Repository navigation
MM-27 added team creation and user assignment functionality in deline… - #2472
mkanadi-ks wants to merge 1 commit into
Conversation
| f'/v1/secrets/lookup?filter.folderId={folder_id}' | ||
| f'&filter.includeSubFolders=true&filter.includeRestricted={restricted}' | ||
| ) | ||
|
|
| self._create_enterprise_users(params, thycotic_users) | ||
|
|
||
| def _prepare_thycotic_groups(self, auth): # type: (ThycoticAuth) -> List[dict] | ||
| """Fetch enabled Delinea groups and their direct user members. |
There was a problem hiding this comment.
on a broader system level, we should also separate this team management part into a separate module or mixin, this should not be tightly coupled to thycotic
| ec_private_key, ec_public_key = crypto.generate_ec_key() | ||
| request['ecc_private_key'] = utils.base64_url_encode( | ||
| crypto.encrypt_aes_v2(crypto.unload_ec_private_key(ec_private_key), team_key)) | ||
| request['ecc_public_key'] = utils.base64_url_encode(crypto.unload_ec_public_key(ec_public_key)) | ||
| if not getattr(params, 'forbid_rsa', False): | ||
| rsa_private_key, rsa_public_key = crypto.generate_rsa_key() | ||
| request['private_key'] = utils.base64_url_encode( | ||
| crypto.encrypt_aes_v1(crypto.unload_rsa_private_key(rsa_private_key), team_key)) | ||
| request['public_key'] = utils.base64_url_encode(crypto.unload_rsa_public_key(rsa_public_key)) |
There was a problem hiding this comment.
would be better to separate the crypto things from here
we should not tightly couple it
also the json assembly
these should be common abstractions, not tied to any single lifecycle
There was a problem hiding this comment.
created seperated helper function for this
| return { | ||
| 'added': added, | ||
| 'queued': queued, | ||
| 'already': already_count, | ||
| 'missing': len(missing), | ||
| 'failed': failed, | ||
| } |
There was a problem hiding this comment.
would a dataclass work better here?
| user_ids = [] | ||
| if (group.get('memberCount') or 0) > 0: | ||
| try: | ||
| member_rs = auth.thycotic_search(f'/v1/groups/{group_id}/users') |
There was a problem hiding this comment.
if this fails, we should stop, else we create empty teams on keeper
There was a problem hiding this comment.
updated logic so that Empty teams wont be created if user fetch fails
| logging.warning('\'%s\' team is not created: %s', name, message or 'no response') | ||
| if created: | ||
| try: | ||
| api.query_enterprise(params) |
There was a problem hiding this comment.
don't you already call this in load existing users?
can we avoid duplicate calls? or is it needed?
| try: | ||
| request, team_key = self._build_team_add_request(params, name, node_id) | ||
| except Exception as e: | ||
| logging.warning('Could not prepare Keeper team "%s": %s', name, e) | ||
| continue |
There was a problem hiding this comment.
yes, that is an error
but if it's encryption key missing error
we will continue to process and fail while looping
it's better to fail faster
There was a problem hiding this comment.
Handled this with MissingTeamEncryptionKey
f058402 to
299e133
Compare
bb7cdc2 to
da2cbb7
Compare
da2cbb7 to
299e133
Compare
Summary
Adds a feature of team creation and user assignment in delinea import
Changes
Added
"--add-teams"flag to enable team creation during import.Implemented comprehensive test cases for the new team creation logic.