infrahouse_toolkit.cli.ih_openvpn.cmd_sync_google_users package

Module contents

infrahouse_toolkit.cli.ih_openvpn.cmd_sync_google_users.EX_CONFIG = 78

EX_CONFIG from sysexits.h. Signals “the Google side is not configured yet” as distinct from “this is broken”. The Puppet wrapper that drives this command on a cron treats 78 as not ready – it logs and exits 0 – so a fleet that has not yet had domain-wide delegation authorized stays quiet instead of mailing an operator daily. Any other non-zero status is reported as a genuine failure. Changing this value breaks that contract; see puppet-code modules/profile/templates/openvpn_server/google-user-sync.sh.erb.

infrahouse_toolkit.cli.ih_openvpn.cmd_sync_google_users.active_users_across_workspaces(service_account: str, admin_subjects: Iterable[str]) → Set[str][source]

Union the active users of every Workspace, or fail without a partial answer.

The caller revokes certificates whose owner is missing from the returned set, so an incomplete union is worse than no answer at all: users of a Workspace that was skipped would look deactivated and lose their VPN access. Hence a failure to read any single Workspace fails the whole call.

Parameters:

  • service_account (str) – Email of the directory-reader service account. The same account impersonates every subject.

  • admin_subjects (Iterable(str)) – Workspace admins to impersonate, one per tenant.

Returns:

Primary email addresses of users active in at least one Workspace.

Return type:

set(str)

Raises:

  • GoogleNotConfigured – if any Workspace is not readable yet.

  • EmptyDirectory – if any Workspace reports no active users.

infrahouse_toolkit.cli.ih_openvpn.cmd_sync_google_users.get_active_directory_users(service_account, admin_subject)[source]

List the primary email addresses of all non-suspended Google Workspace users.

Parameters:

  • service_account (str) – Email of the directory-reader service account.

  • admin_subject (str) – Workspace admin the service account impersonates.

Returns:

Primary email addresses of active users, lowercased.

Return type:

set(str)

Raises:

  • GoogleNotConfigured – if the Google side is not set up yet.

  • HttpError – on a directory API error that is not a setup problem.