Struct kanidmd_lib::idm::server::IdmServerProxyReadTransaction

pub struct IdmServerProxyReadTransaction<'a> {
    pub qs_read: QueryServerReadTransaction<'a>,
    /* private fields */
}

This contains read-only methods, like getting users, groups and other structured content.

Fields

qs_read: QueryServerReadTransaction<'a>

Implementations

impl<'a> IdmServerProxyReadTransaction<'a>

pub fn account_list_user_auth_tokens(
    &self,
    lte: &ListUserAuthTokenEvent
) -> Result<Vec<UatStatus>, OperationError>

impl<'a> IdmServerProxyReadTransaction<'a>

pub fn list_applinks(
    &self,
    ident: &Identity
) -> Result<Vec<AppLink>, OperationError>

impl<'a> IdmServerProxyReadTransaction<'a>

pub fn scim_sync_get_state(
    &self,
    ident: &Identity
) -> Result<ScimSyncState, OperationError>

impl<'a> IdmServerProxyReadTransaction<'a>

pub fn get_radiusauthtoken(
    &mut self,
    rate: &RadiusAuthTokenEvent,
    ct: Duration
) -> Result<RadiusAuthToken, OperationError>

pub fn get_unixusertoken(
    &mut self,
    uute: &UnixUserTokenEvent,
    ct: Duration
) -> Result<UnixUserToken, OperationError>

pub fn get_unixgrouptoken(
    &mut self,
    uute: &UnixGroupTokenEvent
) -> Result<UnixGroupToken, OperationError>

pub fn get_credentialstatus(
    &mut self,
    cse: &CredentialStatusEvent
) -> Result<CredentialStatus, OperationError>

pub fn get_backup_codes(
    &mut self,
    rbce: &ReadBackupCodeEvent
) -> Result<BackupCodesView, OperationError>

pub fn check_oauth2_authorisation(
    &self,
    ident: &Identity,
    uat: &UserAuthToken,
    auth_req: &AuthorisationRequest,
    ct: Duration
) -> Result<AuthoriseResponse, Oauth2Error>

pub fn check_oauth2_authorise_permit(
    &self,
    ident: &Identity,
    uat: &UserAuthToken,
    consent_req: &str,
    ct: Duration
) -> Result<AuthorisePermitSuccess, OperationError>

pub fn check_oauth2_authorise_reject(
    &self,
    ident: &Identity,
    uat: &UserAuthToken,
    consent_req: &str,
    ct: Duration
) -> Result<Url, OperationError>

pub fn check_oauth2_token_exchange(
    &self,
    client_authz: Option<&str>,
    token_req: &AccessTokenRequest,
    ct: Duration
) -> Result<AccessTokenResponse, Oauth2Error>

pub fn check_oauth2_token_introspect(
    &self,
    client_authz: &str,
    intr_req: &AccessTokenIntrospectRequest,
    ct: Duration
) -> Result<AccessTokenIntrospectResponse, Oauth2Error>

pub fn oauth2_openid_userinfo(
    &self,
    client_id: &str,
    client_authz: &str,
    ct: Duration
) -> Result<OidcToken, Oauth2Error>

pub fn oauth2_openid_discovery(
    &self,
    client_id: &str
) -> Result<OidcDiscoveryResponse, OperationError>

pub fn oauth2_openid_publickey(
    &self,
    client_id: &str
) -> Result<JwkKeySet, OperationError>

impl<'a> IdmServerProxyReadTransaction<'a>

pub fn service_account_list_api_token(
    &self,
    lte: &ListApiTokenEvent
) -> Result<Vec<ApiToken>, OperationError>

Trait Implementations

impl<'a> IdmServerTransaction<'a> for IdmServerProxyReadTransaction<'a>

type QsTransactionType = QueryServerReadTransaction<'a>

fn get_qs_txn(&self) -> &Self::QsTransactionType

fn get_uat_validator_txn(&self) -> &JwsValidator

fn validate_and_parse_token_to_ident(
    &self,
    token: Option<&str>,
    ct: Duration
) -> Result<Identity, OperationError>

This is the preferred method to transform and securely verify a token into an identity that can be used for operations and access enforcement. This function is aware of the various classes of tokens that may exist, and can appropriately check them.

fn validate_and_parse_token_to_uat(
    &self,
    token: Option<&str>,
    ct: Duration
) -> Result<UserAuthToken, OperationError>

fn validate_and_parse_token_to_token(
    &self,
    token: Option<&str>,
    ct: Duration
) -> Result<Token, OperationError>

fn validate_and_parse_uat(
    &self,
    token: Option<&str>,
    ct: Duration
) -> Result<UserAuthToken, OperationError>

fn check_oauth2_account_uuid_valid(
    &self,
    uuid: Uuid,
    session_id: Uuid,
    parent_session_id: Uuid,
    iat: i64,
    ct: Duration
) -> Result<Option<Account>, OperationError>

fn process_uat_to_identity(
    &self,
    uat: &UserAuthToken,
    ct: Duration
) -> Result<Identity, OperationError>

For any event/operation to proceed, we need to attach an identity to the event for security and access processing. When that event is externally triggered via one of our various api layers, we process some type of account token into this identity. In the current server this is the UserAuthToken. For a UserAuthToken to be provided it MUST have been cryptographically verified meaning it is now a trusted source of data that we previously issued.

fn process_apit_to_identity(
    &self,
    apit: &ApiToken,
    entry: Arc<EntrySealedCommitted>,
    ct: Duration
) -> Result<Identity, OperationError>

fn validate_ldap_session(
    &self,
    session: &LdapSession,
    ct: Duration
) -> Result<Identity, OperationError>

fn validate_and_parse_sync_token_to_ident(
    &self,
    token: Option<&str>,
    ct: Duration
) -> Result<Identity, OperationError>