All Data Structures Files Functions Variables Typedefs Enumerations Enumerator Friends Macros Groups Pages
as_admin.h
Go to the documentation of this file.
1 /*
2  * Copyright 2008-2016 Aerospike, Inc.
3  *
4  * Portions may be licensed to Aerospike, Inc. under one or more contributor
5  * license agreements.
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License"); you may not
8  * use this file except in compliance with the License. You may obtain a copy of
9  * the License at http://www.apache.org/licenses/LICENSE-2.0
10  *
11  * Unless required by applicable law or agreed to in writing, software
12  * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13  * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14  * License for the specific language governing permissions and limitations under
15  * the License.
16  */
17 #pragma once
18 
19 #include <aerospike/aerospike.h>
20 #include <aerospike/as_config.h>
21 #include <aerospike/as_key.h>
22 
23 #ifdef __cplusplus
24 extern "C" {
25 #endif
26 
27 /******************************************************************************
28  * MACROS
29  *****************************************************************************/
30 
31 /**
32  * Maximum size of role string including null byte.
33  */
34 #define AS_ROLE_SIZE 32
35 
36 /******************************************************************************
37  * TYPES
38  *****************************************************************************/
39 
40 /**
41  * Permission codes define the type of permission granted for a user's role.
42  */
43 typedef enum as_privilege_code_e {
44  /**
45  * User can edit/remove other users. Global scope only.
46  */
48 
49  /**
50  * User can perform systems administration functions on a database that do not involve user
51  * administration. Examples include setting dynamic server configuration.
52  * Global scope only.
53  */
55 
56  /**
57  * User can perform data administration functions on a database that do not involve user
58  * administration. Examples include create/drop index and user defined functions.
59  * Global scope only.
60  */
62 
63  /**
64  * User can read data only.
65  */
67 
68  /**
69  * User can read and write data.
70  */
72 
73  /**
74  * User can read and write data through user defined functions.
75  */
78 
79 /**
80  * User privilege.
81  */
82 typedef struct as_privilege_s {
83  /**
84  * Namespace scope. Apply permission to this null terminated namespace only.
85  * If string length is zero, the privilege applies to all namespaces.
86  */
88 
89  /**
90  * Set name scope. Apply permission to this null terminated set within namespace only.
91  * If string length is zero, the privilege applies to all sets within namespace.
92  */
94 
95  /**
96  * Privilege code.
97  */
99 } as_privilege;
100 
101 /**
102  * Role definition.
103  */
104 typedef struct as_role_s {
105  /**
106  * Role name.
107  */
108  char name[AS_ROLE_SIZE];
109 
110  /**
111  * Length of privileges array.
112  */
114 
115  /**
116  * Array of assigned privileges.
117  */
118  as_privilege privileges[];
119 } as_role;
120 
121 /**
122  * User and assigned roles.
123  */
124 typedef struct as_user_s {
125  /**
126  * User name.
127  */
128  char name[AS_USER_SIZE];
129 
130  /**
131  * Length of roles array.
132  */
134 
135  /**
136  * Array of assigned role names.
137  */
138  char roles[][AS_ROLE_SIZE];
139 } as_user;
140 
141 /******************************************************************************
142  * FUNCTIONS
143  ******************************************************************************/
144 
145 /**
146  * Create user with password and roles. Clear-text password will be hashed using bcrypt before
147  * sending to server.
148  */
149 as_status
150 aerospike_create_user(aerospike* as, as_error* err, const as_policy_admin* policy, const char* user_name, const char* password, const char** roles, int roles_size);
151 
152 /**
153  * Remove user from cluster.
154  */
155 as_status
156 aerospike_drop_user(aerospike* as, as_error* err, const as_policy_admin* policy, const char* user_name);
157 
158 /**
159  * Set user's password by user administrator. Clear-text password will be hashed using bcrypt before sending to server.
160  */
161 as_status
162 aerospike_set_password(aerospike* as, as_error* err, const as_policy_admin* policy, const char* user_name, const char* password);
163 
164 /**
165  * Change user's password by user. Clear-text password will be hashed using bcrypt before sending to server.
166  */
167 as_status
168 aerospike_change_password(aerospike* as, as_error* err, const as_policy_admin* policy, const char* user_name, const char* password);
169 
170 /**
171  * Add role to user's list of roles.
172  */
173 as_status
174 aerospike_grant_roles(aerospike* as, as_error* err, const as_policy_admin* policy, const char* user_name, const char** roles, int roles_size);
175 
176 /**
177  * Remove role from user's list of roles.
178  */
179 as_status
180 aerospike_revoke_roles(aerospike* as, as_error* err, const as_policy_admin* policy, const char* user_name, const char** roles, int roles_size);
181 
182 /**
183  * Create user defined role.
184  */
185 as_status
186 aerospike_create_role(aerospike* as, as_error* err, const as_policy_admin* policy, const char* role, as_privilege** privileges, int privileges_size);
187 
188 /**
189  * Delete user defined role.
190  */
191 as_status
192 aerospike_drop_role(aerospike* as, as_error* err, const as_policy_admin* policy, const char* role);
193 
194 /**
195  * Add specified privileges to user.
196  */
197 as_status
198 aerospike_grant_privileges(aerospike* as, as_error* err, const as_policy_admin* policy, const char* role, as_privilege** privileges, int privileges_size);
199 
200 /**
201  * Remove specified privileges from user.
202  */
203 as_status
204 aerospike_revoke_privileges(aerospike* as, as_error* err, const as_policy_admin* policy, const char* role, as_privilege** privileges, int privileges_size);
205 
206 /**
207  * Retrieve roles for a given user.
208  * When successful, as_user_destroy() must be called to free resources.
209  */
210 as_status
211 aerospike_query_user(aerospike* as, as_error* err, const as_policy_admin* policy, const char* user_name, as_user** user);
212 
213 /**
214  * Release as_user_roles memory.
215  */
216 void
217 as_user_destroy(as_user* user);
218 
219 /**
220  * Retrieve all users and their roles.
221  * When successful, as_users_destroy() must be called to free resources.
222  */
223 as_status
224 aerospike_query_users(aerospike* as, as_error* err, const as_policy_admin* policy, as_user*** users, int* users_size);
225 
226 /**
227  * Release memory for as_user_roles array.
228  */
229 void
230 as_users_destroy(as_user** users, int users_size);
231 
232 /**
233  * Retrieve role definition for a given role name.
234  * When successful, as_role_destroy() must be called to free resources.
235  */
236 as_status
237 aerospike_query_role(aerospike* as, as_error* err, const as_policy_admin* policy, const char* role_name, as_role** role);
238 
239 /**
240  * Release as_role memory.
241  */
242 void
243 as_role_destroy(as_role* role);
244 
245 /**
246  * Retrieve all roles and their privileges.
247  * When successful, as_roles_destroy() must be called to free resources.
248  */
249 as_status
250 aerospike_query_roles(aerospike* as, as_error* err, const as_policy_admin* policy, as_role*** roles, int* roles_size);
251 
252 /**
253  * Release memory for as_role array.
254  */
255 void
256 as_roles_destroy(as_role** roles, int roles_size);
257 
258 /**
259  * @private
260  * Authenticate user with a server node. This is done automatically after socket open.
261  * Do not use this method directly.
262  */
263 as_status
264 as_authenticate(as_error* err, int fd, const char* user, const char* credential, uint64_t deadline_ms);
265 
266 /**
267  * @private
268  * Write authentication command to buffer. Return buffer length.
269  */
270 uint32_t
271 as_authenticate_set(const char* user, const char* credential, uint8_t* buffer);
272 
273 #ifdef __cplusplus
274 } // end extern "C"
275 #endif