keystone.cmd package

Submodules

keystone.cmd.all module

keystone.cmd.all.main()

keystone.cmd.cli module

class keystone.cmd.cli.BaseApp

Bases: object

classmethod add_argument_parser(subparsers)

name = None

class keystone.cmd.cli.BaseCertificateSetup

Bases: keystone.cmd.cli.BasePermissionsSetup

Provides common options for certificate setup.

classmethod add_argument_parser(subparsers)

class keystone.cmd.cli.BasePermissionsSetup

Bases: keystone.cmd.cli.BaseApp

Common user/group setup for file permissions.

classmethod add_argument_parser(subparsers)

static get_user_group()

class keystone.cmd.cli.BootStrap

Bases: keystone.cmd.cli.BaseApp

Perform the basic bootstrap process

classmethod add_argument_parser(subparsers)

do_bootstrap()

Perform the bootstrap actions.

Create bootstrap user, project, and role so that CMS, humans, or scripts can continue to perform initial setup (domains, projects, services, endpoints, etc) of Keystone when standing up a new deployment.

load_backends()

classmethod main()

name = 'bootstrap'

class keystone.cmd.cli.DbSync

Bases: keystone.cmd.cli.BaseApp

Sync the database.

classmethod add_argument_parser(subparsers)

static main()

name = 'db_sync'

class keystone.cmd.cli.DbVersion

Bases: keystone.cmd.cli.BaseApp

Print the current migration version of the database.

classmethod add_argument_parser(subparsers)

static main()

name = 'db_version'

class keystone.cmd.cli.DomainConfigUpload

Bases: keystone.cmd.cli.BaseApp

Upload the domain specific configuration files to the database.

classmethod add_argument_parser(subparsers)

static main()

name = 'domain_config_upload'

class keystone.cmd.cli.DomainConfigUploadFiles(domain_config_finder=<function _domain_config_finder at 0x7f77afd16a28>)

Bases: object

load_backends()

read_domain_configs_from_files()

Read configs from file(s) and load into database.

The command line parameters have already been parsed and the CONF command option will have been set. It is either set to the name of an explicit domain, or it’s None to indicate that we want all domain config files.

run()

upload_config_to_database(file_name, domain_name)

Upload a single config file to the database.

Parameters:

• file_name – the file containing the config options
• domain_name – the domain name

Raises:

• ValueError – the domain does not exist or already has domain specific configurations defined.
• Exceptions from oslo config – there is an issue with options defined in the config file or its format.

The caller of this method should catch the errors raised and handle appropriately in order that the best UX experience can be provided for both the case of when a user has asked for a specific config file to be uploaded, as well as all config files in a directory.

upload_configs_to_database(file_name, domain_name)

Upload configs from file and load into database.

This method will be called repeatedly for all the config files in the config directory. To provide a better UX, we differentiate the error handling in this case (versus when the user has asked for a single config file to be uploaded).

valid_options()

Validate the options, returning True if they are indeed valid.

It would be nice to use the argparse automated checking for this validation, but the only way I can see doing that is to make the default (i.e. if no optional parameters are specified) to upload all configuration files - and that sounds too dangerous as a default. So we use it in a slightly unconventional way, where all parameters are optional, but you must specify at least one.

class keystone.cmd.cli.FernetRotate

Bases: keystone.cmd.cli.BasePermissionsSetup

Rotate Fernet encryption keys.

This assumes you have already run keystone-manage fernet_setup.

A new primary key is placed into rotation, which is used for new tokens. The old primary key is demoted to secondary, which can then still be used for validating tokens. Excess secondary keys (beyond [fernet_tokens] max_active_keys) are revoked. Revoked keys are permanently deleted. A new staged key will be created and used to validate tokens. The next time key rotation takes place, the staged key will be put into rotation as the primary key.

Rotating keys too frequently, or with [fernet_tokens] max_active_keys set too low, will cause tokens to become invalid prior to their expiration.

classmethod main()

name = 'fernet_rotate'

class keystone.cmd.cli.FernetSetup

Bases: keystone.cmd.cli.BasePermissionsSetup

Setup a key repository for Fernet tokens.

This also creates a primary key used for both creating and validating Fernet tokens. To improve security, you should rotate your keys (using keystone-manage fernet_rotate, for example).

classmethod main()

name = 'fernet_setup'

class keystone.cmd.cli.MappingEngineTester

Bases: keystone.cmd.cli.BaseApp

Execute mapping engine locally.

classmethod add_argument_parser(subparsers)

classmethod main()

name = 'mapping_engine'

static normalize_assertion(assertion)

static normalize_rules(rules)

static read_file(path)

static read_rules(path)

class keystone.cmd.cli.MappingPurge

Bases: keystone.cmd.cli.BaseApp

Purge the mapping table.

classmethod add_argument_parser(subparsers)

static main()

name = 'mapping_purge'

class keystone.cmd.cli.PKISetup

Bases: keystone.cmd.cli.BaseCertificateSetup

Set up Key pairs and certificates for token signing and verification.

This is NOT intended for production use, see Keystone Configuration documentation for details. As of the Mitaka release, this command has been DEPRECATED and may be removed in the ‘O’ release.

classmethod main()

name = 'pki_setup'

class keystone.cmd.cli.SSLSetup

Bases: keystone.cmd.cli.BaseCertificateSetup

Create key pairs and certificates for HTTPS connections.

This is NOT intended for production use, see Keystone Configuration documentation for details.

classmethod main()

name = 'ssl_setup'

class keystone.cmd.cli.SamlIdentityProviderMetadata

Bases: keystone.cmd.cli.BaseApp

Generate Identity Provider metadata.

static main()

name = 'saml_idp_metadata'

class keystone.cmd.cli.TokenFlush

Bases: keystone.cmd.cli.BaseApp

Flush expired tokens from the backend.

classmethod main()

name = 'token_flush'

keystone.cmd.cli.add_command_parsers(subparsers)

keystone.cmd.cli.main(argv=None, config_files=None)

keystone.cmd.manage module

keystone.cmd.manage.main()

Module contents