This allows specifying multiple IDs in grants via an `ids` field, which
will eventually become the normal way to specify IDs. Internally, each
grant with multiple IDs turns into multiple ACL grants each with a
single ID; to make this distinction clearer and allow for better
separation of concerns an AclGrant type has been introduced, so really
multiple IDs in a Grant turn into multiple AclGrants.
The nice thing about doing it this way is that it becomes purely a
parsing concern; no actual validation logic has changed.
For backwards compatibility with grants already stored in roles, we do
not error out if `id` is specified. However, eventually we will simply
not support grants with `id` coming via the API; they will fail API
validation, such that new grants will require the use of the updated
`ids` field.
A follow-on PR will plumb this through the service handlers/API/CLI, but
I decided to do it in separate chunks to make reviewing easier, given
that they are easily separable into the internal and external aspects of
the change.
* Add CLI/API checks around using ID in grants (#3264)
* Plumb through some contexts to remove a lot of deprecated errors (#3268)
For requests to the target authorize session endpoint we support passing
a target name instead of an id. This means that `req.GetId()` might not
be the target's public id. Since the first thing authorize session does
includes retrieving the target as part of the authorization checks, this
subtype check can leverage the public id of the target instead of using
the request.
Fixes: 6178dd516e
This adds a new Job type that is for generic session state monitoring. Monitoring sessions does not include any information about specific connections.
Originally, UpstreamMessageHandler was used by
controllerUpstreamMessageServiceServer.UpstreamMessage to process
(aka handle) an upstream message and by SendUpstreamMessage to
send an upstream msg.
We split UpstreamMessageHandler into two interfaces so we can
register handlers independently of a senders.
The upstream messages all basically looked the same; regardless
of which message was sent. This PR adds DetailsUpstreamMessage to
audit events emitted by UpstreamMessage requests/response
Jim
Jeff Mitchell
Todd
Michael Milton
Louis Ruch
Timothy Messier
Johan Brandhorst-Satzkorn
Danielle Miu
Damian Debkowski