authorization

Documentation

Overview

Package authorization provides the APIs for all available authorization concepts.

Index

• Constants
• func CanHaveMembers(resourceTypeName string) bool
• func ScopeForManagingRolesInResourceType(resourceType string) string
• func ScopeForViewingRolesInResourceType(resourceType string) string
• type IdentityAssociation
  • func AppendAssociation(associations []IdentityAssociation, resourceID string, resourceName *string, ...) []IdentityAssociation
  • func MergeAssociations(associations []IdentityAssociation, merge []IdentityAssociation) []IdentityAssociation

Constants

const (
	// IdentityResourceTypeOrganization defines the string constant to be used for denoting an organization managed by the authorization framework
	IdentityResourceTypeOrganization = "identity/organization"

	// IdentityResourceTypeTeam defines the string constant to be used for denoting a team managed by the authorization framework
	IdentityResourceTypeTeam = "identity/team"

	// IdentityResourceTypeGroup defines the string constant to be used for denoting a group managed by the authorization framework
	IdentityResourceTypeGroup = "identity/group"

	// IdentityResourceTypeUser defines the string constant to be used for denoting a user managed by the authorization framework
	IdentityResourceTypeUser = "identity/user"

	// ResourceTypeSpace defines the string constant for the space resource type
	ResourceTypeSpace = "openshift.io/resource/space"

	// ResourceTypeSystem defines the string constant for the system resource type
	ResourceTypeSystem = "openshift.io/resource/system"

	// SystemUserAdminRole is the constant used to denote the name of the system resource's user administrator role
	SystemUserAdminRole = userAdminRole

	// SystemAdminConsoleUser is the constant used to denote the name of the role which allows a user access to the admin console
	SystemAdminConsoleUser = adminConsoleUserRole

	// AccessSystemScope is a general scope required to access a resource of type system
	AccessSystemScope = accessScope

	// ManageUserSystemScope is a general scope required to perform operations for managing users in a resource of type system
	ManageUserSystemScope = manageUserScope

	// OrganizationAdminRole is the constant used to denote the name of the organization resource's administrator role
	OrganizationAdminRole = adminRole

	// OrganizationContributorRole is the constant used to denote the name of the organization resource's contributor role
	OrganizationContributorRole = contributorRole

	// SpaceAdminRole is the constant used to denote the name of a space resource's administrator role
	SpaceAdminRole = adminRole

	// SpaceContributorRole is the constant used to denote the name of the space's contributor role
	SpaceContributorRole = contributorRole

	// SpaceViewerRole is the constant used to denote the name of the space's viewer role
	SpaceViewerRole = viewerRole

	// ViewSpaceScope is a general scope required to perform many space-related operations
	ViewSpaceScope = viewScope

	// ManageSpaceScope is a general scope required to perform operations for managing a space
	ManageSpaceScope = manageScope

	// ContributeSpaceScope is a general scope required to perform many space-related operations
	ContributeSpaceScope = contributeScope

	// ManageTeamsInSpaceScope is the scope required for users wishing to manage teams for a space
	ManageTeamsInSpaceScope = manageScope

	// ManageOrganizationMembersScope is the scope required for users wishing to manage members of an organization
	ManageOrganizationMembersScope = manageScope

	// ManageTeamMembersScope is the scope required for users wishing to manage members of a team
	ManageTeamMembersScope = manageScope

	// ManageSecurityGroupMembersScope is the scope required for users wishing to manage members of a security group
	ManageSecurityGroupMembersScope = manageScope

	// ViewTeamsInSpaceScope is the scope required for users wishing to view the teams in a space
	ViewTeamsInSpaceScope = ViewSpaceScope

	// ManageRoleAssignmentsInSpaceScope is the scope required for managing role assignments in a space
	ManageRoleAssignmentsInSpaceScope = manageScope

	// DeleteSpaceScope is the scope required for deleting a space. It's a space level scope.
	DeleteSpaceScope = ManageSpaceScope

	// ViewRoleAssignmentsInSpaceScope is the scope required for viewing role assignments in a space
	ViewRoleAssignmentsInSpaceScope = ViewSpaceScope

	// ViewOrganizationMembersScope is the scope required for viewing organization members
	ViewOrganizationMembersScope = viewOrganizationScope

	// ViewTeamMembersScope is the scope required for viewing team members
	ViewTeamMembersScope = viewTeamScope

	// ViewSecurityGroupMembersScope is the scope required for viewing security group members
	ViewSecurityGroupMembersScope = viewSecurityGroupScope
)

Functions

func CanHaveMembers

func CanHaveMembers(resourceTypeName string) bool

CanHaveMembers returns a boolean indicating whether the specified resource type may have member Identities

func ScopeForManagingRolesInResourceType

func ScopeForManagingRolesInResourceType(resourceType string) string

ScopeForManagingRolesInResourceType returns the name of the scope that gives a user privileges to manage roles in a resource

func ScopeForViewingRolesInResourceType

func ScopeForViewingRolesInResourceType(resourceType string) string

ScopeForViewingRolesInResourceType returns the name of the scope that gives a user privileges to view roles in a resource

Types

type IdentityAssociation

type IdentityAssociation struct {
	ResourceID       string
	ResourceName     string
	ParentResourceID *string
	IdentityID       *uuid.UUID
	Member           bool
	Roles            []string
}

IdentityAssociation represents an association between an Identity and either another Identity or a Resource, whether by membership or by having been granted a role. It contains metadata about the Identity's relationship with the other entity, including its membership state, and any roles it may have been assigned.

func AppendAssociation

func AppendAssociation(associations []IdentityAssociation, resourceID string, resourceName *string, parentResourceID *string,
	identityID *uuid.UUID, member bool, role *string) []IdentityAssociation

AppendAssociation appends the association state specified by the parameter values to an existing IdentityAssociation array

func MergeAssociations

func MergeAssociations(associations []IdentityAssociation, merge []IdentityAssociation) []IdentityAssociation

MergeAssociations merges two arrays of IdentityAssociation objects into one