High-level client interface to Aserto's APIs.
The client can be used for interacting with Aserto's Authorizer service.
pip install asertopoetry add asertofromaserto.clientimportAuthorizerOptions, Identityfromaserto.client.authorizerimportAuthorizerClientclient=AuthorizerClient(
identity=Identity(type="NONE"),
options=AuthorizerOptions(
api_key=ASERTO_API_KEY,
tenant_id=ASERTO_TENANT_ID,
),
)
result=awaitclient.decision_tree(
decisions=["visible", "enabled", "allowed"],
policy_instance_name=ASERTO_POLICY_INSTANCE_NAME,
policy_instance_label=ASERTO_POLICY_INSTANCE_LABEL,
policy_path_root=ASERTO_POLICY_PATH_ROOT,
policy_path_separator="DOT",
)
assertresult== {
"GET.your.policy.path": {
"visible": True,
"enabled": True,
"allowed": False,
},
}The Directory APIs can be used to interact with the aserto directory services. It provides CRUD operations on objects and relations, including bulk import and export. The client can also be used to check whether a user has a permission or relation on an object instance.
You can initialize a directory client as follows:
fromaserto.client.directory.v3importDirectoryds=Directory(api_key="my_api_key", tenant_id="1234", address="localhost:9292")address: hostname:port of directory service (required)api_key: API key for directory service (required if using hosted directory)tenant_id: Aserto tenant ID (required if using hosted directory)cert: Path to the grpc service certificate when connecting to local topaz instance.
Get a directory object instance with the type and the id, optionally with the object's relations.
# without relations:user=ds.get_object(object_type="user", object_id="euang@acmecorp.com")
# with relations:page=PaginationRequest(size=10)
whileTrue:
resp=ds.get_object(object_type="user", object_id="euang@acmecorp.com", with_relations=True, page=page)
user=resp.result# The returned object.relations_page=resp.relations# A page of relations.ifnotresp.page.next_token:
# we've reached the last page.break# request the next page.page.token=resp.page.next_tokenSimilar to get_object but can retrieve multiple object instances in a single request.
objects=ds.get_object_many(
[
ObjectIdentifier(type="user", id="euan@acmecorp.com"),
ObjectIdentifier(type="group", id="marketing"),
]
)Get object instances with an object type type pagination info (page size and pagination token).
fromaserto.client.directory.v3importPaginationRequestusers=ds.get_objects(object_type="user", page=PaginationRequest(size=10))Create an object instance with the specified properties. If an etag is specified and is different from the current
object's etag, the call raises an ETagMismatchError.
# pass object fields as arguments:user=ds.set_object(
object_type="user",
object_id="new-user@acmecorp.com",
display_name="John Doe",
"properties": {"active": True, "department": "Engineering"},
}
# set_object can also take an Object parameter:user.display_name="Jane Doe"user.properties["title"] ="Senior Engineer"updated_user=ds.set_object(object=user)Delete an object instance and optionally its relations, using its type and id:
# delete an objectds.delete_object(object_type="user", object_id="test-object")
# delete an object and all its relationsds.delete_object(object_type="user", object_id="test-object", with_relations=True)Retrieve a single relation from the directory or raise a NotFoundError if no matching relation exists.
# get the manager of euang@acmecorp.com:relation=ds.get_relation(
object_type="user",
relation="manager",
subject_type="user",
subject_id="euang@acmecorp.com",
)
assertrelation.object_id# include the relation's object and subject in the response:response=ds.get_relation(
object_type="user",
relation="manager",
subject_type="user",
subject_id="euang@acmecorp.com",
with_relations=True,
)
assertresponse.relation.object_idassertresponse.subject.display_name=="Euan Garden"assertresponse.object.properties["department"] =="Sales"#Searches the directory for relations matching the specified criteria, optionally including the object and subject of each returned relation.
# find all groups a user is a member of:page=PaginationRequest(size=10)
whileTrue:
response=ds.get_relations(
object_type="group",
"relation"="member",
"subject_type": "user",
"subject_id": "euang@acmecorp.com",
with_objects=True,
page=page,
)
ifnotresponse.page.next_token:
breakpage.token=response.page.next_tokenCreate a new relation.
ds.set_relation(
object_type="group",
object_id="admin",
relation="member",
subject_type="user",
subject_id="euang@acmecorp.com",
)Delete a relation.
ds.delete_relation(
object_type="group",
object_id="admin",
relation="member",
subject_type="user",
subject_id="euang@acmecorp.com",
)Check if a subject has a given relation or permission on an object.
allowed=ds.check(
object_type="folder",
object_id="/path/to/folder",
relation="can_delete",
subject_type="user",
subject_id="euang@acmecorp.com",
)Find subjects that have a given relation to or permission on a specified object.
reponse=ds.find_subjects(
object_type="folder",
object_id="/path/to/folder",
relation="can_delete",
subject_type="user"
)
assertObjectIdentifier("user", "euang@acmecorp.com") inresponse.resultsFind objects that a given subject has a specified relation to or permission on.
reponse=ds.find_objects(
object_type="folder",
relation="can_delete",
subject_type="user"subjecct_id="euang@acmecorp.com"
)
assertObjectIdentifier("folder", "/path/to/folder") inresponse.resultsDownload the directory manifest.
manifest=ds.get_manifest()
print(manifest.body) # yaml manifest# conditionally get the manifest if its etag has changednew_manifest=ds.get_manifest(etag=manifest.etag)
assertnew_manifestisNone# the manifest hasn't changedUpload a new directory manifest.
withopen("manifest.yaml", "rb") asf:
manifest=f.read()
ds.set_manifest(manifest)Bulk-insert objects and/or relations to the directory. Returns a summary of the number of objects/relations affected.
# import an object and a relation.data= [
Object(type="user", id="test@acmecorp.com"),
Relation(
object_type="user",
object_id="euang@acmecorp.com",
relation="manager",
subject_type="user",
subject_id="test@acmecorp.com",
),
]
response=ds.import_data(data)
assertresponse.objects.set==1assertresponse.object.error==0assertresponse.relations.set==1assertresponse.relations.error==0Bulk-retrieve objects and/or relations from the directory.
fromaserto.client.directory.v3importExportOption, Object, Relation# export all objects and relationsforiteminds.export(ExportOption.OPTION_DATA):
ifisinstance(item, Object):
print("object:", item)
elifisinstance(item, Relation):
print("relation:", item)You can initialize an asynchronous directory client as follows:
fromaserto.client.directory.v3.aioimportDirectoryds=Directory(api_key="my_api_key", tenant_id="1234", address="localhost:9292")The methods on the async directory have the same signatures as their synchronous counterparts.
This project is licensed under the MIT license. See the LICENSE file for more info.