keystone.identity package

Subpackages

• keystone.identity.backends package
  • Submodules
  • keystone.identity.backends.ldap module
  • keystone.identity.backends.sql module
  • Module contents
• keystone.identity.id_generators package
  • Submodules
  • keystone.identity.id_generators.sha256 module
  • Module contents
• keystone.identity.mapping_backends package
  • Submodules
  • keystone.identity.mapping_backends.mapping module
  • keystone.identity.mapping_backends.sql module
  • Module contents
• keystone.identity.shadow_backends package
  • Submodules
  • keystone.identity.shadow_backends.sql module
  • Module contents

Submodules

keystone.identity.controllers module

Workflow Logic the Identity service.

class keystone.identity.controllers.GroupV3

Bases: keystone.common.controller.V3Controller

collection_name = 'groups'

create_group(context, *args, **kwargs)

delete_group(context, *args, **kwargs)

get_group(context, *args, **kwargs)

list_groups(context, **kwargs)

list_groups_for_user(context, **kwargs)

member_name = 'group'

update_group(context, *args, **kwargs)

class keystone.identity.controllers.User(*args, **kwargs)

Bases: keystone.common.controller.V2Controller

create_user(*args, **kwargs)

delete_user(*args, **kwargs)

get_user(*args, **kwargs)

get_user_by_name(*args, **kwargs)

get_users(*args, **kwargs)

set_user_enabled(*args, **kwargs)

set_user_password(*args, **kwargs)

update_user(*args, **kwargs)

class keystone.identity.controllers.UserV3

Bases: keystone.common.controller.V3Controller

add_user_to_group(context, *args, **kwargs)

change_password(context, *args, **kwargs)

check_user_in_group(context, *args, **kwargs)

collection_name = 'users'

create_user(context, *args, **kwargs)

delete_user(context, *args, **kwargs)

get_user(context, *args, **kwargs)

list_users(context, **kwargs)

list_users_in_group(context, **kwargs)

member_name = 'user'

remove_user_from_group(context, *args, **kwargs)

update_user(context, *args, **kwargs)

keystone.identity.core module

Main entry point into the Identity service.

class keystone.identity.core.DomainConfigs(*args, **kwargs)

Bases: dict

Discover, store and provide access to domain specific configs.

The setup_domain_drivers() call will be made via the wrapper from the first call to any driver function handled by this manager.

Domain specific configurations are only supported for the identity backend and the individual configurations are either specified in the resource database or in individual domain configuration files, depending on the setting of the ‘domain_configurations_from_database’ config option.

The result will be that for each domain with a specific configuration, this class will hold a reference to a ConfigOpts and driver object that the identity manager and driver can use.

check_config_and_reload_domain_driver_if_required(domain_id)

Check for, and load, any new domain specific config for this domain.

This is only supported for the database-stored domain specific configuration.

When the domain specific drivers were set up, we stored away the specific config for this domain that was available at that time. So we now read the current version and compare. While this might seem somewhat inefficient, the sensitive config call is cached, so should be light weight. More importantly, when the cache timeout is reached, we will get any config that has been updated from any other keystone process.

This cache-timeout approach works for both multi-process and multi-threaded keystone configurations. In multi-threaded configurations, even though we might remove a driver object (that could be in use by another thread), this won’t actually be thrown away until all references to it have been broken. When that other thread is released back and is restarted with another command to process, next time it accesses the driver it will pickup the new one.

configured = False

driver = None

get_domain_conf(domain_id)

get_domain_driver(domain_id)

lock = <thread.lock object at 0x7f77b2515cb0>

reload_domain_driver(domain_id)

setup_domain_drivers(standard_driver, resource_api)

class keystone.identity.core.IdentityDriverV8

Bases: object

Interface description for an Identity driver.

add_user_to_group(user_id, group_id)

Adds a user to a group.

Raises:

• keystone.exception.UserNotFound – If the user doesn’t exist.
• keystone.exception.GroupNotFound – If the group doesn’t exist.

authenticate(user_id, password)

Authenticate a given user and password.

Returns:user_ref Raises AssertionError:  If user or password is invalid.

check_user_in_group(user_id, group_id)

Checks if a user is a member of a group.

Raises:

• keystone.exception.UserNotFound – If the user doesn’t exist.
• keystone.exception.GroupNotFound – If the group doesn’t exist.

create_group(group_id, group)

Creates a new group.

Raises keystone.exception.Conflict:  If a duplicate group exists.

create_user(user_id, user)

Creates a new user.

Raises keystone.exception.Conflict:  If a duplicate user exists.

default_assignment_driver()

delete_group(group_id)

Deletes an existing group.

Raises keystone.exception.GroupNotFound:  If the group doesn’t exist.

delete_user(user_id)

Deletes an existing user.

Raises keystone.exception.UserNotFound:  If the user doesn’t exist.

generates_uuids()

Indicates if Driver generates UUIDs as the local entity ID.

get_group(group_id)

Get a group by ID.

Returns:group_ref Raises keystone.exception.GroupNotFound:  If the group doesn’t exist.

get_group_by_name(group_name, domain_id)

Get a group by name.

Returns:group_ref Raises keystone.exception.GroupNotFound:  If the group doesn’t exist.

get_user(user_id)

Get a user by ID.

Returns:user_ref Raises keystone.exception.UserNotFound:  If the user doesn’t exist.

get_user_by_name(user_name, domain_id)

Get a user by name.

Returns:user_ref Raises keystone.exception.UserNotFound:  If the user doesn’t exist.

is_domain_aware()

Indicates if Driver supports domains.

is_sql

Indicates if this Driver uses SQL.

list_groups(hints)

List groups in the system.

Parameters:hints – filter hints which the driver should implement if at all possible. Returns:a list of group_refs or an empty list.

list_groups_for_user(user_id, hints)

List groups a user is in

Parameters:

• user_id – the user in question
• hints – filter hints which the driver should implement if at all possible.

Returns:

a list of group_refs or an empty list.

list_users(hints)

List users in the system.

Parameters:hints – filter hints which the driver should implement if at all possible. Returns:a list of user_refs or an empty list.

list_users_in_group(group_id, hints)

List users in a group.

Parameters:

• group_id – the group in question
• hints – filter hints which the driver should implement if at all possible.

Returns:

a list of user_refs or an empty list.

multiple_domains_supported

remove_user_from_group(user_id, group_id)

Removes a user from a group.

Raises keystone.exception.NotFound:  If the entity not found.

update_group(group_id, group)

Updates an existing group.

Raises:

• keystone.exception.GroupNotFound – If the group doesn’t exist.
• keystone.exception.Conflict – If a duplicate group exists.

update_user(user_id, user)

Updates an existing user.

Raises:

• keystone.exception.UserNotFound – If the user doesn’t exist.
• keystone.exception.Conflict – If a duplicate user exists.

class keystone.identity.core.Manager(*args, **kwargs)

Bases: keystone.common.manager.Manager

Default pivot point for the Identity backend.

See keystone.common.manager.Manager for more details on how this dynamically calls the backend.

This class also handles the support of domain specific backends, by using the DomainConfigs class. The setup call for DomainConfigs is called from with the @domains_configured wrapper in a lazy loading fashion to get around the fact that we can’t satisfy the assignment api it needs from within our __init__() function since the assignment driver is not itself yet initialized.

Each of the identity calls are pre-processed here to choose, based on domain, which of the drivers should be called. The non-domain-specific driver is still in place, and is used if there is no specific driver for the domain in question (or we are not using multiple domain drivers).

Starting with Juno, in order to be able to obtain the domain from just an ID being presented as part of an API call, a public ID to domain and local ID mapping is maintained. This mapping also allows for the local ID of drivers that do not provide simple UUIDs (such as LDAP) to be referenced via a public facing ID. The mapping itself is automatically generated as entities are accessed via the driver.

This mapping is only used when: - the entity is being handled by anything other than the default driver, or - the entity is being handled by the default LDAP driver and backward compatible IDs are not required.

This means that in the standard case of a single SQL backend or the default settings of a single LDAP backend (since backward compatible IDs is set to True by default), no mapping is used. An alternative approach would be to always use the mapping table, but in the cases where we don’t need it to make the public and local IDs the same. It is felt that not using the mapping by default is a more prudent way to introduce this functionality.

add_user_to_group(*args, **kwargs)

assert_user_enabled(*args, **kwargs)

Assert the user and the user’s domain are enabled.

:raise AssertionError if the user or the user’s domain is disabled.

authenticate(*args, **kwargs)

change_password(*args, **kwargs)

check_user_in_group(*args, **kwargs)

create_group(*args, **kwargs)

create_user(*args, **kwargs)

delete_group(*args, **kwargs)

delete_user(*args, **kwargs)

driver_namespace = 'keystone.identity'

emit_invalidate_grant_token_persistence(*args, **kwargs)

Emit a notification to the callback system to revoke grant tokens.

This method and associated callback listener removes the need for making a direct call to another manager to delete and revoke tokens.

Parameters:user_project (dict) – {‘user_id’: user_id, ‘project_id’: project_id}

emit_invalidate_user_token_persistence(*args, **kwargs)

Emit a notification to the callback system to revoke user tokens.

This method and associated callback listener removes the need for making a direct call to another manager to delete and revoke tokens.

Parameters:user_id (string) – user identifier

get_group(*args, **kwargs)

get_group_by_name(*args, **kwargs)

get_user(*args, **kwargs)

get_user_by_name(*args, **kwargs)

list_groups(*args, **kwargs)

list_groups_for_user(*args, **kwargs)

list_users(*args, **kwargs)

list_users_in_group(*args, **kwargs)

remove_user_from_group(*args, **kwargs)

shadow_federated_user(*args, **kwargs)

Shadows a federated user by mapping to a user.

Parameters:

• idp_id – identity provider id
• protocol_id – protocol id
• unique_id – unique id for the user within the IdP
• display_name – user’s display name

Returns:

dictionary of the mapped User entity

update_group(*args, **kwargs)

update_user(*args, **kwargs)

class keystone.identity.core.MappingDriverV8

Bases: object

Interface description for an ID Mapping driver.

create_id_mapping(local_entity, public_id=None)

Create and store a mapping to a public_id.

Parameters:

• local_entity (dict) – Containing the entity domain, local ID and type (‘user’ or ‘group’).
• public_id – If specified, this will be the public ID. If this is not specified, a public ID will be generated.

Returns:

public ID

delete_id_mapping(public_id)

Deletes an entry for the given public_id.

Parameters:public_id – The public ID for the mapping to be deleted.

The method is silent if no mapping is found.

get_id_mapping(public_id)

Returns the local mapping.

Parameters:public_id – The public ID for the mapping required. Returns dict:Containing the entity domain, local ID and type. If no mapping is found, it returns None.

get_public_id(local_entity)

Returns the public ID for the given local entity.

Parameters:local_entity (dict) – Containing the entity domain, local ID and type (‘user’ or ‘group’). Returns:public ID, or None if no mapping is found.

purge_mappings(purge_filter)

Purge selected identity mappings.

Parameters:purge_filter (dict) – Containing the attributes of the filter that defines which entries to purge. An empty filter means purge all mappings.

class keystone.identity.core.MappingManager(*args, **kwargs)

Bases: keystone.common.manager.Manager

Default pivot point for the ID Mapping backend.

driver_namespace = 'keystone.identity.id_mapping'

class keystone.identity.core.ShadowUsersDriverV9

Bases: object

Interface description for an Shadow Users driver.

create_federated_user(federated_dict)

Create a new user with the federated identity

Parameters:

• federated_dict (dict) – Reference to the federated user
• user_id – user ID for linking to the federated identity

Returns dict:

Containing the user reference

get_federated_user(idp_id, protocol_id, unique_id)

Returns the found user for the federated identity

Parameters:

• idp_id – The identity provider ID
• protocol_id – The federation protocol ID
• unique_id – The unique ID for the user

Returns dict:

Containing the user reference

update_federated_user_display_name(idp_id, protocol_id, unique_id, display_name)

Updates federated user’s display name if changed

Parameters:

• idp_id – The identity provider ID
• protocol_id – The federation protocol ID
• unique_id – The unique ID for the user
• display_name – The user’s display name

class keystone.identity.core.ShadowUsersManager(*args, **kwargs)

Bases: keystone.common.manager.Manager

Default pivot point for the Shadow Users backend.

driver_namespace = 'keystone.identity.shadow_users'

keystone.identity.core.domains_configured(f)

Wraps API calls to lazy load domain configs after init.

This is required since the assignment manager needs to be initialized before this manager, and yet this manager’s init wants to be able to make assignment calls (to build the domain configs). So instead, we check if the domains have been initialized on entry to each call, and if requires load them,

keystone.identity.core.exception_translated(exception_type)

Wraps API calls to map to correct exception.

keystone.identity.core.filter_user(user_ref)

Filter out private items in a user dict.

‘password’, ‘tenants’ and ‘groups’ are never returned.

Returns:user_ref

keystone.identity.generator module

ID Generator provider interface.

class keystone.identity.generator.IDGenerator

Bases: object

Interface description for an ID Generator provider.

generate_public_ID(mapping)

Return a Public ID for the given mapping dict.

Parameters:mapping (dict) – The items to be hashed.

The ID must be reproducible and no more than 64 chars in length. The ID generated should be independent of the order of the items in the mapping dict.

class keystone.identity.generator.Manager(*args, **kwargs)

Bases: keystone.common.manager.Manager

Default pivot point for the identifier generator backend.

driver_namespace = 'keystone.identity.id_generator'

keystone.identity.routers module

WSGI Routers for the Identity service.

class keystone.identity.routers.Admin(mapper=None)

Bases: keystone.common.wsgi.ComposableRouter

add_routes(mapper)

class keystone.identity.routers.Routers

Bases: keystone.common.wsgi.RoutersBase

append_v3_routers(mapper, routers)

keystone.identity.schema module

Module contents