(domain.getUuid()); |
| response.setDomainName(domain.getName()); |
| } |
| } |
| long accountId = group.getAccountId(); |
| AccountVO owner = _accountDao.findById(accountId); |
| if (owner != null) { |
| response.setAccountName(owner.getAccountName()); |
| } |
| // find all the members in this group |
| List<Long> members = _iamSrv.listAccountsByGroup(group.getId()); |
| if (members != null && members.size() > 0) { |
| for (Long member : members) { |
| AccountVO mem = _accountDao.findById(member); |
| if (mem != null) { |
| response.addMemberAccount(mem.getAccountName()); |
| } |
| } |
| } |
| |
| // find all the policies attached to this group |
| List<IAMPolicy> policies = _iamSrv.listIAMPoliciesByGroup(group.getId()); |
| if (policies != null && policies.size() > 0) { |
| for (IAMPolicy policy : policies) { |
| response.addPolicy(policy.getName()); |
| } |
| } |
| |
| response.setObjectName("aclgroup"); |
| return response; |
| |
| } |
| |
| public List<IAMGroup> listDomainGroup(Domain domain) { |
| |
| if (domain != null) { |
| String domainPath = domain.getPath(); |
| // search for groups |
| Pair<List<IAMGroup>, Integer> result = _iamSrv.listIAMGroups(null, "DomainGrp-" + domain.getUuid(), |
| domainPath, null, null); |
| return result.first(); |
| } |
| return new ArrayList<IAMGroup>(); |
| |
| } |
| |
| @Override |
| public ListResponse<IAMGroupResponse> listIAMGroups(Long iamGroupId, String iamGroupName, Long domainId, Long startIndex, Long pageSize) { |
| // acl check |
| Account caller = CallContext.current().getCallingAccount(); |
| |
| Domain domain = null; |
| if (domainId != null) { |
| domain = _domainDao.findById(domainId); |
| if (domain == null) { |
| throw new InvalidParameterValueException("Domain id=" + domainId + " doesn't exist"); |
| } |
| |
| _accountMgr.checkAccess(caller, domain); |
| } else { |
| domain = _domainDao.findById(caller.getDomainId()); |
| } |
| String domainPath = domain.getPath(); |
| // search for groups |
| Pair<List<IAMGroup>, Integer> result = _iamSrv.listIAMGroups(iamGroupId, iamGroupName, domainPath, startIndex, pageSize); |
| // generate group response |
| ListResponse<IAMGroupResponse> response = new ListResponse<IAMGroupResponse>(); |
| List<IAMGroupResponse> groupResponses = new ArrayList<IAMGroupResponse>(); |
| for (IAMGroup group : result.first()) { |
| IAMGroupResponse resp = createIAMGroupResponse(group); |
| groupResponses.add(resp); |
| } |
| response.setResponses(groupResponses, result.second()); |
| return response; |
| } |
| |
| @Override |
| public ListResponse<IAMPolicyResponse> listIAMPolicies(Long iamPolicyId, String iamPolicyName, Long domainId, Long startIndex, |
| Long pageSize) { |
| // acl check |
| Account caller = CallContext.current().getCallingAccount(); |
| |
| Domain domain = null; |
| if (domainId != null) { |
| domain = _domainDao.findById(domainId); |
| if (domain == null) { |
| throw new InvalidParameterValueException("Domain id=" + domainId + " doesn't exist"); |
| } |
| |
| _accountMgr.checkAccess(caller, domain); |
| } else { |
| domain = _domainDao.findById(caller.getDomainId()); |
| } |
| String domainPath = domain.getPath(); |
| // search for policies |
| Pair<List<IAMPolicy>, Integer> result = _iamSrv.listIAMPolicies(iamPolicyId, iamPolicyName, domainPath, startIndex, pageSize); |
| // generate policy response |
| ListResponse<IAMPolicyResponse> response = new ListResponse<IAMPolicyResponse>(); |
| List<IAMPolicyResponse> policyResponses = new ArrayList<IAMPolicyResponse>(); |
| for (IAMPolicy policy : result.first()) { |
| IAMPolicyResponse resp = createIAMPolicyResponse(policy); |
| policyResponses.add(resp); |
| } |
| response.setResponses(policyResponses, result.second()); |
| return response; |
| } |
| |
| @Override |
| public void grantEntityPermissioinToAccounts(String entityType, Long entityId, AccessType accessType, String action, List<Long> accountIds) { |
| // check if there is already a policy with only this permission added to it |
| IAMPolicy policy = _iamSrv.getResourceGrantPolicy(entityType, entityId, accessType.toString(), action); |
| if (policy == null) { |
| // not found, just create a policy with resource grant permission |
| Account caller = CallContext.current().getCallingAccount(); |
| String aclPolicyName = "policyGrant" + entityType + entityId; |
| String description = "Policy to grant permission to " + entityType + entityId; |
| policy = createIAMPolicy(caller, aclPolicyName, description, null); |
| // add permission to this policy |
| addIAMPermissionToIAMPolicy(policy.getId(), entityType, PermissionScope.RESOURCE, entityId, action, |
| Permission.Allow, false, false); |
| } |
| // attach this policy to list of accounts if not attached already |
| Long policyId = policy.getId(); |
| for (Long acctId : accountIds) { |
| if (!isPolicyAttachedToAccount(policyId, acctId)) { |
| attachIAMPolicyToAccounts(policyId, Collections.singletonList(acctId)); |
| } |
| } |
| } |
| |
| @Override |
| public void revokeEntityPermissioinFromAccounts(String entityType, Long entityId, AccessType accessType, String action, List<Long> accountIds) { |
| // there should already a policy with only this permission added to it, this call is mainly used |
| IAMPolicy policy = _iamSrv.getResourceGrantPolicy(entityType, entityId, accessType.toString(), action); |
| if (policy == null) { |
| s_logger.warn("Cannot find a policy associated with this entity permissioin to be revoked, just return"); |
| return; |
| } |
| // detach this policy from list of accounts if not detached already |
| Long policyId = policy.getId(); |
| for (Long acctId : accountIds) { |
| if (isPolicyAttachedToAccount(policyId, acctId)) { |
| removeIAMPolicyFromAccounts(policyId, Collections.singletonList(acctId)); |
| } |
| } |
| |
| } |
| |
| private boolean isPolicyAttachedToAccount(Long policyId, Long accountId) { |
| List<IAMPolicy> pList = listIAMPolicies(accountId); |
| for (IAMPolicy p : pList) { |
| if (p.getId() == policyId.longValue()) { |
| return true; |
| } |
| } |
| return false; |
| } |
| |
| private void resetTemplatePermission(Long templateId){ |
| // reset template will change template to private, so we need to remove its permission for domain admin and normal user group |
| _iamSrv.removeIAMPermissionFromIAMPolicy(new Long(Account.ACCOUNT_TYPE_DOMAIN_ADMIN + 1), VirtualMachineTemplate.class.getSimpleName(), |
| PermissionScope.RESOURCE.toString(), templateId, "listTemplates"); |
| _iamSrv.removeIAMPermissionFromIAMPolicy(new Long(Account.ACCOUNT_TYPE_NORMAL + 1), VirtualMachineTemplate.class.getSimpleName(), |
| PermissionScope.RESOURCE.toString(), templateId, "listTemplates"); |
| // check if there is a policy with only UseEntry permission for this template added |
| IAMPolicy policy = _iamSrv.getResourceGrantPolicy(VirtualMachineTemplate.class.getSimpleName(), templateId, AccessType.UseEntry.toString(), "listTemplates"); |
| if ( policy == null ){ |
| s_logger.info("No policy found for this template grant: " + templateId + ", no detach to be done"); |
| return; |
| } |
| // delete the policy, which should detach it from groups and accounts |
| _iamSrv.deleteIAMPolicy(policy.getId()); |
| |
| } |
| |
| @Override |
| public Long getPermissionScopeId(String scope, String entityType, String scopeId) { |
| if (scopeId.equals("-1")) { |
| return -1L; |
| } |
| PermissionScope permScope = PermissionScope.valueOf(scope); |
| InternalIdentity entity = null; |
| switch (permScope) { |
| case DOMAIN: |
| entity = _domainDao.findByUuid(scopeId); |
| break; |
| case ACCOUNT: |
| entity = _accountDao.findByUuid(scopeId); |
| break; |
| case RESOURCE: |
| Class<?> clazz = s_typeMap.get(entityType); |
| entity = (InternalIdentity)_entityMgr.findByUuid(clazz, scopeId); |
| } |
| |
| if (entity != null) { |
| return entity.getId(); |
| } |
| throw new InvalidParameterValueException("Unable to find scopeId " + scopeId + " with scope " + scope + " and type " + entityType); |
| } |
| |
| @Override |
| public List<Class<?>> getCommands() { |
| List<Class<?>> cmdList = new ArrayList<Class<?>>(); |
| cmdList.add(CreateIAMPolicyCmd.class); |
| cmdList.add(DeleteIAMPolicyCmd.class); |
| cmdList.add(ListIAMPoliciesCmd.class); |
| cmdList.add(AddIAMPermissionToIAMPolicyCmd.class); |
| cmdList.add(RemoveIAMPermissionFromIAMPolicyCmd.class); |
| cmdList.add(AttachIAMPolicyToIAMGroupCmd.class); |
| cmdList.add(RemoveIAMPolicyFromIAMGroupCmd.class); |
| cmdList.add(CreateIAMGroupCmd.class); |
| cmdList.add(DeleteIAMGroupCmd.class); |
| cmdList.add(ListIAMGroupsCmd.class); |
| cmdList.add(AddAccountToIAMGroupCmd.class); |
| cmdList.add(RemoveAccountFromIAMGroupCmd.class); |
| cmdList.add(AttachIAMPolicyToAccountCmd.class); |
| cmdList.add(RemoveIAMPolicyFromAccountCmd.class); |
| return cmdList; |
| } |
| } |
