mirror of
https://github.com/kanidm/kanidm.git
synced 2025-05-28 11:53:55 +02:00
Compare commits
4 commits
5bb3e37c5f
...
8c8858d5d2
| Author | SHA1 | Date | |
|---|---|---|---|
|
8c8858d5d2 | ||
|
1a39c5f5a2 | ||
|
|
5a6f4fdb22 | ||
|
8fa42384ae |
Cargo.lockCargo.toml
libs/client/src
proto/src
pykanidm
server
unix_integration/nss_kanidm
36
Cargo.lock
generated
36
Cargo.lock
generated
|
|
@ -652,9 +652,9 @@ checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
|
|||
|
||||
[[package]]
|
||||
name = "cc"
|
||||
version = "1.2.21"
|
||||
version = "1.2.22"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "8691782945451c1c383942c4874dbe63814f61cb57ef773cda2972682b7bb3c0"
|
||||
checksum = "32db95edf998450acc7881c932f94cd9b05c87b4b2599e8bab064753da4acfd1"
|
||||
dependencies = [
|
||||
"shlex",
|
||||
]
|
||||
|
|
@ -708,9 +708,9 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "clap"
|
||||
version = "4.5.37"
|
||||
version = "4.5.38"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "eccb054f56cbd38340b380d4a8e69ef1f02f1af43db2f0cc817a4774d80ae071"
|
||||
checksum = "ed93b9805f8ba930df42c2590f05453d5ec36cbb85d018868a5b24d31f6ac000"
|
||||
dependencies = [
|
||||
"clap_builder",
|
||||
"clap_derive",
|
||||
|
|
@ -718,9 +718,9 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "clap_builder"
|
||||
version = "4.5.37"
|
||||
version = "4.5.38"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "efd9466fac8543255d3b1fcad4762c5e116ffe808c8a3043d4263cd4fd4862a2"
|
||||
checksum = "379026ff283facf611b0ea629334361c4211d1b12ee01024eec1591133b04120"
|
||||
dependencies = [
|
||||
"anstream",
|
||||
"anstyle",
|
||||
|
|
@ -730,9 +730,9 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "clap_complete"
|
||||
version = "4.5.48"
|
||||
version = "4.5.50"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "be8c97f3a6f02b9e24cadc12aaba75201d18754b53ea0a9d99642f806ccdb4c9"
|
||||
checksum = "c91d3baa3bcd889d60e6ef28874126a0b384fd225ab83aa6d8a801c519194ce1"
|
||||
dependencies = [
|
||||
"clap",
|
||||
]
|
||||
|
|
@ -5133,9 +5133,9 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "rustls"
|
||||
version = "0.23.26"
|
||||
version = "0.23.27"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "df51b5869f3a441595eac5e8ff14d486ff285f7b8c0df8770e49c3b56351f0f0"
|
||||
checksum = "730944ca083c1c233a75c09f199e973ca499344a2b7ba9e755c457e86fb4a321"
|
||||
dependencies = [
|
||||
"once_cell",
|
||||
"ring",
|
||||
|
|
@ -5177,9 +5177,9 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "rustls-webpki"
|
||||
version = "0.103.1"
|
||||
version = "0.103.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "fef8b8769aaccf73098557a87cd1816b4f9c7c16811c9c77142aa695c16f2c03"
|
||||
checksum = "e4a72fe2bcf7a6ac6fd7d0b9e5cb68aeb7d4c0a0271730218b3e92d43b4eb435"
|
||||
dependencies = [
|
||||
"ring",
|
||||
"rustls-pki-types",
|
||||
|
|
@ -5745,9 +5745,9 @@ checksum = "61c41af27dd6d1e27b1b16b489db798443478cef1f06a660c96db617ba5de3b1"
|
|||
|
||||
[[package]]
|
||||
name = "tempfile"
|
||||
version = "3.19.1"
|
||||
version = "3.20.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7437ac7763b9b123ccf33c338a5cc1bac6f69b45a136c19bdd8a65e3916435bf"
|
||||
checksum = "e8a64e3985349f2441a1a9ef0b853f869006c3855f2cda6862a94d26ebb9d6a1"
|
||||
dependencies = [
|
||||
"fastrand",
|
||||
"getrandom 0.3.2",
|
||||
|
|
@ -5911,9 +5911,9 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "tokio"
|
||||
version = "1.44.2"
|
||||
version = "1.45.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "e6b88822cbe49de4185e3a4cbf8321dd487cf5fe0c5c65695fef6346371e9c48"
|
||||
checksum = "2513ca694ef9ede0fb23fe71a4ee4107cb102b9dc1930f6d0fd77aae068ae165"
|
||||
dependencies = [
|
||||
"backtrace",
|
||||
"bytes",
|
||||
|
|
@ -6104,9 +6104,9 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "tower-http"
|
||||
version = "0.6.2"
|
||||
version = "0.6.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "403fa3b783d4b626a8ad51d766ab03cb6d2dbfc46b1c5d4448395e6628dc9697"
|
||||
checksum = "0fdb0c213ca27a9f57ab69ddb290fd80d970922355b83ae380b395d3986b8a2e"
|
||||
dependencies = [
|
||||
"async-compression",
|
||||
"bitflags 2.9.0",
|
||||
|
|
|
|||
10
Cargo.toml
10
Cargo.toml
|
|
@ -166,8 +166,8 @@ base64 = "^0.22.1"
|
|||
base64urlsafedata = "0.5.1"
|
||||
bitflags = "^2.8.0"
|
||||
bytes = "^1.9.0"
|
||||
clap = { version = "4.5.37", features = ["derive", "env"] }
|
||||
clap_complete = "^4.5.42"
|
||||
clap = { version = "4.5.38", features = ["derive", "env"] }
|
||||
clap_complete = "^4.5.50"
|
||||
# Forced by saffron/cron
|
||||
chrono = "^0.4.39"
|
||||
compact_jwt = { version = "^0.4.2", default-features = false }
|
||||
|
|
@ -254,7 +254,7 @@ reqwest = { version = "0.12.12", default-features = false, features = [
|
|||
"rustls-tls-native-roots-no-provider",
|
||||
] }
|
||||
rusqlite = { version = "0.35.0", features = ["array", "bundled"] }
|
||||
rustls = { version = "0.23.26", default-features = false, features = [
|
||||
rustls = { version = "0.23.27", default-features = false, features = [
|
||||
"aws_lc_rs",
|
||||
] }
|
||||
|
||||
|
|
@ -274,11 +274,11 @@ sshkey-attest = "^0.5.0"
|
|||
sshkeys = "0.3.3"
|
||||
svg = "0.18.0"
|
||||
syn = { version = "2.0.100", features = ["full"] }
|
||||
tempfile = "3.15.0"
|
||||
tempfile = "3.20.0"
|
||||
testkit-macros = { path = "./server/testkit-macros" }
|
||||
time = { version = "^0.3.36", features = ["formatting", "local-offset"] }
|
||||
|
||||
tokio = "^1.44.2"
|
||||
tokio = "^1.45.0"
|
||||
tokio-openssl = "^0.6.5"
|
||||
tokio-util = "^0.7.13"
|
||||
|
||||
|
|
|
|||
19
libs/client/src/application.rs
Normal file
19
libs/client/src/application.rs
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
use crate::{ClientError, KanidmClient};
|
||||
use kanidm_proto::scim_v1::client::{ScimEntryApplication, ScimEntryApplicationPost};
|
||||
|
||||
impl KanidmClient {
|
||||
/// Delete an application
|
||||
pub async fn idm_application_delete(&self, id: &str) -> Result<(), ClientError> {
|
||||
self.perform_delete_request(format!("/scim/v1/Application/{}", id).as_str())
|
||||
.await
|
||||
}
|
||||
|
||||
/// Create an application
|
||||
pub async fn idm_application_create(
|
||||
&self,
|
||||
application: &ScimEntryApplicationPost,
|
||||
) -> Result<ScimEntryApplication, ClientError> {
|
||||
self.perform_post_request("/scim/v1/Application", application)
|
||||
.await
|
||||
}
|
||||
}
|
||||
|
|
@ -50,6 +50,7 @@ use webauthn_rs_proto::{
|
|||
PublicKeyCredential, RegisterPublicKeyCredential, RequestChallengeResponse,
|
||||
};
|
||||
|
||||
mod application;
|
||||
mod domain;
|
||||
mod group;
|
||||
mod oauth;
|
||||
|
|
|
|||
|
|
@ -2,12 +2,10 @@ use crate::{ClientError, KanidmClient};
|
|||
use kanidm_proto::scim_v1::{ScimEntryGeneric, ScimEntryGetQuery, ScimSyncRequest, ScimSyncState};
|
||||
|
||||
impl KanidmClient {
|
||||
// TODO: testing for this
|
||||
pub async fn scim_v1_sync_status(&self) -> Result<ScimSyncState, ClientError> {
|
||||
self.perform_get_request("/scim/v1/Sync").await
|
||||
}
|
||||
|
||||
// TODO: testing for this
|
||||
pub async fn scim_v1_sync_update(
|
||||
&self,
|
||||
scim_sync_request: &ScimSyncRequest,
|
||||
|
|
|
|||
|
|
@ -32,6 +32,7 @@ pub enum Attribute {
|
|||
AcpTargetScope,
|
||||
ApiTokenSession,
|
||||
ApplicationPassword,
|
||||
ApplicationUrl,
|
||||
AttestedPasskeys,
|
||||
#[default]
|
||||
Attr,
|
||||
|
|
@ -268,6 +269,7 @@ impl Attribute {
|
|||
Attribute::AcpTargetScope => ATTR_ACP_TARGET_SCOPE,
|
||||
Attribute::ApiTokenSession => ATTR_API_TOKEN_SESSION,
|
||||
Attribute::ApplicationPassword => ATTR_APPLICATION_PASSWORD,
|
||||
Attribute::ApplicationUrl => ATTR_APPLICATION_URL,
|
||||
Attribute::AttestedPasskeys => ATTR_ATTESTED_PASSKEYS,
|
||||
Attribute::Attr => ATTR_ATTR,
|
||||
Attribute::AttributeName => ATTR_ATTRIBUTENAME,
|
||||
|
|
@ -456,6 +458,7 @@ impl Attribute {
|
|||
ATTR_ACP_TARGET_SCOPE => Attribute::AcpTargetScope,
|
||||
ATTR_API_TOKEN_SESSION => Attribute::ApiTokenSession,
|
||||
ATTR_APPLICATION_PASSWORD => Attribute::ApplicationPassword,
|
||||
ATTR_APPLICATION_URL => Attribute::ApplicationUrl,
|
||||
ATTR_ATTESTED_PASSKEYS => Attribute::AttestedPasskeys,
|
||||
ATTR_ATTR => Attribute::Attr,
|
||||
ATTR_ATTRIBUTENAME => Attribute::AttributeName,
|
||||
|
|
|
|||
|
|
@ -72,6 +72,7 @@ pub const ATTR_ACP_SEARCH_ATTR: &str = "acp_search_attr";
|
|||
pub const ATTR_ACP_TARGET_SCOPE: &str = "acp_targetscope";
|
||||
pub const ATTR_API_TOKEN_SESSION: &str = "api_token_session";
|
||||
pub const ATTR_APPLICATION_PASSWORD: &str = "application_password";
|
||||
pub const ATTR_APPLICATION_URL: &str = "application_url";
|
||||
pub const ATTR_ATTESTED_PASSKEYS: &str = "attested_passkeys";
|
||||
pub const ATTR_ATTR: &str = "attr";
|
||||
pub const ATTR_ATTRIBUTENAME: &str = "attributename";
|
||||
|
|
|
|||
|
|
@ -213,6 +213,8 @@ pub enum OperationError {
|
|||
SC0024SshPublicKeySyntaxInvalid,
|
||||
SC0025UiHintSyntaxInvalid,
|
||||
SC0026Utf8SyntaxInvalid,
|
||||
SC0027ClassSetInvalid,
|
||||
SC0028CreatedUuidsInvalid,
|
||||
// Migration
|
||||
MG0001InvalidReMigrationLevel,
|
||||
MG0002RaiseDomainLevelExceedsMaximum,
|
||||
|
|
@ -531,6 +533,8 @@ impl OperationError {
|
|||
Self::SC0024SshPublicKeySyntaxInvalid => Some("A SCIM Ssh Public Key contained invalid syntax".into()),
|
||||
Self::SC0025UiHintSyntaxInvalid => Some("A SCIM UiHint contained invalid syntax".into()),
|
||||
Self::SC0026Utf8SyntaxInvalid => Some("A SCIM Utf8 String Scope Map contained invalid syntax".into()),
|
||||
Self::SC0027ClassSetInvalid => Some("The internal set of class templates used in this create operation was invalid. THIS IS A BUG.".into()),
|
||||
Self::SC0028CreatedUuidsInvalid => Some("The internal create query did not return the set of created UUIDs. THIS IS A BUG".into()),
|
||||
|
||||
Self::UI0001ChallengeSerialisation => Some("The WebAuthn challenge was unable to be serialised.".into()),
|
||||
Self::UI0002InvalidState => Some("The credential update process returned an invalid state transition.".into()),
|
||||
|
|
|
|||
|
|
@ -2,6 +2,7 @@
|
|||
use super::ScimEntryGetQuery;
|
||||
use super::ScimOauth2ClaimMapJoinChar;
|
||||
use crate::attribute::{Attribute, SubAttribute};
|
||||
use scim_proto::ScimEntryHeader;
|
||||
use serde::{Deserialize, Serialize};
|
||||
use serde_json::Value as JsonValue;
|
||||
use serde_with::formats::PreferMany;
|
||||
|
|
@ -31,6 +32,18 @@ pub struct ScimReference {
|
|||
pub value: Option<String>,
|
||||
}
|
||||
|
||||
impl<T> From<T> for ScimReference
|
||||
where
|
||||
T: AsRef<str>,
|
||||
{
|
||||
fn from(value: T) -> Self {
|
||||
ScimReference {
|
||||
uuid: None,
|
||||
value: Some(value.as_ref().to_string()),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
pub type ScimReferences = Vec<ScimReference>;
|
||||
|
||||
#[serde_as]
|
||||
|
|
@ -79,6 +92,31 @@ pub struct ScimOAuth2ScopeMap {
|
|||
pub scopes: BTreeSet<String>,
|
||||
}
|
||||
|
||||
#[serde_as]
|
||||
#[derive(Serialize, Debug, Clone)]
|
||||
#[serde(rename_all = "snake_case")]
|
||||
pub struct ScimEntryApplicationPost {
|
||||
pub name: String,
|
||||
pub displayname: String,
|
||||
pub linked_group: ScimReference,
|
||||
}
|
||||
|
||||
#[serde_as]
|
||||
#[derive(Deserialize, Debug, Clone)]
|
||||
#[serde(rename_all = "snake_case")]
|
||||
pub struct ScimEntryApplication {
|
||||
#[serde(flatten)]
|
||||
pub header: ScimEntryHeader,
|
||||
|
||||
pub name: String,
|
||||
pub displayname: String,
|
||||
|
||||
pub linked_group: Vec<super::ScimReference>,
|
||||
|
||||
#[serde(flatten)]
|
||||
pub attrs: BTreeMap<Attribute, JsonValue>,
|
||||
}
|
||||
|
||||
#[derive(Serialize, Debug, Clone)]
|
||||
pub struct ScimEntryPutKanidm {
|
||||
pub id: Uuid,
|
||||
|
|
@ -90,6 +128,13 @@ pub struct ScimEntryPutKanidm {
|
|||
#[derive(Deserialize, Serialize, Debug, Clone)]
|
||||
pub struct ScimStrings(#[serde_as(as = "OneOrMany<_, PreferMany>")] pub Vec<String>);
|
||||
|
||||
#[derive(Debug, Clone, Deserialize, Default)]
|
||||
pub struct ScimEntryPostGeneric {
|
||||
/// Create an attribute to contain the following value state.
|
||||
#[serde(flatten)]
|
||||
pub attrs: BTreeMap<Attribute, JsonValue>,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Deserialize, Default)]
|
||||
pub struct ScimEntryPutGeneric {
|
||||
// id is only used to target the entry in question
|
||||
|
|
|
|||
|
|
@ -18,13 +18,13 @@
|
|||
|
||||
use crate::attribute::Attribute;
|
||||
use serde::{Deserialize, Serialize};
|
||||
use serde_with::formats::CommaSeparator;
|
||||
use serde_with::{serde_as, skip_serializing_none, StringWithSeparator};
|
||||
use sshkey_attest::proto::PublicKey as SshPublicKey;
|
||||
use std::collections::BTreeMap;
|
||||
use std::ops::Not;
|
||||
use utoipa::ToSchema;
|
||||
|
||||
use serde_with::formats::CommaSeparator;
|
||||
use serde_with::{serde_as, skip_serializing_none, StringWithSeparator};
|
||||
use uuid::Uuid;
|
||||
|
||||
pub use self::synch::*;
|
||||
pub use scim_proto::prelude::*;
|
||||
|
|
@ -86,6 +86,13 @@ pub struct ScimSshPublicKey {
|
|||
pub value: SshPublicKey,
|
||||
}
|
||||
|
||||
#[derive(Deserialize, Serialize, Debug, Clone, PartialEq, Eq, ToSchema)]
|
||||
#[serde(rename_all = "camelCase")]
|
||||
pub struct ScimReference {
|
||||
pub uuid: Uuid,
|
||||
pub value: String,
|
||||
}
|
||||
|
||||
#[derive(Deserialize, Serialize, Debug, Clone, ToSchema)]
|
||||
pub enum ScimOauth2ClaimMapJoinChar {
|
||||
#[serde(rename = ",", alias = "csv")]
|
||||
|
|
|
|||
46
pykanidm/poetry.lock
generated
46
pykanidm/poetry.lock
generated
|
|
@ -1051,14 +1051,14 @@ pyyaml = ">=5.1"
|
|||
|
||||
[[package]]
|
||||
name = "mkdocs-material"
|
||||
version = "9.6.12"
|
||||
version = "9.6.13"
|
||||
description = "Documentation that simply works"
|
||||
optional = false
|
||||
python-versions = ">=3.8"
|
||||
groups = ["dev"]
|
||||
files = [
|
||||
{file = "mkdocs_material-9.6.12-py3-none-any.whl", hash = "sha256:92b4fbdc329e4febc267ca6e2c51e8501fa97b2225c5f4deb4d4e43550f8e61e"},
|
||||
{file = "mkdocs_material-9.6.12.tar.gz", hash = "sha256:add6a6337b29f9ea7912cb1efc661de2c369060b040eb5119855d794ea85b473"},
|
||||
{file = "mkdocs_material-9.6.13-py3-none-any.whl", hash = "sha256:3730730314e065f422cc04eacbc8c6084530de90f4654a1482472283a38e30d3"},
|
||||
{file = "mkdocs_material-9.6.13.tar.gz", hash = "sha256:7bde7ebf33cfd687c1c86c08ed8f6470d9a5ba737bd89e7b3e5d9f94f8c72c16"},
|
||||
]
|
||||
|
||||
[package.dependencies]
|
||||
|
|
@ -2083,30 +2083,30 @@ files = [
|
|||
|
||||
[[package]]
|
||||
name = "ruff"
|
||||
version = "0.11.8"
|
||||
version = "0.11.9"
|
||||
description = "An extremely fast Python linter and code formatter, written in Rust."
|
||||
optional = false
|
||||
python-versions = ">=3.7"
|
||||
groups = ["dev"]
|
||||
files = [
|
||||
{file = "ruff-0.11.8-py3-none-linux_armv6l.whl", hash = "sha256:896a37516c594805e34020c4a7546c8f8a234b679a7716a3f08197f38913e1a3"},
|
||||
{file = "ruff-0.11.8-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:ab86d22d3d721a40dd3ecbb5e86ab03b2e053bc93c700dc68d1c3346b36ce835"},
|
||||
{file = "ruff-0.11.8-py3-none-macosx_11_0_arm64.whl", hash = "sha256:258f3585057508d317610e8a412788cf726efeefa2fec4dba4001d9e6f90d46c"},
|
||||
{file = "ruff-0.11.8-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:727d01702f7c30baed3fc3a34901a640001a2828c793525043c29f7614994a8c"},
|
||||
{file = "ruff-0.11.8-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:3dca977cc4fc8f66e89900fa415ffe4dbc2e969da9d7a54bfca81a128c5ac219"},
|
||||
{file = "ruff-0.11.8-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:c657fa987d60b104d2be8b052d66da0a2a88f9bd1d66b2254333e84ea2720c7f"},
|
||||
{file = "ruff-0.11.8-py3-none-manylinux_2_17_ppc64.manylinux2014_ppc64.whl", hash = "sha256:f2e74b021d0de5eceb8bd32919f6ff8a9b40ee62ed97becd44993ae5b9949474"},
|
||||
{file = "ruff-0.11.8-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:f9b5ef39820abc0f2c62111f7045009e46b275f5b99d5e59dda113c39b7f4f38"},
|
||||
{file = "ruff-0.11.8-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:c1dba3135ca503727aa4648152c0fa67c3b1385d3dc81c75cd8a229c4b2a1458"},
|
||||
{file = "ruff-0.11.8-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:7f024d32e62faad0f76b2d6afd141b8c171515e4fb91ce9fd6464335c81244e5"},
|
||||
{file = "ruff-0.11.8-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:d365618d3ad747432e1ae50d61775b78c055fee5936d77fb4d92c6f559741948"},
|
||||
{file = "ruff-0.11.8-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:4d9aaa91035bdf612c8ee7266153bcf16005c7c7e2f5878406911c92a31633cb"},
|
||||
{file = "ruff-0.11.8-py3-none-musllinux_1_2_i686.whl", hash = "sha256:0eba551324733efc76116d9f3a0d52946bc2751f0cd30661564117d6fd60897c"},
|
||||
{file = "ruff-0.11.8-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:161eb4cff5cfefdb6c9b8b3671d09f7def2f960cee33481dd898caf2bcd02304"},
|
||||
{file = "ruff-0.11.8-py3-none-win32.whl", hash = "sha256:5b18caa297a786465cc511d7f8be19226acf9c0a1127e06e736cd4e1878c3ea2"},
|
||||
{file = "ruff-0.11.8-py3-none-win_amd64.whl", hash = "sha256:6e70d11043bef637c5617297bdedec9632af15d53ac1e1ba29c448da9341b0c4"},
|
||||
{file = "ruff-0.11.8-py3-none-win_arm64.whl", hash = "sha256:304432e4c4a792e3da85b7699feb3426a0908ab98bf29df22a31b0cdd098fac2"},
|
||||
{file = "ruff-0.11.8.tar.gz", hash = "sha256:6d742d10626f9004b781f4558154bb226620a7242080e11caeffab1a40e99df8"},
|
||||
{file = "ruff-0.11.9-py3-none-linux_armv6l.whl", hash = "sha256:a31a1d143a5e6f499d1fb480f8e1e780b4dfdd580f86e05e87b835d22c5c6f8c"},
|
||||
{file = "ruff-0.11.9-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:66bc18ca783b97186a1f3100e91e492615767ae0a3be584e1266aa9051990722"},
|
||||
{file = "ruff-0.11.9-py3-none-macosx_11_0_arm64.whl", hash = "sha256:bd576cd06962825de8aece49f28707662ada6a1ff2db848d1348e12c580acbf1"},
|
||||
{file = "ruff-0.11.9-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:5b1d18b4be8182cc6fddf859ce432cc9631556e9f371ada52f3eaefc10d878de"},
|
||||
{file = "ruff-0.11.9-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:0f3f46f759ac623e94824b1e5a687a0df5cd7f5b00718ff9c24f0a894a683be7"},
|
||||
{file = "ruff-0.11.9-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:f34847eea11932d97b521450cf3e1d17863cfa5a94f21a056b93fb86f3f3dba2"},
|
||||
{file = "ruff-0.11.9-py3-none-manylinux_2_17_ppc64.manylinux2014_ppc64.whl", hash = "sha256:f33b15e00435773df97cddcd263578aa83af996b913721d86f47f4e0ee0ff271"},
|
||||
{file = "ruff-0.11.9-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:7b27613a683b086f2aca8996f63cb3dd7bc49e6eccf590563221f7b43ded3f65"},
|
||||
{file = "ruff-0.11.9-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:9e0d88756e63e8302e630cee3ce2ffb77859797cc84a830a24473939e6da3ca6"},
|
||||
{file = "ruff-0.11.9-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:537c82c9829d7811e3aa680205f94c81a2958a122ac391c0eb60336ace741a70"},
|
||||
{file = "ruff-0.11.9-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:440ac6a7029f3dee7d46ab7de6f54b19e34c2b090bb4f2480d0a2d635228f381"},
|
||||
{file = "ruff-0.11.9-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:71c539bac63d0788a30227ed4d43b81353c89437d355fdc52e0cda4ce5651787"},
|
||||
{file = "ruff-0.11.9-py3-none-musllinux_1_2_i686.whl", hash = "sha256:c67117bc82457e4501473c5f5217d49d9222a360794bfb63968e09e70f340abd"},
|
||||
{file = "ruff-0.11.9-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:e4b78454f97aa454586e8a5557facb40d683e74246c97372af3c2d76901d697b"},
|
||||
{file = "ruff-0.11.9-py3-none-win32.whl", hash = "sha256:7fe1bc950e7d7b42caaee2a8a3bc27410547cc032c9558ee2e0f6d3b209e845a"},
|
||||
{file = "ruff-0.11.9-py3-none-win_amd64.whl", hash = "sha256:52edaa4a6d70f8180343a5b7f030c7edd36ad180c9f4d224959c2d689962d964"},
|
||||
{file = "ruff-0.11.9-py3-none-win_arm64.whl", hash = "sha256:bcf42689c22f2e240f496d0c183ef2c6f7b35e809f12c1db58f75d9aa8d630ca"},
|
||||
{file = "ruff-0.11.9.tar.gz", hash = "sha256:ebd58d4f67a00afb3a30bf7d383e52d0e036e6195143c6db7019604a05335517"},
|
||||
]
|
||||
|
||||
[[package]]
|
||||
|
|
@ -2406,4 +2406,4 @@ type = ["pytest-mypy"]
|
|||
[metadata]
|
||||
lock-version = "2.1"
|
||||
python-versions = "^3.9"
|
||||
content-hash = "270e31ed5f90704d65cb517ec04f2eb537522f3ee6211f4524a422bb029e0bf5"
|
||||
content-hash = "c5cebc391ff22aa895c2e501029f5984c00d7e182f7908154567a579657824be"
|
||||
|
|
|
|||
|
|
@ -29,7 +29,7 @@ Authlib = "^1.2.0"
|
|||
|
||||
|
||||
[tool.poetry.group.dev.dependencies]
|
||||
ruff = ">=0.5.1,<0.11.9"
|
||||
ruff = ">=0.5.1,<0.11.10"
|
||||
pytest = "^8.3.4"
|
||||
mypy = "^1.14.1"
|
||||
types-requests = "^2.32.0.20241016"
|
||||
|
|
|
|||
|
|
@ -60,7 +60,7 @@ tokio-openssl = { workspace = true }
|
|||
tokio-util = { workspace = true, features = ["codec"] }
|
||||
toml = { workspace = true }
|
||||
tower = { version = "0.5.2", features = ["tokio-stream", "tracing"] }
|
||||
tower-http = { version = "0.6.2", features = [
|
||||
tower-http = { version = "0.6.4", features = [
|
||||
"compression-gzip",
|
||||
"fs",
|
||||
"tokio",
|
||||
|
|
|
|||
|
|
@ -1,10 +1,14 @@
|
|||
use super::{QueryServerReadV1, QueryServerWriteV1};
|
||||
use kanidm_proto::scim_v1::{
|
||||
client::ScimFilter, server::ScimEntryKanidm, ScimEntryGetQuery, ScimSyncRequest, ScimSyncState,
|
||||
client::ScimEntryPostGeneric, client::ScimFilter, server::ScimEntryKanidm, ScimEntryGetQuery,
|
||||
ScimSyncRequest, ScimSyncState,
|
||||
};
|
||||
use kanidmd_lib::idm::scim::{
|
||||
GenerateScimSyncTokenEvent, ScimSyncFinaliseEvent, ScimSyncTerminateEvent, ScimSyncUpdateEvent,
|
||||
};
|
||||
|
||||
use kanidmd_lib::server::scim::{ScimCreateEvent, ScimDeleteEvent};
|
||||
|
||||
use kanidmd_lib::idm::server::IdmServerTransaction;
|
||||
use kanidmd_lib::prelude::*;
|
||||
|
||||
|
|
@ -176,6 +180,73 @@ impl QueryServerWriteV1 {
|
|||
.scim_sync_apply(&sse, &changes, ct)
|
||||
.and_then(|r| idms_prox_write.commit().map(|_| r))
|
||||
}
|
||||
|
||||
#[instrument(
|
||||
level = "info",
|
||||
skip_all,
|
||||
fields(uuid = ?eventid)
|
||||
)]
|
||||
pub async fn scim_entry_create(
|
||||
&self,
|
||||
client_auth_info: ClientAuthInfo,
|
||||
eventid: Uuid,
|
||||
classes: &[EntryClass],
|
||||
entry: ScimEntryPostGeneric,
|
||||
) -> Result<ScimEntryKanidm, OperationError> {
|
||||
let ct = duration_from_epoch_now();
|
||||
let mut idms_prox_write = self.idms.proxy_write(ct).await?;
|
||||
let ident = idms_prox_write
|
||||
.validate_client_auth_info_to_ident(client_auth_info, ct)
|
||||
.map_err(|e| {
|
||||
admin_error!(err = ?e, "Invalid identity");
|
||||
e
|
||||
})?;
|
||||
|
||||
let scim_create_event =
|
||||
ScimCreateEvent::try_from(ident, classes, entry, &mut idms_prox_write.qs_write)?;
|
||||
|
||||
idms_prox_write
|
||||
.qs_write
|
||||
.scim_create(scim_create_event)
|
||||
.and_then(|r| idms_prox_write.commit().map(|_| r))
|
||||
}
|
||||
|
||||
#[instrument(
|
||||
level = "info",
|
||||
skip_all,
|
||||
fields(uuid = ?eventid)
|
||||
)]
|
||||
pub async fn scim_entry_id_delete(
|
||||
&self,
|
||||
client_auth_info: ClientAuthInfo,
|
||||
eventid: Uuid,
|
||||
uuid_or_name: String,
|
||||
class: EntryClass,
|
||||
) -> Result<(), OperationError> {
|
||||
let ct = duration_from_epoch_now();
|
||||
let mut idms_prox_write = self.idms.proxy_write(ct).await?;
|
||||
let ident = idms_prox_write
|
||||
.validate_client_auth_info_to_ident(client_auth_info, ct)
|
||||
.map_err(|e| {
|
||||
admin_error!(err = ?e, "Invalid identity");
|
||||
e
|
||||
})?;
|
||||
|
||||
let target = idms_prox_write
|
||||
.qs_write
|
||||
.name_to_uuid(uuid_or_name.as_str())
|
||||
.map_err(|e| {
|
||||
admin_error!(err = ?e, "Error resolving id to target");
|
||||
e
|
||||
})?;
|
||||
|
||||
let scim_delete_event = ScimDeleteEvent::new(ident, target, class);
|
||||
|
||||
idms_prox_write
|
||||
.qs_write
|
||||
.scim_delete(scim_delete_event)
|
||||
.and_then(|r| idms_prox_write.commit().map(|_| r))
|
||||
}
|
||||
}
|
||||
|
||||
impl QueryServerReadV1 {
|
||||
|
|
|
|||
|
|
@ -78,6 +78,8 @@ impl Modify for SecurityAddon {
|
|||
super::v1_scim::scim_sync_get,
|
||||
super::v1_scim::scim_entry_id_get,
|
||||
super::v1_scim::scim_person_id_get,
|
||||
super::v1_scim::scim_application_post,
|
||||
super::v1_scim::scim_application_id_delete,
|
||||
|
||||
super::v1::schema_get,
|
||||
super::v1::whoami,
|
||||
|
|
|
|||
|
|
@ -43,7 +43,7 @@ fn figure_out_if_we_have_all_the_routes() {
|
|||
.unwrap();
|
||||
// work our way through the source files in this package looking for routedefs
|
||||
let mut found_routes: BTreeMap<String, Vec<(String, String)>> = BTreeMap::new();
|
||||
let walker = walkdir::WalkDir::new(format!("{}/src", env!("CARGO_MANIFEST_DIR")))
|
||||
let walker = walkdir::WalkDir::new(format!("{}/src/https", env!("CARGO_MANIFEST_DIR")))
|
||||
.follow_links(false)
|
||||
.into_iter();
|
||||
|
||||
|
|
|
|||
|
|
@ -9,10 +9,11 @@ use super::ServerState;
|
|||
use crate::https::extractors::VerifiedClientInformation;
|
||||
use axum::extract::{rejection::JsonRejection, DefaultBodyLimit, Path, Query, State};
|
||||
use axum::response::{Html, IntoResponse, Response};
|
||||
use axum::routing::{get, post};
|
||||
use axum::routing::{delete, get, post};
|
||||
use axum::{Extension, Json, Router};
|
||||
use kanidm_proto::scim_v1::{
|
||||
server::ScimEntryKanidm, ScimEntryGetQuery, ScimSyncRequest, ScimSyncState,
|
||||
client::ScimEntryPostGeneric, server::ScimEntryKanidm, ScimEntryGetQuery, ScimSyncRequest,
|
||||
ScimSyncState,
|
||||
};
|
||||
use kanidm_proto::v1::Entry as ProtoEntry;
|
||||
use kanidmd_lib::prelude::*;
|
||||
|
|
@ -383,6 +384,65 @@ async fn scim_person_id_get(
|
|||
.map_err(WebError::from)
|
||||
}
|
||||
|
||||
#[utoipa::path(
|
||||
post,
|
||||
path = "/scim/v1/Application",
|
||||
responses(
|
||||
(status = 200, content_type="application/json", body=ScimEntry),
|
||||
ApiResponseWithout200,
|
||||
),
|
||||
security(("token_jwt" = [])),
|
||||
tag = "scim",
|
||||
operation_id = "scim_application_post"
|
||||
)]
|
||||
async fn scim_application_post(
|
||||
State(state): State<ServerState>,
|
||||
Extension(kopid): Extension<KOpId>,
|
||||
VerifiedClientInformation(client_auth_info): VerifiedClientInformation,
|
||||
Json(entry_post): Json<ScimEntryPostGeneric>,
|
||||
) -> Result<Json<ScimEntryKanidm>, WebError> {
|
||||
state
|
||||
.qe_w_ref
|
||||
.scim_entry_create(
|
||||
client_auth_info,
|
||||
kopid.eventid,
|
||||
&[
|
||||
EntryClass::Account,
|
||||
EntryClass::ServiceAccount,
|
||||
EntryClass::Application,
|
||||
],
|
||||
entry_post,
|
||||
)
|
||||
.await
|
||||
.map(Json::from)
|
||||
.map_err(WebError::from)
|
||||
}
|
||||
|
||||
#[utoipa::path(
|
||||
delete,
|
||||
path = "/scim/v1/Application/{id}",
|
||||
responses(
|
||||
(status = 200, content_type="application/json"),
|
||||
ApiResponseWithout200,
|
||||
),
|
||||
security(("token_jwt" = [])),
|
||||
tag = "scim",
|
||||
operation_id = "scim_application_id_delete"
|
||||
)]
|
||||
async fn scim_application_id_delete(
|
||||
State(state): State<ServerState>,
|
||||
Path(id): Path<String>,
|
||||
Extension(kopid): Extension<KOpId>,
|
||||
VerifiedClientInformation(client_auth_info): VerifiedClientInformation,
|
||||
) -> Result<Json<()>, WebError> {
|
||||
state
|
||||
.qe_w_ref
|
||||
.scim_entry_id_delete(client_auth_info, kopid.eventid, id, EntryClass::Application)
|
||||
.await
|
||||
.map(Json::from)
|
||||
.map_err(WebError::from)
|
||||
}
|
||||
|
||||
pub fn route_setup() -> Router<ServerState> {
|
||||
Router::new()
|
||||
.route(
|
||||
|
|
@ -486,6 +546,17 @@ pub fn route_setup() -> Router<ServerState> {
|
|||
//
|
||||
// POST Send a sync update
|
||||
//
|
||||
//
|
||||
// Application /Application Post Create a new application
|
||||
//
|
||||
.route("/scim/v1/Application", post(scim_application_post))
|
||||
// Application /Application/{id} Delete Delete the application identified by id
|
||||
//
|
||||
.route(
|
||||
"/scim/v1/Application/:id",
|
||||
delete(scim_application_id_delete),
|
||||
)
|
||||
// Synchronisation routes.
|
||||
.route(
|
||||
"/scim/v1/Sync",
|
||||
post(scim_sync_post)
|
||||
|
|
|
|||
|
|
@ -338,6 +338,7 @@ pub const UUID_SCHEMA_ATTR_KEY_ACTION_IMPORT_JWS_RS256: Uuid =
|
|||
uuid!("00000000-0000-0000-0000-ffff00000191");
|
||||
pub const UUID_SCHEMA_CLASS_KEY_OBJECT_JWT_RS256: Uuid =
|
||||
uuid!("00000000-0000-0000-0000-ffff00000192");
|
||||
pub const UUID_SCHEMA_ATTR_APPLICATION_URL: Uuid = uuid!("00000000-0000-0000-0000-ffff00000193");
|
||||
|
||||
// System and domain infos
|
||||
// I'd like to strongly criticise william of the past for making poor choices about these allocations.
|
||||
|
|
|
|||
|
|
@ -24,11 +24,6 @@
|
|||
//! [`filter`]: ../filter/index.html
|
||||
//! [`schema`]: ../schema/index.html
|
||||
|
||||
use std::cmp::Ordering;
|
||||
pub use std::collections::BTreeSet as Set;
|
||||
use std::collections::{BTreeMap as Map, BTreeMap, BTreeSet};
|
||||
use std::sync::Arc;
|
||||
|
||||
use crate::be::dbentry::{DbEntry, DbEntryVers};
|
||||
use crate::be::dbvalue::DbValueSetV2;
|
||||
use crate::be::{IdxKey, IdxSlope};
|
||||
|
|
@ -41,7 +36,13 @@ use crate::prelude::*;
|
|||
use crate::repl::cid::Cid;
|
||||
use crate::repl::entry::EntryChangeState;
|
||||
use crate::repl::proto::{ReplEntryV1, ReplIncrementalEntryV1};
|
||||
use crate::schema::{SchemaAttribute, SchemaClass, SchemaTransaction};
|
||||
use crate::server::access::AccessEffectivePermission;
|
||||
use crate::value::{
|
||||
ApiToken, CredentialType, IndexType, IntentTokenState, Oauth2Session, PartialValue, Session,
|
||||
SyntaxType, Value,
|
||||
};
|
||||
use crate::valueset::{self, ScimResolveStatus, ValueSet};
|
||||
use compact_jwt::JwsEs256Signer;
|
||||
use hashbrown::{HashMap, HashSet};
|
||||
use kanidm_proto::internal::ImageValue;
|
||||
|
|
@ -53,6 +54,10 @@ use kanidm_proto::v1::Entry as ProtoEntry;
|
|||
use ldap3_proto::simple::{LdapPartialAttribute, LdapSearchResultEntry};
|
||||
use openssl::ec::EcKey;
|
||||
use openssl::pkey::{Private, Public};
|
||||
use std::cmp::Ordering;
|
||||
pub use std::collections::BTreeSet as Set;
|
||||
use std::collections::{BTreeMap as Map, BTreeMap, BTreeSet};
|
||||
use std::sync::Arc;
|
||||
use time::OffsetDateTime;
|
||||
use tracing::trace;
|
||||
use uuid::Uuid;
|
||||
|
|
@ -60,13 +65,6 @@ use webauthn_rs::prelude::{
|
|||
AttestationCaList, AttestedPasskey as AttestedPasskeyV4, Passkey as PasskeyV4,
|
||||
};
|
||||
|
||||
use crate::schema::{SchemaAttribute, SchemaClass, SchemaTransaction};
|
||||
use crate::value::{
|
||||
ApiToken, CredentialType, IndexType, IntentTokenState, Oauth2Session, PartialValue, Session,
|
||||
SyntaxType, Value,
|
||||
};
|
||||
use crate::valueset::{self, ScimResolveStatus, ValueSet};
|
||||
|
||||
pub type EntryInitNew = Entry<EntryInit, EntryNew>;
|
||||
pub type EntryInvalidNew = Entry<EntryInvalid, EntryNew>;
|
||||
pub type EntryRefreshNew = Entry<EntryRefresh, EntryNew>;
|
||||
|
|
@ -285,6 +283,18 @@ impl Default for Entry<EntryInit, EntryNew> {
|
|||
}
|
||||
}
|
||||
|
||||
impl FromIterator<(Attribute, ValueSet)> for EntryInitNew {
|
||||
fn from_iter<I: IntoIterator<Item = (Attribute, ValueSet)>>(iter: I) -> Self {
|
||||
let attrs = Eattrs::from_iter(iter);
|
||||
|
||||
Entry {
|
||||
valid: EntryInit,
|
||||
state: EntryNew,
|
||||
attrs,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl Entry<EntryInit, EntryNew> {
|
||||
pub fn new() -> Self {
|
||||
Entry {
|
||||
|
|
@ -292,7 +302,6 @@ impl Entry<EntryInit, EntryNew> {
|
|||
valid: EntryInit,
|
||||
state: EntryNew,
|
||||
attrs: Map::new(),
|
||||
// attrs: Map::with_capacity(32),
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -479,6 +488,11 @@ impl Entry<EntryInit, EntryNew> {
|
|||
self.attrs.remove(attr);
|
||||
}
|
||||
|
||||
/// Set the content of this ava with this valueset, ignoring the previous data.
|
||||
pub fn set_ava_set(&mut self, attr: &Attribute, vs: ValueSet) {
|
||||
self.attrs.insert(attr.clone(), vs);
|
||||
}
|
||||
|
||||
/// Replace the existing content of an attribute set of this Entry, with a new set of Values.
|
||||
pub fn set_ava<T>(&mut self, attr: Attribute, iter: T)
|
||||
where
|
||||
|
|
|
|||
|
|
@ -346,6 +346,8 @@ pub struct CreateEvent {
|
|||
pub entries: Vec<Entry<EntryInit, EntryNew>>,
|
||||
// Is the CreateEvent from an internal or external source?
|
||||
// This may affect which plugins are run ...
|
||||
/// If true, the list of created entry UUID's will be returned.
|
||||
pub return_created_uuids: bool,
|
||||
}
|
||||
|
||||
impl CreateEvent {
|
||||
|
|
@ -363,7 +365,11 @@ impl CreateEvent {
|
|||
// What is the correct consuming iterator here? Can we
|
||||
// even do that?
|
||||
match rentries {
|
||||
Ok(entries) => Ok(CreateEvent { ident, entries }),
|
||||
Ok(entries) => Ok(CreateEvent {
|
||||
ident,
|
||||
entries,
|
||||
return_created_uuids: false,
|
||||
}),
|
||||
Err(e) => Err(e),
|
||||
}
|
||||
}
|
||||
|
|
@ -373,13 +379,18 @@ impl CreateEvent {
|
|||
ident: Identity,
|
||||
entries: Vec<Entry<EntryInit, EntryNew>>,
|
||||
) -> Self {
|
||||
CreateEvent { ident, entries }
|
||||
CreateEvent {
|
||||
ident,
|
||||
entries,
|
||||
return_created_uuids: false,
|
||||
}
|
||||
}
|
||||
|
||||
pub fn new_internal(entries: Vec<Entry<EntryInit, EntryNew>>) -> Self {
|
||||
CreateEvent {
|
||||
ident: Identity::from_internal(),
|
||||
entries,
|
||||
return_created_uuids: false,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -255,139 +255,6 @@ mod tests {
|
|||
|
||||
const TEST_CURRENT_TIME: u64 = 6000;
|
||||
|
||||
// Tests that only the correct combinations of [Account, Person, Application and
|
||||
// ServiceAccount] classes are allowed.
|
||||
#[idm_test]
|
||||
async fn test_idm_application_excludes(idms: &IdmServer, _idms_delayed: &mut IdmServerDelayed) {
|
||||
let ct = Duration::from_secs(TEST_CURRENT_TIME);
|
||||
let mut idms_prox_write = idms.proxy_write(ct).await.unwrap();
|
||||
|
||||
// ServiceAccount, Application and Person not allowed together
|
||||
let test_grp_name = "testgroup1";
|
||||
let test_grp_uuid = Uuid::new_v4();
|
||||
let e1 = entry_init!(
|
||||
(Attribute::Class, EntryClass::Object.to_value()),
|
||||
(Attribute::Class, EntryClass::Group.to_value()),
|
||||
(Attribute::Name, Value::new_iname(test_grp_name)),
|
||||
(Attribute::Uuid, Value::Uuid(test_grp_uuid))
|
||||
);
|
||||
let test_entry_uuid = Uuid::new_v4();
|
||||
let e2 = entry_init!(
|
||||
(Attribute::Class, EntryClass::Object.to_value()),
|
||||
(Attribute::Class, EntryClass::Account.to_value()),
|
||||
(Attribute::Class, EntryClass::ServiceAccount.to_value()),
|
||||
(Attribute::Class, EntryClass::Application.to_value()),
|
||||
(Attribute::Class, EntryClass::Person.to_value()),
|
||||
(Attribute::Name, Value::new_iname("test_app_name")),
|
||||
(Attribute::Uuid, Value::Uuid(test_entry_uuid)),
|
||||
(Attribute::Description, Value::new_utf8s("test_app_desc")),
|
||||
(
|
||||
Attribute::DisplayName,
|
||||
Value::new_utf8s("test_app_dispname")
|
||||
),
|
||||
(Attribute::LinkedGroup, Value::Refer(test_grp_uuid))
|
||||
);
|
||||
let ce = CreateEvent::new_internal(vec![e1, e2]);
|
||||
let cr = idms_prox_write.qs_write.create(&ce);
|
||||
assert!(cr.is_err());
|
||||
|
||||
// Application and Person not allowed together
|
||||
let test_grp_name = "testgroup1";
|
||||
let test_grp_uuid = Uuid::new_v4();
|
||||
let e1 = entry_init!(
|
||||
(Attribute::Class, EntryClass::Object.to_value()),
|
||||
(Attribute::Class, EntryClass::Group.to_value()),
|
||||
(Attribute::Name, Value::new_iname(test_grp_name)),
|
||||
(Attribute::Uuid, Value::Uuid(test_grp_uuid))
|
||||
);
|
||||
let test_entry_uuid = Uuid::new_v4();
|
||||
let e2 = entry_init!(
|
||||
(Attribute::Class, EntryClass::Object.to_value()),
|
||||
(Attribute::Class, EntryClass::Account.to_value()),
|
||||
(Attribute::Class, EntryClass::Application.to_value()),
|
||||
(Attribute::Class, EntryClass::Person.to_value()),
|
||||
(Attribute::Name, Value::new_iname("test_app_name")),
|
||||
(Attribute::Uuid, Value::Uuid(test_entry_uuid)),
|
||||
(Attribute::Description, Value::new_utf8s("test_app_desc")),
|
||||
(
|
||||
Attribute::DisplayName,
|
||||
Value::new_utf8s("test_app_dispname")
|
||||
),
|
||||
(Attribute::LinkedGroup, Value::Refer(test_grp_uuid))
|
||||
);
|
||||
let ce = CreateEvent::new_internal(vec![e1, e2]);
|
||||
let cr = idms_prox_write.qs_write.create(&ce);
|
||||
assert!(cr.is_err());
|
||||
|
||||
// Supplements not satisfied, Application supplements ServiceAccount
|
||||
let test_grp_name = "testgroup1";
|
||||
let test_grp_uuid = Uuid::new_v4();
|
||||
let e1 = entry_init!(
|
||||
(Attribute::Class, EntryClass::Object.to_value()),
|
||||
(Attribute::Class, EntryClass::Group.to_value()),
|
||||
(Attribute::Name, Value::new_iname(test_grp_name)),
|
||||
(Attribute::Uuid, Value::Uuid(test_grp_uuid))
|
||||
);
|
||||
let test_entry_uuid = Uuid::new_v4();
|
||||
let e2 = entry_init!(
|
||||
(Attribute::Class, EntryClass::Object.to_value()),
|
||||
(Attribute::Class, EntryClass::Account.to_value()),
|
||||
(Attribute::Class, EntryClass::Application.to_value()),
|
||||
(Attribute::Name, Value::new_iname("test_app_name")),
|
||||
(Attribute::Uuid, Value::Uuid(test_entry_uuid)),
|
||||
(Attribute::Description, Value::new_utf8s("test_app_desc")),
|
||||
(Attribute::LinkedGroup, Value::Refer(test_grp_uuid))
|
||||
);
|
||||
let ce = CreateEvent::new_internal(vec![e1, e2]);
|
||||
let cr = idms_prox_write.qs_write.create(&ce);
|
||||
assert!(cr.is_err());
|
||||
|
||||
// Supplements not satisfied, Application supplements ServiceAccount
|
||||
let test_grp_name = "testgroup1";
|
||||
let test_grp_uuid = Uuid::new_v4();
|
||||
let e1 = entry_init!(
|
||||
(Attribute::Class, EntryClass::Object.to_value()),
|
||||
(Attribute::Class, EntryClass::Group.to_value()),
|
||||
(Attribute::Name, Value::new_iname(test_grp_name)),
|
||||
(Attribute::Uuid, Value::Uuid(test_grp_uuid))
|
||||
);
|
||||
let test_entry_uuid = Uuid::new_v4();
|
||||
let e2 = entry_init!(
|
||||
(Attribute::Class, EntryClass::Object.to_value()),
|
||||
(Attribute::Class, EntryClass::Application.to_value()),
|
||||
(Attribute::Name, Value::new_iname("test_app_name")),
|
||||
(Attribute::Uuid, Value::Uuid(test_entry_uuid)),
|
||||
(Attribute::Description, Value::new_utf8s("test_app_desc")),
|
||||
(Attribute::LinkedGroup, Value::Refer(test_grp_uuid))
|
||||
);
|
||||
let ce = CreateEvent::new_internal(vec![e1, e2]);
|
||||
let cr = idms_prox_write.qs_write.create(&ce);
|
||||
assert!(cr.is_err());
|
||||
|
||||
// Supplements satisfied, Application supplements ServiceAccount
|
||||
let test_grp_name = "testgroup1";
|
||||
let test_grp_uuid = Uuid::new_v4();
|
||||
let e1 = entry_init!(
|
||||
(Attribute::Class, EntryClass::Object.to_value()),
|
||||
(Attribute::Class, EntryClass::Group.to_value()),
|
||||
(Attribute::Name, Value::new_iname(test_grp_name)),
|
||||
(Attribute::Uuid, Value::Uuid(test_grp_uuid))
|
||||
);
|
||||
let test_entry_uuid = Uuid::new_v4();
|
||||
let e2 = entry_init!(
|
||||
(Attribute::Class, EntryClass::Object.to_value()),
|
||||
(Attribute::Class, EntryClass::Application.to_value()),
|
||||
(Attribute::Class, EntryClass::ServiceAccount.to_value()),
|
||||
(Attribute::Name, Value::new_iname("test_app_name")),
|
||||
(Attribute::Uuid, Value::Uuid(test_entry_uuid)),
|
||||
(Attribute::Description, Value::new_utf8s("test_app_desc")),
|
||||
(Attribute::LinkedGroup, Value::Refer(test_grp_uuid))
|
||||
);
|
||||
let ce = CreateEvent::new_internal(vec![e1, e2]);
|
||||
let cr = idms_prox_write.qs_write.create(&ce);
|
||||
assert!(cr.is_ok());
|
||||
}
|
||||
|
||||
// Tests it is not possible to create an application without the linked group attribute
|
||||
#[idm_test]
|
||||
async fn test_idm_application_no_linked_group(
|
||||
|
|
@ -404,6 +271,7 @@ mod tests {
|
|||
(Attribute::Class, EntryClass::Account.to_value()),
|
||||
(Attribute::Class, EntryClass::ServiceAccount.to_value()),
|
||||
(Attribute::Class, EntryClass::Application.to_value()),
|
||||
(Attribute::DisplayName, Value::new_utf8s("Application")),
|
||||
(Attribute::Name, Value::new_iname("test_app_name")),
|
||||
(Attribute::Uuid, Value::Uuid(test_entry_uuid)),
|
||||
(Attribute::Description, Value::new_utf8s("test_app_desc")),
|
||||
|
|
@ -547,8 +415,10 @@ mod tests {
|
|||
|
||||
let e3 = entry_init!(
|
||||
(Attribute::Class, EntryClass::Object.to_value()),
|
||||
(Attribute::Class, EntryClass::Account.to_value()),
|
||||
(Attribute::Class, EntryClass::ServiceAccount.to_value()),
|
||||
(Attribute::Class, EntryClass::Application.to_value()),
|
||||
(Attribute::DisplayName, Value::new_utf8s("Application")),
|
||||
(Attribute::Name, Value::new_iname(test_app_name)),
|
||||
(Attribute::Uuid, Value::Uuid(test_app_uuid)),
|
||||
(Attribute::LinkedGroup, Value::Refer(test_grp_uuid))
|
||||
|
|
@ -647,7 +517,9 @@ mod tests {
|
|||
let e2 = entry_init!(
|
||||
(Attribute::Class, EntryClass::Object.to_value()),
|
||||
(Attribute::Class, EntryClass::ServiceAccount.to_value()),
|
||||
(Attribute::Class, EntryClass::Account.to_value()),
|
||||
(Attribute::Class, EntryClass::Application.to_value()),
|
||||
(Attribute::DisplayName, Value::new_utf8s("Application")),
|
||||
(Attribute::Name, Value::new_iname("test_app_name")),
|
||||
(Attribute::Uuid, Value::Uuid(test_entry_uuid)),
|
||||
(Attribute::Description, Value::new_utf8s("test_app_desc")),
|
||||
|
|
|
|||
|
|
@ -1119,8 +1119,10 @@ mod tests {
|
|||
|
||||
let e3 = entry_init!(
|
||||
(Attribute::Class, EntryClass::Object.to_value()),
|
||||
(Attribute::Class, EntryClass::Account.to_value()),
|
||||
(Attribute::Class, EntryClass::ServiceAccount.to_value()),
|
||||
(Attribute::Class, EntryClass::Application.to_value()),
|
||||
(Attribute::DisplayName, Value::new_utf8s("Application")),
|
||||
(Attribute::Name, Value::new_iname(app_name)),
|
||||
(Attribute::Uuid, Value::Uuid(app_uuid)),
|
||||
(Attribute::LinkedGroup, Value::Refer(grp_uuid))
|
||||
|
|
@ -1283,8 +1285,10 @@ mod tests {
|
|||
|
||||
let e3 = entry_init!(
|
||||
(Attribute::Class, EntryClass::Object.to_value()),
|
||||
(Attribute::Class, EntryClass::Account.to_value()),
|
||||
(Attribute::Class, EntryClass::ServiceAccount.to_value()),
|
||||
(Attribute::Class, EntryClass::Application.to_value()),
|
||||
(Attribute::DisplayName, Value::new_utf8s("Application")),
|
||||
(Attribute::Name, Value::new_iname("testapp1")),
|
||||
(Attribute::Uuid, Value::Uuid(app_uuid)),
|
||||
(Attribute::LinkedGroup, Value::Refer(grp_uuid))
|
||||
|
|
@ -1456,8 +1460,10 @@ mod tests {
|
|||
|
||||
let e4 = entry_init!(
|
||||
(Attribute::Class, EntryClass::Object.to_value()),
|
||||
(Attribute::Class, EntryClass::Account.to_value()),
|
||||
(Attribute::Class, EntryClass::ServiceAccount.to_value()),
|
||||
(Attribute::Class, EntryClass::Application.to_value()),
|
||||
(Attribute::DisplayName, Value::new_utf8s("Application")),
|
||||
(Attribute::Name, Value::new_iname(app1_name)),
|
||||
(Attribute::Uuid, Value::Uuid(app1_uuid)),
|
||||
(Attribute::LinkedGroup, Value::Refer(grp1_uuid))
|
||||
|
|
@ -1465,8 +1471,10 @@ mod tests {
|
|||
|
||||
let e5 = entry_init!(
|
||||
(Attribute::Class, EntryClass::Object.to_value()),
|
||||
(Attribute::Class, EntryClass::Account.to_value()),
|
||||
(Attribute::Class, EntryClass::ServiceAccount.to_value()),
|
||||
(Attribute::Class, EntryClass::Application.to_value()),
|
||||
(Attribute::DisplayName, Value::new_utf8s("Application")),
|
||||
(Attribute::Name, Value::new_iname(app2_name)),
|
||||
(Attribute::Uuid, Value::Uuid(app2_uuid)),
|
||||
(Attribute::LinkedGroup, Value::Refer(grp2_uuid))
|
||||
|
|
@ -1651,8 +1659,10 @@ mod tests {
|
|||
|
||||
let e3 = entry_init!(
|
||||
(Attribute::Class, EntryClass::Object.to_value()),
|
||||
(Attribute::Class, EntryClass::Account.to_value()),
|
||||
(Attribute::Class, EntryClass::ServiceAccount.to_value()),
|
||||
(Attribute::Class, EntryClass::Application.to_value()),
|
||||
(Attribute::DisplayName, Value::new_utf8s("Application")),
|
||||
(Attribute::Name, Value::new_iname(app1_name)),
|
||||
(Attribute::Uuid, Value::Uuid(app1_uuid)),
|
||||
(Attribute::LinkedGroup, Value::Refer(grp1_uuid))
|
||||
|
|
@ -2693,8 +2703,10 @@ mod tests {
|
|||
|
||||
let e3 = entry_init!(
|
||||
(Attribute::Class, EntryClass::Object.to_value()),
|
||||
(Attribute::Class, EntryClass::Account.to_value()),
|
||||
(Attribute::Class, EntryClass::ServiceAccount.to_value()),
|
||||
(Attribute::Class, EntryClass::Application.to_value()),
|
||||
(Attribute::DisplayName, Value::new_utf8s("Application")),
|
||||
(Attribute::Name, Value::new_iname(app_name)),
|
||||
(Attribute::Uuid, Value::Uuid(app_uuid)),
|
||||
(Attribute::LinkedGroup, Value::Refer(grp_uuid))
|
||||
|
|
|
|||
|
|
@ -106,6 +106,7 @@ pub fn phase_1_schema_attrs() -> Vec<EntryInitNew> {
|
|||
SCHEMA_ATTR_DENIED_NAME_DL10.clone().into(),
|
||||
SCHEMA_ATTR_LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES.clone().into(),
|
||||
SCHEMA_ATTR_KEY_ACTION_IMPORT_JWS_RS256_DL6.clone().into(),
|
||||
// DL11
|
||||
]
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -849,9 +849,9 @@ pub static ref SCHEMA_CLASS_ACCOUNT_DL5: SchemaClass = SchemaClass {
|
|||
Attribute::Spn
|
||||
],
|
||||
systemsupplements: vec![
|
||||
EntryClass::OAuth2ResourceServer.into(),
|
||||
EntryClass::Person.into(),
|
||||
EntryClass::ServiceAccount.into(),
|
||||
EntryClass::OAuth2ResourceServer.into(),
|
||||
],
|
||||
..Default::default()
|
||||
};
|
||||
|
|
|
|||
|
|
@ -106,6 +106,9 @@ pub fn phase_1_schema_attrs() -> Vec<EntryInitNew> {
|
|||
SCHEMA_ATTR_DENIED_NAME_DL10.clone().into(),
|
||||
SCHEMA_ATTR_LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES.clone().into(),
|
||||
SCHEMA_ATTR_KEY_ACTION_IMPORT_JWS_RS256_DL6.clone().into(),
|
||||
// DL11
|
||||
SCHEMA_ATTR_APPLICATION_URL.clone().into(),
|
||||
// DL12
|
||||
]
|
||||
}
|
||||
|
||||
|
|
@ -135,13 +138,14 @@ pub fn phase_2_schema_classes() -> Vec<EntryInitNew> {
|
|||
SCHEMA_CLASS_CLIENT_CERTIFICATE_DL7.clone().into(),
|
||||
// DL8
|
||||
SCHEMA_CLASS_ACCOUNT_POLICY_DL8.clone().into(),
|
||||
SCHEMA_CLASS_APPLICATION_DL8.clone().into(),
|
||||
SCHEMA_CLASS_PERSON_DL8.clone().into(),
|
||||
// DL9
|
||||
SCHEMA_CLASS_OAUTH2_RS_DL9.clone().into(),
|
||||
// DL10
|
||||
SCHEMA_CLASS_DOMAIN_INFO_DL10.clone().into(),
|
||||
SCHEMA_CLASS_KEY_OBJECT_JWT_RS256.clone().into(),
|
||||
// DL11
|
||||
SCHEMA_CLASS_APPLICATION.clone().into(),
|
||||
]
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -740,6 +740,14 @@ pub static ref SCHEMA_ATTR_APPLICATION_PASSWORD_DL8: SchemaAttribute = SchemaAtt
|
|||
..Default::default()
|
||||
};
|
||||
|
||||
pub static ref SCHEMA_ATTR_APPLICATION_URL: SchemaAttribute = SchemaAttribute {
|
||||
uuid: UUID_SCHEMA_ATTR_APPLICATION_URL,
|
||||
name: Attribute::ApplicationUrl,
|
||||
description: "The URL of an external application".to_string(),
|
||||
syntax: SyntaxType::Url,
|
||||
..Default::default()
|
||||
};
|
||||
|
||||
// === classes ===
|
||||
pub static ref SCHEMA_CLASS_PERSON_DL8: SchemaClass = SchemaClass {
|
||||
uuid: UUID_SCHEMA_CLASS_PERSON,
|
||||
|
|
@ -1104,13 +1112,20 @@ pub static ref SCHEMA_CLASS_CLIENT_CERTIFICATE_DL7: SchemaClass = SchemaClass {
|
|||
..Default::default()
|
||||
};
|
||||
|
||||
pub static ref SCHEMA_CLASS_APPLICATION_DL8: SchemaClass = SchemaClass {
|
||||
pub static ref SCHEMA_CLASS_APPLICATION: SchemaClass = SchemaClass {
|
||||
uuid: UUID_SCHEMA_CLASS_APPLICATION,
|
||||
name: EntryClass::Application.into(),
|
||||
|
||||
description: "The class representing an application".to_string(),
|
||||
systemmust: vec![Attribute::Name, Attribute::LinkedGroup],
|
||||
systemmay: vec![Attribute::Description],
|
||||
systemmust: vec![Attribute::LinkedGroup],
|
||||
systemmay: vec![
|
||||
Attribute::ApplicationUrl,
|
||||
],
|
||||
// I think this could change before release - I can see a world
|
||||
// whe we may want an oauth2 application to have application passwords,
|
||||
// or for this to be it's own thing. But service accounts also don't
|
||||
// quite do enough, they have api tokens, but that's all we kind
|
||||
// of want from them?
|
||||
systemsupplements: vec![EntryClass::ServiceAccount.into()],
|
||||
..Default::default()
|
||||
};
|
||||
|
|
|
|||
|
|
@ -365,7 +365,7 @@ mod tests {
|
|||
let create = vec![e];
|
||||
|
||||
run_create_test!(
|
||||
Ok(()),
|
||||
Ok(None),
|
||||
preload,
|
||||
create,
|
||||
None,
|
||||
|
|
@ -468,7 +468,7 @@ mod tests {
|
|||
let create = vec![e];
|
||||
|
||||
run_create_test!(
|
||||
Ok(()),
|
||||
Ok(None),
|
||||
preload,
|
||||
create,
|
||||
None,
|
||||
|
|
|
|||
|
|
@ -205,7 +205,7 @@ mod tests {
|
|||
|
||||
let create = vec![e];
|
||||
|
||||
run_create_test!(Ok(()), preload, create, None, |_| {});
|
||||
run_create_test!(Ok(None), preload, create, None, |_| {});
|
||||
}
|
||||
|
||||
#[test]
|
||||
|
|
|
|||
|
|
@ -464,7 +464,7 @@ mod tests {
|
|||
let create = vec![e_dyn];
|
||||
|
||||
run_create_test!(
|
||||
Ok(()),
|
||||
Ok(None),
|
||||
preload,
|
||||
create,
|
||||
None,
|
||||
|
|
@ -513,7 +513,7 @@ mod tests {
|
|||
let create = vec![e_group];
|
||||
|
||||
run_create_test!(
|
||||
Ok(()),
|
||||
Ok(None),
|
||||
preload,
|
||||
create,
|
||||
None,
|
||||
|
|
@ -562,7 +562,7 @@ mod tests {
|
|||
let create = vec![e_group];
|
||||
|
||||
run_create_test!(
|
||||
Ok(()),
|
||||
Ok(None),
|
||||
preload,
|
||||
create,
|
||||
None,
|
||||
|
|
@ -607,7 +607,7 @@ mod tests {
|
|||
let create = vec![e_dyn, e_group];
|
||||
|
||||
run_create_test!(
|
||||
Ok(()),
|
||||
Ok(None),
|
||||
preload,
|
||||
create,
|
||||
None,
|
||||
|
|
|
|||
|
|
@ -108,7 +108,7 @@ mod tests {
|
|||
|
||||
let create = vec![ea];
|
||||
run_create_test!(
|
||||
Ok(()),
|
||||
Ok(None),
|
||||
preload,
|
||||
create,
|
||||
None,
|
||||
|
|
|
|||
|
|
@ -858,7 +858,7 @@ mod tests {
|
|||
let preload = Vec::with_capacity(0);
|
||||
let create = vec![ea, eb];
|
||||
run_create_test!(
|
||||
Ok(()),
|
||||
Ok(None),
|
||||
preload,
|
||||
create,
|
||||
None,
|
||||
|
|
@ -889,7 +889,7 @@ mod tests {
|
|||
let preload = Vec::with_capacity(0);
|
||||
let create = vec![ea, eb, ec];
|
||||
run_create_test!(
|
||||
Ok(()),
|
||||
Ok(None),
|
||||
preload,
|
||||
create,
|
||||
None,
|
||||
|
|
@ -941,7 +941,7 @@ mod tests {
|
|||
let preload = Vec::with_capacity(0);
|
||||
let create = vec![ea, eb, ec];
|
||||
run_create_test!(
|
||||
Ok(()),
|
||||
Ok(None),
|
||||
preload,
|
||||
create,
|
||||
None,
|
||||
|
|
@ -999,7 +999,7 @@ mod tests {
|
|||
let preload = Vec::with_capacity(0);
|
||||
let create = vec![ea, eb, ec, ed];
|
||||
run_create_test!(
|
||||
Ok(()),
|
||||
Ok(None),
|
||||
preload,
|
||||
create,
|
||||
None,
|
||||
|
|
|
|||
|
|
@ -181,7 +181,7 @@ mod tests {
|
|||
let preload = Vec::with_capacity(0);
|
||||
let create = vec![ea];
|
||||
run_create_test!(
|
||||
Ok(()),
|
||||
Ok(None),
|
||||
preload,
|
||||
create,
|
||||
None,
|
||||
|
|
|
|||
|
|
@ -153,7 +153,7 @@ mod tests {
|
|||
let create = vec![e];
|
||||
|
||||
run_create_test!(
|
||||
Ok(()),
|
||||
Ok(None),
|
||||
preload,
|
||||
create,
|
||||
None,
|
||||
|
|
|
|||
|
|
@ -501,7 +501,7 @@ mod tests {
|
|||
let create = vec![eb];
|
||||
|
||||
run_create_test!(
|
||||
Ok(()),
|
||||
Ok(None),
|
||||
preload,
|
||||
create,
|
||||
None,
|
||||
|
|
@ -534,7 +534,7 @@ mod tests {
|
|||
let create = vec![e_group];
|
||||
|
||||
run_create_test!(
|
||||
Ok(()),
|
||||
Ok(None),
|
||||
preload,
|
||||
create,
|
||||
None,
|
||||
|
|
|
|||
|
|
@ -233,7 +233,7 @@ mod tests {
|
|||
let preload = Vec::with_capacity(0);
|
||||
|
||||
run_create_test!(
|
||||
Ok(()),
|
||||
Ok(None),
|
||||
preload,
|
||||
create,
|
||||
None,
|
||||
|
|
@ -286,7 +286,7 @@ mod tests {
|
|||
let preload = Vec::with_capacity(0);
|
||||
|
||||
run_create_test!(
|
||||
Ok(()),
|
||||
Ok(None),
|
||||
preload,
|
||||
create,
|
||||
None,
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@ impl QueryServerWriteTransaction<'_> {
|
|||
/// The create event is a raw, read only representation of the request
|
||||
/// that was made to us, including information about the identity
|
||||
/// performing the request.
|
||||
pub fn create(&mut self, ce: &CreateEvent) -> Result<(), OperationError> {
|
||||
pub fn create(&mut self, ce: &CreateEvent) -> Result<Option<Vec<Uuid>>, OperationError> {
|
||||
if !ce.ident.is_internal() {
|
||||
security_info!(name = %ce.ident, "create initiator");
|
||||
}
|
||||
|
|
@ -174,7 +174,12 @@ impl QueryServerWriteTransaction<'_> {
|
|||
} else {
|
||||
admin_info!("Create operation success");
|
||||
}
|
||||
Ok(())
|
||||
|
||||
if ce.return_created_uuids {
|
||||
Ok(Some(commit_cand.iter().map(|e| e.get_uuid()).collect()))
|
||||
} else {
|
||||
Ok(None)
|
||||
}
|
||||
}
|
||||
|
||||
pub fn internal_create(
|
||||
|
|
@ -182,7 +187,7 @@ impl QueryServerWriteTransaction<'_> {
|
|||
entries: Vec<Entry<EntryInit, EntryNew>>,
|
||||
) -> Result<(), OperationError> {
|
||||
let ce = CreateEvent::new_internal(entries);
|
||||
self.create(&ce)
|
||||
self.create(&ce).map(|_| ())
|
||||
}
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -28,8 +28,6 @@ use crate::schema::{
|
|||
SchemaWriteTransaction,
|
||||
};
|
||||
use crate::value::{CredentialType, EXTRACT_VAL_DN};
|
||||
use crate::valueset::uuid_to_proto_string;
|
||||
use crate::valueset::ScimValueIntermediate;
|
||||
use crate::valueset::*;
|
||||
use concread::arcache::{ARCacheBuilder, ARCacheReadTxn, ARCacheWriteTxn};
|
||||
use concread::cowcell::*;
|
||||
|
|
@ -1004,138 +1002,6 @@ pub trait QueryServerTransaction<'a> {
|
|||
}
|
||||
}
|
||||
|
||||
fn resolve_scim_json_put(
|
||||
&mut self,
|
||||
attr: &Attribute,
|
||||
value: Option<JsonValue>,
|
||||
) -> Result<Option<ValueSet>, OperationError> {
|
||||
let schema = self.get_schema();
|
||||
// Lookup the attr
|
||||
let Some(schema_a) = schema.get_attributes().get(attr) else {
|
||||
// No attribute of this name exists - fail fast, there is no point to
|
||||
// proceed, as nothing can be satisfied.
|
||||
return Err(OperationError::InvalidAttributeName(attr.to_string()));
|
||||
};
|
||||
|
||||
let Some(value) = value else {
|
||||
// It's a none so the value needs to be unset, and the attr DOES exist in
|
||||
// schema.
|
||||
return Ok(None);
|
||||
};
|
||||
|
||||
let resolve_status = match schema_a.syntax {
|
||||
SyntaxType::Utf8String => ValueSetUtf8::from_scim_json_put(value),
|
||||
SyntaxType::Utf8StringInsensitive => ValueSetIutf8::from_scim_json_put(value),
|
||||
SyntaxType::Uuid => ValueSetUuid::from_scim_json_put(value),
|
||||
SyntaxType::Boolean => ValueSetBool::from_scim_json_put(value),
|
||||
SyntaxType::SyntaxId => ValueSetSyntax::from_scim_json_put(value),
|
||||
SyntaxType::IndexId => ValueSetIndex::from_scim_json_put(value),
|
||||
SyntaxType::ReferenceUuid => ValueSetRefer::from_scim_json_put(value),
|
||||
SyntaxType::Utf8StringIname => ValueSetIname::from_scim_json_put(value),
|
||||
SyntaxType::NsUniqueId => ValueSetNsUniqueId::from_scim_json_put(value),
|
||||
SyntaxType::DateTime => ValueSetDateTime::from_scim_json_put(value),
|
||||
SyntaxType::EmailAddress => ValueSetEmailAddress::from_scim_json_put(value),
|
||||
SyntaxType::Url => ValueSetUrl::from_scim_json_put(value),
|
||||
SyntaxType::OauthScope => ValueSetOauthScope::from_scim_json_put(value),
|
||||
SyntaxType::OauthScopeMap => ValueSetOauthScopeMap::from_scim_json_put(value),
|
||||
SyntaxType::OauthClaimMap => ValueSetOauthClaimMap::from_scim_json_put(value),
|
||||
SyntaxType::UiHint => ValueSetUiHint::from_scim_json_put(value),
|
||||
SyntaxType::CredentialType => ValueSetCredentialType::from_scim_json_put(value),
|
||||
SyntaxType::Certificate => ValueSetCertificate::from_scim_json_put(value),
|
||||
SyntaxType::SshKey => ValueSetSshKey::from_scim_json_put(value),
|
||||
SyntaxType::Uint32 => ValueSetUint32::from_scim_json_put(value),
|
||||
|
||||
// Not Yet ... if ever
|
||||
// SyntaxType::JsonFilter => ValueSetJsonFilter::from_scim_json_put(value),
|
||||
SyntaxType::JsonFilter => Err(OperationError::InvalidAttribute(
|
||||
"Json Filters are not able to be set.".to_string(),
|
||||
)),
|
||||
// Can't be set currently as these are only internally generated for key-id's
|
||||
// SyntaxType::HexString => ValueSetHexString::from_scim_json_put(value),
|
||||
SyntaxType::HexString => Err(OperationError::InvalidAttribute(
|
||||
"Hex strings are not able to be set.".to_string(),
|
||||
)),
|
||||
|
||||
// Can't be set until we have better error handling in the set paths
|
||||
// SyntaxType::Image => ValueSetImage::from_scim_json_put(value),
|
||||
SyntaxType::Image => Err(OperationError::InvalidAttribute(
|
||||
"Images are not able to be set.".to_string(),
|
||||
)),
|
||||
|
||||
// Can't be set yet, mostly as I'm lazy
|
||||
// SyntaxType::WebauthnAttestationCaList => {
|
||||
// ValueSetWebauthnAttestationCaList::from_scim_json_put(value)
|
||||
// }
|
||||
SyntaxType::WebauthnAttestationCaList => Err(OperationError::InvalidAttribute(
|
||||
"Webauthn Attestation Ca Lists are not able to be set.".to_string(),
|
||||
)),
|
||||
|
||||
// Syntax types that can not be submitted
|
||||
SyntaxType::Credential => Err(OperationError::InvalidAttribute(
|
||||
"Credentials are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::SecretUtf8String => Err(OperationError::InvalidAttribute(
|
||||
"Secrets are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::SecurityPrincipalName => Err(OperationError::InvalidAttribute(
|
||||
"SPNs are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::Cid => Err(OperationError::InvalidAttribute(
|
||||
"CIDs are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::PrivateBinary => Err(OperationError::InvalidAttribute(
|
||||
"Private Binaries are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::IntentToken => Err(OperationError::InvalidAttribute(
|
||||
"Intent Tokens are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::Passkey => Err(OperationError::InvalidAttribute(
|
||||
"Passkeys are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::AttestedPasskey => Err(OperationError::InvalidAttribute(
|
||||
"Attested Passkeys are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::Session => Err(OperationError::InvalidAttribute(
|
||||
"Sessions are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::JwsKeyEs256 => Err(OperationError::InvalidAttribute(
|
||||
"Jws ES256 Private Keys are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::JwsKeyRs256 => Err(OperationError::InvalidAttribute(
|
||||
"Jws RS256 Private Keys are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::Oauth2Session => Err(OperationError::InvalidAttribute(
|
||||
"Sessions are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::TotpSecret => Err(OperationError::InvalidAttribute(
|
||||
"TOTP Secrets are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::ApiToken => Err(OperationError::InvalidAttribute(
|
||||
"API Tokens are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::AuditLogString => Err(OperationError::InvalidAttribute(
|
||||
"Audit Strings are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::EcKeyPrivate => Err(OperationError::InvalidAttribute(
|
||||
"EC Private Keys are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::KeyInternal => Err(OperationError::InvalidAttribute(
|
||||
"Key Internal Structures are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::ApplicationPassword => Err(OperationError::InvalidAttribute(
|
||||
"Application Passwords are not able to be set.".to_string(),
|
||||
)),
|
||||
}?;
|
||||
|
||||
match resolve_status {
|
||||
ValueSetResolveStatus::Resolved(vs) => Ok(vs),
|
||||
ValueSetResolveStatus::NeedsResolution(vs_inter) => {
|
||||
self.resolve_valueset_intermediate(vs_inter)
|
||||
}
|
||||
}
|
||||
.map(Some)
|
||||
}
|
||||
|
||||
fn resolve_valueset_intermediate(
|
||||
&mut self,
|
||||
vs_inter: ValueSetIntermediate,
|
||||
|
|
|
|||
|
|
@ -1,23 +1,27 @@
|
|||
use crate::prelude::*;
|
||||
use crate::schema::{SchemaAttribute, SchemaTransaction};
|
||||
use crate::server::batch_modify::{BatchModifyEvent, ModSetValid};
|
||||
use kanidm_proto::scim_v1::client::ScimEntryPutGeneric;
|
||||
use crate::server::ValueSetResolveStatus;
|
||||
use crate::valueset::*;
|
||||
use kanidm_proto::scim_v1::client::{ScimEntryPostGeneric, ScimEntryPutGeneric};
|
||||
use kanidm_proto::scim_v1::JsonValue;
|
||||
use std::collections::BTreeMap;
|
||||
|
||||
#[derive(Debug, Clone)]
|
||||
#[derive(Debug)]
|
||||
pub struct ScimEntryPutEvent {
|
||||
/// The identity performing the change.
|
||||
pub ident: Identity,
|
||||
pub(crate) ident: Identity,
|
||||
|
||||
// future - etags to detect version changes.
|
||||
/// The target entry that will be changed
|
||||
pub target: Uuid,
|
||||
pub(crate) target: Uuid,
|
||||
/// Update an attribute to contain the following value state.
|
||||
/// If the attribute is None, it is removed.
|
||||
pub attrs: BTreeMap<Attribute, Option<ValueSet>>,
|
||||
pub(crate) attrs: BTreeMap<Attribute, Option<ValueSet>>,
|
||||
|
||||
/// If an effective access check should be carried out post modification
|
||||
/// of the entries
|
||||
pub effective_access_check: bool,
|
||||
pub(crate) effective_access_check: bool,
|
||||
}
|
||||
|
||||
impl ScimEntryPutEvent {
|
||||
|
|
@ -48,6 +52,60 @@ impl ScimEntryPutEvent {
|
|||
}
|
||||
}
|
||||
|
||||
#[derive(Debug)]
|
||||
pub struct ScimCreateEvent {
|
||||
pub(crate) ident: Identity,
|
||||
pub(crate) entry: EntryInitNew,
|
||||
}
|
||||
|
||||
impl ScimCreateEvent {
|
||||
pub fn try_from(
|
||||
ident: Identity,
|
||||
classes: &[EntryClass],
|
||||
entry: ScimEntryPostGeneric,
|
||||
qs: &mut QueryServerWriteTransaction,
|
||||
) -> Result<Self, OperationError> {
|
||||
let mut entry = entry
|
||||
.attrs
|
||||
.into_iter()
|
||||
.map(|(attr, json_value)| {
|
||||
qs.resolve_scim_json_post(&attr, json_value)
|
||||
.map(|kani_value| (attr, kani_value))
|
||||
})
|
||||
.collect::<Result<EntryInitNew, _>>()?;
|
||||
|
||||
let classes = ValueSetIutf8::from_iter(classes.iter().map(|cls| cls.as_ref()))
|
||||
.ok_or(OperationError::SC0027ClassSetInvalid)?;
|
||||
|
||||
entry.set_ava_set(&Attribute::Class, classes);
|
||||
|
||||
Ok(ScimCreateEvent { ident, entry })
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Debug)]
|
||||
pub struct ScimDeleteEvent {
|
||||
/// The identity performing the change.
|
||||
pub(crate) ident: Identity,
|
||||
|
||||
// future - etags to detect version changes.
|
||||
/// The target entry that will be changed
|
||||
pub(crate) target: Uuid,
|
||||
|
||||
/// The class of the target entry.
|
||||
pub(crate) class: EntryClass,
|
||||
}
|
||||
|
||||
impl ScimDeleteEvent {
|
||||
pub fn new(ident: Identity, target: Uuid, class: EntryClass) -> Self {
|
||||
ScimDeleteEvent {
|
||||
ident,
|
||||
target,
|
||||
class,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl QueryServerWriteTransaction<'_> {
|
||||
/// SCIM PUT is the handler where a single entry is updated. In a SCIM PUT request
|
||||
/// the request defines the state of an attribute in entirety for the update. This
|
||||
|
|
@ -115,6 +173,251 @@ impl QueryServerWriteTransaction<'_> {
|
|||
}
|
||||
}
|
||||
}
|
||||
|
||||
pub fn scim_create(
|
||||
&mut self,
|
||||
scim_create: ScimCreateEvent,
|
||||
) -> Result<ScimEntryKanidm, OperationError> {
|
||||
let ScimCreateEvent { ident, entry } = scim_create;
|
||||
|
||||
let create_event = CreateEvent {
|
||||
ident,
|
||||
entries: vec![entry],
|
||||
return_created_uuids: true,
|
||||
};
|
||||
|
||||
let changed_uuids = self.create(&create_event)?;
|
||||
|
||||
let mut changed_uuids = changed_uuids.ok_or(OperationError::SC0028CreatedUuidsInvalid)?;
|
||||
|
||||
let target = if let Some(target) = changed_uuids.pop() {
|
||||
if !changed_uuids.is_empty() {
|
||||
// Too many results!
|
||||
return Err(OperationError::UniqueConstraintViolation);
|
||||
}
|
||||
|
||||
target
|
||||
} else {
|
||||
// No results!
|
||||
return Err(OperationError::NoMatchingEntries);
|
||||
};
|
||||
|
||||
// Now get the entry. We handle a lot of the errors here nicely,
|
||||
// but if we got to this point, they really can't happen.
|
||||
let filter_intent = filter!(f_and!([f_eq(Attribute::Uuid, PartialValue::Uuid(target))]));
|
||||
|
||||
let f_intent_valid = filter_intent
|
||||
.validate(self.get_schema())
|
||||
.map_err(OperationError::SchemaViolation)?;
|
||||
|
||||
let f_valid = f_intent_valid.clone().into_ignore_hidden();
|
||||
|
||||
let se = SearchEvent {
|
||||
ident: create_event.ident,
|
||||
filter: f_valid,
|
||||
filter_orig: f_intent_valid,
|
||||
// Return all attributes
|
||||
attrs: None,
|
||||
effective_access_check: false,
|
||||
};
|
||||
|
||||
let mut vs = self.search_ext(&se)?;
|
||||
match vs.pop() {
|
||||
Some(entry) if vs.is_empty() => entry.to_scim_kanidm(self),
|
||||
_ => {
|
||||
if vs.is_empty() {
|
||||
Err(OperationError::NoMatchingEntries)
|
||||
} else {
|
||||
// Multiple entries matched, should not be possible!
|
||||
Err(OperationError::UniqueConstraintViolation)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
pub fn scim_delete(&mut self, scim_delete: ScimDeleteEvent) -> Result<(), OperationError> {
|
||||
let ScimDeleteEvent {
|
||||
ident,
|
||||
target,
|
||||
class,
|
||||
} = scim_delete;
|
||||
|
||||
let filter_intent = filter!(f_eq(Attribute::Uuid, PartialValue::Uuid(target)));
|
||||
let f_intent_valid = filter_intent
|
||||
.validate(self.get_schema())
|
||||
.map_err(OperationError::SchemaViolation)?;
|
||||
|
||||
let filter = filter!(f_and!([
|
||||
f_eq(Attribute::Uuid, PartialValue::Uuid(target)),
|
||||
f_eq(Attribute::Class, class.into())
|
||||
]));
|
||||
let f_valid = filter
|
||||
.validate(self.get_schema())
|
||||
.map_err(OperationError::SchemaViolation)?;
|
||||
|
||||
let de = DeleteEvent {
|
||||
ident,
|
||||
filter: f_valid,
|
||||
filter_orig: f_intent_valid,
|
||||
};
|
||||
|
||||
self.delete(&de)
|
||||
}
|
||||
|
||||
pub(crate) fn resolve_scim_json_put(
|
||||
&mut self,
|
||||
attr: &Attribute,
|
||||
value: Option<JsonValue>,
|
||||
) -> Result<Option<ValueSet>, OperationError> {
|
||||
let schema = self.get_schema();
|
||||
// Lookup the attr
|
||||
let Some(schema_a) = schema.get_attributes().get(attr) else {
|
||||
// No attribute of this name exists - fail fast, there is no point to
|
||||
// proceed, as nothing can be satisfied.
|
||||
return Err(OperationError::InvalidAttributeName(attr.to_string()));
|
||||
};
|
||||
|
||||
let Some(value) = value else {
|
||||
// It's a none so the value needs to be unset, and the attr DOES exist in
|
||||
// schema.
|
||||
return Ok(None);
|
||||
};
|
||||
|
||||
self.resolve_scim_json(schema_a, value).map(Some)
|
||||
}
|
||||
|
||||
pub(crate) fn resolve_scim_json_post(
|
||||
&mut self,
|
||||
attr: &Attribute,
|
||||
value: JsonValue,
|
||||
) -> Result<ValueSet, OperationError> {
|
||||
let schema = self.get_schema();
|
||||
// Lookup the attr
|
||||
let Some(schema_a) = schema.get_attributes().get(attr) else {
|
||||
// No attribute of this name exists - fail fast, there is no point to
|
||||
// proceed, as nothing can be satisfied.
|
||||
return Err(OperationError::InvalidAttributeName(attr.to_string()));
|
||||
};
|
||||
|
||||
self.resolve_scim_json(schema_a, value)
|
||||
}
|
||||
|
||||
fn resolve_scim_json(
|
||||
&mut self,
|
||||
schema_a: &SchemaAttribute,
|
||||
value: JsonValue,
|
||||
) -> Result<ValueSet, OperationError> {
|
||||
let resolve_status = match schema_a.syntax {
|
||||
SyntaxType::Utf8String => ValueSetUtf8::from_scim_json_put(value),
|
||||
SyntaxType::Utf8StringInsensitive => ValueSetIutf8::from_scim_json_put(value),
|
||||
SyntaxType::Uuid => ValueSetUuid::from_scim_json_put(value),
|
||||
SyntaxType::Boolean => ValueSetBool::from_scim_json_put(value),
|
||||
SyntaxType::SyntaxId => ValueSetSyntax::from_scim_json_put(value),
|
||||
SyntaxType::IndexId => ValueSetIndex::from_scim_json_put(value),
|
||||
SyntaxType::ReferenceUuid => ValueSetRefer::from_scim_json_put(value),
|
||||
SyntaxType::Utf8StringIname => ValueSetIname::from_scim_json_put(value),
|
||||
SyntaxType::NsUniqueId => ValueSetNsUniqueId::from_scim_json_put(value),
|
||||
SyntaxType::DateTime => ValueSetDateTime::from_scim_json_put(value),
|
||||
SyntaxType::EmailAddress => ValueSetEmailAddress::from_scim_json_put(value),
|
||||
SyntaxType::Url => ValueSetUrl::from_scim_json_put(value),
|
||||
SyntaxType::OauthScope => ValueSetOauthScope::from_scim_json_put(value),
|
||||
SyntaxType::OauthScopeMap => ValueSetOauthScopeMap::from_scim_json_put(value),
|
||||
SyntaxType::OauthClaimMap => ValueSetOauthClaimMap::from_scim_json_put(value),
|
||||
SyntaxType::UiHint => ValueSetUiHint::from_scim_json_put(value),
|
||||
SyntaxType::CredentialType => ValueSetCredentialType::from_scim_json_put(value),
|
||||
SyntaxType::Certificate => ValueSetCertificate::from_scim_json_put(value),
|
||||
SyntaxType::SshKey => ValueSetSshKey::from_scim_json_put(value),
|
||||
SyntaxType::Uint32 => ValueSetUint32::from_scim_json_put(value),
|
||||
|
||||
// Not Yet ... if ever
|
||||
// SyntaxType::JsonFilter => ValueSetJsonFilter::from_scim_json_put(value),
|
||||
SyntaxType::JsonFilter => Err(OperationError::InvalidAttribute(
|
||||
"Json Filters are not able to be set.".to_string(),
|
||||
)),
|
||||
// Can't be set currently as these are only internally generated for key-id's
|
||||
// SyntaxType::HexString => ValueSetHexString::from_scim_json_put(value),
|
||||
SyntaxType::HexString => Err(OperationError::InvalidAttribute(
|
||||
"Hex strings are not able to be set.".to_string(),
|
||||
)),
|
||||
|
||||
// Can't be set until we have better error handling in the set paths
|
||||
// SyntaxType::Image => ValueSetImage::from_scim_json_put(value),
|
||||
SyntaxType::Image => Err(OperationError::InvalidAttribute(
|
||||
"Images are not able to be set.".to_string(),
|
||||
)),
|
||||
|
||||
// Can't be set yet, mostly as I'm lazy
|
||||
// SyntaxType::WebauthnAttestationCaList => {
|
||||
// ValueSetWebauthnAttestationCaList::from_scim_json_put(value)
|
||||
// }
|
||||
SyntaxType::WebauthnAttestationCaList => Err(OperationError::InvalidAttribute(
|
||||
"Webauthn Attestation Ca Lists are not able to be set.".to_string(),
|
||||
)),
|
||||
|
||||
// Syntax types that can not be submitted
|
||||
SyntaxType::Credential => Err(OperationError::InvalidAttribute(
|
||||
"Credentials are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::SecretUtf8String => Err(OperationError::InvalidAttribute(
|
||||
"Secrets are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::SecurityPrincipalName => Err(OperationError::InvalidAttribute(
|
||||
"SPNs are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::Cid => Err(OperationError::InvalidAttribute(
|
||||
"CIDs are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::PrivateBinary => Err(OperationError::InvalidAttribute(
|
||||
"Private Binaries are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::IntentToken => Err(OperationError::InvalidAttribute(
|
||||
"Intent Tokens are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::Passkey => Err(OperationError::InvalidAttribute(
|
||||
"Passkeys are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::AttestedPasskey => Err(OperationError::InvalidAttribute(
|
||||
"Attested Passkeys are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::Session => Err(OperationError::InvalidAttribute(
|
||||
"Sessions are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::JwsKeyEs256 => Err(OperationError::InvalidAttribute(
|
||||
"Jws ES256 Private Keys are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::JwsKeyRs256 => Err(OperationError::InvalidAttribute(
|
||||
"Jws RS256 Private Keys are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::Oauth2Session => Err(OperationError::InvalidAttribute(
|
||||
"Sessions are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::TotpSecret => Err(OperationError::InvalidAttribute(
|
||||
"TOTP Secrets are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::ApiToken => Err(OperationError::InvalidAttribute(
|
||||
"API Tokens are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::AuditLogString => Err(OperationError::InvalidAttribute(
|
||||
"Audit Strings are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::EcKeyPrivate => Err(OperationError::InvalidAttribute(
|
||||
"EC Private Keys are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::KeyInternal => Err(OperationError::InvalidAttribute(
|
||||
"Key Internal Structures are not able to be set.".to_string(),
|
||||
)),
|
||||
SyntaxType::ApplicationPassword => Err(OperationError::InvalidAttribute(
|
||||
"Application Passwords are not able to be set.".to_string(),
|
||||
)),
|
||||
}?;
|
||||
|
||||
match resolve_status {
|
||||
ValueSetResolveStatus::Resolved(vs) => Ok(vs),
|
||||
ValueSetResolveStatus::NeedsResolution(vs_inter) => {
|
||||
self.resolve_valueset_intermediate(vs_inter)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
|
|
|
|||
|
|
@ -238,6 +238,13 @@ impl ValueSetScimPut for ValueSetRefer {
|
|||
fn from_scim_json_put(value: JsonValue) -> Result<ValueSetResolveStatus, OperationError> {
|
||||
use kanidm_proto::scim_v1::client::{ScimReference, ScimReferences};
|
||||
|
||||
// May be a single reference, lets wrap it in an array to proceed.
|
||||
let value = if !value.is_array() && value.is_object() {
|
||||
JsonValue::Array(vec![value])
|
||||
} else {
|
||||
value
|
||||
};
|
||||
|
||||
let scim_refs: ScimReferences = serde_json::from_value(value).map_err(|err| {
|
||||
warn!(?err, "Invalid SCIM reference set syntax");
|
||||
OperationError::SC0002ReferenceSyntaxInvalid
|
||||
|
|
|
|||
|
|
@ -1,5 +1,10 @@
|
|||
use kanidmd_testkit::AsyncTestEnvironment;
|
||||
use kanidm_proto::scim_v1::client::{ScimEntryApplicationPost, ScimReference};
|
||||
use kanidmd_testkit::{AsyncTestEnvironment, IDM_ADMIN_TEST_PASSWORD, IDM_ADMIN_TEST_USER};
|
||||
use ldap3_client::LdapClientBuilder;
|
||||
use tracing::debug;
|
||||
|
||||
const TEST_PERSON: &str = "user_mcuserton";
|
||||
const TEST_GROUP: &str = "group_mcgroupington";
|
||||
|
||||
#[kanidmd_testkit::test(ldap = true)]
|
||||
async fn test_ldap_basic_unix_bind(test_env: &AsyncTestEnvironment) {
|
||||
|
|
@ -14,3 +19,75 @@ async fn test_ldap_basic_unix_bind(test_env: &AsyncTestEnvironment) {
|
|||
|
||||
assert_eq!(whoami, Some("u: anonymous@localhost".to_string()));
|
||||
}
|
||||
|
||||
#[kanidmd_testkit::test(ldap = true)]
|
||||
async fn test_ldap_application_password_basic(test_env: &AsyncTestEnvironment) {
|
||||
const APPLICATION_1_NAME: &str = "test_application_1";
|
||||
|
||||
// Remember, this isn't the exhaustive test for application password behaviours,
|
||||
// those are in the main server. This is just a basic smoke test that the interfaces
|
||||
// are exposed and work in a basic manner.
|
||||
|
||||
let idm_admin_rsclient = test_env.rsclient.new_session().unwrap();
|
||||
|
||||
// Create a person
|
||||
|
||||
idm_admin_rsclient
|
||||
.auth_simple_password(IDM_ADMIN_TEST_USER, IDM_ADMIN_TEST_PASSWORD)
|
||||
.await
|
||||
.expect("Failed to login as admin");
|
||||
|
||||
idm_admin_rsclient
|
||||
.idm_person_account_create(TEST_PERSON, TEST_PERSON)
|
||||
.await
|
||||
.expect("Failed to create the user");
|
||||
|
||||
idm_admin_rsclient
|
||||
.idm_group_create(TEST_GROUP, None)
|
||||
.await
|
||||
.expect("Failed to create test group");
|
||||
|
||||
// Create two applications
|
||||
|
||||
let application_1 = ScimEntryApplicationPost {
|
||||
name: APPLICATION_1_NAME.to_string(),
|
||||
displayname: APPLICATION_1_NAME.to_string(),
|
||||
linked_group: ScimReference::from(TEST_GROUP),
|
||||
};
|
||||
|
||||
let application_entry = idm_admin_rsclient
|
||||
.idm_application_create(&application_1)
|
||||
.await
|
||||
.expect("Failed to create the user");
|
||||
|
||||
debug!(?application_entry);
|
||||
|
||||
// List, get them.
|
||||
|
||||
// Login as the person
|
||||
|
||||
// Create application passwords
|
||||
|
||||
// Check the work.
|
||||
|
||||
// Check they can't cross talk.
|
||||
|
||||
// Done!
|
||||
|
||||
// let ldap_url = test_env.ldap_url.as_ref().unwrap();
|
||||
|
||||
// let mut ldap_client = LdapClientBuilder::new(ldap_url).build().await.unwrap();
|
||||
|
||||
let result = idm_admin_rsclient
|
||||
.idm_application_delete(APPLICATION_1_NAME)
|
||||
.await
|
||||
.expect("Failed to create the user");
|
||||
|
||||
debug!(?result);
|
||||
|
||||
// Delete the applications
|
||||
|
||||
// Check that you can no longer bind.
|
||||
|
||||
// They no longer list
|
||||
}
|
||||
|
|
|
|||
|
|
@ -24,7 +24,7 @@ libc = { workspace = true }
|
|||
lazy_static = { workspace = true }
|
||||
|
||||
[target."cfg(target_os = \"freebsd\")".build-dependencies]
|
||||
cc = "^1.2.10"
|
||||
cc = "^1.2.22"
|
||||
|
||||
## Debian packaging
|
||||
[package.metadata.deb]
|
||||
|
|
|
|||
Loading…
Reference in a new issue