keystone.assignment package

Subpackages

• keystone.assignment.V8_backends package
  • Submodules
  • keystone.assignment.V8_backends.sql module
  • Module contents
• keystone.assignment.V8_role_backends package
  • Submodules
  • keystone.assignment.V8_role_backends.sql module
  • Module contents
• keystone.assignment.backends package
  • Submodules
  • keystone.assignment.backends.sql module
  • Module contents
• keystone.assignment.role_backends package
  • Submodules
  • keystone.assignment.role_backends.sql module
  • Module contents

Submodules

keystone.assignment.controllers module

Workflow Logic the Assignment service.

class keystone.assignment.controllers.GrantAssignmentV3

Bases: keystone.common.controller.V3Controller

The V3 Grant Assignment APIs.

check_grant(context, *args, **kwargs)

Checks if a role has been granted on either a domain or project.

collection_name = 'roles'

create_grant(context, *args, **kwargs)

Grants a role to a user or group on either a domain or project.

list_grants(context, *args, **kwargs)

Lists roles granted to user/group on either a domain or project.

member_name = 'role'

revoke_grant(context, *args, **kwargs)

Revokes a role from user/group on either a domain or project.

class keystone.assignment.controllers.ImpliedRolesV3(*args, **kwargs)

Bases: keystone.common.controller.V3Controller

The V3 ImpliedRoles CRD APIs. There is no Update.

check_implied_role(context, *args, **kwargs)

create_implied_role(context, *args, **kwargs)

delete_implied_role(context, *args, **kwargs)

get_implied_role(context, *args, **kwargs)

list_implied_roles(context, *args, **kwargs)

list_role_inference_rules(context, *args, **kwargs)

class keystone.assignment.controllers.ProjectAssignmentV3

Bases: keystone.common.controller.V3Controller

The V3 Project APIs that are processing assignments.

collection_name = 'projects'

list_user_projects(context, **kwargs)

member_name = 'project'

class keystone.assignment.controllers.Role(*args, **kwargs)

Bases: keystone.common.controller.V2Controller

The Role management APIs.

create_role(*args, **kwargs)

delete_role(*args, **kwargs)

get_role(*args, **kwargs)

get_roles(*args, **kwargs)

class keystone.assignment.controllers.RoleAssignmentV2(*args, **kwargs)

Bases: keystone.common.controller.V2Controller

The V2 Role APIs that are processing assignments.

add_role_to_user(*args, **kwargs)

Add a role to a user and tenant pair.

Since we’re trying to ignore the idea of user-only roles we’re not implementing them in hopes that the idea will die off.

create_role_ref(*args, **kwargs)

This is actually used for adding a user to a tenant.

In the legacy data model adding a user to a tenant required setting a role.

delete_role_ref(*args, **kwargs)

This is actually used for deleting a user from a tenant.

In the legacy data model removing a user from a tenant required deleting a role.

To emulate this, we encode the tenant and role in the role_ref_id, and if this happens to be the last role for the user-tenant pair, we remove the user from the tenant.

get_role_refs(*args, **kwargs)

Ultimate hack to get around having to make role_refs first-class.

This will basically iterate over the various roles the user has in all tenants the user is a member of and create fake role_refs where the id encodes the user-tenant-role information so we can look up the appropriate data when we need to delete them.

get_user_roles(*args, **kwargs)

Get the roles for a user and tenant pair.

Since we’re trying to ignore the idea of user-only roles we’re not implementing them in hopes that the idea will die off.

remove_role_from_user(*args, **kwargs)

Remove a role from a user and tenant pair.

Since we’re trying to ignore the idea of user-only roles we’re not implementing them in hopes that the idea will die off.

class keystone.assignment.controllers.RoleAssignmentV3(*args, **kwargs)

Bases: keystone.common.controller.V3Controller

The V3 Role Assignment APIs, really just list_role_assignment().

collection_name = 'role_assignments'

list_role_assignments(context, **kwargs)

list_role_assignments_for_tree(context, **kwargs)

list_role_assignments_wrapper(context)

Main entry point from router for list role assignments.

Since we want different policy file rules to be applicable based on whether there the include_subtree query parameter is part of the API call, this method checks for this and then calls the appropriate protected entry point.

member_name = 'role_assignment'

classmethod wrap_member(context, ref)

class keystone.assignment.controllers.RoleV3

Bases: keystone.common.controller.V3Controller

The V3 Role CRUD APIs.

To ease complexity (and hence risk) in writing the policy rules for the role APIs, we create separate policy actions for roles that are domain specific, as opposed to those that are global. In order to achieve this each of the role API methods has a wrapper method that checks to see if the role is global or domain specific.

NOTE (henry-nash): If this separate global vs scoped policy action pattern becomes repeated for other entities, we should consider encapsulating this into a specialized router class.

collection_name = 'roles'

create_domain_role(context, *args, **kwargs)

create_role(context, *args, **kwargs)

create_role_wrapper(context, role)

delete_domain_role(context, *args, **kwargs)

delete_role(context, *args, **kwargs)

delete_role_wrapper(context, role_id)

get_domain_role(context, *args, **kwargs)

get_role(context, *args, **kwargs)

get_role_wrapper(context, role_id)

list_domain_roles(context, **kwargs)

list_roles(context, **kwargs)

list_roles_wrapper(context)

member_name = 'role'

update_domain_role(context, *args, **kwargs)

update_role(context, *args, **kwargs)

update_role_wrapper(context, role_id, role)

class keystone.assignment.controllers.TenantAssignment(*args, **kwargs)

Bases: keystone.common.controller.V2Controller

The V2 Project APIs that are processing assignments.

get_project_users(*args, **kwargs)

get_projects_for_token(*args, **kwargs)

Get valid tenants for token based on token used to authenticate.

Pulls the token from the context, validates it and gets the valid tenants for the user in the token.

Doesn’t care about token scopedness.

keystone.assignment.core module

Main entry point into the Assignment service.

class keystone.assignment.core.AssignmentDriverBase

Bases: object

add_role_to_user_and_project(user_id, tenant_id, role_id)

Add a role to a user within given tenant.

Raises keystone.exception.Conflict:  If a duplicate role assignment exists.

check_grant_role_id(role_id, user_id=None, group_id=None, domain_id=None, project_id=None, inherited_to_projects=False)

Checks an assignment/grant role id.

Raises keystone.exception.RoleAssignmentNotFound:  If the role assignment doesn’t exist. Returns:None or raises an exception if grant not found

create_grant(role_id, user_id=None, group_id=None, domain_id=None, project_id=None, inherited_to_projects=False)

Creates a new assignment/grant.

If the assignment is to a domain, then optionally it may be specified as inherited to owned projects (this requires the OS-INHERIT extension to be enabled).

delete_grant(role_id, user_id=None, group_id=None, domain_id=None, project_id=None, inherited_to_projects=False)

Deletes assignments/grants.

Raises keystone.exception.RoleAssignmentNotFound:  If the role assignment doesn’t exist.

delete_group_assignments(group_id)

Deletes all assignments for a group.

Raises keystone.exception.RoleNotFound:  If the role doesn’t exist.

delete_project_assignments(project_id)

Deletes all assignments for a project.

Raises keystone.exception.ProjectNotFound:  If the project doesn’t exist.

delete_role_assignments(role_id)

Deletes all assignments for a role.

delete_user_assignments(user_id)

Deletes all assignments for a user.

Raises keystone.exception.RoleNotFound:  If the role doesn’t exist.

list_grant_role_ids(user_id=None, group_id=None, domain_id=None, project_id=None, inherited_to_projects=False)

Lists role ids for assignments/grants.

list_role_assignments(role_id=None, user_id=None, group_ids=None, domain_id=None, project_ids=None, inherited_to_projects=None)

Returns a list of role assignments for actors on targets.

Available parameters represent values in which the returned role assignments attributes need to be filtered on.

remove_role_from_user_and_project(user_id, tenant_id, role_id)

Remove a role from a user within given tenant.

Raises keystone.exception.RoleNotFound:  If the role doesn’t exist.

class keystone.assignment.core.AssignmentDriverV8

Bases: keystone.assignment.core.AssignmentDriverBase

Removed or redefined methods from V8.

Move the abstract methods of any methods removed or modified in later versions of the driver from AssignmentDriverBase to here. We maintain this so that legacy drivers, which will be a subclass of AssignmentDriverV8, can still reference them.

list_domain_ids_for_groups(group_ids, inherited=False)

List domain ids accessible to specified groups.

Parameters:

• group_ids – List of group ids.
• inherited – whether to return domain_ids that have inherited assignments or not.

Returns:

List of domain ids accessible to specified groups.

list_domain_ids_for_user(user_id, group_ids, hints, inherited=False)

List all domain ids associated with a given user.

Parameters:

• user_id – the user in question
• group_ids – the groups this user is a member of. This list is built in the Manager, so that the driver itself does not have to call across to identity.
• hints – filter hints which the driver should implement if at all possible.
• inherited – whether to return domain_ids that have inherited assignments or not.

Returns:

a list of domain ids or an empty list.

list_project_ids_for_groups(group_ids, hints, inherited=False)

List project ids accessible to specified groups.

Parameters:

• group_ids – List of group ids.
• hints – filter hints which the driver should implement if at all possible.
• inherited – whether assignments marked as inherited should be included.

Returns:

List of project ids accessible to specified groups.

This method should not try and expand any inherited assignments, just report the projects that have the role for this group. The manager method is responsible for expanding out inherited assignments.

list_project_ids_for_user(user_id, group_ids, hints, inherited=False)

List all project ids associated with a given user.

Parameters:

• user_id – the user in question
• group_ids – the groups this user is a member of. This list is built in the Manager, so that the driver itself does not have to call across to identity.
• hints – filter hints which the driver should implement if at all possible.
• inherited – whether assignments marked as inherited should be included.

Returns:

a list of project ids or an empty list.

This method should not try and expand any inherited assignments, just report the projects that have the role for this user. The manager method is responsible for expanding out inherited assignments.

list_role_ids_for_groups_on_domain(group_ids, domain_id)

List the group role ids for a specific domain.

Parameters:

• group_ids (list) – list of group ids
• domain_id (str) – domain identifier

Returns:

list of role ids for the project

Return type:

list

list_role_ids_for_groups_on_project(group_ids, project_id, project_domain_id, project_parents)

List the group role ids for a specific project.

Supports the OS-INHERIT role inheritance from the project’s domain if supported by the assignment driver.

Parameters:

• group_ids (list) – list of group ids
• project_id (str) – project identifier
• project_domain_id (str) – project’s domain identifier
• project_parents (list) – list of parent ids of this project

Returns:

list of role ids for the project

Return type:

list

list_user_ids_for_project(tenant_id)

Lists all user IDs with a role assignment in the specified project.

Returns:a list of user_ids or an empty set.

class keystone.assignment.core.AssignmentDriverV9

Bases: keystone.assignment.core.AssignmentDriverBase

New or redefined methods from V8.

Add any new V9 abstract methods (or those with modified signatures) to this class.

delete_domain_assignments(domain_id)

Deletes all assignments for a domain.

class keystone.assignment.core.Manager(*args, **kwargs)

Bases: keystone.common.manager.Manager

Default pivot point for the Assignment backend.

See keystone.common.manager.Manager for more details on how this dynamically calls the backend.

add_implied_roles(*args, **kwargs)

Expand out implied roles.

The role_refs passed in have had all inheritance and group assignments expanded out. We now need to look at the role_id in each ref and see if it is a prior role for some implied roles. If it is, then we need to duplicate that ref, one for each implied role. We store the prior role in the indirect dict that is part of such a duplicated ref, so that a caller can determine where the assignment came from.

add_role_to_user_and_project(*args, **kwargs)

add_user_to_project(*args, **kwargs)

Add user to a tenant by creating a default role relationship.

Raises:

• keystone.exception.ProjectNotFound – If the project doesn’t exist.
• keystone.exception.UserNotFound – If the user doesn’t exist.

create_grant(*args, **kwargs)

delete_grant(*args, **kwargs)

delete_tokens_for_role_assignments(*args, **kwargs)

driver_namespace = 'keystone.assignment'

get_grant(*args, **kwargs)

get_roles_for_groups(*args, **kwargs)

Get a list of roles for this group on domain and/or project.

get_roles_for_user_and_domain(*args, **kwargs)

Get the roles associated with a user within given domain.

Returns:a list of role ids. Raises keystone.exception.DomainNotFound:  If the domain doesn’t exist.

get_roles_for_user_and_project(*args, **kwargs)

Get the roles associated with a user within given project.

This includes roles directly assigned to the user on the project, as well as those by virtue of group membership or inheritance.

Returns:a list of role ids. Raises keystone.exception.ProjectNotFound:  If the project doesn’t exist.

list_domains_for_groups(*args, **kwargs)

list_domains_for_user(*args, **kwargs)

list_grants(*args, **kwargs)

list_projects_for_groups(*args, **kwargs)

list_projects_for_user(*args, **kwargs)

list_role_assignments(*args, **kwargs)

List role assignments, honoring effective mode and provided filters.

Returns a list of role assignments, where their attributes match the provided filters (role_id, user_id, group_id, domain_id, project_id and inherited). If include_subtree is True, then assignments on all descendants of the project specified by project_id are also included. The inherited filter defaults to None, meaning to get both non-inherited and inherited role assignments.

If effective mode is specified, this means that rather than simply return the assignments that match the filters, any group or inheritance assignments will be expanded. Group assignments will become assignments for all the users in that group, and inherited assignments will be shown on the projects below the assignment point. Think of effective mode as being the list of assignments that actually affect a user, for example the roles that would be placed in a token.

If include_names is set to true the entities’ names are returned in addition to their id’s.

source_from_group_ids is a list of group IDs and, if specified, then only those assignments that are derived from membership of these groups are considered, and any such assignments will not be expanded into their user membership assignments. This is different to a group filter of the resulting list, instead being a restriction on which assignments should be considered before expansion of inheritance. This option is only used internally (i.e. it is not exposed at the API level) and is only supported in effective mode (since in regular mode there is no difference between this and a group filter, other than it is a list of groups).

In effective mode, any domain specific roles are usually stripped from the returned assignments (since such roles are not placed in tokens). This stripping can be disabled by specifying strip_domain_roles=False, which is useful for internal calls like trusts which need to examine the full set of roles.

If OS-INHERIT extension is disabled or the used driver does not support inherited roles retrieval, inherited role assignments will be ignored.

list_user_ids_for_project(*args, **kwargs)

remove_role_from_user_and_project(*args, **kwargs)

remove_user_from_project(*args, **kwargs)

Remove user from a tenant

Raises:

• keystone.exception.ProjectNotFound – If the project doesn’t exist.
• keystone.exception.UserNotFound – If the user doesn’t exist.

class keystone.assignment.core.RoleDriverBase

Bases: object

create_role(role_id, role)

Creates a new role.

Raises keystone.exception.Conflict:  If a duplicate role exists.

delete_role(role_id)

Deletes an existing role.

Raises keystone.exception.RoleNotFound:  If the role doesn’t exist.

get_role(role_id)

Get a role by ID.

Returns:role_ref Raises keystone.exception.RoleNotFound:  If the role doesn’t exist.

list_roles(hints)

List roles in the system.

Parameters:hints – filter hints which the driver should implement if at all possible. Returns:a list of role_refs or an empty list.

list_roles_from_ids(role_ids)

List roles for the provided list of ids.

Parameters:role_ids – list of ids Returns:a list of role_refs.

This method is used internally by the assignment manager to bulk read a set of roles given their ids.

update_role(role_id, role)

Updates an existing role.

Raises:

• keystone.exception.RoleNotFound – If the role doesn’t exist.
• keystone.exception.Conflict – If a duplicate role exists.

class keystone.assignment.core.RoleDriverV8

Bases: keystone.assignment.core.RoleDriverBase

Removed or redefined methods from V8.

Move the abstract methods of any methods removed or modified in later versions of the driver from RoleDriverBase to here. We maintain this so that legacy drivers, which will be a subclass of RoleDriverV8, can still reference them.

class keystone.assignment.core.RoleDriverV9

Bases: keystone.assignment.core.RoleDriverBase

New or redefined methods from V8.

Add any new V9 abstract methods (or those with modified signatures) to this class.

create_implied_role(prior_role_id, implied_role_id)

Creates a role inference rule

Raises:keystone.exception.RoleNotFound: If the role doesn’t exist.

delete_implied_role(prior_role_id, implied_role_id)

Deletes a role inference rule

Raises keystone.exception.ImpliedRoleNotFound:  If the implied role doesn’t exist.

get_implied_role(prior_role_id, implied_role_id)

Fetches a role inference rule

Raises keystone.exception.ImpliedRoleNotFound:  If the implied role doesn’t exist.

list_implied_roles(prior_role_id)

Lists roles implied from the prior role ID

list_role_inference_rules()

Lists all the rules used to imply one role from another

class keystone.assignment.core.RoleManager(*args, **kwargs)

Bases: keystone.common.manager.Manager

Default pivot point for the Role backend.

create_implied_role(*args, **kwargs)

create_role(*args, **kwargs)

delete_implied_role(*args, **kwargs)

delete_role(*args, **kwargs)

driver_namespace = 'keystone.role'

get_role(*args, **kwargs)

list_roles(*args, **kwargs)

update_role(*args, **kwargs)

class keystone.assignment.core.V9AssignmentWrapperForV8Driver(*args, **kwargs)

Bases: keystone.assignment.core.AssignmentDriverV9

Wrapper class to supported a V8 legacy driver.

In order to support legacy drivers without having to make the manager code driver-version aware, we wrap legacy drivers so that they look like the latest version. For the various changes made in a new driver, here are the actions needed in this wrapper:

Method removed from new driver - remove the call-through method from this

class, since the manager will no longer be calling it.

Method signature (or meaning) changed - wrap the old method in a new

signature here, and munge the input and output parameters accordingly.

New method added to new driver - add a method to implement the new

functionality here if possible. If that is not possible, then return NotImplemented, since we do not guarantee to support new functionality with legacy drivers.

add_role_to_user_and_project(user_id, tenant_id, role_id)

check_grant_role_id(role_id, user_id=None, group_id=None, domain_id=None, project_id=None, inherited_to_projects=False)

create_grant(role_id, user_id=None, group_id=None, domain_id=None, project_id=None, inherited_to_projects=False)

default_resource_driver()

default_role_driver()

delete_domain_assignments(domain_id)

Deletes all assignments for a domain.

delete_grant(role_id, user_id=None, group_id=None, domain_id=None, project_id=None, inherited_to_projects=False)

delete_group_assignments(group_id)

delete_project_assignments(project_id)

delete_role_assignments(role_id)

delete_user_assignments(user_id)

list_grant_role_ids(user_id=None, group_id=None, domain_id=None, project_id=None, inherited_to_projects=False)

list_role_assignments(role_id=None, user_id=None, group_ids=None, domain_id=None, project_ids=None, inherited_to_projects=None)

remove_role_from_user_and_project(user_id, tenant_id, role_id)

class keystone.assignment.core.V9RoleWrapperForV8Driver(*args, **kwargs)

Bases: keystone.assignment.core.RoleDriverV9

Wrapper class to supported a V8 legacy driver.

In order to support legacy drivers without having to make the manager code driver-version aware, we wrap legacy drivers so that they look like the latest version. For the various changes made in a new driver, here are the actions needed in this wrapper:

Method removed from new driver - remove the call-through method from this

class, since the manager will no longer be calling it.

Method signature (or meaning) changed - wrap the old method in a new

signature here, and munge the input and output parameters accordingly.

New method added to new driver - add a method to implement the new

functionality here if possible. If that is not possible, then return NotImplemented, since we do not guarantee to support new functionality with legacy drivers.

This V8 wrapper contains the following support for newer manager code:

• The current manager code expects a role entity to have a domain_id attribute, with a non-None value indicating a domain specific role. V8 drivers will only understand global roles, hence if a non-None domain_id is passed to this wrapper, it will raise a NotImplemented exception. If a None-valued domain_id is passed in, it will be trimmed off before the underlying driver is called (and a None-valued domain_id attribute is added in for any entities returned to the manager.

create_implied_role(prior_role_id, implied_role_id)

create_role(role_id, role)

delete_implied_role(prior_role_id, implied_role_id)

delete_role(role_id)

get_implied_role(prior_role_id, implied_role_id)

get_role(role_id)

list_implied_roles(prior_role_id)

list_role_inference_rules()

list_roles(hints)

list_roles_from_ids(role_ids)

update_role(role_id, role)

keystone.assignment.routers module

WSGI Routers for the Assignment service.

class keystone.assignment.routers.Admin(mapper=None)

Bases: keystone.common.wsgi.ComposableRouter

add_routes(mapper)

class keystone.assignment.routers.Public(mapper=None)

Bases: keystone.common.wsgi.ComposableRouter

add_routes(mapper)

class keystone.assignment.routers.Routers

Bases: keystone.common.wsgi.RoutersBase

append_v3_routers(mapper, routers)

keystone.assignment.schema module

Module contents