// authorizeBuiltinRole authorizes builtin role
485781
func (a *authorizer) authorizeBuiltinRole(r BuiltinRole) (*AuthContext, error) {
	config, err := r.GetClusterConfig()
	if err != nil {
		return nil, trace.Wrap(err)
	}
	return contextForBuiltinRole(r.ClusterName, config, r.Role, r.Username)
}
510330
func (b *planBuilder) buildInnerApply(outerPlan, innerPlan LogicalPlan) LogicalPlan {
	join := &Join{
		JoinType:        InnerJoin,
		baseLogicalPlan: newBaseLogicalPlan(Jn, b.allocator),
	}
	ap := &Apply{Join: *join}
	ap.initIDAndContext(b.ctx)
	ap.self = ap
	addChild(ap, outerPlan)
	addChild(ap, innerPlan)
	ap.SetSchema(expression.MergeSchema(outerPlan.GetSchema(), innerPlan.GetSchema()))
	for i := outerPlan.GetSchema().Len(); i < ap.GetSchema().Len(); i++ {
		ap.schema.Columns[i].IsAggOrSubq = true
	}
	ap.SetCorrelated()
	return ap
}
1152484
func NewAuthorizerFromFile(baseURI string) (autorest.Authorizer, error) {
	settings, err := GetSettingsFromFile()
	if err != nil {
		return nil, err
	}
	if a, err := settings.ClientCredentialsAuthorizer(baseURI); err == nil {
		return a, err
	}
	if a, err := settings.ClientCertificateAuthorizer(baseURI); err == nil {
		return a, err
	}
	return nil, errors.New("auth file missing client and certificate credentials")
}
1298222
func (b *backend) nonLockedSetAWSRole(ctx context.Context, s logical.Storage, roleName string,
	roleEntry *awsRoleEntry) error {
	if roleName == "" {
		return fmt.Errorf("missing role name")
	}

	if roleEntry == nil {
		return fmt.Errorf("nil role entry")
	}

	entry, err := logical.StorageEntryJSON("role/"+strings.ToLower(roleName), roleEntry)
	if err != nil {
		return err
	}

	if err := s.Put(ctx, entry); err != nil {
		return err
	}

	return nil
}
976859
func (s *CreateBranchInput) SetEnableAutoBuild(v bool) *CreateBranchInput {
	s.EnableAutoBuild = &v
	return s
}
836904
func (b *IAMModelBuilder) buildAWSIAMRolePolicy() (fi.Resource, error) {
	functions := template.FuncMap{
		"IAMServiceEC2": func() string {
			// IAMServiceEC2 returns the name of the IAM service for EC2 in the current region
			// it is ec2.amazonaws.com everywhere but in cn-north, where it is ec2.amazonaws.com.cn
			switch b.Region {
			case "cn-north-1":
				return "ec2.amazonaws.com.cn"
			case "cn-northwest-1":
				return "ec2.amazonaws.com.cn"
			default:
				return "ec2.amazonaws.com"
			}
		},
	}

	templateResource, err := NewTemplateResource("AWSIAMRolePolicy", RolePolicyTemplate, functions, nil)
	if err != nil {
		return nil, err
	}
	return templateResource, nil
}
551835
func (r roleResponse) asServerRole(ctx context.Context, c *client) (ServerRole, error) {
	switch r.Role {
	case "SINGLE":
		switch r.Mode {
		case "resilient":
			if err := c.echo(ctx); IsNoLeader(err) {
				return ServerRoleSinglePassive, nil
			} else if err != nil {
				return ServerRoleUndefined, WithStack(err)
			}
			return ServerRoleSingleActive, nil
		default:
			return ServerRoleSingle, nil
		}
	case "PRIMARY":
		return ServerRoleDBServer, nil
	case "COORDINATOR":
		return ServerRoleCoordinator, nil
	case "AGENT":
		return ServerRoleAgent, nil
	case "UNDEFINED":
		return ServerRoleUndefined, nil
	default:
		return ServerRoleUndefined, nil
	}
}
916696
func AuthorizeOrgAndRole(ctx context.Context, org string, blacklistedCerts map[string]*api.BlacklistedCertificate, ou ...string) (string, error) {
	certSubj, err := certSubjectFromContext(ctx)
	if err != nil {
		return "", err
	}
	// Check if the current certificate has an OU that authorizes
	// access to this method
	if intersectArrays(certSubj.OrganizationalUnit, ou) {
		return authorizeOrg(certSubj, org, blacklistedCerts)
	}

	return "", status.Errorf(codes.PermissionDenied, "Permission denied: remote certificate not part of OUs: %v", ou)
}
473323
func (v *version) Roles() RoleInformer {
	return &roleInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
}
968743
func (clnt *Client) CreateRole(policy *AdminPolicy, roleName string, privileges []Privilege) error {
	policy = clnt.getUsableAdminPolicy(policy)

	command := newAdminCommand(nil)
	return command.createRole(clnt.cluster, policy, roleName, privileges)
}
257875
func (i *InitToken) writeTokenRole() error {
	_, err := i.kubernetes.vaultClient.Logical().Write(i.Path(), i.writeData())
	if err != nil {
		return fmt.Errorf("error writing token role %s: %v", i.Path(), err)
	}

	return nil
}
1027704
func NewAuthorizerFromCLI() (autorest.Authorizer, error) {
	settings, err := GetSettingsFromEnvironment()
	if err != nil {
		return nil, err
	}

	if settings.Values[Resource] == "" {
		settings.Values[Resource] = settings.Environment.ResourceManagerEndpoint
	}

	return NewAuthorizerFromCLIWithResource(settings.Values[Resource])
}
1065835
func (e *Enforcer) SetBuiltinPolicy(policy string) error {
	e.adapter.builtinPolicy = policy
	return e.LoadPolicy()
}
1099104
func (ca *CertAuthorityV2) AddRole(name string) {
	for _, r := range ca.Spec.Roles {
		if r == name {
			return
		}
	}
	ca.Spec.Roles = append(ca.Spec.Roles, name)
}
1148887
func RoleEscalationAuthorized(ctx context.Context, a authorizer.Authorizer) bool {
	if a == nil {
		return false
	}

	user, ok := genericapirequest.UserFrom(ctx)
	if !ok {
		return false
	}

	requestInfo, ok := genericapirequest.RequestInfoFrom(ctx)
	if !ok {
		return false
	}

	if !requestInfo.IsResourceRequest {
		return false
	}

	requestResource := schema.GroupResource{Group: requestInfo.APIGroup, Resource: requestInfo.Resource}
	if !roleResources[requestResource] {
		return false
	}

	attrs := authorizer.AttributesRecord{
		User:            user,
		Verb:            "escalate",
		APIGroup:        requestInfo.APIGroup,
		Resource:        requestInfo.Resource,
		Name:            requestInfo.Name,
		Namespace:       requestInfo.Namespace,
		ResourceRequest: true,
	}

	decision, _, err := a.Authorize(attrs)
	if err != nil {
		utilruntime.HandleError(fmt.Errorf(
			"error authorizing user %#v to escalate %#v named %q in namespace %q: %v",
			user, requestResource, requestInfo.Name, requestInfo.Namespace, err,
		))
	}
	return decision == authorizer.DecisionAllow
}
1069292
func (a *Auth) AddRole(user User, r string) error {
	if r == "admin" {
		return fmt.Errorf(`the "admin" role can only be defined by the HAL_AUTH_ADMIN environment variable`)
	}

	if a.HasRole(user.ID, r) {
		return fmt.Errorf("%s already has the %s role", user.Name, r)
	}

	user.Roles = append(user.Roles, r)
	a.robot.Users.Set(user.ID, user)

	return nil
}
1178338
func NewRoleAuthorizer(clusterName string, clusterConfig services.ClusterConfig, r teleport.Role) (Authorizer, error) {
	authContext, err := contextForBuiltinRole(clusterName, clusterConfig, r, fmt.Sprintf("%v", r))
	if err != nil {
		return nil, trace.Wrap(err)
	}
	return &contextAuthorizer{authContext: *authContext}, nil
}