keystone.identity package

Subpackages

• keystone.identity.backends package
  • Subpackages
    • keystone.identity.backends.ldap package
      • Submodules
      • keystone.identity.backends.ldap.common module
      • keystone.identity.backends.ldap.core module
      • keystone.identity.backends.ldap.models module
      • Module contents
  • Submodules
  • keystone.identity.backends.base module
  • keystone.identity.backends.sql module
  • keystone.identity.backends.sql_model module
  • Module contents
• keystone.identity.id_generators package
  • Submodules
  • keystone.identity.id_generators.sha256 module
  • Module contents
• keystone.identity.mapping_backends package
  • Submodules
  • keystone.identity.mapping_backends.base module
  • keystone.identity.mapping_backends.mapping module
  • keystone.identity.mapping_backends.sql module
  • Module contents
• keystone.identity.shadow_backends package
  • Submodules
  • keystone.identity.shadow_backends.base module
  • keystone.identity.shadow_backends.sql module
  • Module contents

Submodules

keystone.identity.controllers module

Workflow Logic the Identity service.

class keystone.identity.controllers.GroupV3

Bases: keystone.common.controller.V3Controller

collection_name = 'groups'

create_group(request, *args, **kwargs)

delete_group(request, *args, **kwargs)

get_group(request, *args, **kwargs)

list_groups(request, **kwargs)

list_groups_for_user(request, **kwargs)

member_name = 'group'

update_group(request, *args, **kwargs)

class keystone.identity.controllers.User(*args, **kwargs)

Bases: keystone.common.controller.V2Controller

create_user(*args, **kwargs)

delete_user(*args, **kwargs)

get_user(*args, **kwargs)

get_user_by_name(*args, **kwargs)

get_users(*args, **kwargs)

set_user_enabled(*args, **kwargs)

set_user_password(*args, **kwargs)

update_user(*args, **kwargs)

class keystone.identity.controllers.UserV3

Bases: keystone.common.controller.V3Controller

add_user_to_group(request, *args, **kwargs)

change_password(request, *args, **kwargs)

check_user_in_group(request, *args, **kwargs)

collection_name = 'users'

create_user(request, *args, **kwargs)

delete_user(request, *args, **kwargs)

get_user(request, *args, **kwargs)

list_users(request, **kwargs)

list_users_in_group(request, **kwargs)

member_name = 'user'

remove_user_from_group(request, *args, **kwargs)

update_user(request, *args, **kwargs)

keystone.identity.core module

Main entry point into the Identity service.

class keystone.identity.core.DomainConfigs(*args, **kwargs)

Bases: dict

Discover, store and provide access to domain specific configs.

The setup_domain_drivers() call will be made via the wrapper from the first call to any driver function handled by this manager.

Domain specific configurations are only supported for the identity backend and the individual configurations are either specified in the resource database or in individual domain configuration files, depending on the setting of the ‘domain_configurations_from_database’ config option.

The result will be that for each domain with a specific configuration, this class will hold a reference to a ConfigOpts and driver object that the identity manager and driver can use.

check_config_and_reload_domain_driver_if_required(domain_id)

Check for, and load, any new domain specific config for this domain.

This is only supported for the database-stored domain specific configuration.

When the domain specific drivers were set up, we stored away the specific config for this domain that was available at that time. So we now read the current version and compare. While this might seem somewhat inefficient, the sensitive config call is cached, so should be light weight. More importantly, when the cache timeout is reached, we will get any config that has been updated from any other keystone process.

This cache-timeout approach works for both multi-process and multi-threaded keystone configurations. In multi-threaded configurations, even though we might remove a driver object (that could be in use by another thread), this won’t actually be thrown away until all references to it have been broken. When that other thread is released back and is restarted with another command to process, next time it accesses the driver it will pickup the new one.

configured = False

driver = None

get_domain_conf(domain_id)

get_domain_driver(domain_id)

lock = <thread.lock object at 0x7fe4f6c2d930>

reload_domain_driver(domain_id)

setup_domain_drivers(standard_driver, resource_api)

class keystone.identity.core.IdentityDriverV8(*args, **kwargs)

Bases: keystone.identity.backends.base.IdentityDriverV8

class keystone.identity.core.Manager(*args, **kwargs)

Bases: keystone.common.manager.Manager

Default pivot point for the Identity backend.

See keystone.common.manager.Manager for more details on how this dynamically calls the backend.

This class also handles the support of domain specific backends, by using the DomainConfigs class. The setup call for DomainConfigs is called from with the @domains_configured wrapper in a lazy loading fashion to get around the fact that we can’t satisfy the assignment api it needs from within our __init__() function since the assignment driver is not itself yet initialized.

Each of the identity calls are pre-processed here to choose, based on domain, which of the drivers should be called. The non-domain-specific driver is still in place, and is used if there is no specific driver for the domain in question (or we are not using multiple domain drivers).

Starting with Juno, in order to be able to obtain the domain from just an ID being presented as part of an API call, a public ID to domain and local ID mapping is maintained. This mapping also allows for the local ID of drivers that do not provide simple UUIDs (such as LDAP) to be referenced via a public facing ID. The mapping itself is automatically generated as entities are accessed via the driver.

This mapping is only used when: - the entity is being handled by anything other than the default driver, or - the entity is being handled by the default LDAP driver and backward compatible IDs are not required.

This means that in the standard case of a single SQL backend or the default settings of a single LDAP backend (since backward compatible IDs is set to True by default), no mapping is used. An alternative approach would be to always use the mapping table, but in the cases where we don’t need it to make the public and local IDs the same. It is felt that not using the mapping by default is a more prudent way to introduce this functionality.

add_user_to_group(*args, **kwargs)

assert_user_enabled(*args, **kwargs)

Assert the user and the user’s domain are enabled.

:raise AssertionError if the user or the user’s domain is disabled.

authenticate(*args, **kwargs)

change_password(*args, **kwargs)

check_user_in_group(*args, **kwargs)

create_group(*args, **kwargs)

create_user(*args, **kwargs)

delete_group(*args, **kwargs)

delete_user(*args, **kwargs)

driver_namespace = 'keystone.identity'

emit_invalidate_grant_token_persistence(*args, **kwargs)

Emit a notification to the callback system to revoke grant tokens.

This method and associated callback listener removes the need for making a direct call to another manager to delete and revoke tokens.

Parameters:user_project (dict) – {‘user_id’: user_id, ‘project_id’: project_id}

emit_invalidate_user_token_persistence(*args, **kwargs)

Emit a notification to the callback system to revoke user tokens.

This method and associated callback listener removes the need for making a direct call to another manager to delete and revoke tokens.

Parameters:user_id (string) – user identifier

get_group(*args, **kwargs)

get_group_by_name(*args, **kwargs)

get_user(*args, **kwargs)

get_user_by_name(*args, **kwargs)

list_groups(*args, **kwargs)

list_groups_for_user(*args, **kwargs)

list_users(*args, **kwargs)

list_users_in_group(*args, **kwargs)

remove_user_from_group(*args, **kwargs)

shadow_federated_user(*args, **kwargs)

Map a federated user to a user.

Parameters:

• idp_id – identity provider id
• protocol_id – protocol id
• unique_id – unique id for the user within the IdP
• display_name – user’s display name

Returns:

dictionary of the mapped User entity

update_group(*args, **kwargs)

update_user(*args, **kwargs)

class keystone.identity.core.MappingDriverV8(*args, **kwargs)

Bases: keystone.identity.mapping_backends.base.MappingDriverV8

class keystone.identity.core.MappingManager(*args, **kwargs)

Bases: keystone.common.manager.Manager

Default pivot point for the ID Mapping backend.

create_id_mapping(*args, **kwargs)

delete_id_mapping(*args, **kwargs)

driver_namespace = 'keystone.identity.id_mapping'

get_id_mapping(*args, **kwargs)

get_public_id(*args, **kwargs)

purge_mappings(*args, **kwargs)

class keystone.identity.core.ShadowUsersDriverV9(*args, **kwargs)

Bases: keystone.identity.shadow_backends.base.ShadowUsersDriverV9

class keystone.identity.core.ShadowUsersManager(*args, **kwargs)

Bases: keystone.common.manager.Manager

Default pivot point for the Shadow Users backend.

driver_namespace = 'keystone.identity.shadow_users'

keystone.identity.core.domains_configured(f)

Wrap API calls to lazy load domain configs after init.

This is required since the assignment manager needs to be initialized before this manager, and yet this manager’s init wants to be able to make assignment calls (to build the domain configs). So instead, we check if the domains have been initialized on entry to each call, and if requires load them,

keystone.identity.core.exception_translated(exception_type)

Wrap API calls to map to correct exception.

keystone.identity.generator module

ID Generator provider interface.

class keystone.identity.generator.IDGenerator

Bases: object

Interface description for an ID Generator provider.

generate_public_ID(mapping)

Return a Public ID for the given mapping dict.

Parameters:mapping (dict) – The items to be hashed.

The ID must be reproducible and no more than 64 chars in length. The ID generated should be independent of the order of the items in the mapping dict.

class keystone.identity.generator.Manager(*args, **kwargs)

Bases: keystone.common.manager.Manager

Default pivot point for the identifier generator backend.

driver_namespace = 'keystone.identity.id_generator'

keystone.identity.routers module

WSGI Routers for the Identity service.

class keystone.identity.routers.Admin(mapper=None)

Bases: keystone.common.wsgi.ComposableRouter

add_routes(mapper)

class keystone.identity.routers.Routers

Bases: keystone.common.wsgi.RoutersBase

append_v3_routers(mapper, routers)

keystone.identity.schema module

Module contents