Package: aserto
Aserto API clientHigh-level client interface to Aserto's APIs.AuthorizerThe client can be used for interacting with Aserto'sAuthorizer service.InstallationUsing PippipinstallasertoUsing PoetrypoetryaddasertoUsagefromaserto.clientimportAuthorizerOptions,Identityfromaserto.client.authorizerimportAuthorizerClientclient=AuthorizerClient(identity=Identity(type="NONE"),options=AuthorizerOptions(api_key=ASERTO_API_KEY,tenant_id=ASERTO_TENANT_ID,),)result=awaitclient.decision_tree(decisions=["visible","enabled","allowed"],policy_instance_name=ASERTO_POLICY_INSTANCE_NAME,policy_instance_label=ASERTO_POLICY_INSTANCE_LABEL,policy_path_root=ASERTO_POLICY_PATH_ROOT,policy_path_separator="DOT",)assertresult=={"GET.your.policy.path":{"visible":True,"enabled":True,"allowed":False,},}DirectoryThe Directory APIs can be used to interact with the aserto directory services.
It provides CRUD operations on objects and relations, including bulk import and export.
The client can also be used to check whether a user has a permission or relation on an object instance.Directory ClientYou can initialize a directory client as follows:fromaserto.client.directory.v3importDirectoryds=Directory(api_key="my_api_key",tenant_id="1234",address="localhost:9292")address: hostname:port of directory service (required)api_key: API key for directory service (requiredif using hosted directory)tenant_id: Aserto tenant ID (requiredif using hosted directory)cert: Path to the grpc service certificate when connecting to local topaz instance.get_objectGet a directory object instance with the type and the id, optionally with the object's relations.# without relations:user=ds.get_object(object_type="user",object_id="euang@acmecorp.com")# with relations:page=PaginationRequest(size=10)whileTrue:resp=ds.get_object(object_type="user",object_id="euang@acmecorp.com",with_relations=True,page=page)user=resp.result# The returned object.relations_page=resp.relations# A page of relations.ifnotresp.page.next_token:# we've reached the last page.break# request the next page.page.token=resp.page.next_tokenget_objects_manySimilar toget_objectbut can retrieve multiple object instances in a single request.objects=ds.get_object_many([ObjectIdentifier(type="user",id="euan@acmecorp.com"),ObjectIdentifier(type="group",id="marketing"),])get_objectsGet object instances with an object type type pagination info (page size and pagination token).fromaserto.client.directory.v3importPaginationRequestusers=ds.get_objects(object_type="user",page=PaginationRequest(size=10))set_objectCreate an object instance with the specified properties. If anetagis specified and is different from the current
object's etag, the call raises anETagMismatchError.# pass object fields as arguments:user=ds.set_object(object_type="user",object_id="new-user@acmecorp.com",display_name="John Doe","properties":{"active":True,"department":"Engineering"},}# set_object can also take an Object parameter:user.display_name="Jane Doe"user.properties["title"]="Senior Engineer"updated_user=ds.set_object(object=user)delete_objectDelete an object instance and optionally its relations, using its type and id:# delete an objectds.delete_object(object_type="user",object_id="test-object")# delete an object and all its relationsds.delete_object(object_type="user",object_id="test-object",with_relations=True)get_relationRetrieve a single relation from the directory or raise aNotFoundErrorif no matching relation exists.# get the manager of euang@acmecorp.com:relation=ds.get_relation(object_type="user",relation="manager",subject_type="user",subject_id="euang@acmecorp.com",)assertrelation.object_id# include the relation's object and subject in the response:response=ds.get_relation(object_type="user",relation="manager",subject_type="user",subject_id="euang@acmecorp.com",with_relations=True,)assertresponse.relation.object_idassertresponse.subject.display_name=="Euan Garden"assertresponse.object.properties["department"]=="Sales"#get_relationsSearches the directory for relations matching the specified criteria, optionally including the object and subject
of each returned relation.# find all groups a user is a member of:page=PaginationRequest(size=10)whileTrue:response=ds.get_relations(object_type="group","relation"="member","subject_type":"user","subject_id":"euang@acmecorp.com",with_objects=True,page=page,)ifnotresponse.page.next_token:breakpage.token=response.page.next_tokenset_relationCreate a new relation.ds.set_relation(object_type="group",object_id="admin",relation="member",subject_type="user",subject_id="euang@acmecorp.com",)delete_relationDelete a relation.ds.delete_relation(object_type="group",object_id="admin",relation="member",subject_type="user",subject_id="euang@acmecorp.com",)checkCheck if a subject has a given relation or permission on an object.allowed=ds.check(object_type="folder",object_id="/path/to/folder",relation="can_delete",subject_type="user",subject_id="euang@acmecorp.com",)get_manifestDownload the directory manifest.manifest=ds.get_manifest()print(manifest.body)# yaml manifest# conditionally get the manifest if its etag has changednew_manifest=ds.get_manifest(etag=manifest.etag)assertnew_manifestisNone# the manifest hasn't changedset_manifestUpload a new directory manifest.withopen("manifest.yaml","rb")asf:manifest=f.read()ds.set_manifest(manifest)import_dataBulk-insert objects and/or relations to the directory. Returns a summary of the number of objects/relations affected.# import an object and a relation.data=[Object(type="user",id="test@acmecorp.com"),Relation(object_type="user",object_id="euang@acmecorp.com",relation="manager",subject_type="user",subject_id="test@acmecorp.com",),]response=ds.import_data(data)assertresponse.objects.set==1assertresponse.object.error==0assertresponse.relations.set==1assertresponse.relations.error==0export_dataBulk-retrieve objects and/or relations from the directory.fromaserto.client.directory.v3importExportOption,Object,Relation# export all objects and relationsforiteminds.export(ExportOption.OPTION_DATA):ifisinstance(item,Object):print("object:",item)elifisinstance(item,Relation):print("relation:",item)Async Directory ClientYou can initialize an asynchronous directory client as follows:fromaserto.client.directory.v3.aioimportDirectoryds=Directory(api_key="my_api_key",tenant_id="1234",address="localhost:9292")The methods on the async directory have the same signatures as their synchronous counterparts.Directory v2 clientTo interact with older instances of the directory service, a v2 client is available with limited functionality.
The v2 client doesn't supportget_manifest/set_manifest, andimport_data/export_data.fromaserto.client.directory.v2importDirectoryds=Directory(api_key="my_api_key",tenant_id="1234",address="localhost:9292")LicenseThis project is licensed under the MIT license. See theLICENSEfile for more info.