This is a Go program to interact with VMware Identity Manager product. For now it mostly implements the administrative functions of IDM.
-
If you haven't already, set up a Go workspace according to the Go docs.
-
To follow the examples below you need to have
make
installed. -
If you want to view code coverage of the test suite with
make coverage
as described below, you need to haveawk
installed. -
Setup GOPATH environment variable
Then:
$ mkdir -p $GOPATH/src/github.com/vmware $ cd $GOPATH/src/github.com/vmware $ git clone [email protected]:vmware/priam.git $ cd priam
To build it and run it:
$ make
$ ./priam
You can also install the priam
executable in the bin
directory of your Go workspace:
$ make install
$ $GOPATH/bin/priam
Run the testsuite:
$ make test
Run the testsuite with code coverage (will open the browser with code coverage):
$ make coverage
To list available commands, use:
$ priam help
To get help on specific command (for example, 'target'):
$ priam help target
or
$ priam target -h
You need an IDM organization (like https://xxx.vmwareidentity.com)
Almost all commands require the user to be logged in as an IDM administrator to run API calls. All examples below assume you have run the following commands before:
$ priam target https://xxx.vmwareidentity.com
$ priam login <admin username>
Password: <enter the admin password>
Access token saved
Note that you can also login with an OAuth 2.0 client_id and secret. In that case use:
$ priam login -c <oauth2 client id>
Secret: <the oauth2 secret>
Access token saved
You can also login using an OAuth2 authorization code flow. This allows you to log in as any user, not just a user in the system domain as shown above. It launches an external browser and opens a local http listener to receive the OAuth2 tokens. However, to use this login option this application must be registered as an OAuth2 client in the target tenant. A helper command is provided for this purpose. If you are logged in as an administrator using one of the previous login options, you can run this command to register the OAuth2 client:
$ priam client register
To see what options are registered (client_id, client_secret, scopes, etc), run:
$ priam client register --help
After registration is completed, you can log in as a user from any domain supported by the tenant, and using authentication methods as specified by access policy:
$ priam login -a
Login as admin as shown above, then run:
$ priam user list
This will list all users in the system. You can also filter the users by their attributes:
$ priam user list --filter 'username eq "test"'
The filter follows the SCIM standard: http://www.simplecloud.info/specs/draft-scim-api-00.html
You can add a local user:
$ priam user add --email [email protected] --family Travolta --given John jtravolta 'password'
You can also add a list of users defined in a YAML file:
$ priam user load list-of-users.yaml
$ cat list-of-users.yaml
---
- {name: user1, given: User1, family: Family1, email: [email protected], pwd: welcome1}
- {name: user2, given: User2, family: Family2, email: [email protected], pwd: welcome2}
- {name: user3, given: User3, family: Family3, email: [email protected], pwd: welcome3}
The users will be added with the "User" role. To add a new local user "joe" as administrator, use:
$ priam user add --email [email protected] --family Joe --given Joe joe 'password'
$ priam role member Administrator joe
To list applications:
$ priam app list
To add an application to the catalog, you need to define a YAML manifest file that will contain the application information.
$ priam app add my-app.yaml
An example of the YAML file for a simple web link:
$ cat my-app.yaml
applications:
- name: my-example-application
workspace:
packageVersion: '1.0'
description: GitHub's Demo App
catalogItemType: WebAppLink
authInfo:
type: WebAppLink
targetUrl: "http://www.vmware.com"
To add an application and entitle users to it, you can specify the entitlement in the manifest, then add the application. Note that if the application already exists, the application information will only be updated and its entitlements too.
$ priam app add my-saml-app-entitled.yaml
App "fannys-saml-app" added to the catalog
Entitled group "ALL USERS" to app "fannys-saml-app".
$ cat my-saml-app-entitled.yaml
applications:
- name: fannys-saml-app
workspace:
packageVersion: '1.0'
description: Demo App for GiHub with entitlements to all users
entitleGroup: ALL USERS
catalogItemType: Saml20
attributeMaps:
userName: "${user.userName}"
firstName: "${user.firstName}"
lastName: "${user.lastName}"
accessPolicy: default_access_policy_set
authInfo:
type: Saml20
validityTimeSeconds: 200
nameIdFormat: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
nameId: "${user.userName}"
configureAs: "manual"
audience: "https://test.fanny.audience"
assertionConsumerServiceUrl: "https://test.fanny/a/{domainName}/acs?RelayState=http://mail.google.com/a/{domainName}"
recipientName: "https://test.fanny/a/{domainName}/acs"
attributes:
- name: https://aws.amazon.com/SAML/Attributes/Role
nameFormat: urn:oasis:names:tc:SAML:2.0:attrname-format:uri
nameSpace: ''
value: arn:aws:iam::646585102600:role/MyRole,arn:aws:iam::12345678:saml-provider/my-org
- name: https://aws.amazon.com/SAML/Attributes/RoleSessionName
nameFormat: urn:oasis:names:tc:SAML:2.0:attrname-format:uri
nameSpace: ''
value: "${user.userName}"
The priam project team welcomes contributions from the community. If you wish to contribute code and you have not signed our contributor license agreement (CLA), our bot will update the issue when you open a Pull Request. For any questions about the CLA process, please refer to our FAQ. For more detailed information, refer to CONTRIBUTING.md.
Priam is available under the Apache 2 license.