keystoneauth1.access package

Submodules

keystoneauth1.access.access module

class keystoneauth1.access.access.AccessInfo(body, auth_token=None)

Bases: object

Encapsulates a raw authentication token from keystone.

Provides helper methods for extracting useful values from that token.

audit_chain_id

Return the audit chain ID if present.

In the event that a token was rescoped then this ID will be the audit_id of the initial token. Returns None if no value present.

Returns:str or None.

audit_id

Return the audit ID if present.

Returns:str or None.

auth_token

Returns the token_id associated with the auth request, to be used in headers for authenticating OpenStack API requests.

Returns:str

bind

Information about external mechanisms the token is bound to.

If a token is bound to an external authentication mechanism it can only be used in conjunction with that mechanism. For example if bound to a kerberos principal it may only be accepted if there is also kerberos authentication performed on the request.

Returns:A dictionary or None. The key will be the bind type the value is a dictionary that is specific to the format of the bind type. Returns None if there is no bind information in the token.

domain_id

Returns the domain id associated with the authentication token.

Returns:str or None (if no domain associated with the token)

domain_name

Returns the domain name associated with the authentication token.

Returns:str or None (if no domain associated with the token)

domain_scoped

Returns true if the authorization token was scoped to a domain.

Returns:bool

expires

Returns the token expiration (as datetime object)

Returns:datetime

has_service_catalog()

Returns true if the authorization token has a service catalog.

Returns:boolean

initial_audit_id

The audit ID of the initially requested token.

This is the audit_chain_id if present or the audit_id.

is_federated

Returns true if federation was used to get the token.

Returns:boolean

issued

Returns the token issue time (as datetime object)

Returns:datetime

oauth_access_token_id

Return the access token ID if OAuth authentication used.

Returns:str or None.

oauth_consumer_id

Return the consumer ID if OAuth authentication used.

Returns:str or None.

project_domain_id

Returns the domain id of the project associated with the authentication request.

Returns:str

project_domain_name

Returns the domain name of the project associated with the authentication request.

Returns:str

project_id

Returns the project ID associated with the authentication request, or None if the authentication request wasn’t scoped to a project.

Returns:str or None (if no project associated with the token)

project_name

Returns the project name associated with the authentication request.

Returns:str or None (if no project associated with the token)

project_scoped

Returns true if the authorization token was scoped to a tenant

(project).

Returns:bool

role_ids

Returns a list of role ids of the user associated with the authentication request.

Returns:a list of strings of role ids

role_names

Returns a list of role names of the user associated with the authentication request.

Returns:a list of strings of role names

scoped

Returns true if the authorization token was scoped to a tenant

(project), and contains a populated service catalog.

This is deprecated, use project_scoped instead.

Returns:bool

service_catalog

service_providers

Return a object representing the list of trusted service providers.

Used for Keystone2Keystone federating-out.

Returns:keystoneauth1.service_providers.ServiceProviders or None

tenant_id

Synonym for project_id.

tenant_name

Synonym for project_name.

trust_id

Returns the trust id associated with the authentication token.

Returns:str or None (if no trust associated with the token)

trust_scoped

Returns true if the authorization token was scoped as delegated in a trust, via the OS-TRUST v3 extension.

Returns:bool

trustee_user_id

Returns the trustee user id associated with a trust.

Returns:str or None (if no trust associated with the token)

trustor_user_id

Returns the trustor user id associated with a trust.

Returns:str or None (if no trust associated with the token)

user_domain_id

Returns the domain id of the user associated with the authentication request.

Returns:str

user_domain_name

Returns the domain name of the user associated with the authentication request.

Returns:str

user_id

Returns the user id associated with the authentication request.

Returns:str

username

Returns the username associated with the authentication request. Follows the pattern defined in the V2 API of first looking for ‘name’, returning that if available, and falling back to ‘username’ if name is unavailable.

Returns:str

will_expire_soon(stale_duration=30)

Determines if expiration is about to occur.

Returns:true if expiration is within the given duration Return type:boolean

class keystoneauth1.access.access.AccessInfoV2(body, auth_token=None)

Bases: keystoneauth1.access.access.AccessInfo

An object for encapsulating a raw v2 auth token from identity service.

audit_chain_id

audit_id

auth_token

bind

domain_id

domain_name

domain_scoped

expires

has_service_catalog()

is_federated

issued

oauth_access_token_id

oauth_consumer_id

project_domain_id

project_domain_name

project_id

project_name

project_scoped

role_ids

role_names

service_providers

trust_id

trust_scoped

trustee_user_id

trustor_user_id

user_domain_id

user_domain_name

user_id

username

version = 'v2.0'

class keystoneauth1.access.access.AccessInfoV3(body, auth_token=None)

Bases: keystoneauth1.access.access.AccessInfo

An object for encapsulating a raw v3 auth token from identity service.

audit_chain_id

audit_id

bind

domain_id

domain_name

domain_scoped

expires

has_service_catalog()

is_federated

issued

oauth_access_token_id

oauth_consumer_id

project_domain_id

project_domain_name

project_id

project_name

project_scoped

role_ids

role_names

service_providers

trust_id

trust_scoped

trustee_user_id

trustor_user_id

user_domain_id

user_domain_name

user_id

username

version = 'v3'

keystoneauth1.access.access.create(*args, **kwargs)

keystoneauth1.access.service_catalog module

class keystoneauth1.access.service_catalog.ServiceCatalog(catalog)

Bases: object

Helper methods for dealing with a Keystone Service Catalog.

catalog

Return the raw service catalog content, mostly useful for debugging.

Applications should avoid this and use accessor methods instead. However, there are times when inspecting the raw catalog can be useful for analysis and other reasons.

get_endpoints(*args, **kwargs)

Fetch and filter endpoints for the specified service(s).

Returns endpoints for the specified service (or all) containing the specified type (or all) and region (or all) and service name.

If there is no name in the service catalog the service_name check will be skipped. This allows compatibility with services that existed before the name was available in the catalog.

get_urls(*args, **kwargs)

Fetch endpoint urls from the service catalog.

Fetch the endpoints from the service catalog for a particular endpoint attribute. If no attribute is given, return the first endpoint of the specified type.

Parameters:

• service_type (string) – Service type of the endpoint.
• interface (string) – Type of endpoint. Possible values: public or publicURL, internal or internalURL, admin or adminURL
• region_name (string) – Region of the endpoint.
• service_name (string) – The assigned name of the service.
• service_id (string) – The identifier of a service.
• endpoint_id (string) – The identifier of an endpoint.

Returns:

tuple of urls or None (if no match found)

is_interface_match(endpoint, interface)

Helper function to normalize endpoint matching across v2 and v3.

Returns:True if the provided endpoint matches the required interface otherwise False.

static normalize_interface(interface)

Handle differences in the way v2 and v3 catalogs specify endpoint.

Both v2 and v3 must be able to handle the endpoint style of the other. For example v2 must be able to handle a ‘public’ interface and v3 must be able to handle a ‘publicURL’ interface.

Returns:the endpoint string in the format appropriate for this service catalog.

url_for(*args, **kwargs)

Fetch an endpoint from the service catalog.

Fetch the specified endpoint from the service catalog for a particular endpoint attribute. If no attribute is given, return the first endpoint of the specified type.

Valid endpoint types: public or publicURL,

internal or internalURL, admin or ‘adminURL`

Parameters:

• service_type (string) – Service type of the endpoint.
• interface (string) – Type of endpoint.
• region_name (string) – Region of the endpoint.
• service_name (string) – The assigned name of the service.
• service_id (string) – The identifier of a service.
• endpoint_id (string) – The identifier of an endpoint.

class keystoneauth1.access.service_catalog.ServiceCatalogV2(catalog)

Bases: keystoneauth1.access.service_catalog.ServiceCatalog

An object for encapsulating the service catalog using raw v2 auth token from Keystone.

classmethod from_token(token)

get_urls(*args, **kwargs)

is_interface_match(endpoint, interface)

static normalize_interface(interface)

class keystoneauth1.access.service_catalog.ServiceCatalogV3(catalog)

Bases: keystoneauth1.access.service_catalog.ServiceCatalog

An object for encapsulating the service catalog using raw v3 auth token from Keystone.

classmethod from_token(token)

get_urls(*args, **kwargs)

is_interface_match(endpoint, interface)

static normalize_interface(interface)

keystoneauth1.access.service_providers module

class keystoneauth1.access.service_providers.ServiceProviders(service_providers)

Bases: object

Helper methods for dealing with Service Providers.

classmethod from_token(token)

get_auth_url(sp_id)

get_sp_url(sp_id)

Module contents

class keystoneauth1.access.AccessInfo(body, auth_token=None)

Bases: object

Encapsulates a raw authentication token from keystone.

Provides helper methods for extracting useful values from that token.

audit_chain_id

Return the audit chain ID if present.

In the event that a token was rescoped then this ID will be the audit_id of the initial token. Returns None if no value present.

Returns:str or None.

audit_id

Return the audit ID if present.

Returns:str or None.

auth_token

Returns the token_id associated with the auth request, to be used in headers for authenticating OpenStack API requests.

Returns:str

bind

Information about external mechanisms the token is bound to.

If a token is bound to an external authentication mechanism it can only be used in conjunction with that mechanism. For example if bound to a kerberos principal it may only be accepted if there is also kerberos authentication performed on the request.

Returns:A dictionary or None. The key will be the bind type the value is a dictionary that is specific to the format of the bind type. Returns None if there is no bind information in the token.

domain_id

Returns the domain id associated with the authentication token.

Returns:str or None (if no domain associated with the token)

domain_name

Returns the domain name associated with the authentication token.

Returns:str or None (if no domain associated with the token)

domain_scoped

Returns true if the authorization token was scoped to a domain.

Returns:bool

expires

Returns the token expiration (as datetime object)

Returns:datetime

has_service_catalog()

Returns true if the authorization token has a service catalog.

Returns:boolean

initial_audit_id

The audit ID of the initially requested token.

This is the audit_chain_id if present or the audit_id.

is_federated

Returns true if federation was used to get the token.

Returns:boolean

issued

Returns the token issue time (as datetime object)

Returns:datetime

oauth_access_token_id

Return the access token ID if OAuth authentication used.

Returns:str or None.

oauth_consumer_id

Return the consumer ID if OAuth authentication used.

Returns:str or None.

project_domain_id

Returns the domain id of the project associated with the authentication request.

Returns:str

project_domain_name

Returns the domain name of the project associated with the authentication request.

Returns:str

project_id

Returns the project ID associated with the authentication request, or None if the authentication request wasn’t scoped to a project.

Returns:str or None (if no project associated with the token)

project_name

Returns the project name associated with the authentication request.

Returns:str or None (if no project associated with the token)

project_scoped

Returns true if the authorization token was scoped to a tenant

(project).

Returns:bool

role_ids

Returns a list of role ids of the user associated with the authentication request.

Returns:a list of strings of role ids

role_names

Returns a list of role names of the user associated with the authentication request.

Returns:a list of strings of role names

scoped

Returns true if the authorization token was scoped to a tenant

(project), and contains a populated service catalog.

This is deprecated, use project_scoped instead.

Returns:bool

service_catalog

service_providers

Return a object representing the list of trusted service providers.

Used for Keystone2Keystone federating-out.

Returns:keystoneauth1.service_providers.ServiceProviders or None

tenant_id

Synonym for project_id.

tenant_name

Synonym for project_name.

trust_id

Returns the trust id associated with the authentication token.

Returns:str or None (if no trust associated with the token)

trust_scoped

Returns true if the authorization token was scoped as delegated in a trust, via the OS-TRUST v3 extension.

Returns:bool

trustee_user_id

Returns the trustee user id associated with a trust.

Returns:str or None (if no trust associated with the token)

trustor_user_id

Returns the trustor user id associated with a trust.

Returns:str or None (if no trust associated with the token)

user_domain_id

Returns the domain id of the user associated with the authentication request.

Returns:str

user_domain_name

Returns the domain name of the user associated with the authentication request.

Returns:str

user_id

Returns the user id associated with the authentication request.

Returns:str

username

Returns the username associated with the authentication request. Follows the pattern defined in the V2 API of first looking for ‘name’, returning that if available, and falling back to ‘username’ if name is unavailable.

Returns:str

will_expire_soon(stale_duration=30)

Determines if expiration is about to occur.

Returns:true if expiration is within the given duration Return type:boolean

class keystoneauth1.access.AccessInfoV2(body, auth_token=None)

Bases: keystoneauth1.access.access.AccessInfo

An object for encapsulating a raw v2 auth token from identity service.

audit_chain_id

audit_id

auth_token

bind

domain_id

domain_name

domain_scoped

expires

has_service_catalog()

is_federated

issued

oauth_access_token_id

oauth_consumer_id

project_domain_id

project_domain_name

project_id

project_name

project_scoped

role_ids

role_names

service_providers

trust_id

trust_scoped

trustee_user_id

trustor_user_id

user_domain_id

user_domain_name

user_id

username

version = 'v2.0'

class keystoneauth1.access.AccessInfoV3(body, auth_token=None)

Bases: keystoneauth1.access.access.AccessInfo

An object for encapsulating a raw v3 auth token from identity service.

audit_chain_id

audit_id

bind

domain_id

domain_name

domain_scoped

expires

has_service_catalog()

is_federated

issued

oauth_access_token_id

oauth_consumer_id

project_domain_id

project_domain_name

project_id

project_name

project_scoped

role_ids

role_names

service_providers

trust_id

trust_scoped

trustee_user_id

trustor_user_id

user_domain_id

user_domain_name

user_id

username

version = 'v3'

keystoneauth1.access.create(*args, **kwargs)