keystonemiddleware.tests.unit.auth_token package

Submodules

keystonemiddleware.tests.unit.auth_token.base module

class keystonemiddleware.tests.unit.auth_token.base.BaseAuthTokenTestCase(*args, **kwds)

Bases: keystonemiddleware.tests.unit.utils.BaseTestCase

classmethod call(middleware, method='GET', path='/', headers=None)

create_middleware(cb, conf=None, use_global_conf=False)

create_simple_middleware(status='200 OK', body='', headers=None, **kwargs)

setUp()

keystonemiddleware.tests.unit.auth_token.test_auth module

class keystonemiddleware.tests.unit.auth_token.test_auth.DefaultAuthPluginTests(*args, **kwds)

Bases: keystonemiddleware.tests.unit.utils.BaseTestCase

new_plugin(auth_host=None, auth_port=None, auth_protocol=None, auth_admin_prefix=None, admin_user=None, admin_password=None, admin_tenant_name=None, admin_token=None, identity_uri=None, log=None)

setUp()

test_auth_uri_from_fragments()

test_identity_uri_overrides_fragments()

test_with_admin_token()

test_with_user_pass()

keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware module

class keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.AuthProtocolLoadingTests(*args, **kwds)

Bases: keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.BaseAuthTokenMiddlewareTest

AUTH_URL = 'http://auth.url/prefix'

CRUD_URL = 'http://crud.url/prefix'

DISC_URL = 'http://disc.url/prefix'

KEYSTONE_BASE_URL = 'http://keystone.url/prefix'

KEYSTONE_URL = 'http://keystone.url/prefix/v2.0'

static get_plugin(app)

good_request(app)

setUp()

test_invalid_plugin_fails_to_initialize()

test_loading_password_plugin()

test_plugin_loading_mixed_opts()

test_plugin_loading_with_auth_section()

class keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.BaseAuthTokenMiddlewareTest(*args, **kwds)

Bases: keystonemiddleware.tests.unit.auth_token.base.BaseAuthTokenTestCase

Base test class for auth_token middleware.

All the tests allow for running with auth_token configured for receiving v2 or v3 tokens, with the choice being made by passing configuration data into setUp().

The base class will, by default, run all the tests expecting v2 token formats. Child classes can override this to specify, for instance, v3 format.

assertLastPath(path)

call_middleware(**kwargs)

purge_service_token_expected_env()

purge_token_expected_env()

setUp(expected_env=None, auth_version=None, fake_app=None)

set_middleware(expected_env=None, conf=None)

Configure the class ready to call the auth_token middleware.

Set up the various fake items needed to run the middleware. Individual tests that need to further refine these can call this function to override the class defaults.

update_expected_env(expected_env={})

class keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.CachePoolTest(*args, **kwds)

Bases: keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.BaseAuthTokenMiddlewareTest

test_multiple_context_managers_share_single_client()

test_nested_context_managers_create_multiple_clients()

test_not_use_cache_from_env()

If swift.cache is set in the environment but cache isn’t set in the config then the env cache isn’t used.

test_use_cache_from_env()

If swift.cache is set in the environment and cache is set in the config then the env cache is used.

class keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.CommonAuthTokenMiddlewareTest

Bases: object

These tests are run once using v2 tokens and again using v3 tokens.

assertIsValidJSON(text)

assert_kerberos_bind(token, bind_level, use_kerberos=True, success=True)

assert_valid_request_200(token, with_catalog=True)

get_revocation_list_json(token_ids=None, mode=None)

test_auth_plugin()

test_auth_with_no_token_does_not_call_http()

test_cached_revoked_error()

test_cached_revoked_pki()

test_cached_revoked_pkiz()

test_cached_revoked_uuid()

test_caching_token_on_verify()

test_doesnt_auto_set_content_type()

test_expired()

test_fetch_revocation_list()

test_get_revocation_list_returns_current_list_from_disk()

test_get_revocation_list_returns_current_list_from_memory()

test_get_revocation_list_returns_fetched_list()

test_get_token_revocation_list_fetched_time_returns_min()

test_get_token_revocation_list_fetched_time_returns_mtime()

test_get_token_revocation_list_fetched_time_returns_utc()

test_get_token_revocation_list_fetched_time_returns_value()

test_http_error_not_cached_token()

Test to don’t cache token as invalid on network errors.

We use UUID tokens since they are the easiest one to reach get_http_connection.

test_http_request_max_retries()

test_init_by_ipv6Addr_auth_host()

test_init_does_not_call_http()

test_invalid_revocation_list_raises_error()

test_is_signed_token_revoked_returns_false()

test_is_signed_token_revoked_returns_true()

test_is_signed_token_revoked_returns_true_sha256()

test_memcache()

test_memcache_set_expired(extra_conf={}, extra_environ={})

test_memcache_set_invalid_uuid()

test_nocatalog()

test_request_blank_token()

test_request_invalid_signed_pkiz_token()

test_request_invalid_signed_token()

test_request_invalid_uuid_token()

test_request_no_token()

test_request_no_token_http()

test_revoked_hashed_pki_token()

test_revoked_hashed_pkiz_token()

test_revoked_pki_token_by_audit_id()

test_revoked_token_receives_401()

test_revoked_token_receives_401_md5_secondary()

test_revoked_token_receives_401_sha256()

test_swift_memcache_set_expired()

test_unexpected_exception_in_validate_offline()

test_uuid_bind_token_disabled_with_incorrect_ticket()

test_uuid_bind_token_disabled_with_kerb_user()

test_uuid_bind_token_named_kerberos_with_incorrect_ticket()

test_uuid_bind_token_named_kerberos_with_kerb_user()

test_uuid_bind_token_named_kerberos_with_unknown_bind()

test_uuid_bind_token_named_kerberos_without_bind()

test_uuid_bind_token_named_kerberos_without_kerb_user()

test_uuid_bind_token_permissive_with_incorrect_ticket()

test_uuid_bind_token_permissive_with_kerb_user()

test_uuid_bind_token_permissive_with_unknown_bind()

test_uuid_bind_token_permissive_without_kerb_user()

test_uuid_bind_token_required_with_kerb_user()

test_uuid_bind_token_required_with_unknown_bind()

test_uuid_bind_token_required_without_bind()

test_uuid_bind_token_required_without_kerb_user()

test_uuid_bind_token_strict_with_kerb_user()

test_uuid_bind_token_strict_with_kerbout_user()

test_uuid_bind_token_strict_with_unknown_bind()

test_uuid_bind_token_with_unknown_named_FOO()

test_valid_signed_compressed_request()

test_valid_signed_request()

test_valid_uuid_request()

test_valid_uuid_request_with_auth_fragments()

test_verify_signed_compressed_token_succeeds_for_unrevoked_token()

test_verify_signed_token_raises_exception_for_revoked_pkiz_token()

test_verify_signed_token_raises_exception_for_revoked_token()

test_verify_signed_token_raises_exception_for_revoked_token_s256()

test_verify_signed_token_succeeds_for_unrevoked_token()

test_verify_signed_token_succeeds_for_unrevoked_token_sha256()

class keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.CommonCompositeAuthTests

Bases: object

Test Composite authentication.

Test the behaviour of adding a service-token.

test_composite_auth_delay_invalid_service_and_user_tokens()

test_composite_auth_delay_invalid_service_token()

test_composite_auth_delay_invalid_user_token()

test_composite_auth_delay_no_service_token()

test_composite_auth_delay_no_user_token()

test_composite_auth_delay_ok()

test_composite_auth_invalid_service_token()

test_composite_auth_invalid_user_token()

test_composite_auth_no_service_token()

test_composite_auth_no_user_token()

test_composite_auth_ok()

class keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.CompositeBase(expected_env=None)

Bases: object

Base composite auth object with common service token environment.

class keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.CompositeFakeApp(expected_env)

Bases: keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.CompositeBase, keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.FakeApp

A fake v2 WSGI app protected by composite auth_token middleware.

class keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.CrossVersionAuthTokenMiddlewareTest(*args, **kwds)

Bases: keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.BaseAuthTokenMiddlewareTest, testresources.ResourcedTestCase

resources = [('examples', <testresources.FixtureResource object at 0x7fbc97db0990>)]

test_valid_uuid_request_forced_to_2_0()

Test forcing auth_token to use lower api version.

By installing the v3 http hander, auth_token will be get a version list that looks like a v3 server - from which it would normally chose v3.0 as the auth version. However, here we specify v2.0 in the configuration - which should force auth_token to use that version instead.

class keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.DelayedAuthTests(*args, **kwds)

Bases: keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.BaseAuthTokenMiddlewareTest

test_auth_plugin_with_no_tokens()

test_delayed_auth_values()

test_header_in_401()

class keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.DiabloAuthTokenMiddlewareTest(*args, **kwds)

Bases: keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.BaseAuthTokenMiddlewareTest, testresources.ResourcedTestCase

resources = [('examples', <testresources.FixtureResource object at 0x7fbc97db0990>)]

Auth Token middleware should understand Diablo keystone responses.

setUp()

test_valid_diablo_response()

class keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.FakeApp(expected_env=None, need_service_token=False)

Bases: object

This represents a WSGI app protected by the auth_token middleware.

FORBIDDEN = 'FORBIDDEN'

SUCCESS = 'SUCCESS'

expected_env = {}

class keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.GeneralAuthTokenMiddlewareTest(*args, **kwds)

Bases: keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.BaseAuthTokenMiddlewareTest, testresources.ResourcedTestCase

These tests are not affected by the token format (see CommonAuthTokenMiddlewareTest).

resources = [('examples', <testresources.FixtureResource object at 0x7fbc97db0990>)]

test_assert_valid_memcache_protection_config()

test_auth_region_name()

test_conf_values_type_convert()

test_conf_values_type_convert_with_wrong_value()

test_config_revocation_cache_timeout()

test_deprecated_conf_values()

test_encrypt_cache_data()

test_fixed_cache_key_length()

test_no_memcache_protection()

test_sign_cache_data()

test_token_is_v2_accepts_v2()

test_token_is_v2_rejects_v3()

test_token_is_v3_accepts_v3()

test_token_is_v3_rejects_v2()

class keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.NoMemcacheAuthToken(*args, **kwds)

Bases: keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.BaseAuthTokenMiddlewareTest

These tests will not have the memcache module available.

setUp()

test_nomemcache()

class keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.OtherTests(*args, **kwds)

Bases: keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.BaseAuthTokenMiddlewareTest

setUp()

test_default_auth_version()

test_micro_version()

test_unknown_server_versions()

test_unsupported_auth_version()

class keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.TestAuthPluginLocalOsloConfig(*args, **kwds)

Bases: keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.BaseAuthTokenMiddlewareTest

test_project_in_local_oslo_configuration()

class keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.TestAuthPluginUserAgentGeneration(*args, **kwds)

Bases: keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.BaseAuthTokenMiddlewareTest

setUp()

test_no_project_configured()

test_project_in_configuration()

test_project_in_oslo_configuration()

class keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.TimeFixture(new_time, normalize=True)

Bases: fixtures.fixture.Fixture

setUp()

class keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.TimezoneFixture(new_tz)

Bases: fixtures.fixture.Fixture

cleanup()

setUp()

static supported()

class keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.V2CertDownloadMiddlewareTest(*args, **kwargs)

Bases: keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.BaseAuthTokenMiddlewareTest, testresources.ResourcedTestCase

resources = [('examples', <testresources.FixtureResource object at 0x7fbc97db0990>)]

setUp()

test_fetch_signing_ca()

test_fetch_signing_cert()

test_prefix_trailing_slash()

test_request_no_token_dummy()

test_without_prefix()

class keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.V3CertDownloadMiddlewareTest(*args, **kwargs)

Bases: keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.V2CertDownloadMiddlewareTest

keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.cleanup_revoked_file(filename)

keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.load_tests(loader, tests, pattern)

keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.memcached_available()

Do a sanity check against memcached.

Returns True if the following conditions are met (otherwise, returns False):

• python-memcached is installed
• a usable memcached instance is available via MEMCACHED_SERVERS
• the client is able to set and get a key/value pair

keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.network_error_response(request, context)

keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.strtime(at=None)

class keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.v2AuthTokenMiddlewareTest(*args, **kwds)

Bases: keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.BaseAuthTokenMiddlewareTest, keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.CommonAuthTokenMiddlewareTest, testresources.ResourcedTestCase

v2 token specific tests.

There are some differences between how the auth-token middleware handles v2 and v3 tokens over and above the token formats, namely:

• A v3 keystone server will auto scope a token to a user’s default project if no scope is specified. A v2 server assumes that the auth-token middleware will do that.
• A v2 keystone server may issue a token without a catalog, even with a tenant

The tests below were originally part of the generic AuthTokenMiddlewareTest class, but now, since they really are v2 specific, they are included here.

assert_unscoped_default_tenant_auto_scopes(token)

Unscoped v2 requests with a default tenant should “auto-scope.”

The implied scope is the user’s tenant ID.

assert_unscoped_token_receives_401(token)

Unscoped requests with no default tenant ID should be rejected.

assert_valid_last_url(token_id)

resources = [('examples', <testresources.FixtureResource object at 0x7fbc97db0990>)]

setUp()

test_default_tenant_signed_token()

test_default_tenant_uuid_token()

test_request_prevent_service_catalog_injection()

test_unscoped_pki_token_receives_401()

test_unscoped_uuid_token_receives_401()

test_user_plugin_token_properties()

class keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.v2CompositeAuthTests(*args, **kwds)

Bases: keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.BaseAuthTokenMiddlewareTest, keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.CommonCompositeAuthTests, testresources.ResourcedTestCase

Test auth_token middleware with v2 token based composite auth.

Execute the Composite auth class tests, but with the auth_token middleware configured to expect v2 tokens back from a keystone server.

resources = [('examples', <testresources.FixtureResource object at 0x7fbc97db0990>)]

setUp()

class keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.v3AuthTokenMiddlewareTest(*args, **kwds)

Bases: keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.BaseAuthTokenMiddlewareTest, keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.CommonAuthTokenMiddlewareTest, testresources.ResourcedTestCase

Test auth_token middleware with v3 tokens.

Re-execute the AuthTokenMiddlewareTest class tests, but with the auth_token middleware configured to expect v3 tokens back from a keystone server.

This is done by configuring the AuthTokenMiddlewareTest class via its Setup(), passing in v3 style data that will then be used by the tests themselves. This approach has been used to ensure we really are running the same tests for both v2 and v3 tokens.

There a few additional specific test for v3 only:

• We allow an unscoped token to be validated (as unscoped), where as for v2 tokens, the auth_token middleware is expected to try and auto-scope it (and fail if there is no default tenant)
• Domain scoped tokens

Since we don’t specify an auth version for auth_token to use, by definition we are thefore implicitely testing that it will use the highest available auth version, i.e. v3.0

assert_valid_last_url(token_id)

resources = [('examples', <testresources.FixtureResource object at 0x7fbc97db0990>)]

setUp()

test_domain_scoped_uuid_request()

test_expire_stored_in_cache()

test_fallback_to_online_validation_with_ca_error()

test_fallback_to_online_validation_with_revocation_list_error()

test_fallback_to_online_validation_with_signing_error()

test_gives_v2_catalog()

test_user_plugin_token_properties()

test_valid_unscoped_uuid_request()

token_response(request, context)

class keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.v3CompositeAuthTests(*args, **kwds)

Bases: keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.BaseAuthTokenMiddlewareTest, keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.CommonCompositeAuthTests, testresources.ResourcedTestCase

Test auth_token middleware with v3 token based composite auth.

Execute the Composite auth class tests, but with the auth_token middleware configured to expect v3 tokens back from a keystone server.

resources = [('examples', <testresources.FixtureResource object at 0x7fbc97db0990>)]

setUp()

token_response(request, context)

class keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.v3CompositeFakeApp(expected_env=None)

Bases: keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.CompositeBase, keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.v3FakeApp

A fake v3 WSGI app protected by composite auth_token middleware.

class keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.v3FakeApp(expected_env=None, need_service_token=False)

Bases: keystonemiddleware.tests.unit.auth_token.test_auth_token_middleware.FakeApp

This represents a v3 WSGI app protected by the auth_token middleware.

keystonemiddleware.tests.unit.auth_token.test_base_middleware module

class keystonemiddleware.tests.unit.auth_token.test_base_middleware.BaseAuthProtocolTests(*args, **kwargs)

Bases: testtools.testcase.TestCase

classmethod call(middleware, method='GET', path='/', headers=None)

test_expired_service_token()

test_expired_user_token()

test_good_v3_service_token()

test_good_v3_user_token()

test_invalid_service_token()

test_invalid_user_token()

test_process_flow(*args, **keywargs)

class keystonemiddleware.tests.unit.auth_token.test_base_middleware.FakeApp

Bases: object

class keystonemiddleware.tests.unit.auth_token.test_base_middleware.FetchingMiddleware(app, token_dict={}, **kwargs)

Bases: keystonemiddleware.auth_token._BaseAuthProtocol

keystonemiddleware.tests.unit.auth_token.test_connection_pool module

class keystonemiddleware.tests.unit.auth_token.test_connection_pool.TestConnectionPool(*args, **kwds)

Bases: keystonemiddleware.tests.unit.utils.TestCase

setUp()

test_acquire_conn_exception_returns_acquired_count()

test_cleanup_pool()

test_connection_pool_limits_maximum_connections()

test_connection_pool_maximum_connection_get_timeout()

test_get_context_manager()

keystonemiddleware.tests.unit.auth_token.test_memcache_crypt module

class keystonemiddleware.tests.unit.auth_token.test_memcache_crypt.MemcacheCryptPositiveTests(*args, **kwds)

Bases: keystonemiddleware.tests.unit.utils.BaseTestCase

test_constant_time_compare()

test_derive_keys()

test_encryption()

test_key_strategy_diff()

test_no_pycrypt()

test_protect_wrappers()

test_sign_data()

keystonemiddleware.tests.unit.auth_token.test_request module

class keystonemiddleware.tests.unit.auth_token.test_request.CatalogConversionTests(*args, **kwds)

Bases: keystonemiddleware.tests.unit.utils.TestCase

ADMIN_URL = 'http://admin:35357/v2.0'

INTERNAL_URL = 'http://internal:5000/v2.0'

PUBLIC_URL = 'http://server:5000/v2.0'

REGION_ONE = 'RegionOne'

REGION_THREE = 'RegionThree'

REGION_TWO = 'RegionTwo'

test_basic_convert()

test_multi_region()

class keystonemiddleware.tests.unit.auth_token.test_request.RequestObjectTests(*args, **kwds)

Bases: keystonemiddleware.tests.unit.utils.TestCase

setUp()

test_auth_type()

test_project_scoped_service_headers()

test_project_scoped_user_headers()

test_removing_headers()

test_service_token()

test_setting_service_token_valid()

test_setting_user_token_valid()

test_storage_token()

test_token_auth()

test_user_token()

keystonemiddleware.tests.unit.auth_token.test_revocations module

class keystonemiddleware.tests.unit.auth_token.test_revocations.RevocationsTests(*args, **kwds)

Bases: keystonemiddleware.tests.unit.utils.BaseTestCase

test_check_by_audit_id_chain_revoked()

test_check_by_audit_id_no_audit_ids()

test_check_by_audit_id_not_revoked()

test_check_by_audit_id_revoked()

test_check_empty_list()

test_check_revoked()

keystonemiddleware.tests.unit.auth_token.test_signing_dir module

class keystonemiddleware.tests.unit.auth_token.test_signing_dir.SigningDirectoryTests(*args, **kwds)

Bases: keystonemiddleware.tests.unit.utils.BaseTestCase

test_calc_path()

test_directory_created_when_doesnt_exist()

test_read_file()

test_read_file_doesnt_exist()

test_recreate_directory()

test_replace_file()

test_use_directory_already_exists()

test_write_file()

keystonemiddleware.tests.unit.auth_token.test_user_auth_plugin module

class keystonemiddleware.tests.unit.auth_token.test_user_auth_plugin.BaseUserPluginTests

Bases: object

assertTokenDataEqual(token_id, token, token_data)

configure_middleware(auth_plugin, group='keystone_authtoken', **kwargs)

get_plugin(token_id, service_token_id=None)

test_user_information()

test_with_service_information()

class keystonemiddleware.tests.unit.auth_token.test_user_auth_plugin.V2UserPluginTests(*args, **kwds)

Bases: keystonemiddleware.tests.unit.auth_token.test_user_auth_plugin.BaseUserPluginTests, keystonemiddleware.tests.unit.auth_token.base.BaseAuthTokenTestCase

assertTokenDataEqual(token_id, token, token_data)

get_role_names(token)

get_token()

setUp()

class keystonemiddleware.tests.unit.auth_token.test_user_auth_plugin.V3UserPluginTests(*args, **kwds)

Bases: keystonemiddleware.tests.unit.auth_token.test_user_auth_plugin.BaseUserPluginTests, keystonemiddleware.tests.unit.auth_token.base.BaseAuthTokenTestCase

assertTokenDataEqual(token_id, token, token_data)

get_role_names(token)

get_token()

setUp()

Module contents