Skip to content

Commit 7b54a6f

Browse files
abh1sarabh1sar
committed
Add events when api key access is changed via api or config setting
1 parent 5bd9a6f commit 7b54a6f

File tree

4 files changed

+20
-5
lines changed

4 files changed

+20
-5
lines changed

‎api/src/main/java/com/cloud/event/EventTypes.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -292,6 +292,7 @@ public class EventTypes {
292292

293293
//register for user API and secret keys
294294
public static final String EVENT_REGISTER_FOR_SECRET_API_KEY = "REGISTER.USER.KEY";
295+
public static final String API_KEY_ACCESS_UPDATE = "API.KEY.ACCESS.UPDATE";
295296

296297
// Template Events
297298
public static final String EVENT_TEMPLATE_CREATE = "TEMPLATE.CREATE";

‎server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@
5353
import org.apache.cloudstack.agent.lb.IndirectAgentLBServiceImpl;
5454
import org.apache.cloudstack.annotation.AnnotationService;
5555
import org.apache.cloudstack.annotation.dao.AnnotationDao;
56+
import org.apache.cloudstack.api.ApiCommandResourceType;
5657
import org.apache.cloudstack.api.ApiConstants;
5758
import org.apache.cloudstack.api.command.admin.config.ResetCfgCmd;
5859
import org.apache.cloudstack.api.command.admin.config.UpdateCfgCmd;
@@ -708,20 +709,23 @@ public String updateConfiguration(final long userId, final String name, final St
708709
value = DBEncryptionUtil.encrypt(value);
709710
}
710711

712+
ApiCommandResourceType resourceType;
711713
ConfigKey.Scope scopeVal = ConfigKey.Scope.valueOf(scope);
712714
switch (scopeVal) {
713715
case Zone:
714716
final DataCenterVO zone = _zoneDao.findById(resourceId);
715717
if (zone == null) {
716718
throw new InvalidParameterValueException("unable to find zone by id " + resourceId);
717719
}
720+
resourceType = ApiCommandResourceType.Zone;
718721
_dcDetailsDao.addDetail(resourceId, name, value, true);
719722
break;
720723
case Cluster:
721724
final ClusterVO cluster = _clusterDao.findById(resourceId);
722725
if (cluster == null) {
723726
throw new InvalidParameterValueException("unable to find cluster by id " + resourceId);
724727
}
728+
resourceType = ApiCommandResourceType.Cluster;
725729
String newName = name;
726730
if (name.equalsIgnoreCase("cpu.overprovisioning.factor")) {
727731
newName = "cpuOvercommitRatio";
@@ -744,6 +748,7 @@ public String updateConfiguration(final long userId, final String name, final St
744748
if (pool == null) {
745749
throw new InvalidParameterValueException("unable to find storage pool by id " + resourceId);
746750
}
751+
resourceType = ApiCommandResourceType.StoragePool;
747752
if(name.equals(CapacityManager.StorageOverprovisioningFactor.key())) {
748753
if(!pool.getPoolType().supportsOverProvisioning() ) {
749754
throw new InvalidParameterValueException("Unable to update storage pool with id " + resourceId + ". Overprovision not supported for " + pool.getPoolType());
@@ -765,6 +770,7 @@ public String updateConfiguration(final long userId, final String name, final St
765770
if (account == null) {
766771
throw new InvalidParameterValueException("unable to find account by id " + resourceId);
767772
}
773+
resourceType = ApiCommandResourceType.Account;
768774
AccountDetailVO accountDetailVO = _accountDetailsDao.findDetail(resourceId, name);
769775
if (accountDetailVO == null) {
770776
accountDetailVO = new AccountDetailVO(resourceId, name, value);
@@ -778,6 +784,7 @@ public String updateConfiguration(final long userId, final String name, final St
778784
case ImageStore:
779785
final ImageStoreVO imgStore = _imageStoreDao.findById(resourceId);
780786
Preconditions.checkState(imgStore != null);
787+
resourceType = ApiCommandResourceType.ImageStore;
781788
_imageStoreDetailsDao.addDetail(resourceId, name, value, true);
782789
break;
783790

@@ -786,6 +793,7 @@ public String updateConfiguration(final long userId, final String name, final St
786793
if (domain == null) {
787794
throw new InvalidParameterValueException("unable to find domain by id " + resourceId);
788795
}
796+
resourceType = ApiCommandResourceType.Domain;
789797
DomainDetailVO domainDetailVO = _domainDetailsDao.findDetail(resourceId, name);
790798
if (domainDetailVO == null) {
791799
domainDetailVO = new DomainDetailVO(resourceId, name, value);
@@ -800,6 +808,10 @@ public String updateConfiguration(final long userId, final String name, final St
800808
throw new InvalidParameterValueException("Scope provided is invalid");
801809
}
802810

811+
CallContext.current().setEventResourceType(resourceType);
812+
CallContext.current().setEventResourceId(resourceId);
813+
CallContext.current().setEventDetails(String.format(" Name: %s, New Value: %s, Scope: %s", name, value, scope));
814+
803815
_configDepot.invalidateConfigCache(name, scopeVal, resourceId);
804816
return valueEncrypted ? DBEncryptionUtil.decrypt(value) : value;
805817
}
@@ -1013,7 +1025,6 @@ public Configuration updateConfiguration(final UpdateCfgCmd cmd) throws InvalidP
10131025
if (value.isEmpty() || value.equals("null")) {
10141026
value = (id == null) ? null : "";
10151027
}
1016-
10171028
final String updatedValue = updateConfiguration(userId, name, category, value, scope, id);
10181029
if (value == null && updatedValue == null || updatedValue.equalsIgnoreCase(value)) {
10191030
return _configDao.findByName(name);

‎server/src/main/java/com/cloud/user/AccountManagerImpl.java‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1470,9 +1470,9 @@ public UserAccount updateUser(UpdateUserCmd updateUserCmd) {
14701470
logger.debug("Updating user with Id: " + user.getUuid());
14711471

14721472
validateAndUpdateApiAndSecretKeyIfNeeded(updateUserCmd, user);
1473-
validateAndUpdateUserApiKeyAccess(updateUserCmd, user);
14741473
Account account = retrieveAndValidateAccount(user);
14751474

1475+
validateAndUpdateUserApiKeyAccess(updateUserCmd, user, account);
14761476
validateAndUpdateFirstNameIfNeeded(updateUserCmd, user);
14771477
validateAndUpdateLastNameIfNeeded(updateUserCmd, user);
14781478
validateAndUpdateUsernameIfNeeded(updateUserCmd, user, account);
@@ -1690,11 +1690,12 @@ protected void validateAndUpdateApiAndSecretKeyIfNeeded(UpdateUserCmd updateUser
16901690
user.setSecretKey(secretKey);
16911691
}
16921692

1693-
protected void validateAndUpdateUserApiKeyAccess(UpdateUserCmd updateUserCmd, UserVO user) {
1693+
protected void validateAndUpdateUserApiKeyAccess(UpdateUserCmd updateUserCmd, UserVO user, Account account) {
16941694
if (updateUserCmd.getApiKeyAccess() != null) {
16951695
try {
16961696
ApiConstants.ApiKeyAccess access = ApiConstants.ApiKeyAccess.valueOf(updateUserCmd.getApiKeyAccess().toUpperCase());
16971697
user.setApiKeyAccess(access.toBoolean());
1698+
ActionEventUtils.onActionEvent(user.getId(), account.getAccountId(), account.getDomainId(), EventTypes.API_KEY_ACCESS_UPDATE, "Api key access was changed for the user to " + access.toString(), user.getId(), ApiCommandResourceType.User.toString());
16981699
} catch (IllegalArgumentException ex) {
16991700
throw new InvalidParameterValueException("ApiKeyAccess value can only be Enabled/Disabled/Inherit");
17001701
}
@@ -1706,6 +1707,7 @@ protected void validateAndUpdateAccountApiKeyAccess(UpdateAccountCmd updateAccou
17061707
try {
17071708
ApiConstants.ApiKeyAccess access = ApiConstants.ApiKeyAccess.valueOf(updateAccountCmd.getApiKeyAccess().toUpperCase());
17081709
account.setApiKeyAccess(access.toBoolean());
1710+
ActionEventUtils.onActionEvent(User.UID_SYSTEM, account.getAccountId(), account.getDomainId(), EventTypes.API_KEY_ACCESS_UPDATE, "Api key access was changed for the account to " + access.toString(), account.getId(), ApiCommandResourceType.Account.toString());
17091711
} catch (IllegalArgumentException ex) {
17101712
throw new InvalidParameterValueException("ApiKeyAccess value can only be Enabled/Disabled/Inherit");
17111713
}
@@ -2842,6 +2844,7 @@ public Map<String, String> getKeys(Long userId) {
28422844
preventRootDomainAdminAccessToRootAdminKeys(caller, account);
28432845
checkAccess(caller, account);
28442846

2847+
// TODO : can return api key access here
28452848
Map<String, String> keys = new HashMap<String, String>();
28462849
keys.put("apikey", user.getApiKey());
28472850
keys.put("secretkey", user.getSecretKey());

‎server/src/test/java/com/cloud/user/AccountManagerImplTest.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -514,15 +514,15 @@ public void validateAndUpdatApiAndSecretKeyIfNeededTest() {
514514
@Test
515515
public void validateAndUpdatUserApiKeyAccess() {
516516
Mockito.doReturn("Enabled").when(UpdateUserCmdMock).getApiKeyAccess();
517-
accountManagerImpl.validateAndUpdateUserApiKeyAccess(UpdateUserCmdMock, userVoMock);
517+
accountManagerImpl.validateAndUpdateUserApiKeyAccess(UpdateUserCmdMock, userVoMock, accountMock);
518518

519519
Mockito.verify(userVoMock).setApiKeyAccess(true);
520520
}
521521

522522
@Test(expected = InvalidParameterValueException.class)
523523
public void validateAndUpdatUserApiKeyAccessInvalidParameter() {
524524
Mockito.doReturn("False").when(UpdateUserCmdMock).getApiKeyAccess();
525-
accountManagerImpl.validateAndUpdateUserApiKeyAccess(UpdateUserCmdMock, userVoMock);
525+
accountManagerImpl.validateAndUpdateUserApiKeyAccess(UpdateUserCmdMock, userVoMock, accountMock);
526526
}
527527

528528
@Test

0 commit comments

Comments
 (0)