keystoneauth1(1)
| KEYSTONEAUTH1(1) | keystoneauth1 | KEYSTONEAUTH1(1) |
NAME
keystoneauth1 - keystoneauth1 5.3.0
Keystoneauth provides a standard way to do authentication and service requests within the OpenStack ecosystem. It is designed for use in conjunction with the existing OpenStack clients and for simplifying the process of writing new clients.
CONTENTS
Using Sessions
Introduction
The keystoneauth1.session.Session class was introduced into keystoneauth1 as an attempt to bring a unified interface to the various OpenStack clients that share common authentication and request parameters between a variety of services.
The model for using a Session and auth plugin as well as the general terms used have been heavily inspired by the requests library. However neither the Session class nor any of the authentication plugins rely directly on those concepts from the requests library so you should not expect a direct translation.
Features
- Common client authentication
Authentication is handled by one of a variety of authentication plugins and then this authentication information is shared between all the services that use the same Session object.
- Security maintenance
Security code is maintained in a single place and reused between all clients such that in the event of problems it can be fixed in a single location.
- Standard service and version discovery
Clients are not expected to have any knowledge of an identity token or any other form of identification credential. Service, endpoint, major version discovery, and microversion support discovery are handled by the Session and plugins. Discovery information is automatically cached in memory, so the user need not worry about excessive use of discovery metadata.
- Safe logging of HTTP interactions
Clients need to be able to enable logging of the HTTP interactions, but some things, such as the token or secrets, need to be ommitted.
Sessions for Users
The Session object is the contact point to your OpenStack cloud services. It stores the authentication credentials and connection information required to communicate with OpenStack such that it can be reused to communicate with many services. When creating services this Session object is passed to the client so that it may use this information.
A Session will authenticate on demand. When a request that requires authentication passes through the Session the authentication plugin will be asked for a valid token. If a valid token is available it will be used otherwise the authentication plugin may attempt to contact the authentication service and fetch a new one.
An example using keystoneclient to wrap a Session:
>>> from keystoneauth1.identity import v3 >>> from keystoneauth1 import session >>> from keystoneclient.v3 import client >>> auth = v3.Password(auth_url='https://my.keystone.com:5000/v3', ... username='myuser', ... password='mypassword', ... project_name='proj', ... user_domain_id='default', ... project_domain_id='default') >>> sess = session.Session(auth=auth, ... verify='/path/to/ca.cert') >>> ks = client.Client(session=sess) >>> users = ks.users.list()
As other OpenStack client libraries adopt this means of operating they will be created in a similar fashion by passing the Session object to the client's constructor.
Sharing Authentication Plugins
A Session can only contain one authentication plugin. However, there is nothing that specifically binds the authentication plugin to that Session - a new Session can be created that reuses the existing authentication plugin:
>>> new_sess = session.Session(auth=sess.auth,
verify='/path/to/different-cas.cert')
In this case we cannot know which Session object will be used when the plugin performs the authentication call so the command must be able to succeed with either.
Authentication plugins can also be provided on a per-request basis. This will be beneficial in a situation where a single Session is juggling multiple authentication credentials:
>>> sess.get('https://my.keystone.com:5000/v3',
auth=my_auth_plugin)
If an auth plugin is provided via parameter then it will override any auth plugin on the Session.
Sessions for Client Developers
Sessions are intended to take away much of the hassle of dealing with authentication data and token formats. Clients should be able to specify filter parameters for selecting the endpoint and have the parsing of the catalog managed for them.
Major Version Discovery and Microversion Support
In OpenStack, the root URLs of available services are distributed to the user in an object called the Service Catalog, which is part of the token they receive. Clients are expected to use the URLs from the Service Catalog rather than have them provided. The root URL of a given service is referred to as the endpoint of the service. The URL of a specific version of a service is referred to as a versioned endpoint. REST requests for a service are made against a given versioned endpoint.
The topic of Major API versions and microversions can be confusing. As keystoneauth provides facilities for discovery of versioned endpoints associated with a Major API Version and for fetching information about the microversions that versioned endpoint supports, it is important to be aware of the distinction between the two.
Conceptually the most important thing to understand is that a Major API Version describes the URL of a discrete versioned endpoint, while a given versioned endpoint might have properties that express that it supports a range of microversions.
When a user wants to make a REST request against a service, the user expresses the Major API version and the type of service so that the appropriate versioned endpoint can be found and used. For example, a user might request version 2 of the compute service from cloud.example.com and end up with a versioned endpoint of https://compute.example.com/v2.
Each service provides a discovery document at the root of each versioned endpoint that contains information about that versioned endpoint. Each service also provides a document at the root of the unversioned endpoint that contains a list of the discovery documents for all of the available versioned endpoints. By examining these documents, it is possible to find the versioned endpoint that corresponds with the user's desired Major API version.
Each of those documents may also indicate that the given versioned endpoint supports microversions by listing a minimum and maximum microversion that it understands. As a result of having found the versioned endpoint for the requested Major API version, the user will also know which microversions, if any, may be used in requests to that versioned endpoint.
When a client makes REST requests to the Major API version's endpoint, the client can, optionally, on a request-by-request basis, include a header specifying that the individual request use the behavior defined by the given microversion. If a client does not request a microversion, the service will behave as if the minimum supported microversion was specified.
The overall transaction then has three parts:
- What is the endpoint for a given Major API version of a given service?
- What are the minimum and maximum microversions supported at that endpoint?
- Which one of that range of microversions, if any, does the user want to use for a given request?
keystoneauth provides facilities for discovering the endpoint for a given Major API of a given service, as well as reporting the available microversion ranges that endpoint supports, if any.
More information is available in the API-WG Specs on the topics of Microversions and Consuming the Catalog.
Authentication
When making a request with a Session object you can simply pass the keyword parameter authenticated to indicate whether the argument should contain a token, by default a token is included if an authentication plugin is available:
>>> # In keystone this route is unprotected by default
>>> resp = sess.get('https://my.keystone.com:5000/v3',
authenticated=False)
Service Discovery
In general a client does not need to know the full URL for the server that they are communicating with, simply that it should send a request to a path belonging to the correct service.
This is controlled by the endpoint_filter parameter to a request which contains all the information an authentication plugin requires to determine the correct URL to which to send a request. When using this mode only the path for the request needs to be specified:
>>> resp = session.get('/users',
endpoint_filter={'service_type': 'identity',
'interface': 'admin',
'region_name': 'myregion',
'min_version': '2.0',
'max_version': '3.4',
'discover_versions': False})
NOTE:
endpoint_filter accepts a number of arguments with which it can determine an endpoint url:
- service_type
- the type of service. For example identity, compute, volume or many other predefined identifiers.
- interface
- the network exposure the interface has. Can also be a list, in which case the first matching interface will be used. Valid values are:
- public: An endpoint that is available to the wider internet or network.
- internal: An endpoint that is only accessible within the private network.
- admin: An endpoint to be used for administrative tasks.
- region_name
- the name of the region where the endpoint resides.
- version
- the minimum version, restricted to a given Major API. For instance, a version of 2.2 will match 2.2 and 2.3 but not 2.1 or 3.0. Mutually exclusive with min_version and max_version.
- min_version
- the minimum version of a given API, intended to be used as the lower bound of a range with max_version. See max_version for examples. Mutually exclusive with version.
- max_version
- the maximum version of a given API, intended to be used as the upper bound of a range with min_version. For example:
'min_version': '2.2', 'max_version': '3.3'
will match 2.2, 2.10, 3.0, and 3.3, but not 1.42, 2.1, or 3.20. Mutually exclusive with version.
NOTE:
- discover_versions
- whether or not version discovery should be run, even if not strictly necessary. It is often possible to fulfill an endpoint request purely from the catalog, meaning the version discovery API is a potentially wasted additional call. However, it's possible that running discovery instead of inference is desired. Defaults to True.
All version arguments (version, min_version and max_version) can be given as:
- string: '2.0'
- int: 2
- float: 2.0
- tuple of ints: (2, 0)
version and max_version can also be given the string latest, which indicates that the highest available version should be used.
The endpoint filter is a simple key-value filter and can be provided with any number of arguments. It is then up to the auth plugin to correctly use the parameters it understands.
If you want to further limit your service discovery by allowing experimental APIs or disallowing deprecated APIs, you can use the allow parameter:
>>> resp = session.get('/<project-id>/volumes',
endpoint_filter={'service_type': 'volume',
'interface': 'public',
'version': 1},
allow={'allow_deprecated': False})
The discoverable types of endpoints that allow can recognize are:
- allow_deprecated: Allow deprecated version endpoints.
- allow_experimental: Allow experimental version endpoints.
- allow_unknown: Allow endpoints with an unrecognised status.
The Session object creates a valid request by determining the URL matching the filters and appending it to the provided path. If multiple URL matches are found then any one may be chosen.
While authentication plugins will endeavour to maintain a consistent set of arguments for an endpoint_filter the concept of an authentication plugin is purposefully generic. A specific mechanism may not know how to interpret certain arguments in which case it may ignore them. For example the keystoneauth1.token_endpoint.Token plugin (which is used when you want to always use a specific endpoint and token combination) will always return the same endpoint regardless of the parameters to endpoint_filter or a custom OpenStack authentication mechanism may not have the concept of multiple interface options and choose to ignore that parameter.
There is some expectation on the user that they understand the limitations of the authentication system they are using.
Using Adapters
If the developer would prefer not to provide endpoint_filter with every API call, a keystoneauth1.adapter.Adapter can be created. The Adapter constructor takes the same arguments as endpoint_filter, as well as a Session. An Adapter behaves much like a Session, with the same REST methods, but is "mounted" on the endpoint that would be found by endpoint_filter.
adapter = keystoneauth1.adapter.Adapter(
session=session,
service_type='volume',
interface='public',
version=1) response = adapter.get('/volumes')
As with endpoint_filter on a Session, the version, min_version and max_version parameters exist to help determine the appropriate endpoint for a Major API of a service.
Endpoint Metadata
Both keystoneauth1.adapter.Adapter and keystoneauth1.session.Session have a method for getting metadata about the endpoint found for a given service: get_endpoint_data.
On the keystoneauth1.session.Session it takes the same arguments as endpoint_filter.
On the keystoneauth1.adapter.Adapter it does not take arguments, as it returns the information for the Endpoint the Adapter is mounted on.
get_endpoint_data returns an keystoneauth1.discovery.EndpointData object. This object can be used to find information about the Endpoint, including which major api_version was found, or which interface in case of ranges, lists of input values or latest version.
It can also be used to determine the min_microversion and max_microversion supported by the API. If an API does not support microversions, the values for both will be None. It will also contain values for next_min_version and not_before if they exist for the endpoint, or None if they do not. The keystoneauth1.discovery.EndpointData object will always contain microversion related attributes regardless of whether the REST document does or not.
get_endpoint_data makes use of the same cache as the rest of the discovery process, so calling it should incur no undue expense. By default it will make at least one version discovery call so that it can fetch microversion metadata. If the user knows a service does not support microversions and is merely curious as to which major version was discovered, discover_versions can be set to False to prevent fetching microversion metadata.
Requesting a Microversion
A user who wants to specify a microversion for a given request can pass it to the microversion parameter of the request method on the keystoneauth1.session.Session object, or the keystoneauth1.adapter.Adapter object. This will cause keystoneauth to pass the appropriate header to the service informing the service of the microversion the user wants.
resp = session.get('/volumes',
microversion='3.15',
endpoint_filter={'service_type': 'volume',
'interface': 'public',
'min_version': '3',
'max_version': 'latest'})
If the user is using a keystoneauth1.adapter.Adapter, the service_type, which is a part of the data sent in the microversion header, will be taken from the Adapter's service_type.
adapter = keystoneauth1.adapter.Adapter(
session=session,
service_type='compute',
interface='public',
min_version='2.1') response = adapter.get('/servers', microversion='2.38')
The user can also provide a default_microversion parameter to the Adapter constructor which will be used on all requests where an explicit microversion is not requested.
adapter = keystoneauth1.adapter.Adapter(
session=session,
service_type='compute',
interface='public',
min_version='2.1',
default_microversion='2.38') response = adapter.get('/servers')
If the user is using a keystoneauth1.session.Session, the service_type will be taken from the service_type in endpoint_filter.
If the service_type is the incorrect value to use for the microversion header for the service in question, the parameter microversion_service_type can be given. For instance, although keystoneauth already knows about Cinder, the service_type for Cinder is block-storage but the microversion header expects volume.
# Interactions with cinder do not need to explicitly override the
# microversion_service_type - it is only being used as an example for the
# use of the parameter.
resp = session.get('/volumes',
microversion='3.15',
microversion_service_type='volume',
endpoint_filter={'service_type': 'block-storage',
'interface': 'public',
'min_version': '3',
'max_version': 'latest'})
Logging
The logging system uses standard python logging rooted on the keystoneauth namespace as would be expected. There are two possibilities of where log messages about HTTP interactions will go.
By default, all messages will go to the keystoneauth.session logger.
If the split_loggers option on the keystoneauth1.session.Session constructor is set to True, the HTTP content will be split across four subloggers to allow for fine-grained control of what is logged and how:
- keystoneauth.session.request-id
- Emits a log entry at the DEBUG level for every http request including information about the URL, service-type and request-id.
- keystoneauth.session.request
- Emits a log entry at the DEBUG level for every http request including a curl formatted string of the request.
- keystoneauth.session.response
- Emits a log entry at the DEBUG level for every http response received, including the status code, and the headers received.
- keystoneauth.session.body
- Emits a log entry at the DEBUG level containing the contents of the response body if the content-type is either text or json.
Using loggers
A full description of how to consume python logging is out of scope of this document, but a few simple examples are provided.
If you would like to configure logging to log keystoneuath at the INFO level with no DEBUG messages:
import keystoneauth1
import logging
logger = logging.getLogger('keystoneauth')
logger.addHandler(logging.StreamHandler())
logger.setLevel(logging.INFO)
If you would like to get a full HTTP debug trace including bodies:
import keystoneauth1
import logging
logger = logging.getLogger('keystoneauth')
logger.addHandler(logging.StreamHandler())
logger.setLevel(logging.DEBUG)
If you would like to get a full HTTP debug trace bug with no bodies:
import keystoneauth1
import keystoneauth1.session
import logging
logger = logging.getLogger('keystoneauth')
logger.addHandler(logging.StreamHandler())
logger.setLevel(logging.DEBUG)
body_logger = logging.getLogger('keystoneauth.session.body')
body_logger.setLevel(logging.WARN)
session = keystoneauth1.session.Session(split_loggers=True)
Finally, if you would like to log request-ids and response headers to one file, request commands, response headers and response bodies to a different file, and everything else to the console:
import keystoneauth1
import keystoneauth1.session
import logging
# Create a handler that outputs only outputs INFO level messages to stdout
stream_handler = logging.StreamHandler()
stream_handler.setLevel(logging.INFO)
# Configure the default behavior of all keystoneauth logging to log at the
# INFO level.
logger = logging.getLogger('keystoneauth')
logger.setLevel(logging.INFO)
# Emit INFO messages from all keystoneauth loggers to stdout
logger.addHandler(stream_handler)
# Create an output formatter that includes logger name and timestamp.
formatter = logging.Formatter('%(asctime)s %(name)s %(message)s')
# Create a file output for request ids and response headers
request_handler = logging.FileHandler('request.log')
request_handler.setFormatter(formatter)
# Create a file output for request commands, response headers and bodies
body_handler = logging.FileHandler('response-body.log')
body_handler.setFormatter(formatter)
# Log all HTTP interactions at the DEBUG level
session_logger = logging.getLogger('keystoneauth.session')
session_logger.setLevel(logging.DEBUG)
# Emit request ids to the request log
request_id_logger = logging.getLogger('keystoneauth.session.request-id')
request_id_logger.addHandler(request_handler)
# Emit response headers to both the request log and the body log
header_logger = logging.getLogger('keystoneauth.session.response')
header_logger.addHandler(request_handler)
header_logger.addHandler(body_handler)
# Emit request commands to the body log
request_logger = logging.getLogger('keystoneauth.session.request')
request_logger.addHandler(body_handler)
# Emit bodies only to the body log
body_logger = logging.getLogger('keystoneauth.session.body')
body_logger.addHandler(body_handler)
session = keystoneauth1.session.Session(split_loggers=True)
The above will produce messages like the following in request.log:
2017-09-19 22:10:09,466 keystoneauth.session.request-id GET call to volumev2 for http://cloud.example.com/volume/v2/137155c35fb34172a284a3c2540c92ab/volumes/detail used request id req-f4f2058a-9308-4c4a-94e6-5ee1cd6c78bd 2017-09-19 22:10:09,751 keystoneauth.session.response [200] Date: Tue, 19 Sep 2017 22:10:09 GMT Server: Apache/2.4.18 (Ubuntu) x-compute-request-id: req-2e9181d2-9f3e-404e-a12f-1f1566736ab3 Content-Type: application/json Content-Length: 15 x-openstack-request-id: req-2e9181d2-9f3e-404e-a12f-1f1566736ab3 Connection: close
And content like the following into response-body.log:
2017-09-19 22:10:09,490 keystoneauth.session.request curl -g -i -X GET http://cloud.example.com/volume/v2/137155c35fb34172a284a3c2540c92ab/volumes/detail?marker=34cd00cf-bf67-4667-a900-5ce233e383d5 -H "User-Agent: os-client-config/1.28.0 shade/1.23.1 keystoneauth1/3.2.0 python-requests/2.18.4 CPython/2.7.12" -H "X-Auth-Token: {SHA1}a1d03d2a4cbee590a55f1786d452e1027d5fd781"
2017-09-19 22:10:09,751 keystoneauth.session.response [200] Date: Tue, 19 Sep 2017 22:10:09 GMT Server: Apache/2.4.18 (Ubuntu) x-compute-request-id: req-2e9181d2-9f3e-404e-a12f-1f1566736ab3 Content-Type: application/json Content-Length: 15 x-openstack-request-id: req-2e9181d2-9f3e-404e-a12f-1f1566736ab3 Connection: close
2017-09-19 22:10:09,751 keystoneauth.session.body {"volumes": []}
User Provided Loggers
The HTTP methods (request, get, post, put, etc) on keystoneauth1.session.Session and keystoneauth1.adapter.Adapter all support a logger parameter. A user can provide their own logger which will override the session loggers mentioned above. If a single logger is provided in this manner, request, response and body content will all be logged to that logger at the DEBUG level, and the strings REQ:, RESP: and RESP BODY: will be pre-pended as appropriate.
Authentication Plugins
Introduction
Authentication plugins provide a generic means by which to extend the authentication mechanisms known to OpenStack clients.
In the vast majority of cases the authentication plugins used will be those written for use with the OpenStack Identity Service (Keystone), however this is not the only possible case, and the mechanisms by which authentication plugins are used and implemented should be generic enough to cover completely customized authentication solutions.
The subset of authentication plugins intended for use with an OpenStack Identity server (such as Keystone) are called Identity Plugins.
Available Plugins
Keystoneauth ships with a number of plugins and particularly Identity Plugins.
V2 Identity Plugins
Standard V2 identity plugins are defined in the module: keystoneauth1.identity.v2
They include:
- Password: Authenticate against a V2 identity service using a username and password.
- Token: Authenticate against a V2 identity service using an existing token.
V2 identity plugins must use an auth_url that points to the root of a V2 identity server URL, i.e.: http://hostname:5000/v2.0.
V3 Identity Plugins
Standard V3 identity plugins are defined in the module keystoneauth1.identity.v3.
V3 Identity plugins are slightly different from their V2 counterparts as a V3 authentication request can contain multiple authentication methods. To handle this V3 defines a number of different AuthMethod classes:
- PasswordMethod: Authenticate against a V3 identity service using a username and password.
- TokenMethod: Authenticate against a V3 identity service using an existing token.
- ReceiptMethod: Authenticate against a V3 identity service using an existing auth-receipt. This method has to be used in conjunction with at least one other method.
- TOTPMethod: Authenticate against a V3 identity service using Time-Based One-Time Password (TOTP).
- TokenlessAuth: Authenticate against a V3 identity service using tokenless authentication.
- ApplicationCredentialMethod: Authenticate against a V3 identity service using an application credential.
- KerberosMethod: Authenticate against a V3 identity service using Kerberos.
- OAuth2ClientCredentialMethod: Authenticate against a V3 identity service using an OAuth2.0 client credential.
- OAuth2mTlsClientCredential: Authenticate against a V3 identity service using an OAuth2.0 Mutual-TLS client credentials.
The AuthMethod objects are then passed to the Auth plugin:
>>> from keystoneauth1 import session >>> from keystoneauth1.identity import v3 >>> password = v3.PasswordMethod(username='user', ... password='password', ... user_domain_name='default') >>> auth = v3.Auth(auth_url='http://my.keystone.com:5000/v3', ... auth_methods=[password], ... project_id='projectid') >>> sess = session.Session(auth=auth)
You can even add additional methods to an existing auth instance after it has been created:
>>> totp = v3.TOTPMethod(username='user', ... passcode='123456', ... user_domain_name='default') >>> auth.add_method(totp)
Or use the MultiFactor helper plugin to do it all simply in one go, an example of whichs exists in the section below.
For the common cases where you will only want to use one AuthMethod there are also helper authentication plugins for the various AuthMethod which can be used more like the V2 plugins:
- Password: Authenticate using only a PasswordMethod.
- Token: Authenticate using only a TokenMethod.
- TOTP: Authenticate using only a TOTPMethod.
- Kerberos: Authenticate using only a KerberosMethod.
>>> auth = v3.Password(auth_url='http://my.keystone.com:5000/v3', ... username='username', ... password='password', ... project_id='projectid', ... user_domain_name='default') >>> sess = session.Session(auth=auth)
This will have exactly the same effect as using the single PasswordMethod above.
V3 identity plugins must use an auth_url that points to the root of a V3 identity server URL, i.e.: http://hostname:5000/v3.
Multi-Factor with V3 Identity Plugins
The basic example of multi-factor authentication is when you supply all the needed auth methods up front.
This can be done by building an Auth class with method instances:
from keystoneauth1 import session from keystoneauth1.identity import v3 auth = v3.Auth(
auth_url='http://my.keystone.com:5000/v3',
auth_methods=[
v3.PasswordMethod(
username='user',
password='password',
user_domain_id="default",
),
v3.TOTPMethod(
username='user',
passcode='123456',
user_domain_id="default",
)
],
project_id='projectid', ) sess = session.Session(auth=auth)
Or by letting the helper plugin do it for you:
from keystoneauth1 import session from keystoneauth1.identity import v3 auth = v3.MultiFactor(
auth_url='http://my.keystone.com:5000/v3',
auth_methods=['v3password', 'v3totp'],
username='user',
password='password',
passcode='123456',
user_domain_id="default",
project_id='projectid', ) sess = session.Session(auth=auth)
Note: The MultiFactor helper does not support auth receipts as an option in auth_methods, but one can be added with auth.add_method.
When you supply just one method when multiple are needed, a MissingAuthMethods error will be raised. This can be caught, and you can infer based on the error what the missing methods were, and from it extract the receipt to continue authentication:
auth = v3.Password(auth_url='http://my.keystone.com:5000/v3',
username='username',
password='password',
project_id='projectid',
user_domain_id='default') sess = session.Session(auth=auth) try:
sess.get_token() except exceptions.MissingAuthMethods as e:
receipt = e.receipt
methods = e.methods
required_methods = e.required_auth_methods
Once you know what auth methods are needed to continue, you can extend the existing auth plugin with additional methods:
auth.add_method(
v3.TOTPMethod(
username='user',
passcode='123456',
user_domain_id='default',
) ) sess.get_token()
Or if you do not have the existing auth method, but have the receipt you can continue as well:
auth = v3.TOTP(
auth_url='http://my.keystone.com:5000/v3',
username='user',
passcode='123456',
user_domain_id='default',
project_id='projectid', ) auth.add_method(v3.ReceiptMethod(receipt=receipt)) sess = session.Session(auth=auth) sess.get_token()
Standalone Plugins
Services can be deployed in a standalone environment where there is no integration with an identity service. The following plugins are provided to support standalone services:
- HTTPBasicAuth: HTTP Basic authentication
- NoAuth: No authentication
Standalone plugins must be given an endpoint that points to the URL of the one service being used, since there is no service catalog to look up endpoints:
from keystoneauth1 import session from keystoneauth1 import noauth auth = noauth.NoAuth(endpoint='http://hostname:6385/') sess = session.Session(auth=auth)
HTTPBasicAuth also requres a username and password:
from keystoneauth1 import session from keystoneauth1 import http_basic auth = http_basic.HTTPBasicAuth(endpoint='http://hostname:6385/',
username='myUser',
password='myPassword') sess = session.Session(auth=auth)
Federation
The following V3 plugins are provided to support federation:
- MappedKerberos: Federated (mapped) Kerberos.
- Password: SAML2 password authentication.
- v3:OpenIDConnectAccessToken: Plugin to reuse an existing OpenID Connect access token.
- v3:OpenIDConnectAuthorizationCode: OpenID Connect Authorization Code grant type.
- v3:OpenIDConnectClientCredentials: OpenID Connect Client Credentials grant type.
- v3:OpenIDConnectPassword: OpenID Connect Resource Owner Password Credentials grant type.
- Keystone2Keystone: Keystone to Keystone Federation.
The Keystone2Keystone plugin is special as it takes a Password auth for one keystone instance acting as an Identity Provider as input in order to create a session on the keystone acting as a Service Provider, for example:
from keystoneauth1 import session from keystoneauth1.identity import v3 from keystoneauth1.identity.v3 import k2k pwauth = v3.Password(auth_url='http://my.keystone.com:5000/v3',
username='username',
password='password',
project_id='projectid',
user_domain_name='Default') k2kauth = k2k.Keystone2Keystone(pwauth, 'mysp',
project_id='federated_projectid') k2ksession = session.Session(auth=k2kauth)
Version Independent Identity Plugins
Standard version independent identity plugins are defined in the module keystoneauth1.identity.generic.
For the cases of plugins that exist under both the identity V2 and V3 APIs there is an abstraction to allow the plugin to determine which of the V2 and V3 APIs are supported by the server and use the most appropriate API.
These plugins are:
- Password: Authenticate using a user/password against either v2 or v3 API.
- Token: Authenticate using an existing token against either v2 or v3 API.
These plugins work by first querying the identity server to determine available versions and so the auth_url used with the plugins should point to the base URL of the identity server to use. If the auth_url points to either a V2 or V3 endpoint it will restrict the plugin to only working with that version of the API.
Simple Plugins
In addition to the Identity plugins a simple plugin that will always use the same provided token and endpoint is available. This is useful for situations where you have a token and want to bypass authentication to obtain a new token for subsequent requests. Testing, proxies, and service-to-service authentication on behalf of a user are good examples use cases for this authentication plugin.
It can be found at keystoneauth1.token_endpoint.Token.
For example:
>>> from keystoneauth1 import token_endpoint
>>> from keystoneauth1 import session
>>> a = token_endpoint.Token('http://my.keystone.com:5000/v3',
... token=token)
>>> s = session.Session(auth=a)
V3 OAuth 1.0a Plugins
There also exists a plugin for OAuth 1.0a authentication. We provide a helper authentication plugin at: V3OAuth1. The plugin requires the OAuth consumer's key and secret, as well as the OAuth access token's key and secret. For example:
>>> from keystoneauth1.extras import oauth1
>>> from keystoneauth1 import session
>>> a = oauth1.V3OAuth1('http://my.keystone.com:5000/v3',
... consumer_key=consumer_id,
... consumer_secret=consumer_secret,
... access_key=access_token_key,
... access_secret=access_token_secret)
>>> s = session.Session(auth=a)
Application Credentials
There is a specific authentication method for interacting with Identity servers that support application credential authentication. Since application credentials are associated to a user on a specific project, some parameters are not required as they would be with traditional password authentication. The following method can be used to authenticate for a token using an application credential:
- •
- ApplicationCredential:
The following example shows the method usage with a session:
>>> from keystoneauth1 import session >>> from keystone.identity import v3 >>> auth = v3.ApplicationCredential(
application_credential_secret='application_credential_secret',
application_credential_id='c2872b920853478292623be94b657090'
) >>> sess = session.Session(auth=auth)
OAuth2.0 Client Credentials
WARNING:
There is a specific authentication method for interacting with Identity servers that support OAuth2.0 Client Credential Grant. The notable difference from the other authentication method is that, after passing the authentication, the session will add "Authorization" header with an OAuth2.0 access token to sent subsequent requests. The following method can be used to authenticate for a token using OAuth2.0 client credentials:
- •
- OAuth2ClientCredential:
The following example shows the method usage with a session:
>>> from keystoneauth1 import session >>> from keystone.identity import v3 >>> auth = v3.OAuth2ClientCredential(
oauth2_endpoint='https://keystone.host/identity/v3/OS-OAUTH2/token'
oauth2_client_id='f96a2fec117141a6b5fbaa0485632244',
oauth2_client_secret='client_credential_secret'
) >>> sess = session.Session(auth=auth)
OAuth2.0 Mutual-TLS Client Credentials
WARNING:
There is a specific authentication method for interacting with Identity servers that support OAuth 2.0 Mutual-TLS Client Authentication. The notable difference from the other authentication method is that, after passing the authentication, the session will add "Authorization" header with an OAuth2.0 Certificate-Bound Access Tokens to sent subsequent requests. The following method can be used to authenticate for a token using OAuth2.0 Mutual-TLS client credentials:
- •
- OAuth2mTlsClientCredential:
The following example shows the method usage with a session:
>>> from keystoneauth1 import session >>> from keystone.identity import v3 >>> auth = v3.OAuth2mTlsClientCredential(
auth_url='http://keystone.host:5000/v3'
oauth2_endpoint='https://keystone.host/identity/v3/OS-OAUTH2/token'
oauth2_client_id='f96a2fec117141a6b5fbaa0485632244'
) >>> sess = session.Session(auth=auth)
Tokenless Auth
A plugin for tokenless authentication also exists. It provides a means to authorize client operations within the Identity server by using an X.509 TLS client certificate without having to issue a token. We provide a tokenless authentication plugin at:
- •
- TokenlessAuth
It is mostly used by service clients for token validation and here is an example of how this plugin would be used in practice:
>>> from keystoneauth1 import session
>>> from keystoneauth1.identity import v3
>>> auth = v3.TokenlessAuth(auth_url='https://keystone:5000/v3',
... domain_name='my_service_domain')
>>> sess = session.Session(
... auth=auth,
... cert=('/opt/service_client.crt',
... '/opt/service_client.key'),
... verify='/opt/ca.crt')
Loading Plugins by Name
In auth_token middleware and for some service to service communication it is possible to specify a plugin to load via name. The authentication options that are available are then specific to the plugin that you specified. Currently the authentication plugins that are available in keystoneauth are:
- http_basic: keystoneauth1.http_basic.HTTPBasicAuth
- none: keystoneauth1.noauth.NoAuth
- password: keystoneauth1.identity.generic.Password
- token: keystoneauth1.identity.generic.Token
- v2password: keystoneauth1.identity.v2.Password
- v2token: keystoneauth1.identity.v2.Token
- v3applicationcredential: keystoneauth1.identity.v3.ApplicationCredential
- v3password: keystoneauth1.identity.v3.Password
- v3token: keystoneauth1.identity.v3.Token
- v3fedkerb: keystoneauth1.extras.kerberos.MappedKerberos
- v3kerberos: keystoneauth1.extras.kerberos.Kerberos
- v3oauth1: keystoneauth1.extras.oauth1.v3.OAuth1
- v3oidcaccesstoken: keystoneauth1.identity.v3:OpenIDConnectAccessToken
- v3oidcauthcode: keystoneauth1.identity.v3:OpenIDConnectAuthorizationCode
- v3oidcdeviceauthz: keystoneauth1.loading._plugins.identity.v3:OpenIDConnectDeviceAuthorization
- v3oidcclientcredentials: keystoneauth1.identity.v3:OpenIDConnectClientCredentials
- v3oidcpassword: keystoneauth1.identity.v3:OpenIDConnectPassword
- v3samlpassword: keystoneauth1.extras._saml2.v3.Password
- v3tokenlessauth: keystoneauth1.identity.v3.TokenlessAuth
- v3totp: keystoneauth1.identity.v3.TOTP
- v3oauth2clientcredential: keystoneauth1.identity.v3.OAuth2ClientCredential
- v3oauth2mtlsclientcredential: keystoneauth1.identity.v3.OAuth2mTlsClientCredential
Creating Authentication Plugins
Creating an Identity Plugin
If you have implemented a new authentication mechanism into the Identity service then you will be able to reuse a lot of the infrastructure available for the existing Identity mechanisms. As the V2 identity API is essentially frozen, it is expected that new plugins are for the V3 API.
To implement a new V3 plugin that can be combined with others you should implement the base keystoneauth1.identity.v3.AuthMethod class and implement the get_auth_data() function. If your Plugin cannot be used in conjunction with existing keystoneauth1.identity.v3.AuthMethod then you should just override keystoneauth1.identity.v3.Auth directly.
The new AuthMethod should take all the required parameters via __init__() and return from get_auth_data() a tuple with the unique identifier of this plugin (e.g. password) and a dictionary containing the payload of values to send to the authentication server. The session, calling auth object and request headers are also passed to this function so that the plugin may use or manipulate them.
You should also provide a class that inherits from keystoneauth1.identity.v3.Auth with an instance of your new AuthMethod as the auth_methods parameter to keystoneauth1.identity.v3.Auth.
By convention (and like above) these are named PluginType and PluginTypeMethod (for example Password and PasswordMethod).
Creating a Custom Plugin
To implement an entirely new plugin you should implement the base class keystoneauth1.plugin.BaseAuthPlugin and provide the get_endpoint(), get_token() and invalidate() methods.
get_token() is called to retrieve the string token from a plugin. It is intended that a plugin will cache a received token and so if the token is still valid then it should be re-used rather than fetching a new one. A session object is provided with which the plugin can contact it's server. (Note: use authenticated=False when making those requests or it will end up being called recursively). The return value should be the token as a string.
get_endpoint() is called to determine a base URL for a particular service's requests. The keyword arguments provided to the function are those that are given by the endpoint_filter variable in keystoneauth1.session.Session.request(). A session object is also provided so that the plugin may contact an external source to determine the endpoint. Again this will be generally be called once per request and so it is up to the plugin to cache these responses if appropriate. The return value should be the base URL to communicate with.
invalidate() should also be implemented to clear the current user credentials so that on the next get_token() call a new token can be retrieved.
The most simple example of a plugin is the keystoneauth1.token_endpoint.Token plugin.
Plugin Options
Using plugins via config file
When using the plugins via config file you define the plugin name as auth_type. The options of the plugin are then specified while replacing - with _ to be valid in configuration.
For example to use the password plugin in a config file you would specify:
[section] auth_url = http://keystone.example.com:5000/ auth_type = password username = myuser password = mypassword project_name = myproject default_domain_name = mydomain
Using plugins via CLI
When using auth plugins via CLI via os-client-config or shade you can specify parameters via environment configuration by using the pattern OS_ followed by the uppercase parameter name replacing - with _.
For example to use the password plugin via environment variable you specify:
export OS_AUTH_TYPE=password export OS_AUTH_URL=http://keystone.example.com:5000/ export OS_USERNAME=myuser export OS_PASSWORD=mypassword export OS_PROJECT_NAME=myproject export OS_DEFAULT_DOMAIN_NAME=mydomain
Specifying operations via CLI parameter will override the environment parameter. These are specified with the pattern --os- and the parameter name. Using the password example again:
openstack --os-auth-type password \
--os-auth-url http://keystone.example.com:5000/ \
--os-username myuser \
--os-password mypassword \
--os-project-name myproject \
--os-default-domain-name mydomain \
operation
Additional loaders
The configuration and CLI loaders are quite commonly used however similar concepts are found in other situations such as os-client-config in which you specify authentication and other cloud parameters in a clouds.yaml file.
Loaders such as these use the same plugin options listed below, but via their own mechanism. In os-client-config the password plugin looks like:
clouds:
mycloud:
auth_type: password
auth:
auth_url: http://keystone.example.com:5000/
auth_type: password
username: myuser
password: mypassword
project_name: myproject
default_domain_name: mydomain
However different services may implement loaders in their own way and you should consult their relevant documentation. The same auth options will be available.
Available Plugins
This is a listing of all included plugins and the options that they accept. Plugins are listed alphabetically and not in any order of priority.
admin_token
Use an existing token and a known endpoint to perform requests.
This plugin is primarily useful for development or for use with identity service ADMIN tokens. Because this token is used directly there is no fetching a service catalog or determining scope information and so it cannot be used by clients that expect use this scope information.
Because there is no service catalog the endpoint that is supplied with initialization is used for all operations performed with this plugin so must be the full base URL to an actual service.
----
- endpoint
- The endpoint that will always be used
- token
- The token that will always be used
http_basic
Use HTTP Basic authentication to perform requests.
This can be used to instantiate clients for services deployed in standalone mode.
There is no fetching a service catalog or determining scope information and so it cannot be used by clients that expect to use this scope information.
----
- username
- Username
- password
- User's password
- endpoint
- The endpoint that will always be used
none
Use no tokens to perform requests.
This can be used to instantiate clients for services deployed in noauth/standalone mode.
There is no fetching a service catalog or determining scope information and so it cannot be used by clients that expect to use this scope information.
----
- endpoint
- The endpoint that will always be used
password
Authenticate via a username and password.
Authenticate to the identity service using an inbuilt username and password. This is the standard and most common form of authentication.
As a generic plugin this plugin is identity version independent and will discover available versions before use. This means it expects to be providen an unversioned URL to operate against.
----
- auth-url
- Authentication URL
- system-scope
- Scope for system operations
- domain-id
- Domain ID to scope to
- domain-name
- Domain name to scope to
- project-id
- Project ID to scope to
- project-name
- Project name to scope to
- project-domain-id
- Domain ID containing project
- project-domain-name
- Domain name containing project
- trust-id
- ID of the trust to use as a trustee use
- default-domain-id
- Optional domain ID to use with v3 and v2 parameters. It will be used for both the user and project domain in v3 and ignored in v2 authentication.
- default-domain-name
- Optional domain name to use with v3 API and v2 parameters. It will be used for both the user and project domain in v3 and ignored in v2 authentication.
- user-id
- User id
- username
- Username
- user-domain-id
- User's domain id
- user-domain-name
- User's domain name
- password
- User's password
token
Given an existing token rescope it to another target.
This plugin uses the Identity service's rescope mechanism to get a new token based upon an existing token. Because an auth plugin requires a service catalog and scope information it is often easier to fetch a new token based on an existing one than validate and reuse the one you already have.
As a generic plugin this plugin is identity version independent and will discover available versions before use. This means it expects to be providen an unversioned URL to operate against.
----
- auth-url
- Authentication URL
- system-scope
- Scope for system operations
- domain-id
- Domain ID to scope to
- domain-name
- Domain name to scope to
- project-id
- Project ID to scope to
- project-name
- Project name to scope to
- project-domain-id
- Domain ID containing project
- project-domain-name
- Domain name containing project
- trust-id
- ID of the trust to use as a trustee use
- default-domain-id
- Optional domain ID to use with v3 and v2 parameters. It will be used for both the user and project domain in v3 and ignored in v2 authentication.
- default-domain-name
- Optional domain name to use with v3 API and v2 parameters. It will be used for both the user and project domain in v3 and ignored in v2 authentication.
- token
- Token to authenticate with
v2password
- auth-url
- Authentication URL
- tenant-id
- Tenant ID
- tenant-name
- Tenant Name
- trust-id
- ID of the trust to use as a trustee use
- username
- Username to login with
- user-id
- User ID to login with
- password
- Password to use
v2token
- auth-url
- Authentication URL
- tenant-id
- Tenant ID
- tenant-name
- Tenant Name
- trust-id
- ID of the trust to use as a trustee use
- token
- Token
v3adfspassword
- auth-url
- Authentication URL
- system-scope
- Scope for system operations
- domain-id
- Domain ID to scope to
- domain-name
- Domain name to scope to
- project-id
- Project ID to scope to
- project-name
- Project name to scope to
- project-domain-id
- Domain ID containing project
- project-domain-name
- Domain name containing project
- trust-id
- ID of the trust to use as a trustee use
- identity-provider
- Identity Provider's name
- protocol
- Protocol for federated plugin
- identity-provider-url
- An Identity Provider URL, where the SAML authentication request will be sent.
- service-provider-endpoint
- Service Provider's Endpoint
- service-provider-entity-id
- Service Provider's SAML Entity ID
- username
- Username
- password
- Password
v3applicationcredential
- auth-url
- Authentication URL
- system-scope
- Scope for system operations
- domain-id
- Domain ID to scope to
- domain-name
- Domain name to scope to
- project-id
- Project ID to scope to
- project-name
- Project name to scope to
- project-domain-id
- Domain ID containing project
- project-domain-name
- Domain name containing project
- trust-id
- ID of the trust to use as a trustee use
- user-id
- User ID
- username
- Username
- user-domain-id
- User's domain id
- user-domain-name
- User's domain name
- application_credential_secret
- Application credential auth secret
- application_credential_id
- Application credential ID
- application_credential_name
- Application credential name
v3fedkerb
- auth-url
- Authentication URL
- system-scope
- Scope for system operations
- domain-id
- Domain ID to scope to
- domain-name
- Domain name to scope to
- project-id
- Project ID to scope to
- project-name
- Project name to scope to
- project-domain-id
- Domain ID containing project
- project-domain-name
- Domain name containing project
- trust-id
- ID of the trust to use as a trustee use
- identity-provider
- Identity Provider's name
- protocol
- Protocol for federated plugin
- mutual-auth
- Configures Kerberos Mutual Authentication
v3kerberos
- auth-url
- Authentication URL
- system-scope
- Scope for system operations
- domain-id
- Domain ID to scope to
- domain-name
- Domain name to scope to
- project-id
- Project ID to scope to
- project-name
- Project name to scope to
- project-domain-id
- Domain ID containing project
- project-domain-name
- Domain name containing project
- trust-id
- ID of the trust to use as a trustee use
- mutual-auth
- Configures Kerberos Mutual Authentication
v3multifactor
- auth-url
- Authentication URL
- system-scope
- Scope for system operations
- domain-id
- Domain ID to scope to
- domain-name
- Domain name to scope to
- project-id
- Project ID to scope to
- project-name
- Project name to scope to
- project-domain-id
- Domain ID containing project
- project-domain-name
- Domain name containing project
- trust-id
- ID of the trust to use as a trustee use
- auth_methods
- Methods to authenticate with.
v3oauth1
- auth-url
- Authentication URL
- consumer-key
- OAuth Consumer ID/Key
- consumer-secret
- OAuth Consumer Secret
- access-key
- OAuth Access Key
- access-secret
- OAuth Access Secret
v3oauth2clientcredential
- auth-url
- Authentication URL
- system-scope
- Scope for system operations
- domain-id
- Domain ID to scope to
- domain-name
- Domain name to scope to
- project-id
- Project ID to scope to
- project-name
- Project name to scope to
- project-domain-id
- Domain ID containing project
- project-domain-name
- Domain name containing project
- trust-id
- ID of the trust to use as a trustee use
- oauth2_endpoint
- Endpoint for OAuth2.0
- oauth2_client_id
- Client id for OAuth2.0
- oauth2_client_secret
- Client secret for OAuth2.0
v3oauth2mtlsclientcredential
- auth-url
- Authentication URL
- system-scope
- Scope for system operations
- domain-id
- Domain ID to scope to
- domain-name
- Domain name to scope to
- project-id
- Project ID to scope to
- project-name
- Project name to scope to
- project-domain-id
- Domain ID containing project
- project-domain-name
- Domain name containing project
- trust-id
- ID of the trust to use as a trustee use
- oauth2-endpoint
- Endpoint for OAuth2.0 Mutual-TLS Authorization
- oauth2-client-id
- Client credential ID for OAuth2.0 Mutual-TLS Authorization
v3oidcaccesstoken
- auth-url
- Authentication URL
- system-scope
- Scope for system operations
- domain-id
- Domain ID to scope to
- domain-name
- Domain name to scope to
- project-id
- Project ID to scope to
- project-name
- Project name to scope to
- project-domain-id
- Domain ID containing project
- project-domain-name
- Domain name containing project
- trust-id
- ID of the trust to use as a trustee use
- identity-provider
- Identity Provider's name
- protocol
- Protocol for federated plugin
- access-token
- OAuth 2.0 Access Token
v3oidcauthcode
- auth-url
- Authentication URL
- system-scope
- Scope for system operations
- domain-id
- Domain ID to scope to
- domain-name
- Domain name to scope to
- project-id
- Project ID to scope to
- project-name
- Project name to scope to
- project-domain-id
- Domain ID containing project
- project-domain-name
- Domain name containing project
- trust-id
- ID of the trust to use as a trustee use
- identity-provider
- Identity Provider's name
- protocol
- Protocol for federated plugin
- client-id
- OAuth 2.0 Client ID
- client-secret
- OAuth 2.0 Client Secret
- openid-scope
- OpenID Connect scope that is requested from authorization server. Note that the OpenID Connect specification states that "openid" must be always specified.
- access-token-endpoint
- OpenID Connect Provider Token Endpoint. Note that if a discovery document is being passed this option will override the endpoint provided by the server in the discovery document.
- discovery-endpoint
- OpenID Connect Discovery Document URL. The discovery document will be used to obtain the values of the access token endpoint and the authentication endpoint. This URL should look like https://idp.example.org/.well-known/openid-configuration
- access-token-type
- OAuth 2.0 Authorization Server Introspection token type, it is used to decide which type of token will be used when processing token introspection. Valid values are: "access_token" or "id_token"
- redirect-uri
- OpenID Connect Redirect URL
- code
- OAuth 2.0 Authorization Code
v3oidcclientcredentials
- auth-url
- Authentication URL
- system-scope
- Scope for system operations
- domain-id
- Domain ID to scope to
- domain-name
- Domain name to scope to
- project-id
- Project ID to scope to
- project-name
- Project name to scope to
- project-domain-id
- Domain ID containing project
- project-domain-name
- Domain name containing project
- trust-id
- ID of the trust to use as a trustee use
- identity-provider
- Identity Provider's name
- protocol
- Protocol for federated plugin
- client-id
- OAuth 2.0 Client ID
- client-secret
- OAuth 2.0 Client Secret
- openid-scope
- OpenID Connect scope that is requested from authorization server. Note that the OpenID Connect specification states that "openid" must be always specified.
- access-token-endpoint
- OpenID Connect Provider Token Endpoint. Note that if a discovery document is being passed this option will override the endpoint provided by the server in the discovery document.
- discovery-endpoint
- OpenID Connect Discovery Document URL. The discovery document will be used to obtain the values of the access token endpoint and the authentication endpoint. This URL should look like https://idp.example.org/.well-known/openid-configuration
- access-token-type
- OAuth 2.0 Authorization Server Introspection token type, it is used to decide which type of token will be used when processing token introspection. Valid values are: "access_token" or "id_token"
v3oidcdeviceauthz
- auth-url
- Authentication URL
- system-scope
- Scope for system operations
- domain-id
- Domain ID to scope to
- domain-name
- Domain name to scope to
- project-id
- Project ID to scope to
- project-name
- Project name to scope to
- project-domain-id
- Domain ID containing project
- project-domain-name
- Domain name containing project
- trust-id
- ID of the trust to use as a trustee use
- identity-provider
- Identity Provider's name
- protocol
- Protocol for federated plugin
- client-id
- OAuth 2.0 Client ID
- client-secret
- OAuth 2.0 Client Secret
- openid-scope
- OpenID Connect scope that is requested from authorization server. Note that the OpenID Connect specification states that "openid" must be always specified.
- access-token-endpoint
- OpenID Connect Provider Token Endpoint. Note that if a discovery document is being passed this option will override the endpoint provided by the server in the discovery document.
- discovery-endpoint
- OpenID Connect Discovery Document URL. The discovery document will be used to obtain the values of the access token endpoint and the authentication endpoint. This URL should look like https://idp.example.org/.well-known/openid-configuration
- device-authorization-endpoint
- OAuth 2.0 Device Authorization Endpoint. Note that if a discovery document is being passed this option will override the endpoint provided by the server in the discovery document.
- code-challenge-method
- PKCE Challenge Method (RFC 7636)
v3oidcpassword
- auth-url
- Authentication URL
- system-scope
- Scope for system operations
- domain-id
- Domain ID to scope to
- domain-name
- Domain name to scope to
- project-id
- Project ID to scope to
- project-name
- Project name to scope to
- project-domain-id
- Domain ID containing project
- project-domain-name
- Domain name containing project
- trust-id
- ID of the trust to use as a trustee use
- identity-provider
- Identity Provider's name
- protocol
- Protocol for federated plugin
- client-id
- OAuth 2.0 Client ID
- client-secret
- OAuth 2.0 Client Secret
- openid-scope
- OpenID Connect scope that is requested from authorization server. Note that the OpenID Connect specification states that "openid" must be always specified.
- access-token-endpoint
- OpenID Connect Provider Token Endpoint. Note that if a discovery document is being passed this option will override the endpoint provided by the server in the discovery document.
- discovery-endpoint
- OpenID Connect Discovery Document URL. The discovery document will be used to obtain the values of the access token endpoint and the authentication endpoint. This URL should look like https://idp.example.org/.well-known/openid-configuration
- access-token-type
- OAuth 2.0 Authorization Server Introspection token type, it is used to decide which type of token will be used when processing token introspection. Valid values are: "access_token" or "id_token"
- username
- Username
- password
- Password
v3password
- auth-url
- Authentication URL
- system-scope
- Scope for system operations
- domain-id
- Domain ID to scope to
- domain-name
- Domain name to scope to
- project-id
- Project ID to scope to
- project-name
- Project name to scope to
- project-domain-id
- Domain ID containing project
- project-domain-name
- Domain name containing project
- trust-id
- ID of the trust to use as a trustee use
- user-id
- User ID
- username
- Username
- user-domain-id
- User's domain id
- user-domain-name
- User's domain name
- password
- User's password
v3samlpassword
- auth-url
- Authentication URL
- system-scope
- Scope for system operations
- domain-id
- Domain ID to scope to
- domain-name
- Domain name to scope to
- project-id
- Project ID to scope to
- project-name
- Project name to scope to
- project-domain-id
- Domain ID containing project
- project-domain-name
- Domain name containing project
- trust-id
- ID of the trust to use as a trustee use
- identity-provider
- Identity Provider's name
- protocol
- Protocol for federated plugin
- identity-provider-url
- An Identity Provider URL, where the SAML2 authentication request will be sent.
- username
- Username
- password
- Password
v3token
- auth-url
- Authentication URL
- system-scope
- Scope for system operations
- domain-id
- Domain ID to scope to
- domain-name
- Domain name to scope to
- project-id
- Project ID to scope to
- project-name
- Project name to scope to
- project-domain-id
- Domain ID containing project
- project-domain-name
- Domain name containing project
- trust-id
- ID of the trust to use as a trustee use
- token
- Token to authenticate with
v3tokenlessauth
- auth-url
- Authentication URL
- domain-id
- Domain ID to scope to
- domain-name
- Domain name to scope to
- project-id
- Project ID to scope to
- project-name
- Project name to scope to
- project-domain-id
- Domain ID containing project
- project-domain-name
- Domain name containing project
v3totp
- auth-url
- Authentication URL
- system-scope
- Scope for system operations
- domain-id
- Domain ID to scope to
- domain-name
- Domain name to scope to
- project-id
- Project ID to scope to
- project-name
- Project name to scope to
- project-domain-id
- Domain ID containing project
- project-domain-name
- Domain name containing project
- trust-id
- ID of the trust to use as a trustee use
- user-id
- User ID
- username
- Username
- user-domain-id
- User's domain id
- user-domain-name
- User's domain name
- passcode
- User's TOTP passcode
Extras
The extensibility of keystoneauth plugins is purposefully designed to allow a range of different authentication mechanisms that don't have to reside in the upstream packages. There are however a number of plugins that upstream supports that involve additional dependencies that the keystoneauth package cannot depend upon directly.
To get around this we utilize setuptools extras dependencies for additional plugins. To use a plugin like the kerberos plugin that has additional dependencies you must install the additional dependencies like:
pip install keystoneauth1[kerberos]
By convention (not a requirement) extra plugins have a module located in the keystoneauth1.extras module with the same name as the dependency. eg:
from keystoneauth1.extras import kerberos
There is no keystoneauth specific check that the correct dependencies are installed for accessing a module. You would expect to see standard python ImportError when the required dependencies are not found.
Examples
All extras plugins follow the pattern:
- 1.
- import plugin module
- 2.
- instantiate the plugin
- 3.
- call get_token method of the plugin passing it a session object to get a token
Kerberos
Get domain-scoped token using Kerberos:
from keystoneauth1.extras import kerberos
from keystoneauth1 import session
plugin = kerberos.Kerberos('http://example.com:5000/v3')
sess = session.Session(plugin)
token = plugin.get_token(sess)
Get unscoped federated token:
from keystoneauth1.extras import kerberos from keystoneauth1 import session plugin = kerberos.MappedKerberos(
auth_url='http://example.com:5000/v3', protocol='example_protocol',
identity_provider='example_identity_provider') sess = session.Session() token = plugin.get_token(sess)
Get project scoped federated token:
from keystoneauth1.extras import kerberos from keystoneauth1 import session plugin = kerberos.MappedKerberos(
auth_url='http://example.com:5000/v3', protocol='example_protocol',
identity_provider='example_identity_provider',
project_id='example_project_id') sess = session.Session() token = plugin.get_token(sess) project_id = plugin.get_project_id(sess)
Migrating from keystoneclient
When keystoneauth was extracted from keystoneclient the basic usage of the session, adapter and auth plugins purposefully did not change. If you are using them in a supported fashion from keystoneclient then the transition should be fairly simple.
Authentication Plugins
The authentication plugins themselves changed very little however there were changes to the way plugins are loaded and some of the supporting classes.
Plugin Loading
In keystoneclient auth plugin loading is managed by the class itself. This method proved useful in allowing the plugin to control the way it was loaded however it linked the authentication logic with the config and CLI loading.
In keystoneauth this has been severed and the auth plugin is handled separately from the mechanism that loads it.
Authentication plugins still implement the base authentication class BaseAuthPlugin. To make the plugins capable of being loaded from CLI or CONF file you should implement the base BaseLoader class which is loaded when --os-auth-type is used. This class handles the options that are presented, and then constructs the authentication plugin for use by the application.
Largely the options that are returned will be the same as what was used in keystoneclient however in keystoneclient the options used oslo_config.cfg.Opt objects. Due to trying to keep minimal dependencies there is no direct dependency from keystoneauth on oslo.config and instead options should be specified as Opt objects.
To ensure distinction between the plugins, the setuptools entrypoints that plugins register at has been updated to reflect keystoneauth1 and should now be: keystoneauth1.plugin
AccessInfo Objects
AccessInfo objects are a representation of the information stored within a token. In keystoneclient these objects were dictionaries of the token data with property accessors. In keystoneauth the dictionary interface has been removed and just the property accessors are available.
The creation function has also changed. The keystoneclient.access.AccessInfo.factory() method has been removed and replaced with the keystoneauth1.access.create().
Step-by-step migration example
Add keystoneauth1 to requirements.txt
In the code do the following change:
-from keystoneclient import auth +from keystoneauth1 import plugin
consequently:
-auth.BaseAuthPlugin +plugin.BaseAuthPlugin
To import service catalog:
-from keystoneclient import service_catalog +from keystoneauth1.access import service_catalog
To get url using service catalog endpoint_type parameter was changed to interface:
-service_catalog.ServiceCatalogV2(sc).service_catalog.url_for(..., endpoint_type=interface) +service_catalog.ServiceCatalogV2(sc).service_catalog.url_for(..., interface=interface)
Obtaining the session:
-from keystoneclient import session +from keystoneauth1 import loading as ks_loading -_SESSION = session.Session.load_from_conf_options( -auth_plugin = auth.load_from_conf_options(conf, NEUTRON_GROUP) +_SESSION = ks_loading.load_session_from_conf_options( +auth_plugin = ks_loading.load_auth_from_conf_options(conf, NEUTRON_GROUP)
Mocking session for test purposes:
-@mock.patch('keystoneclient.session.Session')
+@mock.patch('keystoneauth1.session.Session')
Token fixture imports haven't change much:
-from keystoneclient.fixture import V2Token +from keystoneauth1.fixture import V2Token
keystoneauth1
keystoneauth1 package
Subpackages
keystoneauth1.access package
Submodules
keystoneauth1.access.access module
- class keystoneauth1.access.access.AccessInfo(body, auth_token=None)
- Bases: object
Encapsulates a raw authentication token from keystone.
Provides helper methods for extracting useful values from that token.
- property audit_chain_id
- Return the audit chain ID if present.
In the event that a token was rescoped then this ID will be the audit_id of the initial token. Returns None if no value present.
- Returns
- str or None.
- property audit_id
- Return the audit ID if present.
- Returns
- str or None.
- property auth_token
- Return the token_id associated with the auth request.
To be used in headers for authenticating OpenStack API requests.
- Returns
- str
- property bind
- Information about external mechanisms the token is bound to.
If a token is bound to an external authentication mechanism it can only be used in conjunction with that mechanism. For example if bound to a kerberos principal it may only be accepted if there is also kerberos authentication performed on the request.
- Returns
- A dictionary or None. The key will be the bind type the value is a dictionary that is specific to the format of the bind type. Returns None if there is no bind information in the token.
- property domain_id
- Return the domain id associated with the auth request.
- Returns
- str or None (if no domain associated with the token)
- property domain_name
- Return the domain name associated with the auth request.
- Returns
- str or None (if no domain associated with the token)
- property domain_scoped
- Return true if the auth token was scoped to a domain.
- Returns
- bool
- property expires
- Return the token expiration (as datetime object).
- Returns
- datetime
- has_service_catalog()
- Return true if the auth token has a service catalog.
- Returns
- boolean
- property initial_audit_id
- The audit ID of the initially requested token.
This is the audit_chain_id if present or the audit_id.
- property is_admin_project
- Return true if the current project scope is the admin project.
For backwards compatibility purposes if there is nothing specified in the token we always assume we are in the admin project, so this will default to True.
:returns boolean
- property is_federated
- Return true if federation was used to get the token.
- Returns
- boolean
- property issued
- Return the token issue time (as datetime object).
- Returns
- datetime
- property oauth_access_token_id
- Return the access token ID if OAuth authentication used.
- Returns
- str or None.
- property oauth_consumer_id
- Return the consumer ID if OAuth authentication used.
- Returns
- str or None.
- property project_domain_id
- Return the project's domain id associated with the auth request.
- Returns
- str
- property project_domain_name
- Return the project's domain name associated with the auth request.
- Returns
- str
- property project_id
- Return the project ID associated with the auth request.
This returns None if the auth token wasn't scoped to a project.
- Returns
- str or None (if no project associated with the token)
- property project_is_domain
- Return if a project act as a domain.
- Returns
- bool
- property project_name
- Return the project name associated with the auth request.
- Returns
- str or None (if no project associated with the token)
- property project_scoped
- Return true if the auth token was scoped to a tenant (project).
- Returns
- bool
- property role_ids
- Return a list of user's role ids associated with the auth request.
- Returns
- a list of strings of role ids
- property role_names
- Return a list of user's role names associated with the auth request.
- Returns
- a list of strings of role names
- property scoped
- Return true if the auth token was scoped.
Returns true if scoped to a tenant(project) or domain, and contains a populated service catalog.
This is deprecated, use project_scoped instead.
- Returns
- bool
- property service_catalog
- property service_providers
- Return an object representing the list of trusted service providers.
Used for Keystone2Keystone federating-out.
- Returns
- keystoneauth1.service_providers.ServiceProviders or None
- property system_scoped
- Return true if the auth token was scoped to the system.
- Returns
- bool
- property tenant_id
- Synonym for project_id.
- property tenant_name
- Synonym for project_name.
- property trust_id
- Return the trust id associated with the auth request.
- Returns
- str or None (if no trust associated with the token)
- property trust_scoped
- Return true if the auth token was scoped from a delegated trust.
The trust delegation is via the OS-TRUST v3 extension.
- Returns
- bool
- property trustee_user_id
- Return the trustee user id associated with a trust.
- Returns
- str or None (if no trust associated with the token)
- property trustor_user_id
- Return the trustor user id associated with a trust.
- Returns
- str or None (if no trust associated with the token)
- property user_domain_id
- Return the user's domain id associated with the auth request.
- Returns
- str
- property user_domain_name
- Return the user's domain name associated with the auth request.
- Returns
- str
- property user_id
- Return the user id associated with the auth request.
- Returns
- str
- property username
- Return the username associated with the auth request.
Follows the pattern defined in the V2 API of first looking for 'name', returning that if available, and falling back to 'username' if name is unavailable.
- Returns
- str
- will_expire_soon(stale_duration=30)
- Determine if expiration is about to occur.
- Returns
- true if expiration is within the given duration
- Return type
- boolean
- class keystoneauth1.access.access.AccessInfoV2(body, auth_token=None)
- Bases: AccessInfo
An object for encapsulating raw v2 auth token from identity service.
- property audit_chain_id
- Return the audit chain ID if present.
In the event that a token was rescoped then this ID will be the audit_id of the initial token. Returns None if no value present.
- Returns
- str or None.
- property audit_id
- Return the audit ID if present.
- Returns
- str or None.
- property auth_token
- Return the token_id associated with the auth request.
To be used in headers for authenticating OpenStack API requests.
- Returns
- str
- property bind
- Information about external mechanisms the token is bound to.
If a token is bound to an external authentication mechanism it can only be used in conjunction with that mechanism. For example if bound to a kerberos principal it may only be accepted if there is also kerberos authentication performed on the request.
- Returns
- A dictionary or None. The key will be the bind type the value is a dictionary that is specific to the format of the bind type. Returns None if there is no bind information in the token.
- property domain_id
- Return the domain id associated with the auth request.
- Returns
- str or None (if no domain associated with the token)
- property domain_name
- Return the domain name associated with the auth request.
- Returns
- str or None (if no domain associated with the token)
- property domain_scoped
- Return true if the auth token was scoped to a domain.
- Returns
- bool
- property expires
- Return the token expiration (as datetime object).
- Returns
- datetime
- has_service_catalog()
- Return true if the auth token has a service catalog.
- Returns
- boolean
- property is_admin_project
- Return true if the current project scope is the admin project.
For backwards compatibility purposes if there is nothing specified in the token we always assume we are in the admin project, so this will default to True.
:returns boolean
- property is_federated
- Return true if federation was used to get the token.
- Returns
- boolean
- property issued
- Return the token issue time (as datetime object).
- Returns
- datetime
- property oauth_access_token_id
- Return the access token ID if OAuth authentication used.
- Returns
- str or None.
- property oauth_consumer_id
- Return the consumer ID if OAuth authentication used.
- Returns
- str or None.
- property project_domain_id
- Return the project's domain id associated with the auth request.
- Returns
- str
- property project_domain_name
- Return the project's domain name associated with the auth request.
- Returns
- str
- property project_id
- Return the project ID associated with the auth request.
This returns None if the auth token wasn't scoped to a project.
- Returns
- str or None (if no project associated with the token)
- property project_is_domain
- Return if a project act as a domain.
- Returns
- bool
- property project_name
- Return the project name associated with the auth request.
- Returns
- str or None (if no project associated with the token)
- property role_ids
- Return a list of user's role ids associated with the auth request.
- Returns
- a list of strings of role ids
- property role_names
- Return a list of user's role names associated with the auth request.
- Returns
- a list of strings of role names
- property service_providers
- Return an object representing the list of trusted service providers.
Used for Keystone2Keystone federating-out.
- Returns
- keystoneauth1.service_providers.ServiceProviders or None
- property system_scoped
- Return true if the auth token was scoped to the system.
- Returns
- bool
- property trust_id
- Return the trust id associated with the auth request.
- Returns
- str or None (if no trust associated with the token)
- property trust_scoped
- Return true if the auth token was scoped from a delegated trust.
The trust delegation is via the OS-TRUST v3 extension.
- Returns
- bool
- property trustee_user_id
- Return the trustee user id associated with a trust.
- Returns
- str or None (if no trust associated with the token)
- property trustor_user_id
- Return the trustor user id associated with a trust.
- Returns
- str or None (if no trust associated with the token)
- property user_domain_id
- Return the user's domain id associated with the auth request.
- Returns
- str
- property user_domain_name
- Return the user's domain name associated with the auth request.
- Returns
- str
- property user_id
- Return the user id associated with the auth request.
- Returns
- str
- property username
- Return the username associated with the auth request.
Follows the pattern defined in the V2 API of first looking for 'name', returning that if available, and falling back to 'username' if name is unavailable.
- Returns
- str
- version = 'v2.0'
- class keystoneauth1.access.access.AccessInfoV3(body, auth_token=None)
- Bases: AccessInfo
An object encapsulating raw v3 auth token from identity service.
- property application_credential
- property application_credential_access_rules
- property application_credential_id
- property audit_chain_id
- Return the audit chain ID if present.
In the event that a token was rescoped then this ID will be the audit_id of the initial token. Returns None if no value present.
- Returns
- str or None.
- property audit_id
- Return the audit ID if present.
- Returns
- str or None.
- property bind
- Information about external mechanisms the token is bound to.
If a token is bound to an external authentication mechanism it can only be used in conjunction with that mechanism. For example if bound to a kerberos principal it may only be accepted if there is also kerberos authentication performed on the request.
- Returns
- A dictionary or None. The key will be the bind type the value is a dictionary that is specific to the format of the bind type. Returns None if there is no bind information in the token.
- property domain_id
- Return the domain id associated with the auth request.
- Returns
- str or None (if no domain associated with the token)
- property domain_name
- Return the domain name associated with the auth request.
- Returns
- str or None (if no domain associated with the token)
- property domain_scoped
- Return true if the auth token was scoped to a domain.
- Returns
- bool
- property expires
- Return the token expiration (as datetime object).
- Returns
- datetime
- has_service_catalog()
- Return true if the auth token has a service catalog.
- Returns
- boolean
- property is_admin_project
- Return true if the current project scope is the admin project.
For backwards compatibility purposes if there is nothing specified in the token we always assume we are in the admin project, so this will default to True.
:returns boolean
- property is_federated
- Return true if federation was used to get the token.
- Returns
- boolean
- property issued
- Return the token issue time (as datetime object).
- Returns
- datetime
- property oauth2_credential
- property oauth2_credential_thumbprint
- property oauth_access_token_id
- Return the access token ID if OAuth authentication used.
- Returns
- str or None.
- property oauth_consumer_id
- Return the consumer ID if OAuth authentication used.
- Returns
- str or None.
- property project_domain_id
- Return the project's domain id associated with the auth request.
- Returns
- str
- property project_domain_name
- Return the project's domain name associated with the auth request.
- Returns
- str
- property project_id
- Return the project ID associated with the auth request.
This returns None if the auth token wasn't scoped to a project.
- Returns
- str or None (if no project associated with the token)
- property project_is_domain
- Return if a project act as a domain.
- Returns
- bool
- property project_name
- Return the project name associated with the auth request.
- Returns
- str or None (if no project associated with the token)
- property role_ids
- Return a list of user's role ids associated with the auth request.
- Returns
- a list of strings of role ids
- property role_names
- Return a list of user's role names associated with the auth request.
- Returns
- a list of strings of role names
- property service_providers
- Return an object representing the list of trusted service providers.
Used for Keystone2Keystone federating-out.
- Returns
- keystoneauth1.service_providers.ServiceProviders or None
- property system
- property system_scoped
- Return true if the auth token was scoped to the system.
- Returns
- bool
- property trust_id
- Return the trust id associated with the auth request.
- Returns
- str or None (if no trust associated with the token)
- property trust_scoped
- Return true if the auth token was scoped from a delegated trust.
The trust delegation is via the OS-TRUST v3 extension.
- Returns
- bool
- property trustee_user_id
- Return the trustee user id associated with a trust.
- Returns
- str or None (if no trust associated with the token)
- property trustor_user_id
- Return the trustor user id associated with a trust.
- Returns
- str or None (if no trust associated with the token)
- property user_domain_id
- Return the user's domain id associated with the auth request.
- Returns
- str
- property user_domain_name
- Return the user's domain name associated with the auth request.
- Returns
- str
- property user_id
- Return the user id associated with the auth request.
- Returns
- str
- property username
- Return the username associated with the auth request.
Follows the pattern defined in the V2 API of first looking for 'name', returning that if available, and falling back to 'username' if name is unavailable.
- Returns
- str
- version = 'v3'
- keystoneauth1.access.access.create(resp=None, body=None, auth_token=None)
keystoneauth1.access.service_catalog module
- class keystoneauth1.access.service_catalog.ServiceCatalog(catalog)
- Bases: object
Helper methods for dealing with a Keystone Service Catalog.
- property catalog
- Return the raw service catalog content, mostly useful for debugging.
Applications should avoid this and use accessor methods instead. However, there are times when inspecting the raw catalog can be useful for analysis and other reasons.
- endpoint_data_for(service_type=None, interface='public', region_name=None, service_name=None, service_id=None, endpoint_id=None)
- Fetch endpoint data from the service catalog.
Fetch the specified endpoint data from the service catalog for a particular endpoint attribute. If no attribute is given, return the first endpoint of the specified type.
- Valid interface types: public or publicURL,
- internal or internalURL, admin or 'adminURL`
- Parameters
- service_type (string) -- Service type of the endpoint.
- interface -- Type of endpoint. Can be a single value or a list of values. If it's a list of values, they will be looked for in order of preference.
- region_name (string) -- Region of the endpoint.
- service_name (string) -- The assigned name of the service.
- service_id (string) -- The identifier of a service.
- endpoint_id (string) -- The identifier of an endpoint.
- get_endpoint_data_list(service_type=None, interface='public', region_name=None, service_name=None, service_id=None, endpoint_id=None)
- Fetch a flat list of matching EndpointData objects.
Fetch the endpoints from the service catalog for a particular endpoint attribute. If no attribute is given, return the first endpoint of the specified type.
- Valid interface types: public or publicURL,
- internal or internalURL, admin or 'adminURL`
- Parameters
- service_type (string) -- Service type of the endpoint.
- interface -- Type of endpoint. Can be a single value or a list of values. If it's a list of values, they will be looked for in order of preference.
- region_name (string) -- Region of the endpoint.
- service_name (string) -- The assigned name of the service.
- service_id (string) -- The identifier of a service.
- endpoint_id (string) -- The identifier of an endpoint.
- Returns
- a list of matching EndpointData objects
- Return type
- list(keystoneauth1.discover.EndpointData)
- get_endpoints(service_type=None, interface=None, region_name=None, service_name=None, service_id=None, endpoint_id=None)
- Fetch and filter endpoint data for the specified service(s).
Returns endpoints for the specified service (or all) containing the specified type (or all) and region (or all) and service name.
If there is no name in the service catalog the service_name check will be skipped. This allows compatibility with services that existed before the name was available in the catalog.
Returns a dict keyed by service_type with a list of endpoint dicts
- get_endpoints_data(service_type=None, interface=None, region_name=None, service_name=None, service_id=None, endpoint_id=None)
- Fetch and filter endpoint data for the specified service(s).
Returns endpoints for the specified service (or all) containing the specified type (or all) and region (or all) and service name.
If there is no name in the service catalog the service_name check will be skipped. This allows compatibility with services that existed before the name was available in the catalog.
- Valid interface types: public or publicURL,
- internal or internalURL, admin or 'adminURL`
- Parameters
- service_type (string) -- Service type of the endpoint.
- interface -- Type of endpoint. Can be a single value or a list of values. If it's a list of values, they will be looked for in order of preference.
- region_name (string) -- Region of the endpoint.
- service_name (string) -- The assigned name of the service.
- service_id (string) -- The identifier of a service.
- endpoint_id (string) -- The identifier of an endpoint.
- Returns
- a list of matching EndpointData objects
- Return type
- list(keystoneauth1.discover.EndpointData)
- Returns
- a dict, keyed by service_type, of lists of EndpointData
- get_urls(service_type=None, interface='public', region_name=None, service_name=None, service_id=None, endpoint_id=None)
- Fetch endpoint urls from the service catalog.
Fetch the urls of endpoints from the service catalog for a particular endpoint attribute. If no attribute is given, return the url of the first endpoint of the specified type.
- Valid interface types: public or publicURL,
- internal or internalURL, admin or 'adminURL`
- Parameters
- service_type (string) -- Service type of the endpoint.
- interface -- Type of endpoint. Can be a single value or a list of values. If it's a list of values, they will be looked for in order of preference.
- region_name (string) -- Region of the endpoint.
- service_name (string) -- The assigned name of the service.
- service_id (string) -- The identifier of a service.
- endpoint_id (string) -- The identifier of an endpoint.
- Returns
- tuple of urls
- abstract is_interface_match(endpoint, interface)
- Helper function to normalize endpoint matching across v2 and v3.
- Returns
- True if the provided endpoint matches the required interface otherwise False.
- normalize_catalog()
- Return the catalog normalized into v3 format.
- static normalize_interface(self, interface)
- Handle differences in the way v2 and v3 catalogs specify endpoint.
Both v2 and v3 must be able to handle the endpoint style of the other. For example v2 must be able to handle a 'public' interface and v3 must be able to handle a 'publicURL' interface.
- Returns
- the endpoint string in the format appropriate for this service catalog.
- url_for(service_type=None, interface='public', region_name=None, service_name=None, service_id=None, endpoint_id=None)
- Fetch an endpoint from the service catalog.
Fetch the specified endpoint from the service catalog for a particular endpoint attribute. If no attribute is given, return the first endpoint of the specified type.
- Valid interface types: public or publicURL,
- internal or internalURL, admin or 'adminURL`
- Parameters
- service_type (string) -- Service type of the endpoint.
- interface -- Type of endpoint. Can be a single value or a list of values. If it's a list of values, they will be looked for in order of preference.
- region_name (string) -- Region of the endpoint.
- service_name (string) -- The assigned name of the service.
- service_id (string) -- The identifier of a service.
- endpoint_id (string) -- The identifier of an endpoint.
- class keystoneauth1.access.service_catalog.ServiceCatalogV2(catalog)
- Bases: ServiceCatalog
An object for encapsulating the v2 service catalog.
The object is created using raw v2 auth token from Keystone.
- classmethod from_token(token)
- is_interface_match(endpoint, interface)
- Helper function to normalize endpoint matching across v2 and v3.
- Returns
- True if the provided endpoint matches the required interface otherwise False.
- static normalize_interface(interface)
- Handle differences in the way v2 and v3 catalogs specify endpoint.
Both v2 and v3 must be able to handle the endpoint style of the other. For example v2 must be able to handle a 'public' interface and v3 must be able to handle a 'publicURL' interface.
- Returns
- the endpoint string in the format appropriate for this service catalog.
- class keystoneauth1.access.service_catalog.ServiceCatalogV3(catalog)
- Bases: ServiceCatalog
An object for encapsulating the v3 service catalog.
The object is created using raw v3 auth token from Keystone.
- classmethod from_token(token)
- is_interface_match(endpoint, interface)
- Helper function to normalize endpoint matching across v2 and v3.
- Returns
- True if the provided endpoint matches the required interface otherwise False.
- static normalize_interface(interface)
- Handle differences in the way v2 and v3 catalogs specify endpoint.
Both v2 and v3 must be able to handle the endpoint style of the other. For example v2 must be able to handle a 'public' interface and v3 must be able to handle a 'publicURL' interface.
- Returns
- the endpoint string in the format appropriate for this service catalog.
keystoneauth1.access.service_providers module
- class keystoneauth1.access.service_providers.ServiceProviders(service_providers)
- Bases: object
Helper methods for dealing with Service Providers.
- classmethod from_token(token)
- get_auth_url(sp_id)
- get_sp_url(sp_id)
Module contents
- class keystoneauth1.access.AccessInfo(body, auth_token=None)
- Bases: object
Encapsulates a raw authentication token from keystone.
Provides helper methods for extracting useful values from that token.
- property audit_chain_id
- Return the audit chain ID if present.
In the event that a token was rescoped then this ID will be the audit_id of the initial token. Returns None if no value present.
- Returns
- str or None.
- property audit_id
- Return the audit ID if present.
- Returns
- str or None.
- property auth_token
- Return the token_id associated with the auth request.
To be used in headers for authenticating OpenStack API requests.
- Returns
- str
- property bind
- Information about external mechanisms the token is bound to.
If a token is bound to an external authentication mechanism it can only be used in conjunction with that mechanism. For example if bound to a kerberos principal it may only be accepted if there is also kerberos authentication performed on the request.
- Returns
- A dictionary or None. The key will be the bind type the value is a dictionary that is specific to the format of the bind type. Returns None if there is no bind information in the token.
- property domain_id
- Return the domain id associated with the auth request.
- Returns
- str or None (if no domain associated with the token)
- property domain_name
- Return the domain name associated with the auth request.
- Returns
- str or None (if no domain associated with the token)
- property domain_scoped
- Return true if the auth token was scoped to a domain.
- Returns
- bool
- property expires
- Return the token expiration (as datetime object).
- Returns
- datetime
- has_service_catalog()
- Return true if the auth token has a service catalog.
- Returns
- boolean
- property initial_audit_id
- The audit ID of the initially requested token.
This is the audit_chain_id if present or the audit_id.
- property is_admin_project
- Return true if the current project scope is the admin project.
For backwards compatibility purposes if there is nothing specified in the token we always assume we are in the admin project, so this will default to True.
:returns boolean
- property is_federated
- Return true if federation was used to get the token.
- Returns
- boolean
- property issued
- Return the token issue time (as datetime object).
- Returns
- datetime
- property oauth_access_token_id
- Return the access token ID if OAuth authentication used.
- Returns
- str or None.
- property oauth_consumer_id
- Return the consumer ID if OAuth authentication used.
- Returns
- str or None.
- property project_domain_id
- Return the project's domain id associated with the auth request.
- Returns
- str
- property project_domain_name
- Return the project's domain name associated with the auth request.
- Returns
- str
- property project_id
- Return the project ID associated with the auth request.
This returns None if the auth token wasn't scoped to a project.
- Returns
- str or None (if no project associated with the token)
- property project_is_domain
- Return if a project act as a domain.
- Returns
- bool
- property project_name
- Return the project name associated with the auth request.
- Returns
- str or None (if no project associated with the token)
- property project_scoped
- Return true if the auth token was scoped to a tenant (project).
- Returns
- bool
- property role_ids
- Return a list of user's role ids associated with the auth request.
- Returns
- a list of strings of role ids
- property role_names
- Return a list of user's role names associated with the auth request.
- Returns
- a list of strings of role names
- property scoped
- Return true if the auth token was scoped.
Returns true if scoped to a tenant(project) or domain, and contains a populated service catalog.
This is deprecated, use project_scoped instead.
- Returns
- bool
- property service_catalog
- property service_providers
- Return an object representing the list of trusted service providers.
Used for Keystone2Keystone federating-out.
- Returns
- keystoneauth1.service_providers.ServiceProviders or None
- property system_scoped
- Return true if the auth token was scoped to the system.
- Returns
- bool
- property tenant_id
- Synonym for project_id.
- property tenant_name
- Synonym for project_name.
- property trust_id
- Return the trust id associated with the auth request.
- Returns
- str or None (if no trust associated with the token)
- property trust_scoped
- Return true if the auth token was scoped from a delegated trust.
The trust delegation is via the OS-TRUST v3 extension.
- Returns
- bool
- property trustee_user_id
- Return the trustee user id associated with a trust.
- Returns
- str or None (if no trust associated with the token)
- property trustor_user_id
- Return the trustor user id associated with a trust.
- Returns
- str or None (if no trust associated with the token)
- property user_domain_id
- Return the user's domain id associated with the auth request.
- Returns
- str
- property user_domain_name
- Return the user's domain name associated with the auth request.
- Returns
- str
- property user_id
- Return the user id associated with the auth request.
- Returns
- str
- property username
- Return the username associated with the auth request.
Follows the pattern defined in the V2 API of first looking for 'name', returning that if available, and falling back to 'username' if name is unavailable.
- Returns
- str
- will_expire_soon(stale_duration=30)
- Determine if expiration is about to occur.
- Returns
- true if expiration is within the given duration
- Return type
- boolean
- class keystoneauth1.access.AccessInfoV2(body, auth_token=None)
- Bases: AccessInfo
An object for encapsulating raw v2 auth token from identity service.
- property audit_chain_id
- Return the audit chain ID if present.
In the event that a token was rescoped then this ID will be the audit_id of the initial token. Returns None if no value present.
- Returns
- str or None.
- property audit_id
- Return the audit ID if present.
- Returns
- str or None.
- property auth_token
- Return the token_id associated with the auth request.
To be used in headers for authenticating OpenStack API requests.
- Returns
- str
- property bind
- Information about external mechanisms the token is bound to.
If a token is bound to an external authentication mechanism it can only be used in conjunction with that mechanism. For example if bound to a kerberos principal it may only be accepted if there is also kerberos authentication performed on the request.
- Returns
- A dictionary or None. The key will be the bind type the value is a dictionary that is specific to the format of the bind type. Returns None if there is no bind information in the token.
- property domain_id
- Return the domain id associated with the auth request.
- Returns
- str or None (if no domain associated with the token)
- property domain_name
- Return the domain name associated with the auth request.
- Returns
- str or None (if no domain associated with the token)
- property domain_scoped
- Return true if the auth token was scoped to a domain.
- Returns
- bool
- property expires
- Return the token expiration (as datetime object).
- Returns
- datetime
- has_service_catalog()
- Return true if the auth token has a service catalog.
- Returns
- boolean
- property is_admin_project
- Return true if the current project scope is the admin project.
For backwards compatibility purposes if there is nothing specified in the token we always assume we are in the admin project, so this will default to True.
:returns boolean
- property is_federated
- Return true if federation was used to get the token.
- Returns
- boolean
- property issued
- Return the token issue time (as datetime object).
- Returns
- datetime
- property oauth_access_token_id
- Return the access token ID if OAuth authentication used.
- Returns
- str or None.
- property oauth_consumer_id
- Return the consumer ID if OAuth authentication used.
- Returns
- str or None.
- property project_domain_id
- Return the project's domain id associated with the auth request.
- Returns
- str
- property project_domain_name
- Return the project's domain name associated with the auth request.
- Returns
- str
- property project_id
- Return the project ID associated with the auth request.
This returns None if the auth token wasn't scoped to a project.
- Returns
- str or None (if no project associated with the token)
- property project_is_domain
- Return if a project act as a domain.
- Returns
- bool
- property project_name
- Return the project name associated with the auth request.
- Returns
- str or None (if no project associated with the token)
- property role_ids
- Return a list of user's role ids associated with the auth request.
- Returns
- a list of strings of role ids
- property role_names
- Return a list of user's role names associated with the auth request.
- Returns
- a list of strings of role names
- property service_providers
- Return an object representing the list of trusted service providers.
Used for Keystone2Keystone federating-out.
- Returns
- keystoneauth1.service_providers.ServiceProviders or None
- property system_scoped
- Return true if the auth token was scoped to the system.
- Returns
- bool
- property trust_id
- Return the trust id associated with the auth request.
- Returns
- str or None (if no trust associated with the token)
- property trust_scoped
- Return true if the auth token was scoped from a delegated trust.
The trust delegation is via the OS-TRUST v3 extension.
- Returns
- bool
- property trustee_user_id
- Return the trustee user id associated with a trust.
- Returns
- str or None (if no trust associated with the token)
- property trustor_user_id
- Return the trustor user id associated with a trust.
- Returns
- str or None (if no trust associated with the token)
- property user_domain_id
- Return the user's domain id associated with the auth request.
- Returns
- str
- property user_domain_name
- Return the user's domain name associated with the auth request.
- Returns
- str
- property user_id
- Return the user id associated with the auth request.
- Returns
- str
- property username
- Return the username associated with the auth request.
Follows the pattern defined in the V2 API of first looking for 'name', returning that if available, and falling back to 'username' if name is unavailable.
- Returns
- str
- version = 'v2.0'
- class keystoneauth1.access.AccessInfoV3(body, auth_token=None)
- Bases: AccessInfo
An object encapsulating raw v3 auth token from identity service.
- property application_credential
- property application_credential_access_rules
- property application_credential_id
- property audit_chain_id
- Return the audit chain ID if present.
In the event that a token was rescoped then this ID will be the audit_id of the initial token. Returns None if no value present.
- Returns
- str or None.
- property audit_id
- Return the audit ID if present.
- Returns
- str or None.
- property bind
- Information about external mechanisms the token is bound to.
If a token is bound to an external authentication mechanism it can only be used in conjunction with that mechanism. For example if bound to a kerberos principal it may only be accepted if there is also kerberos authentication performed on the request.
- Returns
- A dictionary or None. The key will be the bind type the value is a dictionary that is specific to the format of the bind type. Returns None if there is no bind information in the token.
- property domain_id
- Return the domain id associated with the auth request.
- Returns
- str or None (if no domain associated with the token)
- property domain_name
- Return the domain name associated with the auth request.
- Returns
- str or None (if no domain associated with the token)
- property domain_scoped
- Return true if the auth token was scoped to a domain.
- Returns
- bool
- property expires
- Return the token expiration (as datetime object).
- Returns
- datetime
- has_service_catalog()
- Return true if the auth token has a service catalog.
- Returns
- boolean
- property is_admin_project
- Return true if the current project scope is the admin project.
For backwards compatibility purposes if there is nothing specified in the token we always assume we are in the admin project, so this will default to True.
:returns boolean
- property is_federated
- Return true if federation was used to get the token.
- Returns
- boolean
- property issued
- Return the token issue time (as datetime object).
- Returns
- datetime
- property oauth2_credential
- property oauth2_credential_thumbprint
- property oauth_access_token_id
- Return the access token ID if OAuth authentication used.
- Returns
- str or None.
- property oauth_consumer_id
- Return the consumer ID if OAuth authentication used.
- Returns
- str or None.
- property project_domain_id
- Return the project's domain id associated with the auth request.
- Returns
- str
- property project_domain_name
- Return the project's domain name associated with the auth request.
- Returns
- str
- property project_id
- Return the project ID associated with the auth request.
This returns None if the auth token wasn't scoped to a project.
- Returns
- str or None (if no project associated with the token)
- property project_is_domain
- Return if a project act as a domain.
- Returns
- bool
- property project_name
- Return the project name associated with the auth request.
- Returns
- str or None (if no project associated with the token)
- property role_ids
- Return a list of user's role ids associated with the auth request.
- Returns
- a list of strings of role ids
- property role_names
- Return a list of user's role names associated with the auth request.
- Returns
- a list of strings of role names
- property service_providers
- Return an object representing the list of trusted service providers.
Used for Keystone2Keystone federating-out.
- Returns
- keystoneauth1.service_providers.ServiceProviders or None
- property system
- property system_scoped
- Return true if the auth token was scoped to the system.
- Returns
- bool
- property trust_id
- Return the trust id associated with the auth request.
- Returns
- str or None (if no trust associated with the token)
- property trust_scoped
- Return true if the auth token was scoped from a delegated trust.
The trust delegation is via the OS-TRUST v3 extension.
- Returns
- bool
- property trustee_user_id
- Return the trustee user id associated with a trust.
- Returns
- str or None (if no trust associated with the token)
- property trustor_user_id
- Return the trustor user id associated with a trust.
- Returns
- str or None (if no trust associated with the token)
- property user_domain_id
- Return the user's domain id associated with the auth request.
- Returns
- str
- property user_domain_name
- Return the user's domain name associated with the auth request.
- Returns
- str
- property user_id
- Return the user id associated with the auth request.
- Returns
- str
- property username
- Return the username associated with the auth request.
Follows the pattern defined in the V2 API of first looking for 'name', returning that if available, and falling back to 'username' if name is unavailable.
- Returns
- str
- version = 'v3'
- keystoneauth1.access.create(resp=None, body=None, auth_token=None)
keystoneauth1.exceptions package
Submodules
keystoneauth1.exceptions.auth module
- exception keystoneauth1.exceptions.auth.AuthorizationFailure(message=None)
- Bases: ClientException
- message = 'Cannot authorize API client.'
- exception keystoneauth1.exceptions.auth.MissingAuthMethods(response)
- Bases: ClientException
- message = 'Not all required auth rules were satisfied'
keystoneauth1.exceptions.auth_plugins module
- exception keystoneauth1.exceptions.auth_plugins.AuthPluginException(message=None)
- Bases: ClientException
- message = 'Unknown error with authentication plugins.'
- exception keystoneauth1.exceptions.auth_plugins.MissingAuthPlugin(message=None)
- Bases: AuthPluginException
- message = 'An authenticated request is required but no plugin available.'
- exception keystoneauth1.exceptions.auth_plugins.MissingRequiredOptions(options)
- Bases: OptionError
One or more required options were not provided.
- Parameters
- options (list(keystoneauth1.loading.Opt)) -- Missing options.
- options
- List of the missing options.
- exception keystoneauth1.exceptions.auth_plugins.NoMatchingPlugin(name)
- Bases: AuthPluginException
No auth plugins could be created from the parameters provided.
- Parameters
- name (str) -- The name of the plugin that was attempted to load.
- name
- The name of the plugin that was attempted to load.
- exception keystoneauth1.exceptions.auth_plugins.OptionError(message=None)
- Bases: AuthPluginException
A requirement of this plugin loader was not met.
This error can be raised by a specific plugin loader during the load_from_options stage to indicate a parameter problem that can not be handled by the generic options loader.
The intention here is that a plugin can do checks like if a name parameter is provided then a domain parameter must also be provided, but that Opt checking doesn't handle.
- exception keystoneauth1.exceptions.auth_plugins.UnsupportedParameters(names)
- Bases: AuthPluginException
A parameter that was provided or returned is not supported.
- Parameters
- names (list(str)) -- Names of the unsupported parameters.
- names
- Names of the unsupported parameters.
keystoneauth1.exceptions.base module
- exception keystoneauth1.exceptions.base.ClientException(message=None)
- Bases: Exception
The base exception for everything to do with clients.
- message = 'ClientException'
keystoneauth1.exceptions.catalog module
- exception keystoneauth1.exceptions.catalog.CatalogException(message=None)
- Bases: ClientException
- message = 'Unknown error with service catalog.'
- exception keystoneauth1.exceptions.catalog.EmptyCatalog(message=None)
- Bases: EndpointNotFound
- message = 'The service catalog is empty.'
- exception keystoneauth1.exceptions.catalog.EndpointNotFound(message=None)
- Bases: CatalogException
- message = 'Could not find requested endpoint in Service Catalog.'
keystoneauth1.exceptions.connection module
- exception keystoneauth1.exceptions.connection.ConnectFailure(message=None)
- Bases: ConnectionError, RetriableConnectionFailure
- message = 'Connection failure that may be retried.'
- exception keystoneauth1.exceptions.connection.ConnectTimeout(message=None)
- Bases: ConnectionError, RetriableConnectionFailure
- message = 'Timed out connecting to service.'
- exception keystoneauth1.exceptions.connection.ConnectionError(message=None)
- Bases: ClientException
- message = 'Cannot connect to API service.'
- exception keystoneauth1.exceptions.connection.RetriableConnectionFailure
- Bases: Exception
A mixin class that implies you can retry the most recent request.
- exception keystoneauth1.exceptions.connection.SSLError(message=None)
- Bases: ConnectionError
- message = 'An SSL error occurred.'
- exception keystoneauth1.exceptions.connection.UnknownConnectionError(msg, original)
- Bases: ConnectionError
An error was encountered but we don't know what it is.
keystoneauth1.exceptions.discovery module
- exception keystoneauth1.exceptions.discovery.DiscoveryFailure(message=None)
- Bases: ClientException
- message = 'Discovery of client versions failed.'
- exception keystoneauth1.exceptions.discovery.ImpliedMaxVersionMismatch(service_type, implied, given)
- Bases: ImpliedVersionMismatch
- label = 'max_version'
- exception keystoneauth1.exceptions.discovery.ImpliedMinVersionMismatch(service_type, implied, given)
- Bases: ImpliedVersionMismatch
- label = 'min_version'
- exception keystoneauth1.exceptions.discovery.ImpliedVersionMismatch(service_type, implied, given)
- Bases: ValueError
- label = 'version'
- exception keystoneauth1.exceptions.discovery.VersionNotAvailable(message=None)
- Bases: DiscoveryFailure
- message = 'Discovery failed. Requested version is not available.'
keystoneauth1.exceptions.http module
HTTP Exceptions used by keystoneauth1.
- exception keystoneauth1.exceptions.http.BadGateway(message=None, details=None, response=None, request_id=None, url=None, method=None, http_status=None, retry_after=0)
- Bases: HttpServerError
HTTP 502 - Bad Gateway.
The server was acting as a gateway or proxy and received an invalid response from the upstream server.
- http_status = 502
- message = 'Bad Gateway'
- exception keystoneauth1.exceptions.http.BadRequest(message=None, details=None, response=None, request_id=None, url=None, method=None, http_status=None, retry_after=0)
- Bases: HTTPClientError
HTTP 400 - Bad Request.
The request cannot be fulfilled due to bad syntax.
- http_status = 400
- message = 'Bad Request'
- exception keystoneauth1.exceptions.http.Conflict(message=None, details=None, response=None, request_id=None, url=None, method=None, http_status=None, retry_after=0)
- Bases: HTTPClientError
HTTP 409 - Conflict.
Indicates that the request could not be processed because of conflict in the request, such as an edit conflict.
- http_status = 409
- message = 'Conflict'
- exception keystoneauth1.exceptions.http.ExpectationFailed(message=None, details=None, response=None, request_id=None, url=None, method=None, http_status=None, retry_after=0)
- Bases: HTTPClientError
HTTP 417 - Expectation Failed.
The server cannot meet the requirements of the Expect request-header field.
- http_status = 417
- message = 'Expectation Failed'
- exception keystoneauth1.exceptions.http.Forbidden(message=None, details=None, response=None, request_id=None, url=None, method=None, http_status=None, retry_after=0)
- Bases: HTTPClientError
HTTP 403 - Forbidden.
The request was a valid request, but the server is refusing to respond to it.
- http_status = 403
- message = 'Forbidden'
- exception keystoneauth1.exceptions.http.GatewayTimeout(message=None, details=None, response=None, request_id=None, url=None, method=None, http_status=None, retry_after=0)
- Bases: HttpServerError
HTTP 504 - Gateway Timeout.
The server was acting as a gateway or proxy and did not receive a timely response from the upstream server.
- http_status = 504
- message = 'Gateway Timeout'
- exception keystoneauth1.exceptions.http.Gone(message=None, details=None, response=None, request_id=None, url=None, method=None, http_status=None, retry_after=0)
- Bases: HTTPClientError
HTTP 410 - Gone.
Indicates that the resource requested is no longer available and will not be available again.
- http_status = 410
- message = 'Gone'
- exception keystoneauth1.exceptions.http.HTTPClientError(message=None, details=None, response=None, request_id=None, url=None, method=None, http_status=None, retry_after=0)
- Bases: HttpError
Client-side HTTP error.
Exception for cases in which the client seems to have erred.
- message = 'HTTP Client Error'
- exception keystoneauth1.exceptions.http.HttpError(message=None, details=None, response=None, request_id=None, url=None, method=None, http_status=None, retry_after=0)
- Bases: ClientException
The base exception class for all HTTP exceptions.
- http_status = 0
- message = 'HTTP Error'
- exception keystoneauth1.exceptions.http.HttpNotImplemented(message=None, details=None, response=None, request_id=None, url=None, method=None, http_status=None, retry_after=0)
- Bases: HttpServerError
HTTP 501 - Not Implemented.
The server either does not recognize the request method, or it lacks the ability to fulfill the request.
- http_status = 501
- message = 'Not Implemented'
- exception keystoneauth1.exceptions.http.HttpServerError(message=None, details=None, response=None, request_id=None, url=None, method=None, http_status=None, retry_after=0)
- Bases: HttpError
Server-side HTTP error.
Exception for cases in which the server is aware that it has erred or is incapable of performing the request.
- message = 'HTTP Server Error'
- exception keystoneauth1.exceptions.http.HttpVersionNotSupported(message=None, details=None, response=None, request_id=None, url=None, method=None, http_status=None, retry_after=0)
- Bases: HttpServerError
HTTP 505 - HttpVersion Not Supported.
The server does not support the HTTP protocol version used in the request.
- http_status = 505
- message = 'HTTP Version Not Supported'
- exception keystoneauth1.exceptions.http.InternalServerError(message=None, details=None, response=None, request_id=None, url=None, method=None, http_status=None, retry_after=0)
- Bases: HttpServerError
HTTP 500 - Internal Server Error.
A generic error message, given when no more specific message is suitable.
- http_status = 500
- message = 'Internal Server Error'
- exception keystoneauth1.exceptions.http.LengthRequired(message=None, details=None, response=None, request_id=None, url=None, method=None, http_status=None, retry_after=0)
- Bases: HTTPClientError
HTTP 411 - Length Required.
The request did not specify the length of its content, which is required by the requested resource.
- http_status = 411
- message = 'Length Required'
- exception keystoneauth1.exceptions.http.MethodNotAllowed(message=None, details=None, response=None, request_id=None, url=None, method=None, http_status=None, retry_after=0)
- Bases: HTTPClientError
HTTP 405 - Method Not Allowed.
A request was made of a resource using a request method not supported by that resource.
- http_status = 405
- message = 'Method Not Allowed'
- exception keystoneauth1.exceptions.http.NotAcceptable(message=None, details=None, response=None, request_id=None, url=None, method=None, http_status=None, retry_after=0)
- Bases: HTTPClientError
HTTP 406 - Not Acceptable.
The requested resource is only capable of generating content not acceptable according to the Accept headers sent in the request.
- http_status = 406
- message = 'Not Acceptable'
- exception keystoneauth1.exceptions.http.NotFound(message=None, details=None, response=None, request_id=None, url=None, method=None, http_status=None, retry_after=0)
- Bases: HTTPClientError
HTTP 404 - Not Found.
The requested resource could not be found but may be available again in the future.
- http_status = 404
- message = 'Not Found'
- exception keystoneauth1.exceptions.http.PaymentRequired(message=None, details=None, response=None, request_id=None, url=None, method=None, http_status=None, retry_after=0)
- Bases: HTTPClientError
HTTP 402 - Payment Required.
Reserved for future use.
- http_status = 402
- message = 'Payment Required'
- exception keystoneauth1.exceptions.http.PreconditionFailed(message=None, details=None, response=None, request_id=None, url=None, method=None, http_status=None, retry_after=0)
- Bases: HTTPClientError
HTTP 412 - Precondition Failed.
The server does not meet one of the preconditions that the requester put on the request.
- http_status = 412
- message = 'Precondition Failed'
- exception keystoneauth1.exceptions.http.ProxyAuthenticationRequired(message=None, details=None, response=None, request_id=None, url=None, method=None, http_status=None, retry_after=0)
- Bases: HTTPClientError
HTTP 407 - Proxy Authentication Required.
The client must first authenticate itself with the proxy.
- http_status = 407
- message = 'Proxy Authentication Required'
- exception keystoneauth1.exceptions.http.RequestEntityTooLarge(*args, **kwargs)
- Bases: HTTPClientError
HTTP 413 - Request Entity Too Large.
The request is larger than the server is willing or able to process.
- http_status = 413
- message = 'Request Entity Too Large'
- exception keystoneauth1.exceptions.http.RequestTimeout(message=None, details=None, response=None, request_id=None, url=None, method=None, http_status=None, retry_after=0)
- Bases: HTTPClientError
HTTP 408 - Request Timeout.
The server timed out waiting for the request.
- http_status = 408
- message = 'Request Timeout'
- exception keystoneauth1.exceptions.http.RequestUriTooLong(message=None, details=None, response=None, request_id=None, url=None, method=None, http_status=None, retry_after=0)
- Bases: HTTPClientError
HTTP 414 - Request-URI Too Long.
The URI provided was too long for the server to process.
- http_status = 414
- message = 'Request-URI Too Long'
- exception keystoneauth1.exceptions.http.RequestedRangeNotSatisfiable(message=None, details=None, response=None, request_id=None, url=None, method=None, http_status=None, retry_after=0)
- Bases: HTTPClientError
HTTP 416 - Requested Range Not Satisfiable.
The client has asked for a portion of the file, but the server cannot supply that portion.
- http_status = 416
- message = 'Requested Range Not Satisfiable'
- exception keystoneauth1.exceptions.http.ServiceUnavailable(message=None, details=None, response=None, request_id=None, url=None, method=None, http_status=None, retry_after=0)
- Bases: HttpServerError
HTTP 503 - Service Unavailable.
The server is currently unavailable.
- http_status = 503
- message = 'Service Unavailable'
- exception keystoneauth1.exceptions.http.Unauthorized(message=None, details=None, response=None, request_id=None, url=None, method=None, http_status=None, retry_after=0)
- Bases: HTTPClientError
HTTP 401 - Unauthorized.
Similar to 403 Forbidden, but specifically for use when authentication is required and has failed or has not yet been provided.
- http_status = 401
- message = 'Unauthorized'
- exception keystoneauth1.exceptions.http.UnprocessableEntity(message=None, details=None, response=None, request_id=None, url=None, method=None, http_status=None, retry_after=0)
- Bases: HTTPClientError
HTTP 422 - Unprocessable Entity.
The request was well-formed but was unable to be followed due to semantic errors.
- http_status = 422
- message = 'Unprocessable Entity'
- exception keystoneauth1.exceptions.http.UnsupportedMediaType(message=None, details=None, response=None, request_id=None, url=None, method=None, http_status=None, retry_after=0)
- Bases: HTTPClientError
HTTP 415 - Unsupported Media Type.
The request entity has a media type which the server or resource does not support.
- http_status = 415
- message = 'Unsupported Media Type'
- keystoneauth1.exceptions.http.from_response(response, method, url)
- Return an instance of HttpError or subclass based on response.
- Parameters
- response -- instance of requests.Response class
- method -- HTTP method used for request
- url -- URL used for request
keystoneauth1.exceptions.oidc module
- exception keystoneauth1.exceptions.oidc.InvalidDiscoveryEndpoint(message=None)
- Bases: AuthPluginException
- message = 'OpenID Connect Discovery Document endpoint not set.'
- exception keystoneauth1.exceptions.oidc.InvalidOidcDiscoveryDocument(message=None)
- Bases: AuthPluginException
- message = 'OpenID Connect Discovery Document is not valid JSON.'
- exception keystoneauth1.exceptions.oidc.OidcAccessTokenEndpointNotFound(message=None)
- Bases: AuthPluginException
- message = 'OpenID Connect access token endpoint not provided.'
- exception keystoneauth1.exceptions.oidc.OidcAuthorizationEndpointNotFound(message=None)
- Bases: AuthPluginException
- message = 'OpenID Connect authorization endpoint not provided.'
- exception keystoneauth1.exceptions.oidc.OidcGrantTypeMissmatch(message=None)
- Bases: AuthPluginException
- message = 'Missmatch between OpenID Connect plugin and grant_type argument'
- exception keystoneauth1.exceptions.oidc.OidcPluginNotSupported(message=None)
- Bases: AuthPluginException
- message = 'OpenID Connect grant type not supported by provider.'
keystoneauth1.exceptions.response module
- exception keystoneauth1.exceptions.response.InvalidResponse(response)
- Bases: ClientException
- message = 'Invalid response from server.'
keystoneauth1.exceptions.service_providers module
- exception keystoneauth1.exceptions.service_providers.ServiceProviderNotFound(sp_id)
- Bases: ClientException
A Service Provider cannot be found.
Module contents
keystoneauth1.extras package
Subpackages
keystoneauth1.extras.kerberos package
Module contents
Kerberos authentication plugins.
WARNING:
$ pip install keystoneauth1[kerberos]
- class keystoneauth1.extras.kerberos.Kerberos(auth_url, *args, **kwargs)
- Bases: AuthConstructor
- class keystoneauth1.extras.kerberos.KerberosMethod(*args, **kwargs)
- Bases: AuthMethod
- get_auth_data(session, auth, headers, request_kwargs, **kwargs)
- Return the authentication section of an auth plugin.
- Parameters
- session (keystoneauth1.session.Session) -- The communication session.
- auth (base.Auth) -- The auth plugin calling the method.
- headers (dict) -- The headers that will be sent with the auth request if a plugin needs to add to them.
- Returns
- The identifier of this plugin and a dict of authentication data for the auth type.
- Return type
- tuple(string, dict)
- class keystoneauth1.extras.kerberos.MappedKerberos(auth_url, identity_provider, protocol, mutual_auth=None, **kwargs)
- Bases: FederationBaseAuth
Authenticate using Kerberos via the keystone federation mechanisms.
This uses the OS-FEDERATION extension to gain an unscoped token and then use the standard keystone auth process to scope that to any given project.
- get_unscoped_auth_ref(session, **kwargs)
- Fetch unscoped federated token.
keystoneauth1.extras.oauth1 package
Submodules
keystoneauth1.extras.oauth1.v3 module
Oauth authentication plugins.
WARNING:
$ pip install keystoneauth['oauth1']
- class keystoneauth1.extras.oauth1.v3.OAuth1(*args, **kwargs)
- Bases: AuthConstructor
- class keystoneauth1.extras.oauth1.v3.OAuth1Method(**kwargs)
- Bases: AuthMethod
OAuth based authentication method.
- Parameters
- consumer_key (string) -- Consumer key.
- consumer_secret (string) -- Consumer secret.
- access_key (string) -- Access token key.
- access_secret (string) -- Access token secret.
- get_auth_data(session, auth, headers, **kwargs)
- Return the authentication section of an auth plugin.
- Parameters
- session (keystoneauth1.session.Session) -- The communication session.
- auth (base.Auth) -- The auth plugin calling the method.
- headers (dict) -- The headers that will be sent with the auth request if a plugin needs to add to them.
- Returns
- The identifier of this plugin and a dict of authentication data for the auth type.
- Return type
- tuple(string, dict)
- get_cache_id_elements()
- Get the elements for this auth method that make it unique.
These elements will be used as part of the keystoneauth1.plugin.BaseIdentityPlugin.get_cache_id() to allow caching of the auth plugin.
Plugins should override this if they want to allow caching of their state.
To avoid collision or overrides the keys of the returned dictionary should be prefixed with the plugin identifier. For example the password plugin returns its username value as 'password_username'.
Module contents
- keystoneauth1.extras.oauth1.V3OAuth1
- alias of OAuth1
- keystoneauth1.extras.oauth1.V3OAuth1Method
- alias of OAuth1Method
Module contents
keystoneauth1.fixture package
Submodules
keystoneauth1.fixture.discovery module
- class keystoneauth1.fixture.discovery.DiscoveryList(href=None, v2=True, v3=True, v2_id=None, v3_id=None, v2_status=None, v2_updated=None, v2_html=True, v2_pdf=True, v3_status=None, v3_updated=None, v3_json=True, v3_xml=True)
- Bases: dict
A List of version elements.
Creates a correctly structured list of identity service endpoints for use in testing with discovery.
- Parameters
- href (string) -- The url that this should be based at.
- v2 (bool) -- Add a v2 element.
- v3 (bool) -- Add a v3 element.
- v2_status (string) -- The status to use for the v2 element.
- v2_updated (DateTime) -- The update time to use for the v2 element.
- v2_html (bool) -- True to add a html link to the v2 element.
- v2_pdf (bool) -- True to add a pdf link to the v2 element.
- v3_status (string) -- The status to use for the v3 element.
- v3_updated (DateTime) -- The update time to use for the v3 element.
- v3_json (bool) -- True to add a html link to the v2 element.
- v3_xml (bool) -- True to add a pdf link to the v2 element.
- TEST_URL = 'http://keystone.host:5000/'
- add_microversion(href, id, **kwargs)
- Add a microversion version to the list.
The parameters are the same as MicroversionDiscovery.
- add_nova_microversion(href, id, **kwargs)
- Add a nova microversion version to the list.
The parameters are the same as NovaMicroversionDiscovery.
- add_v2(href, **kwargs)
- Add a v2 version to the list.
The parameters are the same as V2Discovery.
- add_v3(href, **kwargs)
- Add a v3 version to the list.
The parameters are the same as V3Discovery.
- add_version(version)
- Add a new version structure to the list.
- Parameters
- version (dict) -- A new version structure to add to the list.
- property versions
- class keystoneauth1.fixture.discovery.V2Discovery(href, id=None, html=True, pdf=True, **kwargs)
- Bases: DiscoveryBase
A Version element for a V2 identity service endpoint.
Provides some default values and helper methods for creating a v2.0 endpoint version structure. Clients should use this instead of creating their own structures.
- Parameters
- href (string) -- The url that this entry should point to.
- id (string) -- The version id that should be reported. (optional) Defaults to 'v2.0'.
- html (bool) -- Add HTML describedby links to the structure.
- pdf (bool) -- Add PDF describedby links to the structure.
- add_html_description()
- Add the HTML described by links.
The standard structure includes a link to a HTML document with the API specification. Add it to this entry.
- add_pdf_description()
- Add the PDF described by links.
The standard structure includes a link to a PDF document with the API specification. Add it to this entry.
- class keystoneauth1.fixture.discovery.V3Discovery(href, id=None, json=True, xml=True, **kwargs)
- Bases: DiscoveryBase
A Version element for a V3 identity service endpoint.
Provides some default values and helper methods for creating a v3 endpoint version structure. Clients should use this instead of creating their own structures.
- Parameters
- href -- The url that this entry should point to.
- id (string) -- The version id that should be reported. (optional) Defaults to 'v3.0'.
- json (bool) -- Add JSON media-type elements to the structure.
- xml (bool) -- Add XML media-type elements to the structure.
- add_json_media_type()
- Add the JSON media-type links.
The standard structure includes a list of media-types that the endpoint supports. Add JSON to the list.
- add_xml_media_type()
- Add the XML media-type links.
The standard structure includes a list of media-types that the endpoint supports. Add XML to the list.
- class keystoneauth1.fixture.discovery.VersionDiscovery(href, id, **kwargs)
- Bases: DiscoveryBase
A Version element for non-keystone services without microversions.
Provides some default values and helper methods for creating a microversion endpoint version structure. Clients should use this instead of creating their own structures.
- Parameters
- href (string) -- The url that this entry should point to.
- id (string) -- The version id that should be reported.
keystoneauth1.fixture.exception module
- exception keystoneauth1.fixture.exception.FixtureValidationError
- Bases: Exception
The token you created is not legitimate.
The data contained in the token that was generated is not valid and would not have been returned from a keystone server. You should not do testing with this token.
keystoneauth1.fixture.hooks module
Custom hooks for betamax and keystoneauth.
- Yolanda Robla
- keystoneauth1.fixture.hooks.mask_fixture_values(nested, prev_key)
- keystoneauth1.fixture.hooks.pre_record_hook(interaction, cassette)
- Hook to mask saved data.
This hook will be triggered before saving the interaction, and will perform two tasks: - mask user, project and password in the saved data - set token expiration time to an inifinite time.
keystoneauth1.fixture.keystoneauth_betamax module
A fixture to wrap the session constructor for use with Betamax.
- class keystoneauth1.fixture.keystoneauth_betamax.BetamaxFixture(cassette_name, cassette_library_dir=None, serializer=None, record=False, pre_record_hook=<function pre_record_hook>, serializer_name=None, request_matchers=None)
- Bases: Fixture
- property serializer_name
- Determine the name of the selected serializer.
If a class was specified, use the name attribute to generate this, otherwise, use the serializer_name parameter from __init__.
- Returns
- Name of the serializer
- Return type
- str
- setUp()
- Prepare the Fixture for use.
This should not be overridden. Concrete fixtures should implement _setUp. Overriding of setUp is still supported, just not recommended.
After setUp has completed, the fixture will have one or more attributes which can be used (these depend totally on the concrete subclass).
- Raises
- MultipleExceptions if _setUp fails. The last exception captured within the MultipleExceptions will be a SetupError exception.
- Returns
- None.
- Changed in 1.3
- The recommendation to override setUp has been reversed - before 1.3, setUp() should be overridden, now it should not be.
- Changed in 1.3.1
- BaseException is now caught, and only subclasses of Exception are wrapped in MultipleExceptions.
keystoneauth1.fixture.plugin module
- class keystoneauth1.fixture.plugin.LoadingFixture(token=None, endpoint=None, user_id=None, project_id=None)
- Bases: Fixture
A fixture that will stub out all plugin loading calls.
When using keystoneauth plugins loaded from config, CLI or elsewhere it is often difficult to handle the plugin parts in tests because we don't have a reasonable default.
This fixture will create a TestPlugin that will be returned for all calls to plugin loading so you can simply bypass the authentication steps and return something well known.
- Parameters
- token (str) -- The token to include in authenticated requests.
- endpoint (str) -- The endpoint to respond to service lookups with.
- user_id (str) -- The user_id to report for the authenticated user.
- project_id (str) -- The project_id to report for the authenticated user.
- MOCK_POINT = 'keystoneauth1.loading.base.get_plugin_loader'
- create_plugin()
- get_endpoint(path=None, **kwargs)
- Utility function to get the endpoint the plugin would return.
This function is provided as a convenience so you can do comparisons in your tests. Overriding it will not affect the endpoint returned by the plugin.
- Parameters
- path (str) -- The path to append to the plugin endpoint.
- get_plugin_loader(auth_type)
- setUp()
- Prepare the Fixture for use.
This should not be overridden. Concrete fixtures should implement _setUp. Overriding of setUp is still supported, just not recommended.
After setUp has completed, the fixture will have one or more attributes which can be used (these depend totally on the concrete subclass).
- Raises
- MultipleExceptions if _setUp fails. The last exception captured within the MultipleExceptions will be a SetupError exception.
- Returns
- None.
- Changed in 1.3
- The recommendation to override setUp has been reversed - before 1.3, setUp() should be overridden, now it should not be.
- Changed in 1.3.1
- BaseException is now caught, and only subclasses of Exception are wrapped in MultipleExceptions.
- class keystoneauth1.fixture.plugin.TestPlugin(token=None, endpoint=None, user_id=None, project_id=None)
- Bases: BaseAuthPlugin
A simple plugin that returns what you gave it for testing.
When testing services that use authentication plugins you often want to stub out the authentication calls and focus on the important part of your service. This plugin acts like a real keystoneauth plugin and returns known standard values without having to stub out real keystone responses.
Note that this plugin is a BaseAuthPlugin and not a BaseIdentityPlugin. This means it implements the basic plugin interface that services should be using but does not implement get_auth_ref. get_auth_ref should not be relied upon by services because a user could always configure the service to use a non-keystone auth.
- Parameters
- token (str) -- The token to include in authenticated requests.
- endpoint (str) -- The endpoint to respond to service lookups with.
- user_id (str) -- The user_id to report for the authenticated user.
- project_id (str) -- The project_id to report for the authenticated user.
- auth_type = 'test_plugin'
- get_endpoint(session, **kwargs)
- Return an endpoint for the client.
There are no required keyword arguments to get_endpoint as a plugin implementation should use best effort with the information available to determine the endpoint. However there are certain standard options that will be generated by the clients and should be used by plugins:
- service_type: what sort of service is required.
- service_name: the name of the service in the catalog.
- interface: what visibility the endpoint should have.
- region_name: the region the endpoint exists in.
- Parameters
- session (keystoneauth1.session.Session) -- The session object that the auth_plugin belongs to.
- Returns
- The base URL that will be used to talk to the required service or None if not available.
- Return type
- string
- get_project_id(session, **kwargs)
- Return the project id that we are authenticated to.
Wherever possible the project id should be inferred from the token however there are certain URLs and other places that require access to the currently authenticated project id.
- Parameters
- session (keystoneauth1.session.Session) -- A session object so the plugin can make HTTP calls.
- Returns
- A project identifier or None if one is not available.
- Return type
- str
- get_token(session, **kwargs)
- Obtain a token.
How the token is obtained is up to the plugin. If it is still valid it may be re-used, retrieved from cache or invoke an authentication request against a server.
There are no required kwargs. They are passed directly to the auth plugin and they are implementation specific.
Returning None will indicate that no token was able to be retrieved.
This function is misplaced as it should only be required for auth plugins that use the 'X-Auth-Token' header. However due to the way plugins evolved this method is required and often called to trigger an authentication request on a new plugin.
When implementing a new plugin it is advised that you implement this method, however if you don't require the 'X-Auth-Token' header override the get_headers method instead.
- Parameters
- session (keystoneauth1.session.Session) -- A session object so the plugin can make HTTP calls.
- Returns
- A token to use.
- Return type
- string
- get_user_id(session, **kwargs)
- Return a unique user identifier of the plugin.
Wherever possible the user id should be inferred from the token however there are certain URLs and other places that require access to the currently authenticated user id.
- Parameters
- session (keystoneauth1.session.Session) -- A session object so the plugin can make HTTP calls.
- Returns
- A user identifier or None if one is not available.
- Return type
- str
- invalidate()
- Invalidate the current authentication data.
This should result in fetching a new token on next call.
A plugin may be invalidated if an Unauthorized HTTP response is returned to indicate that the token may have been revoked or is otherwise now invalid.
- Returns
- True if there was something that the plugin did to invalidate. This means that it makes sense to try again. If nothing happens returns False to indicate give up.
- Return type
- bool
keystoneauth1.fixture.serializer module
A serializer to emit YAML but with request body in nicely formatted JSON.
- class keystoneauth1.fixture.serializer.YamlJsonSerializer
- Bases: BaseSerializer
- deserialize(cassette_data)
- A method that must be implemented by the Serializer author.
The return value is extremely important. If it is not empty, the dictionary returned must have the following structure:
{
'http_interactions': [{
# Interaction
},
{
# Interaction
}],
'recorded_with': 'name of recorder'
}
- Params str cassette_data
- The data serialized as a string which needs to be deserialized.
- Returns
- dictionary
- static generate_cassette_name(cassette_library_dir, cassette_name)
- name = 'yamljson'
- serialize(cassette_data)
- A method that must be implemented by the Serializer author.
- Parameters
- cassette_data (dict) -- A dictionary with two keys: http_interactions, recorded_with.
- Returns
- Serialized data as a string.
keystoneauth1.fixture.v2 module
- class keystoneauth1.fixture.v2.Token(token_id=None, expires=None, issued=None, tenant_id=None, tenant_name=None, user_id=None, user_name=None, trust_id=None, trustee_user_id=None, audit_id=None, audit_chain_id=None)
- Bases: dict
A V2 Keystone token that can be used for testing.
This object is designed to allow clients to generate a correct V2 token for use in there test code. It should prevent clients from having to know the correct token format and allow them to test the portions of token handling that matter to them and not copy and paste sample.
- add_role(name=None, id=None)
- add_service(type, name=None)
- property audit_chain_id
- property audit_id
- property expires
- property expires_str
- property issued
- property issued_str
- remove_service(type)
- property root
- set_bind(name, data)
- set_scope(id=None, name=None)
- set_trust(id=None, trustee_user_id=None)
- property tenant_id
- property tenant_name
- property token_id
- property trust_id
- property trustee_user_id
- property user_id
- property user_name
- validate()
keystoneauth1.fixture.v3 module
- class keystoneauth1.fixture.v3.Token(expires=None, issued=None, user_id=None, user_name=None, user_domain_id=None, user_domain_name=None, methods=None, project_id=None, project_name=None, project_domain_id=None, project_domain_name=None, domain_id=None, domain_name=None, trust_id=None, trust_impersonation=None, trustee_user_id=None, trustor_user_id=None, application_credential_id=None, application_credential_access_rules=None, oauth_access_token_id=None, oauth_consumer_id=None, audit_id=None, audit_chain_id=None, is_admin_project=None, project_is_domain=None, oauth2_thumbprint=None)
- Bases: dict
A V3 Keystone token that can be used for testing.
This object is designed to allow clients to generate a correct V3 token for use in there test code. It should prevent clients from having to know the correct token format and allow them to test the portions of token handling that matter to them and not copy and paste sample.
- add_role(name=None, id=None)
- add_service(type, name=None, id=None)
- add_service_provider(sp_id, sp_auth_url, sp_url)
- property application_credential_access_rules
- property application_credential_id
- property audit_chain_id
- property audit_id
- property domain_id
- property domain_name
- property expires
- property expires_str
- property is_admin_project
- property issued
- property issued_str
- property methods
- property oauth2_credential
- property oauth2_thumbprint
- property oauth_access_token_id
- property oauth_consumer_id
- property project_domain_id
- property project_domain_name
- property project_id
- property project_is_domain
- property project_name
- remove_service(type)
- property role_ids
- property role_names
- property root
- property service_providers
- set_application_credential(application_credential_id, access_rules=None)
- set_bind(name, data)
- set_domain_scope(id=None, name=None)
- set_oauth(access_token_id=None, consumer_id=None)
- set_project_scope(id=None, name=None, domain_id=None, domain_name=None, is_domain=None)
- set_system_scope()
- set_trust_scope(id=None, impersonation=False, trustee_user_id=None, trustor_user_id=None)
- property system
- property trust_id
- property trust_impersonation
- property trustee_user_id
- property trustor_user_id
- property user_domain_id
- property user_domain_name
- property user_id
- property user_name
- validate()
- class keystoneauth1.fixture.v3.V3FederationToken(methods=None, identity_provider=None, protocol=None, groups=None)
- Bases: Token
A V3 Keystone Federation token that can be used for testing.
Similar to V3Token, this object is designed to allow clients to generate a correct V3 federation token for use in test code.
- FEDERATED_DOMAIN_ID = 'Federated'
- add_federation_info_to_user(identity_provider=None, protocol=None, groups=None)
Module contents
Produce keystone compliant structures for use in testing.
They are part of the public API because they may be relied upon to generate test tokens for other clients. However they should never be imported into the main client (keystoneauth or other). Because of this there may be dependencies from this module on libraries that are only available in testing.
- class keystoneauth1.fixture.DiscoveryList(href=None, v2=True, v3=True, v2_id=None, v3_id=None, v2_status=None, v2_updated=None, v2_html=True, v2_pdf=True, v3_status=None, v3_updated=None, v3_json=True, v3_xml=True)
- Bases: dict
A List of version elements.
Creates a correctly structured list of identity service endpoints for use in testing with discovery.
- Parameters
- href (string) -- The url that this should be based at.
- v2 (bool) -- Add a v2 element.
- v3 (bool) -- Add a v3 element.
- v2_status (string) -- The status to use for the v2 element.
- v2_updated (DateTime) -- The update time to use for the v2 element.
- v2_html (bool) -- True to add a html link to the v2 element.
- v2_pdf (bool) -- True to add a pdf link to the v2 element.
- v3_status (string) -- The status to use for the v3 element.
- v3_updated (DateTime) -- The update time to use for the v3 element.
- v3_json (bool) -- True to add a html link to the v2 element.
- v3_xml (bool) -- True to add a pdf link to the v2 element.
- TEST_URL = 'http://keystone.host:5000/'
- add_microversion(href, id, **kwargs)
- Add a microversion version to the list.
The parameters are the same as MicroversionDiscovery.
- add_nova_microversion(href, id, **kwargs)
- Add a nova microversion version to the list.
The parameters are the same as NovaMicroversionDiscovery.
- add_v2(href, **kwargs)
- Add a v2 version to the list.
The parameters are the same as V2Discovery.
- add_v3(href, **kwargs)
- Add a v3 version to the list.
The parameters are the same as V3Discovery.
- add_version(version)
- Add a new version structure to the list.
- Parameters
- version (dict) -- A new version structure to add to the list.
- property versions
- exception keystoneauth1.fixture.FixtureValidationError
- Bases: Exception
The token you created is not legitimate.
The data contained in the token that was generated is not valid and would not have been returned from a keystone server. You should not do testing with this token.
- class keystoneauth1.fixture.LoadingFixture(token=None, endpoint=None, user_id=None, project_id=None)
- Bases: Fixture
A fixture that will stub out all plugin loading calls.
When using keystoneauth plugins loaded from config, CLI or elsewhere it is often difficult to handle the plugin parts in tests because we don't have a reasonable default.
This fixture will create a TestPlugin that will be returned for all calls to plugin loading so you can simply bypass the authentication steps and return something well known.
- Parameters
- token (str) -- The token to include in authenticated requests.
- endpoint (str) -- The endpoint to respond to service lookups with.
- user_id (str) -- The user_id to report for the authenticated user.
- project_id (str) -- The project_id to report for the authenticated user.
- MOCK_POINT = 'keystoneauth1.loading.base.get_plugin_loader'
- create_plugin()
- get_endpoint(path=None, **kwargs)
- Utility function to get the endpoint the plugin would return.
This function is provided as a convenience so you can do comparisons in your tests. Overriding it will not affect the endpoint returned by the plugin.
- Parameters
- path (str) -- The path to append to the plugin endpoint.
- get_plugin_loader(auth_type)
- setUp()
- Prepare the Fixture for use.
This should not be overridden. Concrete fixtures should implement _setUp. Overriding of setUp is still supported, just not recommended.
After setUp has completed, the fixture will have one or more attributes which can be used (these depend totally on the concrete subclass).
- Raises
- MultipleExceptions if _setUp fails. The last exception captured within the MultipleExceptions will be a SetupError exception.
- Returns
- None.
- Changed in 1.3
- The recommendation to override setUp has been reversed - before 1.3, setUp() should be overridden, now it should not be.
- Changed in 1.3.1
- BaseException is now caught, and only subclasses of Exception are wrapped in MultipleExceptions.
- class keystoneauth1.fixture.TestPlugin(token=None, endpoint=None, user_id=None, project_id=None)
- Bases: BaseAuthPlugin
A simple plugin that returns what you gave it for testing.
When testing services that use authentication plugins you often want to stub out the authentication calls and focus on the important part of your service. This plugin acts like a real keystoneauth plugin and returns known standard values without having to stub out real keystone responses.
Note that this plugin is a BaseAuthPlugin and not a BaseIdentityPlugin. This means it implements the basic plugin interface that services should be using but does not implement get_auth_ref. get_auth_ref should not be relied upon by services because a user could always configure the service to use a non-keystone auth.
- Parameters
- token (str) -- The token to include in authenticated requests.
- endpoint (str) -- The endpoint to respond to service lookups with.
- user_id (str) -- The user_id to report for the authenticated user.
- project_id (str) -- The project_id to report for the authenticated user.
- auth_type = 'test_plugin'
- get_endpoint(session, **kwargs)
- Return an endpoint for the client.
There are no required keyword arguments to get_endpoint as a plugin implementation should use best effort with the information available to determine the endpoint. However there are certain standard options that will be generated by the clients and should be used by plugins:
- service_type: what sort of service is required.
- service_name: the name of the service in the catalog.
- interface: what visibility the endpoint should have.
- region_name: the region the endpoint exists in.
- Parameters
- session (keystoneauth1.session.Session) -- The session object that the auth_plugin belongs to.
- Returns
- The base URL that will be used to talk to the required service or None if not available.
- Return type
- string
- get_project_id(session, **kwargs)
- Return the project id that we are authenticated to.
Wherever possible the project id should be inferred from the token however there are certain URLs and other places that require access to the currently authenticated project id.
- Parameters
- session (keystoneauth1.session.Session) -- A session object so the plugin can make HTTP calls.
- Returns
- A project identifier or None if one is not available.
- Return type
- str
- get_token(session, **kwargs)
- Obtain a token.
How the token is obtained is up to the plugin. If it is still valid it may be re-used, retrieved from cache or invoke an authentication request against a server.
There are no required kwargs. They are passed directly to the auth plugin and they are implementation specific.
Returning None will indicate that no token was able to be retrieved.
This function is misplaced as it should only be required for auth plugins that use the 'X-Auth-Token' header. However due to the way plugins evolved this method is required and often called to trigger an authentication request on a new plugin.
When implementing a new plugin it is advised that you implement this method, however if you don't require the 'X-Auth-Token' header override the get_headers method instead.
- Parameters
- session (keystoneauth1.session.Session) -- A session object so the plugin can make HTTP calls.
- Returns
- A token to use.
- Return type
- string
- get_user_id(session, **kwargs)
- Return a unique user identifier of the plugin.
Wherever possible the user id should be inferred from the token however there are certain URLs and other places that require access to the currently authenticated user id.
- Parameters
- session (keystoneauth1.session.Session) -- A session object so the plugin can make HTTP calls.
- Returns
- A user identifier or None if one is not available.
- Return type
- str
- invalidate()
- Invalidate the current authentication data.
This should result in fetching a new token on next call.
A plugin may be invalidated if an Unauthorized HTTP response is returned to indicate that the token may have been revoked or is otherwise now invalid.
- Returns
- True if there was something that the plugin did to invalidate. This means that it makes sense to try again. If nothing happens returns False to indicate give up.
- Return type
- bool
- class keystoneauth1.fixture.V2Discovery(href, id=None, html=True, pdf=True, **kwargs)
- Bases: DiscoveryBase
A Version element for a V2 identity service endpoint.
Provides some default values and helper methods for creating a v2.0 endpoint version structure. Clients should use this instead of creating their own structures.
- Parameters
- href (string) -- The url that this entry should point to.
- id (string) -- The version id that should be reported. (optional) Defaults to 'v2.0'.
- html (bool) -- Add HTML describedby links to the structure.
- pdf (bool) -- Add PDF describedby links to the structure.
- add_html_description()
- Add the HTML described by links.
The standard structure includes a link to a HTML document with the API specification. Add it to this entry.
- add_pdf_description()
- Add the PDF described by links.
The standard structure includes a link to a PDF document with the API specification. Add it to this entry.
- keystoneauth1.fixture.V2Token
- alias of Token
- class keystoneauth1.fixture.V3Discovery(href, id=None, json=True, xml=True, **kwargs)
- Bases: DiscoveryBase
A Version element for a V3 identity service endpoint.
Provides some default values and helper methods for creating a v3 endpoint version structure. Clients should use this instead of creating their own structures.
- Parameters
- href -- The url that this entry should point to.
- id (string) -- The version id that should be reported. (optional) Defaults to 'v3.0'.
- json (bool) -- Add JSON media-type elements to the structure.
- xml (bool) -- Add XML media-type elements to the structure.
- add_json_media_type()
- Add the JSON media-type links.
The standard structure includes a list of media-types that the endpoint supports. Add JSON to the list.
- add_xml_media_type()
- Add the XML media-type links.
The standard structure includes a list of media-types that the endpoint supports. Add XML to the list.
- class keystoneauth1.fixture.V3FederationToken(methods=None, identity_provider=None, protocol=None, groups=None)
- Bases: Token
A V3 Keystone Federation token that can be used for testing.
Similar to V3Token, this object is designed to allow clients to generate a correct V3 federation token for use in test code.
- FEDERATED_DOMAIN_ID = 'Federated'
- add_federation_info_to_user(identity_provider=None, protocol=None, groups=None)
- keystoneauth1.fixture.V3Token
- alias of Token
- class keystoneauth1.fixture.VersionDiscovery(href, id, **kwargs)
- Bases: DiscoveryBase
A Version element for non-keystone services without microversions.
Provides some default values and helper methods for creating a microversion endpoint version structure. Clients should use this instead of creating their own structures.
- Parameters
- href (string) -- The url that this entry should point to.
- id (string) -- The version id that should be reported.
keystoneauth1.identity package
Subpackages
keystoneauth1.identity.generic package
Submodules
keystoneauth1.identity.generic.base module
- class keystoneauth1.identity.generic.base.BaseGenericPlugin(auth_url, tenant_id=None, tenant_name=None, project_id=None, project_name=None, project_domain_id=None, project_domain_name=None, domain_id=None, domain_name=None, system_scope=None, trust_id=None, default_domain_id=None, default_domain_name=None, reauthenticate=True)
- Bases: BaseIdentityPlugin
An identity plugin that is not version dependent.
Internally we will construct a version dependent plugin with the resolved URL and then proxy all calls from the base plugin to the versioned one.
- abstract create_plugin(session, version, url, raw_status=None)
- Create a plugin from the given parameters.
This function will be called multiple times with the version and url of a potential endpoint. If a plugin can be constructed that fits the params then it should return it. If not return None and then another call will be made with other available URLs.
- Parameters
- session (keystoneauth1.session.Session) -- A session object.
- version (tuple) -- A tuple of the API version at the URL.
- url (str) -- The base URL for this version.
- raw_status (str) -- The status that was in the discovery field.
- Returns
- A plugin that can match the parameters or None if nothing.
- get_auth_ref(session, **kwargs)
- Obtain a token from an OpenStack Identity Service.
This method is overridden by the various token version plugins.
This function should not be called independently and is expected to be invoked via the do_authenticate function.
This function will be invoked if the AcessInfo object cached by the plugin is not valid. Thus plugins should always fetch a new AccessInfo when invoked. If you are looking to just retrieve the current auth data then you should use get_access.
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- Raises
- keystoneauth1.exceptions.response.InvalidResponse -- The response returned wasn't appropriate.
- keystoneauth1.exceptions.http.HttpError -- An error from an invalid HTTP response.
- Returns
- Token access information.
- Return type
- keystoneauth1.access.AccessInfo
- get_cache_id_elements(_implemented=False)
- Get the elements for this auth plugin that make it unique.
As part of the get_cache_id requirement we need to determine what aspects of this plugin and its values that make up the unique elements.
This should be overridden by plugins that wish to allow caching.
- Returns
- The unique attributes and values of this plugin.
- Return type
- A flat dict with a str key and str or None value. This is required as we feed these values into a hash. Pairs where the value is None are ignored in the hashed id.
- property project_domain_id
- property project_domain_name
keystoneauth1.identity.generic.password module
- class keystoneauth1.identity.generic.password.Password(auth_url, username=None, user_id=None, password=None, user_domain_id=None, user_domain_name=None, **kwargs)
- Bases: BaseGenericPlugin
A common user/password authentication plugin.
- Parameters
- username (string) -- Username for authentication.
- user_id (string) -- User ID for authentication.
- password (string) -- Password for authentication.
- user_domain_id (string) -- User's domain ID for authentication.
- user_domain_name (string) -- User's domain name for authentication.
- create_plugin(session, version, url, raw_status=None)
- Create a plugin from the given parameters.
This function will be called multiple times with the version and url of a potential endpoint. If a plugin can be constructed that fits the params then it should return it. If not return None and then another call will be made with other available URLs.
- Parameters
- session (keystoneauth1.session.Session) -- A session object.
- version (tuple) -- A tuple of the API version at the URL.
- url (str) -- The base URL for this version.
- raw_status (str) -- The status that was in the discovery field.
- Returns
- A plugin that can match the parameters or None if nothing.
- get_cache_id_elements()
- Get the elements for this auth plugin that make it unique.
As part of the get_cache_id requirement we need to determine what aspects of this plugin and its values that make up the unique elements.
This should be overridden by plugins that wish to allow caching.
- Returns
- The unique attributes and values of this plugin.
- Return type
- A flat dict with a str key and str or None value. This is required as we feed these values into a hash. Pairs where the value is None are ignored in the hashed id.
- property user_domain_id
- property user_domain_name
keystoneauth1.identity.generic.token module
- class keystoneauth1.identity.generic.token.Token(auth_url, token=None, **kwargs)
- Bases: BaseGenericPlugin
Generic token auth plugin.
- Parameters
- token (string) -- Token for authentication.
- create_plugin(session, version, url, raw_status=None)
- Create a plugin from the given parameters.
This function will be called multiple times with the version and url of a potential endpoint. If a plugin can be constructed that fits the params then it should return it. If not return None and then another call will be made with other available URLs.
- Parameters
- session (keystoneauth1.session.Session) -- A session object.
- version (tuple) -- A tuple of the API version at the URL.
- url (str) -- The base URL for this version.
- raw_status (str) -- The status that was in the discovery field.
- Returns
- A plugin that can match the parameters or None if nothing.
- get_cache_id_elements()
- Get the elements for this auth plugin that make it unique.
As part of the get_cache_id requirement we need to determine what aspects of this plugin and its values that make up the unique elements.
This should be overridden by plugins that wish to allow caching.
- Returns
- The unique attributes and values of this plugin.
- Return type
- A flat dict with a str key and str or None value. This is required as we feed these values into a hash. Pairs where the value is None are ignored in the hashed id.
Module contents
- class keystoneauth1.identity.generic.BaseGenericPlugin(auth_url, tenant_id=None, tenant_name=None, project_id=None, project_name=None, project_domain_id=None, project_domain_name=None, domain_id=None, domain_name=None, system_scope=None, trust_id=None, default_domain_id=None, default_domain_name=None, reauthenticate=True)
- Bases: BaseIdentityPlugin
An identity plugin that is not version dependent.
Internally we will construct a version dependent plugin with the resolved URL and then proxy all calls from the base plugin to the versioned one.
- abstract create_plugin(session, version, url, raw_status=None)
- Create a plugin from the given parameters.
This function will be called multiple times with the version and url of a potential endpoint. If a plugin can be constructed that fits the params then it should return it. If not return None and then another call will be made with other available URLs.
- Parameters
- session (keystoneauth1.session.Session) -- A session object.
- version (tuple) -- A tuple of the API version at the URL.
- url (str) -- The base URL for this version.
- raw_status (str) -- The status that was in the discovery field.
- Returns
- A plugin that can match the parameters or None if nothing.
- get_auth_ref(session, **kwargs)
- Obtain a token from an OpenStack Identity Service.
This method is overridden by the various token version plugins.
This function should not be called independently and is expected to be invoked via the do_authenticate function.
This function will be invoked if the AcessInfo object cached by the plugin is not valid. Thus plugins should always fetch a new AccessInfo when invoked. If you are looking to just retrieve the current auth data then you should use get_access.
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- Raises
- keystoneauth1.exceptions.response.InvalidResponse -- The response returned wasn't appropriate.
- keystoneauth1.exceptions.http.HttpError -- An error from an invalid HTTP response.
- Returns
- Token access information.
- Return type
- keystoneauth1.access.AccessInfo
- get_cache_id_elements(_implemented=False)
- Get the elements for this auth plugin that make it unique.
As part of the get_cache_id requirement we need to determine what aspects of this plugin and its values that make up the unique elements.
This should be overridden by plugins that wish to allow caching.
- Returns
- The unique attributes and values of this plugin.
- Return type
- A flat dict with a str key and str or None value. This is required as we feed these values into a hash. Pairs where the value is None are ignored in the hashed id.
- property project_domain_id
- property project_domain_name
- class keystoneauth1.identity.generic.Password(auth_url, username=None, user_id=None, password=None, user_domain_id=None, user_domain_name=None, **kwargs)
- Bases: BaseGenericPlugin
A common user/password authentication plugin.
- Parameters
- username (string) -- Username for authentication.
- user_id (string) -- User ID for authentication.
- password (string) -- Password for authentication.
- user_domain_id (string) -- User's domain ID for authentication.
- user_domain_name (string) -- User's domain name for authentication.
- create_plugin(session, version, url, raw_status=None)
- Create a plugin from the given parameters.
This function will be called multiple times with the version and url of a potential endpoint. If a plugin can be constructed that fits the params then it should return it. If not return None and then another call will be made with other available URLs.
- Parameters
- session (keystoneauth1.session.Session) -- A session object.
- version (tuple) -- A tuple of the API version at the URL.
- url (str) -- The base URL for this version.
- raw_status (str) -- The status that was in the discovery field.
- Returns
- A plugin that can match the parameters or None if nothing.
- get_cache_id_elements()
- Get the elements for this auth plugin that make it unique.
As part of the get_cache_id requirement we need to determine what aspects of this plugin and its values that make up the unique elements.
This should be overridden by plugins that wish to allow caching.
- Returns
- The unique attributes and values of this plugin.
- Return type
- A flat dict with a str key and str or None value. This is required as we feed these values into a hash. Pairs where the value is None are ignored in the hashed id.
- property user_domain_id
- property user_domain_name
- class keystoneauth1.identity.generic.Token(auth_url, token=None, **kwargs)
- Bases: BaseGenericPlugin
Generic token auth plugin.
- Parameters
- token (string) -- Token for authentication.
- create_plugin(session, version, url, raw_status=None)
- Create a plugin from the given parameters.
This function will be called multiple times with the version and url of a potential endpoint. If a plugin can be constructed that fits the params then it should return it. If not return None and then another call will be made with other available URLs.
- Parameters
- session (keystoneauth1.session.Session) -- A session object.
- version (tuple) -- A tuple of the API version at the URL.
- url (str) -- The base URL for this version.
- raw_status (str) -- The status that was in the discovery field.
- Returns
- A plugin that can match the parameters or None if nothing.
- get_cache_id_elements()
- Get the elements for this auth plugin that make it unique.
As part of the get_cache_id requirement we need to determine what aspects of this plugin and its values that make up the unique elements.
This should be overridden by plugins that wish to allow caching.
- Returns
- The unique attributes and values of this plugin.
- Return type
- A flat dict with a str key and str or None value. This is required as we feed these values into a hash. Pairs where the value is None are ignored in the hashed id.
keystoneauth1.identity.v3 package
Submodules
keystoneauth1.identity.v3.application_credential module
- class keystoneauth1.identity.v3.application_credential.ApplicationCredential(auth_url, *args, **kwargs)
- Bases: AuthConstructor
A plugin for authenticating with an application credential.
- Parameters
- auth_url (string) -- Identity service endpoint for authentication.
- application_credential_secret (string) -- Application credential secret.
- application_credential_id (string) -- Application credential ID.
- application_credential_name (string) -- Application credential name.
- username (string) -- Username for authentication.
- user_id (string) -- User ID for authentication.
- user_domain_id (string) -- User's domain ID for authentication.
- user_domain_name (string) -- User's domain name for authentication.
- reauthenticate (bool) -- Allow fetching a new token if the current one is going to expire. (optional) default True
- class keystoneauth1.identity.v3.application_credential.ApplicationCredentialMethod(**kwargs)
- Bases: AuthMethod
Construct a User/Passcode based authentication method.
- Parameters
- application_credential_secret (string) -- Application credential secret.
- application_credential_id (string) -- Application credential id.
- application_credential_name (string) -- The name of the application credential, if an ID is not provided.
- username (string) -- Username for authentication, if an application credential ID is not provided.
- user_id (string) -- User ID for authentication, if an application credential ID is not provided.
- user_domain_id (string) -- User's domain ID for authentication, if an application credential ID is not provided.
- user_domain_name (string) -- User's domain name for authentication, if an application credential ID is not provided.
- get_auth_data(session, auth, headers, **kwargs)
- Return the authentication section of an auth plugin.
- Parameters
- session (keystoneauth1.session.Session) -- The communication session.
- auth (base.Auth) -- The auth plugin calling the method.
- headers (dict) -- The headers that will be sent with the auth request if a plugin needs to add to them.
- Returns
- The identifier of this plugin and a dict of authentication data for the auth type.
- Return type
- tuple(string, dict)
- get_cache_id_elements()
- Get the elements for this auth method that make it unique.
These elements will be used as part of the keystoneauth1.plugin.BaseIdentityPlugin.get_cache_id() to allow caching of the auth plugin.
Plugins should override this if they want to allow caching of their state.
To avoid collision or overrides the keys of the returned dictionary should be prefixed with the plugin identifier. For example the password plugin returns its username value as 'password_username'.
keystoneauth1.identity.v3.base module
- class keystoneauth1.identity.v3.base.Auth(auth_url, auth_methods, **kwargs)
- Bases: BaseAuth
Identity V3 Authentication Plugin.
- Parameters
- auth_url (string) -- Identity service endpoint for authentication.
- auth_methods (list) -- A collection of methods to authenticate with.
- trust_id (string) -- Trust ID for trust scoping.
- domain_id (string) -- Domain ID for domain scoping.
- domain_name (string) -- Domain name for domain scoping.
- project_id (string) -- Project ID for project scoping.
- project_name (string) -- Project name for project scoping.
- project_domain_id (string) -- Project's domain ID for project.
- project_domain_name (string) -- Project's domain name for project.
- reauthenticate (bool) -- Allow fetching a new token if the current one is going to expire. (optional) default True
- include_catalog (bool) -- Include the service catalog in the returned token. (optional) default True.
- unscoped (bool) -- Force the return of an unscoped token. This will make the keystone server return an unscoped token even if a default_project_id is set for this user.
- add_method(method)
- Add an additional initialized AuthMethod instance.
- get_auth_ref(session, **kwargs)
- Obtain a token from an OpenStack Identity Service.
This method is overridden by the various token version plugins.
This function should not be called independently and is expected to be invoked via the do_authenticate function.
This function will be invoked if the AcessInfo object cached by the plugin is not valid. Thus plugins should always fetch a new AccessInfo when invoked. If you are looking to just retrieve the current auth data then you should use get_access.
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- Raises
- keystoneauth1.exceptions.response.InvalidResponse -- The response returned wasn't appropriate.
- keystoneauth1.exceptions.http.HttpError -- An error from an invalid HTTP response.
- Returns
- Token access information.
- Return type
- keystoneauth1.access.AccessInfo
- get_cache_id_elements()
- Get the elements for this auth plugin that make it unique.
As part of the get_cache_id requirement we need to determine what aspects of this plugin and its values that make up the unique elements.
This should be overridden by plugins that wish to allow caching.
- Returns
- The unique attributes and values of this plugin.
- Return type
- A flat dict with a str key and str or None value. This is required as we feed these values into a hash. Pairs where the value is None are ignored in the hashed id.
- class keystoneauth1.identity.v3.base.AuthConstructor(auth_url, *args, **kwargs)
- Bases: Auth
Abstract base class for creating an Auth Plugin.
The Auth Plugin created contains only one authentication method. This is generally the required usage.
An AuthConstructor creates an AuthMethod based on the method's arguments and the auth_method_class defined by the plugin. It then creates the auth plugin with only that authentication method.
- class keystoneauth1.identity.v3.base.AuthMethod(**kwargs)
- Bases: object
One part of a V3 Authentication strategy.
V3 Tokens allow multiple methods to be presented when authentication against the server. Each one of these methods is implemented by an AuthMethod.
Note: When implementing an AuthMethod use the method_parameters and do not use positional arguments. Otherwise they can't be picked up by the factory method and don't work as well with AuthConstructors.
- abstract get_auth_data(session, auth, headers, **kwargs)
- Return the authentication section of an auth plugin.
- Parameters
- session (keystoneauth1.session.Session) -- The communication session.
- auth (base.Auth) -- The auth plugin calling the method.
- headers (dict) -- The headers that will be sent with the auth request if a plugin needs to add to them.
- Returns
- The identifier of this plugin and a dict of authentication data for the auth type.
- Return type
- tuple(string, dict)
- get_cache_id_elements()
- Get the elements for this auth method that make it unique.
These elements will be used as part of the keystoneauth1.plugin.BaseIdentityPlugin.get_cache_id() to allow caching of the auth plugin.
Plugins should override this if they want to allow caching of their state.
To avoid collision or overrides the keys of the returned dictionary should be prefixed with the plugin identifier. For example the password plugin returns its username value as 'password_username'.
- class keystoneauth1.identity.v3.base.BaseAuth(auth_url, trust_id=None, system_scope=None, domain_id=None, domain_name=None, project_id=None, project_name=None, project_domain_id=None, project_domain_name=None, reauthenticate=True, include_catalog=True)
- Bases: BaseIdentityPlugin
Identity V3 Authentication Plugin.
- Parameters
- auth_url (string) -- Identity service endpoint for authentication.
- trust_id (string) -- Trust ID for trust scoping.
- system_scope (string) -- System information to scope to.
- domain_id (string) -- Domain ID for domain scoping.
- domain_name (string) -- Domain name for domain scoping.
- project_id (string) -- Project ID for project scoping.
- project_name (string) -- Project name for project scoping.
- project_domain_id (string) -- Project's domain ID for project.
- project_domain_name (string) -- Project's domain name for project.
- reauthenticate (bool) -- Allow fetching a new token if the current one is going to expire. (optional) default True
- include_catalog (bool) -- Include the service catalog in the returned token. (optional) default True.
- abstract get_auth_ref(session, **kwargs)
- Obtain a token from an OpenStack Identity Service.
This method is overridden by the various token version plugins.
This function should not be called independently and is expected to be invoked via the do_authenticate function.
This function will be invoked if the AcessInfo object cached by the plugin is not valid. Thus plugins should always fetch a new AccessInfo when invoked. If you are looking to just retrieve the current auth data then you should use get_access.
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- Raises
- keystoneauth1.exceptions.response.InvalidResponse -- The response returned wasn't appropriate.
- keystoneauth1.exceptions.http.HttpError -- An error from an invalid HTTP response.
- Returns
- Token access information.
- Return type
- keystoneauth1.access.AccessInfo
- property has_scope_parameters
- Return true if parameters can be used to create a scoped token.
- property token_url
- The full URL where we will send authentication data.
keystoneauth1.identity.v3.federation module
- class keystoneauth1.identity.v3.federation.FederationBaseAuth(auth_url, identity_provider, protocol, **kwargs)
- Bases: _Rescoped
Federation authentication plugin.
- Parameters
- auth_url (string) -- URL of the Identity Service
- identity_provider (string) -- name of the Identity Provider the client will authenticate against. This parameter will be used to build a dynamic URL used to obtain unscoped OpenStack token.
- protocol (string) -- name of the protocol the client will authenticate against.
- property federated_token_url
- Full URL where authorization data is sent.
keystoneauth1.identity.v3.k2k module
- class keystoneauth1.identity.v3.k2k.Keystone2Keystone(base_plugin, service_provider, **kwargs)
- Bases: _Rescoped
Plugin to execute the Keystone to Keyestone authentication flow.
In this plugin, an ECP wrapped SAML assertion provided by a keystone Identity Provider (IdP) is used to request an OpenStack unscoped token from a keystone Service Provider (SP).
- Parameters
- base_plugin (keystoneauth1.identity.v3.base.BaseAuth) -- Auth plugin already authenticated against the keystone IdP.
- service_provider (str) -- The Service Provider ID as returned by ServiceProviderManager.list()
- HTTP_MOVED_TEMPORARILY = 302
- HTTP_SEE_OTHER = 303
- REQUEST_ECP_URL = '/auth/OS-FEDERATION/saml2/ecp'
- Path where the ECP wrapped SAML assertion should be presented to the Keystone Service Provider.
- get_unscoped_auth_ref(session, **kwargs)
- Fetch unscoped federated token.
keystoneauth1.identity.v3.multi_factor module
- class keystoneauth1.identity.v3.multi_factor.MultiFactor(auth_url, auth_methods, **kwargs)
- Bases: Auth
A plugin for authenticating with multiple auth methods.
- Parameters
- auth_url (string) -- Identity service endpoint for authentication.
- auth_methods (string) -- names of the methods to authenticate with.
- trust_id (string) -- Trust ID for trust scoping.
- system_scope (string) -- System information to scope to.
- domain_id (string) -- Domain ID for domain scoping.
- domain_name (string) -- Domain name for domain scoping.
- project_id (string) -- Project ID for project scoping.
- project_name (string) -- Project name for project scoping.
- project_domain_id (string) -- Project's domain ID for project.
- project_domain_name (string) -- Project's domain name for project.
- reauthenticate (bool) -- Allow fetching a new token if the current one is going to expire. (optional) default True
Also accepts various keyword args based on which methods are specified.
keystoneauth1.identity.v3.oauth2_client_credential module
- class keystoneauth1.identity.v3.oauth2_client_credential.OAuth2ClientCredential(auth_url, *args, **kwargs)
- Bases: AuthConstructor
A plugin for authenticating via an OAuth2.0 client credential.
- Parameters
- auth_url (string) -- Identity service endpoint for authentication.
- oauth2_endpoint (string) -- OAuth2.0 endpoint.
- oauth2_client_id (string) -- OAuth2.0 client credential id.
- oauth2_client_secret (string) -- OAuth2.0 client credential secret.
- get_headers(session, **kwargs)
- Fetch authentication headers for message.
- Parameters
- session (keystoneauth1.session.Session) -- The session object that the auth_plugin belongs to.
- Returns
- Headers that are set to authenticate a message or None for failure. Note that when checking this value that the empty dict is a valid, non-failure response.
- Return type
- dict
- class keystoneauth1.identity.v3.oauth2_client_credential.OAuth2ClientCredentialMethod(**kwargs)
- Bases: AuthMethod
An auth method to fetch a token via an OAuth2.0 client credential.
- Parameters
- oauth2_endpoint (string) -- OAuth2.0 endpoint.
- oauth2_client_id (string) -- OAuth2.0 client credential id.
- oauth2_client_secret (string) -- OAuth2.0 client credential secret.
- get_auth_data(session, auth, headers, **kwargs)
- Return the authentication section of an auth plugin.
- Parameters
- session (keystoneauth1.session.Session) -- The communication session.
- auth (base.Auth) -- The auth plugin calling the method.
- headers (dict) -- The headers that will be sent with the auth request if a plugin needs to add to them.
- Returns
- The identifier of this plugin and a dict of authentication data for the auth type.
- Return type
- tuple(string, dict)
- get_cache_id_elements()
- Get the elements for this auth method that make it unique.
These elements will be used as part of the keystoneauth1.plugin.BaseIdentityPlugin.get_cache_id() to allow caching of the auth plugin.
Plugins should override this if they want to allow caching of their state.
To avoid collision or overrides the keys of the returned dictionary should be prefixed with the plugin identifier. For example the password plugin returns its username value as 'password_username'.
keystoneauth1.identity.v3.oauth2_mtls_client_credential module
- class keystoneauth1.identity.v3.oauth2_mtls_client_credential.OAuth2mTlsClientCredential(auth_url, oauth2_endpoint, oauth2_client_id, *args, **kwargs)
- Bases: BaseAuth
A plugin for authenticating via an OAuth2.0 mTLS client credential.
- Parameters
- auth_url (string) -- keystone authorization endpoint.
- oauth2_endpoint (string) -- OAuth2.0 endpoint.
- oauth2_client_id (string) -- OAuth2.0 client credential id.
- get_auth_ref(session, **kwargs)
- Obtain a token from an OpenStack Identity Service.
This method is overridden by the various token version plugins.
This function should not be called independently and is expected to be invoked via the do_authenticate function.
This function will be invoked if the AcessInfo object cached by the plugin is not valid. Thus plugins should always fetch a new AccessInfo when invoked. If you are looking to just retrieve the current auth data then you should use get_access.
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- Raises
- keystoneauth1.exceptions.response.InvalidResponse -- The response returned wasn't appropriate.
- keystoneauth1.exceptions.http.HttpError -- An error from an invalid HTTP response.
- keystoneauth1.exceptions.ClientException -- An error from getting OAuth2.0 access token.
- Returns
- Token access information.
- Return type
- keystoneauth1.access.AccessInfo
- get_headers(session, **kwargs)
- Fetch authentication headers for message.
- Parameters
- session (keystoneauth1.session.Session) -- The session object that the auth_plugin belongs to.
- Returns
- Headers that are set to authenticate a message or None for failure. Note that when checking this value that the empty dict is a valid, non-failure response.
- Return type
- dict
keystoneauth1.identity.v3.oidc module
- class keystoneauth1.identity.v3.oidc.OidcAccessToken(auth_url, identity_provider, protocol, access_token, **kwargs)
- Bases: _OidcBase
Implementation for OpenID Connect access token reuse.
- get_payload(session)
- OidcAccessToken does not require a payload.
- get_unscoped_auth_ref(session)
- Authenticate with OpenID Connect and get back claims.
We exchange the access token upon accessing the protected Keystone endpoint (federated auth URL). This will trigger the OpenID Connect Provider to perform a user introspection and retrieve information (specified in the scope) about the user in the form of an OpenID Connect Claim. These claims will be sent to Keystone in the form of environment variables.
- Parameters
- session (keystoneauth1.session.Session) -- a session object to send out HTTP requests.
- Returns
- a token data representation
- Return type
- keystoneauth1.access.AccessInfoV3
- class keystoneauth1.identity.v3.oidc.OidcAuthorizationCode(auth_url, identity_provider, protocol, client_id, client_secret, access_token_endpoint=None, discovery_endpoint=None, access_token_type='access_token', redirect_uri=None, code=None, **kwargs)
- Bases: _OidcBase
Implementation for OpenID Connect Authorization Code.
- get_payload(session)
- Get an authorization grant for the "authorization_code" grant type.
- Parameters
- session (keystoneauth1.session.Session) -- a session object to send out HTTP requests.
- Returns
- a python dictionary containing the payload to be exchanged
- Return type
- dict
- grant_type = 'authorization_code'
- class keystoneauth1.identity.v3.oidc.OidcClientCredentials(auth_url, identity_provider, protocol, client_id, client_secret, access_token_endpoint=None, discovery_endpoint=None, access_token_type='access_token', **kwargs)
- Bases: _OidcBase
Implementation for OpenID Connect Client Credentials.
- get_payload(session)
- Get an authorization grant for the client credentials grant type.
- Parameters
- session (keystoneauth1.session.Session) -- a session object to send out HTTP requests.
- Returns
- a python dictionary containing the payload to be exchanged
- Return type
- dict
- grant_type = 'client_credentials'
- class keystoneauth1.identity.v3.oidc.OidcPassword(auth_url, identity_provider, protocol, client_id, client_secret, access_token_endpoint=None, discovery_endpoint=None, access_token_type='access_token', username=None, password=None, **kwargs)
- Bases: _OidcBase
Implementation for OpenID Connect Resource Owner Password Credential.
- get_payload(session)
- Get an authorization grant for the "password" grant type.
- Parameters
- session (keystoneauth1.session.Session) -- a session object to send out HTTP requests.
- Returns
- a python dictionary containing the payload to be exchanged
- Return type
- dict
- grant_type = 'password'
keystoneauth1.identity.v3.password module
- class keystoneauth1.identity.v3.password.Password(auth_url, *args, **kwargs)
- Bases: AuthConstructor
A plugin for authenticating with a username and password.
- Parameters
- auth_url (string) -- Identity service endpoint for authentication.
- password (string) -- Password for authentication.
- username (string) -- Username for authentication.
- user_id (string) -- User ID for authentication.
- user_domain_id (string) -- User's domain ID for authentication.
- user_domain_name (string) -- User's domain name for authentication.
- trust_id (string) -- Trust ID for trust scoping.
- system_scope (string) -- System information to scope to.
- domain_id (string) -- Domain ID for domain scoping.
- domain_name (string) -- Domain name for domain scoping.
- project_id (string) -- Project ID for project scoping.
- project_name (string) -- Project name for project scoping.
- project_domain_id (string) -- Project's domain ID for project.
- project_domain_name (string) -- Project's domain name for project.
- reauthenticate (bool) -- Allow fetching a new token if the current one is going to expire. (optional) default True
- class keystoneauth1.identity.v3.password.PasswordMethod(**kwargs)
- Bases: AuthMethod
Construct a User/Password based authentication method.
- Parameters
- password (string) -- Password for authentication.
- username (string) -- Username for authentication.
- user_id (string) -- User ID for authentication.
- user_domain_id (string) -- User's domain ID for authentication.
- user_domain_name (string) -- User's domain name for authentication.
- get_auth_data(session, auth, headers, **kwargs)
- Return the authentication section of an auth plugin.
- Parameters
- session (keystoneauth1.session.Session) -- The communication session.
- auth (base.Auth) -- The auth plugin calling the method.
- headers (dict) -- The headers that will be sent with the auth request if a plugin needs to add to them.
- Returns
- The identifier of this plugin and a dict of authentication data for the auth type.
- Return type
- tuple(string, dict)
- get_cache_id_elements()
- Get the elements for this auth method that make it unique.
These elements will be used as part of the keystoneauth1.plugin.BaseIdentityPlugin.get_cache_id() to allow caching of the auth plugin.
Plugins should override this if they want to allow caching of their state.
To avoid collision or overrides the keys of the returned dictionary should be prefixed with the plugin identifier. For example the password plugin returns its username value as 'password_username'.
keystoneauth1.identity.v3.receipt module
- class keystoneauth1.identity.v3.receipt.ReceiptMethod(**kwargs)
- Bases: AuthMethod
Construct an Auth plugin to continue authentication with a receipt.
- Parameters
- receipt (string) -- Receipt for authentication.
- get_auth_data(session, auth, headers, **kwargs)
- Add the auth receipt to the headers.
We explicitly return None to avoid being added to the request methods, or body.
- get_cache_id_elements()
- Get the elements for this auth method that make it unique.
These elements will be used as part of the keystoneauth1.plugin.BaseIdentityPlugin.get_cache_id() to allow caching of the auth plugin.
Plugins should override this if they want to allow caching of their state.
To avoid collision or overrides the keys of the returned dictionary should be prefixed with the plugin identifier. For example the password plugin returns its username value as 'password_username'.
keystoneauth1.identity.v3.token module
- class keystoneauth1.identity.v3.token.Token(auth_url, token, **kwargs)
- Bases: AuthConstructor
A plugin for authenticating with an existing Token.
- Parameters
- auth_url (string) -- Identity service endpoint for authentication.
- token (string) -- Token for authentication.
- trust_id (string) -- Trust ID for trust scoping.
- domain_id (string) -- Domain ID for domain scoping.
- domain_name (string) -- Domain name for domain scoping.
- project_id (string) -- Project ID for project scoping.
- project_name (string) -- Project name for project scoping.
- project_domain_id (string) -- Project's domain ID for project.
- project_domain_name (string) -- Project's domain name for project.
- reauthenticate (bool) -- Allow fetching a new token if the current one is going to expire. (optional) default True
- class keystoneauth1.identity.v3.token.TokenMethod(**kwargs)
- Bases: AuthMethod
Construct an Auth plugin to fetch a token from a token.
- Parameters
- token (string) -- Token for authentication.
- get_auth_data(session, auth, headers, **kwargs)
- Return the authentication section of an auth plugin.
- Parameters
- session (keystoneauth1.session.Session) -- The communication session.
- auth (base.Auth) -- The auth plugin calling the method.
- headers (dict) -- The headers that will be sent with the auth request if a plugin needs to add to them.
- Returns
- The identifier of this plugin and a dict of authentication data for the auth type.
- Return type
- tuple(string, dict)
- get_cache_id_elements()
- Get the elements for this auth method that make it unique.
These elements will be used as part of the keystoneauth1.plugin.BaseIdentityPlugin.get_cache_id() to allow caching of the auth plugin.
Plugins should override this if they want to allow caching of their state.
To avoid collision or overrides the keys of the returned dictionary should be prefixed with the plugin identifier. For example the password plugin returns its username value as 'password_username'.
keystoneauth1.identity.v3.tokenless_auth module
- class keystoneauth1.identity.v3.tokenless_auth.TokenlessAuth(auth_url, domain_id=None, domain_name=None, project_id=None, project_name=None, project_domain_id=None, project_domain_name=None)
- Bases: BaseAuthPlugin
A plugin for authenticating with Tokenless Auth.
This is for Tokenless Authentication. Scoped information like domain name and project ID will be passed in the headers and token validation request will be authenticated based on the provided HTTPS certificate along with the scope information.
- get_endpoint(session, service_type=None, **kwargs)
- Return a valid endpoint for a service.
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- service_type (string) -- The type of service to lookup the endpoint for. This plugin will return None (failure) if service_type is not provided.
- Returns
- A valid endpoint URL or None if not available.
- Return type
- string or None
- get_headers(session, **kwargs)
- Fetch authentication headers for message.
This is to override the default get_headers method to provide tokenless auth scope headers if token is not provided in the session.
- Parameters
- session (keystoneauth1.session.Session) -- The session object that the auth_plugin belongs to.
- Returns
- Headers that are set to authenticate a message or None for failure. Note that when checking this value that the empty dict is a valid, non-failure response.
- Return type
- dict
keystoneauth1.identity.v3.totp module
- class keystoneauth1.identity.v3.totp.TOTP(auth_url, *args, **kwargs)
- Bases: AuthConstructor
A plugin for authenticating with a username and TOTP passcode.
- Parameters
- auth_url (string) -- Identity service endpoint for authentication.
- passcode (string) -- TOTP passcode for authentication.
- username (string) -- Username for authentication.
- user_id (string) -- User ID for authentication.
- user_domain_id (string) -- User's domain ID for authentication.
- user_domain_name (string) -- User's domain name for authentication.
- trust_id (string) -- Trust ID for trust scoping.
- domain_id (string) -- Domain ID for domain scoping.
- domain_name (string) -- Domain name for domain scoping.
- project_id (string) -- Project ID for project scoping.
- project_name (string) -- Project name for project scoping.
- project_domain_id (string) -- Project's domain ID for project.
- project_domain_name (string) -- Project's domain name for project.
- reauthenticate (bool) -- Allow fetching a new token if the current one is going to expire. (optional) default True
- class keystoneauth1.identity.v3.totp.TOTPMethod(**kwargs)
- Bases: AuthMethod
Construct a User/Passcode based authentication method.
- Parameters
- passcode (string) -- TOTP passcode for authentication.
- username (string) -- Username for authentication.
- user_id (string) -- User ID for authentication.
- user_domain_id (string) -- User's domain ID for authentication.
- user_domain_name (string) -- User's domain name for authentication.
- get_auth_data(session, auth, headers, **kwargs)
- Return the authentication section of an auth plugin.
- Parameters
- session (keystoneauth1.session.Session) -- The communication session.
- auth (base.Auth) -- The auth plugin calling the method.
- headers (dict) -- The headers that will be sent with the auth request if a plugin needs to add to them.
- Returns
- The identifier of this plugin and a dict of authentication data for the auth type.
- Return type
- tuple(string, dict)
- get_cache_id_elements()
- Get the elements for this auth method that make it unique.
These elements will be used as part of the keystoneauth1.plugin.BaseIdentityPlugin.get_cache_id() to allow caching of the auth plugin.
Plugins should override this if they want to allow caching of their state.
To avoid collision or overrides the keys of the returned dictionary should be prefixed with the plugin identifier. For example the password plugin returns its username value as 'password_username'.
Module contents
- class keystoneauth1.identity.v3.ApplicationCredential(auth_url, *args, **kwargs)
- Bases: AuthConstructor
A plugin for authenticating with an application credential.
- Parameters
- auth_url (string) -- Identity service endpoint for authentication.
- application_credential_secret (string) -- Application credential secret.
- application_credential_id (string) -- Application credential ID.
- application_credential_name (string) -- Application credential name.
- username (string) -- Username for authentication.
- user_id (string) -- User ID for authentication.
- user_domain_id (string) -- User's domain ID for authentication.
- user_domain_name (string) -- User's domain name for authentication.
- reauthenticate (bool) -- Allow fetching a new token if the current one is going to expire. (optional) default True
- class keystoneauth1.identity.v3.ApplicationCredentialMethod(**kwargs)
- Bases: AuthMethod
Construct a User/Passcode based authentication method.
- Parameters
- application_credential_secret (string) -- Application credential secret.
- application_credential_id (string) -- Application credential id.
- application_credential_name (string) -- The name of the application credential, if an ID is not provided.
- username (string) -- Username for authentication, if an application credential ID is not provided.
- user_id (string) -- User ID for authentication, if an application credential ID is not provided.
- user_domain_id (string) -- User's domain ID for authentication, if an application credential ID is not provided.
- user_domain_name (string) -- User's domain name for authentication, if an application credential ID is not provided.
- get_auth_data(session, auth, headers, **kwargs)
- Return the authentication section of an auth plugin.
- Parameters
- session (keystoneauth1.session.Session) -- The communication session.
- auth (base.Auth) -- The auth plugin calling the method.
- headers (dict) -- The headers that will be sent with the auth request if a plugin needs to add to them.
- Returns
- The identifier of this plugin and a dict of authentication data for the auth type.
- Return type
- tuple(string, dict)
- get_cache_id_elements()
- Get the elements for this auth method that make it unique.
These elements will be used as part of the keystoneauth1.plugin.BaseIdentityPlugin.get_cache_id() to allow caching of the auth plugin.
Plugins should override this if they want to allow caching of their state.
To avoid collision or overrides the keys of the returned dictionary should be prefixed with the plugin identifier. For example the password plugin returns its username value as 'password_username'.
- class keystoneauth1.identity.v3.Auth(auth_url, auth_methods, **kwargs)
- Bases: BaseAuth
Identity V3 Authentication Plugin.
- Parameters
- auth_url (string) -- Identity service endpoint for authentication.
- auth_methods (list) -- A collection of methods to authenticate with.
- trust_id (string) -- Trust ID for trust scoping.
- domain_id (string) -- Domain ID for domain scoping.
- domain_name (string) -- Domain name for domain scoping.
- project_id (string) -- Project ID for project scoping.
- project_name (string) -- Project name for project scoping.
- project_domain_id (string) -- Project's domain ID for project.
- project_domain_name (string) -- Project's domain name for project.
- reauthenticate (bool) -- Allow fetching a new token if the current one is going to expire. (optional) default True
- include_catalog (bool) -- Include the service catalog in the returned token. (optional) default True.
- unscoped (bool) -- Force the return of an unscoped token. This will make the keystone server return an unscoped token even if a default_project_id is set for this user.
- add_method(method)
- Add an additional initialized AuthMethod instance.
- get_auth_ref(session, **kwargs)
- Obtain a token from an OpenStack Identity Service.
This method is overridden by the various token version plugins.
This function should not be called independently and is expected to be invoked via the do_authenticate function.
This function will be invoked if the AcessInfo object cached by the plugin is not valid. Thus plugins should always fetch a new AccessInfo when invoked. If you are looking to just retrieve the current auth data then you should use get_access.
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- Raises
- keystoneauth1.exceptions.response.InvalidResponse -- The response returned wasn't appropriate.
- keystoneauth1.exceptions.http.HttpError -- An error from an invalid HTTP response.
- Returns
- Token access information.
- Return type
- keystoneauth1.access.AccessInfo
- get_cache_id_elements()
- Get the elements for this auth plugin that make it unique.
As part of the get_cache_id requirement we need to determine what aspects of this plugin and its values that make up the unique elements.
This should be overridden by plugins that wish to allow caching.
- Returns
- The unique attributes and values of this plugin.
- Return type
- A flat dict with a str key and str or None value. This is required as we feed these values into a hash. Pairs where the value is None are ignored in the hashed id.
- class keystoneauth1.identity.v3.AuthConstructor(auth_url, *args, **kwargs)
- Bases: Auth
Abstract base class for creating an Auth Plugin.
The Auth Plugin created contains only one authentication method. This is generally the required usage.
An AuthConstructor creates an AuthMethod based on the method's arguments and the auth_method_class defined by the plugin. It then creates the auth plugin with only that authentication method.
- class keystoneauth1.identity.v3.AuthMethod(**kwargs)
- Bases: object
One part of a V3 Authentication strategy.
V3 Tokens allow multiple methods to be presented when authentication against the server. Each one of these methods is implemented by an AuthMethod.
Note: When implementing an AuthMethod use the method_parameters and do not use positional arguments. Otherwise they can't be picked up by the factory method and don't work as well with AuthConstructors.
- abstract get_auth_data(session, auth, headers, **kwargs)
- Return the authentication section of an auth plugin.
- Parameters
- session (keystoneauth1.session.Session) -- The communication session.
- auth (base.Auth) -- The auth plugin calling the method.
- headers (dict) -- The headers that will be sent with the auth request if a plugin needs to add to them.
- Returns
- The identifier of this plugin and a dict of authentication data for the auth type.
- Return type
- tuple(string, dict)
- get_cache_id_elements()
- Get the elements for this auth method that make it unique.
These elements will be used as part of the keystoneauth1.plugin.BaseIdentityPlugin.get_cache_id() to allow caching of the auth plugin.
Plugins should override this if they want to allow caching of their state.
To avoid collision or overrides the keys of the returned dictionary should be prefixed with the plugin identifier. For example the password plugin returns its username value as 'password_username'.
- class keystoneauth1.identity.v3.BaseAuth(auth_url, trust_id=None, system_scope=None, domain_id=None, domain_name=None, project_id=None, project_name=None, project_domain_id=None, project_domain_name=None, reauthenticate=True, include_catalog=True)
- Bases: BaseIdentityPlugin
Identity V3 Authentication Plugin.
- Parameters
- auth_url (string) -- Identity service endpoint for authentication.
- trust_id (string) -- Trust ID for trust scoping.
- system_scope (string) -- System information to scope to.
- domain_id (string) -- Domain ID for domain scoping.
- domain_name (string) -- Domain name for domain scoping.
- project_id (string) -- Project ID for project scoping.
- project_name (string) -- Project name for project scoping.
- project_domain_id (string) -- Project's domain ID for project.
- project_domain_name (string) -- Project's domain name for project.
- reauthenticate (bool) -- Allow fetching a new token if the current one is going to expire. (optional) default True
- include_catalog (bool) -- Include the service catalog in the returned token. (optional) default True.
- abstract get_auth_ref(session, **kwargs)
- Obtain a token from an OpenStack Identity Service.
This method is overridden by the various token version plugins.
This function should not be called independently and is expected to be invoked via the do_authenticate function.
This function will be invoked if the AcessInfo object cached by the plugin is not valid. Thus plugins should always fetch a new AccessInfo when invoked. If you are looking to just retrieve the current auth data then you should use get_access.
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- Raises
- keystoneauth1.exceptions.response.InvalidResponse -- The response returned wasn't appropriate.
- keystoneauth1.exceptions.http.HttpError -- An error from an invalid HTTP response.
- Returns
- Token access information.
- Return type
- keystoneauth1.access.AccessInfo
- property has_scope_parameters
- Return true if parameters can be used to create a scoped token.
- property token_url
- The full URL where we will send authentication data.
- class keystoneauth1.identity.v3.FederationBaseAuth(auth_url, identity_provider, protocol, **kwargs)
- Bases: _Rescoped
Federation authentication plugin.
- Parameters
- auth_url (string) -- URL of the Identity Service
- identity_provider (string) -- name of the Identity Provider the client will authenticate against. This parameter will be used to build a dynamic URL used to obtain unscoped OpenStack token.
- protocol (string) -- name of the protocol the client will authenticate against.
- property federated_token_url
- Full URL where authorization data is sent.
- class keystoneauth1.identity.v3.Keystone2Keystone(base_plugin, service_provider, **kwargs)
- Bases: _Rescoped
Plugin to execute the Keystone to Keyestone authentication flow.
In this plugin, an ECP wrapped SAML assertion provided by a keystone Identity Provider (IdP) is used to request an OpenStack unscoped token from a keystone Service Provider (SP).
- Parameters
- base_plugin (keystoneauth1.identity.v3.base.BaseAuth) -- Auth plugin already authenticated against the keystone IdP.
- service_provider (str) -- The Service Provider ID as returned by ServiceProviderManager.list()
- HTTP_MOVED_TEMPORARILY = 302
- HTTP_SEE_OTHER = 303
- REQUEST_ECP_URL = '/auth/OS-FEDERATION/saml2/ecp'
- Path where the ECP wrapped SAML assertion should be presented to the Keystone Service Provider.
- get_unscoped_auth_ref(session, **kwargs)
- Fetch unscoped federated token.
- class keystoneauth1.identity.v3.MultiFactor(auth_url, auth_methods, **kwargs)
- Bases: Auth
A plugin for authenticating with multiple auth methods.
- Parameters
- auth_url (string) -- Identity service endpoint for authentication.
- auth_methods (string) -- names of the methods to authenticate with.
- trust_id (string) -- Trust ID for trust scoping.
- system_scope (string) -- System information to scope to.
- domain_id (string) -- Domain ID for domain scoping.
- domain_name (string) -- Domain name for domain scoping.
- project_id (string) -- Project ID for project scoping.
- project_name (string) -- Project name for project scoping.
- project_domain_id (string) -- Project's domain ID for project.
- project_domain_name (string) -- Project's domain name for project.
- reauthenticate (bool) -- Allow fetching a new token if the current one is going to expire. (optional) default True
Also accepts various keyword args based on which methods are specified.
- class keystoneauth1.identity.v3.OAuth2ClientCredential(auth_url, *args, **kwargs)
- Bases: AuthConstructor
A plugin for authenticating via an OAuth2.0 client credential.
- Parameters
- auth_url (string) -- Identity service endpoint for authentication.
- oauth2_endpoint (string) -- OAuth2.0 endpoint.
- oauth2_client_id (string) -- OAuth2.0 client credential id.
- oauth2_client_secret (string) -- OAuth2.0 client credential secret.
- get_headers(session, **kwargs)
- Fetch authentication headers for message.
- Parameters
- session (keystoneauth1.session.Session) -- The session object that the auth_plugin belongs to.
- Returns
- Headers that are set to authenticate a message or None for failure. Note that when checking this value that the empty dict is a valid, non-failure response.
- Return type
- dict
- class keystoneauth1.identity.v3.OAuth2ClientCredentialMethod(**kwargs)
- Bases: AuthMethod
An auth method to fetch a token via an OAuth2.0 client credential.
- Parameters
- oauth2_endpoint (string) -- OAuth2.0 endpoint.
- oauth2_client_id (string) -- OAuth2.0 client credential id.
- oauth2_client_secret (string) -- OAuth2.0 client credential secret.
- get_auth_data(session, auth, headers, **kwargs)
- Return the authentication section of an auth plugin.
- Parameters
- session (keystoneauth1.session.Session) -- The communication session.
- auth (base.Auth) -- The auth plugin calling the method.
- headers (dict) -- The headers that will be sent with the auth request if a plugin needs to add to them.
- Returns
- The identifier of this plugin and a dict of authentication data for the auth type.
- Return type
- tuple(string, dict)
- get_cache_id_elements()
- Get the elements for this auth method that make it unique.
These elements will be used as part of the keystoneauth1.plugin.BaseIdentityPlugin.get_cache_id() to allow caching of the auth plugin.
Plugins should override this if they want to allow caching of their state.
To avoid collision or overrides the keys of the returned dictionary should be prefixed with the plugin identifier. For example the password plugin returns its username value as 'password_username'.
- class keystoneauth1.identity.v3.OAuth2mTlsClientCredential(auth_url, oauth2_endpoint, oauth2_client_id, *args, **kwargs)
- Bases: BaseAuth
A plugin for authenticating via an OAuth2.0 mTLS client credential.
- Parameters
- auth_url (string) -- keystone authorization endpoint.
- oauth2_endpoint (string) -- OAuth2.0 endpoint.
- oauth2_client_id (string) -- OAuth2.0 client credential id.
- get_auth_ref(session, **kwargs)
- Obtain a token from an OpenStack Identity Service.
This method is overridden by the various token version plugins.
This function should not be called independently and is expected to be invoked via the do_authenticate function.
This function will be invoked if the AcessInfo object cached by the plugin is not valid. Thus plugins should always fetch a new AccessInfo when invoked. If you are looking to just retrieve the current auth data then you should use get_access.
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- Raises
- keystoneauth1.exceptions.response.InvalidResponse -- The response returned wasn't appropriate.
- keystoneauth1.exceptions.http.HttpError -- An error from an invalid HTTP response.
- keystoneauth1.exceptions.ClientException -- An error from getting OAuth2.0 access token.
- Returns
- Token access information.
- Return type
- keystoneauth1.access.AccessInfo
- get_headers(session, **kwargs)
- Fetch authentication headers for message.
- Parameters
- session (keystoneauth1.session.Session) -- The session object that the auth_plugin belongs to.
- Returns
- Headers that are set to authenticate a message or None for failure. Note that when checking this value that the empty dict is a valid, non-failure response.
- Return type
- dict
- class keystoneauth1.identity.v3.OidcAccessToken(auth_url, identity_provider, protocol, access_token, **kwargs)
- Bases: _OidcBase
Implementation for OpenID Connect access token reuse.
- get_payload(session)
- OidcAccessToken does not require a payload.
- get_unscoped_auth_ref(session)
- Authenticate with OpenID Connect and get back claims.
We exchange the access token upon accessing the protected Keystone endpoint (federated auth URL). This will trigger the OpenID Connect Provider to perform a user introspection and retrieve information (specified in the scope) about the user in the form of an OpenID Connect Claim. These claims will be sent to Keystone in the form of environment variables.
- Parameters
- session (keystoneauth1.session.Session) -- a session object to send out HTTP requests.
- Returns
- a token data representation
- Return type
- keystoneauth1.access.AccessInfoV3
- class keystoneauth1.identity.v3.OidcAuthorizationCode(auth_url, identity_provider, protocol, client_id, client_secret, access_token_endpoint=None, discovery_endpoint=None, access_token_type='access_token', redirect_uri=None, code=None, **kwargs)
- Bases: _OidcBase
Implementation for OpenID Connect Authorization Code.
- get_payload(session)
- Get an authorization grant for the "authorization_code" grant type.
- Parameters
- session (keystoneauth1.session.Session) -- a session object to send out HTTP requests.
- Returns
- a python dictionary containing the payload to be exchanged
- Return type
- dict
- grant_type = 'authorization_code'
- class keystoneauth1.identity.v3.OidcClientCredentials(auth_url, identity_provider, protocol, client_id, client_secret, access_token_endpoint=None, discovery_endpoint=None, access_token_type='access_token', **kwargs)
- Bases: _OidcBase
Implementation for OpenID Connect Client Credentials.
- get_payload(session)
- Get an authorization grant for the client credentials grant type.
- Parameters
- session (keystoneauth1.session.Session) -- a session object to send out HTTP requests.
- Returns
- a python dictionary containing the payload to be exchanged
- Return type
- dict
- grant_type = 'client_credentials'
- class keystoneauth1.identity.v3.OidcPassword(auth_url, identity_provider, protocol, client_id, client_secret, access_token_endpoint=None, discovery_endpoint=None, access_token_type='access_token', username=None, password=None, **kwargs)
- Bases: _OidcBase
Implementation for OpenID Connect Resource Owner Password Credential.
- get_payload(session)
- Get an authorization grant for the "password" grant type.
- Parameters
- session (keystoneauth1.session.Session) -- a session object to send out HTTP requests.
- Returns
- a python dictionary containing the payload to be exchanged
- Return type
- dict
- grant_type = 'password'
- class keystoneauth1.identity.v3.Password(auth_url, *args, **kwargs)
- Bases: AuthConstructor
A plugin for authenticating with a username and password.
- Parameters
- auth_url (string) -- Identity service endpoint for authentication.
- password (string) -- Password for authentication.
- username (string) -- Username for authentication.
- user_id (string) -- User ID for authentication.
- user_domain_id (string) -- User's domain ID for authentication.
- user_domain_name (string) -- User's domain name for authentication.
- trust_id (string) -- Trust ID for trust scoping.
- system_scope (string) -- System information to scope to.
- domain_id (string) -- Domain ID for domain scoping.
- domain_name (string) -- Domain name for domain scoping.
- project_id (string) -- Project ID for project scoping.
- project_name (string) -- Project name for project scoping.
- project_domain_id (string) -- Project's domain ID for project.
- project_domain_name (string) -- Project's domain name for project.
- reauthenticate (bool) -- Allow fetching a new token if the current one is going to expire. (optional) default True
- class keystoneauth1.identity.v3.PasswordMethod(**kwargs)
- Bases: AuthMethod
Construct a User/Password based authentication method.
- Parameters
- password (string) -- Password for authentication.
- username (string) -- Username for authentication.
- user_id (string) -- User ID for authentication.
- user_domain_id (string) -- User's domain ID for authentication.
- user_domain_name (string) -- User's domain name for authentication.
- get_auth_data(session, auth, headers, **kwargs)
- Return the authentication section of an auth plugin.
- Parameters
- session (keystoneauth1.session.Session) -- The communication session.
- auth (base.Auth) -- The auth plugin calling the method.
- headers (dict) -- The headers that will be sent with the auth request if a plugin needs to add to them.
- Returns
- The identifier of this plugin and a dict of authentication data for the auth type.
- Return type
- tuple(string, dict)
- get_cache_id_elements()
- Get the elements for this auth method that make it unique.
These elements will be used as part of the keystoneauth1.plugin.BaseIdentityPlugin.get_cache_id() to allow caching of the auth plugin.
Plugins should override this if they want to allow caching of their state.
To avoid collision or overrides the keys of the returned dictionary should be prefixed with the plugin identifier. For example the password plugin returns its username value as 'password_username'.
- class keystoneauth1.identity.v3.ReceiptMethod(**kwargs)
- Bases: AuthMethod
Construct an Auth plugin to continue authentication with a receipt.
- Parameters
- receipt (string) -- Receipt for authentication.
- get_auth_data(session, auth, headers, **kwargs)
- Add the auth receipt to the headers.
We explicitly return None to avoid being added to the request methods, or body.
- get_cache_id_elements()
- Get the elements for this auth method that make it unique.
These elements will be used as part of the keystoneauth1.plugin.BaseIdentityPlugin.get_cache_id() to allow caching of the auth plugin.
Plugins should override this if they want to allow caching of their state.
To avoid collision or overrides the keys of the returned dictionary should be prefixed with the plugin identifier. For example the password plugin returns its username value as 'password_username'.
- class keystoneauth1.identity.v3.TOTP(auth_url, *args, **kwargs)
- Bases: AuthConstructor
A plugin for authenticating with a username and TOTP passcode.
- Parameters
- auth_url (string) -- Identity service endpoint for authentication.
- passcode (string) -- TOTP passcode for authentication.
- username (string) -- Username for authentication.
- user_id (string) -- User ID for authentication.
- user_domain_id (string) -- User's domain ID for authentication.
- user_domain_name (string) -- User's domain name for authentication.
- trust_id (string) -- Trust ID for trust scoping.
- domain_id (string) -- Domain ID for domain scoping.
- domain_name (string) -- Domain name for domain scoping.
- project_id (string) -- Project ID for project scoping.
- project_name (string) -- Project name for project scoping.
- project_domain_id (string) -- Project's domain ID for project.
- project_domain_name (string) -- Project's domain name for project.
- reauthenticate (bool) -- Allow fetching a new token if the current one is going to expire. (optional) default True
- class keystoneauth1.identity.v3.TOTPMethod(**kwargs)
- Bases: AuthMethod
Construct a User/Passcode based authentication method.
- Parameters
- passcode (string) -- TOTP passcode for authentication.
- username (string) -- Username for authentication.
- user_id (string) -- User ID for authentication.
- user_domain_id (string) -- User's domain ID for authentication.
- user_domain_name (string) -- User's domain name for authentication.
- get_auth_data(session, auth, headers, **kwargs)
- Return the authentication section of an auth plugin.
- Parameters
- session (keystoneauth1.session.Session) -- The communication session.
- auth (base.Auth) -- The auth plugin calling the method.
- headers (dict) -- The headers that will be sent with the auth request if a plugin needs to add to them.
- Returns
- The identifier of this plugin and a dict of authentication data for the auth type.
- Return type
- tuple(string, dict)
- get_cache_id_elements()
- Get the elements for this auth method that make it unique.
These elements will be used as part of the keystoneauth1.plugin.BaseIdentityPlugin.get_cache_id() to allow caching of the auth plugin.
Plugins should override this if they want to allow caching of their state.
To avoid collision or overrides the keys of the returned dictionary should be prefixed with the plugin identifier. For example the password plugin returns its username value as 'password_username'.
- class keystoneauth1.identity.v3.Token(auth_url, token, **kwargs)
- Bases: AuthConstructor
A plugin for authenticating with an existing Token.
- Parameters
- auth_url (string) -- Identity service endpoint for authentication.
- token (string) -- Token for authentication.
- trust_id (string) -- Trust ID for trust scoping.
- domain_id (string) -- Domain ID for domain scoping.
- domain_name (string) -- Domain name for domain scoping.
- project_id (string) -- Project ID for project scoping.
- project_name (string) -- Project name for project scoping.
- project_domain_id (string) -- Project's domain ID for project.
- project_domain_name (string) -- Project's domain name for project.
- reauthenticate (bool) -- Allow fetching a new token if the current one is going to expire. (optional) default True
- class keystoneauth1.identity.v3.TokenMethod(**kwargs)
- Bases: AuthMethod
Construct an Auth plugin to fetch a token from a token.
- Parameters
- token (string) -- Token for authentication.
- get_auth_data(session, auth, headers, **kwargs)
- Return the authentication section of an auth plugin.
- Parameters
- session (keystoneauth1.session.Session) -- The communication session.
- auth (base.Auth) -- The auth plugin calling the method.
- headers (dict) -- The headers that will be sent with the auth request if a plugin needs to add to them.
- Returns
- The identifier of this plugin and a dict of authentication data for the auth type.
- Return type
- tuple(string, dict)
- get_cache_id_elements()
- Get the elements for this auth method that make it unique.
These elements will be used as part of the keystoneauth1.plugin.BaseIdentityPlugin.get_cache_id() to allow caching of the auth plugin.
Plugins should override this if they want to allow caching of their state.
To avoid collision or overrides the keys of the returned dictionary should be prefixed with the plugin identifier. For example the password plugin returns its username value as 'password_username'.
- class keystoneauth1.identity.v3.TokenlessAuth(auth_url, domain_id=None, domain_name=None, project_id=None, project_name=None, project_domain_id=None, project_domain_name=None)
- Bases: BaseAuthPlugin
A plugin for authenticating with Tokenless Auth.
This is for Tokenless Authentication. Scoped information like domain name and project ID will be passed in the headers and token validation request will be authenticated based on the provided HTTPS certificate along with the scope information.
- get_endpoint(session, service_type=None, **kwargs)
- Return a valid endpoint for a service.
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- service_type (string) -- The type of service to lookup the endpoint for. This plugin will return None (failure) if service_type is not provided.
- Returns
- A valid endpoint URL or None if not available.
- Return type
- string or None
- get_headers(session, **kwargs)
- Fetch authentication headers for message.
This is to override the default get_headers method to provide tokenless auth scope headers if token is not provided in the session.
- Parameters
- session (keystoneauth1.session.Session) -- The session object that the auth_plugin belongs to.
- Returns
- Headers that are set to authenticate a message or None for failure. Note that when checking this value that the empty dict is a valid, non-failure response.
- Return type
- dict
Submodules
keystoneauth1.identity.access module
- class keystoneauth1.identity.access.AccessInfoPlugin(auth_ref, auth_url=None)
- Bases: BaseIdentityPlugin
A plugin that turns an existing AccessInfo object into a usable plugin.
There are cases where reuse of an auth_ref or AccessInfo object is warranted such as from a cache, from auth_token middleware, or another source.
Turn the existing access info object into an identity plugin. This plugin cannot be refreshed as the AccessInfo object does not contain any authorizing information.
- Parameters
- auth_ref (keystoneauth1.access.AccessInfo) -- the existing AccessInfo object.
- auth_url -- the url where this AccessInfo was retrieved from. Required if using the AUTH_INTERFACE with get_endpoint. (optional)
- get_auth_ref(session, **kwargs)
- Obtain a token from an OpenStack Identity Service.
This method is overridden by the various token version plugins.
This function should not be called independently and is expected to be invoked via the do_authenticate function.
This function will be invoked if the AcessInfo object cached by the plugin is not valid. Thus plugins should always fetch a new AccessInfo when invoked. If you are looking to just retrieve the current auth data then you should use get_access.
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- Raises
- keystoneauth1.exceptions.response.InvalidResponse -- The response returned wasn't appropriate.
- keystoneauth1.exceptions.http.HttpError -- An error from an invalid HTTP response.
- Returns
- Token access information.
- Return type
- keystoneauth1.access.AccessInfo
- invalidate()
- Invalidate the current authentication data.
This should result in fetching a new token on next call.
A plugin may be invalidated if an Unauthorized HTTP response is returned to indicate that the token may have been revoked or is otherwise now invalid.
- Returns
- True if there was something that the plugin did to invalidate. This means that it makes sense to try again. If nothing happens returns False to indicate give up.
- Return type
- bool
keystoneauth1.identity.base module
- class keystoneauth1.identity.base.BaseIdentityPlugin(auth_url=None, reauthenticate=True)
- Bases: BaseAuthPlugin
- MIN_TOKEN_LIFE_SECONDS = 120
- get_access(session, **kwargs)
- Fetch or return a current AccessInfo object.
If a valid AccessInfo is present then it is returned otherwise a new one will be fetched.
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- Raises
- keystoneauth1.exceptions.http.HttpError -- An error from an invalid HTTP response.
- Returns
- Valid AccessInfo
- Return type
- keystoneauth1.access.AccessInfo
- get_all_version_data(session, interface='public', region_name=None, service_type=None, **kwargs)
- Get version data for all services in the catalog.
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- interface -- Type of endpoint to get version data for. Can be a single value or a list of values. A value of None indicates that all interfaces should be queried. (optional, defaults to public)
- region_name (string) -- Region of endpoints to get version data for. A valueof None indicates that all regions should be queried. (optional, defaults to None)
- service_type (string) -- Limit the version data to a single service. (optional, defaults to None)
- Returns
- A dictionary keyed by region_name with values containing dictionaries keyed by interface with values being a list of VersionData.
- get_api_major_version(session, service_type=None, interface=None, region_name=None, service_name=None, version=None, allow=None, allow_version_hack=True, skip_discovery=False, discover_versions=False, min_version=None, max_version=None, **kwargs)
- Return the major API version for a service.
If a valid token is not present then a new one will be fetched using the session and kwargs.
version, min_version and max_version can all be given either as a string or a tuple.
- Valid interface types: public or publicURL,
- internal or internalURL, admin or 'adminURL`
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- service_type (string) -- The type of service to lookup the endpoint for. This plugin will return None (failure) if service_type is not provided.
- interface -- Type of endpoint. Can be a single value or a list of values. If it's a list of values, they will be looked for in order of preference. Can also be keystoneauth1.plugin.AUTH_INTERFACE to indicate that the auth_url should be used instead of the value in the catalog. (optional, defaults to public)
- region_name (string) -- The region the endpoint should exist in. (optional)
- service_name (string) -- The name of the service in the catalog. (optional)
- version -- The minimum version number required for this endpoint. (optional)
- allow (dict) -- Extra filters to pass when discovering API versions. (optional)
- allow_version_hack (bool) -- Allow keystoneauth to hack up catalog URLS to support older schemes. (optional, default True)
- skip_discovery (bool) -- Whether to skip version discovery even if a version has been given. This is useful if endpoint_override or similar has been given and grabbing additional information about the endpoint is not useful.
- discover_versions (bool) -- Whether to get version metadata from the version discovery document even if it's not neccessary to fulfill the major version request. Defaults to False because get_endpoint doesn't need metadata. (optional, defaults to False)
- min_version -- The minimum version that is acceptable. Mutually exclusive with version. If min_version is given with no max_version it is as if max version is 'latest'. (optional)
- max_version -- The maximum version that is acceptable. Mutually exclusive with version. If min_version is given with no max_version it is as if max version is 'latest'. (optional)
- Raises
- keystoneauth1.exceptions.http.HttpError -- An error from an invalid HTTP response.
- Returns
- The major version of the API of the service discovered.
- Return type
- tuple or None
NOTE:
There are many cases when major version can be satisfied without actually calling the discovery endpoint (like when the version is in the url). If the user has a cloud with the versioned endpoint https://volume.example.com/v3 in the catalog for the block-storage service and they do:
client = adapter.Adapter(
session, service_type='block-storage', min_version=2,
max_version=3) volume_version = client.get_api_major_version()
The version actually be returned with no api calls other than getting the token. For that reason, get_api_major_version() first calls get_endpoint_data() with discover_versions=False.
If their catalog has an unversioned endpoint https://volume.example.com for the block-storage service and they do this:
client = adapter.Adapter(session, service_type='block-storage')
client is now set up to "use whatever is in the catalog". Since the url doesn't have a version, get_endpoint_data() with discover_versions=False will result in api_version=None. (No version was requested so it didn't need to do the round trip)
In order to find out what version the endpoint actually is, we must make a round trip. Therefore, if api_version is None after the first call, get_api_major_version() will make a second call to get_endpoint_data() with discover_versions=True.
- abstract get_auth_ref(session, **kwargs)
- Obtain a token from an OpenStack Identity Service.
This method is overridden by the various token version plugins.
This function should not be called independently and is expected to be invoked via the do_authenticate function.
This function will be invoked if the AcessInfo object cached by the plugin is not valid. Thus plugins should always fetch a new AccessInfo when invoked. If you are looking to just retrieve the current auth data then you should use get_access.
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- Raises
- keystoneauth1.exceptions.response.InvalidResponse -- The response returned wasn't appropriate.
- keystoneauth1.exceptions.http.HttpError -- An error from an invalid HTTP response.
- Returns
- Token access information.
- Return type
- keystoneauth1.access.AccessInfo
- get_auth_state()
- Retrieve the current authentication state for the plugin.
Retrieve any internal state that represents the authenticated plugin.
This should not fetch any new data if it is not present.
- Returns
- a string that can be stored or None if there is no auth state present in the plugin. This string can be reloaded with set_auth_state to set the same authentication.
- Return type
- str or None if no auth present.
- get_cache_id()
- Fetch an identifier that uniquely identifies the auth options.
The returned identifier need not be decomposable or otherwise provide any way to recreate the plugin.
This string MUST change if any of the parameters that are used to uniquely identity this plugin change. It should not change upon a reauthentication of the plugin.
- Returns
- A unique string for the set of options
- Return type
- str or None if this is unsupported or unavailable.
- get_cache_id_elements()
- Get the elements for this auth plugin that make it unique.
As part of the get_cache_id requirement we need to determine what aspects of this plugin and its values that make up the unique elements.
This should be overridden by plugins that wish to allow caching.
- Returns
- The unique attributes and values of this plugin.
- Return type
- A flat dict with a str key and str or None value. This is required as we feed these values into a hash. Pairs where the value is None are ignored in the hashed id.
- get_discovery(session, url, authenticated=None)
- Return the discovery object for a URL.
Check the session and the plugin cache to see if we have already performed discovery on the URL and if so return it, otherwise create a new discovery object, cache it and return it.
This function is expected to be used by subclasses and should not be needed by users.
- Parameters
- session (keystoneauth1.session.Session) -- A session object to discover with.
- url (str) -- The url to lookup.
- authenticated (bool) -- Include a token in the discovery call. (optional) Defaults to None (use a token if a plugin is installed).
- Raises
- keystoneauth1.exceptions.discovery.DiscoveryFailure -- if for some reason the lookup fails.
- keystoneauth1.exceptions.http.HttpError -- An error from an invalid HTTP response.
- Returns
- A discovery object with the results of looking up that URL.
- get_endpoint(session, service_type=None, interface=None, region_name=None, service_name=None, version=None, allow=None, allow_version_hack=True, skip_discovery=False, min_version=None, max_version=None, **kwargs)
- Return a valid endpoint for a service.
If a valid token is not present then a new one will be fetched using the session and kwargs.
version, min_version and max_version can all be given either as a string or a tuple.
- Valid interface types: public or publicURL,
- internal or internalURL, admin or 'adminURL`
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- service_type (string) -- The type of service to lookup the endpoint for. This plugin will return None (failure) if service_type is not provided.
- interface -- Type of endpoint. Can be a single value or a list of values. If it's a list of values, they will be looked for in order of preference. Can also be keystoneauth1.plugin.AUTH_INTERFACE to indicate that the auth_url should be used instead of the value in the catalog. (optional, defaults to public)
- region_name (string) -- The region the endpoint should exist in. (optional)
- service_name (string) -- The name of the service in the catalog. (optional)
- version -- The minimum version number required for this endpoint. (optional)
- allow (dict) -- Extra filters to pass when discovering API versions. (optional)
- allow_version_hack (bool) -- Allow keystoneauth to hack up catalog URLS to support older schemes. (optional, default True)
- skip_discovery (bool) -- Whether to skip version discovery even if a version has been given. This is useful if endpoint_override or similar has been given and grabbing additional information about the endpoint is not useful.
- min_version -- The minimum version that is acceptable. Mutually exclusive with version. If min_version is given with no max_version it is as if max version is 'latest'. (optional)
- max_version -- The maximum version that is acceptable. Mutually exclusive with version. If min_version is given with no max_version it is as if max version is 'latest'. (optional)
- Raises
- keystoneauth1.exceptions.http.HttpError -- An error from an invalid HTTP response.
- Returns
- A valid endpoint URL or None if not available.
- Return type
- string or None
- get_endpoint_data(session, service_type=None, interface=None, region_name=None, service_name=None, allow=None, allow_version_hack=True, discover_versions=True, skip_discovery=False, min_version=None, max_version=None, endpoint_override=None, **kwargs)
- Return a valid endpoint data for a service.
If a valid token is not present then a new one will be fetched using the session and kwargs.
version, min_version and max_version can all be given either as a string or a tuple.
- Valid interface types: public or publicURL,
- internal or internalURL, admin or 'adminURL`
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- service_type (string) -- The type of service to lookup the endpoint for. This plugin will return None (failure) if service_type is not provided.
- interface -- Type of endpoint. Can be a single value or a list of values. If it's a list of values, they will be looked for in order of preference. Can also be keystoneauth1.plugin.AUTH_INTERFACE to indicate that the auth_url should be used instead of the value in the catalog. (optional, defaults to public)
- region_name (string) -- The region the endpoint should exist in. (optional)
- service_name (string) -- The name of the service in the catalog. (optional)
- allow (dict) -- Extra filters to pass when discovering API versions. (optional)
- allow_version_hack (bool) -- Allow keystoneauth to hack up catalog URLS to support older schemes. (optional, default True)
- discover_versions (bool) -- Whether to get version metadata from the version discovery document even if it's not neccessary to fulfill the major version request. (optional, defaults to True)
- skip_discovery (bool) -- Whether to skip version discovery even if a version has been given. This is useful if endpoint_override or similar has been given and grabbing additional information about the endpoint is not useful.
- min_version -- The minimum version that is acceptable. Mutually exclusive with version. If min_version is given with no max_version it is as if max version is 'latest'. (optional)
- max_version -- The maximum version that is acceptable. Mutually exclusive with version. If min_version is given with no max_version it is as if max version is 'latest'. (optional)
- endpoint_override (str) -- URL to use instead of looking in the catalog. Catalog lookup will be skipped, but version discovery will be run. Sets allow_version_hack to False (optional)
- kwargs -- Ignored.
- Raises
- keystoneauth1.exceptions.http.HttpError -- An error from an invalid HTTP response.
- Returns
- Valid EndpointData or None if not available.
- Return type
- keystoneauth1.discover.EndpointData or None
- get_project_id(session, **kwargs)
- Return the project id that we are authenticated to.
Wherever possible the project id should be inferred from the token however there are certain URLs and other places that require access to the currently authenticated project id.
- Parameters
- session (keystoneauth1.session.Session) -- A session object so the plugin can make HTTP calls.
- Returns
- A project identifier or None if one is not available.
- Return type
- str
- get_sp_auth_url(session, sp_id, **kwargs)
- Return auth_url from the Service Provider object.
This url is used for obtaining unscoped federated token from remote cloud.
- Parameters
- sp_id (string) -- ID of the Service Provider to be queried.
- Returns
- A Service Provider auth_url or None if one is not available.
- Return type
- str
- get_sp_url(session, sp_id, **kwargs)
- Return sp_url from the Service Provider object.
This url is used for passing SAML2 assertion to the remote cloud.
- Parameters
- sp_id (str) -- ID of the Service Provider to be queried.
- Returns
- A Service Provider sp_url or None if one is not available.
- Return type
- str
- get_token(session, **kwargs)
- Return a valid auth token.
If a valid token is not present then a new one will be fetched.
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- Raises
- keystoneauth1.exceptions.http.HttpError -- An error from an invalid HTTP response.
- Returns
- A valid token.
- Return type
- string
- get_user_id(session, **kwargs)
- Return a unique user identifier of the plugin.
Wherever possible the user id should be inferred from the token however there are certain URLs and other places that require access to the currently authenticated user id.
- Parameters
- session (keystoneauth1.session.Session) -- A session object so the plugin can make HTTP calls.
- Returns
- A user identifier or None if one is not available.
- Return type
- str
- invalidate()
- Invalidate the current authentication data.
This should result in fetching a new token on next call.
A plugin may be invalidated if an Unauthorized HTTP response is returned to indicate that the token may have been revoked or is otherwise now invalid.
- Returns
- True if there was something that the plugin did to invalidate. This means that it makes sense to try again. If nothing happens returns False to indicate give up.
- Return type
- bool
- set_auth_state(data)
- Install existing authentication state for a plugin.
Take the output of get_auth_state and install that authentication state into the current authentication plugin.
keystoneauth1.identity.v2 module
- class keystoneauth1.identity.v2.Auth(auth_url, trust_id=None, tenant_id=None, tenant_name=None, reauthenticate=True)
- Bases: BaseIdentityPlugin
Identity V2 Authentication Plugin.
- Parameters
- auth_url (string) -- Identity service endpoint for authorization.
- trust_id (string) -- Trust ID for trust scoping.
- tenant_id (string) -- Tenant ID for project scoping.
- tenant_name (string) -- Tenant name for project scoping.
- reauthenticate (bool) -- Allow fetching a new token if the current one is going to expire. (optional) default True
- abstract get_auth_data(headers=None)
- Return the authentication section of an auth plugin.
- Parameters
- headers (dict) -- The headers that will be sent with the auth request if a plugin needs to add to them.
- Returns
- A dict of authentication data for the auth type.
- Return type
- dict
- get_auth_ref(session, **kwargs)
- Obtain a token from an OpenStack Identity Service.
This method is overridden by the various token version plugins.
This function should not be called independently and is expected to be invoked via the do_authenticate function.
This function will be invoked if the AcessInfo object cached by the plugin is not valid. Thus plugins should always fetch a new AccessInfo when invoked. If you are looking to just retrieve the current auth data then you should use get_access.
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- Raises
- keystoneauth1.exceptions.response.InvalidResponse -- The response returned wasn't appropriate.
- keystoneauth1.exceptions.http.HttpError -- An error from an invalid HTTP response.
- Returns
- Token access information.
- Return type
- keystoneauth1.access.AccessInfo
- property has_scope_parameters
- Return true if parameters can be used to create a scoped token.
- class keystoneauth1.identity.v2.Password(auth_url, username=<object object>, password=None, user_id=<object object>, **kwargs)
- Bases: Auth
A plugin for authenticating with a username and password.
A username or user_id must be provided.
- Parameters
- auth_url (string) -- Identity service endpoint for authorization.
- username (string) -- Username for authentication.
- password (string) -- Password for authentication.
- user_id (string) -- User ID for authentication.
- trust_id (string) -- Trust ID for trust scoping.
- tenant_id (string) -- Tenant ID for tenant scoping.
- tenant_name (string) -- Tenant name for tenant scoping.
- reauthenticate (bool) -- Allow fetching a new token if the current one is going to expire. (optional) default True
- Raises
- TypeError -- if a user_id or username is not provided.
- get_auth_data(headers=None)
- Return the authentication section of an auth plugin.
- Parameters
- headers (dict) -- The headers that will be sent with the auth request if a plugin needs to add to them.
- Returns
- A dict of authentication data for the auth type.
- Return type
- dict
- get_cache_id_elements()
- Get the elements for this auth plugin that make it unique.
As part of the get_cache_id requirement we need to determine what aspects of this plugin and its values that make up the unique elements.
This should be overridden by plugins that wish to allow caching.
- Returns
- The unique attributes and values of this plugin.
- Return type
- A flat dict with a str key and str or None value. This is required as we feed these values into a hash. Pairs where the value is None are ignored in the hashed id.
- class keystoneauth1.identity.v2.Token(auth_url, token, **kwargs)
- Bases: Auth
A plugin for authenticating with an existing token.
- Parameters
- auth_url (string) -- Identity service endpoint for authorization.
- token (string) -- Existing token for authentication.
- tenant_id (string) -- Tenant ID for tenant scoping.
- tenant_name (string) -- Tenant name for tenant scoping.
- trust_id (string) -- Trust ID for trust scoping.
- reauthenticate (bool) -- Allow fetching a new token if the current one is going to expire. (optional) default True
- get_auth_data(headers=None)
- Return the authentication section of an auth plugin.
- Parameters
- headers (dict) -- The headers that will be sent with the auth request if a plugin needs to add to them.
- Returns
- A dict of authentication data for the auth type.
- Return type
- dict
- get_cache_id_elements()
- Get the elements for this auth plugin that make it unique.
As part of the get_cache_id requirement we need to determine what aspects of this plugin and its values that make up the unique elements.
This should be overridden by plugins that wish to allow caching.
- Returns
- The unique attributes and values of this plugin.
- Return type
- A flat dict with a str key and str or None value. This is required as we feed these values into a hash. Pairs where the value is None are ignored in the hashed id.
Module contents
- class keystoneauth1.identity.BaseIdentityPlugin(auth_url=None, reauthenticate=True)
- Bases: BaseAuthPlugin
- MIN_TOKEN_LIFE_SECONDS = 120
- get_access(session, **kwargs)
- Fetch or return a current AccessInfo object.
If a valid AccessInfo is present then it is returned otherwise a new one will be fetched.
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- Raises
- keystoneauth1.exceptions.http.HttpError -- An error from an invalid HTTP response.
- Returns
- Valid AccessInfo
- Return type
- keystoneauth1.access.AccessInfo
- get_all_version_data(session, interface='public', region_name=None, service_type=None, **kwargs)
- Get version data for all services in the catalog.
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- interface -- Type of endpoint to get version data for. Can be a single value or a list of values. A value of None indicates that all interfaces should be queried. (optional, defaults to public)
- region_name (string) -- Region of endpoints to get version data for. A valueof None indicates that all regions should be queried. (optional, defaults to None)
- service_type (string) -- Limit the version data to a single service. (optional, defaults to None)
- Returns
- A dictionary keyed by region_name with values containing dictionaries keyed by interface with values being a list of VersionData.
- get_api_major_version(session, service_type=None, interface=None, region_name=None, service_name=None, version=None, allow=None, allow_version_hack=True, skip_discovery=False, discover_versions=False, min_version=None, max_version=None, **kwargs)
- Return the major API version for a service.
If a valid token is not present then a new one will be fetched using the session and kwargs.
version, min_version and max_version can all be given either as a string or a tuple.
- Valid interface types: public or publicURL,
- internal or internalURL, admin or 'adminURL`
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- service_type (string) -- The type of service to lookup the endpoint for. This plugin will return None (failure) if service_type is not provided.
- interface -- Type of endpoint. Can be a single value or a list of values. If it's a list of values, they will be looked for in order of preference. Can also be keystoneauth1.plugin.AUTH_INTERFACE to indicate that the auth_url should be used instead of the value in the catalog. (optional, defaults to public)
- region_name (string) -- The region the endpoint should exist in. (optional)
- service_name (string) -- The name of the service in the catalog. (optional)
- version -- The minimum version number required for this endpoint. (optional)
- allow (dict) -- Extra filters to pass when discovering API versions. (optional)
- allow_version_hack (bool) -- Allow keystoneauth to hack up catalog URLS to support older schemes. (optional, default True)
- skip_discovery (bool) -- Whether to skip version discovery even if a version has been given. This is useful if endpoint_override or similar has been given and grabbing additional information about the endpoint is not useful.
- discover_versions (bool) -- Whether to get version metadata from the version discovery document even if it's not neccessary to fulfill the major version request. Defaults to False because get_endpoint doesn't need metadata. (optional, defaults to False)
- min_version -- The minimum version that is acceptable. Mutually exclusive with version. If min_version is given with no max_version it is as if max version is 'latest'. (optional)
- max_version -- The maximum version that is acceptable. Mutually exclusive with version. If min_version is given with no max_version it is as if max version is 'latest'. (optional)
- Raises
- keystoneauth1.exceptions.http.HttpError -- An error from an invalid HTTP response.
- Returns
- The major version of the API of the service discovered.
- Return type
- tuple or None
NOTE:
There are many cases when major version can be satisfied without actually calling the discovery endpoint (like when the version is in the url). If the user has a cloud with the versioned endpoint https://volume.example.com/v3 in the catalog for the block-storage service and they do:
client = adapter.Adapter(
session, service_type='block-storage', min_version=2,
max_version=3) volume_version = client.get_api_major_version()
The version actually be returned with no api calls other than getting the token. For that reason, get_api_major_version() first calls get_endpoint_data() with discover_versions=False.
If their catalog has an unversioned endpoint https://volume.example.com for the block-storage service and they do this:
client = adapter.Adapter(session, service_type='block-storage')
client is now set up to "use whatever is in the catalog". Since the url doesn't have a version, get_endpoint_data() with discover_versions=False will result in api_version=None. (No version was requested so it didn't need to do the round trip)
In order to find out what version the endpoint actually is, we must make a round trip. Therefore, if api_version is None after the first call, get_api_major_version() will make a second call to get_endpoint_data() with discover_versions=True.
- abstract get_auth_ref(session, **kwargs)
- Obtain a token from an OpenStack Identity Service.
This method is overridden by the various token version plugins.
This function should not be called independently and is expected to be invoked via the do_authenticate function.
This function will be invoked if the AcessInfo object cached by the plugin is not valid. Thus plugins should always fetch a new AccessInfo when invoked. If you are looking to just retrieve the current auth data then you should use get_access.
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- Raises
- keystoneauth1.exceptions.response.InvalidResponse -- The response returned wasn't appropriate.
- keystoneauth1.exceptions.http.HttpError -- An error from an invalid HTTP response.
- Returns
- Token access information.
- Return type
- keystoneauth1.access.AccessInfo
- get_auth_state()
- Retrieve the current authentication state for the plugin.
Retrieve any internal state that represents the authenticated plugin.
This should not fetch any new data if it is not present.
- Returns
- a string that can be stored or None if there is no auth state present in the plugin. This string can be reloaded with set_auth_state to set the same authentication.
- Return type
- str or None if no auth present.
- get_cache_id()
- Fetch an identifier that uniquely identifies the auth options.
The returned identifier need not be decomposable or otherwise provide any way to recreate the plugin.
This string MUST change if any of the parameters that are used to uniquely identity this plugin change. It should not change upon a reauthentication of the plugin.
- Returns
- A unique string for the set of options
- Return type
- str or None if this is unsupported or unavailable.
- get_cache_id_elements()
- Get the elements for this auth plugin that make it unique.
As part of the get_cache_id requirement we need to determine what aspects of this plugin and its values that make up the unique elements.
This should be overridden by plugins that wish to allow caching.
- Returns
- The unique attributes and values of this plugin.
- Return type
- A flat dict with a str key and str or None value. This is required as we feed these values into a hash. Pairs where the value is None are ignored in the hashed id.
- get_discovery(session, url, authenticated=None)
- Return the discovery object for a URL.
Check the session and the plugin cache to see if we have already performed discovery on the URL and if so return it, otherwise create a new discovery object, cache it and return it.
This function is expected to be used by subclasses and should not be needed by users.
- Parameters
- session (keystoneauth1.session.Session) -- A session object to discover with.
- url (str) -- The url to lookup.
- authenticated (bool) -- Include a token in the discovery call. (optional) Defaults to None (use a token if a plugin is installed).
- Raises
- keystoneauth1.exceptions.discovery.DiscoveryFailure -- if for some reason the lookup fails.
- keystoneauth1.exceptions.http.HttpError -- An error from an invalid HTTP response.
- Returns
- A discovery object with the results of looking up that URL.
- get_endpoint(session, service_type=None, interface=None, region_name=None, service_name=None, version=None, allow=None, allow_version_hack=True, skip_discovery=False, min_version=None, max_version=None, **kwargs)
- Return a valid endpoint for a service.
If a valid token is not present then a new one will be fetched using the session and kwargs.
version, min_version and max_version can all be given either as a string or a tuple.
- Valid interface types: public or publicURL,
- internal or internalURL, admin or 'adminURL`
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- service_type (string) -- The type of service to lookup the endpoint for. This plugin will return None (failure) if service_type is not provided.
- interface -- Type of endpoint. Can be a single value or a list of values. If it's a list of values, they will be looked for in order of preference. Can also be keystoneauth1.plugin.AUTH_INTERFACE to indicate that the auth_url should be used instead of the value in the catalog. (optional, defaults to public)
- region_name (string) -- The region the endpoint should exist in. (optional)
- service_name (string) -- The name of the service in the catalog. (optional)
- version -- The minimum version number required for this endpoint. (optional)
- allow (dict) -- Extra filters to pass when discovering API versions. (optional)
- allow_version_hack (bool) -- Allow keystoneauth to hack up catalog URLS to support older schemes. (optional, default True)
- skip_discovery (bool) -- Whether to skip version discovery even if a version has been given. This is useful if endpoint_override or similar has been given and grabbing additional information about the endpoint is not useful.
- min_version -- The minimum version that is acceptable. Mutually exclusive with version. If min_version is given with no max_version it is as if max version is 'latest'. (optional)
- max_version -- The maximum version that is acceptable. Mutually exclusive with version. If min_version is given with no max_version it is as if max version is 'latest'. (optional)
- Raises
- keystoneauth1.exceptions.http.HttpError -- An error from an invalid HTTP response.
- Returns
- A valid endpoint URL or None if not available.
- Return type
- string or None
- get_endpoint_data(session, service_type=None, interface=None, region_name=None, service_name=None, allow=None, allow_version_hack=True, discover_versions=True, skip_discovery=False, min_version=None, max_version=None, endpoint_override=None, **kwargs)
- Return a valid endpoint data for a service.
If a valid token is not present then a new one will be fetched using the session and kwargs.
version, min_version and max_version can all be given either as a string or a tuple.
- Valid interface types: public or publicURL,
- internal or internalURL, admin or 'adminURL`
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- service_type (string) -- The type of service to lookup the endpoint for. This plugin will return None (failure) if service_type is not provided.
- interface -- Type of endpoint. Can be a single value or a list of values. If it's a list of values, they will be looked for in order of preference. Can also be keystoneauth1.plugin.AUTH_INTERFACE to indicate that the auth_url should be used instead of the value in the catalog. (optional, defaults to public)
- region_name (string) -- The region the endpoint should exist in. (optional)
- service_name (string) -- The name of the service in the catalog. (optional)
- allow (dict) -- Extra filters to pass when discovering API versions. (optional)
- allow_version_hack (bool) -- Allow keystoneauth to hack up catalog URLS to support older schemes. (optional, default True)
- discover_versions (bool) -- Whether to get version metadata from the version discovery document even if it's not neccessary to fulfill the major version request. (optional, defaults to True)
- skip_discovery (bool) -- Whether to skip version discovery even if a version has been given. This is useful if endpoint_override or similar has been given and grabbing additional information about the endpoint is not useful.
- min_version -- The minimum version that is acceptable. Mutually exclusive with version. If min_version is given with no max_version it is as if max version is 'latest'. (optional)
- max_version -- The maximum version that is acceptable. Mutually exclusive with version. If min_version is given with no max_version it is as if max version is 'latest'. (optional)
- endpoint_override (str) -- URL to use instead of looking in the catalog. Catalog lookup will be skipped, but version discovery will be run. Sets allow_version_hack to False (optional)
- kwargs -- Ignored.
- Raises
- keystoneauth1.exceptions.http.HttpError -- An error from an invalid HTTP response.
- Returns
- Valid EndpointData or None if not available.
- Return type
- keystoneauth1.discover.EndpointData or None
- get_project_id(session, **kwargs)
- Return the project id that we are authenticated to.
Wherever possible the project id should be inferred from the token however there are certain URLs and other places that require access to the currently authenticated project id.
- Parameters
- session (keystoneauth1.session.Session) -- A session object so the plugin can make HTTP calls.
- Returns
- A project identifier or None if one is not available.
- Return type
- str
- get_sp_auth_url(session, sp_id, **kwargs)
- Return auth_url from the Service Provider object.
This url is used for obtaining unscoped federated token from remote cloud.
- Parameters
- sp_id (string) -- ID of the Service Provider to be queried.
- Returns
- A Service Provider auth_url or None if one is not available.
- Return type
- str
- get_sp_url(session, sp_id, **kwargs)
- Return sp_url from the Service Provider object.
This url is used for passing SAML2 assertion to the remote cloud.
- Parameters
- sp_id (str) -- ID of the Service Provider to be queried.
- Returns
- A Service Provider sp_url or None if one is not available.
- Return type
- str
- get_token(session, **kwargs)
- Return a valid auth token.
If a valid token is not present then a new one will be fetched.
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- Raises
- keystoneauth1.exceptions.http.HttpError -- An error from an invalid HTTP response.
- Returns
- A valid token.
- Return type
- string
- get_user_id(session, **kwargs)
- Return a unique user identifier of the plugin.
Wherever possible the user id should be inferred from the token however there are certain URLs and other places that require access to the currently authenticated user id.
- Parameters
- session (keystoneauth1.session.Session) -- A session object so the plugin can make HTTP calls.
- Returns
- A user identifier or None if one is not available.
- Return type
- str
- invalidate()
- Invalidate the current authentication data.
This should result in fetching a new token on next call.
A plugin may be invalidated if an Unauthorized HTTP response is returned to indicate that the token may have been revoked or is otherwise now invalid.
- Returns
- True if there was something that the plugin did to invalidate. This means that it makes sense to try again. If nothing happens returns False to indicate give up.
- Return type
- bool
- set_auth_state(data)
- Install existing authentication state for a plugin.
Take the output of get_auth_state and install that authentication state into the current authentication plugin.
- class keystoneauth1.identity.Password(auth_url, username=None, user_id=None, password=None, user_domain_id=None, user_domain_name=None, **kwargs)
- Bases: BaseGenericPlugin
A common user/password authentication plugin.
- Parameters
- username (string) -- Username for authentication.
- user_id (string) -- User ID for authentication.
- password (string) -- Password for authentication.
- user_domain_id (string) -- User's domain ID for authentication.
- user_domain_name (string) -- User's domain name for authentication.
- create_plugin(session, version, url, raw_status=None)
- Create a plugin from the given parameters.
This function will be called multiple times with the version and url of a potential endpoint. If a plugin can be constructed that fits the params then it should return it. If not return None and then another call will be made with other available URLs.
- Parameters
- session (keystoneauth1.session.Session) -- A session object.
- version (tuple) -- A tuple of the API version at the URL.
- url (str) -- The base URL for this version.
- raw_status (str) -- The status that was in the discovery field.
- Returns
- A plugin that can match the parameters or None if nothing.
- get_cache_id_elements()
- Get the elements for this auth plugin that make it unique.
As part of the get_cache_id requirement we need to determine what aspects of this plugin and its values that make up the unique elements.
This should be overridden by plugins that wish to allow caching.
- Returns
- The unique attributes and values of this plugin.
- Return type
- A flat dict with a str key and str or None value. This is required as we feed these values into a hash. Pairs where the value is None are ignored in the hashed id.
- property user_domain_id
- property user_domain_name
- class keystoneauth1.identity.Token(auth_url, token=None, **kwargs)
- Bases: BaseGenericPlugin
Generic token auth plugin.
- Parameters
- token (string) -- Token for authentication.
- create_plugin(session, version, url, raw_status=None)
- Create a plugin from the given parameters.
This function will be called multiple times with the version and url of a potential endpoint. If a plugin can be constructed that fits the params then it should return it. If not return None and then another call will be made with other available URLs.
- Parameters
- session (keystoneauth1.session.Session) -- A session object.
- version (tuple) -- A tuple of the API version at the URL.
- url (str) -- The base URL for this version.
- raw_status (str) -- The status that was in the discovery field.
- Returns
- A plugin that can match the parameters or None if nothing.
- get_cache_id_elements()
- Get the elements for this auth plugin that make it unique.
As part of the get_cache_id requirement we need to determine what aspects of this plugin and its values that make up the unique elements.
This should be overridden by plugins that wish to allow caching.
- Returns
- The unique attributes and values of this plugin.
- Return type
- A flat dict with a str key and str or None value. This is required as we feed these values into a hash. Pairs where the value is None are ignored in the hashed id.
- keystoneauth1.identity.V2Password
- See keystoneauth1.identity.v2.Password
- keystoneauth1.identity.V2Token
- See keystoneauth1.identity.v2.Token
- keystoneauth1.identity.V3ApplicationCredential
- See keystoneauth1.identity.v3.ApplicationCredential
- keystoneauth1.identity.V3MultiFactor
- See keystoneauth1.identity.v3.MultiFactor
- keystoneauth1.identity.V3OAuth2ClientCredential
- See keystoneauth1.identity.v3.OAuth2ClientCredential
- keystoneauth1.identity.V3OAuth2mTlsClientCredential
- See keystoneauth1.identity.v3.OAuth2mTlsClientCredential
- keystoneauth1.identity.V3OidcAccessToken
- See keystoneauth1.identity.v3.oidc.OidcAccessToken
- keystoneauth1.identity.V3OidcAuthorizationCode
- See keystoneauth1.identity.v3.oidc.OidcAuthorizationCode
- keystoneauth1.identity.V3OidcDeviceAuthorization
- See keystoneauth1.identity.v3.oidc.OidcDeviceAuthorization
- keystoneauth1.identity.V3OidcPassword
- See keystoneauth1.identity.v3.oidc.OidcPassword
- keystoneauth1.identity.V3Password
- See keystoneauth1.identity.v3.Password
- keystoneauth1.identity.V3TOTP
- See keystoneauth1.identity.v3.TOTP
- keystoneauth1.identity.V3Token
- See keystoneauth1.identity.v3.Token
- keystoneauth1.identity.V3TokenlessAuth
- See keystoneauth1.identity.v3.TokenlessAuth
keystoneauth1.loading package
Submodules
keystoneauth1.loading.adapter module
- keystoneauth1.loading.adapter.get_conf_options(*args, **kwargs)
- keystoneauth1.loading.adapter.load_from_conf_options(*args, **kwargs)
- keystoneauth1.loading.adapter.register_argparse_arguments(*args, **kwargs)
- keystoneauth1.loading.adapter.register_conf_options(*args, **kwargs)
- keystoneauth1.loading.adapter.register_service_argparse_arguments(*args, **kwargs)
keystoneauth1.loading.base module
- class keystoneauth1.loading.base.BaseLoader
- Bases: object
- property available
- Return if the plugin is available for loading.
If a plugin is missing dependencies or for some other reason should not be available to the current system it should override this property and return False to exclude itself from the plugin list.
- Return type
- bool
- create_plugin(**kwargs)
- Create a plugin from the options available for the loader.
Given the options that were specified by the loader create an appropriate plugin. You can override this function in your loader.
This used to be specified by providing the plugin_class property and this is still supported, however specifying a property didn't let you choose a plugin type based upon the options that were presented.
Override this function if you wish to return different plugins based on the options presented, otherwise you can simply provide the plugin_class property.
Added 2.9
- abstract get_options()
- Return the list of parameters associated with the auth plugin.
This list may be used to generate CLI or config arguments.
- Returns
- A list of Param objects describing available plugin parameters.
- Return type
- list
- load_from_options(**kwargs)
- Create a plugin from the arguments retrieved from get_options.
A client can override this function to do argument validation or to handle differences between the registered options and what is required to create the plugin.
- load_from_options_getter(getter, **kwargs)
- Load a plugin from getter function that returns appropriate values.
To handle cases other than the provided CONF and CLI loading you can specify a custom loader function that will be queried for the option value. The getter is a function that takes a keystoneauth1.loading.Opt and returns a value to load with.
- Parameters
- getter (callable) -- A function that returns a value for the given opt.
- Returns
- An authentication Plugin.
- Return type
- keystoneauth1.plugin.BaseAuthPlugin
- property plugin_class
- keystoneauth1.loading.base.get_available_plugin_loaders()
- Retrieve all the plugin classes available on the system.
- Returns
- A dict with plugin entrypoint name as the key and the plugin loader as the value.
- Return type
- dict
- keystoneauth1.loading.base.get_available_plugin_names()
- Get the names of all the plugins that are available on the system.
This is particularly useful for help and error text to prompt a user for example what plugins they may specify.
- Returns
- A list of names.
- Return type
- frozenset
- keystoneauth1.loading.base.get_plugin_loader(name)
- Retrieve a plugin class by its entrypoint name.
- Parameters
- name (str) -- The name of the object to get.
- Returns
- An auth plugin class.
- Return type
- keystoneauth1.loading.BaseLoader
- Raises
- keystoneauth1.exceptions.auth_plugins.NoMatchingPlugin -- if a plugin cannot be created.
- keystoneauth1.loading.base.get_plugin_options(name)
- Get the options for a specific plugin.
This will be the list of options that is registered and loaded by the specified plugin.
- Returns
- A list of keystoneauth1.loading.Opt options.
- Raises
- keystoneauth1.exceptions.auth_plugins.NoMatchingPlugin -- if a plugin cannot be created.
keystoneauth1.loading.cli module
- keystoneauth1.loading.cli.load_from_argparse_arguments(namespace, **kwargs)
- Retrieve the created plugin from the completed argparse results.
Loads and creates the auth plugin from the information parsed from the command line by argparse.
- Parameters
- namespace (Namespace) -- The result from CLI parsing.
- Returns
- An auth plugin, or None if a name is not provided.
- Return type
- keystoneauth1.plugin.BaseAuthPlugin
- Raises
- keystoneauth1.exceptions.auth_plugins.NoMatchingPlugin -- if a plugin cannot be created.
- keystoneauth1.loading.cli.register_argparse_arguments(parser, argv, default=None)
- Register CLI options needed to create a plugin.
The function inspects the provided arguments so that it can also register the options required for that specific plugin if available.
- Parameters
- parser (argparse.ArgumentParser) -- the parser to attach argparse options to.
- argv (list) -- the arguments provided to the appliation.
- default (str/class) -- a default plugin name or a plugin object to use if one isn't specified by the CLI. default: None.
- Returns
- The plugin class that will be loaded or None if not provided.
- Return type
- keystoneauth1.plugin.BaseAuthPlugin
- Raises
- keystoneauth1.exceptions.auth_plugins.NoMatchingPlugin -- if a plugin cannot be created.
keystoneauth1.loading.conf module
- keystoneauth1.loading.conf.get_common_conf_options()
- Get the oslo_config options common for all auth plugins.
These may be useful without being registered for config file generation or to manipulate the options before registering them yourself.
- The options that are set are:
- auth_type
- The name of the plugin to load.
- auth_section
- The config file section to load options from.
- Returns
- A list of oslo_config options.
- keystoneauth1.loading.conf.get_plugin_conf_options(plugin)
- Get the oslo_config options for a specific plugin.
This will be the list of config options that is registered and loaded by the specified plugin.
- Parameters
- plugin (str or keystoneauth1._loading.BaseLoader) -- The name of the plugin loader or a plugin loader object
- Returns
- A list of oslo_config options.
- keystoneauth1.loading.conf.load_from_conf_options(conf, group, **kwargs)
- Load a plugin from an oslo_config CONF object.
Each plugin will register their own required options and so there is no standard list and the plugin should be consulted.
The base options should have been registered with register_conf_options before this function is called.
- Parameters
- conf (oslo_config.cfg.ConfigOpts) -- A conf object.
- group (str) -- The group name that options should be read from.
- Returns
- An authentication Plugin or None if a name is not provided
- Return type
- keystoneauth1.plugin.BaseAuthPlugin
- Raises
- keystoneauth1.exceptions.auth_plugins.NoMatchingPlugin -- if a plugin cannot be created.
- keystoneauth1.loading.conf.register_conf_options(conf, group)
- Register the oslo_config options that are needed for a plugin.
This only registers the basic options shared by all plugins. Options that are specific to a plugin are loaded just before they are read.
The defined options are:
- •
- auth_type: the name of the auth plugin that will be used for
- authentication.
- •
- auth_section: the group from which further auth plugin options should be
- taken. If section is not provided then the auth plugin options will be taken from the same group as provided in the parameters.
- Parameters
- conf (oslo_config.cfg.ConfigOpts) -- config object to register with.
- group (string) -- The ini group to register options in.
keystoneauth1.loading.identity module
- class keystoneauth1.loading.identity.BaseFederationLoader
- Bases: BaseV3Loader
Base Option handling for federation plugins.
This class defines options and handling that should be common to the V3 identity federation API. It provides the options expected by the keystoneauth1.identity.v3.FederationBaseAuth class.
- get_options()
- Return the list of parameters associated with the auth plugin.
This list may be used to generate CLI or config arguments.
- Returns
- A list of Param objects describing available plugin parameters.
- Return type
- list
- class keystoneauth1.loading.identity.BaseGenericLoader
- Bases: BaseIdentityLoader
Base Option handling for generic plugins.
This class defines options and handling that should be common to generic plugins. These plugins target the OpenStack identity service however are designed to be independent of API version. It provides the options expected by the keystoneauth1.identity.v3.BaseGenericPlugin class.
- get_options()
- Return the list of parameters associated with the auth plugin.
This list may be used to generate CLI or config arguments.
- Returns
- A list of Param objects describing available plugin parameters.
- Return type
- list
- class keystoneauth1.loading.identity.BaseIdentityLoader
- Bases: BaseLoader
Base Option handling for identity plugins.
This class defines options and handling that should be common across all plugins that are developed against the OpenStack identity service. It provides the options expected by the keystoneauth1.identity.BaseIdentityPlugin class.
- get_options()
- Return the list of parameters associated with the auth plugin.
This list may be used to generate CLI or config arguments.
- Returns
- A list of Param objects describing available plugin parameters.
- Return type
- list
- class keystoneauth1.loading.identity.BaseV2Loader
- Bases: BaseIdentityLoader
Base Option handling for identity plugins.
This class defines options and handling that should be common to the V2 identity API. It provides the options expected by the keystoneauth1.identity.v2.Auth class.
- get_options()
- Return the list of parameters associated with the auth plugin.
This list may be used to generate CLI or config arguments.
- Returns
- A list of Param objects describing available plugin parameters.
- Return type
- list
- class keystoneauth1.loading.identity.BaseV3Loader
- Bases: BaseIdentityLoader
Base Option handling for identity plugins.
This class defines options and handling that should be common to the V3 identity API. It provides the options expected by the keystoneauth1.identity.v3.Auth class.
- get_options()
- Return the list of parameters associated with the auth plugin.
This list may be used to generate CLI or config arguments.
- Returns
- A list of Param objects describing available plugin parameters.
- Return type
- list
- load_from_options(**kwargs)
- Create a plugin from the arguments retrieved from get_options.
A client can override this function to do argument validation or to handle differences between the registered options and what is required to create the plugin.
keystoneauth1.loading.opts module
- class keystoneauth1.loading.opts.Opt(name, type=<class 'str'>, help=None, secret=False, dest=None, deprecated=None, default=None, metavar=None, required=False, prompt=None)
- Bases: object
An option required by an authentication plugin.
Opts provide a means for authentication plugins that are going to be dynamically loaded to specify the parameters that are to be passed to the plugin on initialization.
The Opt specifies information about the way the plugin parameter is to be represented in different loading mechanisms.
When defining an Opt with a - the - should be present in the name parameter. This will automatically be converted to an _ when passing to the plugin initialization. For example, you should specify:
Opt('user-domain-id')
which will pass the value as user_domain_id to the plugin's initialization.
- Parameters
- name (str) -- The name of the option.
- type (callable) -- The type of the option. This is a callable which is passed the raw option that was loaded (often a string) and is required to return the parameter in the type expected by __init__.
- help (str) -- The help text that is shown along with the option.
- secret (bool) -- If the parameter is secret it should not be printed or logged in debug output.
- dest (str) -- the name of the argument that will be passed to __init__. This allows you to have a different name in loading than is used by the __init__ function. Defaults to the value of name.
- keystoneauth1.loading.Opt -- A list of other options that are deprecated in favour of this one. This ensures the old options are still registered.
- default -- A default value that can be used if one is not provided.
- metavar (str) -- The <metavar> that should be printed in CLI help text.
- required (bool) -- If the option is required to load the plugin. If a required option is not present loading should fail.
- prompt (str) -- If the option can be requested via a prompt (where appropriate) set the string that should be used to prompt with.
- property argparse_args
- property argparse_default
keystoneauth1.loading.session module
- keystoneauth1.loading.session.get_conf_options(*args, **kwargs)
- keystoneauth1.loading.session.load_from_argparse_arguments(*args, **kwargs)
- keystoneauth1.loading.session.load_from_conf_options(*args, **kwargs)
- keystoneauth1.loading.session.register_argparse_arguments(*args, **kwargs)
- keystoneauth1.loading.session.register_conf_options(*args, **kwargs)
Module contents
- class keystoneauth1.loading.BaseFederationLoader
- Bases: BaseV3Loader
Base Option handling for federation plugins.
This class defines options and handling that should be common to the V3 identity federation API. It provides the options expected by the keystoneauth1.identity.v3.FederationBaseAuth class.
- get_options()
- Return the list of parameters associated with the auth plugin.
This list may be used to generate CLI or config arguments.
- Returns
- A list of Param objects describing available plugin parameters.
- Return type
- list
- class keystoneauth1.loading.BaseGenericLoader
- Bases: BaseIdentityLoader
Base Option handling for generic plugins.
This class defines options and handling that should be common to generic plugins. These plugins target the OpenStack identity service however are designed to be independent of API version. It provides the options expected by the keystoneauth1.identity.v3.BaseGenericPlugin class.
- get_options()
- Return the list of parameters associated with the auth plugin.
This list may be used to generate CLI or config arguments.
- Returns
- A list of Param objects describing available plugin parameters.
- Return type
- list
- class keystoneauth1.loading.BaseIdentityLoader
- Bases: BaseLoader
Base Option handling for identity plugins.
This class defines options and handling that should be common across all plugins that are developed against the OpenStack identity service. It provides the options expected by the keystoneauth1.identity.BaseIdentityPlugin class.
- get_options()
- Return the list of parameters associated with the auth plugin.
This list may be used to generate CLI or config arguments.
- Returns
- A list of Param objects describing available plugin parameters.
- Return type
- list
- class keystoneauth1.loading.BaseLoader
- Bases: object
- property available
- Return if the plugin is available for loading.
If a plugin is missing dependencies or for some other reason should not be available to the current system it should override this property and return False to exclude itself from the plugin list.
- Return type
- bool
- create_plugin(**kwargs)
- Create a plugin from the options available for the loader.
Given the options that were specified by the loader create an appropriate plugin. You can override this function in your loader.
This used to be specified by providing the plugin_class property and this is still supported, however specifying a property didn't let you choose a plugin type based upon the options that were presented.
Override this function if you wish to return different plugins based on the options presented, otherwise you can simply provide the plugin_class property.
Added 2.9
- abstract get_options()
- Return the list of parameters associated with the auth plugin.
This list may be used to generate CLI or config arguments.
- Returns
- A list of Param objects describing available plugin parameters.
- Return type
- list
- load_from_options(**kwargs)
- Create a plugin from the arguments retrieved from get_options.
A client can override this function to do argument validation or to handle differences between the registered options and what is required to create the plugin.
- load_from_options_getter(getter, **kwargs)
- Load a plugin from getter function that returns appropriate values.
To handle cases other than the provided CONF and CLI loading you can specify a custom loader function that will be queried for the option value. The getter is a function that takes a keystoneauth1.loading.Opt and returns a value to load with.
- Parameters
- getter (callable) -- A function that returns a value for the given opt.
- Returns
- An authentication Plugin.
- Return type
- keystoneauth1.plugin.BaseAuthPlugin
- property plugin_class
- class keystoneauth1.loading.BaseV2Loader
- Bases: BaseIdentityLoader
Base Option handling for identity plugins.
This class defines options and handling that should be common to the V2 identity API. It provides the options expected by the keystoneauth1.identity.v2.Auth class.
- get_options()
- Return the list of parameters associated with the auth plugin.
This list may be used to generate CLI or config arguments.
- Returns
- A list of Param objects describing available plugin parameters.
- Return type
- list
- class keystoneauth1.loading.BaseV3Loader
- Bases: BaseIdentityLoader
Base Option handling for identity plugins.
This class defines options and handling that should be common to the V3 identity API. It provides the options expected by the keystoneauth1.identity.v3.Auth class.
- get_options()
- Return the list of parameters associated with the auth plugin.
This list may be used to generate CLI or config arguments.
- Returns
- A list of Param objects describing available plugin parameters.
- Return type
- list
- load_from_options(**kwargs)
- Create a plugin from the arguments retrieved from get_options.
A client can override this function to do argument validation or to handle differences between the registered options and what is required to create the plugin.
- class keystoneauth1.loading.Opt(name, type=<class 'str'>, help=None, secret=False, dest=None, deprecated=None, default=None, metavar=None, required=False, prompt=None)
- Bases: object
An option required by an authentication plugin.
Opts provide a means for authentication plugins that are going to be dynamically loaded to specify the parameters that are to be passed to the plugin on initialization.
The Opt specifies information about the way the plugin parameter is to be represented in different loading mechanisms.
When defining an Opt with a - the - should be present in the name parameter. This will automatically be converted to an _ when passing to the plugin initialization. For example, you should specify:
Opt('user-domain-id')
which will pass the value as user_domain_id to the plugin's initialization.
- Parameters
- name (str) -- The name of the option.
- type (callable) -- The type of the option. This is a callable which is passed the raw option that was loaded (often a string) and is required to return the parameter in the type expected by __init__.
- help (str) -- The help text that is shown along with the option.
- secret (bool) -- If the parameter is secret it should not be printed or logged in debug output.
- dest (str) -- the name of the argument that will be passed to __init__. This allows you to have a different name in loading than is used by the __init__ function. Defaults to the value of name.
- keystoneauth1.loading.Opt -- A list of other options that are deprecated in favour of this one. This ensures the old options are still registered.
- default -- A default value that can be used if one is not provided.
- metavar (str) -- The <metavar> that should be printed in CLI help text.
- required (bool) -- If the option is required to load the plugin. If a required option is not present loading should fail.
- prompt (str) -- If the option can be requested via a prompt (where appropriate) set the string that should be used to prompt with.
- property argparse_args
- property argparse_default
- keystoneauth1.loading.get_adapter_conf_options(*args, **kwargs)
- keystoneauth1.loading.get_auth_common_conf_options()
- Get the oslo_config options common for all auth plugins.
These may be useful without being registered for config file generation or to manipulate the options before registering them yourself.
- The options that are set are:
- auth_type
- The name of the plugin to load.
- auth_section
- The config file section to load options from.
- Returns
- A list of oslo_config options.
- keystoneauth1.loading.get_auth_plugin_conf_options(plugin)
- Get the oslo_config options for a specific plugin.
This will be the list of config options that is registered and loaded by the specified plugin.
- Parameters
- plugin (str or keystoneauth1._loading.BaseLoader) -- The name of the plugin loader or a plugin loader object
- Returns
- A list of oslo_config options.
- keystoneauth1.loading.get_available_plugin_loaders()
- Retrieve all the plugin classes available on the system.
- Returns
- A dict with plugin entrypoint name as the key and the plugin loader as the value.
- Return type
- dict
- keystoneauth1.loading.get_available_plugin_names()
- Get the names of all the plugins that are available on the system.
This is particularly useful for help and error text to prompt a user for example what plugins they may specify.
- Returns
- A list of names.
- Return type
- frozenset
- keystoneauth1.loading.get_plugin_loader(name)
- Retrieve a plugin class by its entrypoint name.
- Parameters
- name (str) -- The name of the object to get.
- Returns
- An auth plugin class.
- Return type
- keystoneauth1.loading.BaseLoader
- Raises
- keystoneauth1.exceptions.auth_plugins.NoMatchingPlugin -- if a plugin cannot be created.
- keystoneauth1.loading.get_session_conf_options(*args, **kwargs)
- keystoneauth1.loading.load_adapter_from_conf_options(*args, **kwargs)
- keystoneauth1.loading.load_auth_from_argparse_arguments(namespace, **kwargs)
- Retrieve the created plugin from the completed argparse results.
Loads and creates the auth plugin from the information parsed from the command line by argparse.
- Parameters
- namespace (Namespace) -- The result from CLI parsing.
- Returns
- An auth plugin, or None if a name is not provided.
- Return type
- keystoneauth1.plugin.BaseAuthPlugin
- Raises
- keystoneauth1.exceptions.auth_plugins.NoMatchingPlugin -- if a plugin cannot be created.
- keystoneauth1.loading.load_auth_from_conf_options(conf, group, **kwargs)
- Load a plugin from an oslo_config CONF object.
Each plugin will register their own required options and so there is no standard list and the plugin should be consulted.
The base options should have been registered with register_conf_options before this function is called.
- Parameters
- conf (oslo_config.cfg.ConfigOpts) -- A conf object.
- group (str) -- The group name that options should be read from.
- Returns
- An authentication Plugin or None if a name is not provided
- Return type
- keystoneauth1.plugin.BaseAuthPlugin
- Raises
- keystoneauth1.exceptions.auth_plugins.NoMatchingPlugin -- if a plugin cannot be created.
- keystoneauth1.loading.load_session_from_argparse_arguments(*args, **kwargs)
- keystoneauth1.loading.load_session_from_conf_options(*args, **kwargs)
- keystoneauth1.loading.register_adapter_argparse_arguments(*args, **kwargs)
- keystoneauth1.loading.register_adapter_conf_options(*args, **kwargs)
- keystoneauth1.loading.register_auth_argparse_arguments(parser, argv, default=None)
- Register CLI options needed to create a plugin.
The function inspects the provided arguments so that it can also register the options required for that specific plugin if available.
- Parameters
- parser (argparse.ArgumentParser) -- the parser to attach argparse options to.
- argv (list) -- the arguments provided to the appliation.
- default (str/class) -- a default plugin name or a plugin object to use if one isn't specified by the CLI. default: None.
- Returns
- The plugin class that will be loaded or None if not provided.
- Return type
- keystoneauth1.plugin.BaseAuthPlugin
- Raises
- keystoneauth1.exceptions.auth_plugins.NoMatchingPlugin -- if a plugin cannot be created.
- keystoneauth1.loading.register_auth_conf_options(conf, group)
- Register the oslo_config options that are needed for a plugin.
This only registers the basic options shared by all plugins. Options that are specific to a plugin are loaded just before they are read.
The defined options are:
- •
- auth_type: the name of the auth plugin that will be used for
- authentication.
- •
- auth_section: the group from which further auth plugin options should be
- taken. If section is not provided then the auth plugin options will be taken from the same group as provided in the parameters.
- Parameters
- conf (oslo_config.cfg.ConfigOpts) -- config object to register with.
- group (string) -- The ini group to register options in.
- keystoneauth1.loading.register_service_adapter_argparse_arguments(*args, **kwargs)
- keystoneauth1.loading.register_session_argparse_arguments(*args, **kwargs)
- keystoneauth1.loading.register_session_conf_options(*args, **kwargs)
Submodules
keystoneauth1.adapter module
- class keystoneauth1.adapter.Adapter(session, service_type=None, service_name=None, interface=None, region_name=None, endpoint_override=None, version=None, auth=None, user_agent=None, connect_retries=None, logger=None, allow=None, additional_headers=None, client_name=None, client_version=None, allow_version_hack=None, global_request_id=None, min_version=None, max_version=None, default_microversion=None, status_code_retries=None, retriable_status_codes=None, raise_exc=None, rate_limit=None, concurrency=None, connect_retry_delay=None, status_code_retry_delay=None)
- Bases: object
An instance of a session with local variables.
A session is a global object that is shared around amongst many clients. It therefore contains state that is relevant to everyone. There is a lot of state such as the service type and region_name that are only relevant to a particular client that is using the session. An adapter provides a wrapper of client local data around the global session object.
version, min_version, max_version and default_microversion can all be given either as a string or a tuple.
- Parameters
- session (keystoneauth1.session.Session) -- The session object to wrap.
- service_type (str) -- The default service_type for URL discovery.
- service_name (str) -- The default service_name for URL discovery.
- interface (str) -- The default interface for URL discovery.
- region_name (str) -- The default region_name for URL discovery.
- endpoint_override (str) -- Always use this endpoint URL for requests for this client.
- version -- The minimum version restricted to a given Major API. Mutually exclusive with min_version and max_version. (optional)
- auth (keystoneauth1.plugin.BaseAuthPlugin) -- An auth plugin to use instead of the session one.
- user_agent (str) -- The User-Agent string to set.
- connect_retries (int) -- The maximum number of retries that should be attempted for connection errors. Default None - use session default which is don't retry.
- logger (logging.Logger) -- A logging object to use for requests that pass through this adapter.
- allow (dict) -- Extra filters to pass when discovering API versions. (optional)
- additional_headers (dict) -- Additional headers that should be attached to every request passing through the adapter. Headers of the same name specified per request will take priority.
- client_name (str) -- The name of the client that created the adapter. This will be used to create the user_agent.
- client_version (str) -- The version of the client that created the adapter. This will be used to create the user_agent.
- allow_version_hack (bool) -- Allow keystoneauth to hack up catalog URLS to support older schemes. (optional, default True)
- global_request_id (str) -- A global_request_id (in the form of req-$uuid) that will be passed on all requests. Enables cross project request id tracking.
- min_version -- The minimum major version of a given API, intended to be used as the lower bound of a range with max_version. Mutually exclusive with version. If min_version is given with no max_version it is as if max version is 'latest'. (optional)
- max_version -- The maximum major version of a given API, intended to be used as the upper bound of a range with min_version. Mutually exclusive with version. (optional)
- default_microversion -- The default microversion value to send with API requests. While microversions are a per-request feature, a user may know they want to default to sending a specific value. (optional)
- status_code_retries (int) -- The maximum number of retries that should be attempted for retriable HTTP status codes (optional, defaults to 0 - never retry).
- retriable_status_codes (list) -- List of HTTP status codes that should be retried (optional, defaults to HTTP 503, has no effect when status_code_retries is 0).
- raise_exc (bool) -- If True, requests returning failing HTTP responses will raise an exception; if False, the response is returned. This can be overridden on a per-request basis via the kwarg of the same name.
- rate_limit (float) -- A client-side rate limit to impose on requests made through this adapter in requests per second. For instance, a rate_limit of 2 means to allow no more than 2 requests per second, and a rate_limit of 0.5 means to allow no more than 1 request every two seconds. (optional, defaults to None, which means no rate limiting will be applied).
- concurrency (int) -- How many simultaneous http requests this Adapter can be used for. (optional, defaults to None, which means no limit).
- connect_retry_delay (float) -- Delay (in seconds) between two connect retries (if enabled). By default exponential retry starting with 0.5 seconds up to a maximum of 60 seconds is used.
- status_code_retry_delay (float) -- Delay (in seconds) between two status code retries (if enabled). By default exponential retry starting with 0.5 seconds up to a maximum of 60 seconds is used.
- client_name = None
- client_version = None
- delete(url, **kwargs)
- get(url, **kwargs)
- get_all_version_data(interface='public', region_name=None)
- Get data about all versions of a service.
- Parameters
- interface -- Type of endpoint to get version data for. Can be a single value or a list of values. A value of None indicates that all interfaces should be queried. (optional, defaults to public)
- region_name (string) -- Region of endpoints to get version data for. A valueof None indicates that all regions should be queried. (optional, defaults to None)
- Returns
- A dictionary keyed by region_name with values containing dictionaries keyed by interface with values being a list of VersionData.
- get_api_major_version(auth=None, **kwargs)
- Get the major API version as provided by the auth plugin.
- Parameters
- auth (keystoneauth1.plugin.BaseAuthPlugin) -- The auth plugin to use for token. Overrides the plugin on the session. (optional)
- Raises
- keystoneauth1.exceptions.auth_plugins.MissingAuthPlugin -- if a plugin is not available.
- Returns
- The major version of the API of the service discovered.
- Return type
- tuple or None
- get_endpoint(auth=None, **kwargs)
- Get an endpoint as provided by the auth plugin.
- Parameters
- auth (keystoneauth1.plugin.BaseAuthPlugin) -- The auth plugin to use for token. Overrides the plugin on the session. (optional)
- Raises
- keystoneauth1.exceptions.auth_plugins.MissingAuthPlugin -- if a plugin is not available.
- Returns
- An endpoint if available or None.
- Return type
- str
- get_endpoint_data(auth=None)
- Get the endpoint data for this Adapter's endpoint.
- Parameters
- auth (keystoneauth1.plugin.BaseAuthPlugin) -- The auth plugin to use for token. Overrides the plugin on the session. (optional)
- Raises
- keystoneauth1.exceptions.auth_plugins.MissingAuthPlugin -- if a plugin is not available.
- TypeError -- If arguments are invalid
- Returns
- Endpoint data if available or None.
- Return type
- keystoneauth1.discover.EndpointData
- get_project_id(auth=None)
- Return the authenticated project_id as provided by the auth plugin.
- Parameters
- auth (keystoneauth1.plugin.BaseAuthPlugin) -- The auth plugin to use for token. Overrides the plugin on the session. (optional)
- Raises
- keystoneauth1.exceptions.auth.AuthorizationFailure -- if a new token fetch fails.
- keystoneauth1.exceptions.auth_plugins.MissingAuthPlugin -- if a plugin is not available.
- Returns
- Current project_id or None if not supported by plugin.
- Return type
- str
- get_token(auth=None)
- Return a token as provided by the auth plugin.
- Parameters
- auth (keystoneauth1.plugin.BaseAuthPlugin) -- The auth plugin to use for token. Overrides the plugin on the session. (optional)
- Raises
- keystoneauth1.exceptions.auth.AuthorizationFailure -- if a new token fetch fails.
- Returns
- A valid token.
- Return type
- str
- get_user_id(auth=None)
- Return the authenticated user_id as provided by the auth plugin.
- Parameters
- auth (keystoneauth1.plugin.BaseAuthPlugin) -- The auth plugin to use for token. Overrides the plugin on the session. (optional)
- Raises
- keystoneauth1.exceptions.auth.AuthorizationFailure -- if a new token fetch fails.
- keystoneauth1.exceptions.auth_plugins.MissingAuthPlugin -- if a plugin is not available.
- Returns
- Current user_id or None if not supported by plugin.
- Return type
- str
- head(url, **kwargs)
- invalidate(auth=None)
- Invalidate an authentication plugin.
- patch(url, **kwargs)
- post(url, **kwargs)
- put(url, **kwargs)
- classmethod register_argparse_arguments(parser, service_type=None)
- Attach arguments to a given argparse Parser for Adapters.
- Parameters
- parser (argparse.ArgumentParser) -- The argparse parser to attach options to.
- service_type (str) -- Default service_type value. (optional)
- classmethod register_service_argparse_arguments(parser, service_type)
- Attach arguments to a given argparse Parser for Adapters.
- Parameters
- parser (argparse.ArgumentParser) -- The argparse parser to attach options to.
- service_type (str) -- Name of a service to generate additional arguments for.
- request(url, method, **kwargs)
- class keystoneauth1.adapter.LegacyJsonAdapter(session, service_type=None, service_name=None, interface=None, region_name=None, endpoint_override=None, version=None, auth=None, user_agent=None, connect_retries=None, logger=None, allow=None, additional_headers=None, client_name=None, client_version=None, allow_version_hack=None, global_request_id=None, min_version=None, max_version=None, default_microversion=None, status_code_retries=None, retriable_status_codes=None, raise_exc=None, rate_limit=None, concurrency=None, connect_retry_delay=None, status_code_retry_delay=None)
- Bases: Adapter
Make something that looks like an old HTTPClient.
A common case when using an adapter is that we want an interface similar to the HTTPClients of old which returned the body as JSON as well.
You probably don't want this if you are starting from scratch.
- request(*args, **kwargs)
- keystoneauth1.adapter.register_adapter_argparse_arguments(*args, **kwargs)
- keystoneauth1.adapter.register_service_adapter_argparse_arguments(*args, **kwargs)
keystoneauth1.discover module
The passive components to version discovery.
The Discover object in discover.py contains functions that can create objects on your behalf. These functions are not usable from within the keystoneauth1 library because you will get dependency resolution issues.
The Discover object in this file provides the querying components of Discovery. This includes functions like url_for which allow you to retrieve URLs and the raw data specified in version discovery responses.
- class keystoneauth1.discover.Discover(session, url, authenticated=None)
- Bases: object
- CURRENT_STATUSES = ('stable', 'current', 'supported')
- DEPRECATED_STATUSES = ('deprecated',)
- EXPERIMENTAL_STATUSES = ('experimental',)
- data_for(version, **kwargs)
- Return endpoint data for a version.
- NOTE: This method raises a TypeError if version is None. It is
- kept for backwards compatability. New code should use versioned_data_for instead.
- Parameters
- version (tuple) -- The version is always a minimum version in the same major release as there should be no compatibility issues with using a version newer than the one asked for.
- Returns
- the endpoint data for a URL that matches the required version (the format is described in version_data) or None if no match.
- Return type
- dict
- raw_version_data(allow_experimental=False, allow_deprecated=True, allow_unknown=False)
- Get raw version information from URL.
Raw data indicates that only minimal validation processing is performed on the data, so what is returned here will be the data in the same format it was received from the endpoint.
- Parameters
- allow_experimental (bool) -- Allow experimental version endpoints.
- allow_deprecated (bool) -- Allow deprecated version endpoints.
- allow_unknown (bool) -- Allow endpoints with an unrecognised status.
- Returns
- The endpoints returned from the server that match the criteria.
- Return type
- list
- url_for(version, **kwargs)
- Get the endpoint url for a version.
- NOTE: This method raises a TypeError if version is None. It is
- kept for backwards compatability. New code should use versioned_url_for instead.
- Parameters
- version (tuple) -- The version is always a minimum version in the same major release as there should be no compatibility issues with using a version newer than the one asked for.
- Returns
- The url for the specified version or None if no match.
- Return type
- str
- version_data(reverse=False, **kwargs)
- Get normalized version data.
Return version data in a structured way.
- Parameters
- reverse (bool) -- Reverse the list. reverse=true will mean the returned list is sorted from newest to oldest version.
- Returns
- A list of VersionData sorted by version number.
- Return type
- list(VersionData)
- version_string_data(reverse=False, **kwargs)
- Get normalized version data with versions as strings.
Return version data in a structured way.
- Parameters
- reverse (bool) -- Reverse the list. reverse=true will mean the returned list is sorted from newest to oldest version.
- Returns
- A list of VersionData sorted by version number.
- Return type
- list(VersionData)
- versioned_data_for(url=None, min_version=None, max_version=None, **kwargs)
- Return endpoint data for the service at a url.
min_version and max_version can be given either as strings or tuples.
- Parameters
- url (string) -- If url is given, the data will be returned for the endpoint data that has a self link matching the url.
- min_version -- The minimum endpoint version that is acceptable. If min_version is given with no max_version it is as if max version is 'latest'. If min_version is 'latest', max_version may only be 'latest' or None.
- max_version -- The maximum endpoint version that is acceptable. If min_version is given with no max_version it is as if max version is 'latest'. If min_version is 'latest', max_version may only be 'latest' or None.
- Returns
- the endpoint data for a URL that matches the required version (the format is described in version_data) or None if no match.
- Return type
- dict
- versioned_url_for(min_version=None, max_version=None, **kwargs)
- Get the endpoint url for a version.
min_version and max_version can be given either as strings or tuples.
- Parameters
- min_version -- The minimum version that is acceptable. If min_version is given with no max_version it is as if max version is 'latest'.
- max_version -- The maximum version that is acceptable. If min_version is given with no max_version it is as if max version is 'latest'.
- Returns
- The url for the specified version or None if no match.
- Return type
- str
- class keystoneauth1.discover.EndpointData(catalog_url=None, service_url=None, service_type=None, service_name=None, service_id=None, region_name=None, interface=None, endpoint_id=None, raw_endpoint=None, api_version=None, major_version=None, min_microversion=None, max_microversion=None, next_min_version=None, not_before=None, status=None)
- Bases: object
Normalized information about a discovered endpoint.
Contains url, version, microversion, interface and region information. This is essentially the data contained in the catalog and the version discovery documents about an endpoint that is used to select the endpoint desired by the user. It is returned so that a user can know which qualities a discovered endpoint had, in case their request allowed for a range of possibilities.
- get_all_version_string_data(session, project_id=None)
- Return version data for all versions discovery can find.
- Parameters
- project_id (string) -- ID of the currently scoped project. Used for removing project_id components of URLs from the catalog. (optional)
- Returns
- A list of VersionData sorted by version number.
- Return type
- list(VersionData)
- get_current_versioned_data(session, allow=None, cache=None, project_id=None)
- Run version discovery on the current endpoint.
A simplified version of get_versioned_data, get_current_versioned_data runs discovery but only on the endpoint that has been found already.
It can be useful in some workflows where the user wants version information about the endpoint they have.
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- allow (dict) -- Extra filters to pass when discovering API versions. (optional)
- cache (dict) -- A dict to be used for caching results in addition to caching them on the Session. (optional)
- project_id (string) -- ID of the currently scoped project. Used for removing project_id components of URLs from the catalog. (optional)
- Returns
- A new EndpointData with the requested versioned data.
- Return type
- keystoneauth1.discover.EndpointData
- Raises
- keystoneauth1.exceptions.discovery.DiscoveryFailure -- If the appropriate versioned data could not be discovered.
- get_versioned_data(session, allow=None, cache=None, allow_version_hack=True, project_id=None, discover_versions=True, min_version=None, max_version=None)
- Run version discovery for the service described.
Performs Version Discovery and returns a new EndpointData object with information found.
min_version and max_version can be given either as strings or tuples.
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- allow (dict) -- Extra filters to pass when discovering API versions. (optional)
- cache (dict) -- A dict to be used for caching results in addition to caching them on the Session. (optional)
- allow_version_hack (bool) -- Allow keystoneauth to hack up catalog URLS to support older schemes. (optional, default True)
- project_id (string) -- ID of the currently scoped project. Used for removing project_id components of URLs from the catalog. (optional)
- discover_versions (bool) -- Whether to get version metadata from the version discovery document even if it's not neccessary to fulfill the major version request. (optional, defaults to True)
- min_version -- The minimum version that is acceptable. If min_version is given with no max_version it is as if max version is 'latest'.
- max_version -- The maximum version that is acceptable. If min_version is given with no max_version it is as if max version is 'latest'.
- Returns
- A new EndpointData with the requested versioned data.
- Return type
- keystoneauth1.discover.EndpointData
- Raises
- keystoneauth1.exceptions.discovery.DiscoveryFailure -- If the appropriate versioned data could not be discovered.
- property url
- class keystoneauth1.discover.Status
- Bases: object
- CURRENT = 'CURRENT'
- DEPRECATED = 'DEPRECATED'
- EXPERIMENTAL = 'EXPERIMENTAL'
- KNOWN = ('CURRENT', 'SUPPORTED', 'DEPRECATED', 'EXPERIMENTAL')
- SUPPORTED = 'SUPPORTED'
- UNKNOWN = 'UNKNOWN'
- classmethod normalize(raw_status)
- Turn a status into a canonical status value.
If the status from the version discovery document does not match one of the known values, it will be set to 'UNKNOWN'.
- Parameters
- raw_status (str) -- Status value from a discovery document.
- Returns
- A canonicalized version of the status. Valid values are CURRENT, SUPPORTED, DEPRECATED, EXPERIMENTAL and UNKNOWN
- Return type
- str
- class keystoneauth1.discover.VersionData(version, url, collection=None, max_microversion=None, min_microversion=None, next_min_version=None, not_before=None, status='CURRENT', raw_status=None)
- Bases: dict
Normalized Version Data about an endpoint.
- property collection
- The URL for the discovery document.
May be None.
- property max_microversion
- The maximum microversion supported by the endpoint.
May be None.
- property min_microversion
- The minimum microversion supported by the endpoint.
May be None.
- property raw_status
- The status as provided by the server.
- property status
- A canonicalized version of the status.
Valid values are CURRENT, SUPPORTED, DEPRECATED and EXPERIMENTAL.
- property url
- The url for the endpoint.
- property version
- The normalized version of the endpoint.
- keystoneauth1.discover.add_catalog_discover_hack(service_type, old, new)
- Add a version removal rule for a particular service.
Originally deployments of OpenStack would contain a versioned endpoint in the catalog for different services. E.g. an identity service might look like http://localhost:5000/v2.0. This is a problem when we want to use a different version like v3.0 as there is no way to tell where it is located. We cannot simply change all service catalogs either so there must be a way to handle the older style of catalog.
This function adds a rule for a given service type that if part of the URL matches a given regular expression in old then it will be replaced with the new value. This will replace all instances of old with new. It should therefore contain a regex anchor.
For example the included rule states:
add_catalog_version_hack('identity', re.compile('/v2.0/?$'), '/')
so if the catalog retrieves an identity URL that ends with /v2.0 or /v2.0/ then it should replace it simply with / to fix the user's catalog.
- Parameters
- service_type (str) -- The service type as defined in the catalog that the rule will apply to.
- old (re.RegexObject) -- The regular expression to search for and replace if found.
- new (str) -- The new string to replace the pattern with.
- keystoneauth1.discover.get_discovery(session, url, cache=None, authenticated=False)
- Return the discovery object for a URL.
Check the session and the plugin cache to see if we have already performed discovery on the URL and if so return it, otherwise create a new discovery object, cache it and return it.
NOTE: This function is expected to be used by keystoneauth and should not be needed by users part of normal usage. A normal user should use get_endpoint or get_endpoint_data on keystoneauth.session.Session or endpoint_filters on keystoneauth.session.Session or keystoneauth.session.Session. However, should the user need to perform direct discovery for some reason, this function should be used so that the discovery caching is used.
- Parameters
- session (keystoneauth1.session.Session) -- A session object to discover with.
- url (str) -- The url to lookup.
- cache (dict) -- A dict to be used for caching results, in addition to caching them on the Session. (optional) Defaults to None.
- authenticated (bool) -- Include a token in the discovery call. (optional) Defaults to None, which will use a token if an auth plugin is installed.
- Raises
- keystoneauth1.exceptions.discovery.DiscoveryFailure -- if for some reason the lookup fails.
- keystoneauth1.exceptions.http.HttpError -- An error from an invalid HTTP response.
- Returns
- A discovery object with the results of looking up that URL.
- Return type
- keystoneauth1.discover.Discovery
- keystoneauth1.discover.get_version_data(session, url, authenticated=None, version_header=None)
- Retrieve raw version data from a url.
The return is a list of dicts of the form:
[{
'status': 'STABLE',
'id': 'v2.3',
'links': [
{
'href': 'http://network.example.com/v2.3',
'rel': 'self',
},
{
'href': 'http://network.example.com/',
'rel': 'collection',
},
],
'min_version': '2.0',
'max_version': '2.7',
},
...,
]
Note: The maximum microversion may be specified by max_version or version, the former superseding the latter. All *version keys are optional. Other keys and 'links' entries are permitted, but ignored.
- Parameters
- session (keystoneauth1.session.Session) -- A Session object that can be used for communication.
- url (string) -- Endpoint or discovery URL from which to retrieve data.
- authenticated (bool) -- Include a token in the discovery call. (optional) Defaults to None.
- version_header (string) -- provide the OpenStack-API-Version header for services which don't return version information without it, for backward compatibility.
- Returns
- A list of dicts containing version information.
- Return type
- list(dict)
- keystoneauth1.discover.normalize_version_number(version)
- Turn a version representation into a tuple.
Examples:
The following all produce a return value of (1, 0):
1, '1', 'v1', [1], (1,), ['1'], 1.0, '1.0', 'v1.0', (1, 0)
The following all produce a return value of (1, 20, 3):
'v1.20.3', '1.20.3', (1, 20, 3), ['1', '20', '3']
The following all produce a return value of (LATEST, LATEST):
'latest', 'vlatest', ('latest', 'latest'), (LATEST, LATEST)
The following all produce a return value of (2, LATEST):
'2.latest', 'v2.latest', (2, LATEST), ('2', 'latest')
- Parameters
- version -- A version specifier in any of the following forms: String, possibly prefixed with 'v', containing one or more numbers or the string 'latest', separated by periods. Examples: 'v1', 'v1.2', '1.2.3', '123', 'latest', '1.latest', 'v1.latest'. Integer. This will be assumed to be the major version, with a minor version of 0. Float. The integer part is assumed to be the major version; the decimal part the minor version. Non-string iterable comprising integers, integer strings, the string 'latest', or the special value LATEST. Examples: (1,), [1, 2], ('12', '34', '56'), (LATEST,), (2, 'latest')
- Returns
- A tuple of len >= 2 comprising integers and/or LATEST.
- Raises
- TypeError -- If the input version cannot be interpreted.
- keystoneauth1.discover.version_between(min_version, max_version, candidate)
- Determine whether a candidate version is within a specified range.
- Parameters
- min_version -- The minimum version that is acceptable. None/empty indicates no lower bound.
- max_version -- The maximum version that is acceptable. None/empty indicates no upper bound.
- candidate -- Candidate version to test. May not be None/empty.
- Returns
- True if candidate is between min_version and max_version; False otherwise.
- Raises
- ValueError -- If candidate is None.
- TypeError -- If any input cannot be normalized.
- keystoneauth1.discover.version_match(required, candidate)
- Test that an available version satisfies the required version.
To be suitable a version must be of the same major version as required and be at least a match in minor/patch level.
eg. 3.3 is a match for a required 3.1 but 4.1 is not.
- Parameters
- required (tuple) -- the version that must be met.
- candidate (tuple) -- the version to test against required.
- Returns
- True if candidate is suitable False otherwise.
- Return type
- bool
- keystoneauth1.discover.version_to_string(version)
- Turn a version tuple into a string.
- Parameters
- version (tuple) -- A version represented as a tuple of ints. As a special case, a tuple member may be LATEST, which translates to 'latest'.
- Returns
- A version represented as a period-delimited string.
keystoneauth1.http_basic module
- class keystoneauth1.http_basic.HTTPBasicAuth(endpoint=None, username=None, password=None)
- Bases: FixedEndpointPlugin
A provider that will always use HTTP Basic authentication.
This is useful to unify session/adapter loading for services that might be deployed in standalone mode.
- get_headers(session, **kwargs)
- Fetch authentication headers for message.
This is a more generalized replacement of the older get_token to allow plugins to specify different or additional authentication headers to the OpenStack standard 'X-Auth-Token' header.
How the authentication headers are obtained is up to the plugin. If the headers are still valid they may be re-used, retrieved from cache or the plugin may invoke an authentication request against a server.
The default implementation of get_headers calls the get_token method to enable older style plugins to continue functioning unchanged. Subclasses should feel free to completely override this function to provide the headers that they want.
There are no required kwargs. They are passed directly to the auth plugin and they are implementation specific.
Returning None will indicate that no token was able to be retrieved and that authorization was a failure. Adding no authentication data can be achieved by returning an empty dictionary.
- Parameters
- session (keystoneauth1.session.Session) -- The session object that the auth_plugin belongs to.
- Returns
- Headers that are set to authenticate a message or None for failure. Note that when checking this value that the empty dict is a valid, non-failure response.
- Return type
- dict
- get_token(session, **kwargs)
- Obtain a token.
How the token is obtained is up to the plugin. If it is still valid it may be re-used, retrieved from cache or invoke an authentication request against a server.
There are no required kwargs. They are passed directly to the auth plugin and they are implementation specific.
Returning None will indicate that no token was able to be retrieved.
This function is misplaced as it should only be required for auth plugins that use the 'X-Auth-Token' header. However due to the way plugins evolved this method is required and often called to trigger an authentication request on a new plugin.
When implementing a new plugin it is advised that you implement this method, however if you don't require the 'X-Auth-Token' header override the get_headers method instead.
- Parameters
- session (keystoneauth1.session.Session) -- A session object so the plugin can make HTTP calls.
- Returns
- A token to use.
- Return type
- string
keystoneauth1.noauth module
- class keystoneauth1.noauth.NoAuth(endpoint=None)
- Bases: FixedEndpointPlugin
A provider that will always use no auth.
This is useful to unify session/adapter loading for services that might be deployed in standalone/noauth mode.
- get_token(session, **kwargs)
- Obtain a token.
How the token is obtained is up to the plugin. If it is still valid it may be re-used, retrieved from cache or invoke an authentication request against a server.
There are no required kwargs. They are passed directly to the auth plugin and they are implementation specific.
Returning None will indicate that no token was able to be retrieved.
This function is misplaced as it should only be required for auth plugins that use the 'X-Auth-Token' header. However due to the way plugins evolved this method is required and often called to trigger an authentication request on a new plugin.
When implementing a new plugin it is advised that you implement this method, however if you don't require the 'X-Auth-Token' header override the get_headers method instead.
- Parameters
- session (keystoneauth1.session.Session) -- A session object so the plugin can make HTTP calls.
- Returns
- A token to use.
- Return type
- string
keystoneauth1.plugin module
- class keystoneauth1.plugin.BaseAuthPlugin
- Bases: object
The basic structure of an authentication plugin.
NOTE:
- get_api_major_version(session, endpoint_override=None, **kwargs)
- Get the major API version from the endpoint.
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- endpoint_override (str) -- URL to use for version discovery.
- kwargs -- Ignored.
- Raises
- keystoneauth1.exceptions.http.HttpError -- An error from an invalid HTTP response.
- Returns
- Valid EndpointData or None if not available.
- Return type
- keystoneauth1.discover.EndpointData or None
- get_auth_ref(session, **kwargs)
- Return the authentication reference of an auth plugin.
There are no required kwargs. They are passed directly to the auth plugin and they are implementation specific.
- Parameters
- session (keystoneauth1.session.session) -- A session object to be used for communication
- get_auth_state()
- Retrieve the current authentication state for the plugin.
Retrieve any internal state that represents the authenticated plugin.
This should not fetch any new data if it is not present.
- Raises
- NotImplementedError -- if the plugin does not support this feature.
- Returns
- raw python data (which can be JSON serialized) that can be moved into another plugin (of the same type) to have the same authenticated state.
- Return type
- object or None if unauthenticated.
- get_cache_id()
- Fetch an identifier that uniquely identifies the auth options.
The returned identifier need not be decomposable or otherwise provide anyway to recreate the plugin. It should not contain sensitive data in plaintext.
This string MUST change if any of the parameters that are used to uniquely identity this plugin change.
If get_cache_id returns a str value suggesting that caching is supported then get_auth_cache and set_auth_cache must also be implemented.
- Returns
- A unique string for the set of options
- Return type
- str or None if this is unsupported or unavailable.
- get_connection_params(session, **kwargs)
- Return any additional connection parameters required for the plugin.
- Parameters
- session (keystoneauth1.session.Session) -- The session object that the auth_plugin belongs to.
- Returns
- Headers that are set to authenticate a message or None for failure. Note that when checking this value that the empty dict is a valid, non-failure response.
- Return type
- dict
- get_endpoint(session, **kwargs)
- Return an endpoint for the client.
There are no required keyword arguments to get_endpoint as a plugin implementation should use best effort with the information available to determine the endpoint. However there are certain standard options that will be generated by the clients and should be used by plugins:
- service_type: what sort of service is required.
- service_name: the name of the service in the catalog.
- interface: what visibility the endpoint should have.
- region_name: the region the endpoint exists in.
- Parameters
- session (keystoneauth1.session.Session) -- The session object that the auth_plugin belongs to.
- Returns
- The base URL that will be used to talk to the required service or None if not available.
- Return type
- string
- get_endpoint_data(session, endpoint_override=None, discover_versions=True, **kwargs)
- Return a valid endpoint data for a the service.
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- endpoint_override (str) -- URL to use for version discovery.
- discover_versions (bool) -- Whether to get version metadata from the version discovery document even if it major api version info can be inferred from the url. (optional, defaults to True)
- kwargs -- Ignored.
- Raises
- keystoneauth1.exceptions.http.HttpError -- An error from an invalid HTTP response.
- Returns
- Valid EndpointData or None if not available.
- Return type
- keystoneauth1.discover.EndpointData or None
- get_headers(session, **kwargs)
- Fetch authentication headers for message.
This is a more generalized replacement of the older get_token to allow plugins to specify different or additional authentication headers to the OpenStack standard 'X-Auth-Token' header.
How the authentication headers are obtained is up to the plugin. If the headers are still valid they may be re-used, retrieved from cache or the plugin may invoke an authentication request against a server.
The default implementation of get_headers calls the get_token method to enable older style plugins to continue functioning unchanged. Subclasses should feel free to completely override this function to provide the headers that they want.
There are no required kwargs. They are passed directly to the auth plugin and they are implementation specific.
Returning None will indicate that no token was able to be retrieved and that authorization was a failure. Adding no authentication data can be achieved by returning an empty dictionary.
- Parameters
- session (keystoneauth1.session.Session) -- The session object that the auth_plugin belongs to.
- Returns
- Headers that are set to authenticate a message or None for failure. Note that when checking this value that the empty dict is a valid, non-failure response.
- Return type
- dict
- get_project_id(session, **kwargs)
- Return the project id that we are authenticated to.
Wherever possible the project id should be inferred from the token however there are certain URLs and other places that require access to the currently authenticated project id.
- Parameters
- session (keystoneauth1.session.Session) -- A session object so the plugin can make HTTP calls.
- Returns
- A project identifier or None if one is not available.
- Return type
- str
- get_sp_auth_url(session, sp_id, **kwargs)
- Return auth_url from the Service Provider object.
This url is used for obtaining unscoped federated token from remote cloud.
- Parameters
- sp_id (string) -- ID of the Service Provider to be queried.
- Returns
- A Service Provider auth_url or None if one is not available.
- Return type
- str
- get_sp_url(session, sp_id, **kwargs)
- Return sp_url from the Service Provider object.
This url is used for passing SAML2 assertion to the remote cloud.
- Parameters
- sp_id (str) -- ID of the Service Provider to be queried.
- Returns
- A Service Provider sp_url or None if one is not available.
- Return type
- str
- get_token(session, **kwargs)
- Obtain a token.
How the token is obtained is up to the plugin. If it is still valid it may be re-used, retrieved from cache or invoke an authentication request against a server.
There are no required kwargs. They are passed directly to the auth plugin and they are implementation specific.
Returning None will indicate that no token was able to be retrieved.
This function is misplaced as it should only be required for auth plugins that use the 'X-Auth-Token' header. However due to the way plugins evolved this method is required and often called to trigger an authentication request on a new plugin.
When implementing a new plugin it is advised that you implement this method, however if you don't require the 'X-Auth-Token' header override the get_headers method instead.
- Parameters
- session (keystoneauth1.session.Session) -- A session object so the plugin can make HTTP calls.
- Returns
- A token to use.
- Return type
- string
- get_user_id(session, **kwargs)
- Return a unique user identifier of the plugin.
Wherever possible the user id should be inferred from the token however there are certain URLs and other places that require access to the currently authenticated user id.
- Parameters
- session (keystoneauth1.session.Session) -- A session object so the plugin can make HTTP calls.
- Returns
- A user identifier or None if one is not available.
- Return type
- str
- invalidate()
- Invalidate the current authentication data.
This should result in fetching a new token on next call.
A plugin may be invalidated if an Unauthorized HTTP response is returned to indicate that the token may have been revoked or is otherwise now invalid.
- Returns
- True if there was something that the plugin did to invalidate. This means that it makes sense to try again. If nothing happens returns False to indicate give up.
- Return type
- bool
- set_auth_state(data)
- Install existing authentication state for a plugin.
Take the output of get_auth_state and install that authentication state into the current authentication plugin.
- Raises
- NotImplementedError -- if the plugin does not support this feature.
- class keystoneauth1.plugin.FixedEndpointPlugin(endpoint=None)
- Bases: BaseAuthPlugin
A base class for plugins that have one fixed endpoint.
- get_endpoint(session, **kwargs)
- Return the supplied endpoint.
Using this plugin the same endpoint is returned regardless of the parameters passed to the plugin. endpoint_override overrides the endpoint specified when constructing the plugin.
- get_endpoint_data(session, endpoint_override=None, discover_versions=True, **kwargs)
- Return a valid endpoint data for a the service.
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- endpoint_override (str) -- URL to use for version discovery.
- discover_versions (bool) -- Whether to get version metadata from the version discovery document even if it major api version info can be inferred from the url. (optional, defaults to True)
- kwargs -- Ignored.
- Raises
- keystoneauth1.exceptions.http.HttpError -- An error from an invalid HTTP response.
- Returns
- Valid EndpointData or None if not available.
- Return type
- keystoneauth1.discover.EndpointData or None
keystoneauth1.service_token module
- class keystoneauth1.service_token.ServiceTokenAuthWrapper(user_auth, service_auth)
- Bases: BaseAuthPlugin
- get_connection_params(*args, **kwargs)
- Return any additional connection parameters required for the plugin.
- Parameters
- session (keystoneauth1.session.Session) -- The session object that the auth_plugin belongs to.
- Returns
- Headers that are set to authenticate a message or None for failure. Note that when checking this value that the empty dict is a valid, non-failure response.
- Return type
- dict
- get_endpoint(*args, **kwargs)
- Return an endpoint for the client.
There are no required keyword arguments to get_endpoint as a plugin implementation should use best effort with the information available to determine the endpoint. However there are certain standard options that will be generated by the clients and should be used by plugins:
- service_type: what sort of service is required.
- service_name: the name of the service in the catalog.
- interface: what visibility the endpoint should have.
- region_name: the region the endpoint exists in.
- Parameters
- session (keystoneauth1.session.Session) -- The session object that the auth_plugin belongs to.
- Returns
- The base URL that will be used to talk to the required service or None if not available.
- Return type
- string
- get_headers(session, **kwargs)
- Fetch authentication headers for message.
This is a more generalized replacement of the older get_token to allow plugins to specify different or additional authentication headers to the OpenStack standard 'X-Auth-Token' header.
How the authentication headers are obtained is up to the plugin. If the headers are still valid they may be re-used, retrieved from cache or the plugin may invoke an authentication request against a server.
The default implementation of get_headers calls the get_token method to enable older style plugins to continue functioning unchanged. Subclasses should feel free to completely override this function to provide the headers that they want.
There are no required kwargs. They are passed directly to the auth plugin and they are implementation specific.
Returning None will indicate that no token was able to be retrieved and that authorization was a failure. Adding no authentication data can be achieved by returning an empty dictionary.
- Parameters
- session (keystoneauth1.session.Session) -- The session object that the auth_plugin belongs to.
- Returns
- Headers that are set to authenticate a message or None for failure. Note that when checking this value that the empty dict is a valid, non-failure response.
- Return type
- dict
- get_project_id(*args, **kwargs)
- Return the project id that we are authenticated to.
Wherever possible the project id should be inferred from the token however there are certain URLs and other places that require access to the currently authenticated project id.
- Parameters
- session (keystoneauth1.session.Session) -- A session object so the plugin can make HTTP calls.
- Returns
- A project identifier or None if one is not available.
- Return type
- str
- get_sp_auth_url(*args, **kwargs)
- Return auth_url from the Service Provider object.
This url is used for obtaining unscoped federated token from remote cloud.
- Parameters
- sp_id (string) -- ID of the Service Provider to be queried.
- Returns
- A Service Provider auth_url or None if one is not available.
- Return type
- str
- get_sp_url(*args, **kwargs)
- Return sp_url from the Service Provider object.
This url is used for passing SAML2 assertion to the remote cloud.
- Parameters
- sp_id (str) -- ID of the Service Provider to be queried.
- Returns
- A Service Provider sp_url or None if one is not available.
- Return type
- str
- get_token(*args, **kwargs)
- Obtain a token.
How the token is obtained is up to the plugin. If it is still valid it may be re-used, retrieved from cache or invoke an authentication request against a server.
There are no required kwargs. They are passed directly to the auth plugin and they are implementation specific.
Returning None will indicate that no token was able to be retrieved.
This function is misplaced as it should only be required for auth plugins that use the 'X-Auth-Token' header. However due to the way plugins evolved this method is required and often called to trigger an authentication request on a new plugin.
When implementing a new plugin it is advised that you implement this method, however if you don't require the 'X-Auth-Token' header override the get_headers method instead.
- Parameters
- session (keystoneauth1.session.Session) -- A session object so the plugin can make HTTP calls.
- Returns
- A token to use.
- Return type
- string
- get_user_id(*args, **kwargs)
- Return a unique user identifier of the plugin.
Wherever possible the user id should be inferred from the token however there are certain URLs and other places that require access to the currently authenticated user id.
- Parameters
- session (keystoneauth1.session.Session) -- A session object so the plugin can make HTTP calls.
- Returns
- A user identifier or None if one is not available.
- Return type
- str
- invalidate()
- Invalidate the current authentication data.
This should result in fetching a new token on next call.
A plugin may be invalidated if an Unauthorized HTTP response is returned to indicate that the token may have been revoked or is otherwise now invalid.
- Returns
- True if there was something that the plugin did to invalidate. This means that it makes sense to try again. If nothing happens returns False to indicate give up.
- Return type
- bool
keystoneauth1.session module
- class keystoneauth1.session.NoOpSemaphore
- Bases: object
Empty context manager for use as a default semaphore.
- class keystoneauth1.session.RequestTiming(method, url, elapsed)
- Bases: object
Contains timing information for an HTTP interaction.
- elapsed: timedelta = None
- Elapsed time information
- method = None
- HTTP method used for the call (GET, POST, etc)
- url = None
- URL against which the call was made
- class keystoneauth1.session.Session(auth=None, session=None, original_ip=None, verify=True, cert=None, timeout=None, user_agent=None, redirect=30, additional_headers=None, app_name=None, app_version=None, additional_user_agent=None, discovery_cache=None, split_loggers=None, collect_timing=False, rate_semaphore=None, connect_retries=0)
- Bases: object
Maintains client communication state and common functionality.
As much as possible the parameters to this class reflect and are passed directly to the requests library.
- Parameters
- auth (keystoneauth1.plugin.BaseAuthPlugin) -- An authentication plugin to authenticate the session with. (optional, defaults to None)
- session (requests.Session) -- A requests session object that can be used for issuing requests. (optional)
- original_ip (str) -- The original IP of the requesting user which will be sent to identity service in a 'Forwarded' header. (optional)
- verify -- The verification arguments to pass to requests. These are of the same form as requests expects, so True or False to verify (or not) against system certificates or a path to a bundle or CA certs to check against or None for requests to attempt to locate and use certificates. (optional, defaults to True)
- cert -- A client certificate to pass to requests. These are of the same form as requests expects. Either a single filename containing both the certificate and key or a tuple containing the path to the certificate then a path to the key. (optional)
- timeout (float) -- A timeout to pass to requests. This should be a numerical value indicating some amount (or fraction) of seconds or 0 for no timeout. (optional, defaults to 0)
- user_agent (str) -- A User-Agent header string to use for the request. If not provided, a default of DEFAULT_USER_AGENT is used, which contains the keystoneauth1 version as well as those of the requests library and which Python is being used. When a non-None value is passed, it will be prepended to the default.
- redirect (int/bool) -- Controls the maximum number of redirections that can be followed by a request. Either an integer for a specific count or True/False for forever/never. (optional, default to 30)
- additional_headers (dict) -- Additional headers that should be attached to every request passing through the session. Headers of the same name specified per request will take priority.
- app_name (str) -- The name of the application that is creating the session. This will be used to create the user_agent.
- app_version (str) -- The version of the application creating the session. This will be used to create the user_agent.
- additional_user_agent (list) -- A list of tuple of name, version that will be added to the user agent. This can be used by libraries that are part of the communication process.
- discovery_cache (dict) -- A dict to be used for caching of discovery information. This is normally managed transparently, but if the user wants to share a single cache across multiple sessions that do not share an auth plugin, it can be provided here. (optional, defaults to None which means automatically manage)
- split_loggers (bool) -- Split the logging of requests across multiple loggers instead of just one. Defaults to False.
- collect_timing (bool) -- Whether or not to collect per-method timing information for each API call. (optional, defaults to False)
- rate_semaphore -- Semaphore to be used to control concurrency and rate limiting of requests. (optional, defaults to no concurrency or rate control)
- connect_retries (int) -- the maximum number of retries that should be attempted for connection errors. (optional, defaults to 0 - never retry).
- property adapters
- delete(url, **kwargs)
- Perform a DELETE request.
This calls request() with method set to DELETE.
- get(url, **kwargs)
- Perform a GET request.
This calls request() with method set to GET.
- get_all_version_data(auth=None, interface='public', region_name=None, service_type=None, **kwargs)
- Get version data for all services in the catalog.
- Parameters
- auth (keystoneauth1.plugin.BaseAuthPlugin) -- The auth plugin to use for token. Overrides the plugin on the session. (optional)
- interface -- Type of endpoint to get version data for. Can be a single value or a list of values. A value of None indicates that all interfaces should be queried. (optional, defaults to public)
- region_name (string) -- Region of endpoints to get version data for. A valueof None indicates that all regions should be queried. (optional, defaults to None)
- service_type (string) -- Limit the version data to a single service. (optional, defaults to None)
- Returns
- A dictionary keyed by region_name with values containing dictionaries keyed by interface with values being a list of ~keystoneauth1.discover.VersionData.
- get_api_major_version(auth=None, **kwargs)
- Get the major API version as provided by the auth plugin.
- Parameters
- auth (keystoneauth1.plugin.BaseAuthPlugin) -- The auth plugin to use for token. Overrides the plugin on the session. (optional)
- Raises
- keystoneauth1.exceptions.auth_plugins.MissingAuthPlugin -- if a plugin is not available.
- Returns
- The major version of the API of the service discovered.
- Return type
- tuple or None
- get_auth_connection_params(auth=None, **kwargs)
- Return auth connection params as provided by the auth plugin.
An auth plugin may specify connection parameters to the request like providing a client certificate for communication.
We restrict the values that may be returned from this function to prevent an auth plugin overriding values unrelated to connection parmeters. The values that are currently accepted are:
- cert: a path to a client certificate, or tuple of client certificate and key pair that are used with this request.
- verify: a boolean value to indicate verifying SSL certificates against the system CAs or a path to a CA file to verify with.
These values are passed to the requests library and further information on accepted values may be found there.
- Parameters
- auth (keystoneauth1.plugin.BaseAuthPlugin) -- The auth plugin to use for tokens. Overrides the plugin on the session. (optional)
- Raises
- keystoneauth1.exceptions.auth.AuthorizationFailure -- if a new token fetch fails.
- keystoneauth1.exceptions.auth_plugins.MissingAuthPlugin -- if a plugin is not available.
- keystoneauth1.exceptions.auth_plugins.UnsupportedParameters -- if the plugin returns a parameter that is not supported by this session.
- Returns
- Authentication headers or None for failure.
- Return type
- dict
- get_auth_headers(auth=None, **kwargs)
- Return auth headers as provided by the auth plugin.
- Parameters
- auth (keystoneauth1.plugin.BaseAuthPlugin) -- The auth plugin to use for token. Overrides the plugin on the session. (optional)
- Raises
- keystoneauth1.exceptions.auth.AuthorizationFailure -- if a new token fetch fails.
- keystoneauth1.exceptions.auth_plugins.MissingAuthPlugin -- if a plugin is not available.
- Returns
- Authentication headers or None for failure.
- Return type
- dict
- get_endpoint(auth=None, **kwargs)
- Get an endpoint as provided by the auth plugin.
- Parameters
- auth (keystoneauth1.plugin.BaseAuthPlugin) -- The auth plugin to use for token. Overrides the plugin on the session. (optional)
- Raises
- keystoneauth1.exceptions.auth_plugins.MissingAuthPlugin -- if a plugin is not available.
- Returns
- An endpoint if available or None.
- Return type
- string
- get_endpoint_data(auth=None, **kwargs)
- Get endpoint data as provided by the auth plugin.
- Parameters
- auth (keystoneauth1.plugin.BaseAuthPlugin) -- The auth plugin to use for token. Overrides the plugin on the session. (optional)
- Raises
- keystoneauth1.exceptions.auth_plugins.MissingAuthPlugin -- if a plugin is not available.
- TypeError -- If arguments are invalid
- Returns
- Endpoint data if available or None.
- Return type
- keystoneauth1.discover.EndpointData
- get_project_id(auth=None)
- Return the authenticated project_id as provided by the auth plugin.
- Parameters
- auth (keystoneauth1.plugin.BaseAuthPlugin) -- The auth plugin to use for token. Overrides the plugin on the session. (optional)
- Raises
- keystoneauth1.exceptions.auth.AuthorizationFailure -- if a new token fetch fails.
- keystoneauth1.exceptions.auth_plugins.MissingAuthPlugin -- if a plugin is not available.
- Returns
- Current project_id or None if not supported by plugin.
- Return type
- str
- get_timings()
- Return collected API timing information.
- Returns
- List of RequestTiming objects.
- get_token(auth=None)
- Return a token as provided by the auth plugin.
- Parameters
- auth (keystoneauth1.plugin.BaseAuthPlugin) -- The auth plugin to use for token. Overrides the plugin on the session. (optional)
- Raises
- keystoneauth1.exceptions.auth.AuthorizationFailure -- if a new token fetch fails.
- keystoneauth1.exceptions.auth_plugins.MissingAuthPlugin -- if a plugin is not available.
WARNING:
- Returns
- A valid token.
- Return type
- string
- get_user_id(auth=None)
- Return the authenticated user_id as provided by the auth plugin.
- Parameters
- auth (keystoneauth1.plugin.BaseAuthPlugin) -- The auth plugin to use for token. Overrides the plugin on the session. (optional)
- Raises
- keystoneauth1.exceptions.auth.AuthorizationFailure -- if a new token fetch fails.
- keystoneauth1.exceptions.auth_plugins.MissingAuthPlugin -- if a plugin is not available.
- Returns
- Current user_id or None if not supported by plugin.
- Return type
- str
- head(url, **kwargs)
- Perform a HEAD request.
This calls request() with method set to HEAD.
- invalidate(auth=None)
- Invalidate an authentication plugin.
- Parameters
- auth (keystoneauth1.plugin.BaseAuthPlugin) -- The auth plugin to invalidate. Overrides the plugin on the session. (optional)
- mount(scheme, adapter)
- patch(url, **kwargs)
- Perform a PATCH request.
This calls request() with method set to PATCH.
- post(url, **kwargs)
- Perform a POST request.
This calls request() with method set to POST.
- put(url, **kwargs)
- Perform a PUT request.
This calls request() with method set to PUT.
- request(url, method, json=None, original_ip=None, user_agent=None, redirect=None, authenticated=None, endpoint_filter=None, auth=None, requests_auth=None, raise_exc=True, allow_reauth=True, log=True, endpoint_override=None, connect_retries=None, logger=None, allow=None, client_name=None, client_version=None, microversion=None, microversion_service_type=None, status_code_retries=0, retriable_status_codes=None, rate_semaphore=None, global_request_id=None, connect_retry_delay=None, status_code_retry_delay=None, **kwargs)
- Send an HTTP request with the specified characteristics.
Wrapper around requests.Session.request to handle tasks such as setting headers, JSON encoding/decoding, and error handling.
Arguments that are not handled are passed through to the requests library.
- Parameters
- url (str) -- Path or fully qualified URL of HTTP request. If only a path is provided then endpoint_filter must also be provided such that the base URL can be determined. If a fully qualified URL is provided then endpoint_filter will be ignored.
- method (str) -- The http method to use. (e.g. 'GET', 'POST')
- original_ip (str) -- Mark this request as forwarded for this ip. (optional)
- headers (dict) -- Headers to be included in the request. (optional)
- json -- Some data to be represented as JSON. (optional)
- user_agent (str) -- A user_agent to use for the request. If present will override one present in headers. (optional)
- redirect (int/bool) -- the maximum number of redirections that can be followed by a request. Either an integer for a specific count or True/False for forever/never. (optional)
- connect_retries (int) -- the maximum number of retries that should be attempted for connection errors. (optional, defaults to None - never retry).
- authenticated (bool) -- True if a token should be attached to this request, False if not or None for attach if an auth_plugin is available. (optional, defaults to None)
- endpoint_filter (dict) -- Data to be provided to an auth plugin with which it should be able to determine an endpoint to use for this request. If not provided then URL is expected to be a fully qualified URL. (optional)
- endpoint_override (str) -- The URL to use instead of looking up the endpoint in the auth plugin. This will be ignored if a fully qualified URL is provided but take priority over an endpoint_filter. This string may contain the values %(project_id)s and %(user_id)s to have those values replaced by the project_id/user_id of the current authentication. (optional)
- auth (keystoneauth1.plugin.BaseAuthPlugin) -- The auth plugin to use when authenticating this request. This will override the plugin that is attached to the session (if any). (optional)
- requests_auth (requests.auth.AuthBase) -- A requests library auth plugin that cannot be passed via kwarg because the auth kwarg collides with our own auth plugins. (optional)
- raise_exc (bool) -- If True then raise an appropriate exception for failed HTTP requests. If False then return the request object. (optional, default True)
- allow_reauth (bool) -- Allow fetching a new token and retrying the request on receiving a 401 Unauthorized response. (optional, default True)
- log (bool) -- If True then log the request and response data to the debug log. (optional, default True)
- logger (logging.Logger) -- The logger object to use to log request and responses. If not provided the keystoneauth1.session default logger will be used.
- allow (dict) -- Extra filters to pass when discovering API versions. (optional)
- microversion -- Microversion to send for this request. microversion can be given as a string or a tuple. (optional)
- microversion_service_type (str) -- The service_type to be sent in the microversion header, if a microversion is given. Defaults to the value of service_type from endpoint_filter if one exists. If endpoint_filter is not provided or does not have a service_type, microversion is given and microversion_service_type is not provided, an exception will be raised.
- status_code_retries (int) -- the maximum number of retries that should be attempted for retriable HTTP status codes (optional, defaults to 0 - never retry).
- retriable_status_codes (list) -- list of HTTP status codes that should be retried (optional, defaults to HTTP 503, has no effect when status_code_retries is 0).
- rate_semaphore -- Semaphore to be used to control concurrency and rate limiting of requests. (optional, defaults to no concurrency or rate control)
- global_request_id -- Value for the X-Openstack-Request-Id header.
- connect_retry_delay (float) -- Delay (in seconds) between two connect retries (if enabled). By default exponential retry starting with 0.5 seconds up to a maximum of 60 seconds is used.
- status_code_retry_delay (float) -- Delay (in seconds) between two status code retries (if enabled). By default exponential retry starting with 0.5 seconds up to a maximum of 60 seconds is used.
- kwargs --
any other parameter that can be passed to requests.Session.request() (such as headers). Except:
- data will be overwritten by the data in the json param.
- allow_redirects is ignored as redirects are handled by the session.
- Raises
- keystoneauth1.exceptions.base.ClientException -- For connection failure, or to indicate an error response code.
- Returns
- The response to the request.
- reset_timings()
- Clear API timing information.
- user_agent = None
- class keystoneauth1.session.TCPKeepAliveAdapter(pool_connections=10, pool_maxsize=10, max_retries=0, pool_block=False)
- Bases: HTTPAdapter
The custom adapter used to set TCP Keep-Alive on all connections.
This Adapter also preserves the default behaviour of Requests which disables Nagle's Algorithm. See also: https://blogs.msdn.com/b/windowsazurestorage/archive/2010/06/25/nagle-s-algorithm-is-not-friendly-towards-small-requests.aspx
- init_poolmanager(*args, **kwargs)
- Initializes a urllib3 PoolManager.
This method should not be called from user code, and is only exposed for use when subclassing the HTTPAdapter.
- Parameters
- connections -- The number of urllib3 connection pools to cache.
- maxsize -- The maximum number of connections to save in the pool.
- block -- Block when no free connections are available.
- pool_kwargs -- Extra keyword arguments used to initialize the Pool Manager.
keystoneauth1.token_endpoint module
- class keystoneauth1.token_endpoint.Token(endpoint, token)
- Bases: BaseAuthPlugin
A provider that will always use the given token and endpoint.
This is really only useful for testing and in certain CLI cases where you have a known endpoint and admin token that you want to use.
- get_auth_ref(session, **kwargs)
- Return the authentication reference of an auth plugin.
- Parameters
- session (keystoneauth1.session.session) -- A session object to be used for communication
- get_endpoint(session, **kwargs)
- Return the supplied endpoint.
Using this plugin the same endpoint is returned regardless of the parameters passed to the plugin.
- get_endpoint_data(session, endpoint_override=None, discover_versions=True, **kwargs)
- Return a valid endpoint data for a the service.
- Parameters
- session (keystoneauth1.session.Session) -- A session object that can be used for communication.
- endpoint_override (str) -- URL to use for version discovery other than the endpoint stored in the plugin. (optional, defaults to None)
- discover_versions (bool) -- Whether to get version metadata from the version discovery document even if it major api version info can be inferred from the url. (optional, defaults to True)
- kwargs -- Ignored.
- Raises
- keystoneauth1.exceptions.http.HttpError -- An error from an invalid HTTP response.
- Returns
- Valid EndpointData or None if not available.
- Return type
- keystoneauth1.discover.EndpointData or None
- get_token(session)
- Obtain a token.
How the token is obtained is up to the plugin. If it is still valid it may be re-used, retrieved from cache or invoke an authentication request against a server.
There are no required kwargs. They are passed directly to the auth plugin and they are implementation specific.
Returning None will indicate that no token was able to be retrieved.
This function is misplaced as it should only be required for auth plugins that use the 'X-Auth-Token' header. However due to the way plugins evolved this method is required and often called to trigger an authentication request on a new plugin.
When implementing a new plugin it is advised that you implement this method, however if you don't require the 'X-Auth-Token' header override the get_headers method instead.
- Parameters
- session (keystoneauth1.session.Session) -- A session object so the plugin can make HTTP calls.
- Returns
- A token to use.
- Return type
- string
Module contents
RELEASE NOTES
Release Notes
CONTRIBUTING
Code is hosted on opendev.org. Submit bugs to the Keystone project on Launchpad. Submit code to the openstack/keystoneauth project using Gerrit.
Run tests with tox.
INDICES AND TABLES
- Index
- Module Index
- Search Page
AUTHOR
unknown
COPYRIGHT
OpenStack Contributors
| October 16, 2023 | 5.3.0 |