diff options
Diffstat (limited to 'keystoneclient/auth/identity')
| -rw-r--r-- | keystoneclient/auth/identity/base.py | 12 | ||||
| -rw-r--r-- | keystoneclient/auth/identity/generic/__init__.py | 21 | ||||
| -rw-r--r-- | keystoneclient/auth/identity/generic/base.py | 179 | ||||
| -rw-r--r-- | keystoneclient/auth/identity/generic/password.py | 83 | ||||
| -rw-r--r-- | keystoneclient/auth/identity/generic/token.py | 52 |
5 files changed, 342 insertions, 5 deletions
diff --git a/keystoneclient/auth/identity/base.py b/keystoneclient/auth/identity/base.py index 4b02f94..dbdcc1f 100644 --- a/keystoneclient/auth/identity/base.py +++ b/keystoneclient/auth/identity/base.py @@ -24,6 +24,12 @@ from keystoneclient import utils LOG = logging.getLogger(__name__) +def get_options(): + return [ + cfg.StrOpt('auth-url', help='Authentication URL'), + ] + + @six.add_metaclass(abc.ABCMeta) class BaseIdentityPlugin(base.BaseAuthPlugin): @@ -256,9 +262,5 @@ class BaseIdentityPlugin(base.BaseAuthPlugin): @classmethod def get_options(cls): options = super(BaseIdentityPlugin, cls).get_options() - - options.extend([ - cfg.StrOpt('auth-url', help='Authentication URL'), - ]) - + options.extend(get_options()) return options diff --git a/keystoneclient/auth/identity/generic/__init__.py b/keystoneclient/auth/identity/generic/__init__.py new file mode 100644 index 0000000..b24c3d6 --- /dev/null +++ b/keystoneclient/auth/identity/generic/__init__.py @@ -0,0 +1,21 @@ +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + +from keystoneclient.auth.identity.generic.base import BaseGenericPlugin # noqa +from keystoneclient.auth.identity.generic.password import Password # noqa +from keystoneclient.auth.identity.generic.token import Token # noqa + + +__all__ = ['BaseGenericPlugin', + 'Password', + 'Token', + ] diff --git a/keystoneclient/auth/identity/generic/base.py b/keystoneclient/auth/identity/generic/base.py new file mode 100644 index 0000000..94d48ec --- /dev/null +++ b/keystoneclient/auth/identity/generic/base.py @@ -0,0 +1,179 @@ +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + +import abc +import logging + +from oslo.config import cfg +import six +import six.moves.urllib.parse as urlparse + +from keystoneclient import _discover +from keystoneclient.auth.identity import base +from keystoneclient import exceptions + +LOG = logging.getLogger(__name__) + + +def get_options(): + return base.get_options() + [ + cfg.StrOpt('domain-id', help='Domain ID to scope to'), + cfg.StrOpt('domain-name', help='Domain name to scope to'), + cfg.StrOpt('tenant-id', help='Tenant ID to scope to'), + cfg.StrOpt('tenant-name', help='Tenant name to scope to'), + cfg.StrOpt('project-id', help='Project ID to scope to'), + cfg.StrOpt('project-name', help='Project name to scope to'), + cfg.StrOpt('project-domain-id', + help='Domain ID containing project'), + cfg.StrOpt('project-domain-name', + help='Domain name containing project'), + cfg.StrOpt('trust-id', help='Trust ID'), + ] + + +@six.add_metaclass(abc.ABCMeta) +class BaseGenericPlugin(base.BaseIdentityPlugin): + """An identity plugin that is not version dependant. + + Internally we will construct a version dependant plugin with the resolved + URL and then proxy all calls from the base plugin to the versioned one. + """ + + def __init__(self, auth_url, + tenant_id=None, + tenant_name=None, + project_id=None, + project_name=None, + project_domain_id=None, + project_domain_name=None, + domain_id=None, + domain_name=None, + trust_id=None): + super(BaseGenericPlugin, self).__init__(auth_url=auth_url) + + self._project_id = project_id or tenant_id + self._project_name = project_name or tenant_name + self._project_domain_id = project_domain_id + self._project_domain_name = project_domain_name + self._domain_id = domain_id + self._domain_name = domain_name + self._trust_id = trust_id + + self._plugin = None + + @abc.abstractmethod + def create_plugin(self, session, version, url, raw_status=None): + """Create a plugin from the given paramters. + + This function will be called multiple times with the version and url + of a potential endpoint. If a plugin can be constructed that fits the + params then it should return it. If not return None and then another + call will be made with other available URLs. + + :param Session session: A session object. + :param tuple version: A tuple of the API version at the URL. + :param string url: The base URL for this version. + :param string raw_status: The status that was in the discovery field. + + :returns: A plugin that can match the parameters or None if nothing. + """ + return None + + @property + def _has_domain_scope(self): + """Are there domain parameters. + + Domain parameters are v3 only so returns if any are set. + + :returns: True if a domain parameter is set, false otherwise. + """ + return any([self._domain_id, self._domain_name, + self._project_domain_id, self._project_domain_name]) + + @property + def _v2_params(self): + """Parameters that are common to v2 plugins.""" + return {'trust_id': self._trust_id, + 'tenant_id': self._project_id, + 'tenant_name': self._project_name} + + @property + def _v3_params(self): + """Parameters that are common to v3 plugins.""" + return {'trust_id': self._trust_id, + 'project_id': self._project_id, + 'project_name': self._project_name, + 'project_domain_id': self._project_domain_id, + 'project_domain_name': self._project_domain_name, + 'domain_id': self._domain_id, + 'domain_name': self._domain_name} + + def _do_create_plugin(self, session): + plugin = None + + try: + disc = self.get_discovery(session, + self.auth_url, + authenticated=False) + except (exceptions.DiscoveryFailure, + exceptions.HTTPError, + exceptions.ConnectionError): + LOG.warn('Discovering versions from the identity service failed ' + 'when creating the password plugin. Attempting to ' + 'determine version from URL.') + + url_parts = urlparse.urlparse(self.auth_url) + path = url_parts.path.lower() + + if path.startswith('/v2.0') and not self._has_domain_scope: + plugin = self.create_plugin(session, (2, 0), self.auth_url) + elif path.startswith('/v3'): + plugin = self.create_plugin(session, (3, 0), self.auth_url) + + else: + disc_data = disc.version_data() + + for data in disc_data: + version = data['version'] + + if (_discover.version_match((2,), version) and + self._has_domain_scope): + # NOTE(jamielennox): if there are domain parameters there + # is no point even trying against v2 APIs. + continue + + plugin = self.create_plugin(session, + version, + data['url'], + raw_status=data['raw_status']) + + if plugin: + break + + if plugin: + return plugin + + # so there were no URLs that i could use for auth of any version. + msg = 'Could not determine a suitable URL for the plugin' + raise exceptions.DiscoveryFailure(msg) + + def get_auth_ref(self, session, **kwargs): + if not self._plugin: + self._plugin = self._do_create_plugin(session) + + return self._plugin.get_auth_ref(session, **kwargs) + + @classmethod + def get_options(cls): + options = super(BaseGenericPlugin, cls).get_options() + options.extend(get_options()) + return options diff --git a/keystoneclient/auth/identity/generic/password.py b/keystoneclient/auth/identity/generic/password.py new file mode 100644 index 0000000..c8d9b7a --- /dev/null +++ b/keystoneclient/auth/identity/generic/password.py @@ -0,0 +1,83 @@ +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + +import logging + +from oslo.config import cfg + +from keystoneclient import _discover +from keystoneclient.auth.identity.generic import base +from keystoneclient.auth.identity import v2 +from keystoneclient.auth.identity import v3 +from keystoneclient import utils + +LOG = logging.getLogger(__name__) + + +def get_options(): + return [ + cfg.StrOpt('user-name', dest='username', help='Username', + deprecated_name='username'), + cfg.StrOpt('user-domain-id', help="User's domain id"), + cfg.StrOpt('user-domain-name', help="User's domain name"), + cfg.StrOpt('password', help="User's password"), + ] + + +class Password(base.BaseGenericPlugin): + """A common user/password authentication plugin.""" + + @utils.positional() + def __init__(self, auth_url, username=None, user_id=None, password=None, + user_domain_id=None, user_domain_name=None, **kwargs): + """Construct plugin. + + :param string username: Username for authentication. + :param string user_id: User ID for authentication. + :param string password: Password for authentication. + :param string user_domain_id: User's domain ID for authentication. + :param string user_domain_name: User's domain name for authentication. + """ + super(Password, self).__init__(auth_url=auth_url, **kwargs) + + self._username = username + self._user_id = user_id + self._password = password + self._user_domain_id = user_domain_id + self._user_domain_name = user_domain_name + + def create_plugin(self, session, version, url, raw_status=None): + if _discover.version_match((2,), version): + if self._user_domain_id or self._user_domain_name: + # If you specify any domain parameters it won't work so quit. + return None + + return v2.Password(auth_url=url, + user_id=self._user_id, + username=self._username, + password=self._password, + **self._v2_params) + + elif _discover.version_match((3,), version): + return v3.Password(auth_url=url, + user_id=self._user_id, + username=self._username, + user_domain_id=self._user_domain_id, + user_domain_name=self._user_domain_name, + password=self._password, + **self._v3_params) + + @classmethod + def get_options(cls): + options = super(Password, cls).get_options() + options.extend(get_options()) + return options diff --git a/keystoneclient/auth/identity/generic/token.py b/keystoneclient/auth/identity/generic/token.py new file mode 100644 index 0000000..547ce36 --- /dev/null +++ b/keystoneclient/auth/identity/generic/token.py @@ -0,0 +1,52 @@ +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + +import logging + +from oslo.config import cfg + +from keystoneclient import _discover +from keystoneclient.auth.identity.generic import base +from keystoneclient.auth.identity import v2 +from keystoneclient.auth.identity import v3 + +LOG = logging.getLogger(__name__) + + +def get_options(): + return [ + cfg.StrOpt('token', help='Token to authenticate with'), + ] + + +class Token(base.BaseGenericPlugin): + + def __init__(self, auth_url, token=None, **kwargs): + """Construct a plugin. + + :param string token: Token for authentication. + """ + super(Token, self).__init__(auth_url, **kwargs) + self._token = token + + def create_plugin(self, session, version, url, raw_status=None): + if _discover.version_match((2,), version): + return v2.Token(url, self._token, **self._v2_params) + + elif _discover.version_match((3,), version): + return v3.Token(url, self._token, **self._v3_params) + + @classmethod + def get_options(cls): + options = super(Token, cls).get_options() + options.extend(get_options()) + return options |