Bases: object
Add member to the member list.
| Parameters: |
|
|---|---|
| Raises: |
|
Apply filtering to a query.
| Parameters: |
|
|---|---|
| Returns query: | LDAP query, updated with any filters satisfied |
Remove member from the member list.
| Parameters: |
|
|---|---|
| Raises: |
|
Bases: keystone.identity.backends.ldap.common.BaseLdap
Emulates boolean ‘enabled’ attribute if turned on.
Creates a group holding all enabled objects of this class, all missing objects are considered disabled.
Options:
Where ${name}s is the plural of self.options_name (‘users’ or ‘tenants’), ${tree_dn} is self.tree_dn.
Bases: keystone.identity.backends.ldap.common.LDAPHandler
Convert data types and perform logging.
This LDAP interface wraps the python-ldap based interfaces. The python-ldap interfaces require string values encoded in UTF-8. The OpenStack logging framework at the time of this writing is not capable of accepting strings encoded in UTF-8, the log functions will throw decoding errors if a non-ascii character appears in a string.
Prior to the call Python data types are converted to a string representation as required by the LDAP APIs.
Then logging is performed so we can track what is being sent/received from LDAP. Also the logging filters security sensitive items (i.e. passwords).
Then the string values are encoded into UTF-8.
Then the LDAP API entry point is invoked.
Data returned from the LDAP call is converted back from UTF-8 encoded strings into the Python data type used internally in OpenStack.
Bases: object
Abstract class which defines methods for a LDAP API provider.
Native Keystone values cannot be passed directly into and from the python-ldap API. Type conversion must occur at the LDAP API boundary, examples of type conversions are:
- booleans map to the strings ‘TRUE’ and ‘FALSE’
- integer values map to their string representation.
- unicode strings are encoded in UTF-8
In addition to handling type conversions at the API boundary we have the requirement to support more than one LDAP API provider. Currently we have:
- python-ldap, this is the standard LDAP API for Python, it requires access to a live LDAP server.
- Fake LDAP which emulates python-ldap. This is used for testing without requiring a live LDAP server.
To support these requirements we need a layer that performs type conversions and then calls another LDAP API which is configurable (e.g. either python-ldap or the fake emulation).
We have an additional constraint at the time of this writing due to limitations in the logging module. The logging module is not capable of accepting UTF-8 encoded strings, it will throw an encoding exception. Therefore all logging MUST be performed prior to UTF-8 conversion. This means no logging can be performed in the ldap APIs that implement the python-ldap API because those APIs are defined to accept only UTF-8 strings. Thus the layer which performs type conversions must also do the logging. We do the type conversions in two steps, once to convert all Python types to unicode strings, then log, then convert the unicode strings to UTF-8.
There are a variety of ways one could accomplish this, we elect to use a chaining technique whereby instances of this class simply call the next member in the chain via the “conn” attribute. The chain is constructed by passing in an existing instance of this class as the conn attribute when the class is instantiated.
Here is a brief explanation of why other possible approaches were not used:
subclassing
To perform the wrapping operations in the correct order the type conversion class would have to subclass each of the API providers. This is awkward, doubles the number of classes, and does not scale well. It requires the type conversion class to be aware of all possible API providers.decorators
Decorators provide an elegant solution to wrap methods and would be an ideal way to perform type conversions before calling the wrapped function and then converting the values returned from the wrapped function. However decorators need to be aware of the method signature, it has to know what input parameters need conversion and how to convert the result. For an API like python-ldap which has a large number of different method signatures it would require a large number of specialized decorators. Experience has shown it’s very easy to apply the wrong decorator due to the inherent complexity and tendency to cut-n-paste code. Another option is to parameterize the decorator to make it “smart”. Experience has shown such decorators become insanely complicated and difficult to understand and debug. Also decorators tend to hide what’s really going on when a method is called, the operations being performed are not visible when looking at the implemation of a decorated method, this too experience has shown leads to mistakes.
Chaining simplifies both wrapping to perform type conversion as well as the substitution of alternative API providers. One simply creates a new instance of the API interface and insert it at the front of the chain. Type conversions are explicit and obvious.
If a new method needs to be added to the API interface one adds it to the abstract class definition. Should one miss adding the new method to any derivations of the abstract class the code will fail to load and run making it impossible to forget updating all the derived classes.
Bases: list
Wrapper class to hold connection and msgid.
Bases: keystone.identity.backends.ldap.common.LDAPHandler
LDAPHandler implementation which uses pooled connection manager.
Pool specific configuration is defined in [ldap] section. All other LDAP configuration is still used from [ldap] section
Keystone LDAP authentication logic authenticates an end user using its DN and password via LDAP bind to establish supplied password is correct. This can fill up the pool quickly (as pool re-uses existing connection based on its bind data) and would not leave space in pool for connection re-use for other LDAP operations. Now a separate pool can be established for those requests when related flag ‘use_auth_pool’ is enabled. That pool can have its own size and connection lifetime. Other pool attributes are shared between those pools. If ‘use_pool’ is disabled, then ‘use_auth_pool’ does not matter. If ‘use_auth_pool’ is not enabled, then connection pooling is not used for those LDAP operations.
Note, the python-ldap API requires all string values to be UTF-8 encoded. The KeystoneLDAPHandler enforces this prior to invoking the methods in this class.
alias of StateConnector
Wait for and return the result.
This method returns the result of an operation previously initiated by one of the LDAP asynchronous operation routines (eg search_ext()). It returned an invocation identifier (a message id) upon successful initiation of their operation.
Input msgid is expected to be instance of class MsgId which has LDAP session/connection used to execute search_ext and message idenfier.
The connection associated with search_ext is released once last hard reference to MsgId object is freed. This will happen when function which requested msgId and used it in result3 exits.
Return a MsgId instance, it asynchronous API.
The MsgId instance can be safely used in a call to result3().
To work with result3() API in predictable manner, the same LDAP connection is needed which originally provided the msgid. So, this method wraps the existing connection and msgid in a new MsgId instance. The connection associated with search_ext is released once last hard reference to the MsgId instance is freed.
Bases: keystone.identity.backends.ldap.common.LDAPHandler
LDAPHandler implementation which calls the python-ldap API.
Note, the python-ldap API requires all string values to be UTF-8 encoded. The KeystoneLDAPHandler enforces this prior to invoking the methods in this class.
Convert LDAP search result to Python types used by OpenStack.
Each result tuple is of the form (dn, attrs), where dn is a string containing the DN (distinguished name) of the entry, and attrs is a dictionary containing the attributes associated with the entry. The keys of attrs are strings, and the associated values are lists of strings.
OpenStack wants to use Python types of its choosing. Strings will be unicode, truth values boolean, whole numbers int’s, etc. DN’s will also be decoded from UTF-8 to unicode.
| Parameters: | ldap_result – LDAP search result |
|---|---|
| Returns: | list of 2-tuples containing (dn, attrs) where dn is unicode and attrs is a dict whose values are type converted to OpenStack preferred types. |
Return True if and only if the descendant_dn is under the dn.
| Parameters: |
|
|---|
Similar to ldap2py, only useful for the enabled attribute.
Filter out private items in an entity dict.
| Parameters: | entity_ref – the entity dictionary. The ‘dn’ field will be removed. ‘dn’ is used in LDAP, but should not be returned to the user. This value may be modified. |
|---|---|
| Returns: | entity_ref |
Return True if and only if the AVAs are equal.
When comparing AVAs, the equality matching rule for the attribute type should be taken into consideration. For simplicity, this implementation does a case-insensitive comparison.
Note that this function uses prep_case_insenstive so the limitations of that function apply here.
Return True if and only if the DNs are equal.
Two DNs are equal if they’ve got the same number of RDNs and if the RDNs are the same at each position. See RFC4517.
Note that this function uses is_rdn_equal to compare RDNs so the limitations of that function apply here.
| Parameters: |
|
|---|
Return True if and only if the RDNs are equal.
Note that this function uses is_ava_value_equal to compare AVAs so the limitations of that function apply here.
Convert an LDAP formatted value to Python type used by OpenStack.
Virtually all LDAP values are stored as UTF-8 encoded strings. OpenStack prefers values which are unicode friendly.
| Parameters: | val – LDAP formatted value |
|---|---|
| Returns: | val converted to preferred Python type |
Prepare a string for case-insensitive comparison.
This is defined in RFC4518. For simplicity, all this function does is lowercase all the characters, strip leading and trailing whitespace, and compress sequences of spaces to a single space.
Type convert a Python value to a type accepted by LDAP (unicode).
The LDAP API only accepts strings for values therefore convert the value’s type to a unicode string. A subsequent type conversion will encode the unicode as UTF-8 as required by the python-ldap API, but for now we just want a string representation of the value.
| Parameters: | val – The value to convert to a LDAP string representation |
|---|---|
| Returns: | unicode string representation of value. |
Use this only for connection pool specific ldap API.
This adds connection object to decorated API as next argument after self.
Decode a from UTF-8 into unicode.
If the value is a binary string assume it’s UTF-8 encoded and decode it into a unicode string. Otherwise convert the value from its type into a unicode string.
| Parameters: | value – value to be returned as unicode |
|---|---|
| Returns: | value as unicode |
| Raises UnicodeDecodeError: | |
| for invalid UTF-8 encoding | |
Encode a basestring to UTF-8.
If the string is unicode encode it to UTF-8, if the string is str then assume it’s already encoded. Otherwise raise a TypeError.
| Parameters: | value – A basestring |
|---|---|
| Returns: | UTF-8 encoded version of value |
| Raises TypeError: | |
| If value is not basestring | |
Bases: keystone.identity.backends.ldap.common.BaseLdap
alias of GroupNotFound
Return a filtered list of groups for which the user is a member.
alias of Group
Bases: keystone.identity.backends.ldap.common.EnabledEmuMixIn, keystone.identity.backends.ldap.common.BaseLdap
alias of UserNotFound
alias of User
Base model for keystone internal services.
Unless marked otherwise, all fields are strings.
Bases: keystone.identity.backends.ldap.models.Model
Group object.
Optional keys:
description
Bases: keystone.identity.backends.ldap.models.Model
User object.