auth

package
v1.1.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jan 15, 2026 License: Apache-2.0 Imports: 44 Imported by: 2

Documentation

Index

Constants

View Source 
const IpaVersion = "2.254"
View Source 
const ResourceArnPrefix = "arn:aws:s3:::"

Variables

View Source 
var (
	// ErrUserExists is returned when the user already exists
	ErrUserExists = errors.New("user already exists")
	// ErrNoSuchUser is returned when the user does not exist
	ErrNoSuchUser = errors.New("user not found")
)
View Source 
var ErrAccessDenied = errors.New("access denied")

Functions

func CheckIfAccountsExist 

func CheckIfAccountsExist(accs []string, iam IAMService) ([]string, error)

func CheckObjectAccess 

func CheckObjectAccess(ctx context.Context, bucket, userAccess string, objects []types.ObjectIdentifier, bypass, isBucketPublic bool, be backend.Backend, isOverwrite bool) error

func IsAdminOrOwner 

func IsAdminOrOwner(acct Account, isRoot bool, acl ACL) error

func IsObjectLockRetentionPutAllowed added in v1.0.19 

func IsObjectLockRetentionPutAllowed(ctx context.Context, be backend.Backend, bucket, object, versionId, userAccess string, input *s3response.PutObjectRetentionInput, bypass bool) error

IsObjectLockRetentionPutAllowed checks if the object lock retention PUT request is allowed against the current state of the object lock

func ParseBucketLockConfigurationInput 

func ParseBucketLockConfigurationInput(input []byte) ([]byte, error)

func ParseBucketLockConfigurationOutput 

func ParseBucketLockConfigurationOutput(input []byte) (*types.ObjectLockConfiguration, error)

func ParseObjectLegalHoldOutput 

func ParseObjectLegalHoldOutput(status *bool) *s3response.GetObjectLegalHoldResult

func ParseObjectLockRetentionInput 

func ParseObjectLockRetentionInput(input []byte) (*s3response.PutObjectRetentionInput, error)

func ParseObjectLockRetentionInputToJSON added in v1.0.19 

func ParseObjectLockRetentionInputToJSON(input *s3response.PutObjectRetentionInput) ([]byte, error)

func ParseObjectLockRetentionOutput 

func ParseObjectLockRetentionOutput(input []byte) (*types.ObjectLockRetention, error)

func UpdateACL 

func UpdateACL(input *PutBucketAclInput, acl ACL, iam IAMService) ([]byte, error)

func UpdateBucketACLOwner added in v1.0.16 

func UpdateBucketACLOwner(ctx context.Context, be backend.Backend, bucket, newOwner string) error

UpdateBucketACLOwner sets default ACL with new owner and removes any previous bucket policy that was in place

func ValidateCannedACL added in v1.0.19 

func ValidateCannedACL(acl string) error

ValidateCannedACL validates bucket canned acl value

func ValidatePolicyDocument 

func ValidatePolicyDocument(policyBin []byte, bucket string, iam IAMService) error

func VerifyAccess 

func VerifyAccess(ctx context.Context, be backend.Backend, opts AccessOptions) error

func VerifyBucketPolicy 

func VerifyBucketPolicy(policy []byte, access, bucket, object string, action Action) error

func VerifyObjectCopyAccess 

func VerifyObjectCopyAccess(ctx context.Context, be backend.Backend, copySource string, opts AccessOptions) error

func VerifyPublicAccess added in v1.0.15 

func VerifyPublicAccess(ctx context.Context, be backend.Backend, action Action, permission Permission, bucket, object string) error

VerifyPublicAccess checks if the bucket is publically accessible by ACL or Policy

func VerifyPublicBucketACL added in v1.0.15 

func VerifyPublicBucketACL(ctx context.Context, be backend.Backend, bucket string, action Action, permission Permission) error

Verifies if the bucket acl grants public access

func VerifyPublicBucketPolicy added in v1.0.15 

func VerifyPublicBucketPolicy(policy []byte, bucket, object string, action Action) error

Checks if the bucket policy grants public access

Types

type ACL 

type ACL struct {
	Owner    string
	Grantees []Grantee
}

func ParseACL 

func ParseACL(data []byte) (ACL, error)

func (*ACL) IsPublic added in v1.0.15 

func (acl *ACL) IsPublic(permission Permission) bool

IsPublic specifies if the acl grants public read access

type AccessControlList 

type AccessControlList struct {
	Grants []Grant `xml:"Grant"`
}

type AccessControlPolicy 

type AccessControlPolicy struct {
	AccessControlList AccessControlList `xml:"AccessControlList"`
	Owner             *types.Owner
}

func (*AccessControlPolicy) Validate added in v1.0.10 

func (acp *AccessControlPolicy) Validate() error

type AccessOptions 

type AccessOptions struct {
	Acl             ACL
	AclPermission   Permission
	IsRoot          bool
	Acc             Account
	Bucket          string
	Object          string
	Action          Action
	Readonly        bool
	IsPublicRequest bool
}

type Account 

type Account struct {
	Access    string `json:"access"`
	Secret    string `json:"secret"`
	Role      Role   `json:"role"`
	UserID    int    `json:"userID"`
	GroupID   int    `json:"groupID"`
	ProjectID int    `json:"projectID"`
}

Account is a gateway IAM account

type Action 

type Action string
const (
	GetBucketAclAction                       Action = "s3:GetBucketAcl"
	CreateBucketAction                       Action = "s3:CreateBucket"
	PutBucketAclAction                       Action = "s3:PutBucketAcl"
	DeleteBucketAction                       Action = "s3:DeleteBucket"
	PutBucketVersioningAction                Action = "s3:PutBucketVersioning"
	GetBucketVersioningAction                Action = "s3:GetBucketVersioning"
	PutBucketPolicyAction                    Action = "s3:PutBucketPolicy"
	GetBucketPolicyAction                    Action = "s3:GetBucketPolicy"
	DeleteBucketPolicyAction                 Action = "s3:DeleteBucketPolicy"
	AbortMultipartUploadAction               Action = "s3:AbortMultipartUpload"
	ListMultipartUploadPartsAction           Action = "s3:ListMultipartUploadParts"
	ListBucketMultipartUploadsAction         Action = "s3:ListBucketMultipartUploads"
	PutObjectAction                          Action = "s3:PutObject"
	GetObjectAction                          Action = "s3:GetObject"
	GetObjectVersionAction                   Action = "s3:GetObjectVersion"
	DeleteObjectAction                       Action = "s3:DeleteObject"
	DeleteObjectVersionAction                Action = "s3:DeleteObjectVersion"
	GetObjectAclAction                       Action = "s3:GetObjectAcl"
	GetObjectAttributesAction                Action = "s3:GetObjectAttributes"
	GetObjectVersionAttributesAction         Action = "s3:GetObjectVersionAttributes"
	PutObjectAclAction                       Action = "s3:PutObjectAcl"
	RestoreObjectAction                      Action = "s3:RestoreObject"
	GetBucketTaggingAction                   Action = "s3:GetBucketTagging"
	PutBucketTaggingAction                   Action = "s3:PutBucketTagging"
	GetObjectTaggingAction                   Action = "s3:GetObjectTagging"
	GetObjectVersionTaggingAction            Action = "s3:GetObjectVersionTagging"
	PutObjectTaggingAction                   Action = "s3:PutObjectTagging"
	PutObjectVersionTaggingAction            Action = "s3:PutObjectVersionTagging"
	DeleteObjectTaggingAction                Action = "s3:DeleteObjectTagging"
	DeleteObjectVersionTaggingAction         Action = "s3:DeleteObjectVersionTagging"
	ListBucketVersionsAction                 Action = "s3:ListBucketVersions"
	ListBucketAction                         Action = "s3:ListBucket"
	GetBucketObjectLockConfigurationAction   Action = "s3:GetBucketObjectLockConfiguration"
	PutBucketObjectLockConfigurationAction   Action = "s3:PutBucketObjectLockConfiguration"
	GetObjectLegalHoldAction                 Action = "s3:GetObjectLegalHold"
	PutObjectLegalHoldAction                 Action = "s3:PutObjectLegalHold"
	GetObjectRetentionAction                 Action = "s3:GetObjectRetention"
	PutObjectRetentionAction                 Action = "s3:PutObjectRetention"
	BypassGovernanceRetentionAction          Action = "s3:BypassGovernanceRetention"
	PutBucketOwnershipControlsAction         Action = "s3:PutBucketOwnershipControls"
	GetBucketOwnershipControlsAction         Action = "s3:GetBucketOwnershipControls"
	PutBucketCorsAction                      Action = "s3:PutBucketCORS"
	GetBucketCorsAction                      Action = "s3:GetBucketCORS"
	PutAnalyticsConfigurationAction          Action = "s3:PutAnalyticsConfiguration"
	GetAnalyticsConfigurationAction          Action = "s3:GetAnalyticsConfiguration"
	PutEncryptionConfigurationAction         Action = "s3:PutEncryptionConfiguration"
	GetEncryptionConfigurationAction         Action = "s3:GetEncryptionConfiguration"
	PutIntelligentTieringConfigurationAction Action = "s3:PutIntelligentTieringConfiguration"
	GetIntelligentTieringConfigurationAction Action = "s3:GetIntelligentTieringConfiguration"
	PutInventoryConfigurationAction          Action = "s3:PutInventoryConfiguration"
	GetInventoryConfigurationAction          Action = "s3:GetInventoryConfiguration"
	PutLifecycleConfigurationAction          Action = "s3:PutLifecycleConfiguration"
	GetLifecycleConfigurationAction          Action = "s3:GetLifecycleConfiguration"
	PutBucketLoggingAction                   Action = "s3:PutBucketLogging"
	GetBucketLoggingAction                   Action = "s3:GetBucketLogging"
	PutBucketRequestPaymentAction            Action = "s3:PutBucketRequestPayment"
	GetBucketRequestPaymentAction            Action = "s3:GetBucketRequestPayment"
	PutMetricsConfigurationAction            Action = "s3:PutMetricsConfiguration"
	GetMetricsConfigurationAction            Action = "s3:GetMetricsConfiguration"
	PutReplicationConfigurationAction        Action = "s3:PutReplicationConfiguration"
	GetReplicationConfigurationAction        Action = "s3:GetReplicationConfiguration"
	PutBucketPublicAccessBlockAction         Action = "s3:PutBucketPublicAccessBlock"
	GetBucketPublicAccessBlockAction         Action = "s3:GetBucketPublicAccessBlock"
	PutBucketNotificationAction              Action = "s3:PutBucketNotification"
	GetBucketNotificationAction              Action = "s3:GetBucketNotification"
	PutAccelerateConfigurationAction         Action = "s3:PutAccelerateConfiguration"
	GetAccelerateConfigurationAction         Action = "s3:GetAccelerateConfiguration"
	PutBucketWebsiteAction                   Action = "s3:PutBucketWebsite"
	GetBucketWebsiteAction                   Action = "s3:GetBucketWebsite"
	GetBucketPolicyStatusAction              Action = "s3:GetBucketPolicyStatus"
	GetBucketLocationAction                  Action = "s3:GetBucketLocation"

	AllActions Action = "s3:*"
)

func (Action) IsObjectAction 

func (a Action) IsObjectAction() *bool

Checks if the action is object action nil points to 's3:*'

func (Action) IsValid 

func (a Action) IsValid() error

Validates Action: it should either wildcard match with supported actions list or be in it

func (Action) Match added in v1.0.18 

func (a Action) Match(pattern Action) bool

Match wildcard matches the given pattern to the action

func (Action) String added in v1.0.18 

func (a Action) String() string

String converts the action to string

type Actions 

type Actions map[Action]struct{}

func (Actions) Add 

func (a Actions) Add(str string) error

Validates and adds a new Action to Actions map

func (Actions) FindMatch 

func (a Actions) FindMatch(action Action) bool

FindMatch tries to match the given action to the actions list

func (*Actions) UnmarshalJSON 

func (a *Actions) UnmarshalJSON(data []byte) error

Override UnmarshalJSON method to decode both []string and string properties

type Base64Encoded added in v1.0.10 

type Base64Encoded []byte

e.g. 

"value": "aGVsbG93b3JsZAo="

func (*Base64Encoded) UnmarshalJSON added in v1.0.10 

func (b *Base64Encoded) UnmarshalJSON(data []byte) error

type Base64EncodedWrapped added in v1.0.10 

type Base64EncodedWrapped []byte

e.g. 

"value" {
	"__base64__": "aGVsbG93b3JsZAo="
 }

func (*Base64EncodedWrapped) MarshalJSON added in v1.0.10 

func (b *Base64EncodedWrapped) MarshalJSON() ([]byte, error)

func (*Base64EncodedWrapped) UnmarshalJSON added in v1.0.10 

func (b *Base64EncodedWrapped) UnmarshalJSON(data []byte) error

type BucketLockConfig 

type BucketLockConfig struct {
	Enabled          bool
	DefaultRetention *types.DefaultRetention
	CreatedAt        *time.Time
}

type BucketPolicy 

type BucketPolicy struct {
	Version   PolicyVersion      `json:"Version"`
	Statement []BucketPolicyItem `json:"Statement"`
}

func ParsePolicyDocument added in v1.0.17 

func ParsePolicyDocument(data []byte) (*BucketPolicy, error)

ParsePolicyDocument parses raw bytes to 'BucketPolicy'

func (*BucketPolicy) IsPublic added in v1.0.17 

func (bp *BucketPolicy) IsPublic() bool

IsPublic checks if one of bucket policy statments grant public access to ALL users

func (*BucketPolicy) UnmarshalJSON added in v1.0.13 

func (bp *BucketPolicy) UnmarshalJSON(data []byte) error

func (*BucketPolicy) Validate 

func (bp *BucketPolicy) Validate(bucket string, iam IAMService) error

type BucketPolicyAccessType 

type BucketPolicyAccessType string
const (
	BucketPolicyAccessTypeDeny  BucketPolicyAccessType = "Deny"
	BucketPolicyAccessTypeAllow BucketPolicyAccessType = "Allow"
)

func (BucketPolicyAccessType) Validate 

func (bpat BucketPolicyAccessType) Validate() error

Checks policy statement Effect to be valid ("Deny", "Allow")

type BucketPolicyItem 

type BucketPolicyItem struct {
	Effect     BucketPolicyAccessType `json:"Effect"`
	Principals Principals             `json:"Principal"`
	Actions    Actions                `json:"Action"`
	Resources  Resources              `json:"Resource"`
}

func (*BucketPolicyItem) Validate 

func (bpi *BucketPolicyItem) Validate(bucket string, iam IAMService) error

type CORSAllowanceConfig added in v1.0.17 

type CORSAllowanceConfig struct {
	Origin           string
	Methods          string
	ExposedHeaders   string
	AllowCredentials string
	AllowHeaders     string
	MaxAge           *int32
}

type CORSConfiguration added in v1.0.17 

type CORSConfiguration struct {
	Rules []CORSRule `xml:"CORSRule"`
}

func ParseCORSOutput added in v1.0.17 

func ParseCORSOutput(data []byte) (*CORSConfiguration, error)

ParseCORSOutput parses raw bytes to 'CORSConfiguration'

func (*CORSConfiguration) IsAllowed added in v1.0.17 

func (cc *CORSConfiguration) IsAllowed(origin string, method CORSHTTPMethod, headers []CORSHeader) (*CORSAllowanceConfig, error)

IsAllowed walks through the CORS rules and finds the first one allowing access. If no rule grants access, returns 'AccessForbidden'

func (*CORSConfiguration) Validate added in v1.0.17 

func (cc *CORSConfiguration) Validate() error

Validate validates the cors configuration rules

type CORSHTTPMethod added in v1.0.17 

type CORSHTTPMethod string

func (CORSHTTPMethod) IsEmpty added in v1.0.17 

func (cm CORSHTTPMethod) IsEmpty() bool

IsEmpty checks if the cors method is an empty string

func (CORSHTTPMethod) IsValid added in v1.0.17 

func (cm CORSHTTPMethod) IsValid() bool

IsValid validates the cors http request method: the methods are case sensitive

func (CORSHTTPMethod) String added in v1.0.17 

func (cm CORSHTTPMethod) String() string

String converts the method value to 'string'

type CORSHeader added in v1.0.17 

type CORSHeader string

func ParseCORSHeaders added in v1.0.17 

func ParseCORSHeaders(headers string) ([]CORSHeader, error)

ParseCORSHeaders parses/validates Access-Control-Request-Headers and returns []CORSHeaders

func (CORSHeader) IsValid added in v1.0.17 

func (ch CORSHeader) IsValid() bool

IsValid validates the CORS http header the rules are based on http RFC https://datatracker.ietf.org/doc/html/rfc7230#section-3.2

Empty values are considered as valid

func (CORSHeader) String added in v1.0.17 

func (ch CORSHeader) String() string

String converts the header value to 'string'

func (CORSHeader) ToLower added in v1.0.17 

func (ch CORSHeader) ToLower() string

ToLower converts the header to lower case

type CORSRule added in v1.0.17 

type CORSRule struct {
	AllowedMethods []CORSHTTPMethod `xml:"AllowedMethod"`
	AllowedHeaders []CORSHeader     `xml:"AllowedHeader"`
	ExposeHeaders  []CORSHeader     `xml:"ExposeHeader"`
	AllowedOrigins []string         `xml:"AllowedOrigin"`
	ID             *string
	MaxAgeSeconds  *int32
}

func (*CORSRule) GetAllowedMethods added in v1.0.17 

func (cr *CORSRule) GetAllowedMethods() string

GetAllowedMethods returns comma separated CORS allowed methods

func (*CORSRule) GetExposeHeaders added in v1.0.17 

func (cr *CORSRule) GetExposeHeaders() string

GetExposeHeaders returns comma separated CORS expose headers

func (*CORSRule) Match added in v1.0.17 

func (cr *CORSRule) Match(origin string, method CORSHTTPMethod, headers []CORSHeader) (bool, bool)

Match matches the provided origin, method and headers with the CORS configuration rule if the matching origin is "*", it returns true as the first argument

func (*CORSRule) Validate added in v1.0.17 

func (cr *CORSRule) Validate() error

Validate validates and returns error if CORS configuration has invalid rule

type GetBucketAclOutput 

type GetBucketAclOutput struct {
	XMLName           xml.Name `xml:"http://s3.amazonaws.com/doc/2006-03-01/ AccessControlPolicy"`
	Owner             *types.Owner
	AccessControlList AccessControlList
}

func ParseACLOutput 

func ParseACLOutput(data []byte, owner string) (GetBucketAclOutput, error)

type Grant added in v1.0.4 

type Grant struct {
	Grantee    *Grt       `xml:"Grantee"`
	Permission Permission `xml:"Permission"`
}

type Grantee 

type Grantee struct {
	Permission Permission
	Access     string
	Type       types.Type
}

type Grt added in v1.0.4 

type Grt struct {
	XMLNS string     `xml:"xmlns:xsi,attr"`
	Type  types.Type `xml:"xsi:type,attr"`
	ID    string     `xml:"ID"`
}

func (*Grt) UnmarshalXML added in v1.0.10 

func (g *Grt) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error

Custom Unmarshalling for Grt to parse xsi:type properly

type IAMCache 

type IAMCache struct {
	// contains filtered or unexported fields
}

IAMCache is an in memory cache of the IAM accounts with expiration. This helps to alleviate the load on the real IAM service if the gateway is handling many requests. This forwards account updates to the underlying service, and returns cached results while the in memory account is not expired.

func NewCache 

func NewCache(service IAMService, expireTime, cleanupInterval time.Duration) *IAMCache

NewCache initializes an IAM cache for the provided service. The expireTime is the duration a cache entry can be valid, and the cleanupInterval is how often to scan cache and cleanup expired entries.

func (*IAMCache) CreateAccount 

func (c *IAMCache) CreateAccount(account Account) error

CreateAccount send create to IAM service and creates an account cache entry

func (*IAMCache) DeleteUserAccount 

func (c *IAMCache) DeleteUserAccount(access string) error

DeleteUserAccount deletes account from IAM service and cache

func (*IAMCache) GetUserAccount 

func (c *IAMCache) GetUserAccount(access string) (Account, error)

GetUserAccount retrieves the cache account if it is in the cache and not expired. Otherwise retrieves from underlying IAM service and caches result for the expire duration.

func (*IAMCache) ListUserAccounts 

func (c *IAMCache) ListUserAccounts() ([]Account, error)

ListUserAccounts is a passthrough to the underlying service and does not make use of the cache

func (*IAMCache) Shutdown 

func (c *IAMCache) Shutdown() error

Shutdown graceful termination of service

func (*IAMCache) UpdateUserAccount added in v1.0.2 

func (c *IAMCache) UpdateUserAccount(access string, props MutableProps) error

type IAMService 

type IAMService interface {
	CreateAccount(account Account) error
	GetUserAccount(access string) (Account, error)
	UpdateUserAccount(access string, props MutableProps) error
	DeleteUserAccount(access string) error
	ListUserAccounts() ([]Account, error)
	Shutdown() error
}

IAMService is the interface for all IAM service implementations

func New 

func New(o *Opts) (IAMService, error)

func NewIAMServiceSingle added in v1.0.13 

func NewIAMServiceSingle(r Account) IAMService

func NewLDAPService 

func NewLDAPService(rootAcc Account, ldapURL, bindDN, pass, queryBase, accAtr, secAtr, roleAtr, userIdAtr, groupIdAtr, projectIdAtr, objClasses string, tlsSkipVerify bool) (IAMService, error)

func NewVaultIAMService 

func NewVaultIAMService(rootAcc Account, endpoint, namespace, secretStoragePath, secretStorageNamespace,
	authMethod, authNamespace, mountPath, rootToken, roleID, roleSecret, serverCert,
	clientCert, clientCertKey string) (IAMService, error)

type IAMServiceInternal 

type IAMServiceInternal struct {
	// This mutex will help with racing updates to the IAM data
	// from multiple requests to this gateway instance, but
	// will not help with racing updates to multiple load balanced
	// gateway instances. This is a limitation of the internal
	// IAM service. All account updates should be sent to a single
	// gateway instance if possible.
	sync.RWMutex
	// contains filtered or unexported fields
}

IAMServiceInternal manages the internal IAM service

func NewInternal 

func NewInternal(rootAcc Account, dir string) (*IAMServiceInternal, error)

NewInternal creates a new instance for the Internal IAM service

func (*IAMServiceInternal) CreateAccount 

func (s *IAMServiceInternal) CreateAccount(account Account) error

CreateAccount creates a new IAM account. Returns an error if the account already exists.

func (*IAMServiceInternal) DeleteUserAccount 

func (s *IAMServiceInternal) DeleteUserAccount(access string) error

DeleteUserAccount deletes the specified user account. Does not check if account exists.

func (*IAMServiceInternal) GetUserAccount 

func (s *IAMServiceInternal) GetUserAccount(access string) (Account, error)

GetUserAccount retrieves account info for the requested user. Returns ErrNoSuchUser if the account does not exist.

func (*IAMServiceInternal) ListUserAccounts 

func (s *IAMServiceInternal) ListUserAccounts() ([]Account, error)

ListUserAccounts lists all the user accounts stored.

func (*IAMServiceInternal) Shutdown 

func (s *IAMServiceInternal) Shutdown() error

Shutdown graceful termination of service

func (*IAMServiceInternal) UpdateUserAccount added in v1.0.2 

func (s *IAMServiceInternal) UpdateUserAccount(access string, props MutableProps) error

UpdateUserAccount updates the specified user account fields. Returns ErrNoSuchUser if the account does not exist.

type IAMServiceS3 

type IAMServiceS3 struct {
	// This mutex will help with racing updates to the IAM data
	// from multiple requests to this gateway instance, but
	// will not help with racing updates to multiple load balanced
	// gateway instances. This is a limitation of the internal
	// IAM service. All account updates should be sent to a single
	// gateway instance if possible.
	sync.RWMutex
	// contains filtered or unexported fields
}

func NewS3 

func NewS3(rootAcc Account, access, secret, region, bucket, endpoint string, sslSkipVerify bool) (*IAMServiceS3, error)

func (*IAMServiceS3) CreateAccount 

func (s *IAMServiceS3) CreateAccount(account Account) error

func (*IAMServiceS3) DeleteUserAccount 

func (s *IAMServiceS3) DeleteUserAccount(access string) error

func (*IAMServiceS3) GetUserAccount 

func (s *IAMServiceS3) GetUserAccount(access string) (Account, error)

func (*IAMServiceS3) ListUserAccounts 

func (s *IAMServiceS3) ListUserAccounts() ([]Account, error)

func (*IAMServiceS3) Shutdown 

func (s *IAMServiceS3) Shutdown() error

func (*IAMServiceS3) UpdateUserAccount added in v1.0.2 

func (s *IAMServiceS3) UpdateUserAccount(access string, props MutableProps) error

type IAMServiceSingle 

type IAMServiceSingle struct {
	// contains filtered or unexported fields
}

IAMServiceSingle manages the single tenant (root-only) IAM service

func (IAMServiceSingle) CreateAccount 

func (IAMServiceSingle) CreateAccount(account Account) error

CreateAccount not valid in single tenant mode

func (IAMServiceSingle) DeleteUserAccount 

func (IAMServiceSingle) DeleteUserAccount(access string) error

DeleteUserAccount no accounts in single tenant mode

func (IAMServiceSingle) GetUserAccount 

func (s IAMServiceSingle) GetUserAccount(access string) (Account, error)

GetUserAccount returns root account, if the root access key is provided and "ErrAdminUserNotFound" otherwise

func (IAMServiceSingle) ListUserAccounts 

func (IAMServiceSingle) ListUserAccounts() ([]Account, error)

ListUserAccounts no accounts in single tenant mode

func (IAMServiceSingle) Shutdown 

func (IAMServiceSingle) Shutdown() error

Shutdown graceful termination of service

func (IAMServiceSingle) UpdateUserAccount added in v1.0.2 

func (IAMServiceSingle) UpdateUserAccount(access string, props MutableProps) error

UpdateUserAccount no accounts in single tenant mode

type IpaIAMService added in v1.0.10 

type IpaIAMService struct {
	// contains filtered or unexported fields
}

func NewIpaIAMService added in v1.0.10 

func NewIpaIAMService(rootAcc Account, host, vaultName, username, password string, isInsecure bool) (*IpaIAMService, error)

func (*IpaIAMService) CreateAccount added in v1.0.10 

func (ipa *IpaIAMService) CreateAccount(account Account) error

func (*IpaIAMService) DeleteUserAccount added in v1.0.10 

func (ipa *IpaIAMService) DeleteUserAccount(access string) error

func (*IpaIAMService) GetUserAccount added in v1.0.10 

func (ipa *IpaIAMService) GetUserAccount(access string) (Account, error)

func (*IpaIAMService) ListUserAccounts added in v1.0.10 

func (ipa *IpaIAMService) ListUserAccounts() ([]Account, error)

func (*IpaIAMService) Shutdown added in v1.0.10 

func (ipa *IpaIAMService) Shutdown() error

func (*IpaIAMService) UpdateUserAccount added in v1.0.10 

func (ipa *IpaIAMService) UpdateUserAccount(access string, props MutableProps) error

type LdapIAMService 

type LdapIAMService struct {
	// contains filtered or unexported fields
}

func (*LdapIAMService) CreateAccount 

func (ld *LdapIAMService) CreateAccount(account Account) error

func (*LdapIAMService) DeleteUserAccount 

func (ld *LdapIAMService) DeleteUserAccount(access string) error

func (*LdapIAMService) GetUserAccount 

func (ld *LdapIAMService) GetUserAccount(access string) (Account, error)

func (*LdapIAMService) ListUserAccounts 

func (ld *LdapIAMService) ListUserAccounts() ([]Account, error)

func (*LdapIAMService) Shutdown 

func (ld *LdapIAMService) Shutdown() error

Shutdown graceful termination of service

func (*LdapIAMService) UpdateUserAccount added in v1.0.2 

func (ld *LdapIAMService) UpdateUserAccount(access string, props MutableProps) error

type ListUserAccountsResult added in v1.0.8 

type ListUserAccountsResult struct {
	Accounts []Account
}

type MutableProps added in v1.0.2 

type MutableProps struct {
	Secret    *string `json:"secret"`
	Role      Role    `json:"role"`
	UserID    *int    `json:"userID"`
	GroupID   *int    `json:"groupID"`
	ProjectID *int    `json:"projectID"`
}

Mutable props, which could be changed when updating an IAM account

func (MutableProps) Validate added in v1.0.14 

func (m MutableProps) Validate() error

type Opts 

type Opts struct {
	RootAccount                 Account
	Dir                         string
	LDAPServerURL               string
	LDAPBindDN                  string
	LDAPPassword                string
	LDAPQueryBase               string
	LDAPObjClasses              string
	LDAPAccessAtr               string
	LDAPSecretAtr               string
	LDAPRoleAtr                 string
	LDAPUserIdAtr               string
	LDAPGroupIdAtr              string
	LDAPProjectIdAtr            string
	LDAPTLSSkipVerify           bool
	VaultEndpointURL            string
	VaultNamespace              string
	VaultSecretStoragePath      string
	VaultSecretStorageNamespace string
	VaultAuthMethod             string
	VaultAuthNamespace          string
	VaultMountPath              string
	VaultRootToken              string
	VaultRoleId                 string
	VaultRoleSecret             string
	VaultServerCert             string
	VaultClientCert             string
	VaultClientCertKey          string
	S3Access                    string
	S3Secret                    string
	S3Region                    string
	S3Bucket                    string
	S3Endpoint                  string
	S3DisableSSlVerfiy          bool
	CacheDisable                bool
	CacheTTL                    int
	CachePrune                  int
	IpaHost                     string
	IpaVaultName                string
	IpaUser                     string
	IpaPassword                 string
	IpaInsecure                 bool
}

type Permission added in v1.0.10 

type Permission string
const (
	PermissionFullControl Permission = "FULL_CONTROL"
	PermissionWrite       Permission = "WRITE"
	PermissionWriteAcp    Permission = "WRITE_ACP"
	PermissionRead        Permission = "READ"
	PermissionReadAcp     Permission = "READ_ACP"
)

type PolicyVersion added in v1.0.19 

type PolicyVersion string
const (
	PolicyVersion2008 PolicyVersion = "2008-10-17"
	PolicyVersion2012 PolicyVersion = "2012-10-17"
)

type Principals 

type Principals map[string]struct{}

func (Principals) Add 

func (p Principals) Add(key string)

func (Principals) Contains 

func (p Principals) Contains(userAccess string) bool

func (Principals) ToSlice 

func (p Principals) ToSlice() []string

Converts Principals map to a slice, by omitting "*"

func (*Principals) UnmarshalJSON 

func (p *Principals) UnmarshalJSON(data []byte) error

Override UnmarshalJSON method to decode both []string and string properties

func (Principals) Validate 

func (p Principals) Validate(iam IAMService) error

Validates Principals by checking user account access keys existence

type PublicACLAllowedActions added in v1.0.15 

type PublicACLAllowedActions map[Action]struct{}

type PutBucketAclInput added in v1.0.4 

type PutBucketAclInput struct {
	Bucket              *string
	ACL                 types.BucketCannedACL
	AccessControlPolicy *AccessControlPolicy
	GrantFullControl    *string
	GrantRead           *string
	GrantReadACP        *string
	GrantWrite          *string
	GrantWriteACP       *string
}

type Resources 

type Resources map[string]struct{}

func (Resources) Add 

func (r Resources) Add(rc string) error

Adds and validates a new resource to Resources map

func (Resources) ContainsBucketPattern 

func (r Resources) ContainsBucketPattern() bool

Checks if the resources contain bucket pattern

func (Resources) ContainsObjectPattern 

func (r Resources) ContainsObjectPattern() bool

Checks if the resources contain object pattern

func (Resources) FindMatch 

func (r Resources) FindMatch(resource string) bool

func (Resources) Match added in v1.0.11 

func (r Resources) Match(pattern, input string) bool

Match matches the given input resource with the pattern

func (*Resources) UnmarshalJSON 

func (r *Resources) UnmarshalJSON(data []byte) error

Override UnmarshalJSON method to decode both []string and string properties

func (Resources) Validate 

func (r Resources) Validate(bucket string) error

Bucket resources should start with bucket name: arn:aws:s3:::MyBucket/*

type Role 

type Role string
const (
	RoleUser     Role = "user"
	RoleAdmin    Role = "admin"
	RoleUserPlus Role = "userplus"
)

func (Role) IsValid added in v1.0.8 

func (r Role) IsValid() bool

type UpdateAcctFunc 

type UpdateAcctFunc func([]byte) ([]byte, error)

UpdateAcctFunc accepts the current data and returns the new data to be stored

type VaultIAMNamespace added in v1.0.19 

type VaultIAMNamespace struct {
	Auth          string
	SecretStorage string
}

type VaultIAMService 

type VaultIAMService struct {
	// contains filtered or unexported fields
}

func (*VaultIAMService) CreateAccount 

func (vt *VaultIAMService) CreateAccount(account Account) error

func (*VaultIAMService) DeleteUserAccount 

func (vt *VaultIAMService) DeleteUserAccount(access string) error

func (*VaultIAMService) GetUserAccount 

func (vt *VaultIAMService) GetUserAccount(access string) (Account, error)

func (*VaultIAMService) ListUserAccounts 

func (vt *VaultIAMService) ListUserAccounts() ([]Account, error)

func (*VaultIAMService) Shutdown 

func (vt *VaultIAMService) Shutdown() error

the client doesn't have explicit shutdown, as it uses http.Client

func (*VaultIAMService) UpdateUserAccount added in v1.0.2 

func (vt *VaultIAMService) UpdateUserAccount(access string, props MutableProps) error

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.