Add PAM support (#3438)

* PAM first pass

* Add factory and extend to organization

* Extend to project, add examples

* Add additionalProperties to all objects

* Fix boilerplate

* Expose pam_entitlements to project-factory

* Fix readme

* Move entitlements to second folder/project pass

* extend tests

* Fix readme

* Remove timeouts from inventories

modules/organization/schemas/pam-entitlements.schema.json

@@ -0,0 +1,115 @@
+{
+    "$schema": "http://json-schema.org/draft-07/schema#",
+    "type": "object",
+    "patternProperties": {
+        "^[a-z][a-z0-9-]{0,61}[a-z0-9]$": {
+            "type": "object",
+            "properties": {
+                "max_request_duration": {
+                    "type": "string"
+                },
+                "eligible_users": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "privileged_access": {
+                    "type": "array",
+                    "items": {
+                        "type": "object",
+                        "properties": {
+                            "role": {
+                                "type": "string"
+                            },
+                            "condition": {
+                                "type": "string"
+                            }
+                        },
+                        "required": [
+                            "role"
+                        ],
+                        "additionalProperties": false
+                    }
+                },
+                "requester_justification_config": {
+                    "type": "object",
+                    "properties": {
+                        "not_mandatory": {
+                            "type": "boolean"
+                        },
+                        "unstructured": {
+                            "type": "boolean"
+                        }
+                    },
+                    "additionalProperties": false
+                },
+                "manual_approvals": {
+                    "type": "object",
+                    "properties": {
+                        "require_approver_justification": {
+                            "type": "boolean"
+                        },
+                        "steps": {
+                            "type": "array",
+                            "items": {
+                                "type": "object",
+                                "properties": {
+                                    "approvers": {
+                                        "type": "array",
+                                        "items": {
+                                            "type": "string"
+                                        }
+                                    },
+                                    "approvals_needed": {
+                                        "type": "number"
+                                    },
+                                    "approver_email_recipients": {
+                                        "type": "array",
+                                        "items": {
+                                            "type": "string"
+                                        }
+                                    }
+                                },
+                                "required": [
+                                    "approvers"
+                                ],
+                                "additionalProperties": false
+                            }
+                        }
+                    },
+                    "required": [
+                        "require_approver_justification",
+                        "steps"
+                    ],
+                    "additionalProperties": false
+                },
+                "additional_notification_targets": {
+                    "type": "object",
+                    "properties": {
+                        "admin_email_recipients": {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            }
+                        },
+                        "requester_email_recipients": {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            }
+                        }
+                    },
+                    "additionalProperties": false
+                }
+            },
+            "required": [
+                "max_request_duration",
+                "eligible_users",
+                "privileged_access"
+            ],
+            "additionalProperties": false
+        }
+    },
+    "additionalProperties": false
+}

modules/organization/schemas/pam-entitlements.schema.md

@@ -0,0 +1,43 @@
+# None
+
+<!-- markdownlint-disable MD036 -->
+
+## Properties
+
+*additional properties: false*
+
+- **`^[a-z][a-z0-9-]{0,61}[a-z0-9]$`**: *object*
+  <br>*additional properties: false*
+  - ⁺**max_request_duration**: *string*
+  - ⁺**eligible_users**: *array*
+    - items: *string*
+  - ⁺**privileged_access**: *array*
+    - items: *object*
+      <br>*additional properties: false*
+      - ⁺**role**: *string*
+      - **condition**: *string*
+  - **requester_justification_config**: *object*
+    <br>*additional properties: false*
+    - **not_mandatory**: *boolean*
+    - **unstructured**: *boolean*
+  - **manual_approvals**: *object*
+    <br>*additional properties: false*
+    - ⁺**require_approver_justification**: *boolean*
+    - ⁺**steps**: *array*
+      - items: *object*
+        <br>*additional properties: false*
+        - ⁺**approvers**: *array*
+          - items: *string*
+        - **approvals_needed**: *number*
+        - **approver_email_recipients**: *array*
+          - items: *string*
+  - **additional_notification_targets**: *object*
+    <br>*additional properties: false*
+    - **admin_email_recipients**: *array*
+      - items: *string*
+    - **requester_email_recipients**: *array*
+      - items: *string*
+
+## Definitions
+
+