univention.authorization package

Submodules

univention.authorization.authorization module

Interface to Guardian

class univention.authorization.authorization.LocalGuardianAuthorizationClient(base_path)

Bases: object

reload()

static load_local_roles(base_path)

check_permissions(actor, targets, contexts, namespaces, extra_request_data=None, targeted_permissions_to_check=None, general_permissions_to_check=None)

get_and_check_permissions(actor, targets, contexts, namespaces, extra_request_data=None, targeted_permissions_to_check=None, general_permissions_to_check=None)

get_permissions(actor, targets, contexts, namespaces, extra_request_data=None, include_general_permissions=False)

udm_conditions_target_position_from_context(params, condition_data)

udm_conditions_target_position_in(params, condition_data)

Checks if the position matches the condition.

udm_conditions_target_object_type_equals(params, condition_data)

Checks the object type of the target object

udm_conditions_target_property_values_compares(params, condition_data)

Checks a property matches any certain value in the target object properties

target_is_self(params, condition_data)

class univention.authorization.authorization.GuardianAuthorizationClient

Bases: object

check_permissions(actor, targets, contexts, namespaces, extra_request_data=None, targeted_permissions_to_check=None, general_permissions_to_check=None)

get_and_check_permissions(actor, targets, contexts, namespaces, extra_request_data=None, targeted_permissions_to_check=None, general_permissions_to_check=None)

get_permissions(actor, targets, contexts, namespaces, extra_request_data=None, include_general_permissions=False)

univention.authorization.config module

class univention.authorization.config.AuthorizationConfig(filename)

Bases: object

A YAML based configuration format for Guardian.

This intermediate layer allows to de-duplicate data while Guardian dosen’t offer capability bundles, permission bundles, and multiple role to capability assignments, etc.

parse()

compose()

create(client)

create_permission(role_string, permissions)

create_capability_bundle(role_string, bundle_name)

create_capability(role_string, capability_string)

resolve_conditions(condition_name)

resolve_permissions(permission_names)

univention.authorization.management module

Guardian Management Client

exception univention.authorization.management.TokenInvalidError

Bases: Exception

class univention.authorization.management.GuardianManagementClient(management_url, username, password, oidc_token_endpoint_url, oidc_client_id)

Bases: object

static get_token(token_endpoint_url, client_id, username, password)

handle_status_code(response)

generate_headers()

post(path, data)

put(path, data)

patch(path, data)

request(method, path, data)

create_app(app_name, display_name)

modify_app(app_name, display_name)

create_namespace(app_name, namespace_name, display_name=None)

modify_namespace(app_name, namespace_name, display_name)

create_role(app_name, namespace_name, role_name, display_name)

modify_role(app_name, namespace_name, role_name, display_name)

create_permission(app_name, namespace_name, permission_name, display_name)

modify_permission(app_name, namespace_name, permission_name, display_name)

create_context(app_name, namespace_name, context_name, display_name)

modify_context(app_name, namespace_name, context_name, display_name)

create_condition(app_name, namespace_name, condition_name, display_name, documentation, code, parameters=None)

modify_condition(app_name, namespace_name, condition_name, display_name, documentation, code, parameters=None)

create_role_capability_mapping(app_name, namespace_name, name, display_name, role, permissions, conditions=None, relation='AND')

modify_role_capability_mapping(app_name, namespace_name, name, display_name, role, permissions, conditions=None, relation='AND')

prune(apps, contexts, namespaces, roles, capabilities)

univention.authorization.management.expand_role(app_name, namespace_name, name)

univention.authorization.management.expand_permission(app_name, namespace_name, name)

univention.authorization.management.expand_string(string)

univention.authorization.management.implode_string(app_name, namespace_name, name)

univention.authorization.management.expand_condition(condition, parameters=None)

class univention.authorization.management.GuardianManagementClientLocal(local_path, management_url, username, password, oidc_token_endpoint_url, oidc_client_id)

Bases: GuardianManagementClient

request(method, path, data)

prune(apps, contexts, namespaces, roles, capabilities)