Add an automatic cleanup feature for delegated roles.

core/zms/src/main/java/com/yahoo/athenz/zms/Domain.java

@@ -117,6 +117,9 @@ public class Domain {
     @RdlOptional
     @JsonInclude(JsonInclude.Include.NON_NULL)
     public String onCall;
+    @RdlOptional
+    @JsonInclude(JsonInclude.Include.NON_EMPTY)
+    public Boolean autoDeleteTenantAssumeRoleAssertions;
     public String name;
     @RdlOptional
     @JsonInclude(JsonInclude.Include.NON_EMPTY)
@@ -356,6 +359,13 @@ public Domain setOnCall(String onCall) {
     public String getOnCall() {
         return onCall;
     }
+    public Domain setAutoDeleteTenantAssumeRoleAssertions(Boolean autoDeleteTenantAssumeRoleAssertions) {
+        this.autoDeleteTenantAssumeRoleAssertions = autoDeleteTenantAssumeRoleAssertions;
+        return this;
+    }
+    public Boolean getAutoDeleteTenantAssumeRoleAssertions() {
+        return autoDeleteTenantAssumeRoleAssertions;
+    }
     public Domain setName(String name) {
         this.name = name;
         return this;
@@ -484,6 +494,9 @@ public boolean equals(Object another) {
             if (onCall == null ? a.onCall != null : !onCall.equals(a.onCall)) {
                 return false;
             }
+            if (autoDeleteTenantAssumeRoleAssertions == null ? a.autoDeleteTenantAssumeRoleAssertions != null : !autoDeleteTenantAssumeRoleAssertions.equals(a.autoDeleteTenantAssumeRoleAssertions)) {
+                return false;
+            }
             if (name == null ? a.name != null : !name.equals(a.name)) {
                 return false;
             }

core/zms/src/main/java/com/yahoo/athenz/zms/DomainData.java

@@ -113,6 +113,9 @@ public class DomainData {
     @RdlOptional
     @JsonInclude(JsonInclude.Include.NON_NULL)
     public String onCall;
+    @RdlOptional
+    @JsonInclude(JsonInclude.Include.NON_EMPTY)
+    public Boolean autoDeleteTenantAssumeRoleAssertions;
     public String name;
     public List<Role> roles;
     public SignedPolicies policies;
@@ -352,6 +355,13 @@ public DomainData setOnCall(String onCall) {
     public String getOnCall() {
         return onCall;
     }
+    public DomainData setAutoDeleteTenantAssumeRoleAssertions(Boolean autoDeleteTenantAssumeRoleAssertions) {
+        this.autoDeleteTenantAssumeRoleAssertions = autoDeleteTenantAssumeRoleAssertions;
+        return this;
+    }
+    public Boolean getAutoDeleteTenantAssumeRoleAssertions() {
+        return autoDeleteTenantAssumeRoleAssertions;
+    }
     public DomainData setName(String name) {
         this.name = name;
         return this;
@@ -508,6 +518,9 @@ public boolean equals(Object another) {
             if (onCall == null ? a.onCall != null : !onCall.equals(a.onCall)) {
                 return false;
             }
+            if (autoDeleteTenantAssumeRoleAssertions == null ? a.autoDeleteTenantAssumeRoleAssertions != null : !autoDeleteTenantAssumeRoleAssertions.equals(a.autoDeleteTenantAssumeRoleAssertions)) {
+                return false;
+            }
             if (name == null ? a.name != null : !name.equals(a.name)) {
                 return false;
             }

core/zms/src/main/java/com/yahoo/athenz/zms/DomainMeta.java

@@ -113,6 +113,9 @@ public class DomainMeta {
     @RdlOptional
     @JsonInclude(JsonInclude.Include.NON_NULL)
     public String onCall;
+    @RdlOptional
+    @JsonInclude(JsonInclude.Include.NON_EMPTY)
+    public Boolean autoDeleteTenantAssumeRoleAssertions;
 
     public DomainMeta setDescription(String description) {
         this.description = description;
@@ -345,6 +348,13 @@ public DomainMeta setOnCall(String onCall) {
     public String getOnCall() {
         return onCall;
     }
+    public DomainMeta setAutoDeleteTenantAssumeRoleAssertions(Boolean autoDeleteTenantAssumeRoleAssertions) {
+        this.autoDeleteTenantAssumeRoleAssertions = autoDeleteTenantAssumeRoleAssertions;
+        return this;
+    }
+    public Boolean getAutoDeleteTenantAssumeRoleAssertions() {
+        return autoDeleteTenantAssumeRoleAssertions;
+    }
 
     @Override
     public boolean equals(Object another) {
@@ -452,6 +462,9 @@ public boolean equals(Object another) {
             if (onCall == null ? a.onCall != null : !onCall.equals(a.onCall)) {
                 return false;
             }
+            if (autoDeleteTenantAssumeRoleAssertions == null ? a.autoDeleteTenantAssumeRoleAssertions != null : !autoDeleteTenantAssumeRoleAssertions.equals(a.autoDeleteTenantAssumeRoleAssertions)) {
+                return false;
+            }
         }
         return true;
     }
@@ -466,6 +479,9 @@ public DomainMeta init() {
         if (auditEnabled == null) {
             auditEnabled = false;
         }
+        if (autoDeleteTenantAssumeRoleAssertions == null) {
+            autoDeleteTenantAssumeRoleAssertions = false;
+        }
         return this;
     }
 }

core/zms/src/main/java/com/yahoo/athenz/zms/SubDomain.java

@@ -113,6 +113,9 @@ public class SubDomain {
     @RdlOptional
     @JsonInclude(JsonInclude.Include.NON_NULL)
     public String onCall;
+    @RdlOptional
+    @JsonInclude(JsonInclude.Include.NON_EMPTY)
+    public Boolean autoDeleteTenantAssumeRoleAssertions;
     public String name;
     public List<String> adminUsers;
     @RdlOptional
@@ -351,6 +354,13 @@ public SubDomain setOnCall(String onCall) {
     public String getOnCall() {
         return onCall;
     }
+    public SubDomain setAutoDeleteTenantAssumeRoleAssertions(Boolean autoDeleteTenantAssumeRoleAssertions) {
+        this.autoDeleteTenantAssumeRoleAssertions = autoDeleteTenantAssumeRoleAssertions;
+        return this;
+    }
+    public Boolean getAutoDeleteTenantAssumeRoleAssertions() {
+        return autoDeleteTenantAssumeRoleAssertions;
+    }
     public SubDomain setName(String name) {
         this.name = name;
         return this;
@@ -486,6 +496,9 @@ public boolean equals(Object another) {
             if (onCall == null ? a.onCall != null : !onCall.equals(a.onCall)) {
                 return false;
             }
+            if (autoDeleteTenantAssumeRoleAssertions == null ? a.autoDeleteTenantAssumeRoleAssertions != null : !autoDeleteTenantAssumeRoleAssertions.equals(a.autoDeleteTenantAssumeRoleAssertions)) {
+                return false;
+            }
             if (name == null ? a.name != null : !name.equals(a.name)) {
                 return false;
             }

core/zms/src/main/java/com/yahoo/athenz/zms/TopLevelDomain.java

@@ -114,6 +114,9 @@ public class TopLevelDomain {
     @RdlOptional
     @JsonInclude(JsonInclude.Include.NON_NULL)
     public String onCall;
+    @RdlOptional
+    @JsonInclude(JsonInclude.Include.NON_EMPTY)
+    public Boolean autoDeleteTenantAssumeRoleAssertions;
     public String name;
     public List<String> adminUsers;
     @RdlOptional
@@ -351,6 +354,13 @@ public TopLevelDomain setOnCall(String onCall) {
     public String getOnCall() {
         return onCall;
     }
+    public TopLevelDomain setAutoDeleteTenantAssumeRoleAssertions(Boolean autoDeleteTenantAssumeRoleAssertions) {
+        this.autoDeleteTenantAssumeRoleAssertions = autoDeleteTenantAssumeRoleAssertions;
+        return this;
+    }
+    public Boolean getAutoDeleteTenantAssumeRoleAssertions() {
+        return autoDeleteTenantAssumeRoleAssertions;
+    }
     public TopLevelDomain setName(String name) {
         this.name = name;
         return this;
@@ -479,6 +489,9 @@ public boolean equals(Object another) {
             if (onCall == null ? a.onCall != null : !onCall.equals(a.onCall)) {
                 return false;
             }
+            if (autoDeleteTenantAssumeRoleAssertions == null ? a.autoDeleteTenantAssumeRoleAssertions != null : !autoDeleteTenantAssumeRoleAssertions.equals(a.autoDeleteTenantAssumeRoleAssertions)) {
+                return false;
+            }
             if (name == null ? a.name != null : !name.equals(a.name)) {
                 return false;
             }

core/zms/src/main/java/com/yahoo/athenz/zms/UserDomain.java

@@ -113,6 +113,9 @@ public class UserDomain {
     @RdlOptional
     @JsonInclude(JsonInclude.Include.NON_NULL)
     public String onCall;
+    @RdlOptional
+    @JsonInclude(JsonInclude.Include.NON_EMPTY)
+    public Boolean autoDeleteTenantAssumeRoleAssertions;
     public String name;
     @RdlOptional
     @JsonInclude(JsonInclude.Include.NON_EMPTY)
@@ -349,6 +352,13 @@ public UserDomain setOnCall(String onCall) {
     public String getOnCall() {
         return onCall;
     }
+    public UserDomain setAutoDeleteTenantAssumeRoleAssertions(Boolean autoDeleteTenantAssumeRoleAssertions) {
+        this.autoDeleteTenantAssumeRoleAssertions = autoDeleteTenantAssumeRoleAssertions;
+        return this;
+    }
+    public Boolean getAutoDeleteTenantAssumeRoleAssertions() {
+        return autoDeleteTenantAssumeRoleAssertions;
+    }
     public UserDomain setName(String name) {
         this.name = name;
         return this;
@@ -470,6 +480,9 @@ public boolean equals(Object another) {
             if (onCall == null ? a.onCall != null : !onCall.equals(a.onCall)) {
                 return false;
             }
+            if (autoDeleteTenantAssumeRoleAssertions == null ? a.autoDeleteTenantAssumeRoleAssertions != null : !autoDeleteTenantAssumeRoleAssertions.equals(a.autoDeleteTenantAssumeRoleAssertions)) {
+                return false;
+            }
             if (name == null ? a.name != null : !name.equals(a.name)) {
                 return false;
             }

core/zms/src/main/java/com/yahoo/athenz/zms/ZMSSchema.java

@@ -157,7 +157,8 @@ private static Schema build() {
             .field("x509CertSignerKeyId", "String", true, "requested x509 cert signer key id (system attribute)")
             .field("sshCertSignerKeyId", "String", true, "requested ssh cert signer key id (system attribute)")
             .field("slackChannel", "String", true, "slack channel for any notifications in this domain")
-            .field("onCall", "String", true, "oncall team name/id for any incidents in this domain");
+            .field("onCall", "String", true, "oncall team name/id for any incidents in this domain")
+            .field("autoDeleteTenantAssumeRoleAssertions", "Bool", true, "Indicates whether to automatically delete assertions for a tenant's assume role", false);
 
         sb.structType("Domain", "DomainMeta")
             .comment("A domain is an independent partition of users, roles, and resources. Its name represents the definition of a namespace; the only way a new namespace can be created, from the top, is by creating Domains. Administration of a domain is governed by the parent domain (using reverse-DNS namespaces). The top level domains are governed by the special \"sys.auth\" domain.")

core/zms/src/main/rdl/Domain.tdl

@@ -45,6 +45,7 @@ type DomainMeta Struct {
     String sshCertSignerKeyId (optional, x_allowempty="true"); //requested ssh cert signer key id (system attribute)
     String slackChannel (optional, x_allowempty="true"); //slack channel for any notifications in this domain
     String onCall (optional, x_allowempty="true"); //oncall team name/id for any incidents in this domain
+    Bool autoDeleteTenantAssumeRoleAssertions (optional, default=false); // Indicates whether to automatically delete assertions for a tenant's assume role
 }
 
 //A domain is an independent partition of users, roles, and resources.