// groupsForUser returns the groups for the given user subject.
507799
func (ctx *RoleBindingRestrictionContext) groupsForUser(subject rbac.Subject) ([]*userapi.Group, error) {
	if subject.Kind != rbac.UserKind {
		return []*userapi.Group{}, fmt.Errorf("not a user: %q", subject.Name)
	}

	return ctx.groupCache.GroupsFor(subject.Name)
}
875752
func (s *DeviceEKStorage) ListAllForUser(mctx libkb.MetaContext) (all []string, err error) {
	defer mctx.TraceTimed("DeviceEKStorage#ListAllForUser", func() error { return err })()

	s.Lock()
	defer s.Unlock()

	return s.listAllForUser(mctx, mctx.ActiveDevice().Username(mctx))
}
1257543
func (s *UserService) GetGroups(username string) (*[]UserGroup, *Response, error) {
	apiEndpoint := fmt.Sprintf("/rest/api/2/user/groups?username=%s", username)
	req, err := s.client.NewRequest("GET", apiEndpoint, nil)
	if err != nil {
		return nil, nil, err
	}

	userGroups := new([]UserGroup)
	resp, err := s.client.Do(req, userGroups)
	if err != nil {
		return nil, resp, NewJiraError(resp, err)
	}
	return userGroups, resp, nil
}
879472
func (id *Identity) Subject() pkix.Name {
	subject := pkix.Name{
		CommonName: id.Username,
	}
	subject.Organization = append([]string{}, id.Groups...)
	subject.OrganizationalUnit = append([]string{}, id.Usage...)
	subject.Locality = append([]string{}, id.Principals...)
	subject.Province = append([]string{}, id.KubernetesGroups...)
	return subject
}
1015073
func (ctx *RoleBindingRestrictionContext) labelSetForGroup(subject rbac.Subject) (labels.Set, error) {
	if subject.Kind != rbac.GroupKind {
		return labels.Set{}, fmt.Errorf("not a group: %q", subject.Name)
	}

	labelSet, ok := ctx.groupToLabelSet[subject.Name]
	if ok {
		return labelSet, nil
	}

	group, err := ctx.userClient.Groups().Get(subject.Name, metav1.GetOptions{})
	if err != nil {
		return labels.Set{}, err
	}

	ctx.groupToLabelSet[subject.Name] = labels.Set(group.Labels)

	return ctx.groupToLabelSet[subject.Name], nil
}
30687
func (api *Client) EnableUserGroup(userGroup string) (UserGroup, error) {
	return api.EnableUserGroupContext(context.Background(), userGroup)
}
646137
func (org *Organization) Users() ([]*User, error) {
	var us []userResource
	err := org.PPE.get(fmt.Sprintf("/orgs/%s/users", org.PrimaryDomain), &us)
	if err != nil {
		return []*User{}, err
	}
	users := make([]*User, len(us))
	for i, u := range us {
		users[i] = userFromUserResource(org, u)
	}
	return users, nil
}
171004
func RoleForUser(u User) Role {
	return &RoleV3{
		Kind:    KindRole,
		Version: V3,
		Metadata: Metadata{
			Name:      RoleNameForUser(u.GetName()),
			Namespace: defaults.Namespace,
		},
		Spec: RoleSpecV3{
			Options: RoleOptions{
				CertificateFormat: teleport.CertificateFormatStandard,
				MaxSessionTTL:     NewDuration(defaults.MaxCertDuration),
				PortForwarding:    NewBoolOption(true),
				ForwardAgent:      NewBool(true),
			},
			Allow: RoleConditions{
				Namespaces: []string{defaults.Namespace},
				NodeLabels: Labels{Wildcard: []string{Wildcard}},
				Rules:      CopyRulesSlice(AdminUserRules),
			},
		},
	}
}
651363
func (api *Client) GetUserGroups(options ...GetUserGroupsOption) ([]UserGroup, error) {
	return api.GetUserGroupsContext(context.Background(), options...)
}
697458
func (c *Crowd) GetNestedGroups(user string) ([]*Group, error) {
	return c.GetGroups(user, true)
}
993818
func (o *L2Domain) Groups(info *bambou.FetchingInfo) (GroupsList, *bambou.Error) {

	var list GroupsList
	err := bambou.CurrentSession().FetchChildren(o, GroupIdentity, &list, info)
	return list, err
}
115800
func (st *State) CloudsForUser(user names.UserTag, all bool) ([]CloudInfo, error) {
	// We only treat the user as a superuser if they pass --all
	isControllerSuperuser := false
	if all {
		var err error
		isControllerSuperuser, err = st.isUserSuperuser(user)
		if err != nil {
			return nil, errors.Trace(err)
		}
	}

	clouds, closer := st.db().GetCollection(cloudsC)
	defer closer()

	var cloudQuery mongo.Query
	if isControllerSuperuser {
		// Fast path, we just get all the clouds.
		cloudQuery = clouds.Find(nil)
	} else {
		cloudNames, err := st.cloudNamesForUser(user)
		if err != nil {
			return nil, errors.Trace(err)
		}
		cloudQuery = clouds.Find(bson.M{
			"_id": bson.M{"$in": cloudNames},
		})
	}
	cloudQuery = cloudQuery.Sort("name")

	var cloudDocs []cloudDoc
	if err := cloudQuery.All(&cloudDocs); err != nil {
		return nil, errors.Trace(err)
	}
	result := make([]CloudInfo, len(cloudDocs))
	for i, c := range cloudDocs {
		result[i] = CloudInfo{
			Cloud: c.toCloud(),
		}
	}
	if err := st.fillInCloudUserAccess(user, result); err != nil {
		return nil, errors.Trace(err)
	}
	return result, nil
}
1182186
func (o *Enterprise) Users(info *bambou.FetchingInfo) (UsersList, *bambou.Error) {

	var list UsersList
	err := bambou.CurrentSession().FetchChildren(o, UserIdentity, &list, info)
	return list, err
}
1269237
func (o *Me) PolicyObjectGroups(info *bambou.FetchingInfo) (PolicyObjectGroupsList, *bambou.Error) {

	var list PolicyObjectGroupsList
	err := bambou.CurrentSession().FetchChildren(o, PolicyObjectGroupIdentity, &list, info)
	return list, err
}
1184942
func (r *showResults) Users() []chronograf.User {
	res := []chronograf.User{}
	for _, u := range *r {
		for _, s := range u.Series {
			for _, v := range s.Values {
				if name, ok := v[0].(string); !ok {
					continue
				} else if admin, ok := v[1].(bool); !ok {
					continue
				} else {
					c := chronograf.User{
						Name:        name,
						Permissions: chronograf.Permissions{},
					}
					if admin {
						c.Permissions = adminPerms()
					}
					res = append(res, c)
				}
			}
		}
	}
	return res
}
970957
func (p *provisioningIdentityMapper) UserFor(info authapi.UserIdentityInfo) (kuser.Info, error) {
	// Retrying up to three times lets us handle race conditions with up to two conflicting identity providers without returning an error
	// * A single race is possible on user creation for every conflicting identity provider
	// * A single race is possible on user creation between two instances of the same provider
	// * A single race is possible on identity creation between two instances of the same provider
	//
	// A race condition between three conflicting identity providers *and* multiple instances of the same identity provider
	// seems like a reasonable situation to return an error (you would get an AlreadyExists error on either the user or the identity)
	return p.userForWithRetries(info, 3)
}
4775
func (c *UsersProfileSetCall) User(user string) *UsersProfileSetCall {
	c.user = user
	return c
}