Repository navigation
MM-5 Enhance Delinea Secret Server Migration: Phase one - #2478
Open
ajaiswal-ks wants to merge 6 commits into
Open
ajaiswal-ks wants to merge 6 commits into
ajaiswal-ks wants to merge 6 commits into
Conversation
…2464) * MM-26 Added functionality for interactive safe selection * MM-26 improved time complexity, added edge cases to test case * MM-26 decoupled input prompts on non-interactive environments * MM-26 added _load_folders helper function, to avoid logical branching
* MM-25 Added Create users functionality in delinea import Added a new flag "--add-thycotic-users" to create users. Added test cases for create users functionality. * MM-25 Enhanced Dry-Run to display a preview of user details eligible for migration. Removed reporting mechanism. Added error handling to continue processing remaining users if a single user fetch fails. * MM-25 implemented add-users as common flag. Improved error handling. Optimized user email extractor function. Updated test cases. * MM-25 removed dependency on global variable, instead added function to check if format supports add users functionality or not.
#2461) * Add support for thycotic(Delinea) restricted secrets and implement related tests * Enhance Thycotic secret handling with improved error reporting and access parameters * Refactor ThycoticImporter to remove redundant attachment list checks * Refactor error logging in ThycoticAuth to simplify response handling * Add secret retrieval handling in ImportFolderSelectionTests * Enhance secret lookup functionality to include restricted secrets and improve response handling * Add support for retrieving secret IDs with restricted access in ThycoticMixin * Refactor ThycoticMixin to deduplicate folder IDs in secret ID lookup and update tests for improved query handling * Improve Thycotic secret handling: log warnings for legacy queries, refine error handling, and enhance logging for attachment imports * Add SSH key validation limits and improve query parameter handling
…#2463) * Updated thycotic importer to add support for secrets level permission inside keeper * MM-28 Address review feedback on secret-level permissions - Normalize Delinea/Keeper folder paths (both separators) for record matching - Index Keeper records once in locate_secret_share_records - Use url_from_tenant when parsing user@host import targets - Wrap per-user detail fetch in try/except - Direct emailAddress/emailaddress lookup; dict lookup for existing users - Replace print with logging Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * MM-28 Cache folder permissions and skip secrets whose fetch fails - Cache folder-permission rows per folder so secrets in the same folder do not refetch them (failed fetches are not cached) - Log and skip a secret whose permission fetch fails instead of aborting the whole load; report the skipped count at the end Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * MM-28 Add tests for failures, invalid data and edge cases - External call failures: secret, lookup, secret/folder permissions, user detail, Keeper user load and create - _create_enterprise_users outcomes: existing, duplicate, invalid, failed, name fallback - Invalid permission rows, email extraction, folder walk cycles, path normalization and tenant URL parsing Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * MM-28 Handle share records in multiple folders; fix user report - Apply the --folder prefix to every folder of a share record, matching the main import (an empty path becomes the prefix) - locate_secret_share_records looks the record up in each of its folders - Membership dedupe key uses all folder paths, not just the first - Remove a stale user-creation loop left in _print_thycotic_user_report by the mm-5-phase-one merge (NameError on any non-empty report) * MM-28 Warn about secret roles that cannot be mapped to Keeper Custom Secret Server roles are still skipped rather than guessed. Each affected secret now logs the role names so the admin can share those users manually, with a total at the end of the load. * MM-28 Retry on rate limits, handle non-JSON errors, split iter_secret_shares - Secret Server GETs retry on 429 up to 3 times, waiting the larger of Retry-After (capped at 300s) and 5s exponential backoff, same pattern as the Keeper API throttle retry - Error responses that are not JSON (proxy or HTML pages) now raise or log "HTTP <status>" instead of a JSON decode error, in login, token refresh, search and entity fetch - iter_secret_shares: move custom-role warning, folder path lookup and record building into helpers; skip unnamed secrets before loading groups; correct the "no permission lists" warning text - Document how group permissions are flattened into per-user shares * MM-28 Load secret permissions in bulk and with a bounded worker pool - One paged GET /v1/secret-permissions (no secretId filter) grouped by secretId replaces a request per secret; falls back to per-secret requests if the bulk call fails or returns nothing - Secret reads run on a small worker pool (download-membership --workers, default 4, 1-16; 1 runs on the calling thread). At most workers * 2 requests are queued, results keep lookup order, and stopping early cancels queued work - Group lookup and record building stay on the calling thread - ensure_auth_token is locked so parallel requests refresh an expired token once instead of reusing a rotated refresh token * MM-28 Lock the shared folder cache, un-nest helpers, log skipped records - FolderPermissionCache: folder permission rows shared by the worker threads are read and written under a lock; first write wins and failed fetches are still not cached - Replace nested functions with methods: _secret_permission_rows, _fetch_secret_entry (worker task), _user_outcome, and module-level _share_record_key in commands - locate_secret_share_records logs a record listed more than once under the same path, and counts records that could not be read --------- Co-authored-by: Shashwat Tripathi <stripathimail@keepersecurity.com>
#2477) * MM-27 Added `"add-teams"` flag to support creating keeper teams in delinea import Added test cases for add teams feature * MM-27 added a function which was missed while resolving merge conflicts * MM-27 Updated logic of check if user already exists in keeper team. Updated test cases accordingly. * add url func call --------- Co-authored-by: ajaiswal-ks <ajaiswal@keepersecurity.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This feature PR implements