Skip to content

Commit

Permalink
DR-765 Change code for Discovery enforcement
Browse files Browse the repository at this point in the history
* Update the PAM protobuf to keeperapp-protobuf PR 106.
* Change CMT_GENERAL to CMT_DISCOVERY for any discovery gateway action.
* Added a readme on how to generate a protobuf python file.

To enable Discovey ...

```
https://dev.keepersecurity.com/console/dev2/#login

once logged in, navigate to Admin -> Roles
find the role that belongs to the user you're using
click on Enforcement Policies button
click on Privileged Access Manager tab (left side menu panel)
at the very bottom, you should see the Discovery enforcement
```

This enforcement permission via requests to the gateway.
There are still commands in Commander that can be run by
any person, which we may need to lock down.
  • Loading branch information
jwalstra-keeper committed Oct 25, 2024
1 parent ec10db8 commit 4ac5dd3
Show file tree
Hide file tree
Showing 5 changed files with 106 additions and 66 deletions.
2 changes: 1 addition & 1 deletion keepercommander/commands/discover/job_remove.py
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ def execute(self, params, **kwargs):
gateway_action=GatewayActionDiscoverJobRemove(
inputs=action_inputs,
conversation_id=conversation_id),
message_type=pam_pb2.CMT_GENERAL,
message_type=pam_pb2.CMT_DISCOVERY,
is_streaming=False,
destination_gateway_uid_str=gateway_context.gateway_uid
)
Expand Down
2 changes: 1 addition & 1 deletion keepercommander/commands/discover/job_start.py
Original file line number Diff line number Diff line change
Expand Up @@ -211,7 +211,7 @@ def execute(self, params, **kwargs):
gateway_action=GatewayActionDiscoverJobStart(
inputs=action_inputs,
conversation_id=conversation_id),
message_type=pam_pb2.CMT_GENERAL,
message_type=pam_pb2.CMT_DISCOVERY,
is_streaming=False,
destination_gateway_uid_str=gateway_context.gateway_uid
)
Expand Down
2 changes: 1 addition & 1 deletion keepercommander/commands/discover/rule_add.py
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ def validate_rule_statement(params: KeeperParams, gateway_context: GatewayContex
gateway_action=GatewayActionDiscoverRuleValidate(
inputs=action_inputs,
conversation_id=conversation_id),
message_type=pam_pb2.CMT_GENERAL,
message_type=pam_pb2.CMT_DISCOVERY,
is_streaming=False,
destination_gateway_uid_str=gateway_context.gateway_uid
)
Expand Down
42 changes: 42 additions & 0 deletions keepercommander/proto/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
# Protoc

These files were generated with protoc 3.19.4.

https://github.com/protocolbuffers/protobuf/releases/tag/v3.19.4

On macOS, you will need to approve the running of `protoc`.
This can be done by running `protoc`, approving the dialog box, then going
to the **Privacy & Security** tab in the **Settings**.
In the **Security** section, allow `protoc` to run.
The next time you run `protoc`, you'll still get a popup, but it will allow
the application to run.

## Generate a Python file

Change into the directory, of the repo, that contains the .proto files.
You need to be in that directory because the `.proto` file
may include other `.proto` files.

```shell
/path/to/protoc-3.19.4-osx-x86_64/bin/protoc --python_out=.. FOO.proto
```
In the prior directory, `FOO_pb2.py` will be created.
Move the file into the `keepercommander/proto` directory.

## Edit the file

Ignore `# Generated by the protocol buffer compiler. DO NOT EDIT!` :)

You'll need change the import files to relative style imports. For example, change ....

```python
import enterprise_pb2 as enterprise_pb2
import record_pb2 as record_pb2
```

to

```python
from . import enterprise_pb2 as enterprise_pb2
from . import record_pb2 as record_pb2
```
124 changes: 61 additions & 63 deletions keepercommander/proto/pam_pb2.py

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

0 comments on commit 4ac5dd3

Please sign in to comment.