keystone.tests.unit package

Subpackages

• keystone.tests.unit.assignment package
  • Subpackages
    • keystone.tests.unit.assignment.role_backends package
      • Submodules
      • keystone.tests.unit.assignment.role_backends.test_sql module
      • Module contents
  • Submodules
  • keystone.tests.unit.assignment.test_backends module
  • keystone.tests.unit.assignment.test_core module
  • Module contents
• keystone.tests.unit.auth package
  • Submodules
  • keystone.tests.unit.auth.test_controllers module
  • keystone.tests.unit.auth.test_schema module
  • Module contents
• keystone.tests.unit.backend package
  • Submodules
  • keystone.tests.unit.backend.core_ldap module
  • keystone.tests.unit.backend.core_sql module
  • Module contents
• keystone.tests.unit.catalog package
  • Submodules
  • keystone.tests.unit.catalog.test_backends module
  • keystone.tests.unit.catalog.test_core module
  • Module contents
• keystone.tests.unit.common package
  • Submodules
  • keystone.tests.unit.common.test_authorization module
  • keystone.tests.unit.common.test_cache module
  • keystone.tests.unit.common.test_database_conflicts module
  • keystone.tests.unit.common.test_injection module
  • keystone.tests.unit.common.test_json_home module
  • keystone.tests.unit.common.test_notifications module
  • keystone.tests.unit.common.test_resource_options_common module
  • keystone.tests.unit.common.test_sql_core module
  • keystone.tests.unit.common.test_utils module
  • Module contents
• keystone.tests.unit.contrib package
  • Subpackages
    • keystone.tests.unit.contrib.federation package
      • Submodules
      • keystone.tests.unit.contrib.federation.test_utils module
      • Module contents
  • Module contents
• keystone.tests.unit.credential package
  • Submodules
  • keystone.tests.unit.credential.test_backend_sql module
  • keystone.tests.unit.credential.test_fernet_provider module
  • Module contents
• keystone.tests.unit.endpoint_policy package
  • Subpackages
    • keystone.tests.unit.endpoint_policy.backends package
      • Submodules
      • keystone.tests.unit.endpoint_policy.backends.test_base module
      • keystone.tests.unit.endpoint_policy.backends.test_sql module
      • Module contents
  • Module contents
• keystone.tests.unit.external package
  • Submodules
  • keystone.tests.unit.external.test_timeutils module
  • Module contents
• keystone.tests.unit.federation package
  • Submodules
  • keystone.tests.unit.federation.test_core module
  • Module contents
• keystone.tests.unit.identity package
  • Subpackages
    • keystone.tests.unit.identity.backends package
      • Submodules
      • keystone.tests.unit.identity.backends.test_base module
      • keystone.tests.unit.identity.backends.test_ldap module
      • keystone.tests.unit.identity.backends.test_ldap_common module
      • keystone.tests.unit.identity.backends.test_sql module
      • Module contents
    • keystone.tests.unit.identity.shadow_users package
      • Submodules
      • keystone.tests.unit.identity.shadow_users.test_backend module
      • keystone.tests.unit.identity.shadow_users.test_core module
      • Module contents
  • Submodules
  • keystone.tests.unit.identity.test_backend_sql module
  • keystone.tests.unit.identity.test_backends module
  • keystone.tests.unit.identity.test_controllers module
  • keystone.tests.unit.identity.test_core module
  • Module contents
• keystone.tests.unit.ksfixtures package
  • Submodules
  • keystone.tests.unit.ksfixtures.auth_plugins module
  • keystone.tests.unit.ksfixtures.backendloader module
  • keystone.tests.unit.ksfixtures.cache module
  • keystone.tests.unit.ksfixtures.database module
  • keystone.tests.unit.ksfixtures.hacking module
  • keystone.tests.unit.ksfixtures.key_repository module
  • keystone.tests.unit.ksfixtures.ldapdb module
  • keystone.tests.unit.ksfixtures.policy module
  • keystone.tests.unit.ksfixtures.temporaryfile module
  • Module contents
• keystone.tests.unit.policy package
  • Subpackages
    • keystone.tests.unit.policy.backends package
      • Submodules
      • keystone.tests.unit.policy.backends.test_base module
      • keystone.tests.unit.policy.backends.test_sql module
      • Module contents
  • Submodules
  • keystone.tests.unit.policy.test_backends module
  • Module contents
• keystone.tests.unit.resource package
  • Subpackages
    • keystone.tests.unit.resource.backends package
      • Submodules
      • keystone.tests.unit.resource.backends.test_sql module
      • Module contents
    • keystone.tests.unit.resource.config_backends package
      • Submodules
      • keystone.tests.unit.resource.config_backends.test_sql module
      • Module contents
  • Submodules
  • keystone.tests.unit.resource.test_backends module
  • keystone.tests.unit.resource.test_controllers module
  • keystone.tests.unit.resource.test_core module
  • Module contents
• keystone.tests.unit.schema package
  • Submodules
  • keystone.tests.unit.schema.v2 module
  • Module contents
• keystone.tests.unit.tests package
  • Submodules
  • keystone.tests.unit.tests.test_core module
  • keystone.tests.unit.tests.test_utils module
  • Module contents
• keystone.tests.unit.token package
  • Submodules
  • keystone.tests.unit.token.test_backends module
  • keystone.tests.unit.token.test_common module
  • keystone.tests.unit.token.test_fernet_provider module
  • keystone.tests.unit.token.test_token_data_helper module
  • keystone.tests.unit.token.test_token_model module
  • keystone.tests.unit.token.test_uuid_provider module
  • Module contents
• keystone.tests.unit.trust package
  • Submodules
  • keystone.tests.unit.trust.test_backends module
  • Module contents

Submodules

keystone.tests.unit.core module

class keystone.tests.unit.core.BaseTestCase(*args, **kwargs)

Bases: testtools.testcase.TestCase

Light weight base test class.

This is a placeholder that will eventually go away once the setup/teardown in TestCase is properly trimmed down to the bare essentials. This is really just a play to speed up the tests by eliminating unnecessary work.

cleanup_instance(*names)

Create a function suitable for use with self.addCleanup.

Returns:a callable that uses a closure to delete instance attributes

setUp()

skip_if_env_not_set(env_var)

skip_test_overrides(*args, **kwargs)

class keystone.tests.unit.core.EggLoader(spec)

Bases: paste.deploy.loadwsgi.EggLoader

find_egg_entry_point(object_type, name=None)

class keystone.tests.unit.core.SQLDriverOverrides

Bases: object

A mixin for consolidating sql-specific test overrides.

config_overrides()

class keystone.tests.unit.core.TestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.BaseTestCase

assertCloseEnoughForGovernmentWork(a, b, delta=3)

Assert that two datetimes are nearly equal within a small delta.

Parameters:delta – Maximum allowable time delta, defined in seconds.

assertNotEmpty(l)

assertRaisesRegexp(expected_exception, expected_regexp, callable_obj, *args, **kwargs)

Assert that the message in a raised exception matches a regexp.

assertTimestampEqual(expected, value)

assertUserDictEqual(expected, observed, message='')

Assert that a user dict is equal to another user dict.

User dictionaries have some variable values that should be ignored in the comparison. This method is a helper that strips those elements out when comparing the user dictionary. This normalized these differences that should not change the comparison.

config(config_files)

config_files()

config_overrides()

ipv6_enabled

load_backends()

Initialize each manager and assigns them to an attribute.

load_fixtures(fixtures)

Hacky basic and naive fixture loading based on a python module.

Expects that the various APIs into the various services are already defined on self.

loadapp(config, name='main')

make_request(path='/', **kwargs)

setUp()

skip_if_no_ipv6()

exception keystone.tests.unit.core.UnexpectedExit

Bases: exceptions.Exception

keystone.tests.unit.core.create_user(api, domain_id, **kwargs)

Create a user via the API. Keep the created password.

The password is saved and restored when api.create_user() is called. Only use this routine if there is a requirement for the user object to have a valid password after api.create_user() is called.

class keystone.tests.unit.core.dirs

Bases: object

static etc(*p)

static root(*p)

static tests(*p)

static tests_conf(*p)

static tmp(*p)

keystone.tests.unit.core.new_cert_credential(user_id, project_id=None, blob=None, **kwargs)

keystone.tests.unit.core.new_credential_ref(user_id, project_id=None, type='cert', **kwargs)

keystone.tests.unit.core.new_domain_ref(**kwargs)

keystone.tests.unit.core.new_ec2_credential(user_id, project_id=None, blob=None, **kwargs)

keystone.tests.unit.core.new_endpoint_ref(service_id, interface='public', region_id=<object object>, **kwargs)

keystone.tests.unit.core.new_endpoint_ref_with_region(service_id, region, interface='public', **kwargs)

Define an endpoint_ref having a pre-3.2 form.

Contains the deprecated ‘region’ instead of ‘region_id’.

keystone.tests.unit.core.new_federated_user_ref(idp_id=None, protocol_id=None, **kwargs)

keystone.tests.unit.core.new_group_ref(domain_id, **kwargs)

keystone.tests.unit.core.new_policy_ref(**kwargs)

keystone.tests.unit.core.new_project_ref(domain_id=None, is_domain=False, **kwargs)

keystone.tests.unit.core.new_region_ref(parent_region_id=None, **kwargs)

keystone.tests.unit.core.new_role_ref(**kwargs)

keystone.tests.unit.core.new_service_ref(**kwargs)

keystone.tests.unit.core.new_totp_credential(user_id, project_id=None, blob=None)

keystone.tests.unit.core.new_trust_ref(trustor_user_id, trustee_user_id, project_id=None, impersonation=None, expires=None, role_ids=None, role_names=None, remaining_uses=None, allow_redelegation=False, redelegation_count=None, **kwargs)

keystone.tests.unit.core.new_user_ref(domain_id, project_id=None, **kwargs)

keystone.tests.unit.core.remove_test_databases()

keystone.tests.unit.core.skip_if_cache_disabled(*sections)

Skip a test if caching is disabled, this is a decorator.

Caching can be disabled either globally or for a specific section.

In the code fragment:

@skip_if_cache_is_disabled('assignment', 'token')
def test_method(*args):
    ...

The method test_method would be skipped if caching is disabled globally via the enabled option in the cache section of the configuration or if the caching option is set to false in either assignment or token sections of the configuration. This decorator can be used with no arguments to only check global caching.

If a specified configuration section does not define the caching option, this decorator makes the same assumption as the should_cache_fn in keystone.common.cache that caching should be enabled.

keystone.tests.unit.core.skip_if_cache_is_enabled(*sections)

keystone.tests.unit.core.skip_if_no_multiple_domains_support(f)

Decorator to skip tests for identity drivers limited to one domain.

keystone.tests.unit.default_fixtures module

keystone.tests.unit.fakeldap module

Fake LDAP server for test harness.

This class does very little error checking, and knows nothing about ldap class definitions. It implements the minimum emulation of the python ldap library to work with keystone.

class keystone.tests.unit.fakeldap.FakeLdap(conn=None)

Bases: keystone.identity.backends.ldap.common.LDAPHandler

Emulate the python-ldap API.

The python-ldap API requires all strings to be UTF-8 encoded. This is assured by the caller of this interface (i.e. KeystoneLDAPHandler).

However, internally this emulation MUST process and store strings in a canonical form which permits operations on characters. Encoded strings do not provide the ability to operate on characters. Therefore this emulation accepts UTF-8 encoded strings, decodes them to unicode for operations internal to this emulation, and encodes them back to UTF-8 when returning values from the emulation.

add_s(dn, modlist)

Add an object with the specified attributes at dn.

connect(url, page_size=0, alias_dereferencing=None, use_tls=False, tls_cacertfile=None, tls_cacertdir=None, tls_req_cert='demand', chase_referrals=None, debug_level=None, use_pool=None, pool_size=None, pool_retry_max=None, pool_retry_delay=None, pool_conn_timeout=None, pool_conn_lifetime=None, conn_timeout=None)

delete_ext_s(dn, serverctrls, clientctrls=None)

Remove the ldap object at specified dn.

delete_s(dn)

Remove the ldap object at specified dn.

dn(dn)

get_option(option)

key(dn)

modify_s(dn, modlist)

Modify the object at dn using the attribute list.

Parameters:

• dn – an LDAP DN
• modlist – a list of tuples in the following form: ([MOD_ADD | MOD_DELETE | MOD_REPACE], attribute, value)

result3(msgid=-1, all=1, timeout=None, resp_ctrl_classes=None)

Execute async request.

Only msgid param is supported. Request info is fetched from global variable PendingRequests by msgid, executed using search_s and limited if requested.

search_ext(base, scope, filterstr='(objectClass=*)', attrlist=None, attrsonly=0, serverctrls=None, clientctrls=None, timeout=-1, sizelimit=0)

search_s(base, scope, filterstr='(objectClass=*)', attrlist=None, attrsonly=0)

Search for all matching objects under base using the query.

Args: base – dn to search under scope – search scope (base, subtree, onelevel) filterstr – filter objects by attrlist – attrs to return. Returns all attrs if not specified

set_option(option, invalue)

simple_bind_s(who='', cred='', serverctrls=None, clientctrls=None)

Provide for compatibility but this method is ignored.

unbind_s()

Provide for compatibility but this method is ignored.

class keystone.tests.unit.fakeldap.FakeLdapNoSubtreeDelete(conn=None)

Bases: keystone.tests.unit.fakeldap.FakeLdap

FakeLdap subclass that does not support subtree delete.

Same as FakeLdap except delete will throw the LDAP error ldap.NOT_ALLOWED_ON_NONLEAF if there is an attempt to delete an entry that has children.

delete_ext_s(dn, serverctrls, clientctrls=None)

Remove the ldap object at specified dn.

class keystone.tests.unit.fakeldap.FakeLdapPool(uri, retry_max=None, retry_delay=None, conn=None)

Bases: keystone.tests.unit.fakeldap.FakeLdap

Emulate the python-ldap API with pooled connections.

This class is used as connector class in PooledLDAPHandler.

get_lifetime()

simple_bind_s(who=None, cred=None, serverctrls=None, clientctrls=None)

unbind_ext_s()

Added to extend FakeLdap as connector class.

class keystone.tests.unit.fakeldap.FakeShelve

Bases: dict

sync()

keystone.tests.unit.federation_fixtures module

keystone.tests.unit.filtering module

class keystone.tests.unit.filtering.FilterTests

Bases: object

keystone.tests.unit.identity_mapping module

keystone.tests.unit.identity_mapping.list_id_mappings()

List all id_mappings for testing purposes.

keystone.tests.unit.mapping_fixtures module

Fixtures for Federation Mapping.

keystone.tests.unit.rest module

class keystone.tests.unit.rest.RestfulTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

Performs restful tests against the WSGI app over HTTP.

This class launches public & admin WSGI servers for every test, which can be accessed by calling public_request() or admin_request(), respectfully.

restful_request() and request() methods are also exposed if you need to bypass restful conventions or access HTTP details in your test implementation.

Three new asserts are provided:

• assertResponseSuccessful: called automatically for every request

  unless an expected_status is provided

• assertResponseStatus: called instead of assertResponseSuccessful,

  if an expected_status is provided

• assertValidResponseHeaders: validates that the response headers

  appear as expected

Requests are automatically serialized according to the defined content_type. Responses are automatically deserialized as well, and available in the response.body attribute. The original body content is available in the response.raw attribute.

admin_request(**kwargs)

assertResponseStatus(response, expected_status)

Assert a specific status code on the response.

Parameters:

• response – httplib.HTTPResponse
• expected_status – The specific status result expected

example:

self.assertResponseStatus(response, http_client.NO_CONTENT)

assertResponseSuccessful(response)

Assert that a status code lies inside the 2xx range.

Parameters:response – httplib.HTTPResponse to be verified to have a status code between 200 and 299.

example:

self.assertResponseSuccessful(response)

assertValidErrorResponse(response, expected_status=400)

Verify that the error response is valid.

Subclasses can override this function based on the expected response.

assertValidResponseHeaders(response)

Ensure that response headers appear as expected.

auth_plugin_config_override(methods=None, **method_classes)

content_type = 'json'

get_admin_token()

get_scoped_token(tenant_id=None)

Convenience method so that we can test authenticated requests.

get_unscoped_token()

Convenience method so that we can test authenticated requests.

public_request(**kwargs)

request(app, path, body=None, headers=None, token=None, expected_status=None, **kwargs)

restful_request(method='GET', headers=None, body=None, content_type=None, response_content_type=None, **kwargs)

Serialize/deserialize json as request/response body.

Warning

• Existing Accept header will be overwritten.
• Existing Content-Type header will be overwritten.

setUp(app_conf='keystone')

keystone.tests.unit.test_associate_project_endpoint_extension module

class keystone.tests.unit.test_associate_project_endpoint_extension.EndpointFilterCRUDTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_associate_project_endpoint_extension.EndpointFilterTestCase

test_check_endpoint_project_association()

HEAD /OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id}.

Valid project and endpoint id test case.

test_check_endpoint_project_association_with_invalid_endpoint()

HEAD /OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id}.

Invalid endpoint id test case.

test_check_endpoint_project_association_with_invalid_project()

HEAD /OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id}.

Invalid project id test case.

test_create_endpoint_project_association()

PUT /OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id}.

Valid endpoint and project id test case.

test_create_endpoint_project_association_invalidates_cache(*args, **kwargs)

test_create_endpoint_project_association_with_invalid_endpoint()

PUT /OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id}.

Invalid endpoint id test case.

test_create_endpoint_project_association_with_invalid_project()

PUT OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id}.

Invalid project id test case.

test_create_endpoint_project_association_with_unexpected_body()

PUT /OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id}.

Unexpected body in request. The body should be ignored.

test_endpoint_project_association_cleanup_when_endpoint_deleted()

test_endpoint_project_association_cleanup_when_project_deleted()

test_list_endpoints_associated_with_invalid_project()

GET /OS-EP-FILTER/projects/{project_id}/endpoints.

Invalid project id test case.

test_list_endpoints_associated_with_valid_project()

GET /OS-EP-FILTER/projects/{project_id}/endpoints.

Valid project and endpoint id test case.

test_list_projects_associated_with_endpoint()

GET /OS-EP-FILTER/endpoints/{endpoint_id}/projects.

Valid endpoint-project association test case.

test_list_projects_associated_with_invalid_endpoint()

GET /OS-EP-FILTER/endpoints/{endpoint_id}/projects.

Invalid endpoint id test case.

test_list_projects_with_no_endpoint_project_association()

GET /OS-EP-FILTER/endpoints/{endpoint_id}/projects.

Valid endpoint id but no endpoint-project associations test case.

test_remove_endpoint_from_project_invalidates_cache(*args, **kwargs)

test_remove_endpoint_project_association()

DELETE /OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id}.

Valid project id and endpoint id test case.

test_remove_endpoint_project_association_with_invalid_endpoint()

DELETE /OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id}.

Invalid endpoint id test case.

test_remove_endpoint_project_association_with_invalid_project()

DELETE /OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id}.

Invalid project id test case.

class keystone.tests.unit.test_associate_project_endpoint_extension.EndpointFilterTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

config_overrides()

setUp()

class keystone.tests.unit.test_associate_project_endpoint_extension.EndpointFilterTokenRequestTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_associate_project_endpoint_extension.EndpointFilterTestCase

test_default_scoped_token_using_endpoint_filter()

Verify endpoints from default scoped token filtered.

test_disabled_endpoint()

Test that a disabled endpoint is handled.

test_get_auth_catalog_using_endpoint_filter()

test_invalid_endpoint_project_association()

Verify an invalid endpoint-project association is handled.

test_multiple_endpoint_project_associations()

test_project_scoped_token_using_endpoint_filter()

Verify endpoints from project scoped token filtered.

test_scoped_token_with_no_catalog_using_endpoint_filter()

Verify endpoint filter does not affect no catalog.

class keystone.tests.unit.test_associate_project_endpoint_extension.EndpointGroupCRUDTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_associate_project_endpoint_extension.EndpointFilterTestCase

DEFAULT_ENDPOINT_GROUP_BODY = {'endpoint_group': {'filters': {'interface': 'admin'}, 'description': 'endpoint group description', 'name': 'endpoint_group_name'}}

DEFAULT_ENDPOINT_GROUP_URL = '/OS-EP-FILTER/endpoint_groups'

test_add_endpoint_group_to_project()

Create a valid endpoint group and project association.

test_add_endpoint_group_to_project_invalidates_catalog_cache(*args, **kwargs)

test_add_endpoint_group_to_project_with_invalid_project_id()

Create an invalid endpoint group and project association.

test_check_endpoint_group()

HEAD /OS-EP-FILTER/endpoint_groups/{endpoint_group_id}.

Valid endpoint_group_id test case.

test_check_endpoint_group_to_project()

Test HEAD with a valid endpoint group and project association.

test_check_endpoint_group_to_project_with_invalid_project_id()

Test HEAD with an invalid endpoint group and project association.

test_check_invalid_endpoint_group()

HEAD /OS-EP-FILTER/endpoint_groups/{endpoint_group_id}.

Invalid endpoint_group_id test case.

test_create_endpoint_group()

POST /OS-EP-FILTER/endpoint_groups.

Valid endpoint group test case.

test_create_invalid_endpoint_group()

POST /OS-EP-FILTER/endpoint_groups.

Invalid endpoint group creation test case.

test_delete_endpoint_group()

GET /OS-EP-FILTER/endpoint_groups/{endpoint_group}.

Valid endpoint group test case.

test_delete_invalid_endpoint_group()

GET /OS-EP-FILTER/endpoint_groups/{endpoint_group}.

Invalid endpoint group test case.

test_empty_endpoint_groups_in_project()

Test when no endpoint groups associated with the project.

test_endpoint_group_project_cleanup_with_endpoint_group()

test_endpoint_group_project_cleanup_with_project()

test_get_endpoint_group()

GET /OS-EP-FILTER/endpoint_groups/{endpoint_group}.

Valid endpoint group test case.

test_get_endpoint_group_in_project()

Test retrieving project endpoint group association.

test_get_invalid_endpoint_group()

GET /OS-EP-FILTER/endpoint_groups/{endpoint_group}.

Invalid endpoint group test case.

test_get_invalid_endpoint_group_in_project()

Test retrieving project endpoint group association.

test_list_endpoint_groups()

GET /OS-EP-FILTER/endpoint_groups.

test_list_endpoint_groups_in_invalid_project()

Test retrieving from invalid project.

test_list_endpoint_groups_in_project()

GET /OS-EP-FILTER/projects/{project_id}/endpoint_groups.

test_list_endpoints_associated_with_endpoint_group()

GET /OS-EP-FILTER/endpoint_groups/{endpoint_group}/endpoints.

Valid endpoint group test case.

test_list_endpoints_associated_with_project_endpoint_group()

GET /OS-EP-FILTER/projects/{project_id}/endpoints.

Valid project, endpoint id, and endpoint group test case.

test_list_projects_associated_with_endpoint_group()

GET /OS-EP-FILTER/endpoint_groups/{endpoint_group}/projects.

Valid endpoint group test case.

test_patch_endpoint_group()

PATCH /OS-EP-FILTER/endpoint_groups/{endpoint_group}.

Valid endpoint group patch test case.

test_patch_invalid_endpoint_group()

PATCH /OS-EP-FILTER/endpoint_groups/{endpoint_group}.

Valid endpoint group patch test case.

test_patch_nonexistent_endpoint_group()

PATCH /OS-EP-FILTER/endpoint_groups/{endpoint_group}.

Invalid endpoint group patch test case.

test_remove_endpoint_group_from_project_invalidates_cache(*args, **kwargs)

test_remove_endpoint_group_with_project_association()

test_removing_an_endpoint_group_project()

class keystone.tests.unit.test_associate_project_endpoint_extension.JsonHomeTests(*args, **kwargs)

Bases: keystone.tests.unit.test_associate_project_endpoint_extension.EndpointFilterTestCase, keystone.tests.unit.test_v3.JsonHomeTestMixin

JSON_HOME_DATA = {'https://docs.openstack.org/api/openstack-identity/3/ext/OS-EP-FILTER/1.0/rel/endpoint_groups': {'href': '/OS-EP-FILTER/endpoint_groups'}, 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-EP-FILTER/1.0/rel/project_endpoint_groups': {'href-vars': {'project_id': 'https://docs.openstack.org/api/openstack-identity/3/param/project_id'}, 'href-template': '/OS-EP-FILTER/projects/{project_id}/endpoint_groups'}, 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-EP-FILTER/1.0/rel/endpoint_group': {'href-vars': {'endpoint_group_id': 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-EP-FILTER/1.0/param/endpoint_group_id'}, 'href-template': '/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}'}, 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-EP-FILTER/1.0/rel/endpoints_in_endpoint_group': {'href-vars': {'endpoint_group_id': 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-EP-FILTER/1.0/param/endpoint_group_id'}, 'href-template': '/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/endpoints'}, 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-EP-FILTER/1.0/rel/endpoint_projects': {'href-vars': {'endpoint_id': 'https://docs.openstack.org/api/openstack-identity/3/param/endpoint_id'}, 'href-template': '/OS-EP-FILTER/endpoints/{endpoint_id}/projects'}, 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-EP-FILTER/1.0/rel/endpoint_group_to_project_association': {'href-vars': {'project_id': 'https://docs.openstack.org/api/openstack-identity/3/param/project_id', 'endpoint_group_id': 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-EP-FILTER/1.0/param/endpoint_group_id'}, 'href-template': '/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/projects/{project_id}'}, 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-EP-FILTER/1.0/rel/projects_associated_with_endpoint_group': {'href-vars': {'endpoint_group_id': 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-EP-FILTER/1.0/param/endpoint_group_id'}, 'href-template': '/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/projects'}}

keystone.tests.unit.test_auth module

class keystone.tests.unit.test_auth.AuthBadRequests(*args, **kwargs)

Bases: keystone.tests.unit.test_auth.AuthTest

test_authenticate_blank_auth()

Verify sending blank ‘auth’ raises the right exception.

test_authenticate_blank_request_body()

Verify sending empty json dict raises the right exception.

test_authenticate_fails_if_project_unsafe()

Verify authenticate to a project with unsafe name fails.

test_authenticate_invalid_auth_content()

Verify sending invalid ‘auth’ raises the right exception.

test_authenticate_password_too_large()

Verify sending large ‘password’ raises the right exception.

test_authenticate_tenant_id_too_large()

Verify sending large ‘tenantId’ raises the right exception.

test_authenticate_tenant_name_too_large()

Verify sending large ‘tenantName’ raises the right exception.

test_authenticate_token_too_large()

Verify sending large ‘token’ raises the right exception.

test_authenticate_user_id_too_large()

Verify sending large ‘userId’ raises the right exception.

test_authenticate_username_too_large()

Verify sending large ‘username’ raises the right exception.

test_empty_remote_user()

Verify exception is raised when REMOTE_USER is an empty string.

test_empty_username_and_userid_in_auth()

Verify that empty username and userID raises ValidationError.

test_no_credentials_in_auth()

Verify that the method generator raises exception if no creds.

test_no_external_auth()

Verify that _authenticate_external() raises exception if N/A.

test_no_token_in_auth()

Verify that authenticate raises exception if no token.

class keystone.tests.unit.test_auth.AuthCatalog(*args, **kwargs)

Bases: keystone.tests.unit.core.SQLDriverOverrides, keystone.tests.unit.test_auth.AuthTest

Test for the catalog provided in the auth response.

config_files()

test_auth_catalog_disabled_endpoint()

On authenticate, get a catalog that excludes disabled endpoints.

test_validate_catalog_disabled_endpoint()

On validate, get back a catalog that excludes disabled endpoints.

class keystone.tests.unit.test_auth.AuthTest(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

assertEqualTokens(a, b, enforce_audit_ids=True)

Assert that two tokens are equal.

Compare two tokens except for their ids. This also truncates the time in the comparison.

setUp()

class keystone.tests.unit.test_auth.AuthWithPasswordCredentials(*args, **kwargs)

Bases: keystone.tests.unit.test_auth.AuthTest

test_auth_empty_password()

Verify exception is raised if empty password.

test_auth_invalid_user()

Verify exception is raised if invalid user.

test_auth_no_password()

Verify exception is raised if empty password.

test_auth_valid_user_invalid_password()

Verify exception is raised if invalid password.

test_authenticate_blank_password_credentials()

Sending empty dict as passwordCredentials raises 400 Bad Requset.

test_authenticate_no_username()

Verify skipping username raises the right exception.

test_bind_without_remote_user()

test_change_default_domain_id()

class keystone.tests.unit.test_auth.AuthWithRemoteUser

Bases: object

test_bind_with_kerberos()

test_bind_without_config_opt()

test_scoped_nometa_remote_authn()

Verify getting a token with external authn and no metadata.

test_scoped_remote_authn()

Verify getting a token with external authn.

test_scoped_remote_authn_invalid_user()

Verify that external auth with invalid user fails.

test_unscoped_remote_authn()

Verify getting an unscoped token with external authn.

test_unscoped_remote_authn_jsonless()

Verify that external auth with invalid request fails.

class keystone.tests.unit.test_auth.AuthWithToken

Bases: object

test_auth_bad_formatted_token()

Verify exception is raised if invalid token.

test_auth_invalid_token()

Verify exception is raised if invalid token.

test_auth_scoped_token_bad_project_with_debug()

Authenticating with an invalid project fails.

test_auth_scoped_token_bad_project_without_debug()

Authenticating with an invalid project fails.

test_auth_token_project_group_role()

Verify getting a token in a tenant with group roles.

test_auth_unscoped_token_no_project()

Verify getting an unscoped token with an unscoped token.

test_auth_unscoped_token_project()

Verify getting a token in a tenant with an unscoped token.

test_belongs_to()

test_belongs_to_no_tenant()

test_deleting_role_assignment_does_not_revoke_unscoped_token()

test_deleting_role_revokes_token()

test_only_original_audit_id_is_kept()

test_revoke_by_audit_chain_id_chained_token()

test_revoke_by_audit_chain_id_original_token()

test_token_auth_with_binding()

test_unscoped_token()

Verify getting an unscoped token with password creds.

class keystone.tests.unit.test_auth.AuthWithTrust

Bases: object

assert_token_count_for_trust(trust, expected_value)

build_v2_token_request(username, password, trust, tenant_id=None)

config_overrides()

create_trust(trust_data, trustor_name, expires_at=None, impersonation=True)

disable_user(user)

fetch_v2_token_from_trust(trust)

fetch_v3_token_from_trust(trust, trustee)

get_unscoped_token(username, password='foo2')

setUp()

test_create_trust()

test_create_trust_bad_data_fails()

test_create_trust_expires_bad()

test_create_trust_expires_older_than_now()

test_create_trust_impersonation()

test_create_trust_no_impersonation()

test_create_trust_no_roles()

test_create_trust_without_project_id()

Verify that trust can be created without project id.

Also, token can be generated with that trust.

test_create_v3_token_from_trust()

test_delete_tokens_for_user_invalidates_tokens_from_trust()

test_delete_trust_revokes_token()

test_do_not_consume_remaining_uses_when_get_token_fails()

test_expired_trust_get_token_fails()

test_get_trust()

test_token_from_trust()

test_token_from_trust_cant_get_another_token()

test_token_from_trust_with_no_role_fails()

test_token_from_trust_with_wrong_role_fails()

test_token_from_trust_wrong_project_fails()

test_token_from_trust_wrong_user_fails()

test_trust_get_token_fails_if_trustee_disabled()

test_trust_get_token_fails_if_trustor_disabled()

test_trust_get_token_fails_with_future_token_if_trustee_disabled()

Test disabling trustee and using an unrevoked token.

This test simulates what happens when a token is generated after the disable event. Technically this should not happen, but it’s possible in a multinode deployment with only a slight clock skew.

test_v3_trust_token_get_token_fails()

test_validate_trust_scoped_token_against_v2()

test_validate_v3_trust_scoped_token_against_v2_succeeds()

class keystone.tests.unit.test_auth.FernetAuthWithRemoteUser(*args, **kwargs)

Bases: keystone.tests.unit.test_auth.AuthWithRemoteUser, keystone.tests.unit.test_auth.AuthTest

config_overrides()

test_bind_with_kerberos()

class keystone.tests.unit.test_auth.FernetAuthWithToken(*args, **kwargs)

Bases: keystone.tests.unit.test_auth.AuthWithToken, keystone.tests.unit.test_auth.AuthTest

config_overrides()

test_deleting_role_revokes_token()

test_token_auth_with_binding()

class keystone.tests.unit.test_auth.FernetAuthWithTrust(*args, **kwargs)

Bases: keystone.tests.unit.test_auth.AuthWithTrust, keystone.tests.unit.test_auth.AuthTest

config_overrides()

setUp()

test_delete_tokens_for_user_invalidates_tokens_from_trust()

test_delete_trust_revokes_token()

test_trust_get_token_fails_with_future_token_if_trustee_disabled()

Test disabling trustee and using an unrevoked token.

This test simulates what happens when a Fernet token is generated after the disable event. Technically this should not happen, but it’s possible in a multinode deployment with only a slight clock skew.

class keystone.tests.unit.test_auth.NonDefaultAuthTest(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

test_add_non_default_auth_method()

class keystone.tests.unit.test_auth.TokenExpirationTest(*args, **kwargs)

Bases: keystone.tests.unit.test_auth.AuthTest

test_maintain_uuid_token_expiration()

class keystone.tests.unit.test_auth.UUIDAuthWithRemoteUser(*args, **kwargs)

Bases: keystone.tests.unit.test_auth.AuthWithRemoteUser, keystone.tests.unit.test_auth.AuthTest

config_overrides()

class keystone.tests.unit.test_auth.UUIDAuthWithToken(*args, **kwargs)

Bases: keystone.tests.unit.test_auth.AuthWithToken, keystone.tests.unit.test_auth.AuthTest

config_overrides()

class keystone.tests.unit.test_auth.UUIDAuthWithTrust(*args, **kwargs)

Bases: keystone.tests.unit.test_auth.AuthWithTrust, keystone.tests.unit.test_auth.AuthTest

config_overrides()

setUp()

keystone.tests.unit.test_auth_plugin module

class keystone.tests.unit.test_auth_plugin.SimpleChallengeResponse

Bases: keystone.auth.plugins.base.AuthMethodHandler

authenticate(context, auth_payload)

class keystone.tests.unit.test_auth_plugin.TestAuthPlugin(*args, **kwargs)

Bases: keystone.tests.unit.core.SQLDriverOverrides, keystone.tests.unit.core.TestCase

setUp()

test_addition_auth_steps()

test_duplicate_method()

test_unsupported_auth_method()

class keystone.tests.unit.test_auth_plugin.TestAuthPluginDynamicOptions(*args, **kwargs)

Bases: keystone.tests.unit.test_auth_plugin.TestAuthPlugin

config_files()

config_overrides()

class keystone.tests.unit.test_auth_plugin.TestMapped(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

config_files()

setUp()

test_mapped_with_remote_user()

test_supporting_multiple_methods()

keystone.tests.unit.test_backend_endpoint_policy module

class keystone.tests.unit.test_backend_endpoint_policy.PolicyAssociationTests

Bases: object

load_sample_data()

Create sample data to test policy associations.

The following data is created:

• 3 regions, in a hierarchy, 0 -> 1 -> 2 (where 0 is top)
• 3 services
• 6 endpoints, 2 in each region, with a mixture of services: 0 - region 0, Service 0 1 - region 0, Service 1 2 - region 1, Service 1 3 - region 1, Service 2 4 - region 2, Service 2 5 - region 2, Service 0

test_delete_association_by_entity()

test_invalid_policy_to_endpoint_association()

test_overwriting_policy_to_endpoint_association()

test_policy_to_endpoint_association_crud()

test_policy_to_explicit_endpoint_association()

test_policy_to_region_and_service_association()

test_policy_to_service_association()

keystone.tests.unit.test_backend_endpoint_policy_sql module

class keystone.tests.unit.test_backend_endpoint_policy_sql.SqlPolicyAssociationTable(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_sql.SqlModels

Set of tests for checking SQL Policy Association Mapping.

test_policy_association_mapping()

class keystone.tests.unit.test_backend_endpoint_policy_sql.SqlPolicyAssociationTests(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_sql.SqlTests, keystone.tests.unit.test_backend_endpoint_policy.PolicyAssociationTests

load_fixtures(fixtures)

keystone.tests.unit.test_backend_federation_sql module

class keystone.tests.unit.test_backend_federation_sql.SqlFederation(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_sql.SqlModels

Set of tests for checking SQL Federation.

test_federated_protocol()

test_identity_provider()

test_idp_remote_ids()

test_mapping()

test_service_provider()

keystone.tests.unit.test_backend_id_mapping_sql module

class keystone.tests.unit.test_backend_id_mapping_sql.SqlIDMapping(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_sql.SqlTests

clean_sample_data()

load_sample_data()

setUp()

test_cache_when_id_mapping_crud(*args, **kwargs)

test_create_duplicate_mapping()

test_delete_public_id_is_silent()

test_get_domain_mapping_list()

test_id_mapping_crud()

test_id_mapping_handles_unicode()

test_invalid_public_key()

test_invalidate_cache_when_purge_mappings(*args, **kwargs)

test_purge_mappings()

class keystone.tests.unit.test_backend_id_mapping_sql.SqlIDMappingTable(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_sql.SqlModels

Set of tests for checking SQL Identity ID Mapping.

test_id_mapping()

keystone.tests.unit.test_backend_kvs module

class keystone.tests.unit.test_backend_kvs.KvsToken(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase, keystone.tests.unit.token.test_backends.TokenTests

config_overrides()

setUp()

test_cleanup_user_index_on_create()

test_flush_expired_token()

class keystone.tests.unit.test_backend_kvs.KvsTokenCacheInvalidation(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase, keystone.tests.unit.token.test_backends.TokenCacheInvalidation

config_overrides()

setUp()

keystone.tests.unit.test_backend_ldap module

class keystone.tests.unit.test_backend_ldap.AssignmentTests

Bases: keystone.tests.unit.assignment.test_backends.AssignmentTests

test_del_role_assignment_by_domain_not_found()

test_delete_role_with_user_and_group_grants()

test_get_and_remove_correct_role_grant_from_a_mix()

test_get_and_remove_role_grant_by_group_and_cross_domain()

test_get_and_remove_role_grant_by_user_and_cross_domain()

test_get_and_remove_role_grant_by_user_and_domain()

test_get_role_assignment_by_domain_not_found()

test_get_roles_for_groups_on_domain()

test_get_roles_for_groups_on_project()

test_get_roles_for_user_and_domain()

test_list_domains_for_groups()

test_list_projects_for_groups()

test_list_role_assignment_containing_names()

test_multi_group_grants_on_project_domain()

test_multi_role_grant_by_user_group_on_project_domain()

test_role_grant_by_group_and_cross_domain_project()

test_role_grant_by_user_and_cross_domain_project()

class keystone.tests.unit.test_backend_ldap.BaseLDAPIdentity

Bases: keystone.tests.unit.test_backend_ldap.IdentityTests, keystone.tests.unit.test_backend_ldap.AssignmentTests, keystone.tests.unit.test_backend_ldap.ResourceTests

config_files()

config_overrides()

get_config(domain_id)

get_user_enabled_vals(user)

new_user_ref(domain_id, project_id=None, **kwargs)

setUp()

test_add_remove_user_group_deprecated(*args, **keywargs)

test_authenticate_requires_simple_bind()

test_build_tree()

Regression test for building the tree names.

test_cache_layer_group_crud(*args, **kwargs)

test_configurable_allowed_user_actions()

test_create_project_with_domain_id_and_without_parent_id()

Multiple domains are not supported.

test_create_project_with_domain_id_mismatch_to_parent_domain()

Multiple domains are not supported.

test_create_user_none_mapping()

test_create_user_with_boolean_string_names()

test_get_and_remove_role_grant_by_group_and_domain()

test_get_and_remove_role_grant_by_group_and_project()

test_group_crud(*args, **keywargs)

test_group_enabled_ignored_disable_error()

test_list_domains()

test_list_group_members_missing_entry()

List group members with deleted user.

If a group has a deleted entry for a member, the non-deleted members are returned.

test_list_group_members_when_no_members()

test_list_groups_by_name_and_with_filter()

test_list_projects_for_user()

test_list_projects_for_user_and_groups()

test_list_projects_for_user_with_grants()

test_list_role_assignment_by_domain()

Multiple domain assignments are not supported.

test_list_role_assignment_by_user_with_domain_group_roles()

Multiple domain assignments are not supported.

test_list_role_assignment_using_sourced_groups_with_domains()

Multiple domain assignments are not supported.

test_list_role_assignments_unfiltered()

test_list_users_by_name_and_with_filter()

test_remove_foreign_assignments_when_deleting_a_domain()

Multiple domains are not supported.

test_remove_role_grant_from_user_and_project()

test_unignored_user_none_mapping()

test_update_user_name()

A user’s name cannot be changed through the LDAP driver.

test_user_enabled_ignored_disable_error()

test_user_filter()

test_user_id_comma()

Even if the user has a , in their ID, groups can be listed.

test_user_id_comma_grants()

List user and group grants, even with a comma in the user’s ID.

class keystone.tests.unit.test_backend_ldap.BaseMultiLDAPandSQLIdentity

Bases: object

Mixin class with support methods for domain-specific config testing.

check_user(user, domain_id, expected_status)

Check user is in correct backend.

As part of the tests, we want to force ourselves to manually select the driver for a given domain, to make sure the entity ended up in the correct backend.

create_users_across_domains()

Create a set of users, each with a role on their own domain.

setup_initial_domains()

test_authenticate_to_each_domain()

Test that a user in each domain can authenticate.

class keystone.tests.unit.test_backend_ldap.DomainSpecificLDAPandSQLIdentity(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_ldap.BaseLDAPIdentity, keystone.tests.unit.core.SQLDriverOverrides, keystone.tests.unit.core.TestCase, keystone.tests.unit.test_backend_ldap.BaseMultiLDAPandSQLIdentity

Class to test when all domains use specific configs, including SQL.

We define a set of domains and domain-specific backends:

• A separate LDAP backend for the default domain
• A separate SQL backend for domain1

Although the default driver still exists, we don’t use it.

DOMAIN_COUNT = 2

DOMAIN_SPECIFIC_COUNT = 2

assert_backends()

config_overrides()

get_config(domain_id)

load_fixtures(fixtures)

setUp()

test_create_project_with_domain_id_and_without_parent_id()

test_create_project_with_domain_id_mismatch_to_parent_domain()

test_delete_domain()

test_delete_domain_with_project_api()

test_domain_segregation()

Test that separate configs have segregated the domain.

Test Plan:

• Users were created in each domain as part of setup, now make sure you can only find a given user in its relevant domain/backend
• Make sure that for a backend that supports multiple domains you can get the users via any of its domains

test_get_domain_mapping_list_is_used()

test_group_enabled_ignored_disable_error()

test_list_domains()

test_list_domains_filtered_and_limited()

test_list_role_assignments_filtered_by_role()

test_list_users()

test_user_enabled_ignored_disable_error()

test_user_id_comma()

class keystone.tests.unit.test_backend_ldap.DomainSpecificSQLIdentity(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_ldap.DomainSpecificLDAPandSQLIdentity

Class to test simplest use of domain-specific SQL driver.

The simplest use of an SQL domain-specific backend is when it is used to augment the standard case when LDAP is the default driver defined in the main config file. This would allow, for example, service users to be stored in SQL while LDAP handles the rest. Hence we define:

• The default driver uses the LDAP backend for the default domain
• A separate SQL backend for domain1

DOMAIN_COUNT = 2

DOMAIN_SPECIFIC_COUNT = 1

assert_backends()

config_overrides()

get_config(domain_id)

test_default_sql_plus_sql_specific_driver_fails()

test_multiple_sql_specific_drivers_fails()

class keystone.tests.unit.test_backend_ldap.IdentityTests

Bases: keystone.tests.unit.identity.test_backends.IdentityTests

test_arbitrary_attributes_are_returned_from_get_user()

test_create_duplicate_group_name_in_different_domains()

test_create_duplicate_user_name_in_different_domains()

test_delete_group_with_user_project_domain_links()

test_delete_user_with_group_project_domain_links()

test_move_group_between_domains()

test_move_user_between_domains()

test_new_arbitrary_attributes_are_returned_from_update_user()

test_updated_arbitrary_attributes_are_returned_from_update_user()

class keystone.tests.unit.test_backend_ldap.LDAPIdentity(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_ldap.BaseLDAPIdentity, keystone.tests.unit.core.TestCase

load_fixtures(fixtures)

setUp()

test_base_ldap_connection_deref_option()

test_cache_layer_project_crud(*args, **kwargs)

test_chase_referrals_off(*args, **keywargs)

test_chase_referrals_on(*args, **keywargs)

test_configurable_allowed_project_actions()

test_create_domain()

test_create_domain_case_sensitivity(*args, **kwargs)

test_debug_level_set(*args, **keywargs)

test_domain_rename_invalidates_get_domain_by_name_cache()

test_get_default_domain_by_name()

test_get_id_from_dn_for_multivalued_attribute_id(*args, **keywargs)

test_id_attribute_not_found(*args, **keywargs)

test_list_domains()

test_list_groups_for_user_no_dn()

test_list_groups_no_dn()

test_list_users_no_dn()

test_multi_role_grant_by_user_group_on_project_domain()

test_parse_extra_attribute_mapping()

test_project_crud()

test_project_rename_invalidates_get_project_by_name_cache()

test_update_is_domain_field()

test_user_api_get_connection_no_user_password(*args, **keywargs)

Bind anonymously when the user and password are blank.

test_user_description_attribute_mapping()

test_user_enable_attribute_mask()

test_user_enabled_attribute_handles_expired(*args, **keywargs)

test_user_enabled_attribute_handles_utf8(*args, **keywargs)

test_user_enabled_invert()

test_user_enabled_invert_default_str_value(*args, **keywargs)

test_user_enabled_invert_no_enabled_value(*args, **keywargs)

test_user_extra_attribute_mapping()

test_user_extra_attribute_mapping_description_is_returned()

test_user_id_attribute_in_create()

test_user_id_attribute_map()

test_user_id_not_in_dn(*args, **keywargs)

test_user_mixed_case_attribute(*args, **keywargs)

test_user_name_in_dn(*args, **keywargs)

test_user_with_missing_id()

test_wrong_alias_dereferencing()

test_wrong_ldap_scope()

class keystone.tests.unit.test_backend_ldap.LDAPIdentityEnabledEmulation(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_ldap.LDAPIdentity

config_files()

config_overrides()

load_fixtures(fixtures)

setUp()

test_delete_user_group_cleanup()

test_escape_member_dn()

test_project_crud()

test_user_auth_emulated()

test_user_crud(*args, **keywargs)

test_user_enable_attribute_mask()

test_user_enabled_attribute_handles_utf8(*args, **keywargs)

test_user_enabled_invert()

test_user_enabled_invert_default_str_value()

test_user_enabled_invert_no_enabled_value()

test_user_enabled_use_group_config()

class keystone.tests.unit.test_backend_ldap.LDAPLimitTests(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase, keystone.tests.unit.identity.test_backends.LimitTests

config_files()

config_overrides()

setUp()

class keystone.tests.unit.test_backend_ldap.LDAPMatchingRuleInChainTests(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_ldap.LDAPTestSetup

config_files()

config_overrides()

setUp()

test_get_group()

test_list_groups()

test_list_groups_for_user()

test_list_user_groups()

class keystone.tests.unit.test_backend_ldap.LDAPPosixGroupsTest(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_ldap.LDAPTestSetup

config_files()

config_overrides()

load_fixtures(fixtures)

setUp()

test_posix_member_id()

class keystone.tests.unit.test_backend_ldap.LDAPTestSetup(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

Common setup for LDAP tests.

setUp()

class keystone.tests.unit.test_backend_ldap.LdapFilterTests(*args, **kwargs)

Bases: keystone.tests.unit.identity.test_backends.FilterTests, keystone.tests.unit.test_backend_ldap.LDAPTestSetup

config_files()

config_overrides()

setUp()

test_list_users_in_group_exact_filtered(*args, **kwargs)

test_list_users_in_group_inexact_filtered(*args, **kwargs)

class keystone.tests.unit.test_backend_ldap.LdapIdentityWithMapping(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_ldap.BaseLDAPIdentity, keystone.tests.unit.core.SQLDriverOverrides, keystone.tests.unit.core.TestCase

Class to test mapping of default LDAP backend.

The default configuration is not to enable mapping when using a single backend LDAP driver. However, a cloud provider might want to enable the mapping, hence hiding the LDAP IDs from any clients of keystone. Setting backward_compatible_ids to False will enable this mapping.

config_files()

config_overrides()

setUp()

test_dynamic_mapping_build()

Test to ensure entities not create via controller are mapped.

Many LDAP backends will, essentially, by Read Only. In these cases the mapping is not built by creating objects, rather from enumerating the entries. We test this here my manually deleting the mapping and then trying to re-read the entries.

test_list_domains()

class keystone.tests.unit.test_backend_ldap.MultiLDAPandSQLIdentity(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_ldap.BaseLDAPIdentity, keystone.tests.unit.core.SQLDriverOverrides, keystone.tests.unit.core.TestCase, keystone.tests.unit.test_backend_ldap.BaseMultiLDAPandSQLIdentity

Class to test common SQL plus individual LDAP backends.

We define a set of domains and domain-specific backends:

• A separate LDAP backend for the default domain
• A separate LDAP backend for domain1
• domain2 shares the same LDAP as domain1, but uses a different tree attach point
• An SQL backend for all other domains (which will include domain3 and domain4)

Normally one would expect that the default domain would be handled as part of the “other domains” - however the above provides better test coverage since most of the existing backend tests use the default domain.

assert_backends()

config_overrides()

enable_multi_domain()

Enable the chosen form of multi domain configuration support.

This method enables the file-based configuration support. Child classes that wish to use the database domain configuration support should override this method and set the appropriate config_fixture option.

get_config(domain_id)

load_fixtures(fixtures)

setUp()

test_create_project_with_domain_id_and_without_parent_id()

test_create_project_with_domain_id_mismatch_to_parent_domain()

test_delete_domain_with_user_added()

test_domain_segregation()

Test that separate configs have segregated the domain.

Test Plan:

• Users were created in each domain as part of setup, now make sure you can only find a given user in its relevant domain/backend
• Make sure that for a backend that supports multiple domains you can get the users via any of its domains

test_existing_uuids_work()

Test that ‘uni-domain’ created IDs still work.

Throwing the switch to domain-specific backends should not cause existing identities to be inaccessible via ID.

test_group_enabled_ignored_disable_error()

test_list_limit_domain_specific_inheritance(*args, **keywargs)

test_list_limit_domain_specific_override(*args, **keywargs)

test_list_role_assignment_by_domain()

test_list_role_assignment_by_user_with_domain_group_roles()

test_list_role_assignment_using_sourced_groups_with_domains()

test_list_role_assignments_filtered_by_role()

test_list_users()

test_remove_foreign_assignments_when_deleting_a_domain()

test_scanning_of_config_dir()

Test the Manager class scans the config directory.

The setup for the main tests above load the domain configs directly so that the test overrides can be included. This test just makes sure that the standard config directory scanning does pick up the relevant domain config files.

test_user_enabled_ignored_disable_error()

class keystone.tests.unit.test_backend_ldap.MultiLDAPandSQLIdentityDomainConfigsInSQL(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_ldap.MultiLDAPandSQLIdentity

Class to test the use of domain configs stored in the database.

Repeat the same tests as MultiLDAPandSQLIdentity, but instead of using the domain specific config files, store the domain specific values in the database.

assert_backends()

enable_multi_domain()

test_delete_domain_clears_sql_registration()

Ensure registration is deleted when a domain is deleted.

test_domain_config_has_no_impact_if_database_support_disabled()

Ensure database domain configs have no effect if disabled.

Set reading from database configs to false, restart the backends and then try and set and use database configs.

test_orphaned_registration_does_not_prevent_getting_sql_driver()

Ensure we self heal an orphaned sql registration.

test_reloading_domain_config()

Ensure domain drivers are reloaded on a config modification.

test_same_domain_gets_sql_driver()

Ensure we can set an SQL driver if we have had it before.

test_setting_multiple_sql_driver_raises_exception()

Ensure setting multiple domain specific sql drivers is prevented.

class keystone.tests.unit.test_backend_ldap.ResourceTests

Bases: keystone.tests.unit.resource.test_backends.ResourceTests

test_cache_layer_domain_crud()

test_cannot_enable_cascade_with_parent_disabled()

test_check_hierarchy_depth()

test_check_leaf_projects()

test_create_domain_under_regular_project_hierarchy_fails()

test_create_duplicate_project_name_in_different_domains()

test_create_project_passing_is_domain_flag_true()

test_create_project_under_disabled_one()

test_create_project_with_invalid_parent()

test_create_project_with_parent_id_and_without_domain_id()

test_delete_hierarchical_leaf_project()

test_delete_hierarchical_not_leaf_project()

test_disable_hierarchical_leaf_project()

test_disable_hierarchical_not_leaf_project()

test_domain_crud()

test_domain_delete_hierarchy()

test_enable_project_with_disabled_parent()

test_hierarchical_projects_crud()

test_list_project_parents()

test_list_projects_for_alternate_domain()

test_list_projects_in_subtree()

test_list_projects_in_subtree_with_circular_reference()

test_move_project_between_domains()

test_move_project_between_domains_with_clashing_names_fails()

test_update_project_enabled_cascade()

test_update_project_parent()

keystone.tests.unit.test_backend_ldap.create_group_container(identity_api)

keystone.tests.unit.test_backend_ldap_pool module

class keystone.tests.unit.test_backend_ldap_pool.LDAPIdentity(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_ldap_pool.LdapPoolCommonTestMixin, keystone.tests.unit.test_backend_ldap.LDAPIdentity, keystone.tests.unit.core.TestCase

Executes tests in existing base class with pooled LDAP handler.

config_files()

setUp()

test_utf8_encoded_is_used_in_pool(*args, **keywargs)

class keystone.tests.unit.test_backend_ldap_pool.LdapPoolCommonTestMixin

Bases: object

LDAP pool specific common tests used here and in live tests.

cleanup_pools()

test_handler_with_end_user_auth_use_pool_not_enabled(*args, **keywargs)

test_handler_with_use_pool_enabled()

test_handler_with_use_pool_not_enabled(*args, **keywargs)

test_max_connection_error_raised()

test_password_change_with_pool()

test_pool_connection_lifetime_set()

test_pool_retry_delay_set()

test_pool_retry_max_set()

test_pool_size_expands_correctly()

test_pool_size_set()

test_pool_timeout_set()

test_pool_use_pool_set()

test_pool_use_tls_set()

keystone.tests.unit.test_backend_rules module

class keystone.tests.unit.test_backend_rules.RulesPolicy(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase, keystone.tests.unit.policy.test_backends.PolicyTests

config_overrides()

setUp()

test_create()

test_delete()

test_delete_policy_returns_not_found()

test_get()

test_get_policy_returns_not_found()

test_list()

test_update()

test_update_policy_returns_not_found()

keystone.tests.unit.test_backend_sql module

class keystone.tests.unit.test_backend_sql.FakeTable(*args, **kwargs)

Bases: sqlalchemy.ext.declarative.api.Base

col

insert(*args, **kwargs)

lookup(*args, **kwargs)

update(*args, **kwargs)

class keystone.tests.unit.test_backend_sql.SqlCatalog(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_sql.SqlTests, keystone.tests.unit.catalog.test_backends.CatalogTests

test_catalog_ignored_malformed_urls()

test_create_endpoint_region_returns_not_found()

test_create_region_invalid_id()

test_create_region_invalid_parent_id()

test_delete_region_with_endpoint()

test_get_catalog_with_empty_public_url()

test_v3_catalog_domain_scoped_token()

test_v3_catalog_endpoint_filter_disabled()

test_v3_catalog_endpoint_filter_enabled()

class keystone.tests.unit.test_backend_sql.SqlCredential(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_sql.SqlTests

setUp()

test_create_credential_is_encrypted_when_stored()

test_list_credentials()

test_list_credentials_for_user()

test_list_credentials_for_user_and_type()

test_list_credentials_is_decrypted()

class keystone.tests.unit.test_backend_sql.SqlDecorators(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

test_conflict_happend()

test_initialization()

test_initialization_fail()

test_not_conflict_error()

class keystone.tests.unit.test_backend_sql.SqlFilterTests(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_sql.SqlTests, keystone.tests.unit.identity.test_backends.FilterTests

clean_up_entities()

Clean up entity test data from Filter Test Cases.

test_filter_sql_injection_attack()

Test against sql injection attack on filters.

Test Plan: - Attempt to get all entities back by passing a two-term attribute - Attempt to piggyback filter to damage DB (e.g. drop table)

test_list_entities_filtered_by_domain()

class keystone.tests.unit.test_backend_sql.SqlIdentity(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_sql.SqlTests, keystone.tests.unit.identity.test_backends.IdentityTests, keystone.tests.unit.assignment.test_backends.AssignmentTests, keystone.tests.unit.resource.test_backends.ResourceTests

test_create_null_user_name()

test_create_project_case_sensitivity()

test_create_user_case_sensitivity()

test_create_user_with_null_password()

test_delete_project_with_user_association()

test_delete_user_with_project_association()

test_hidden_project_domain_root_is_really_hidden()

Ensure we cannot access the hidden root of all project domains.

Calling any of the driver methods should result in the same as would be returned if we passed a project that does not exist. We don’t test create_project, since we do not allow a caller of our API to specify their own ID for a new entity.

test_list_domains_for_user()

test_list_domains_for_user_with_grants()

test_list_domains_for_user_with_inherited_grants()

Test that inherited roles on the domain are excluded.

Test Plan:

• Create two domains, one user, group and role
• Domain1 is given an inherited user role, Domain2 an inherited group role (for a group of which the user is a member)
• When listing domains for user, neither domain should be returned

test_list_users_call_count()

There should not be O(N) queries.

test_password_hashed()

test_sql_user_to_dict_null_default_project_id()

test_storing_null_domain_id_in_project_ref()

Test the special storage of domain_id=None in sql resource driver.

The resource driver uses a special value in place of None for domain_id in the project record. This shouldn’t escape the driver. Hence we test the interface to ensure that you can store a domain_id of None, and that any special value used inside the driver does not escape through the interface.

test_update_project_returns_extra()

Test for backward compatibility with an essex/folsom bug.

Non-indexed attributes were returned in an ‘extra’ attribute, instead of on the entity itself; for consistency and backwards compatibility, those attributes should be included twice.

This behavior is specific to the SQL driver.

test_update_user_returns_extra()

Test for backwards-compatibility with an essex/folsom bug.

Non-indexed attributes were returned in an ‘extra’ attribute, instead of on the entity itself; for consistency and backwards compatibility, those attributes should be included twice.

This behavior is specific to the SQL driver.

test_update_user_with_null_password()

class keystone.tests.unit.test_backend_sql.SqlImpliedRoles(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_sql.SqlTests, keystone.tests.unit.assignment.test_backends.ImpliedRoleTests

class keystone.tests.unit.test_backend_sql.SqlInheritance(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_sql.SqlTests, keystone.tests.unit.assignment.test_backends.InheritanceTests

class keystone.tests.unit.test_backend_sql.SqlLimitTests(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_sql.SqlTests, keystone.tests.unit.identity.test_backends.LimitTests

setUp()

class keystone.tests.unit.test_backend_sql.SqlModels(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_sql.SqlTests

assertExpectedSchema(table, expected_schema)

Assert that a table’s schema is what we expect.

Parameters:

• table (string) – the name of the table to inspect
• expected_schema (tuple) – a tuple of tuples containing the expected schema

Raises:

AssertionError – when the database schema doesn’t match the expected schema

The expected_schema format is simply:

(
    ('column name', sql type, qualifying detail),
    ...
)

The qualifying detail varies based on the type of the column:

- sql.Boolean columns must indicate the column's default value or
  None if there is no default
- Columns with a length, like sql.String, must indicate the
  column's length
- All other column types should use None

Example:

cols = (('id', sql.String, 64),
        ('enabled', sql.Boolean, True),
        ('extra', sql.JsonBlob, None))
self.assertExpectedSchema('table_name', cols)

select_table(name)

test_federated_user_model()

test_group_model()

test_local_user_model()

test_nonlocal_user_model()

test_password_model()

test_project_model()

test_revocation_event_model()

test_role_assignment_model()

test_user_group_membership()

test_user_model()

class keystone.tests.unit.test_backend_sql.SqlModuleInitialization(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

test_initialize_module(*args, **keywargs)

class keystone.tests.unit.test_backend_sql.SqlPolicy(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_sql.SqlTests, keystone.tests.unit.policy.test_backends.PolicyTests

class keystone.tests.unit.test_backend_sql.SqlTests(*args, **kwargs)

Bases: keystone.tests.unit.core.SQLDriverOverrides, keystone.tests.unit.core.TestCase

config_files()

setUp()

class keystone.tests.unit.test_backend_sql.SqlToken(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_sql.SqlTests, keystone.tests.unit.token.test_backends.TokenTests

test_expiry_range_batched()

test_expiry_range_strategy_ibm_db_sa()

test_expiry_range_strategy_mysql()

test_expiry_range_strategy_sqlite()

test_expiry_range_with_allow_expired()

test_flush_expired_tokens_batch()

test_flush_expired_tokens_batch_mysql()

test_token_revocation_list_uses_right_columns()

class keystone.tests.unit.test_backend_sql.SqlTokenCacheInvalidationWithUUID(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_sql.SqlTests, keystone.tests.unit.token.test_backends.TokenCacheInvalidation

config_overrides()

setUp()

class keystone.tests.unit.test_backend_sql.SqlTrust(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_sql.SqlTests, keystone.tests.unit.trust.test_backends.TrustTests

keystone.tests.unit.test_backend_templated module

class keystone.tests.unit.test_backend_templated.TestTemplatedCatalog(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase, keystone.tests.unit.catalog.test_backends.CatalogTests

DEFAULT_FIXTURE = {'RegionOne': {'compute': {'id': '2', 'internalURL': 'http://localhost:8774/v1.1/bar', 'adminURL': 'http://localhost:8774/v1.1/bar', 'name': "'Compute Service'", 'publicURL': 'http://localhost:8774/v1.1/bar'}, 'identity': {'id': '1', 'internalURL': 'http://localhost:35357/v2.0', 'adminURL': 'http://localhost:35357/v2.0', 'name': "'Identity Service'", 'publicURL': 'http://localhost:5000/v2.0'}}}

assert_catalogs_equal(expected, observed)

config_overrides()

setUp()

test_avoid_creating_circular_references_in_regions_update()

test_cache_layer_delete_service_with_endpoint()

test_cache_layer_region_crud(*args, **kwargs)

test_cache_layer_service_crud(*args, **kwargs)

test_catalog_ignored_malformed_urls(*args, **kwargs)

test_circular_regions_can_be_deleted(*args, **keywargs)

test_create_endpoint()

test_create_endpoint_nonexistent_region()

test_create_region_invalid_parent_region_returns_not_found()

test_create_region_with_duplicate_id()

test_delete_association_by_endpoint()

test_delete_association_by_project()

test_delete_endpoint_group_association_by_project()

test_delete_endpoint_returns_not_found()

test_delete_region_returns_not_found()

test_delete_service_returns_not_found()

test_delete_service_with_endpoint()

test_get_catalog()

test_get_catalog_endpoint_disabled()

test_get_catalog_ignores_endpoints_with_invalid_urls()

test_get_endpoint_returns_not_found()

test_get_v3_catalog()

test_get_v3_catalog_endpoint_disabled()

test_invalidate_cache_when_updating_endpoint(*args, **kwargs)

test_invalidate_cache_when_updating_region(*args, **kwargs)

test_invalidate_cache_when_updating_service(*args, **kwargs)

test_list_endpoints()

test_list_regions_filtered_by_parent_region_id()

test_list_services_with_hints()

test_region_crud()

test_service_crud()

test_service_filtering()

test_update_endpoint()

test_update_endpoint_nonexistent_region()

test_update_endpoint_nonexistent_service()

keystone.tests.unit.test_catalog module

class keystone.tests.unit.test_catalog.TestV2CatalogAPISQL(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

config_overrides()

create_endpoint(service_id, **kwargs)

setUp()

test_get_catalog_always_returns_service_name()

test_get_catalog_ignores_endpoints_with_invalid_urls()

class keystone.tests.unit.test_catalog.V2CatalogTestCase(*args, **kwargs)

Bases: keystone.tests.unit.rest.RestfulTestCase

config_overrides()

setUp()

test_endpoint_create()

test_endpoint_create_with_empty_adminurl()

test_endpoint_create_with_empty_internalurl()

test_endpoint_create_with_empty_publicurl()

test_endpoint_create_with_empty_service_id()

test_endpoint_create_with_invalid_url()

Test the invalid cases: substitutions is not exactly right.

test_endpoint_create_with_null_adminurl()

test_endpoint_create_with_null_internalurl()

test_endpoint_create_with_null_publicurl()

test_endpoint_create_with_null_service_id()

test_endpoint_create_with_valid_url()

Create endpoint with valid URL should be tested, too.

test_endpoint_create_without_region()

test_pure_v3_endpoint_with_publicurl_visible_from_v2()

Test pure v3 endpoint can be fetched via v2.0 API.

For those who are using v2.0 APIs, endpoints created by v3 API should also be visible as there are no differences about the endpoints except the format or the internal implementation. Since publicURL is required for v2.0 API, so only v3 endpoints of the service which have the public interface endpoint will be converted into v2.0 endpoints.

test_pure_v3_endpoint_without_publicurl_invisible_from_v2()

Test that the v2.0 API can’t fetch v3 endpoints without publicURLs.

v2.0 API will return endpoints created by v3 API, but publicURL is required for the service in the v2.0 API, therefore v3 endpoints of a service which don’t have publicURL will be ignored.

keystone.tests.unit.test_cert_setup module

class keystone.tests.unit.test_cert_setup.CertSetupTestCase(*args, **kwargs)

Bases: keystone.tests.unit.rest.RestfulTestCase

config_overrides()

setUp()

test_create_pki_certs(rebuild=False)

test_create_pki_certs_twice_without_rebuild()

test_failure()

test_fetch_signing_cert(rebuild=False)

test_fetch_signing_cert_when_rebuild()

test_pki_certs_rebuild()

test_rebuild_pki_certs_remove_error(*args, **keywargs)

class keystone.tests.unit.test_cert_setup.TestExecCommand(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

test_running_a_successful_command(*args, **keywargs)

test_running_an_invalid_command(*args, **keywargs)

keystone.tests.unit.test_cli module

class keystone.tests.unit.test_cli.CachingDoctorTests(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

test_caching_symptom_caching_enabled_without_a_backend()

test_symptom_caching_disabled()

class keystone.tests.unit.test_cli.CliBootStrapTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.SQLDriverOverrides, keystone.tests.unit.core.TestCase

config(config_files)

config_files()

setUp()

test_bootstrap()

test_bootstrap_creates_default_role()

test_bootstrap_is_idempotent_when_password_does_not_change()

test_bootstrap_is_not_idempotent_when_password_does_change()

test_bootstrap_recovers_user()

class keystone.tests.unit.test_cli.CliBootStrapTestCaseWithEnvironment(*args, **kwargs)

Bases: keystone.tests.unit.test_cli.CliBootStrapTestCase

config(config_files)

setUp()

test_assignment_created_with_project_exists()

test_assignment_created_with_region_exists()

test_assignment_created_with_role_exists()

test_assignment_created_with_user_exists()

test_endpoints_created_with_endpoint_exists()

test_endpoints_created_with_service_exists()

class keystone.tests.unit.test_cli.CliDBSyncTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.BaseTestCase

class FakeConfCommand(parent)

Bases: object

CliDBSyncTestCase.setUp()

CliDBSyncTestCase.test_db_sync()

CliDBSyncTestCase.test_db_sync_contract()

CliDBSyncTestCase.test_db_sync_expand()

CliDBSyncTestCase.test_db_sync_migrate()

class keystone.tests.unit.test_cli.CliDomainConfigAllTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.SQLDriverOverrides, keystone.tests.unit.core.TestCase

cleanup_domains()

config(config_files)

config_files()

setUp()

setup_initial_domains()

test_config_upload()

class keystone.tests.unit.test_cli.CliDomainConfigInvalidDomainTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_cli.CliDomainConfigAllTestCase

config(config_files)

test_config_upload()

class keystone.tests.unit.test_cli.CliDomainConfigNoOptionsTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_cli.CliDomainConfigAllTestCase

config(config_files)

test_config_upload()

class keystone.tests.unit.test_cli.CliDomainConfigSingleDomainTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_cli.CliDomainConfigAllTestCase

config(config_files)

test_config_upload()

test_no_overwrite_config()

class keystone.tests.unit.test_cli.CliDomainConfigTooManyOptionsTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_cli.CliDomainConfigAllTestCase

config(config_files)

test_config_upload()

class keystone.tests.unit.test_cli.CliDomainConfigUploadNothing(*args, **kwargs)

Bases: keystone.tests.unit.core.BaseTestCase

setUp()

test_uploading_all_from_an_empty_directory()

class keystone.tests.unit.test_cli.CliNoConfigTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.BaseTestCase

setUp()

test_cli()

class keystone.tests.unit.test_cli.CliTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.SQLDriverOverrides, keystone.tests.unit.core.TestCase

config_files()

test_token_flush()

test_token_flush_excepts_not_implemented_and_logs_warning()

class keystone.tests.unit.test_cli.CredentialDoctorTests(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

test_credential_and_fernet_key_repositories_are_unique()

test_credential_and_fernet_key_repositories_match()

test_keys_in_credential_fernet_key_repository_not_raised(*args, **keywargs)

test_keys_in_credential_fernet_key_repository_raised(*args, **keywargs)

test_usability_of_cred_fernet_key_repo_not_raised(*args, **keywargs)

test_usability_of_cred_fernet_key_repo_raised(*args, **keywargs)

class keystone.tests.unit.test_cli.DatabaseDoctorTests(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

test_symptom_is_raised_if_database_connection_is_SQLite()

class keystone.tests.unit.test_cli.DebugDoctorTests(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

test_symptom_debug_mode_is_enabled()

class keystone.tests.unit.test_cli.FederationDoctorTests(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

test_symptom_comma_in_SAML_private_key_file_path()

test_symptom_comma_in_SAML_public_certificate_path()

class keystone.tests.unit.test_cli.LdapDoctorTests(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

test_file_based_domain_specific_configs_formatted_correctly_not_raised(*args, **keywargs)

test_file_based_domain_specific_configs_formatted_correctly_raised(*args, **keywargs)

test_file_based_domain_specific_configs_not_raised(*args, **keywargs)

test_file_based_domain_specific_configs_raised(*args, **keywargs)

test_group_members_are_ids_disabled_not_raised()

test_group_members_are_ids_disabled_raised()

test_user_enabled_emulation_dn_ignored_not_raised()

test_user_enabled_emulation_dn_ignored_raised()

test_user_enabled_emulation_use_group_config_ignored_not_raised()

test_user_enabled_emulation_use_group_config_ignored_raised()

class keystone.tests.unit.test_cli.SecurityComplianceDoctorTests(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

test_invalid_password_regular_expression()

test_minimum_password_age_and_password_expires_days_deactivated()

test_minimum_password_age_equal_to_password_expires_days()

test_minimum_password_age_greater_than_password_expires_days()

test_minimum_password_age_less_than_password_expires_days()

test_password_regular_expression_deactivated()

test_password_regular_expression_description_deactivated()

test_password_regular_expression_description_not_set()

test_password_regular_expression_description_set()

test_valid_password_regular_expression()

class keystone.tests.unit.test_cli.TestDomainConfigFinder(*args, **kwargs)

Bases: keystone.tests.unit.core.BaseTestCase

setUp()

test_finder_ignores_files(*args, **keywargs)

class keystone.tests.unit.test_cli.TestMappingPopulate(*args, **kwargs)

Bases: keystone.tests.unit.core.SQLDriverOverrides, keystone.tests.unit.core.TestCase

config(config_files)

config_files()

config_overrides()

setUp()

test_bad_domain_name()

test_mapping_populate()

class keystone.tests.unit.test_cli.TokenFernetDoctorTests(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

test_keys_in_Fernet_key_repository_not_raised(*args, **keywargs)

test_keys_in_Fernet_key_repository_raised(*args, **keywargs)

test_usability_of_Fernet_key_repository_not_raised(*args, **keywargs)

test_usability_of_Fernet_key_repository_raised(*args, **keywargs)

class keystone.tests.unit.test_cli.TokensDoctorTests(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

test_unreasonable_max_token_size_not_raised()

test_unreasonable_max_token_size_raised()

keystone.tests.unit.test_config module

class keystone.tests.unit.test_config.ConfigTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

config_files()

test_config_default()

test_paste_config()

test_profiler_config_default()

Check config.set_config_defaults() has set [profiler]enabled.

class keystone.tests.unit.test_config.DeprecatedOverrideTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

Test using the deprecated AND new name for renamed options.

config_files()

test_sql()

class keystone.tests.unit.test_config.DeprecatedTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

Test using the original (deprecated) name for renamed options.

config_files()

test_sql()

keystone.tests.unit.test_contrib_s3_core module

class keystone.tests.unit.test_contrib_s3_core.S3ContribCore(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

setUp()

test_bad_signature_v1()

test_bad_signature_v4()

test_bad_token_v4()

test_good_signature_v1()

test_good_signature_v4()

keystone.tests.unit.test_contrib_simple_cert module

class keystone.tests.unit.test_contrib_simple_cert.BaseTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

CA_PATH = '/v3/OS-SIMPLE-CERT/ca'

CERT_PATH = '/v3/OS-SIMPLE-CERT/certificates'

class keystone.tests.unit.test_contrib_simple_cert.TestSimpleCert(*args, **kwargs)

Bases: keystone.tests.unit.test_contrib_simple_cert.BaseTestCase

request_cert(path)

test_ca_cert()

test_missing_file()

test_signing_cert()

keystone.tests.unit.test_credential module

class keystone.tests.unit.test_credential.V2CredentialEc2Controller(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

setUp()

test_check_non_admin_user()

Checking if user is admin causes uncaught error.

When checking if a user is an admin, keystone.exception.Unauthorized is raised but not caught if the user is not an admin.

test_signature_validate_invalid_signature()

Signature is not signed on the correct data.

test_signature_validate_no_host_port()

Test signature validation with the access/secret provided.

test_signature_validate_no_signature()

Signature is not presented in signature reference data.

test_signature_validate_with_host_port()

Test signature validation when host is bound with port.

Host is bound with a port, generally, the port here is not the standard port for the protocol, like ‘80’ for HTTP and port 443 for HTTPS, the port is not omitted by the client library.

test_signature_validate_with_missed_host_port()

Test signature validation when host is bound with well-known port.

Host is bound with a port, but the port is well-know port like ‘80’ for HTTP and port 443 for HTTPS, sometimes, client library omit the port but then make the request with the port. see (How to create the string to sign): ‘http://docs.aws.amazon.com/ general/latest/gr/signature-version-2.html’.

Since “credentials[‘host’]” is not set by client library but is taken from “req.host”, so caused the differences.

class keystone.tests.unit.test_credential.V2CredentialEc2TestCase(*args, **kwargs)

Bases: keystone.tests.unit.rest.RestfulTestCase

assertValidErrorResponse(r)

setUp()

test_ec2_cannot_get_non_ec2_credential()

test_ec2_list_credentials()

keystone.tests.unit.test_driver_hints module

class keystone.tests.unit.test_driver_hints.ListHintsTests(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

test_create_iterate_satisfy()

test_limits()

test_multiple_creates()

keystone.tests.unit.test_entry_points module

class keystone.tests.unit.test_entry_points.TestPasteDeploymentEntryPoints(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

test_entry_point_middleware()

Assert that our list of expected middleware is present.

keystone.tests.unit.test_exception module

class keystone.tests.unit.test_exception.ExceptionTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.BaseTestCase

assertValidJsonRendering(e)

test_all_json_renderings()

Everything callable in the exception module should be renderable.

... except for the base error class (exception.Error), which is not user-facing.

This test provides a custom message to bypass docstring parsing, which should be tested separately.

test_forbidden_title()

test_invalid_unicode_string()

test_not_found()

test_unicode_message()

test_unicode_string()

test_validation_error()

class keystone.tests.unit.test_exception.SecurityErrorTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_exception.ExceptionTestCase

Test whether security-related info is exposed to the API user.

setUp()

test_forbidden_action_exposure()

test_forbidden_action_exposure_in_debug()

test_forbidden_action_no_message()

test_forbidden_exposure()

test_forbidden_exposure_in_debug()

test_unauthorized_exposure()

test_unauthorized_exposure_in_debug()

test_unicode_argument_message()

class keystone.tests.unit.test_exception.TestSecurityErrorTranslation(*args, **kwargs)

Bases: keystone.tests.unit.core.BaseTestCase

Test i18n for SecurityError exceptions.

exception CustomError(message=None, **kwargs)

Bases: keystone.exception.Error

message_format = u'We had a failure in the %(place)r'

exception TestSecurityErrorTranslation.CustomSecurityError(message=None, **kwargs)

Bases: keystone.exception.SecurityError

message_format = u'We had a failure in the %(place)r'

TestSecurityErrorTranslation.setUp()

TestSecurityErrorTranslation.test_nested_translation_of_SecurityErrors()

TestSecurityErrorTranslation.test_that_regular_Errors_can_be_deep_copied()

class keystone.tests.unit.test_exception.UnexpectedExceptionTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_exception.ExceptionTestCase

Test if internal info is exposed to the API user on UnexpectedError.

exception SubClassExc(message=None, **kwargs)

Bases: keystone.exception.UnexpectedError

debug_message_format = 'Debug Message: %(debug_info)s'

UnexpectedExceptionTestCase.setUp()

UnexpectedExceptionTestCase.test_unexpected_error_custom_message_binary_debug()

UnexpectedExceptionTestCase.test_unexpected_error_custom_message_debug()

UnexpectedExceptionTestCase.test_unexpected_error_custom_message_exception_debug()

UnexpectedExceptionTestCase.test_unexpected_error_custom_message_no_debug()

UnexpectedExceptionTestCase.test_unexpected_error_debug()

UnexpectedExceptionTestCase.test_unexpected_error_no_debug()

UnexpectedExceptionTestCase.test_unexpected_error_subclass_debug()

UnexpectedExceptionTestCase.test_unexpected_error_subclass_no_debug()

keystone.tests.unit.test_hacking_checks module

class keystone.tests.unit.test_hacking_checks.BaseLoggingCheck(*args, **kwargs)

Bases: keystone.tests.unit.test_hacking_checks.BaseStyleCheck

assert_has_errors(code, expected_errors=None)

get_checker()

get_fixture()

class keystone.tests.unit.test_hacking_checks.BaseStyleCheck(*args, **kwargs)

Bases: keystone.tests.unit.core.BaseTestCase

assert_has_errors(code, expected_errors=None)

get_checker()

Return the checker to be used for tests in this class.

get_fixture()

run_check(code)

setUp()

class keystone.tests.unit.test_hacking_checks.TestAssertingNoneEquality(*args, **kwargs)

Bases: keystone.tests.unit.test_hacking_checks.BaseStyleCheck

get_checker()

test()

class keystone.tests.unit.test_hacking_checks.TestBlockCommentsBeginWithASpace(*args, **kwargs)

Bases: keystone.tests.unit.test_hacking_checks.BaseStyleCheck

get_checker()

test()

class keystone.tests.unit.test_hacking_checks.TestCheckForDebugLoggingIssues(*args, **kwargs)

Bases: keystone.tests.unit.test_hacking_checks.BaseLoggingCheck

test_for_translations()

class keystone.tests.unit.test_hacking_checks.TestCheckForMutableDefaultArgs(*args, **kwargs)

Bases: keystone.tests.unit.test_hacking_checks.BaseStyleCheck

get_checker()

test()

class keystone.tests.unit.test_hacking_checks.TestCheckForNonDebugLoggingIssues(*args, **kwargs)

Bases: keystone.tests.unit.test_hacking_checks.BaseLoggingCheck

test_for_translations()

class keystone.tests.unit.test_hacking_checks.TestDictConstructorWithSequenceCopy(*args, **kwargs)

Bases: keystone.tests.unit.test_hacking_checks.BaseStyleCheck

get_checker()

test()

class keystone.tests.unit.test_hacking_checks.TestLoggingWithWarn(*args, **kwargs)

Bases: keystone.tests.unit.test_hacking_checks.BaseLoggingCheck

test()

keystone.tests.unit.test_kvs module

class keystone.tests.unit.test_kvs.KVSBackendFixture(arguments)

Bases: keystone.common.kvs.backends.inmemdb.MemoryBackend

get_mutex(key)

classmethod key_mangler(key)

class keystone.tests.unit.test_kvs.KVSBackendForcedKeyMangleFixture(arguments)

Bases: keystone.tests.unit.test_kvs.KVSBackendFixture

classmethod key_mangler(key)

use_backend_key_mangler = True

class keystone.tests.unit.test_kvs.KVSTest(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

setUp()

test_kvs_backend_registration_does_not_reregister_backends()

test_kvs_basic_configuration()

test_kvs_basic_get_set_delete()

test_kvs_key_mangler_configuration_backend()

test_kvs_key_mangler_configuration_disabled()

test_kvs_key_mangler_configuration_forced_backend()

test_kvs_key_mangler_fallthrough_default()

test_kvs_key_mangler_set_on_backend()

test_kvs_locking_context_handler()

test_kvs_locking_context_handler_locking_disabled()

test_kvs_memcache_key_mangler_set_to_none()

test_kvs_memcache_manager_no_expiry_keys()

test_kvs_memcache_set_arguments_and_memcache_expires_ttl()

test_kvs_memcached_manager_invalid_dogpile_memcached_backend()

test_kvs_memcached_manager_valid_dogpile_memcached_backend()

test_kvs_multi_get_set_delete()

test_kvs_proxy_configuration()

test_kvs_with_lock_action_context_manager()

test_kvs_with_lock_action_context_manager_no_lock()

test_kvs_with_lock_action_context_manager_timeout()

test_kvs_with_lock_action_mismatched_keys()

test_memcached_lock_max_lock_attempts()

test_noncallable_key_mangler_set_on_driver_raises_type_error()

class keystone.tests.unit.test_kvs.MutexFixture(storage_dict, key, timeout)

Bases: object

acquire(wait=True)

release()

class keystone.tests.unit.test_kvs.RegionProxy2Fixture(*args, **kwargs)

Bases: dogpile.cache.proxy.ProxyBackend

A test dogpile.cache proxy that does nothing.

class keystone.tests.unit.test_kvs.RegionProxyFixture(*args, **kwargs)

Bases: dogpile.cache.proxy.ProxyBackend

A test dogpile.cache proxy that does nothing.

class keystone.tests.unit.test_kvs.TestCacheRegionInit(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

Illustrate the race condition on cache initialization.

This case doesn’t actually expose the error, it just simulates unprotected code behaviour, when race condition leads to re-configuration of shared KVS backend object. What, in turn, results in an exception.

kvs_backend = 'openstack.kvs.Memory'

store_name = 'test-kvs'

test_different_instances_initialization()

Simulate race condition on token storage initialization.

test_kvs_configure_called_twice()

Check if configure() is called again.

class keystone.tests.unit.test_kvs.TestMemcacheDriver(arguments)

Bases: dogpile.cache.api.CacheBackend

A test dogpile.cache backend.

This test backend conforms to the mixin-mechanism for overriding set and set_multi methods on dogpile memcached drivers.

set(key, value)

set_multi(mapping)

class test_client

Bases: object

add(key, value, expiry_time)

delete(key)

set(key, value, **set_arguments)

set_multi(mapping, **set_arguments)

class keystone.tests.unit.test_kvs.TestMemcachedBackend(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

test_invalid_backend_fails_initialization(*args, **keywargs)

keystone.tests.unit.test_ldap_livetest module

class keystone.tests.unit.test_ldap_livetest.LiveLDAPIdentity(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_ldap.LDAPIdentity

clear_database()

config_files()

setUp()

test_build_tree()

Regression test for building the tree names.

test_create_project_case_sensitivity()

test_create_user_case_sensitivity()

test_ldap_dereferencing()

test_list_groups_for_user_filtered()

test_project_update_missing_attrs_with_a_falsey_value()

test_user_enable_attribute_mask()

keystone.tests.unit.test_ldap_livetest.create_object(dn, attrs)

keystone.tests.unit.test_ldap_pool_livetest module

class keystone.tests.unit.test_ldap_pool_livetest.LiveLDAPPoolIdentity(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_ldap_pool.LdapPoolCommonTestMixin, keystone.tests.unit.test_ldap_livetest.LiveLDAPIdentity

Executes existing LDAP live test with pooled LDAP handler.

Also executes common pool specific tests via Mixin class.

config_files()

setUp()

test_assert_connector_used_not_fake_ldap_pool()

test_async_search_and_result3()

test_password_change_with_auth_pool_disabled()

test_password_change_with_auth_pool_enabled_long_lifetime()

test_password_change_with_auth_pool_enabled_no_lifetime()

test_pool_size_expands_correctly()

keystone.tests.unit.test_ldap_tls_livetest module

class keystone.tests.unit.test_ldap_tls_livetest.LiveTLSLDAPIdentity(*args, **kwargs)

Bases: keystone.tests.unit.test_ldap_livetest.LiveLDAPIdentity

config_files()

test_tls_bad_certdir()

test_tls_bad_certfile()

test_tls_certdir_demand_option()

test_tls_certfile_demand_option()

keystone.tests.unit.test_ldap_tls_livetest.create_object(dn, attrs)

keystone.tests.unit.test_middleware module

class keystone.tests.unit.test_middleware.AdminTokenAuthMiddlewareTest(*args, **kwargs)

Bases: keystone.tests.unit.test_middleware.MiddlewareRequestTestBase

MIDDLEWARE_CLASS

alias of AdminTokenAuthMiddleware

config_overrides()

test_request_admin()

test_request_non_admin()

class keystone.tests.unit.test_middleware.AuthContextMiddlewareTest(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_sql.SqlTests, keystone.tests.unit.test_middleware.MiddlewareRequestTestBase

MIDDLEWARE_CLASS

alias of AuthContextMiddleware

setUp()

test_admin_token_context()

test_client_issuer_not_trusted()

test_context_already_exists()

test_create_idp_id_attri_not_found_fail()

test_create_idp_id_success()

test_domain_disable_fail()

test_empty_trusted_issuer_list()

test_ephemeral_any_user_success()

Verify ephemeral user does not need a specified user.

Keystone is not looking to match the user, but a corresponding group.

test_ephemeral_incorrect_mapping_fail()

Test ephemeral user picking up the non-ephemeral user mapping.

Looking up the mapping with protocol Id ‘x509’ will load up the non-ephemeral user mapping, results unauthenticated.

test_ephemeral_invalid_scope_fail()

test_ephemeral_no_group_found_fail()

test_ephemeral_success()

test_ephemeral_with_default_user_type_success()

test_has_only_issuer_and_project_domain_id_request()

test_has_only_issuer_and_project_domain_name_request()

test_has_only_issuer_and_project_name_request()

test_invalid_user_fail()

test_mapping_with_userid_and_domainid_success()

test_mapping_with_userid_and_domainname_success()

test_mapping_with_username_and_domainid_success()

test_missing_both_domain_and_project_request()

test_missing_domain_data_fail()

test_no_issuer_attribute_request()

test_no_tokenless_attributes_request()

test_not_applicable_to_token_request()

test_only_domain_id_fail()

test_only_domain_name_fail()

test_proj_scope_with_proj_id_and_proj_dom_id_success()

test_proj_scope_with_proj_id_only_success()

test_proj_scope_with_proj_name_and_proj_dom_id_success()

test_proj_scope_with_proj_name_and_proj_dom_name_success()

test_proj_scope_with_proj_name_only_fail()

test_user_disable_fail()

test_userid_success()

class keystone.tests.unit.test_middleware.JsonBodyMiddlewareTest(*args, **kwargs)

Bases: keystone.tests.unit.test_middleware.MiddlewareRequestTestBase

MIDDLEWARE_CLASS

alias of JsonBodyMiddleware

test_malformed_json()

test_no_content_type()

test_not_dict_body()

test_request_with_params()

test_unrecognized_content_type()

test_unrecognized_content_type_without_body()

class keystone.tests.unit.test_middleware.MiddlewareRequestTestBase(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

MIDDLEWARE_CLASS = None

class keystone.tests.unit.test_middleware.TokenAuthMiddlewareTest(*args, **kwargs)

Bases: keystone.tests.unit.test_middleware.MiddlewareRequestTestBase

MIDDLEWARE_CLASS

alias of TokenAuthMiddleware

test_request()

keystone.tests.unit.test_no_admin_token_auth module

class keystone.tests.unit.test_no_admin_token_auth.TestNoAdminTokenAuth(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

setUp()

test_request_no_admin_token_auth()

keystone.tests.unit.test_policy module

class keystone.tests.unit.test_policy.DefaultPolicyTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

setUp()

test_default_not_found()

test_not_found_policy_calls_default()

test_policy_called()

class keystone.tests.unit.test_policy.PolicyFileTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

setUp()

test_modified_policy_reloads()

class keystone.tests.unit.test_policy.PolicyJsonTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

test_all_targets_documented()

test_json_examples_have_matching_entries()

test_policies_loads()

class keystone.tests.unit.test_policy.PolicyTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

setUp()

test_early_AND_enforcement()

test_early_OR_enforcement()

test_enforce_bad_action_throws()

test_enforce_good_action()

test_enforce_nonexistent_action_throws()

test_ignore_case_role_check()

test_templatized_enforcement()

keystone.tests.unit.test_revoke module

class keystone.tests.unit.test_revoke.FernetSqlRevokeTests(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_sql.SqlTests, keystone.tests.unit.test_revoke.RevokeTests

config_overrides()

class keystone.tests.unit.test_revoke.RevokeListTests(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

remove_event(event)

setUp()

test_by_domain_domain()

test_by_domain_project()

test_by_domain_user()

test_by_project_and_user_and_role()

test_cleanup()

test_revoke_by_audit_chain_id()

class keystone.tests.unit.test_revoke.RevokeTests

Bases: object

test_by_project_grant()

test_delete_group_without_role_does_not_revoke_users()

test_expired_events_are_removed(*args, **keywargs)

test_list()

test_list_revoked_audit()

test_list_revoked_multiple_filters()

test_list_revoked_project()

test_list_revoked_since()

test_list_revoked_user()

test_list_since()

test_revoke_by_audit_id()

test_revoke_by_user()

test_revoke_by_user_matches_trustee()

test_revoke_by_user_matches_trustor()

class keystone.tests.unit.test_revoke.UUIDSqlRevokeTests(*args, **kwargs)

Bases: keystone.tests.unit.test_backend_sql.SqlTests, keystone.tests.unit.test_revoke.RevokeTests

config_overrides()

keystone.tests.unit.test_revoke.add_event(events, event)

keystone.tests.unit.test_revoke.remove_event(events, event)

keystone.tests.unit.test_shadow_users module

class keystone.tests.unit.test_shadow_users.ShadowUsersTests(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase, keystone.tests.unit.identity.shadow_users.test_backend.ShadowUsersBackendTests, keystone.tests.unit.identity.shadow_users.test_core.ShadowUsersCoreTests

setUp()

keystone.tests.unit.test_sql_banned_operations module

class keystone.tests.unit.test_sql_banned_operations.BannedDBSchemaOperations(banned_ops=None, migration_repo='/home/jenkins/workspace/keystone-docs-ubuntu-xenial/keystone/common/sql/migrate_repo/__init__.py')

Bases: fixtures.fixture.Fixture

Ban some operations for migrations.

setUp()

exception keystone.tests.unit.test_sql_banned_operations.DBOperationNotAllowed

Bases: exceptions.Exception

class keystone.tests.unit.test_sql_banned_operations.KeystoneMigrationsCheckers

Bases: oslo_db.sqlalchemy.test_migrations.WalkVersionsMixin

Walk over and test all sqlalchemy-migrate migrations.

INIT_VERSION

REPOSITORY

banned_ops = {'Table': ['alter', 'drop'], 'Column': ['alter', 'drop']}

downgrade = False

exceptions = [102, 106]

first_version = 101

migrate_engine

migrate_file = '/home/jenkins/workspace/keystone-docs-ubuntu-xenial/keystone/common/sql/migrate_repo/__init__.py'

migrate_fully(repo_name)

migrate_up(version, with_data=False)

Check that migrations don’t cause downtime.

Schema migrations can be done online, allowing for rolling upgrades.

migration_api

snake_walk = False

test_walk_versions()

class keystone.tests.unit.test_sql_banned_operations.TestBannedDBSchemaOperations(*args, **kwargs)

Bases: testtools.testcase.TestCase

Test the BannedDBSchemaOperations fixture.

test_column()

Test column operations raise DBOperationNotAllowed.

test_table()

Test table operations raise DBOperationNotAllowed.

class keystone.tests.unit.test_sql_banned_operations.TestKeystoneContractSchemaMigrations

Bases: keystone.tests.unit.test_sql_banned_operations.KeystoneMigrationsCheckers

banned_ops = {'Table': ['create', 'insert', 'delete'], 'Column': ['create']}

exceptions = [2, 4, 13]

first_version = 1

migrate_file = '/home/jenkins/workspace/keystone-docs-ubuntu-xenial/keystone/common/sql/contract_repo/__init__.py'

setUp()

class keystone.tests.unit.test_sql_banned_operations.TestKeystoneContractSchemaMigrationsMySQL(*args, **kwargs)

Bases: keystone.tests.unit.test_sql_banned_operations.TestKeystoneContractSchemaMigrations, oslo_db.sqlalchemy.test_base.MySQLOpportunisticTestCase

class keystone.tests.unit.test_sql_banned_operations.TestKeystoneContractSchemaMigrationsPostgreSQL(*args, **kwargs)

Bases: keystone.tests.unit.test_sql_banned_operations.TestKeystoneContractSchemaMigrations, oslo_db.sqlalchemy.test_base.PostgreSQLOpportunisticTestCase

class keystone.tests.unit.test_sql_banned_operations.TestKeystoneContractSchemaMigrationsSQLite(*args, **kwargs)

Bases: keystone.tests.unit.test_sql_banned_operations.TestKeystoneContractSchemaMigrations, oslo_db.sqlalchemy.test_base.DbTestCase

setUp()

class keystone.tests.unit.test_sql_banned_operations.TestKeystoneDataMigrations

Bases: keystone.tests.unit.test_sql_banned_operations.KeystoneMigrationsCheckers

banned_ops = {'Table': ['create', 'alter', 'drop'], 'Column': ['create', 'alter', 'drop']}

exceptions = [2, 4, 13]

first_version = 1

migrate_file = '/home/jenkins/workspace/keystone-docs-ubuntu-xenial/keystone/common/sql/data_migration_repo/__init__.py'

setUp()

class keystone.tests.unit.test_sql_banned_operations.TestKeystoneDataMigrationsMySQL(*args, **kwargs)

Bases: keystone.tests.unit.test_sql_banned_operations.TestKeystoneDataMigrations, oslo_db.sqlalchemy.test_base.MySQLOpportunisticTestCase

class keystone.tests.unit.test_sql_banned_operations.TestKeystoneDataMigrationsPostgreSQL(*args, **kwargs)

Bases: keystone.tests.unit.test_sql_banned_operations.TestKeystoneDataMigrations, oslo_db.sqlalchemy.test_base.PostgreSQLOpportunisticTestCase

class keystone.tests.unit.test_sql_banned_operations.TestKeystoneDataMigrationsSQLite(*args, **kwargs)

Bases: keystone.tests.unit.test_sql_banned_operations.TestKeystoneDataMigrations, oslo_db.sqlalchemy.test_base.DbTestCase

class keystone.tests.unit.test_sql_banned_operations.TestKeystoneExpandSchemaMigrations

Bases: keystone.tests.unit.test_sql_banned_operations.KeystoneMigrationsCheckers

banned_ops = {'Table': ['alter', 'drop', 'insert', 'delete'], 'Column': ['alter', 'drop']}

exceptions = [2, 3, 4]

first_version = 1

migrate_file = '/home/jenkins/workspace/keystone-docs-ubuntu-xenial/keystone/common/sql/expand_repo/__init__.py'

setUp()

class keystone.tests.unit.test_sql_banned_operations.TestKeystoneExpandSchemaMigrationsMySQL(*args, **kwargs)

Bases: keystone.tests.unit.test_sql_banned_operations.TestKeystoneExpandSchemaMigrations, oslo_db.sqlalchemy.test_base.MySQLOpportunisticTestCase

class keystone.tests.unit.test_sql_banned_operations.TestKeystoneExpandSchemaMigrationsPostgreSQL(*args, **kwargs)

Bases: keystone.tests.unit.test_sql_banned_operations.TestKeystoneExpandSchemaMigrations, oslo_db.sqlalchemy.test_base.PostgreSQLOpportunisticTestCase

class keystone.tests.unit.test_sql_banned_operations.TestKeystoneMigrationsMySQL(*args, **kwargs)

Bases: keystone.tests.unit.test_sql_banned_operations.KeystoneMigrationsCheckers, oslo_db.sqlalchemy.test_base.MySQLOpportunisticTestCase

class keystone.tests.unit.test_sql_banned_operations.TestKeystoneMigrationsPostgreSQL(*args, **kwargs)

Bases: keystone.tests.unit.test_sql_banned_operations.KeystoneMigrationsCheckers, oslo_db.sqlalchemy.test_base.PostgreSQLOpportunisticTestCase

class keystone.tests.unit.test_sql_banned_operations.TestKeystoneMigrationsSQLite(*args, **kwargs)

Bases: keystone.tests.unit.test_sql_banned_operations.KeystoneMigrationsCheckers, oslo_db.sqlalchemy.test_base.DbTestCase

keystone.tests.unit.test_sql_upgrade module

Test for SQL migration extensions.

To run these tests against a live database:

1. Set up a blank, live database.

2. Export database information to environment variable OS_TEST_DBAPI_ADMIN_CONNECTION. For example:

   export OS_TEST_DBAPI_ADMIN_CONNECTION=postgresql://localhost/postgres?host=
   /var/folders/7k/pwdhb_mj2cv4zyr0kyrlzjx40000gq/T/tmpMGqN8C&port=9824
   

3. Run the tests using:

   tox -e py27 -- keystone.tests.unit.test_sql_upgrade
   

For further information, see oslo.db documentation.

WARNING:

Your database will be wiped.

Do not do this against a database with valuable data as
all data will be lost.

class keystone.tests.unit.test_sql_upgrade.FullMigration(*args, **kwargs)

Bases: keystone.tests.unit.test_sql_upgrade.SqlMigrateBase, keystone.tests.unit.core.TestCase

Test complete orchestration between all database phases.

setUp()

test_migration_002_password_created_at_not_nullable()

test_migration_003_migrate_unencrypted_credentials()

test_migration_004_reset_password_created_at()

test_migration_010_add_revocation_event_indexes()

test_migration_011_user_id_unique_for_nonlocal_user()

test_migration_012_add_domain_id_to_idp()

test_migration_013_protocol_cascade_delete_for_federated_user()

test_migration_014_add_domain_id_to_user_table()

test_migration_015_update_federated_user_domain()

test_migration_016_add_user_options()

class keystone.tests.unit.test_sql_upgrade.MySQLOpportunisticContractSchemaUpgradeTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_sql_upgrade.SqlContractSchemaUpgradeTests

FIXTURE

alias of MySQLOpportunisticFixture

class keystone.tests.unit.test_sql_upgrade.MySQLOpportunisticDataMigrationUpgradeTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_sql_upgrade.SqlDataMigrationUpgradeTests

FIXTURE

alias of MySQLOpportunisticFixture

class keystone.tests.unit.test_sql_upgrade.MySQLOpportunisticExpandSchemaUpgradeTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_sql_upgrade.SqlExpandSchemaUpgradeTests

FIXTURE

alias of MySQLOpportunisticFixture

class keystone.tests.unit.test_sql_upgrade.MySQLOpportunisticFullMigration(*args, **kwargs)

Bases: keystone.tests.unit.test_sql_upgrade.FullMigration

FIXTURE

alias of MySQLOpportunisticFixture

class keystone.tests.unit.test_sql_upgrade.MySQLOpportunisticUpgradeTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_sql_upgrade.SqlLegacyRepoUpgradeTests

FIXTURE

alias of MySQLOpportunisticFixture

class keystone.tests.unit.test_sql_upgrade.PostgreSQLOpportunisticContractSchemaUpgradeTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_sql_upgrade.SqlContractSchemaUpgradeTests

FIXTURE

alias of PostgreSQLOpportunisticFixture

class keystone.tests.unit.test_sql_upgrade.PostgreSQLOpportunisticDataMigrationUpgradeTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_sql_upgrade.SqlDataMigrationUpgradeTests

FIXTURE

alias of PostgreSQLOpportunisticFixture

class keystone.tests.unit.test_sql_upgrade.PostgreSQLOpportunisticExpandSchemaUpgradeTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_sql_upgrade.SqlExpandSchemaUpgradeTests

FIXTURE

alias of PostgreSQLOpportunisticFixture

class keystone.tests.unit.test_sql_upgrade.PostgreSQLOpportunisticFullMigration(*args, **kwargs)

Bases: keystone.tests.unit.test_sql_upgrade.FullMigration

FIXTURE

alias of PostgreSQLOpportunisticFixture

class keystone.tests.unit.test_sql_upgrade.PostgreSQLOpportunisticUpgradeTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_sql_upgrade.SqlLegacyRepoUpgradeTests

FIXTURE

alias of PostgreSQLOpportunisticFixture

class keystone.tests.unit.test_sql_upgrade.SqlContractSchemaUpgradeTests(*args, **kwargs)

Bases: keystone.tests.unit.test_sql_upgrade.SqlMigrateBase, keystone.tests.unit.core.TestCase

setUp()

test_start_version_db_init_version()

class keystone.tests.unit.test_sql_upgrade.SqlDataMigrationUpgradeTests(*args, **kwargs)

Bases: keystone.tests.unit.test_sql_upgrade.SqlMigrateBase

setUp()

test_start_version_db_init_version()

class keystone.tests.unit.test_sql_upgrade.SqlExpandSchemaUpgradeTests(*args, **kwargs)

Bases: keystone.tests.unit.test_sql_upgrade.SqlMigrateBase

setUp()

test_start_version_db_init_version()

class keystone.tests.unit.test_sql_upgrade.SqlLegacyRepoUpgradeTests(*args, **kwargs)

Bases: keystone.tests.unit.test_sql_upgrade.SqlMigrateBase

check_initial_table_structure()

test_add_config_registration()

test_add_domain_specific_roles()

Check database upgraded successfully for domain specific roles.

The following items need to be checked:

• The domain_id column has been added
• That it has been added to the uniqueness constraints
• Existing roles have their domain_id columns set to the specific string of ‘<<null>>’

test_add_federated_user_table()

test_add_int_pkey_to_revocation_event_table()

test_add_local_user_and_password_tables()

test_add_nonlocal_user_table()

test_add_root_of_all_domains()

test_add_trust_unique_constraint_upgrade()

test_blank_db_to_start()

test_create_federation_tables()

test_create_oauth_tables()

test_create_revoke_table()

test_domain_as_project_upgrade()

test_drop_domain_table()

test_endpoint_filter_already_migrated(*args, **keywargs)

test_endpoint_filter_upgrade()

test_endpoint_policy_already_migrated(*args, **keywargs)

test_endpoint_policy_upgrade()

test_federation_already_migrated(*args, **keywargs)

test_implied_roles_fk_on_delete_cascade()

test_implied_roles_upgrade()

test_insert_assignment_inherited_pk()

test_kilo_squash()

test_migrate_data_to_local_user_and_password_tables()

test_migrate_user_skip_user_already_exist_in_local_user()

test_migrate_user_with_null_password_to_password_tables()

test_migration_101()

test_migration_101_constraint_exists()

test_migration_104()

test_migration_104_constraint_exists()

test_migration_104_inconsistent_constraint_exists()

test_migration_105_add_password_date_columns()

test_migration_106_allow_password_column_to_be_nullable()

test_migration_107_add_user_date_columns()

test_migration_108_add_failed_auth_columns()

test_migration_109_add_password_self_service_column()

test_migration_88_drops_unique_constraint()

test_migration_88_inconsistent_constraint_name()

test_migration_91_drops_unique_constraint()

test_migration_91_inconsistent_constraint_name()

test_migration_96()

test_migration_96_constraint_exists()

test_migration_97()

test_migration_97_constraint_exists()

test_migration_97_inconsistent_constraint_exists()

test_oauth1_already_migrated(*args, **keywargs)

test_project_is_domain_upgrade()

test_revoke_already_migrated(*args, **keywargs)

test_start_version_db_init_version()

test_upgrade_add_initial_tables()

class keystone.tests.unit.test_sql_upgrade.SqlMigrateBase(*args, **kwargs)

Bases: oslo_db.sqlalchemy.test_base.DbTestCase

assertTableColumns(table_name, expected_cols)

Assert that the table contains the expected set of columns.

assertTableCountsMatch(table1_name, table2_name)

assertTableDoesNotExist(table_name)

Assert that a given table exists cannot be selected by name.

assertTableExists(table_name)

calc_table_row_count(table_name)

Return the number of rows in the table.

contract(*args, **kwargs)

Contract database schema.

does_constraint_exist(table_name, constraint_name)

does_fk_exist(table, fk_column)

does_index_exist(table_name, index_name)

does_pk_exist(table, pk_column)

Check whether a column is primary key on a table.

does_unique_constraint_exist(table_name, column_name)

expand(*args, **kwargs)

Expand database schema.

insert_dict(session, table_name, d, table=None)

Naively inserts key-value pairs into a table, given a dictionary.

metadata

A collection of tables and their associated schemas.

migrate(*args, **kwargs)

Migrate data.

select_table(name)

setUp()

upgrade(*args, **kwargs)

Upgrade the legacy migration repository.

class keystone.tests.unit.test_sql_upgrade.SqlUpgradeGetInitVersionTests(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

test_get_init_version_no_path(*args, **keywargs)

test_get_init_version_with_path(*args, **keywargs)

test_get_init_version_with_path_initial_version_0(*args, **keywargs)

class keystone.tests.unit.test_sql_upgrade.VersionTests(*args, **kwargs)

Bases: keystone.tests.unit.test_sql_upgrade.SqlMigrateBase

test_assert_not_schema_downgrade()

test_core_initial()

Get the version before migrated, it’s the initial DB version.

test_core_max()

When get the version after upgrading, it’s the new version.

test_migrate_repos_stay_in_lockstep()

Rolling upgrade repositories should always stay in lockstep.

By maintaining a single “latest” version number in each of the three migration repositories (expand, data migrate, and contract), we can trivially prevent operators from “doing the wrong thing”, such as running upgrades operations out of order (for example, you should not be able to run data migration 5 until schema expansion 5 has been run).

For example, even if your rolling upgrade task only involves adding a new column with a reasonable default, and doesn’t require any triggers, data migration, etc, you still need to create “empty” upgrade steps in the data migration and contract repositories with the same version number as the expansion.

For more information, see “Database Migrations” here:

https://docs.openstack.org/developer/keystone/devref/development_best_practices.html#database-migrations

test_these_are_not_the_migrations_you_are_looking_for()

Keystone has shifted to rolling upgrades.

New database migrations should no longer land in the legacy migration repository. Instead, new database migrations should be divided into three discrete steps: schema expansion, data migration, and schema contraction. These migrations live in a new set of database migration repositories, called expand_repo, data_migration_repo, and contract_repo.

For more information, see “Database Migrations” here:

https://docs.openstack.org/developer/keystone/devref/development_best_practices.html#database-migrations

keystone.tests.unit.test_token_bind module

class keystone.tests.unit.test_token_bind.BindTest(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

Test binding tokens to a Principal.

Even though everything in this file references kerberos the same concepts will apply to all future binding mechanisms.

assert_kerberos_bind(tokens, bind_level, use_kerberos=True, success=True)

setUp()

test_bind_disabled_with_kerb_user()

test_bind_named_with_kerb_user()

test_bind_named_with_regular_token()

test_bind_named_with_unknown_bind()

test_bind_named_with_unknown_scheme()

test_bind_named_without_kerb_user()

test_bind_permissive_with_kerb_user()

test_bind_permissive_with_regular_token()

test_bind_permissive_with_unknown_bind()

test_bind_permissive_without_kerb_user()

test_bind_required_with_kerb_user()

test_bind_required_with_regular_token()

test_bind_required_with_unknown_bind()

test_bind_required_without_kerb_user()

test_bind_strict_with_kerb_user()

test_bind_strict_with_regular_token()

test_bind_strict_with_unknown_bind()

test_bind_strict_without_kerb_user()

keystone.tests.unit.test_token_provider module

class keystone.tests.unit.test_token_provider.TestTokenProvider(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

setUp()

test_get_token_version()

test_provider_token_expiration_validation()

test_supported_token_providers()

test_unsupported_token_provider()

test_validate_v3_token_with_no_token_raises_token_not_found()

keystone.tests.unit.test_token_provider.create_v2_token()

keystone.tests.unit.test_token_provider.create_v3_token()

keystone.tests.unit.test_url_middleware module

class keystone.tests.unit.test_url_middleware.FakeApp

Bases: object

Fakes a WSGI app URL normalized.

class keystone.tests.unit.test_url_middleware.UrlMiddlewareTest(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

setUp()

start_fake_response(status, headers)

test_rewrite_empty_path()

Test empty path is rewritten to root.

test_trailing_slash_normalization()

Test /v2.0/tokens and /v2.0/tokens/ normalized URLs match.

keystone.tests.unit.test_v2 module

class keystone.tests.unit.test_v2.CoreApiTests

Bases: object

assertNoRoles(r)

Helper method to assert No Roles.

This needs to be overridden by child classes based on their content type.

assertValidError(error)

assertValidExtension(extension)

assertValidExtensionLink(link)

assertValidRole(tenant)

assertValidTenant(tenant)

assertValidUser(user)

assertValidVersion(version)

test_admin_extensions()

test_admin_extensions_returns_not_found()

test_admin_multiple_choice()

test_admin_not_found()

test_admin_osksadm_extension()

test_admin_version()

test_authenticate()

test_authenticate_unscoped()

test_authenticating_a_user_with_no_password()

test_create_update_user_invalid_enabled_type()

test_create_update_user_valid_enabled_type()

test_endpoints()

test_error_response()

Trigger assertValidErrorResponse by convention.

test_get_tenant()

test_get_tenant_by_name()

test_get_tenants_for_token()

test_get_user()

test_get_user_by_name()

test_get_user_roles_with_tenant()

test_get_user_roles_without_tenant()

test_invalid_parameter_error_response()

test_invalid_token_returns_not_found()

test_public_extensions()

test_public_multiple_choice()

test_public_not_found()

test_public_osksadm_extension_returns_not_found()

test_public_version()

test_remove_role_revokes_token()

test_update_user_tenant()

test_update_user_with_invalid_tenant()

test_update_user_with_invalid_tenant_no_prev_tenant()

test_update_user_with_old_tenant()

test_validate_token()

test_validate_token_belongs_to()

test_validate_token_head()

The same call as above, except using HEAD.

There’s no response to validate here, but this is included for the sake of completely covering the core API.

test_validate_token_no_belongs_to_still_returns_catalog()

test_validate_token_service_role()

test_www_authenticate_header()

test_www_authenticate_header_host()

class keystone.tests.unit.test_v2.LegacyV2UsernameTests

Bases: object

Test to show the broken username behavior in V2.

The V2 API is documented to use username instead of name. The API forced used to use name and left the username to fall into the extra field.

These tests ensure this behavior works so fixes to username/name will be backward compatible.

create_user(**user_attrs)

Create a users and returns the response object.

Parameters:user_attrs – attributes added to the request body (optional)

test_create_with_extra_username()

The response for creating a user will contain the extra fields.

test_get_returns_username_from_extra()

The response for getting a user will contain the extra fields.

test_update_returns_new_username_when_adding_username()

The response for updating a user will contain the extra fields.

This is specifically testing for updating a username when a value was not previously set.

test_update_returns_new_username_when_updating_username()

The response for updating a user will contain the extra fields.

This tests updating a username that was previously set.

test_updated_username_is_returned()

Username is set as the value of name if no username is provided.

This matches the v2.0 spec where we really should be using username and not name.

test_username_can_be_used_instead_of_name_create()

test_username_can_be_used_instead_of_name_update()

test_username_is_always_returned_create()

Username is set as the value of name if no username is provided.

This matches the v2.0 spec where we really should be using username and not name.

test_username_is_always_returned_get()

Username is set as the value of name if no username is provided.

This matches the v2.0 spec where we really should be using username and not name.

test_username_is_always_returned_get_by_name()

Username is set as the value of name if no username is provided.

This matches the v2.0 spec where we really should be using username and not name.

test_username_is_always_returned_update_no_username_provided()

Username is set as the value of name if no username is provided.

This matches the v2.0 spec where we really should be using username and not name.

class keystone.tests.unit.test_v2.RestfulTestCase(*args, **kwargs)

Bases: keystone.tests.unit.rest.RestfulTestCase

setUp()

class keystone.tests.unit.test_v2.TestFernetTokenProviderV2(*args, **kwargs)

Bases: keystone.tests.unit.test_v2.RestfulTestCase

assertValidScopedTokenResponse(r)

assertValidUnscopedTokenResponse(r)

config_overrides()

new_project_ref()

setUp()

test_authenticate_scoped_token()

test_authenticate_unscoped_token()

test_rescoped_tokens_maintain_original_expiration()

test_token_authentication_and_validation()

Test token authentication for Fernet token provider.

Verify that token authentication returns validate response code and valid token belongs to project.

test_validate_scoped_token()

test_validate_unscoped_token()

class keystone.tests.unit.test_v2.V2TestCase

Bases: object

assertNoRoles(r)

assertValidAuthenticationResponse(r, require_service_catalog=False)

assertValidEndpointListResponse(r)

assertValidErrorResponse(r)

assertValidExtension(extension, expected)

assertValidExtensionListResponse(r, expected)

assertValidExtensionResponse(r, expected)

assertValidMultipleChoiceResponse(r)

assertValidRevocationListResponse(response)

assertValidRoleListResponse(r)

assertValidTenantListResponse(r)

assertValidTenantResponse(r)

assertValidUser(user)

assertValidUserResponse(r)

assertValidVersion(version)

assertValidVersionResponse(r)

config_overrides()

get_user_attribute_from_response(r, attribute_name)

get_user_from_response(r)

test_authenticating_a_user_with_an_OSKSADM_password()

test_create_update_user_invalid_enabled_type()

test_enable_or_disable_user()

test_fetch_revocation_list_admin_200()

test_fetch_revocation_list_nonadmin_fails()

test_service_crud_requires_auth()

Service CRUD should return unauthorized without an X-Auth-Token.

test_updating_a_user_with_an_OSKSADM_password()

test_user_role_list_requires_auth()

User role list return unauthorized without an X-Auth-Token.

class keystone.tests.unit.test_v2.V2TestCaseFernet(*args, **kwargs)

Bases: keystone.tests.unit.test_v2.V2TestCase, keystone.tests.unit.test_v2.RestfulTestCase, keystone.tests.unit.test_v2.CoreApiTests, keystone.tests.unit.test_v2.LegacyV2UsernameTests

config_overrides()

test_fetch_revocation_list_md5()

test_fetch_revocation_list_sha256()

class keystone.tests.unit.test_v2.V2TestCaseUUID(*args, **kwargs)

Bases: keystone.tests.unit.test_v2.V2TestCase, keystone.tests.unit.test_v2.RestfulTestCase, keystone.tests.unit.test_v2.CoreApiTests, keystone.tests.unit.test_v2.LegacyV2UsernameTests

config_overrides()

keystone.tests.unit.test_v2_controller module

class keystone.tests.unit.test_v2_controller.TenantTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

Test for the V2 Tenant controller.

These tests exercise keystone.assignment.controllers.Tenant.

setUp()

test_create_is_domain_project_fails()

Test that the creation of a project acting as a domain fails.

test_create_project_passing_is_domain_false_fails()

Test that passing is_domain=False is not allowed.

test_delete_is_domain_project_not_found()

Test that delete is_domain project is not allowed in v2.

test_get_is_domain_project_not_found()

Test that get project does not return is_domain projects.

test_get_project_users_no_user()

Test the user’s existence for get_project_users.

When a user that’s not known to identity has a role on a project, then get_project_users just skips that user.

test_list_is_domain_project_not_found()

Test v2 get_all_projects having projects that act as a domain.

In v2 no project with the is_domain flag enabled should be returned.

test_list_projects_default_domain()

Test that list projects only returns those in the default domain.

test_update_is_domain_project_not_found()

Test that update is_domain project is not allowed in v2.

keystone.tests.unit.test_v2_validation module

class keystone.tests.unit.test_v2_validation.RoleValidationTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.BaseTestCase

Test for V2 Roles API Validation.

setUp()

test_validate_role_create_fails_with_invalid_name()

Exception when validating a create request with invalid name.

test_validate_role_create_fails_with_invalid_params()

test_validate_role_create_fails_with_no_params()

test_validate_role_create_succeeds()

test_validate_role_create_succeeds_with_extra_params()

class keystone.tests.unit.test_v2_validation.ServiceValidationTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.BaseTestCase

Test for V2 Service API Validation.

setUp()

test_validate_service_create_fails_with_invalid_name()

test_validate_service_create_fails_with_invalid_params()

test_validate_service_create_succeeds()

test_validate_service_create_with_enabled()

Validate enabled as boolean-like values.

test_validate_service_create_with_invalid_enabled_fails()

Exception is raised when enabled isn’t a boolean-like value.

test_validate_service_create_with_invalid_type()

test_validate_service_create_with_type_too_large()

class keystone.tests.unit.test_v2_validation.TenantValidationTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.BaseTestCase

Test for v2 Tenant API Validation.

setUp()

test_validate_tenant_create_fails_with_invalid_name()

Exception when validating a create request with invalid name.

test_validate_tenant_create_failure_with_empty_request()

test_validate_tenant_create_failure_with_is_domain()

test_validate_tenant_create_failure_with_missing_name()

test_validate_tenant_create_success()

test_validate_tenant_create_success_with_empty_description()

test_validate_tenant_create_success_with_extra_parameters()

test_validate_tenant_create_with_enabled()

Validate enabled as boolean-like values.

test_validate_tenant_create_with_invalid_enabled_fails()

Exception is raised when enabled isn’t a boolean-like value.

test_validate_tenant_update_fails_with_invalid_name()

Exception when validating an update request with invalid name.

test_validate_tenant_update_success()

test_validate_tenant_update_success_with_optional_ids()

test_validate_tenant_update_with_domain_id()

test_validate_tenant_update_with_empty_request()

test_validate_tenant_update_with_enabled()

Validate enabled as boolean-like values.

test_validate_tenant_update_with_invalid_enabled_fails()

Exception is raised when enabled isn’t a boolean-like value.

test_validate_tenant_update_with_is_domain()

class keystone.tests.unit.test_v2_validation.UserValidationTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.BaseTestCase

Test for V2 User API Validation.

setUp()

test_validate_user_create_fails_with_invalid_name()

test_validate_user_create_fails_with_invalid_params()

test_validate_user_create_succeeds_with_name()

test_validate_user_create_succeeds_with_username()

test_validate_user_create_with_enabled()

Validate enabled as boolean-like values.

test_validate_user_create_with_invalid_enabled_fails()

Exception is raised when enabled isn’t a boolean-like value.

test_validate_user_update_fails_with_invalid_name()

test_validate_user_update_succeeds_with_name()

test_validate_user_update_succeeds_with_no_params()

test_validate_user_update_succeeds_with_username()

test_validate_user_update_with_enabled()

Validate enabled as boolean-like values.

test_validate_user_update_with_invalid_enabled_fails()

Exception is raised when enabled isn’t a boolean-like value.

keystone.tests.unit.test_v3 module

class keystone.tests.unit.test_v3.AssignmentTestMixin

Bases: object

To hold assignment helper functions.

build_role_assignment_entity(link=None, prior_role_link=None, **attribs)

Build and return a role assignment entity with provided attributes.

Provided attributes are expected to contain: domain_id or project_id, user_id or group_id, role_id and, optionally, inherited_to_projects.

build_role_assignment_entity_include_names(domain_ref=None, role_ref=None, group_ref=None, user_ref=None, project_ref=None, inherited_assignment=None)

Build and return a role assignment entity with provided attributes.

The expected attributes are: domain_ref or project_ref, user_ref or group_ref, role_ref and, optionally, inherited_to_projects.

build_role_assignment_link(**attribs)

Build and return a role assignment link with provided attributes.

Provided attributes are expected to contain: domain_id or project_id, user_id or group_id, role_id and, optionally, inherited_to_projects.

build_role_assignment_query_url(effective=False, **filters)

Build and return a role assignment query url with provided params.

Available filters are: domain_id, project_id, user_id, group_id, role_id and inherited_to_projects.

class keystone.tests.unit.test_v3.AuthContextMiddlewareAdminTokenTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

config_overrides()

test_admin_auth_context()

class keystone.tests.unit.test_v3.AuthContextMiddlewareTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

test_auth_context_build_by_middleware()

test_auth_context_override()

test_domain_scoped_token_auth_context()

test_oslo_context()

test_project_scoped_token_auth_context()

test_unscoped_token_auth_context()

class keystone.tests.unit.test_v3.AuthTestMixin

Bases: object

To hold auth building helper functions.

build_auth_scope(project_id=None, project_name=None, project_domain_id=None, project_domain_name=None, domain_id=None, domain_name=None, trust_id=None, unscoped=None, is_domain=None)

build_authentication_request(token=None, user_id=None, username=None, user_domain_id=None, user_domain_name=None, password=None, kerberos=False, **kwargs)

Build auth dictionary.

It will create an auth dictionary based on all the arguments that it receives.

build_password_auth(user_id=None, username=None, user_domain_id=None, user_domain_name=None, password=None)

build_token_auth(token)

class keystone.tests.unit.test_v3.JsonHomeTestMixin

Bases: object

JSON Home test.

Mixin this class to provide a test for the JSON-Home response for an extension.

The base class must set JSON_HOME_DATA to a dict of relationship URLs (rels) to the JSON-Home data for the relationship. The rels and associated data must be in the response.

test_get_json_home()

class keystone.tests.unit.test_v3.RestfulTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.SQLDriverOverrides, keystone.tests.unit.rest.RestfulTestCase, keystone.tests.common.auth.AuthTestMixin

assertEqualTokens(a, b)

Assert that two tokens are equal.

Compare two tokens except for their ids. This also truncates the time in the comparison.

assertRoleAssignmentInListResponse(resp, ref, expected=1)

assertRoleAssignmentNotInListResponse(resp, ref)

assertRoleInListResponse(resp, ref, expected=1)

assertRoleNotInListResponse(resp, ref)

assertValidCatalog(entity)

assertValidCatalogResponse(resp, *args, **kwargs)

assertValidCredential(entity, ref=None)

assertValidCredentialListResponse(resp, *args, **kwargs)

assertValidCredentialResponse(resp, *args, **kwargs)

assertValidDomain(entity, ref=None)

assertValidDomainListResponse(resp, *args, **kwargs)

assertValidDomainResponse(resp, *args, **kwargs)

assertValidDomainScopedTokenResponse(r, *args, **kwargs)

assertValidEndpoint(entity, ref=None)

assertValidEndpointListResponse(resp, *args, **kwargs)

assertValidEndpointResponse(resp, *args, **kwargs)

assertValidEntity(entity, ref=None, keys_to_check=None)

Make assertions common to all API entities.

If a reference is provided, the entity will also be compared against the reference.

assertValidErrorResponse(r)

assertValidGroup(entity, ref=None)

assertValidGroupListResponse(resp, *args, **kwargs)

assertValidGroupResponse(resp, *args, **kwargs)

assertValidISO8601ExtendedFormatDatetime(dt)

assertValidListLinks(links, resource_url=None)

assertValidListResponse(resp, key, entity_validator, ref=None, expected_length=None, keys_to_check=None, resource_url=None)

Make assertions common to all API list responses.

If a reference is provided, it’s ID will be searched for in the response, and asserted to be equal.

assertValidPolicy(entity, ref=None)

assertValidPolicyListResponse(resp, *args, **kwargs)

assertValidPolicyResponse(resp, *args, **kwargs)

assertValidProject(entity, ref=None)

assertValidProjectListResponse(resp, *args, **kwargs)

assertValidProjectResponse(resp, *args, **kwargs)

assertValidProjectScopedTokenResponse(r, *args, **kwargs)

assertValidRegion(entity, ref=None)

assertValidRegionListResponse(resp, *args, **kwargs)

assertValidRegionResponse(resp, *args, **kwargs)

assertValidResponse(resp, key, entity_validator, *args, **kwargs)

Make assertions common to all API responses.

assertValidRole(entity, ref=None)

assertValidRoleAssignment(entity, ref=None)

assertValidRoleAssignmentListResponse(resp, expected_length=None, resource_url=None)

assertValidRoleListResponse(resp, *args, **kwargs)

assertValidRoleResponse(resp, *args, **kwargs)

assertValidScopedTokenResponse(r, *args, **kwargs)

assertValidService(entity, ref=None)

assertValidServiceListResponse(resp, *args, **kwargs)

assertValidServiceProvider(entity, ref=None, *args, **kwargs)

assertValidServiceProviderListResponse(resp, *args, **kwargs)

assertValidServiceResponse(resp, *args, **kwargs)

assertValidTokenResponse(r, user=None)

assertValidTrust(entity, ref=None, summary=False)

assertValidTrustListResponse(resp, *args, **kwargs)

assertValidTrustResponse(resp, *args, **kwargs)

assertValidTrustSummary(entity, ref=None)

assertValidUnscopedTokenResponse(r, *args, **kwargs)

assertValidUser(entity, ref=None)

assertValidUserListResponse(resp, *args, **kwargs)

assertValidUserResponse(resp, *args, **kwargs)

build_external_auth_request(remote_user, remote_domain=None, auth_data=None, kerberos=False)

config_files()

create_new_default_project_for_user(user_id, domain_id, enable_project=True)

delete(path, expected_status=204, **kwargs)

generate_token_schema(domain_scoped=False, project_scoped=False)

Return a dictionary of token properties to validate against.

get(path, expected_status=200, **kwargs)

get_admin_token()

Convenience method so that we can test authenticated requests.

get_domain_scoped_token()

Convenience method for requesting domain scoped token.

get_requested_token(auth)

Request the specific token we want.

get_scoped_token()

Convenience method so that we can test authenticated requests.

get_unscoped_token()

Convenience method so that we can test authenticated requests.

head(path, expected_status=204, **kwargs)

load_backends()

load_fixtures(fixtures)

load_sample_data(create_region_and_endpoints=True)

patch(path, expected_status=200, **kwargs)

post(path, expected_status=201, **kwargs)

put(path, expected_status=204, **kwargs)

setUp(app_conf='keystone')

Setup for v3 Restful Test Cases.

v3_create_token(auth, expected_status=201)

v3_noauth_request(path, **kwargs)

v3_request(path, **kwargs)

class keystone.tests.unit.test_v3.VersionTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

test_get_version()

keystone.tests.unit.test_v3_assignment module

class keystone.tests.unit.test_v3_assignment.AssignmentInheritanceTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase, keystone.tests.unit.test_v3.AssignmentTestMixin

Test inheritance crud and its effects.

test_crud_inherited_and_direct_assignment_on_domains()

test_crud_inherited_and_direct_assignment_on_projects()

test_crud_user_inherited_domain_role_grants()

test_filtered_role_assignments_for_inherited_grants()

Call GET /role_assignments?scope.OS-INHERIT:inherited_to.

Test Plan:

• Create 5 roles
• Create a domain with a user, group and two projects
• Assign three direct spoiler roles to projects
• Issue the URL to add an inherited user role to the domain
• Issue the URL to add an inherited group role to the domain
• Issue the URL to filter by inherited roles - this should return just the 2 inherited roles.

test_get_effective_role_assignments_for_project_hierarchy()

Call GET /role_assignments?effective.

Test Plan:

• Create 2 roles
• Create a hierarchy of projects with one root and one leaf project
• Issue the URL to add a non-inherited user role to the root project
• Issue the URL to add an inherited user role to the root project
• Issue the URL to get effective role assignments - this should return 1 role (non-inherited) on the root project and 1 role (inherited) on the leaf project.

test_get_effective_role_assignments_for_project_tree()

Get role_assignment ?project_id=X&include_subtree=True&effective``.

Test Plan:

• Create 2 roles and a hierarchy of projects with one root and 4 levels of child project
• Issue the URL to add a non-inherited user role to the root project and a level 1 project
• Issue the URL to add an inherited user role on the level 2 project
• Issue the URL to get effective role assignments for the level 1 project and it’s subtree - this should return a role (non-inherited) on the level 1 project and roles (inherited) on each of the level 2, 3 and 4 projects

test_get_inherited_role_assignments_for_project_hierarchy()

Call GET /role_assignments?scope.OS-INHERIT:inherited_to.

Test Plan:

• Create 2 roles
• Create a hierarchy of projects with one root and one leaf project
• Issue the URL to add a non-inherited user role to the root project
• Issue the URL to add an inherited user role to the root project
• Issue the URL to filter inherited to projects role assignments - this should return 1 role (inherited) on the root project.

test_get_role_assignments_for_project_hierarchy()

Call GET /role_assignments.

Test Plan:

• Create 2 roles
• Create a hierarchy of projects with one root and one leaf project
• Issue the URL to add a non-inherited user role to the root project
• Issue the URL to add an inherited user role to the root project
• Issue the URL to get all role assignments - this should return just 2 roles (non-inherited and inherited) in the root project.

test_get_role_assignments_for_project_tree()

Get role_assignment?scope.project.id=X&include_subtree``.

Test Plan:

• Create 2 roles and a hierarchy of projects with one root and one leaf
• Issue the URL to add a non-inherited user role to the root project and the leaf project
• Issue the URL to get role assignments for the root project but not the subtree - this should return just the root assignment
• Issue the URL to get role assignments for the root project and it’s subtree - this should return both assignments
• Check that explicitly setting include_subtree to False is the equivalent to not including it at all in the query.

test_get_token_from_inherited_group_domain_role_grants()

test_get_token_from_inherited_group_project_role_grants()

test_get_token_from_inherited_user_domain_role_grants()

test_get_token_from_inherited_user_project_role_grants()

test_list_inherited_role_assignments_include_names()

Call GET /role_assignments?include_names.

Test goal: ensure calling list role assignments including names honors the inherited role assignments flag.

Test plan: - Create a role and a domain with a user; - Create a inherited role assignment; - List role assignments for that user; - List role assignments for that user including names.

test_list_role_assignments_for_disabled_inheritance_extension()

Call GET /role_assignments with inherited domain grants.

Test Plan:

• Issue the URL to add inherited role to the domain
• Issue the URL to check effective roles on project include the inherited role
• Disable the extension
• Re-check the effective roles, proving the inherited role no longer shows up.

test_list_role_assignments_for_inherited_domain_grants()

Call GET /role_assignments with inherited domain grants.

Test Plan:

• Create 4 roles
• Create a domain with a user and two projects
• Assign two direct roles to project1
• Assign a spoiler role to project2
• Issue the URL to add inherited role to the domain
• Issue the URL to check it is indeed on the domain
• Issue the URL to check effective roles on project1 - this should return 3 roles.

test_list_role_assignments_for_inherited_group_domain_grants()

Call GET /role_assignments with inherited group domain grants.

Test Plan:

• Create 4 roles
• Create a domain with a user and two projects
• Assign two direct roles to project1
• Assign a spoiler role to project2
• Issue the URL to add inherited role to the domain
• Issue the URL to check it is indeed on the domain
• Issue the URL to check effective roles on project1 - this should return 3 roles.

test_list_role_assignments_include_names_domain_role()

test_list_role_assignments_include_names_global_role()

test_project_id_specified_if_include_subtree_specified()

When using include_subtree, you must specify a project ID.

class keystone.tests.unit.test_v3_assignment.AssignmentTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase, keystone.tests.unit.test_v3.AssignmentTestMixin

Test roles and role assignments.

setUp()

test_check_effective_values_for_role_assignments()

Call GET /role_assignments?effective=value.

Check the various ways of specifying the ‘effective’ query parameter. If the ‘effective’ query parameter is included then this should always be treated as meaning ‘True’ unless it is specified as:

{url}?effective=0

This is by design to match the agreed way of handling policy checking on query/filter parameters.

Test Plan:

• Create two extra user for tests
• Add these users to a group
• Add a role assignment for the group on a domain
• Get a list of all role assignments, checking one has been added
• Then issue various request with different ways of defining the ‘effective’ query parameter. As we have tested the correctness of the data coming back when we get effective roles in other tests, here we just use the count of entities to know if we are getting effective roles or not

test_create_member_role()

Call POST /roles.

test_create_role()

Call POST /roles.

test_create_role_bad_request()

Call POST /roles.

test_crud_group_domain_role_grants()

test_crud_group_domain_role_grants_no_group()

Grant role on a domain to a group that doesn’t exist.

When grant a role on a domain to a group that doesn’t exist, the server returns 404 Not Found for the group.

test_crud_group_project_role_grants()

test_crud_group_project_role_grants_no_group()

Grant role on a project to a group that doesn’t exist.

When grant a role on a project to a group that doesn’t exist, the server returns 404 Not Found for the group.

test_crud_user_domain_role_grants()

test_crud_user_domain_role_grants_no_user()

Grant role on a domain to a user that doesn’t exist.

When grant a role on a domain to a user that doesn’t exist, the server returns 404 Not Found for the user.

test_crud_user_project_role_grants()

test_crud_user_project_role_grants_no_user()

Grant role on a project to a user that doesn’t exist.

When grant a role on a project to a user that doesn’t exist, the server returns Not Found for the user.

test_delete_grant_from_group_and_domain_invalidates_cache(*args, **kwargs)

test_delete_grant_from_group_and_project_invalidates_cache(*args, **kwargs)

test_delete_grant_from_user_and_domain_invalidates_cache(*args, **kwargs)

test_delete_grant_from_user_and_project_invalidate_cache(*args, **kwargs)

test_delete_role()

Call DELETE /roles/{role_id}.

test_delete_user_and_check_role_assignment_fails()

Call DELETE on the user and check the role assignment.

test_delete_user_before_removing_role_assignment_succeeds()

Call DELETE on the user before the role assignment.

test_filtered_role_assignments()

Call GET /role_assignments?filters.

Test Plan:

• Create extra users, group, role and project for tests
• Make the following assignments: Give group1, role1 on project1 and domain Give user1, role2 on project1 and domain Make User1 a member of Group1
• Test a series of single filter list calls, checking that the correct results are obtained
• Test a multi-filtered list call
• Test listing all effective roles for a given user
• Test the equivalent of the list of roles in a project scoped token (all effective roles for a user on a project)

test_get_effective_role_assignments()

Call GET /role_assignments?effective.

Test Plan:

• Create two extra user for tests
• Add these users to a group
• Add a role assignment for the group on a domain
• Get a list of all role assignments, checking one has been added
• Then get a list of all effective role assignments - the group assignment should have turned into assignments on the domain for each of the group members.

test_get_head_role()

Call GET & HEAD /roles/{role_id}.

test_get_head_role_assignments()

Call GET & HEAD /role_assignments.

The sample data set up already has a user, group and project that is part of self.domain. We use these plus a new user we create as our data set, making sure we ignore any role assignments that are already in existence.

Since we don’t yet support a first class entity for role assignments, we are only testing the LIST API. To create and delete the role assignments we use the old grant APIs.

Test Plan:

• Create extra user for tests
• Get a list of all existing role assignments
• Add a new assignment for each of the four combinations, i.e. group+domain, user+domain, group+project, user+project, using the same role each time
• Get a new list of all role assignments, checking these four new ones have been added
• Then delete the four we added
• Get a new list of all role assignments, checking the four have been removed

test_list_head_roles()

Call GET & HEAD /roles.

test_token_revoked_once_group_role_grant_revoked()

Test token is revoked when group role grant is revoked.

When a role granted to a group is revoked for a given scope, all tokens related to this scope and belonging to one of the members of this group should be revoked.

The revocation should be independently to the presence of the revoke API.

test_update_role()

Call PATCH /roles/{role_id}.

class keystone.tests.unit.test_v3_assignment.DomainSpecificRoleTests(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase, keystone.tests.unit.core.TestCase

setUp()

test_cross_domain_assignment_invalid()

test_cross_domain_assignment_valid()

test_cross_domain_implied_roles_authentication()

test_delete_domain_specific_roles()

test_get_and_list_domain_specific_roles()

test_same_domain_assignment()

test_update_domain_specific_roles()

class keystone.tests.unit.test_v3_assignment.ImpliedRolesTests(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase, keystone.tests.unit.test_v3.AssignmentTestMixin, keystone.tests.unit.core.TestCase

test_CRD_implied_roles()

test_global_role_cannot_imply_domain_specific_role()

test_list_all_rules()

test_list_implied_roles_none()

test_list_role_assignments_with_implied_roles()

Call GET /role_assignments with implied role grant.

Test Plan:

• Create a domain with a user and a project
• Create 3 roles
• Role 0 implies role 1 and role 1 implies role 2
• Assign the top role to the project
• Issue the URL to check effective roles on project - this should return all 3 roles.
• Check the links of the 3 roles indicate the prior role where appropriate

test_root_role_as_implied_role_forbidden()

Test root role is forbidden to be set as an implied role.

Create 2 roles that are prohibited from being an implied role. Create 1 additional role which should be accepted as an implied role. Assure the prohibited role names cannot be set as an implied role. Assure the accepted role name which is not a member of the prohibited implied role list can be successfully set an implied role.

test_trusts_from_domain_specific_implied_role()

test_trusts_from_implied_role()

class keystone.tests.unit.test_v3_assignment.ListUserProjectsTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

Test for /users/<user>/projects.

load_sample_data()

test_list_by_domain_id()

test_list_disabled()

test_list_enabled()

test_list_head_all()

class keystone.tests.unit.test_v3_assignment.RoleAssignmentBaseTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase, keystone.tests.unit.test_v3.AssignmentTestMixin

Base class for testing /v3/role_assignments API behavior.

MAX_HIERARCHY_BREADTH = 3

MAX_HIERARCHY_DEPTH = 4

get_role_assignments(expected_status=200, **filters)

Return the result from querying role assignment API + queried URL.

Calls GET /v3/role_assignments?<params> and returns its result, where <params> is the HTTP query parameters form of effective option plus filters, if provided. Queried URL is returned as well.

Returns:a tuple containing the list role assignments API response and queried URL.

load_sample_data()

Create sample data to be used on tests.

Created data are i) a role and ii) a domain containing: a project hierarchy and 3 users within 3 groups.

class keystone.tests.unit.test_v3_assignment.RoleAssignmentDirectTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_v3_assignment.RoleAssignmentBaseTestCase

Class for testing direct assignments on /v3/role_assignments API.

Direct assignments on a domain or project have effect on them directly, instead of on their project hierarchy, i.e they are non-inherited. In addition, group direct assignments are not expanded to group’s users.

Tests on this class make assertions on the representation and API filtering of direct assignments.

test_get_role_assignments_by_domain(**filters)

test_get_role_assignments_by_domain_and_group(**filters)

test_get_role_assignments_by_domain_and_user(**filters)

test_get_role_assignments_by_domain_group_and_role(**filters)

test_get_role_assignments_by_domain_user_and_role(**filters)

test_get_role_assignments_by_group(**filters)

test_get_role_assignments_by_project(**filters)

test_get_role_assignments_by_project_and_group(**filters)

test_get_role_assignments_by_project_and_user(**filters)

test_get_role_assignments_by_project_group_and_role(**filters)

test_get_role_assignments_by_project_user_and_role(**filters)

test_get_role_assignments_by_role(**filters)

test_get_role_assignments_by_user(**filters)

class keystone.tests.unit.test_v3_assignment.RoleAssignmentEffectiveTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_v3_assignment.RoleAssignmentInheritedTestCase

Class for testing inheritance effects on /v3/role_assignments API.

Inherited assignments on a domain or project have no effect on them directly, but on the projects under them instead.

Tests on this class make assertions on the effect of inherited assignments and API filtering.

class keystone.tests.unit.test_v3_assignment.RoleAssignmentFailureTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_v3_assignment.RoleAssignmentBaseTestCase

Class for testing invalid query params on /v3/role_assignments API.

Querying domain and project, or user and group results in a HTTP 400 Bad Request, since a role assignment must contain only a single pair of (actor, target). In addition, since filtering on role assignments applies only to the final result, effective mode cannot be combined with i) group or ii) domain and inherited, because it would always result in an empty list.

test_get_role_assignments_by_domain_and_project()

test_get_role_assignments_by_effective_and_group()

test_get_role_assignments_by_effective_and_inherited()

test_get_role_assignments_by_user_and_group()

class keystone.tests.unit.test_v3_assignment.RoleAssignmentInheritedTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_v3_assignment.RoleAssignmentDirectTestCase

Class for testing inherited assignments on /v3/role_assignments API.

Inherited assignments on a domain or project have no effect on them directly, but on the projects under them instead.

Tests on this class do not make assertions on the effect of inherited assignments, but in their representation and API filtering.

keystone.tests.unit.test_v3_auth module

class keystone.tests.unit.test_v3_auth.AllowRescopeScopedTokenDisabledTests(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

config_overrides()

test_rescoped_domain_token_disabled()

test_rescoping_v2_to_v2_disabled()

test_rescoping_v2_to_v3_disabled()

test_rescoping_v3_to_v2_disabled()

test_rescoping_v3_to_v3_disabled()

class keystone.tests.unit.test_v3_auth.AuthExternalDomainBehavior

Bases: object

content_type = 'json'

test_project_id_scoped_with_remote_user()

test_remote_user_with_realm()

test_unscoped_bind_with_remote_user()

class keystone.tests.unit.test_v3_auth.TestAuthContext(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

setUp()

test_identity_attribute_conflict()

test_identity_attribute_conflict_with_none_value()

test_non_identity_attribute_conflict_override()

test_pick_lowest_expires_at()

class keystone.tests.unit.test_v3_auth.TestAuthExternalDefaultDomain

Bases: object

config_overrides()

content_type = 'json'

test_project_id_scoped_with_remote_user()

test_remote_user_with_default_domain()

test_unscoped_bind_with_remote_user()

class keystone.tests.unit.test_v3_auth.TestAuthExternalDisabled(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

config_overrides()

test_remote_user_disabled()

class keystone.tests.unit.test_v3_auth.TestAuthExternalDomainBehaviorWithUUID(*args, **kwargs)

Bases: keystone.tests.unit.test_v3_auth.AuthExternalDomainBehavior, keystone.tests.unit.test_v3.RestfulTestCase

config_overrides()

class keystone.tests.unit.test_v3_auth.TestAuthInfo(*args, **kwargs)

Bases: keystone.tests.common.auth.AuthTestMixin, testtools.testcase.TestCase

setUp()

test_both_project_and_domain_in_scope()

test_get_method_data_invalid_method()

test_get_method_names_duplicates()

test_missing_auth_method_data()

test_project_name_no_domain()

test_unsupported_auth_method()

class keystone.tests.unit.test_v3_auth.TestAuthJSONExternal(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

auth_plugin_config_override(methods=None, **method_classes)

content_type = 'json'

test_remote_user_no_method()

class keystone.tests.unit.test_v3_auth.TestAuthSpecificData(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

test_get_catalog_domain_scoped_token()

Call GET /auth/catalog with a domain-scoped token.

test_get_catalog_no_token()

Call GET /auth/catalog without a token.

test_get_catalog_project_scoped_token()

Call GET /auth/catalog with a project-scoped token.

test_get_catalog_unscoped_token()

Call GET /auth/catalog with an unscoped token.

test_get_domains_project_scoped_token()

test_get_projects_project_scoped_token()

class keystone.tests.unit.test_v3_auth.TestAuthTOTP(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

auth_plugin_config_override()

cleanup()

setUp()

test_generated_passcode_is_correct_format()

test_with_a_corrupt_totp_credential()

test_with_a_valid_passcode()

test_with_an_invalid_passcode_and_user_credentials()

test_with_an_invalid_passcode_with_no_user_credentials()

test_with_multiple_credentials()

test_with_multiple_users()

test_with_multiple_users_and_invalid_credentials()

Prevent logging in with someone else’s credentials.

It’s very easy to forget to limit the credentials query by user. Let’s just test it for a sanity check.

test_with_username_and_domain_id()

class keystone.tests.unit.test_v3_auth.TestFernetTokenAPIs(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase, keystone.tests.unit.test_v3_auth.TokenAPITests, keystone.tests.unit.test_v3_auth.TokenDataTests

config_overrides()

setUp()

test_auth_with_bind_token()

test_trust_scoped_token_is_invalid_after_disabling_trustor()

test_v2_v3_bind_token_intermix()

test_validate_tampered_project_scoped_token_fails()

test_validate_tampered_trust_scoped_token_fails()

test_validate_tampered_unscoped_token_fails()

test_verify_with_bound_token()

class keystone.tests.unit.test_v3_auth.TestFetchRevocationList

Bases: object

Test fetch token revocation list on the v3 Identity API.

config_overrides()

test_audit_id_only_no_tokens()

test_audit_id_only_token()

test_ids_no_tokens()

test_ids_token()

class keystone.tests.unit.test_v3_auth.TestMFARules(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

auth_plugin_config_override(methods=None, **method_classes)

config_overrides()

test_MFA_multi_method_rules_requirements_met_succeeds()

test_MFA_multi_method_rules_requirements_not_met_fails()

test_MFA_rules_all_bogus_rules_results_in_default_behavior()

test_MFA_rules_bogus_non_existing_auth_method_succeeds()

test_MFA_rules_disabled_MFA_succeeeds()

test_MFA_rules_rescope_works_without_token_method_in_rules()

test_MFA_single_method_rules_requirements_met_succeeds()

test_MFA_single_method_rules_requirements_not_met_fails()

class keystone.tests.unit.test_v3_auth.TestTokenRevokeApi(*args, **kwargs)

Bases: keystone.tests.unit.test_v3_auth.TestTokenRevokeById

Test token revocation on the v3 Identity API.

assertDomainAndProjectInList(events_response, domain_id)

assertEventDataInList(events, **kwargs)

assertValidDeletedProjectResponse(events_response, project_id)

assertValidRevokedTokenResponse(events_response, **kwargs)

config_overrides()

test_disable_domain_shows_in_event_list()

test_list_delete_project_shows_in_event_list()

test_list_delete_token_shows_in_event_list()

test_list_with_filter()

test_revoke_by_id_false_returns_gone()

test_revoke_token()

test_revoke_v2_token()

class keystone.tests.unit.test_v3_auth.TestTokenRevokeByAssignment(*args, **kwargs)

Bases: keystone.tests.unit.test_v3_auth.TestTokenRevokeById

config_overrides()

test_removing_role_assignment_keeps_other_project_token_groups()

Test assignment isolation.

Revoking a group role from one project should not invalidate all group users’ tokens

class keystone.tests.unit.test_v3_auth.TestTokenRevokeById(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

Test token revocation on the v3 Identity API.

config_overrides()

get_v2_token(token=None, project_id=None)

role_data_fixtures()

setUp()

Setup for Token Revoking Test Cases.

As well as the usual housekeeping, create a set of domains, users, groups, roles and projects for the subsequent tests:

• Two domains: A & B
• Three users (1, 2 and 3)
• Three groups (1, 2 and 3)
• Two roles (1 and 2)
• DomainA owns user1, domainB owns user2 and user3
• DomainA owns group1 and group2, domainB owns group3
• User1 and user2 are members of group1
• User3 is a member of group2
• Two projects: A & B, both in domainA
• Group1 has role1 on Project A and B, meaning that user1 and user2 will get these roles by virtue of membership
• User1, 2 and 3 have role1 assigned to projectA
• Group1 has role1 on Project A and B, meaning that user1 and user2 will get role1 (duplicated) by virtue of membership
• User1 has role2 assigned to domainA

test_deleting_group_grant_revokes_tokens()

Test deleting a group grant revokes tokens.

Test Plan:

• Get a token for user1, scoped to ProjectA
• Get a token for user2, scoped to ProjectA
• Get a token for user3, scoped to ProjectA
• Delete the grant group1 has on ProjectA
• Check tokens for user1 & user2 are no longer valid, since user1 and user2 are members of group1
• Check token for user3 is invalid too

test_deleting_project_deletes_grants()

test_deleting_project_revokes_token()

test_deleting_role_revokes_token()

Test deleting a role revokes token.

Add some additional test data, namely:

• A third project (project C)
• Three additional users - user4 owned by domainB and user5 and 6 owned by domainA (different domain ownership should not affect the test results, just provided to broaden test coverage)
• User5 is a member of group1
• Group1 gets an additional assignment - role1 on projectB as well as its existing role1 on projectA
• User4 has role2 on Project C
• User6 has role1 on projectA and domainA
• This allows us to create 5 tokens by virtue of different types of role assignment: - user1, scoped to ProjectA by virtue of user role1 assignment - user5, scoped to ProjectB by virtue of group role1 assignment - user4, scoped to ProjectC by virtue of user role2 assignment - user6, scoped to ProjectA by virtue of user role1 assignment - user6, scoped to DomainA by virtue of user role1 assignment
• role1 is then deleted
• Check the tokens on Project A and B, and DomainA are revoked, but not the one for Project C

test_deleting_user_grant_revokes_token()

Test deleting a user grant revokes token.

Test Plan:

• Get a token for user1, scoped to ProjectA
• Delete the grant user1 has on ProjectA
• Check token is no longer valid

test_disabling_project_revokes_token()

test_domain_group_role_assignment_maintains_token()

Test domain-group role assignment maintains existing token.

Test Plan:

• Get a token for user1, scoped to ProjectA
• Create a grant for group1 on DomainB
• Check token is still longer valid

test_domain_user_role_assignment_maintains_token()

Test user-domain role assignment maintains existing token.

Test Plan:

• Get a token for user1, scoped to ProjectA
• Create a grant for user1 on DomainB
• Check token is still valid

test_group_membership_changes_revokes_token()

Test add/removal to/from group revokes token.

Test Plan:

• Get a token for user1, scoped to ProjectA
• Get a token for user2, scoped to ProjectA
• Remove user1 from group1
• Check token for user1 is no longer valid
• Check token for user2 is still valid, even though user2 is also part of group1
• Add user2 to group2
• Check token for user2 is now no longer valid

test_removing_role_assignment_does_not_affect_other_users()

Revoking a role from one user should not affect other users.

test_revoke_token_from_token()

test_revoke_token_from_token_v2()

test_revoke_v2_token_no_check()

test_unscoped_token_remains_valid_after_role_assignment()

class keystone.tests.unit.test_v3_auth.TestTokenRevokeSelfAndAdmin(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

Test token revoke using v3 Identity API by token owner and admin.

load_sample_data()

Load Sample Data for Test Cases.

Two domains, domainA and domainB Two users in domainA, userNormalA and userAdminA One user in domainB, userAdminB

test_adminA_revokes_userA_token()

test_adminB_fails_revoking_userA_token()

test_user_revokes_own_token()

class keystone.tests.unit.test_v3_auth.TestTrustAuthFernetTokenProvider(*args, **kwargs)

Bases: keystone.tests.unit.test_v3_auth.TrustAPIBehavior, keystone.tests.unit.test_v3_auth.TestTrustChain

config_overrides()

class keystone.tests.unit.test_v3_auth.TestTrustChain(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

assert_trust_tokens_revoked(trust_id)

assert_user_authenticate(user)

config_overrides()

setUp()

test_delete_broken_chain()

test_delete_trust_cascade()

test_intermediate_user_deleted()

test_intermediate_user_disabled()

test_trustor_roles_revoked()

class keystone.tests.unit.test_v3_auth.TestTrustOptional(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

config_overrides()

test_auth_with_scope_in_trust_forbidden()

test_trusts_returns_not_found()

class keystone.tests.unit.test_v3_auth.TestUUIDTokenAPIs(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase, keystone.tests.unit.test_v3_auth.TokenAPITests, keystone.tests.unit.test_v3_auth.TokenDataTests

config_overrides()

setUp()

test_v3_token_id()

class keystone.tests.unit.test_v3_auth.TokenAPITests

Bases: object

doSetUp()

test_auth_token_cross_domain_group_and_project()

Verify getting a token in cross domain group/project roles.

test_auth_with_bind_token()

test_auth_with_token_as_different_user_fails()

test_bind_not_set_with_remote_user()

test_chained_implied_role_shows_in_v3_token()

test_check_token()

test_create_domain_token_fails_if_domain_name_unsafe()

Verify authenticate to a domain with unsafe name fails.

test_create_domain_token_scoped_with_domain_id()

test_create_domain_token_scoped_with_domain_id_and_user_id()

test_create_domain_token_scoped_with_domain_id_and_username()

test_create_domain_token_scoped_with_domain_name()

test_create_domain_token_scoped_with_domain_name_and_username()

test_create_domain_token_with_group_role()

test_create_domain_token_with_only_domain_name_and_username()

test_create_domain_token_without_grant_returns_unauthorized()

test_create_explicit_unscoped_token()

test_create_implied_role_shows_in_v3_domain_token()

test_create_implied_role_shows_in_v3_project_token()

test_create_project_scoped_token_fails_if_domain_name_unsafe()

Verify authenticate to a project using unsafe domain name fails.

test_create_project_scoped_token_fails_if_project_name_unsafe()

Verify authenticate to a project with unsafe name fails.

test_create_project_scoped_token_with_project_id_and_user_id()

test_create_project_scoped_token_with_username_and_domain_id()

test_create_project_scoped_token_with_username_and_domain_name()

test_create_project_token_fails_with_project_acting_as_domain()

test_create_project_token_with_disabled_project_domain_fails()

test_create_project_token_with_same_domain_and_project_name()

Authenticate to a project with the same name as its domain.

test_create_token_for_user_without_password_fails()

test_create_token_with_nonexistant_domain_id_fails()

test_create_token_with_nonexistant_domain_name_fails()

test_create_token_with_nonexistant_user_id_fails()

test_create_token_with_nonexistant_username_fails()

test_create_token_with_wrong_password_fails()

test_create_unscoped_token_by_authenticating_with_unscoped_token()

test_create_unscoped_token_with_user_domain_id()

test_create_unscoped_token_with_user_domain_name()

test_create_unscoped_token_with_user_id()

test_create_v3_project_token_from_v2_project_token()

test_default_fixture_scope_token()

test_delete_implied_role_do_not_show_in_v3_token()

test_disabled_default_project_domain_result_in_unscoped_token()

test_disabled_users_default_project_result_in_unscoped_token()

test_domain_scoped_token_invalid_after_disabling_domain()

test_domain_scoped_token_is_invalid_after_deleting_grant()

test_domain_scoped_token_is_invalid_after_disabling_user()

test_domain_specific_roles_do_not_show_v3_token()

test_fetch_expired_allow_expired()

test_group_assigned_implied_role_shows_in_v3_token()

test_implicit_project_id_scoped_token_with_user_id_no_catalog()

test_implied_role_disabled_by_config()

test_is_admin_token_by_ids()

test_is_admin_token_by_names()

test_multiple_implied_roles_show_in_v3_token()

test_no_access_to_default_project_result_in_unscoped_token()

test_only_admin_project_set_acts_as_non_admin()

test_project_scoped_token_catalog_attributes()

test_project_scoped_token_catalog_excludes_disabled_endpoint()

test_project_scoped_token_catalog_excludes_disabled_service()

On authenticate, get a catalog that excludes disabled services.

test_project_scoped_token_invalid_after_changing_user_password()

test_project_scoped_token_invalid_after_disabling_project()

test_project_scoped_token_is_invalid_after_deleting_grant()

test_project_scoped_token_is_invalid_after_disabling_user()

test_project_scoped_token_is_scoped_to_default_project()

test_project_scoped_token_no_catalog_is_scoped_to_default_project()

test_remote_user_and_explicit_external()

test_remote_user_and_password()

test_remote_user_bad_password()

test_remote_user_no_domain()

test_remote_user_no_realm()

test_remove_all_roles_from_scope_result_in_404()

test_rescope_unscoped_token_with_trust()

test_rescoping_token()

test_revoke_project_scoped_token()

test_revoke_trust_scoped_token()

test_revoke_unscoped_token()

test_scope_to_project_without_grant_returns_unauthorized()

test_token_for_non_admin_domain_same_project_name_is_not_admin()

test_token_for_non_admin_project_is_not_admin()

test_trust_scoped_token_invalid_after_changing_trustee_password()

test_trust_scoped_token_invalid_after_changing_trustor_password()

test_trust_scoped_token_invalid_after_disabled_trustor_domain()

test_trust_scoped_token_is_invalid_after_disabling_trustee()

test_trust_scoped_token_is_invalid_after_disabling_trustor()

test_trust_token_is_invalid_when_trustee_domain_disabled()

test_unrelated_implied_roles_do_not_change_v3_token()

test_unscoped_token_is_invalid_after_changing_user_password()

test_unscoped_token_is_invalid_after_disabling_user()

test_unscoped_token_is_invalid_after_disabling_user_domain()

test_unscoped_token_is_invalid_after_enabling_disabled_user()

test_user_and_group_roles_scoped_token()

Test correct roles are returned in scoped token.

Test Plan:

• Create a domain, with 1 project, 2 users (user1 and user2) and 2 groups (group1 and group2)
• Make user1 a member of group1, user2 a member of group2
• Create 8 roles, assigning them to each of the 8 combinations of users/groups on domain/project
• Get a project scoped token for user1, checking that the right two roles are returned (one directly assigned, one by virtue of group membership)
• Repeat this for a domain scoped token
• Make user1 also a member of group2
• Get another scoped token making sure the additional role shows up
• User2 is just here as a spoiler, to make sure we don’t get any roles uniquely assigned to it returned in any of our tokens

test_v2_token_deleted_on_v3()

test_v2_v3_bind_token_intermix()

test_v2_v3_token_intermix()

test_v2_v3_unscoped_token_intermix()

test_v2_validate_domain_scoped_token_returns_unauthorized()

test_v3_v2_intermix_domain_scope_failed()

test_v3_v2_intermix_domain_scoped_token_failed()

test_v3_v2_intermix_new_default_domain()

test_v3_v2_intermix_non_default_project_succeed()

test_v3_v2_intermix_non_default_user_succeed()

test_v3_v2_token_intermix()

test_v3_v2_unscoped_token_intermix()

test_validate_a_trust_scoped_token()

test_validate_a_trust_scoped_token_impersonated()

test_validate_domain_scoped_token()

test_validate_expired_domain_scoped_token_returns_not_found()

test_validate_expired_project_scoped_token_returns_not_found()

test_validate_expired_trust_scoped_token_returns_not_found()

test_validate_expired_unscoped_token_returns_not_found()

test_validate_missing_auth_token()

test_validate_missing_subject_token()

test_validate_project_scoped_token()

test_validate_token()

test_validate_token_nocatalog()

test_validate_trust_token_on_v2_fails_outside_default_domain()

test_validate_unscoped_token()

test_verify_with_bound_token()

class keystone.tests.unit.test_v3_auth.TokenDataTests

Bases: object

Test the data in specific token types.

test_domain_scoped_token_format()

test_extra_data_in_domain_scoped_token_fails_validation()

test_extra_data_in_project_scoped_token_fails_validation()

test_extra_data_in_unscoped_token_fails_validation()

test_project_scoped_token_format()

test_unscoped_token_format()

class keystone.tests.unit.test_v3_auth.TrustAPIBehavior(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

Redelegation valid and secure.

Redelegation is a hierarchical structure of trusts between initial trustor and a group of users allowed to impersonate trustor and act in his name. Hierarchy is created in a process of trusting already trusted permissions and organized as an adjacency list using ‘redelegated_trust_id’ field. Redelegation is valid if each subsequent trust in a chain passes ‘not more’ permissions than being redelegated.

Trust constraints are:

• roles - set of roles trusted by trustor
• expiration_time
• allow_redelegation - a flag
• redelegation_count - decreasing value restricting length of trust chain
• remaining_uses - DISALLOWED when allow_redelegation == True

Trust becomes invalid in case:

• trust roles were revoked from trustor
• one of the users in the delegation chain was disabled or deleted
• expiration time passed
• one of the parent trusts has become invalid
• one of the parent trusts was deleted

assertTrustTokensRevoked(trust_id)

config_overrides()

disable_user(user)

setUp()

test_change_password_invalidates_trust_tokens()

test_consume_trust_once()

test_create_one_time_use_trust()

test_create_trust_no_roles()

test_create_unlimited_use_trust()

test_create_unscoped_trust()

test_delete_trust()

test_delete_trust_revokes_tokens()

test_depleted_redelegation_count_error()

test_do_not_consume_remaining_uses_when_get_token_fails()

test_impersonation_token_cannot_create_new_trust()

test_max_redelegation_count_constraint()

test_modified_redelegation_count_error()

test_redelegate_new_role_fails()

test_redelegate_with_role_by_name()

test_redelegation_expiry()

test_redelegation_remaining_uses()

test_redelegation_terminator()

test_redelegation_without_impersonation()

test_roles_subset()

test_trust_chained()

Test that a trust token can’t be used to execute another trust.

To do this, we create an A->B->C hierarchy of trusts, then attempt to execute the trusts in series (C->B->A).

test_trust_deleted_grant()

test_trust_get_token_fails_if_trustee_disabled()

test_trust_get_token_fails_if_trustor_disabled()

test_trustee_can_do_role_ops()

class keystone.tests.unit.test_v3_auth.UUIDAuthExternalDefaultDomain(*args, **kwargs)

Bases: keystone.tests.unit.test_v3_auth.TestAuthExternalDefaultDomain, keystone.tests.unit.test_v3.RestfulTestCase

config_overrides()

class keystone.tests.unit.test_v3_auth.UUIDAuthKerberos(*args, **kwargs)

Bases: keystone.tests.unit.test_v3_auth.AuthExternalDomainBehavior, keystone.tests.unit.test_v3.RestfulTestCase

config_overrides()

class keystone.tests.unit.test_v3_auth.UUIDFetchRevocationList(*args, **kwargs)

Bases: keystone.tests.unit.test_v3_auth.TestFetchRevocationList, keystone.tests.unit.test_v3.RestfulTestCase

config_overrides()

keystone.tests.unit.test_v3_catalog module

class keystone.tests.unit.test_v3_catalog.CatalogTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

Test service & endpoint CRUD.

test_create_endpoint_enabled_false()

Call POST /endpoints with enabled: false.

test_create_endpoint_enabled_str_false()

Call POST /endpoints with enabled: ‘False’.

test_create_endpoint_enabled_str_random()

Call POST /endpoints with enabled: ‘puppies’.

test_create_endpoint_enabled_str_true()

Call POST /endpoints with enabled: ‘True’.

test_create_endpoint_enabled_true()

Call POST /endpoints with enabled: true.

test_create_endpoint_no_enabled()

Call POST /endpoints.

test_create_endpoint_on_v2()

test_create_endpoint_with_empty_url()

Call POST /endpoints.

test_create_endpoint_with_invalid_region_id()

Call POST /endpoints.

test_create_endpoint_with_no_region()

EndpointV3 allows to creates the endpoint without region.

test_create_endpoint_with_region()

EndpointV3 creates the region before creating the endpoint.

This occurs when endpoint is provided with ‘region’ and no ‘region_id’.

test_create_region()

Call POST /regions with an ID in the request body.

test_create_region_with_conflicting_ids()

Call PUT /regions/{region_id} with conflicting region IDs.

test_create_region_with_duplicate_id()

Call PUT /regions/{region_id}.

test_create_region_with_empty_id()

Call POST /regions with an empty ID in the request body.

test_create_region_with_id()

Call PUT /regions/{region_id} w/o an ID in the request body.

test_create_region_with_matching_ids()

Call PUT /regions/{region_id} with an ID in the request body.

test_create_region_without_description()

Call POST /regions without description in the request body.

test_create_region_without_id()

Call POST /regions without an ID in the request body.

test_create_regions_with_same_description_string()

Call POST /regions with duplicate descriptions.

test_create_regions_without_descriptions()

Call POST /regions with no description.

test_create_service()

Call POST /services.

test_create_service_enabled_false()

Call POST /services.

test_create_service_enabled_str_false()

Call POST /services.

test_create_service_enabled_str_random()

Call POST /services.

test_create_service_enabled_str_true()

Call POST /services.

test_create_service_enabled_true()

Call POST /services.

test_create_service_no_enabled()

Call POST /services.

test_create_service_no_name()

Call POST /services.

test_delete_endpoint()

Call DELETE /endpoints/{endpoint_id}.

test_delete_region()

Call DELETE /regions/{region_id}.

test_delete_service()

Call DELETE /services/{service_id}.

test_deleting_endpoint_with_space_in_url()

test_endpoint_create_with_invalid_url()

Test the invalid cases: substitutions is not exactly right.

test_endpoint_create_with_valid_url()

Create endpoint with valid url should be tested,too.

test_endpoint_create_with_valid_url_project_id()

Create endpoint with valid url should be tested,too.

test_filter_list_services_by_name()

Call GET /services?name=<some name>.

test_filter_list_services_by_name_with_list_limit()

Call GET /services?name=<some name>.

test_filter_list_services_by_type()

Call GET /services?type=<some type>.

test_get_head_endpoint()

Call GET & HEAD /endpoints/{endpoint_id}.

test_get_head_region()

Call GET & HEAD /regions/{region_id}.

test_get_head_service()

Call GET & HEAD /services/{service_id}.

test_list_endpoints_filtered_by_interface()

Call GET /endpoints?interface={interface}.

test_list_endpoints_filtered_by_parent_region_id()

Call GET /endpoints?region_id={region_id}.

Ensure passing the parent_region_id as filter returns an empty list.

test_list_endpoints_filtered_by_region_id()

Call GET /endpoints?region_id={region_id}.

test_list_endpoints_filtered_by_service_id()

Call GET /endpoints?service_id={service_id}.

test_list_endpoints_with_multiple_filters()

Call GET /endpoints?interface={interface}....

Ensure passing different combinations of interface, region_id and service_id as filters will return the correct result.

test_list_endpoints_with_random_filter_values()

Call GET /endpoints?interface={interface}....

Ensure passing random values for: interface, region_id and service_id will return an empty list.

test_list_head_endpoints()

Call GET & HEAD /endpoints.

test_list_head_regions()

Call GET & HEAD /regions.

test_list_head_services()

Call GET & HEAD /services.

test_list_regions_filtered_by_parent_region_id()

Call GET /regions?parent_region_id={parent_region_id}.

test_update_endpoint()

Call PATCH /endpoints/{endpoint_id}.

test_update_endpoint_enabled_false()

Call PATCH /endpoints/{endpoint_id} with enabled: False.

test_update_endpoint_enabled_str_false()

Call PATCH /endpoints/{endpoint_id} with enabled: ‘False’.

test_update_endpoint_enabled_str_random()

Call PATCH /endpoints/{endpoint_id} with enabled: ‘kitties’.

test_update_endpoint_enabled_str_true()

Call PATCH /endpoints/{endpoint_id} with enabled: ‘True’.

test_update_endpoint_enabled_true()

Call PATCH /endpoints/{endpoint_id} with enabled: True.

test_update_region()

Call PATCH /regions/{region_id}.

test_update_region_with_null_description()

Call PATCH /regions/{region_id}.

test_update_region_without_description_keeps_original()

Call PATCH /regions/{region_id}.

test_update_service()

Call PATCH /services/{service_id}.

class keystone.tests.unit.test_v3_catalog.TestCatalogAPISQL(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

Test for the catalog Manager against the SQL backend.

config_overrides()

create_endpoint(service_id, **kwargs)

setUp()

test_get_catalog_always_returns_service_name()

test_get_catalog_ignores_endpoints_with_invalid_urls()

class keystone.tests.unit.test_v3_catalog.TestCatalogAPISQLRegions(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

Test for the catalog Manager against the SQL backend.

assertValidCatalogEndpoint(entity, ref=None)

config_overrides()

setUp()

test_get_catalog_returns_proper_endpoints_with_no_region()

test_get_catalog_returns_proper_endpoints_with_region()

class keystone.tests.unit.test_v3_catalog.TestCatalogAPITemplatedProject(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

Templated Catalog doesn’t support full API.

Eg. No region/endpoint creation.

config_overrides()

load_fixtures(fixtures)

test_project_delete()

Deleting a project should not result in an 500 ISE.

Deleting a project will create a notification, which the EndpointFilter functionality will use to clean up any project->endpoint and project->endpoint_group relationships. The templated catalog does not support such relationships, but the act of attempting to delete them should not cause a NotImplemented exception to be exposed to an API caller.

Deleting an endpoint has a similar notification and clean up mechanism, but since we do not allow deletion of endpoints with the templated catalog, there is no testing to do for that action.

keystone.tests.unit.test_v3_credential module

class keystone.tests.unit.test_v3_credential.CredentialBaseTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

setUp()

class keystone.tests.unit.test_v3_credential.CredentialTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_v3_credential.CredentialBaseTestCase

Test credential CRUD.

setUp()

test_create_credential()

Call POST /credentials.

test_create_credential_with_admin_token()

test_create_ec2_credential()

Call POST /credentials for creating ec2 credential.

test_create_ec2_credential_with_invalid_blob()

Test creating ec2 credential with invalid blob.

Call POST /credentials.

test_create_ec2_credential_with_missing_project_id()

Test Creating ec2 credential with missing project_id.

Call POST /credentials.

test_create_non_ec2_credential()

Test creating non-ec2 credential.

Call POST /credentials.

test_credential_api_delete_credentials_for_project()

test_credential_api_delete_credentials_for_user()

test_delete_credential()

Call DELETE /credentials/{credential_id}.

test_get_credential()

Call GET /credentials/{credential_id}.

test_get_ec2_dict_blob()

Ensure non-JSON blob data is correctly converted.

test_list_credentials()

Call GET /credentials.

test_list_credentials_filtered_by_type()

Call GET  /credentials?type={type}.

test_list_credentials_filtered_by_type_and_user_id()

Call GET  /credentials?user_id={user_id}&type={type}.

test_list_credentials_filtered_by_user_id()

Call GET  /credentials?user_id={user_id}.

test_list_ec2_dict_blob()

Ensure non-JSON blob data is correctly converted.

test_update_credential()

Call PATCH /credentials/{credential_id}.

test_update_credential_to_ec2_missing_project_id()

Call PATCH /credentials/{credential_id}.

test_update_credential_to_ec2_type()

Call PATCH /credentials/{credential_id}.

test_update_credential_to_ec2_with_previously_set_project_id()

Call PATCH /credentials/{credential_id}.

class keystone.tests.unit.test_v3_credential.TestCredentialEc2(*args, **kwargs)

Bases: keystone.tests.unit.test_v3_credential.CredentialBaseTestCase

Test v3 credential compatibility with ec2tokens.

setUp()

test_ec2_cannot_get_non_ec2_credential()

test_ec2_create_credential()

Test ec2 credential creation.

test_ec2_credential_signature_validate()

Test signature validation with a v3 ec2 credential.

test_ec2_credential_signature_validate_legacy()

Test signature validation with a legacy v3 ec2 credential.

test_ec2_delete_credential()

Test ec2 credential deletion.

test_ec2_get_credential()

test_ec2_list_credentials()

Test ec2 credential listing.

class keystone.tests.unit.test_v3_credential.TestCredentialTrustScoped(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

Test credential with trust scoped token.

config_overrides()

setUp()

test_trust_scoped_ec2_credential()

Test creating trust scoped ec2 credential.

Call POST /credentials.

keystone.tests.unit.test_v3_domain_config module

class keystone.tests.unit.test_v3_domain_config.DomainConfigTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

Test domain config support.

setUp()

test_create_config()

Call PUT /domains/{domain_id}/config.

test_create_config_invalid_domain()

Call PUT /domains/{domain_id}/config.

While creating Identity API-based domain config with an invalid domain id provided, the request shall be rejected with a response, 404 domain not found.

test_create_config_twice()

Check multiple creates don’t throw error.

test_delete_config()

Call DELETE /domains{domain_id}/config.

test_delete_config_by_group()

Call DELETE /domains{domain_id}/config/{group}.

test_delete_config_by_group_invalid_domain()

Call DELETE /domains{domain_id}/config/{group}.

While deleting Identity API-based domain config by group with an invalid domain id provided, the request shall be rejected with a response 404 domain not found.

test_delete_config_invalid_domain()

Call DELETE /domains{domain_id}/config.

While deleting Identity API-based domain config with an invalid domain id provided, the request shall be rejected with a response, 404 domain not found.

test_get_config_by_group()

Call GET & HEAD /domains{domain_id}/config/{group}.

test_get_config_by_group_invalid_domain()

Call GET & HEAD /domains{domain_id}/config/{group}.

While retrieving Identity API-based domain config by group with an invalid domain id provided, the request shall be rejected with a response 404 domain not found.

test_get_config_by_option()

Call GET & HEAD /domains{domain_id}/config/{group}/{option}.

test_get_config_by_option_invalid_domain()

Call GET & HEAD /domains{domain_id}/config/{group}/{option}.

While retrieving Identity API-based domain config by option with an invalid domain id provided, the request shall be rejected with a response 404 domain not found.

test_get_config_default()

Call GET /domains/config/default.

test_get_config_default_by_group()

Call GET /domains/config/{group}/default.

test_get_config_default_by_invalid_group()

Call GET for /domains/config/{bad-group}/default.

test_get_config_default_by_invalid_option()

Call GET for /domains/config/{group}/{bad-option}/default.

test_get_config_default_by_option()

Call GET /domains/config/{group}/{option}/default.

test_get_head_config()

Call GET & HEAD for /domains{domain_id}/config.

test_get_non_existant_config()

Call GET /domains{domain_id}/config when no config defined.

test_get_non_existant_config_group()

Call GET /domains{domain_id}/config/{group_not_exist}.

test_get_non_existant_config_group_invalid_domain()

Call GET /domains{domain_id}/config/{group_not_exist}.

While retrieving non-existent Identity API-based domain config group with an invalid domain id provided, the request shall be rejected with a response, 404 domain not found.

test_get_non_existant_config_invalid_domain()

Call GET /domains{domain_id}/config when no config defined.

While retrieving non-existent Identity API-based domain config with an invalid domain id provided, the request shall be rejected with a response 404 domain not found.

test_get_non_existant_config_option()

Call GET /domains{domain_id}/config/group/{option_not_exist}.

test_get_non_existant_config_option_invalid_domain()

Call GET /domains{domain_id}/config/group/{option_not_exist}.

While retrieving non-existent Identity API-based domain config option with an invalid domain id provided, the request shall be rejected with a response, 404 domain not found.

test_update_config()

Call PATCH /domains/{domain_id}/config.

test_update_config_group()

Call PATCH /domains/{domain_id}/config/{group}.

test_update_config_group_invalid_domain()

Call PATCH /domains/{domain_id}/config/{group}.

While updating Identity API-based domain config group with an invalid domain id provided, the request shall be rejected with a response, 404 domain not found.

test_update_config_invalid_domain()

Call PATCH /domains/{domain_id}/config.

While updating Identity API-based domain config with an invalid domain id provided, the request shall be rejected with a response, 404 domain not found.

test_update_config_invalid_group()

Call PATCH /domains/{domain_id}/config/{invalid_group}.

test_update_config_invalid_group_invalid_domain()

Call PATCH /domains/{domain_id}/config/{invalid_group}.

While updating Identity API-based domain config with an invalid group and an invalid domain id provided, the request shall be rejected with a response, 404 domain not found.

test_update_config_invalid_option()

Call PATCH /domains/{domain_id}/config/{group}/{invalid}.

test_update_config_invalid_option_invalid_domain()

Call PATCH /domains/{domain_id}/config/{group}/{invalid}.

While updating Identity API-based domain config with an invalid option and an invalid domain id provided, the request shall be rejected with a response, 404 domain not found.

test_update_config_option()

Call PATCH /domains/{domain_id}/config/{group}/{option}.

test_update_config_option_invalid_domain()

Call PATCH /domains/{domain_id}/config/{group}/{option}.

While updating Identity API-based domain config option with an invalid domain id provided, the request shall be rejected with a response, 404 domain not found.

class keystone.tests.unit.test_v3_domain_config.SecurityRequirementsTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

setUp()

test_delete_non_whitelisted_security_compliance_options_fails()

The security compliance options shouldn’t be deleteable.

test_delete_security_compliance_group_fails()

The security compliance group shouldn’t be deleteable.

test_delete_security_compliance_password_regex_description_fails()

The security compliance options shouldn’t be deleteable.

test_delete_security_compliance_password_regex_fails()

The security compliance options shouldn’t be deleteable.

test_get_non_whitelisted_security_compliance_opt_fails()

We only support exposing a subset of security compliance options.

Given that security compliance information is sensitive in nature, we should make sure that only the options we want to expose are readable via the API.

test_get_security_compliance_config_for_default_domain()

Ask for all security compliance configuration options.

Support for enforcing security compliance per domain currently doesn’t exist. Make sure when we ask for security compliance information, it’s only for the default domain and that it only returns whitelisted options.

test_get_security_compliance_config_for_non_default_domain_fails()

Getting security compliance opts for other domains should fail.

Support for enforcing security compliance rules per domain currently does not exist, so exposing security compliance information for any domain other than the default domain should not be allowed.

test_get_security_compliance_config_with_user_from_other_domain()

Make sure users from other domains can access password requirements.

Even though a user is in a separate domain, they should be able to see the security requirements for the deployment. This is because security compliance is not yet implemented on a per domain basis. Once that happens, then this should no longer be possible since a user should only care about the security compliance requirements for the domain that they are in.

test_get_security_compliance_password_regex()

Ask for the security compliance password regular expression.

test_get_security_compliance_password_regex_desc_returns_none()

When an option isn’t set, we should explicitly return None.

test_get_security_compliance_password_regex_description()

Ask for the security compliance password regex description.

test_get_security_compliance_password_regex_returns_none()

When an option isn’t set, we should explicitly return None.

test_update_non_whitelisted_security_compliance_option_fails()

Updating security compliance options through the API is not allowed.

Requests to update anything in the security compliance group through the API should be Forbidden. This ensures that we are covering cases where the option being updated isn’t in the white list.

test_update_security_compliance_config_group_fails()

Make sure that updates to the entire security group section fail.

We should only allow the ability to modify a deployments security compliance rules through configuration. Especially since it’s only enforced on the default domain.

test_update_security_compliance_password_regex_description_fails()

Make sure any updates to security compliance options fail.

test_update_security_compliance_password_regex_fails()

Make sure any updates to security compliance options fail.

keystone.tests.unit.test_v3_endpoint_policy module

class keystone.tests.unit.test_v3_endpoint_policy.EndpointPolicyTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

Test endpoint policy CRUD.

In general, the controller layer of the endpoint policy extension is really just marshalling the data around the underlying manager calls. Given that the manager layer is tested in depth by the backend tests, the tests we execute here concentrate on ensuring we are correctly passing and presenting the data.

assert_head_and_get_return_same_response(url, expected_status)

setUp()

test_crud_for_policy_for_explicit_endpoint()

PUT, HEAD and DELETE for explicit endpoint policy.

test_crud_for_policy_for_region_and_service()

PUT, HEAD and DELETE for region and service endpoint policy.

test_crud_for_policy_for_service()

PUT, HEAD and DELETE for service endpoint policy.

test_endpoint_association_cleanup_when_endpoint_deleted()

test_get_policy_for_endpoint()

GET /endpoints/{endpoint_id}/policy.

test_list_endpoints_for_policy()

GET /policies/%(policy_id}/endpoints.

test_region_service_association_cleanup_when_region_deleted()

test_region_service_association_cleanup_when_service_deleted()

test_service_association_cleanup_when_policy_deleted()

test_service_association_cleanup_when_service_deleted()

class keystone.tests.unit.test_v3_endpoint_policy.JsonHomeTests

Bases: keystone.tests.unit.test_v3.JsonHomeTestMixin

EXTENSION_LOCATION = 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-ENDPOINT-POLICY/1.0/rel'

JSON_HOME_DATA = {'https://docs.openstack.org/api/openstack-identity/3/ext/OS-ENDPOINT-POLICY/1.0/rel/service_policy_association': {'href-vars': {'service_id': 'https://docs.openstack.org/api/openstack-identity/3/param/service_id', 'policy_id': 'https://docs.openstack.org/api/openstack-identity/3/param/policy_id'}, 'href-template': '/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id}'}, 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-ENDPOINT-POLICY/1.0/rel/endpoint_policy': {'href-vars': {'endpoint_id': 'https://docs.openstack.org/api/openstack-identity/3/param/endpoint_id'}, 'href-template': '/endpoints/{endpoint_id}/OS-ENDPOINT-POLICY/policy'}, 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-ENDPOINT-POLICY/1.0/rel/region_and_service_policy_association': {'href-vars': {'service_id': 'https://docs.openstack.org/api/openstack-identity/3/param/service_id', 'region_id': 'https://docs.openstack.org/api/openstack-identity/3/param/region_id', 'policy_id': 'https://docs.openstack.org/api/openstack-identity/3/param/policy_id'}, 'href-template': '/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id}/regions/{region_id}'}, 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-ENDPOINT-POLICY/1.0/rel/policy_endpoints': {'href-vars': {'policy_id': 'https://docs.openstack.org/api/openstack-identity/3/param/policy_id'}, 'href-template': '/policies/{policy_id}/OS-ENDPOINT-POLICY/endpoints'}, 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-ENDPOINT-POLICY/1.0/rel/endpoint_policy_association': {'href-vars': {'endpoint_id': 'https://docs.openstack.org/api/openstack-identity/3/param/endpoint_id', 'policy_id': 'https://docs.openstack.org/api/openstack-identity/3/param/policy_id'}, 'href-template': '/policies/{policy_id}/OS-ENDPOINT-POLICY/endpoints/{endpoint_id}'}}

PARAM_LOCATION = 'https://docs.openstack.org/api/openstack-identity/3/param'

keystone.tests.unit.test_v3_federation module

class keystone.tests.unit.test_v3_federation.FederatedIdentityProviderTests(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

A test class for Identity Providers.

assertIdpDomainCreated(idp_id, domain_id)

base_url(suffix=None)

default_body = {'enabled': True, 'description': None}

idp_keys = ['description', 'enabled']

test_assign_protocol_to_idp()

Assign a protocol to existing IdP.

test_assign_protocol_to_nonexistent_idp()

Assign protocol to IdP that doesn’t exist.

Expect HTTP 404 Not Found code.

test_cannot_update_idp_domain()

test_check_idp_uniqueness()

Add same IdP twice.

Expect HTTP 409 Conflict code for the latter call.

test_create_idp_domain_id_none()

test_create_idp_domain_id_unique_constraint()

test_create_idp_remote()

Create the IdentityProvider entity associated to remote_ids.

test_create_idp_remote_empty()

Create an IdP with empty remote_ids.

test_create_idp_remote_none()

Create an IdP with a None remote_ids.

test_create_idp_remote_repeated()

Create two IdentityProvider entities with some remote_ids.

A remote_id is the same for both so the second IdP is not created because of the uniqueness of the remote_ids

Expect HTTP 409 Conflict code for the latter call.

test_create_idp_with_domain_id()

test_create_idp_with_nonexistent_domain_id_fails()

test_create_idp_without_domain_id()

Create the IdentityProvider entity associated to remote_ids.

test_delete_existing_idp()

Create and later delete IdP.

Expect HTTP 404 Not Found for the GET IdP call.

test_delete_idp_also_deletes_assigned_protocols()

Deleting an IdP will delete its assigned protocol.

test_delete_nonexisting_idp()

Delete nonexisting IdP.

Expect HTTP 404 Not Found for the GET IdP call.

test_delete_protocol()

Delete protocol.

Expect HTTP 404 Not Found code for the GET call after the protocol is deleted.

test_filter_list_idp_by_enabled()

test_filter_list_idp_by_id()

test_get_idp()

Create and later fetch IdP.

test_get_nonexisting_idp()

Fetch nonexisting IdP entity.

Expected HTTP 404 Not Found status code.

test_get_protocol()

Create and later fetch protocol tied to IdP.

test_list_idps(iterations=5)

List all available IdentityProviders.

This test collects ids of created IdPs and intersects it with the list of all available IdPs. List of all IdPs can be a superset of IdPs created in this test, because other tests also create IdPs.

test_list_protocols()

Create set of protocols and later list them.

Compare input and output id sets.

test_protocol_composite_pk()

Test that Keystone can add two entities.

The entities have identical names, however, attached to different IdPs.

1. Add IdP and assign it protocol with predefined name
2. Add another IdP and assign it a protocol with same name.

Expect HTTP 201 code

test_protocol_idp_pk_uniqueness()

Test whether Keystone checks for unique idp/protocol values.

Add same protocol twice, expect Keystone to reject a latter call and return HTTP 409 Conflict code.

test_update_idp_clean_remote_ids()

Update IdP’s remote_ids parameter with an empty list.

test_update_idp_immutable_attributes()

Update IdP’s immutable parameters.

Expect HTTP BAD REQUEST.

test_update_idp_mutable_attributes()

Update IdP’s mutable parameters.

test_update_idp_remote_ids()

Update IdP’s remote_ids parameter.

test_update_idp_remote_repeated()

Update an IdentityProvider entity reusing a remote_id.

A remote_id is the same for both so the second IdP is not updated because of the uniqueness of the remote_ids.

Expect HTTP 409 Conflict code for the latter call.

test_update_nonexistent_idp()

Update nonexistent IdP.

Expect HTTP 404 Not Found code.

test_update_protocols_attribute()

Update protocol’s attribute.

class keystone.tests.unit.test_v3_federation.FederatedSetupMixin

Bases: object

ACTION = 'authenticate'

ASSERTION_PREFIX = 'PREFIX_'

AUTH_METHOD = 'saml2'

IDP = 'ORG_IDP'

IDP_WITH_REMOTE = 'ORG_IDP_REMOTE'

PROTOCOL = 'saml2'

REMOTE_IDS = ['entityID_IDP1', 'entityID_IDP2']

REMOTE_ID_ATTR = 'e1c16181dbe84e01a413e7afba18cb91'

UNSCOPED_V3_SAML2_REQ = {'identity': {'methods': ['saml2'], 'saml2': {'identity_provider': 'ORG_IDP', 'protocol': 'saml2'}}}

USER = 'user@ORGANIZATION'

assertValidMappedUser(token)

Check if user object meets all the criteria.

idp_ref(id=None)

load_federation_sample_data()

Inject additional data.

mapping_ref(rules=None)

proto_ref(mapping_id=None)

class keystone.tests.unit.test_v3_federation.FederatedTokenTests(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase, keystone.tests.unit.test_v3_federation.FederatedSetupMixin

auth_plugin_config_override()

load_fixtures(fixtures)

setUp()

test_assertion_prefix_parameter()

Test parameters filtering based on the prefix.

With assertion_prefix set to fixed, non default value, issue an unscoped token from assertion EMPLOYEE_ASSERTION_PREFIXED. Expect server to return unscoped token.

test_assertion_prefix_parameter_expect_fail()

Test parameters filtering based on the prefix.

With assertion_prefix default value set to empty string issue an unscoped token from assertion EMPLOYEE_ASSERTION. Next, configure assertion_prefix to value UserName. Try issuing unscoped token with EMPLOYEE_ASSERTION. Expect server to raise exception.Unathorized exception.

test_empty_blacklist_passess_all_values()

Test a mapping with empty blacklist specified.

Not adding a blacklist keyword to the mapping rules has the same effect as adding an empty blacklist. In both cases, the mapping engine will not discard any groups that are associated with apache environment variables.

This test checks scenario where an empty blacklist was specified. Expected result is to allow any value.

The test scenario is as follows:

• Create group EXISTS
• Create group NO_EXISTS
• Set mapping rules for existing IdP with a blacklist that passes through as REMOTE_USER_GROUPS
• Issue unscoped token with groups EXISTS and NO_EXISTS assigned

test_empty_whitelist_discards_all_values()

Test that empty whitelist blocks all the values.

Not adding a whitelist keyword to the mapping value is different than adding empty whitelist. The former case will simply pass all the values, whereas the latter would discard all the values.

This test checks scenario where an empty whitelist was specified. The expected result is that no groups are matched.

The test scenario is as follows:

• Create group EXISTS
• Set mapping rules for existing IdP with an empty whitelist that whould discard any values from the assertion
• Try issuing unscoped token, no groups were matched and that the federated user does not have any group assigned.

test_full_workflow(*args, **kwargs)

Test ‘standard’ workflow for granting access tokens.

• Issue unscoped token
• List available projects based on groups
• Scope token to one of available projects

test_issue_token_for_local_user_user_not_found()

test_issue_token_from_rules_without_user()

test_issue_token_with_nonexistent_group()

Inject assertion that matches rule issuing bad group id.

Expect server to find out that some groups are missing in the backend and raise exception.MappedGroupNotFound exception.

test_issue_unscoped_token()

test_issue_unscoped_token_disabled_idp()

Check if authentication works with disabled identity providers.

Test plan: 1) Disable default IdP 2) Try issuing unscoped token for that IdP 3) Expect server to forbid authentication

test_issue_unscoped_token_for_local_user()

test_issue_unscoped_token_group_names_in_mapping()

test_issue_unscoped_token_malformed_environment()

Test whether non string objects are filtered out.

Put non string objects into the environment, inject correct assertion and try to get an unscoped token. Expect server not to fail on using split() method on non string objects and return token id in the HTTP header.

test_issue_unscoped_token_no_groups()

test_issue_unscoped_token_notify()

test_issue_unscoped_token_with_remote()

test_issue_unscoped_token_with_remote_default_overwritten()

Test that protocol remote_id_attribute has higher priority.

Make sure the parameter stored under protocol section has higher priority over parameter from default federation configuration section.

test_issue_unscoped_token_with_remote_different()

test_issue_unscoped_token_with_remote_no_attribute()

test_issue_unscoped_token_with_remote_unavailable()

test_issue_unscoped_token_with_remote_user_as_empty_string()

test_issue_unscoped_token_with_saml2_remote()

test_issue_unscoped_tokens_nonexisting_group()

test_list_domains()

test_list_projects()

test_list_projects_for_inherited_project_assignment()

test_lists_with_missing_group_in_backend()

Test a mapping that points to a group that does not exist.

For explicit mappings, we expect the group to exist in the backend, but for lists, specifically blacklists, a missing group is expected as many groups will be specified by the IdP that are not Keystone groups.

The test scenario is as follows:

• Create group EXISTS
• Set mapping rules for existing IdP with a blacklist that passes through as REMOTE_USER_GROUPS
• Issue unscoped token with on group EXISTS id in it

test_not_adding_blacklist_passess_all_values()

Test a mapping without blacklist specified.

Not adding a blacklist keyword to the mapping rules has the same effect as adding an empty blacklist. In both cases all values will be accepted and passed.

This test checks scenario where an blacklist was not specified. Expected result is to allow any value.

The test scenario is as follows:

• Create group EXISTS
• Create group NO_EXISTS
• Set mapping rules for existing IdP with a blacklist that passes through as REMOTE_USER_GROUPS
• Issue unscoped token with on groups EXISTS and NO_EXISTS assigned

test_not_setting_whitelist_accepts_all_values()

Test that not setting whitelist passes.

Not adding a whitelist keyword to the mapping value is different than adding empty whitelist. The former case will simply pass all the values, whereas the latter would discard all the values.

This test checks a scenario where a whitelist was not specified. Expected result is that no groups are ignored.

The test scenario is as follows:

• Create group EXISTS
• Set mapping rules for existing IdP with an empty whitelist that whould discard any values from the assertion
• Issue an unscoped token and make sure ephemeral user is a member of two groups.

test_scope_to_bad_project()

Scope unscoped token with a project we don’t have access to.

test_scope_to_domain_multiple_tokens()

Issue multiple tokens scoping to different domains.

The new tokens should be scoped to:

• domainA
• domainB
• domainC

test_scope_to_domain_once()

test_scope_to_domain_with_only_inherited_roles_fails()

Try to scope to a domain that has no direct roles.

test_scope_to_project_multiple_times()

Try to scope the unscoped token multiple times.

The new tokens should be scoped to:

• Customers’ project
• Employees’ project

test_scope_to_project_once()

test_scope_to_project_once_notify()

test_scope_to_project_with_only_inherited_roles()

Try to scope token whose only roles are inherited.

test_scope_token_from_nonexistent_unscoped_token()

Try to scope token from non-existent unscoped token.

test_scope_token_with_idp_disabled()

Scope token issued by disabled IdP.

Try scoping the token issued by an IdP which is disabled now. Expect server to refuse scoping operation.

This test confirms correct behaviour when IdP was enabled and unscoped token was issued, but disabled before user tries to scope the token. Here we assume the unscoped token was already issued and start from the moment where IdP is being disabled and unscoped token is being used.

Test plan: 1) Disable IdP 2) Try scoping unscoped token

test_scoped_token_has_user_domain()

test_unscoped_token_has_user_domain()

test_user_name_and_id_in_federation_token()

test_v2_auth_with_federation_token_fails()

Test that using a federation token with v2 auth fails.

If an admin sets up a federated Keystone environment, and a user incorrectly configures a service (like Nova) to only use v2 auth, the returned message should be informative.

test_workflow_with_groups_deletion()

Test full workflow with groups deletion before token scoping.

The test scenario is as follows:

• Create group group
• Create and assign roles to group and project_all
• Patch mapping rules for existing IdP so it issues group id
• Issue unscoped token with group‘s id
• Delete group group
• Scope token to project_all
• Expect HTTP 500 response

class keystone.tests.unit.test_v3_federation.FederatedTokenTestsMethodToken(*args, **kwargs)

Bases: keystone.tests.unit.test_v3_federation.FederatedTokenTests

Test federation operation with unified scoping auth method.

Test all the operations with auth method set to token as a new, unified way for scoping all the tokens.

AUTH_METHOD = 'token'

auth_plugin_config_override()

test_full_workflow(*args, **kwargs)

Test ‘standard’ workflow for granting access tokens.

• Issue unscoped token
• List available projects based on groups
• Scope token to one of available projects

class keystone.tests.unit.test_v3_federation.FederatedUserTests(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase, keystone.tests.unit.test_v3_federation.FederatedSetupMixin

Test for federated users.

Tests new shadow users functionality

auth_plugin_config_override()

load_fixtures(fixtures)

setUp()

test_auth_domains_matches_federation_domains()

test_auth_domains_matches_federation_domains_with_group_assign()

test_auth_projects_matches_federation_projects()

test_auth_projects_matches_federation_projects_with_group_assign()

test_delete_protocol_after_federated_authentication()

test_domain_scoped_user_role_assignment()

test_list_domains_for_user_duplicates()

test_list_projects_for_user_duplicates()

test_user_id_persistense()

Ensure user_id is persistend for multiple federated authn calls.

test_user_role_assignment()

class keystone.tests.unit.test_v3_federation.FernetFederatedTokenTests(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase, keystone.tests.unit.test_v3_federation.FederatedSetupMixin

AUTH_METHOD = 'token'

auth_plugin_config_override()

config_overrides()

load_fixtures(fixtures)

test_federated_unscoped_token()

test_federated_unscoped_token_with_multiple_groups()

test_fernet_full_workflow()

Test ‘standard’ workflow for granting Fernet access tokens.

• Issue unscoped token
• List available projects based on groups
• Scope token to one of available projects

test_validate_federated_unscoped_token()

class keystone.tests.unit.test_v3_federation.IdPMetadataGenerationTests(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

A class for testing Identity Provider Metadata generation.

METADATA_URL = '/OS-FEDERATION/saml2/metadata'

config_overrides()

setUp()

test_check_entity_id()

test_check_idp_sso()

test_get_metadata()

test_get_metadata_with_no_metadata_file_configured()

test_metadata_invalid_contact_type()

test_metadata_invalid_idp_entity_id()

test_metadata_invalid_idp_sso_endpoint()

test_metadata_no_contact_person()

test_metadata_no_organization()

test_metadata_validity()

Call md.EntityDescriptor method that does internal verification.

test_serialize_metadata_object()

Check whether serialization doesn’t raise any exceptions.

class keystone.tests.unit.test_v3_federation.JsonHomeTests(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase, keystone.tests.unit.test_v3.JsonHomeTestMixin

JSON_HOME_DATA = {'https://docs.openstack.org/api/openstack-identity/3/ext/OS-FEDERATION/1.0/rel/identity_provider': {'href-vars': {'idp_id': 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-FEDERATION/1.0/param/idp_id'}, 'href-template': '/OS-FEDERATION/identity_providers/{idp_id}'}}

class keystone.tests.unit.test_v3_federation.K2KServiceCatalogTests(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

SP1 = 'SP1'

SP2 = 'SP2'

SP3 = 'SP3'

setUp()

sp_ref()

sp_response(id, ref)

test_no_service_providers_in_token()

Test service catalog with disabled service providers.

There should be no entry service_providers in the catalog. Test passes providing no attribute was raised.

test_service_providers_in_token()

Check if service providers are listed in service catalog.

test_service_provides_in_token_disabled_sp()

Test behaviour with disabled service providers.

Disabled service providers should not be listed in the service catalog.

class keystone.tests.unit.test_v3_federation.MappingCRUDTests(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

A class for testing CRUD operations for Mappings.

MAPPING_URL = '/OS-FEDERATION/mappings/'

assertValidMapping(entity, ref=None)

assertValidMappingListResponse(resp, *args, **kwargs)

assertValidMappingResponse(resp, *args, **kwargs)

test_create_mapping_bad_requirements()

test_create_mapping_bad_value()

test_create_mapping_empty_map()

test_create_mapping_extra_remote_properties_any_one_of()

test_create_mapping_extra_remote_properties_just_type()

test_create_mapping_extra_remote_properties_not_any_of()

test_create_mapping_extra_rules_properties()

test_create_mapping_missing_local()

test_create_mapping_missing_type()

test_create_mapping_no_remote_objects()

test_create_mapping_no_rules()

test_create_mapping_with_bad_user_type()

test_create_mapping_with_blacklist_and_whitelist()

Test for adding whitelist and blacklist in the rule.

Server should respond with HTTP 400 Bad Request error upon discovering both whitelist and blacklist keywords in the same rule.

test_create_mapping_with_ephemeral()

test_create_mapping_with_local_user_and_local_domain()

test_create_mapping_wrong_type()

test_create_shadow_mapping_without_name_fails()

Validate project mappings contain the project name when created.

test_create_shadow_mapping_without_roles_fails()

Validate that mappings with projects contain roles when created.

test_delete_mapping_dne()

test_get_mapping_dne()

test_mapping_create()

test_mapping_delete()

test_mapping_get()

test_mapping_list()

test_mapping_update()

test_update_shadow_mapping_without_name_fails()

Validate project mappings contain the project name when updated.

test_update_shadow_mapping_without_roles_fails()

Validate that mappings with projects contain roles when updated.

class keystone.tests.unit.test_v3_federation.SAMLGenerationTests(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

ASSERTION_FILE = 'signed_saml2_assertion.xml'

ASSERTION_VERSION = '2.0'

ECP_GENERATION_ROUTE = '/auth/OS-FEDERATION/saml2/ecp'

ISSUER = 'https://acme.com/FIM/sps/openstack/saml20'

PROJECT = 'development'

PROJECT_DOMAIN = 'project_domain'

RECIPIENT = 'http://beta.com/Shibboleth.sso/SAML2/POST'

ROLES = ['admin', 'member']

SAML_GENERATION_ROUTE = '/auth/OS-FEDERATION/saml2'

SERVICE_PROVDIER_ID = 'ACME'

SP_AUTH_URL = 'http://beta.com:5000/v3/OS-FEDERATION/identity_providers/BETA/protocols/saml2/auth'

SUBJECT = 'test_user'

SUBJECT_DOMAIN = 'user_domain'

setUp()

sp_ref()

test_assertion_using_explicit_namespace_prefixes()

test_comma_in_certfile_path()

test_comma_in_keyfile_path()

test_generate_ecp_route()

Test that the ECP generation endpoint produces XML.

The ECP endpoint /v3/auth/OS-FEDERATION/saml2/ecp should take the same input as the SAML generation endpoint (scoped token ID + Service Provider ID). The controller should return a SAML assertion that is wrapped in a SOAP envelope.

test_generate_saml_route()

Test that the SAML generation endpoint produces XML.

The SAML endpoint /v3/auth/OS-FEDERATION/saml2 should take as input, a scoped token ID, and a Service Provider ID. The controller should fetch details about the user from the token, and details about the service provider from its ID. This should be enough information to invoke the SAML generator and provide a valid SAML (XML) document back.

test_invalid_scope_body()

Test that missing the scope in request body raises an exception.

Raises exception.SchemaValidationError() - error 400 Bad Request

test_invalid_token_body()

Test that missing the token in request body raises an exception.

Raises exception.SchemaValidationError() - error 400 Bad Request

test_not_project_scoped_token()

Ensure SAML generation fails when passing domain-scoped tokens.

The server should return a 403 Forbidden Action.

test_saml_signing()

Test that the SAML generator produces a SAML object.

Test the SAML generator directly by passing known arguments, the result should be a SAML object that consistently includes attributes based on the known arguments that were passed in.

test_samlize_token_values()

Test the SAML generator produces a SAML object.

Test the SAML generator directly by passing known arguments, the result should be a SAML object that consistently includes attributes based on the known arguments that were passed in.

test_sign_assertion(*args, **keywargs)

test_sign_assertion_exc(*args, **keywargs)

test_sign_assertion_fileutils_exc(*args, **keywargs)

test_sp_disabled()

Try generating assertion for disabled Service Provider.

test_sp_not_found()

Test SAML generation with an invalid service provider ID.

Raises exception.ServiceProviderNotFound() - error Not Found 404

test_token_not_found()

Test that an invalid token in the request body raises an exception.

Raises exception.TokenNotFound() - error Not Found 404

test_valid_saml_xml()

Test the generated SAML object can become valid XML.

Test the generator directly by passing known arguments, the result should be a SAML object that consistently includes attributes based on the known arguments that were passed in.

test_verify_assertion_object()

Test that the Assertion object is built properly.

The Assertion doesn’t need to be signed in this test, so _sign_assertion method is patched and doesn’t alter the assertion.

class keystone.tests.unit.test_v3_federation.ServiceProviderTests(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

A test class for Service Providers.

COLLECTION_NAME = 'service_providers'

MEMBER_NAME = 'service_provider'

SERVICE_PROVIDER_ID = 'ACME'

SP_KEYS = ['auth_url', 'id', 'enabled', 'description', 'relay_state_prefix', 'sp_url']

base_url(suffix=None)

setUp()

sp_ref()

test_create_service_provider()

test_create_service_provider_fail()

Try adding SP object with unallowed attribute.

test_create_service_provider_invalidates_cache(*args, **kwargs)

test_create_sp_relay_state_default()

Create an SP without relay state, should default to ss:mem.

test_create_sp_relay_state_non_default()

Create an SP with custom relay state.

test_delete_service_provider()

test_delete_service_provider_invalidates_cache(*args, **kwargs)

test_delete_service_provider_returns_not_found()

test_filter_list_sp_by_enabled()

test_filter_list_sp_by_id()

test_get_service_provider()

test_get_service_provider_fail()

test_list_service_providers()

Test listing of service provider objects.

Add two new service providers. List all available service providers. Expect to get list of three service providers (one created by setUp()) Test if attributes match.

test_update_service_provider()

Update existing service provider.

Update default existing service provider and make sure it has been properly changed.

test_update_service_provider_immutable_parameters()

Update immutable attributes in service provider.

In this particular case the test will try to change id attribute. The server should return an HTTP 403 Forbidden error code.

test_update_service_provider_invalidates_cache(*args, **kwargs)

test_update_service_provider_returns_not_found()

test_update_service_provider_unknown_parameter()

test_update_sp_relay_state()

Update an SP with custom relay state.

class keystone.tests.unit.test_v3_federation.ShadowMappingTests(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase, keystone.tests.unit.test_v3_federation.FederatedSetupMixin

Test class dedicated to auto-provisioning resources at login.

A shadow mapping is a mapping that contains extra properties about that specific federated user’s situation based on attributes from the assertion. For example, a shadow mapping can tell us that a user should have specific role assignments on certain projects within a domain. When a federated user authenticates, the shadow mapping will create these entities before returning the authenticated response to the user. This test class is dedicated to testing specific aspects of shadow mapping when performing federated authentication.

auth_plugin_config_override()

load_fixtures(fixtures)

setUp()

test_mapping_with_groups_includes_projects_with_group_assignment()

test_roles_in_idp_domain_can_be_assigned_from_mapping()

test_roles_outside_idp_domain_fail_mapping()

test_shadow_mapping_create_projects_role_assignments()

test_shadow_mapping_creates_project_in_identity_provider_domain()

test_shadow_mapping_creates_projects()

test_shadow_mapping_does_not_create_roles()

test_shadow_mapping_is_idempotent()

Test that projects remain idempotent for every federated auth.

class keystone.tests.unit.test_v3_federation.WebSSOTests(*args, **kwargs)

Bases: keystone.tests.unit.test_v3_federation.FederatedTokenTests

A class for testing Web SSO.

ORIGIN = 'http%3A%2F%2Fhorizon.com'

PROTOCOL_REMOTE_ID_ATTR = '3baf0416a1df4a82ab108cd2ce2fa83c'

SSO_TEMPLATE_NAME = 'sso_callback_template.html'

SSO_TEMPLATE_PATH = '/home/jenkins/workspace/keystone-docs-ubuntu-xenial/etc/sso_callback_template.html'

SSO_URL = '/auth/OS-FEDERATION/websso/'

TRUSTED_DASHBOARD = 'http://horizon.com'

config_overrides()

setUp()

test_federated_sso_auth()

test_federated_sso_auth_bad_remote_id()

test_federated_sso_auth_with_protocol_specific_remote_id()

test_federated_sso_missing_query()

test_federated_sso_missing_query_bad_remote_id()

test_federated_sso_missing_remote_id()

test_federated_sso_untrusted_dashboard()

test_federated_sso_untrusted_dashboard_bad_remote_id()

test_get_sso_origin_host_case_insensitive()

test_identity_provider_specific_federated_authentication()

test_render_callback_template()

keystone.tests.unit.test_v3_federation.dummy_validator(*args, **kwargs)

keystone.tests.unit.test_v3_filters module

class keystone.tests.unit.test_v3_filters.IdentityPasswordExpiryFilteredTestCase(*args, **kwargs)

Bases: keystone.tests.unit.filtering.FilterTests, keystone.tests.unit.test_v3.RestfulTestCase

Test password expiring filter on the v3 Identity API.

load_sample_data()

Create sample data for password expiry tests.

The test environment will consist of a single domain, containing a single project. It will create three users and one group. Each user is going to be given a role assignment on the project and the domain. Two of the three users are going to be placed into the group, which won’t have any role assignments to either the project or the domain.

setUp()

Setup for Identity Filter Test Cases.

test_list_users_by_password_expires_after()

Ensure users can be filtered on gt and gte.

GET /users?password_expires_at=gt:{timestamp} GET /users?password_expires_at=gte:{timestamp}

test_list_users_by_password_expires_at()

Ensure users can be filtered on no operator, eq and neq.

GET /users?password_expires_at={timestamp} GET /users?password_expires_at=eq:{timestamp}

test_list_users_by_password_expires_before()

Ensure users can be filtered on lt and lte.

GET /users?password_expires_at=lt:{timestamp} GET /users?password_expires_at=lte:{timestamp}

test_list_users_by_password_expires_interval()

Ensure users can be filtered on time intervals.

GET /users?password_expires_at=lt:{timestamp}&gt:{timestamp} GET /users?password_expires_at=lte:{timestamp}&gte:{timestamp}

Time intervals are defined by using lt or lte and gt or gte, where the lt/lte time is greater than the gt/gte time.

test_list_users_by_password_expires_with_bad_operator_fails()

Ensure an invalid operator returns a Bad Request.

GET /users?password_expires_at={invalid_operator}:{timestamp} GET /users?password_expires_at={operator}:{timestamp}& {invalid_operator}:{timestamp}

test_list_users_by_password_expires_with_bad_timestamp_fails()

Ensure a invalid timestamp returns a Bad Request.

GET /users?password_expires_at={invalid_timestamp} GET /users?password_expires_at={operator}:{timestamp}& {operator}:{invalid_timestamp}

test_list_users_in_group_by_password_expires_after()

Ensure users in a group can be filtered on with gt and gte.

GET /groups/{groupid}/users?password_expires_at=gt:{timestamp} GET /groups/{groupid}/users?password_expires_at=gte:{timestamp}

test_list_users_in_group_by_password_expires_at()

Ensure users in a group can be filtered on no operator, eq, and neq.

GET /groups/{groupid}/users?password_expires_at={timestamp} GET /groups/{groupid}/users?password_expires_at=eq:{timestamp}

test_list_users_in_group_by_password_expires_bad_operator_fails()

Ensure an invalid operator returns a Bad Request.

GET /groups/{groupid}/users?password_expires_at= {invalid_operator}:{timestamp} GET /groups/{group_id}/users?password_expires_at= {operator}:{timestamp}&{invalid_operator}:{timestamp}

test_list_users_in_group_by_password_expires_bad_timestamp_fails()

Ensure and invalid timestamp returns a Bad Request.

GET /groups/{groupid}/users?password_expires_at={invalid_timestamp} GET /groups/{groupid}/users?password_expires_at={operator}:{timestamp}& {operator}:{invalid_timestamp}

test_list_users_in_group_by_password_expires_before()

Ensure users in a group can be filtered on with lt and lte.

GET /groups/{groupid}/users?password_expires_at=lt:{timestamp} GET /groups/{groupid}/users?password_expires_at=lte:{timestamp}

test_list_users_in_group_by_password_expires_interval()

Ensure users in a group can be filtered on time intervals.

GET /groups/{groupid}/users?password_expires_at= lt:{timestamp}&gt:{timestamp} GET /groups/{groupid}/users?password_expires_at= lte:{timestamp}&gte:{timestamp}

Time intervals are defined by using lt or lte and gt or gte, where the lt/lte time is greater than the gt/gte time.

class keystone.tests.unit.test_v3_filters.IdentityTestFilteredCase(*args, **kwargs)

Bases: keystone.tests.unit.filtering.FilterTests, keystone.tests.unit.test_v3.RestfulTestCase

Test filter enforcement on the v3 Identity API.

load_sample_data()

Create sample data for these tests.

As well as the usual housekeeping, create a set of domains, users, roles and projects for the subsequent tests:

• Three domains: A,B & C. C is disabled.
• DomainA has user1, DomainB has user2 and user3
• DomainA has group1 and group2, DomainB has group3
• User1 has a role on DomainA

Remember that there will also be a fourth domain in existence, the default domain.

setUp()

Setup for Identity Filter Test Cases.

test_filter_sql_injection_attack()

GET /users?name=<injected sql_statement>.

Test Plan:

• Attempt to get all entities back by passing a two-term attribute
• Attempt to piggyback filter to damage DB (e.g. drop table)

test_inexact_filters()

test_invalid_filter_is_ignored()

GET /domains?enableds&name=myname.

Test Plan:

• Update policy for no protection on api
• Filter by name and ‘enableds’, which does not exist
• Assert ‘enableds’ is ignored

test_list_filtered_domains()

GET /domains?enabled=0.

Test Plan:

• Update policy for no protection on api
• Filter by the ‘enabled’ boolean to get disabled domains, which should return just domainC
• Try the filter using different ways of specifying True/False to test that our handling of booleans in filter matching is correct

test_list_users_filtered_by_domain()

GET /users?domain_id=mydomain (filtered).

Test Plan:

• Update policy so api is unprotected
• Use an un-scoped token to make sure we can filter the users by domainB, getting back the 2 users in that domain

test_list_users_filtered_by_funny_name()

GET /users?name=%myname%.

Test Plan:

• Update policy so api is unprotected
• Update a user with name that has filter escape characters
• Ensure we can filter on it

test_multiple_filters()

GET /domains?enabled&name=myname.

Test Plan:

• Update policy for no protection on api
• Filter by the ‘enabled’ boolean and name - this should return a single domain

class keystone.tests.unit.test_v3_filters.IdentityTestListLimitCase(*args, **kwargs)

Bases: keystone.tests.unit.test_v3_filters.IdentityTestFilteredCase

Test list limiting enforcement on the v3 Identity API.

clean_up_entity(entity)

Clean up entity test data from Identity Limit Test Cases.

clean_up_policy()

Clean up policy test data from Identity Limit Test Cases.

clean_up_service()

Clean up service test data from Identity Limit Test Cases.

content_type = 'json'

setUp()

Setup for Identity Limit Test Cases.

test_at_limit()

Check truncated attribute not set when list at max size.

test_groups_list_limit()

test_no_limit()

Check truncated attribute not set when list not limited.

test_non_driver_list_limit()

Check list can be limited without driver level support.

Policy limiting is not done at the driver level (since it really isn’t worth doing it there). So use this as a test for ensuring the controller level will successfully limit in this case.

test_projects_list_limit()

test_services_list_limit()

test_users_list_limit()

keystone.tests.unit.test_v3_identity module

class keystone.tests.unit.test_v3_identity.ChangePasswordTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

change_password(expected_status, **kwargs)

Return a test response for a change password request.

get_request_token(password, expected_status)

setUp()

class keystone.tests.unit.test_v3_identity.IdentityTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

Test users and groups.

setUp()

test_add_user_to_group()

Call PUT /groups/{group_id}/users/{user_id}.

test_admin_password_reset()

test_admin_password_reset_with_min_password_age_enabled()

test_check_user_in_group()

Call HEAD /groups/{group_id}/users/{user_id}.

test_create_group()

Call POST /groups.

test_create_group_bad_request()

Call POST /groups.

test_create_user()

Call POST /users.

test_create_user_bad_domain_id()

Call POST /users.

test_create_user_bad_request()

Call POST /users.

test_create_user_password_not_logged()

test_create_user_with_admin_token_and_domain()

Call POST /users with admin token and domain id.

test_create_user_without_domain()

Call POST /users without specifying domain.

According to the identity-api specification, if you do not explicitly specific the domain_id in the entity, it should take the domain scope of the token as the domain_id.

test_delete_group()

Call DELETE /groups/{group_id}.

test_delete_user()

Call DELETE /users/{user_id}.

As well as making sure the delete succeeds, we ensure that any credentials that reference this user are also deleted, while other credentials are unaffected. In addition, no tokens should remain valid for this user.

test_delete_user_retries_on_deadlock()

test_get_head_group()

Call GET & HEAD /groups/{group_id}.

test_get_head_user()

Call GET & HEAD /users/{user_id}.

test_get_user_does_not_include_extra_attributes()

Call GET /users/{user_id} extra attributes are not included.

test_get_user_includes_required_attributes()

Call GET /users/{user_id} required attributes are included.

test_get_user_with_default_project()

Call GET /users/{user_id} making sure of default_project_id.

test_list_head_groups()

Call GET & HEAD /groups.

test_list_head_groups_for_user()

Call GET & HEAD /users/{user_id}/groups.

test_list_head_users()

Call GET & HEAD /users.

test_list_head_users_in_group()

Call GET & HEAD /groups/{group_id}/users.

test_list_users_no_default_project()

Call GET /users making sure no default_project_id.

test_list_users_with_multiple_backends()

Call GET /users when multiple backends is enabled.

In this scenario, the controller requires a domain to be specified either as a filter or by using a domain scoped token.

test_remove_user_from_group()

Call DELETE /groups/{group_id}/users/{user_id}.

test_setting_default_project_id_to_domain_failed()

Call POST and PATCH /users default_project_id=domain_id.

Make sure we validate the default_project_id if it is specified. It cannot be set to a domain_id, even for a project acting as domain right now. That’s because we haven’t sort out the issuing project-scoped token for project acting as domain bit yet. Once we got that sorted out, we can relax this constraint.

test_update_group()

Call PATCH /groups/{group_id}.

test_update_group_domain_id()

Call PATCH /groups/{group_id} with domain_id.

A group’s domain_id is immutable. Ensure that any attempts to update the domain_id of a group fails.

test_update_password_not_logged()

test_update_user()

Call PATCH /users/{user_id}.

test_update_user_domain_id()

Call PATCH /users/{user_id} with domain_id.

A user’s domain_id is immutable. Ensure that any attempts to update the domain_id of a user fails.

test_user_management_normalized_keys()

Illustrate the inconsistent handling of hyphens in keys.

To quote Morgan in bug 1526244:

the reason this is converted from “domain-id” to “domain_id” is because of how we process/normalize data. The way we have to handle specific data types for known columns requires avoiding “-” in the actual python code since “-” is not valid for attributes in python w/o significant use of “getattr” etc.

In short, historically we handle some things in conversions. The use of “extras” has long been a poor design choice that leads to odd/strange inconsistent behaviors because of other choices made in handling data from within the body. (In many cases we convert from “-” to “_” throughout openstack)

Source: https://bugs.launchpad.net/keystone/+bug/1526244/comments/9

class keystone.tests.unit.test_v3_identity.IdentityTestCaseStaticAdminToken(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

config_overrides()

test_create_user_with_admin_token_and_no_domain()

Call POST /users with admin token but no domain id.

It should not be possible to use the admin token to create a user while not explicitly passing the domain in the request body.

test_list_users_with_static_admin_token_and_multiple_backends()

class keystone.tests.unit.test_v3_identity.IdentityV3toV2MethodsTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

Test users V3 to V2 conversion methods.

new_user_ref(**kwargs)

Construct a bare bones user ref.

Omits all optional components.

setUp()

test_v3_to_v2_user_method()

test_v3_to_v2_user_method_list()

class keystone.tests.unit.test_v3_identity.PasswordValidationTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_v3_identity.ChangePasswordTestCase

setUp()

test_changing_password_with_simple_password_strength()

test_changing_password_with_strong_password_strength()

test_changing_password_with_strong_password_strength_fails()

test_create_user_with_invalid_password()

test_update_user_with_invalid_password()

class keystone.tests.unit.test_v3_identity.UserFederatedAttributesTests(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

setUp()

test_list_users_with_all_federated_attributes()

test_list_users_with_idp_id()

test_list_users_with_idp_id_and_protocol_id()

test_list_users_with_idp_id_and_unique_id()

test_list_users_with_protocol_id()

test_list_users_with_protocol_id_and_unique_id()

test_list_users_with_unique_id()

class keystone.tests.unit.test_v3_identity.UserSelfServiceChangingPasswordsTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_v3_identity.ChangePasswordTestCase

setUp()

test_change_password_required_upon_first_use_for_admin_reset()

test_change_password_required_upon_first_use_for_create()

test_change_password_required_upon_first_use_ignore_user()

test_changing_expired_password_succeeds()

test_changing_expired_password_with_disabled_user_fails()

test_changing_password()

test_changing_password_not_logged()

test_changing_password_with_disabled_user_fails()

test_changing_password_with_incorrect_password_fails()

test_changing_password_with_min_password_age()

test_changing_password_with_missing_original_password_fails()

test_changing_password_with_missing_password_fails()

test_lockout_exempt()

keystone.tests.unit.test_v3_oauth1 module

class keystone.tests.unit.test_v3_oauth1.AccessTokenCRUDTests(*args, **kwargs)

Bases: keystone.tests.unit.test_v3_oauth1.OAuthFlowTests

test_delete_access_token_dne()

test_get_access_token_dne()

test_get_role_in_access_token()

test_get_role_in_access_token_dne()

test_get_single_access_token()

test_list_all_roles_in_access_token()

test_list_and_delete_access_tokens()

test_list_no_access_tokens()

class keystone.tests.unit.test_v3_oauth1.AuthTokenTests

Bases: object

test_change_user_password_also_deletes_tokens()

test_delete_access_token_also_revokes_token()

test_delete_keystone_tokens_by_consumer_id()

test_deleting_consumer_also_deletes_tokens()

test_deleting_project_also_invalidates_tokens()

test_keystone_token_is_valid()

test_oauth_token_cannot_authorize_request_token()

test_oauth_token_cannot_create_new_trust()

test_oauth_token_cannot_list_request_tokens()

test_token_chaining_is_not_allowed()

test_trust_token_cannot_authorize_request_token()

test_trust_token_cannot_list_request_tokens()

class keystone.tests.unit.test_v3_oauth1.ConsumerCRUDTests(*args, **kwargs)

Bases: keystone.tests.unit.test_v3_oauth1.OAuth1Tests

test_consumer_create()

test_consumer_create_no_description()

test_consumer_create_none_desc_1()

test_consumer_create_none_desc_2()

test_consumer_create_normalize_field()

test_consumer_delete()

test_consumer_get()

test_consumer_get_bad_id()

test_consumer_list()

test_consumer_update()

test_consumer_update_bad_id()

test_consumer_update_bad_secret()

test_consumer_update_normalize_field()

class keystone.tests.unit.test_v3_oauth1.FernetAuthTokenTests(*args, **kwargs)

Bases: keystone.tests.unit.test_v3_oauth1.AuthTokenTests, keystone.tests.unit.test_v3_oauth1.OAuthFlowTests

config_overrides()

test_delete_keystone_tokens_by_consumer_id()

class keystone.tests.unit.test_v3_oauth1.JsonHomeTests(*args, **kwargs)

Bases: keystone.tests.unit.test_v3_oauth1.OAuth1Tests, keystone.tests.unit.test_v3.JsonHomeTestMixin

JSON_HOME_DATA = {'https://docs.openstack.org/api/openstack-identity/3/ext/OS-OAUTH1/1.0/rel/consumers': {'href': '/OS-OAUTH1/consumers'}}

class keystone.tests.unit.test_v3_oauth1.MaliciousOAuth1Tests(*args, **kwargs)

Bases: keystone.tests.unit.test_v3_oauth1.OAuth1Tests

test_bad_authorizing_roles()

test_bad_consumer_id()

test_bad_consumer_secret()

test_bad_request_token_key()

test_bad_requested_project_id()

test_bad_verifier()

test_expired_authorizing_request_token()

test_expired_creating_keystone_token()

test_missing_oauth_headers()

test_no_authorizing_user_id()

test_validate_access_token_request_failed()

test_validate_requet_token_request_failed()

class keystone.tests.unit.test_v3_oauth1.OAuth1Tests(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

CONSUMER_URL = '/OS-OAUTH1/consumers'

setUp()

class keystone.tests.unit.test_v3_oauth1.OAuthCADFNotificationTests(*args, **kwargs)

Bases: keystone.tests.unit.test_v3_oauth1.OAuthNotificationTests

setUp()

Repeat the tests for CADF notifications.

class keystone.tests.unit.test_v3_oauth1.OAuthFlowTests(*args, **kwargs)

Bases: keystone.tests.unit.test_v3_oauth1.OAuth1Tests

test_oauth_flow()

class keystone.tests.unit.test_v3_oauth1.OAuthNotificationTests(*args, **kwargs)

Bases: keystone.tests.unit.test_v3_oauth1.OAuth1Tests, keystone.tests.unit.common.test_notifications.BaseNotificationTest

test_create_consumer()

test_delete_consumer()

test_oauth_flow_notifications()

Test to ensure notifications are sent for oauth tokens.

This test is very similar to test_oauth_flow, however there are additional checks in this test for ensuring that notifications for request token creation, and access token creation/deletion are emitted.

test_update_consumer()

class keystone.tests.unit.test_v3_oauth1.UUIDAuthTokenTests(*args, **kwargs)

Bases: keystone.tests.unit.test_v3_oauth1.AuthTokenTests, keystone.tests.unit.test_v3_oauth1.OAuthFlowTests

config_overrides()

keystone.tests.unit.test_v3_os_revoke module

class keystone.tests.unit.test_v3_os_revoke.OSRevokeTests(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase, keystone.tests.unit.test_v3.JsonHomeTestMixin

JSON_HOME_DATA = {'https://docs.openstack.org/api/openstack-identity/3/ext/OS-REVOKE/1.0/rel/events': {'href': '/OS-REVOKE/events'}}

assertReportedEventMatchesRecorded(event, sample, before_time)

test_access_token_id_not_in_event()

test_disabled_domain_in_list()

test_disabled_project_in_list()

test_get_empty_list()

test_list_since_invalid()

test_list_since_valid()

test_retries_on_deadlock()

test_revoked_at_in_list()

test_revoked_list_self_url()

test_revoked_token_in_list()

test_since_future_time_no_events()

keystone.tests.unit.test_v3_policy module

class keystone.tests.unit.test_v3_policy.PolicyTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

Test policy CRUD.

setUp()

test_create_policy()

Call POST /policies.

test_delete_policy()

Call DELETE /policies/{policy_id}.

test_get_head_policy()

Call GET & HEAD /policies/{policy_id}.

test_list_head_policies()

Call GET & HEAD /policies.

test_update_policy()

Call PATCH /policies/{policy_id}.

keystone.tests.unit.test_v3_protection module

class keystone.tests.unit.test_v3_protection.IdentityTestImpliedDomainSpecificRoles(*args, **kwargs)

Bases: keystone.tests.unit.test_v3_protection.IdentityTestv3CloudPolicySample

Test Domain specific Implied Roles via the REST API.

setUp()

test_allowed_role_implication_different_domains_as_cloud_admin()

test_check()

test_delete()

test_forbidden_role_implication_from_different_domain()

test_get()

test_list()

test_put()

class keystone.tests.unit.test_v3_protection.IdentityTestPolicySample(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

Test policy enforcement of the policy.json file.

load_sample_data()

test_admin_check_user_token()

test_admin_revoke_user_token()

test_admin_validate_user_token()

test_list_revoke_events_is_protected()

test_user_check_other_user_token_rejected()

test_user_check_same_token()

test_user_check_user_token()

test_user_revoke_other_user_token_rejected()

test_user_revoke_same_token()

test_user_revoke_user_token()

test_user_validate_other_user_token_rejected()

test_user_validate_same_token()

test_user_validate_user_token()

class keystone.tests.unit.test_v3_protection.IdentityTestProtectedCase(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

Test policy enforcement on the v3 Identity API.

load_sample_data()

setUp()

Setup for Identity Protection Test Cases.

As well as the usual housekeeping, create a set of domains, users, roles and projects for the subsequent tests:

• Three domains: A,B & C. C is disabled.
• DomainA has user1, DomainB has user2 and user3
• DomainA has group1 and group2, DomainB has group3
• User1 has two roles on DomainA
• User2 has one role on DomainA

Remember that there will also be a fourth domain in existence, the default domain.

test_get_user_protected_match_id()

GET /users/{id} (match payload).

Test Plan:

• Update policy to protect api by user_id
• List users with user_id of user1 as filter, to check that this will correctly match user_id in the flattened payload

test_get_user_protected_match_target()

GET /users/{id} (match target).

Test Plan:

• Update policy to protect api by domain_id
• Try and read a user who is in DomainB with a token scoped to Domain A - this should fail
• Retry this for a user who is in Domain A, which should succeed.
• Finally, try getting a user that does not exist, which should still return UserNotFound

test_list_groups_protected_by_domain()

GET /groups?domain_id=mydomain (protected).

Test Plan:

• Update policy to protect api by domain_id
• List groups using a token scoped to domainA and make sure we only get back the two groups that are in domainA
• Try and read the groups from domainB - this should fail since we don’t have a token scoped for domainB

test_list_groups_protected_by_domain_and_filtered()

GET /groups?domain_id=mydomain&name=myname (protected).

Test Plan:

• Update policy to protect api by domain_id
• List groups using a token scoped to domainA with a filter specifying both domainA and the name of group.
• We should only get back the group in domainA that matches the name

test_list_users_admin_project()

test_list_users_filtered_by_domain()

GET /users?domain_id=mydomain (filtered).

Test Plan:

• Update policy so api is unprotected
• Use an un-scoped token to make sure we can filter the users by domainB, getting back the 2 users in that domain

test_list_users_not_in_admin_project()

test_list_users_protected_by_domain()

GET /users?domain_id=mydomain (protected).

Test Plan:

• Update policy to protect api by domain_id
• List groups using a token scoped to domainA with a filter specifying domainA - we should only get back the one user that is in domainA.
• Try and read the users from domainB - this should fail since we don’t have a token scoped for domainB

test_list_users_unprotected()

GET /users (unprotected).

Test Plan:

• Update policy so api is unprotected
• Use an un-scoped token to make sure we can get back all the users independent of domain

test_revoke_grant_protected_match_target()

DELETE /domains/{id}/users/{id}/roles/{id} (match target).

Test Plan:

• Update policy to protect api by domain_id of entities in the grant
• Try and delete the existing grant that has a user who is from a different domain - this should fail.
• Retry this for a user who is in Domain A, which should succeed.

class keystone.tests.unit.test_v3_protection.IdentityTestv3CloudPolicySample(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase, keystone.tests.unit.test_v3.AssignmentTestMixin

Test policy enforcement of the sample v3 cloud policy file.

load_sample_data()

setUp()

Setup for v3 Cloud Policy Sample Test Cases.

The following data is created:

• Three domains: domainA, domainB and admin_domain
• One project, which name is ‘project’
• domainA has three users: domain_admin_user, project_admin_user and just_a_user:
  • domain_admin_user has role ‘admin’ on domainA,
  • project_admin_user has role ‘admin’ on the project,
  • just_a_user has a non-admin role on both domainA and the project.
• admin_domain has admin_project, and user cloud_admin_user, with an ‘admin’ role on admin_project.
• domainA has two groups (group1, group2), domainB has one group (group3)

We test various api protection rules from the cloud sample policy file to make sure the sample is valid and that we correctly enforce it.

test_admin_check_user_token()

test_admin_project()

test_admin_project_list_assignments_of_project()

test_admin_project_validate_user_token()

test_admin_revoke_user_token()

test_admin_validate_user_token()

test_cloud_admin()

test_cloud_admin_list_assignments_of_domain()

test_cloud_admin_list_assignments_of_project()

test_domain_admin_get_domain()

test_domain_admin_list_assignment_tree()

test_domain_admin_list_assignments_of_another_domain_failed()

test_domain_admin_list_assignments_of_domain()

test_domain_admin_list_assignments_of_project(*args, **kwargs)

test_domain_grants()

test_domain_grants_by_cloud_admin()

test_domain_grants_by_cloud_admin_for_domain_specific_role()

test_domain_grants_by_domain_admin_for_domain_specific_role()

test_domain_grants_by_non_admin_for_domain_specific_role()

test_domain_role_management_no_admin_no_rights()

test_domain_role_management_with_cloud_admin()

test_domain_role_management_with_domain_admin()

test_domain_role_management_with_project_admin()

test_domain_user_list_assignments_of_domain_failed()

test_domain_user_list_assignments_of_project_failed()

test_get_and_delete_ec2_credentials()

Test getting and deleting ec2 credentials through the ec2 API.

test_group_management()

test_group_management_by_cloud_admin()

test_list_revoke_events_is_protected()

test_list_user_credentials()

test_project_admin_get_project()

test_project_admin_list_assignments_of_another_project_failed()

test_project_grants()

test_project_grants_by_domain_admin()

test_project_grants_by_domain_admin_for_domain_specific_role()

test_project_grants_by_non_admin_for_domain_specific_role()

test_project_grants_by_project_admin_for_domain_specific_role()

test_project_management()

test_project_management_by_cloud_admin()

test_role_management_no_admin_no_rights()

test_role_management_with_cloud_admin()

test_role_management_with_domain_admin()

test_role_management_with_project_admin()

test_user_check_other_user_token_rejected()

test_user_check_same_token()

test_user_check_user_token()

test_user_management()

test_user_management_by_cloud_admin()

test_user_management_normalized_keys()

Illustrate the inconsistent handling of hyphens in keys.

To quote Morgan in bug 1526244:

the reason this is converted from “domain-id” to “domain_id” is because of how we process/normalize data. The way we have to handle specific data types for known columns requires avoiding “-” in the actual python code since “-” is not valid for attributes in python w/o significant use of “getattr” etc.

In short, historically we handle some things in conversions. The use of “extras” has long been a poor design choice that leads to odd/strange inconsistent behaviors because of other choices made in handling data from within the body. (In many cases we convert from “-” to “_” throughout openstack)

Source: https://bugs.launchpad.net/keystone/+bug/1526244/comments/9

test_user_revoke_other_user_token_rejected()

test_user_revoke_same_token()

test_user_revoke_user_token()

test_user_validate_other_user_token_rejected()

test_user_validate_same_token()

test_user_validate_user_token()

test_user_with_a_role_get_project()

keystone.tests.unit.test_v3_resource module

class keystone.tests.unit.test_v3_resource.ResourceTestCase(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase, keystone.tests.unit.test_v3.AssignmentTestMixin

Test domains and projects.

setUp()

test_create_domain()

Call POST /domains.

test_create_domain_bad_request()

Call POST /domains.

test_create_domain_case_sensitivity()

Call POST /domains` twice with upper() and lower() cased name.

test_create_domain_creates_is_domain_project()

Check a project that acts as a domain is created.

Call POST /domains.

test_create_domain_unsafe()

Call POST /domains with unsafe names.

test_create_domain_unsafe_default()

Check default for unsafe names for POST /domains.

test_create_hierarchical_project()

Call POST /projects.

test_create_is_domain_project_creates_domain()

Call POST /projects is_domain and check a domain is created.

test_create_project()

Call POST /projects.

test_create_project_bad_request()

Call POST /projects.

test_create_project_invalid_domain_id()

Call POST /projects.

test_create_project_unsafe()

Call POST /projects with unsafe names.

test_create_project_unsafe_default()

Check default for unsafe names for POST /projects.

test_create_project_with_parent_id_and_no_domain_id(*args, **kwargs)

Call POST /projects.

test_create_project_with_parent_id_none_and_domain_id_none()

Call POST /projects.

test_create_project_without_parent_id_and_without_domain_id()

Call POST /projects.

test_delete_default_domain()

test_delete_domain()

Call DELETE /domains/{domain_id}.

The sample data set up already has a user and project that is part of self.domain. Additionally we will create a group and a credential within it. Since we will authenticate in this domain, we create another set of entities in a second domain. Deleting this second domain should delete all these new entities. In addition, all the entities in the regular self.domain should be unaffected by the delete.

Test Plan:

• Create domain2 and a 2nd set of entities
• Disable domain2
• Delete domain2
• Check entities in domain2 have been deleted
• Check entities in self.domain are unaffected

test_delete_domain_deletes_is_domain_project()

Check the project that acts as a domain is deleted.

Call DELETE /domains.

test_delete_domain_hierarchy()

Call DELETE /domains/{domain_id}.

test_delete_enabled_domain_fails()

Call DELETE /domains/{domain_id} (when domain enabled).

test_delete_not_leaf_project()

Call DELETE /projects/{project_id}.

test_delete_project()

Call DELETE /projects/{project_id}.

As well as making sure the delete succeeds, we ensure that any credentials that reference this projects are also deleted, while other credentials are unaffected.

test_disable_domain()

Call PATCH /domains/{domain_id} (set enabled=False).

test_disable_leaf_project()

Call PATCH /projects/{project_id}.

test_disable_not_leaf_project()

Call PATCH /projects/{project_id}.

test_forbid_operations_on_defined_federated_domain()

Make sure one cannot operate on a user-defined federated domain.

This includes operations like create, update, delete.

test_forbid_operations_on_federated_domain()

Make sure one cannot operate on federated domain.

This includes operations like create, update, delete on domain identified by id and name where difference variations of id ‘Federated’ are used.

test_get_head_domain()

Call GET /domains/{domain_id}.

test_get_head_project()

Call GET & HEAD /projects/{project_id}.

test_get_project_with_parents_as_ids()

Call GET /projects/{project_id}?parents_as_ids.

test_get_project_with_parents_as_list_and_parents_as_ids()

Attempt to list a project’s parents as both a list and as IDs.

This uses GET /projects/{project_id}?parents_as_list&parents_as_ids which should fail with a Bad Request due to the conflicting query strings.

test_get_project_with_parents_as_list_with_full_access()

GET /projects/{project_id}?parents_as_list with full access.

Test plan:

• Create ‘parent’, ‘project’ and ‘subproject’ projects;
• Assign a user a role on each one of those projects;
• Check that calling parents_as_list on ‘subproject’ returns both ‘project’ and ‘parent’.

test_get_project_with_parents_as_list_with_invalid_id()

Call GET /projects/{project_id}?parents_as_list.

test_get_project_with_parents_as_list_with_partial_access()

GET /projects/{project_id}?parents_as_list with partial access.

Test plan:

• Create ‘parent’, ‘project’ and ‘subproject’ projects;
• Assign a user a role on ‘parent’ and ‘subproject’;
• Check that calling parents_as_list on ‘subproject’ only returns ‘parent’.

test_get_project_with_subtree_as_ids()

Call GET /projects/{project_id}?subtree_as_ids.

This test creates a more complex hierarchy to test if the structured dictionary returned by using the subtree_as_ids query param correctly represents the hierarchy.

The hierarchy contains 5 projects with the following structure:

   +--A--+
   |     |
+--B--+  C
|     |
D     E

test_get_project_with_subtree_as_list_and_subtree_as_ids()

Attempt to get a project subtree as both a list and as IDs.

This uses GET /projects/{project_id}?subtree_as_list&subtree_as_ids which should fail with a bad request due to the conflicting query strings.

test_get_project_with_subtree_as_list_with_full_access()

GET /projects/{project_id}?subtree_as_list with full access.

Test plan:

• Create ‘parent’, ‘project’ and ‘subproject’ projects;
• Assign a user a role on each one of those projects;
• Check that calling subtree_as_list on ‘parent’ returns both ‘parent’ and ‘subproject’.

test_get_project_with_subtree_as_list_with_invalid_id()

Call GET /projects/{project_id}?subtree_as_list.

test_get_project_with_subtree_as_list_with_partial_access()

GET /projects/{project_id}?subtree_as_list with partial access.

Test plan:

• Create ‘parent’, ‘project’ and ‘subproject’ projects;
• Assign a user a role on ‘parent’ and ‘subproject’;
• Check that calling subtree_as_list on ‘parent’ returns ‘subproject’.

test_list_head_domains()

Call GET & HEAD /domains.

test_list_head_projects()

Call GET & HEAD /projects.

test_list_project_is_domain_filter()

Call GET /projects?is_domain=True/False.

test_list_project_is_domain_filter_default()

Default project list should not see projects acting as domains.

test_list_projects_filtering_by_parent_id()

Call GET /projects?parent_id={project_id}.

test_token_revoked_once_domain_disabled()

Test token from a disabled domain has been invalidated.

Test that a token that was valid for an enabled domain becomes invalid once that domain is disabled.

test_update_domain()

Call PATCH /domains/{domain_id}.

test_update_domain_unsafe()

Call POST /domains/{domain_id} with unsafe names.

test_update_domain_unsafe_default()

Check default for unsafe names for POST /domains.

test_update_domain_updates_is_domain_project()

Check the project that acts as a domain is updated.

Call PATCH /domains.

test_update_project()

Call PATCH /projects/{project_id}.

test_update_project_domain_id()

Call PATCH /projects/{project_id} with domain_id.

A projects’s domain_id is immutable. Ensure that any attempts to update the domain_id of a project fails.

test_update_project_is_domain_not_allowed()

Call PATCH /projects/{project_id} with is_domain.

The is_domain flag is immutable.

test_update_project_parent_id()

Call PATCH /projects/{project_id}.

test_update_project_unsafe()

Call POST /projects/{project_id} with unsafe names.

test_update_project_unsafe_default()

Check default for unsafe names for POST /projects.

class keystone.tests.unit.test_v3_resource.ResourceV3toV2MethodsTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

Test domain V3 to V2 conversion methods.

test_v2controller_filter_domain()

test_v2controller_filter_domain_id()

test_v2controller_filter_project_parent_id()

test_v3_to_v2_project_method()

test_v3_to_v2_project_method_list()

test_v3controller_filter_domain_id()

keystone.tests.unit.test_v3_trust module

class keystone.tests.unit.test_v3_trust.TestTrustOperations(*args, **kwargs)

Bases: keystone.tests.unit.test_v3.RestfulTestCase

Test module for create, read, update and delete operations on trusts.

This module is specific to tests for trust CRUD operations. All other tests related to trusts that are authentication or authorization specific should live in the keystone/tests/unit/test_v3_auth.py module.

setUp()

test_create_trust_bad_request()

test_create_trust_with_bad_remaining_uses_returns_bad_request()

test_create_trust_with_non_existant_project_returns_not_found()

test_create_trust_with_non_existant_role_id_returns_not_found()

test_create_trust_with_non_existant_role_name_returns_not_found()

test_create_trust_with_non_existant_trustee_returns_not_found()

test_create_trust_with_trustee_as_trustor_returns_forbidden()

test_create_trust_without_impersonation_returns_bad_request()

test_create_trust_without_trustee_returns_bad_request()

test_delete_trust()

test_exercise_trust_scoped_token_with_impersonation()

test_exercise_trust_scoped_token_without_impersonation()

test_forbidden_trust_impersonation_in_redelegation()

Test forbiddance of impersonation in trust redelegation.

Check that trustee not allowed to create a trust (with impersonation set to true) from a redelegated trust (with impersonation set to false)

test_list_trusts()

test_trust_crud()

test_trust_deleted_when_project_deleted()

test_trust_deleted_when_user_deleted()

test_v3_v2_intermix_project_not_in_default_domain_failed()

test_v3_v2_intermix_trustee_not_in_default_domain_failed()

test_validate_trust_scoped_token_against_v2()

keystone.tests.unit.test_validation module

class keystone.tests.unit.test_validation.CredentialValidationTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 Credential API validation.

setUp()

test_validate_credential_ec2_without_project_id_fails()

Validate project_id is required for ec2.

Test that a SchemaValidationError is raised when type is ec2 and no project_id is provided in create request.

test_validate_credential_non_ec2_without_project_id_succeeds()

Validate project_id is not required for non-ec2.

Test that create request without project_id succeeds for any non-ec2 credential.

test_validate_credential_succeeds()

Test that we validate a credential request.

test_validate_credential_update_succeeds()

Test that a credential request is properly validated.

test_validate_credential_update_with_extra_parameters_succeeds()

Validate credential update with extra parameters.

test_validate_credential_update_without_parameters_fails()

Exception is raised on update without parameters.

test_validate_credential_with_extra_parameters_succeeds()

Validate create request with extra parameters.

test_validate_credential_with_project_id_succeeds()

Test that credential request works for all types.

test_validate_credential_without_blob_fails()

Exception raised without blob in create request.

test_validate_credential_without_type_fails()

Exception raised without type in create request.

test_validate_credential_without_user_id_fails()

Exception raised without user_id in create request.

class keystone.tests.unit.test_validation.DomainValidationTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 Domain API validation.

setUp()

test_validate_domain_create_fails_with_invalid_name()

Exception when validating a create request with invalid name.

test_validate_domain_request()

Make sure we successfully validate a create domain request.

test_validate_domain_request_with_enabled()

Validate enabled as boolean-like values for domains.

test_validate_domain_request_with_invalid_description_fails()

Exception is raised when description is a non-string value.

test_validate_domain_request_with_invalid_enabled_fails()

Exception is raised when enabled isn’t a boolean-like value.

test_validate_domain_request_with_name_too_long()

Exception is raised when name is too long.

test_validate_domain_request_with_valid_description()

Test that we validate description in create domain requests.

test_validate_domain_request_without_name_fails()

Make sure we raise an exception when name isn’t included.

test_validate_domain_update_fails_with_invalid_name()

Exception when validating an update request with invalid name.

test_validate_domain_update_request()

Test that we validate a domain update request.

test_validate_domain_update_request_with_name_too_long_fails()

Exception raised when updating a domain with name too long.

test_validate_domain_update_request_with_no_parameters_fails()

Exception is raised when updating a domain without parameters.

class keystone.tests.unit.test_validation.EndpointGroupValidationTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 Endpoint Group API validation.

setUp()

test_validate_create_endpoint_group_fails_with_invalid_filters()

Validate invalid filters value in endpoint group parameters.

This test ensures that exception is raised when non-dict values is used as filters in endpoint group create request.

test_validate_endpoint_group_create_fails_without_filters()

Exception raised when filters isn’t in endpoint group request.

test_validate_endpoint_group_create_fails_without_name()

Exception raised when name isn’t in endpoint group request.

test_validate_endpoint_group_create_succeeds_with_req_parameters()

Validate required endpoint group parameters.

This test ensure that validation succeeds with only the required parameters passed for creating an endpoint group.

test_validate_endpoint_group_create_succeeds_with_valid_filters()

Validate filters in endpoint group create requests.

test_validate_endpoint_group_request_succeeds()

Test that we validate an endpoint group request.

test_validate_endpoint_group_update_fails_with_invalid_filters()

Exception raised when passing invalid filters in request.

test_validate_endpoint_group_update_fails_with_no_parameters()

Exception raised when no parameters on endpoint group update.

test_validate_endpoint_group_update_request_succeeds()

Test that we validate an endpoint group update request.

test_validate_endpoint_group_update_succeeds_with_name()

Validate request with only name in endpoint group update.

This test ensures that passing only a name passes validation on update endpoint group request.

test_validate_endpoint_group_update_succeeds_with_valid_filters()

Validate filters as dict values.

class keystone.tests.unit.test_validation.EndpointValidationTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 Endpoint API validation.

setUp()

test_validate_create_endpoint_fails_with_invalid_enabled()

Exception raised when boolean-like values as enabled.

test_validate_endpoint_create_fails_with_invalid_interface()

Exception raised with invalid interface.

test_validate_endpoint_create_fails_with_invalid_region_id()

Exception raised when passing invalid region(_id) in request.

test_validate_endpoint_create_fails_with_invalid_url()

Exception raised when passing invalid url in request.

test_validate_endpoint_create_fails_without_interface()

Exception raised when interface isn’t in endpoint request.

test_validate_endpoint_create_fails_without_service_id()

Exception raised when service_id isn’t in endpoint request.

test_validate_endpoint_create_fails_without_url()

Exception raised when url isn’t in endpoint request.

test_validate_endpoint_create_succeeds_with_extra_parameters()

Test that extra parameters pass validation on create endpoint.

test_validate_endpoint_create_succeeds_with_required_parameters()

Validate an endpoint request with only the required parameters.

test_validate_endpoint_create_succeeds_with_url()

Validate url attribute in endpoint create request.

test_validate_endpoint_create_succeeds_with_valid_enabled()

Validate an endpoint with boolean values.

Validate boolean values as enabled in endpoint create requests.

test_validate_endpoint_request_succeeds()

Test that we validate an endpoint request.

test_validate_endpoint_update_fails_with_invalid_enabled()

Exception raised when enabled is boolean-like value.

test_validate_endpoint_update_fails_with_invalid_interface()

Exception raised when invalid interface on endpoint update.

test_validate_endpoint_update_fails_with_invalid_region_id()

Exception raised when passing invalid region(_id) in request.

test_validate_endpoint_update_fails_with_invalid_url()

Exception raised when passing invalid url in request.

test_validate_endpoint_update_fails_with_no_parameters()

Exception raised when no parameters on endpoint update.

test_validate_endpoint_update_request_succeeds()

Test that we validate an endpoint update request.

test_validate_endpoint_update_succeeds_with_extra_parameters()

Test that extra parameters pass validation on update endpoint.

test_validate_endpoint_update_succeeds_with_url()

Validate url attribute in endpoint update request.

test_validate_endpoint_update_succeeds_with_valid_enabled()

Validate enabled as boolean values.

class keystone.tests.unit.test_validation.EntityValidationTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.BaseTestCase

setUp()

test_create_entity_with_all_valid_parameters_validates()

Validate all parameter values against test schema.

test_create_entity_with_invalid_email_fails()

Validate invalid email address.

Test that an exception is raised when validating improperly formatted email addresses.

test_create_entity_with_invalid_enabled_format_raises_exception()

Validate invalid enabled formats.

Test that an exception is raised when passing invalid boolean-like values as enabled.

test_create_entity_with_invalid_id_strings()

Exception raised when using invalid id strings.

test_create_entity_with_invalid_urls_fails()

Test that an exception is raised when validating improper urls.

test_create_entity_with_name_too_long_raises_exception()

Validate long names.

Validate that an exception is raised when validating a string of 255+ characters passed in as a name.

test_create_entity_with_name_too_short_raises_exception()

Validate short names.

Test that an exception is raised when passing a string of length zero as a name parameter.

test_create_entity_with_null_id_string()

Validate that None is an acceptable optional string type.

test_create_entity_with_null_string_succeeds()

Exception raised when passing None on required id strings.

test_create_entity_with_only_required_valid_parameters_validates()

Validate correct for only parameters values against test schema.

test_create_entity_with_unicode_name_validates()

Test that we successfully validate a unicode string.

test_create_entity_with_valid_email_validates()

Validate email address.

Test that we successfully validate properly formatted email addresses.

test_create_entity_with_valid_enabled_formats_validates()

Validate valid enabled formats.

Test that we have successful validation on boolean values for enabled.

test_create_entity_with_valid_id_strings()

Validate acceptable id strings.

test_create_entity_with_valid_urls_validates()

Test that proper urls are successfully validated.

test_update_entity_with_a_null_optional_parameter_validates()

Optional parameters can be null to removed the value.

test_update_entity_with_a_required_null_parameter_fails()

The name parameter can’t be null.

test_update_entity_with_a_valid_optional_parameter_validates()

Succeed with only a single valid optional parameter.

test_update_entity_with_a_valid_required_parameter_validates()

Succeed if a valid required parameter is provided.

test_update_entity_with_all_parameters_valid_validates()

Simulate updating an entity by ID.

test_update_entity_with_invalid_optional_parameter_fails()

Fail when an optional parameter is invalid.

test_update_entity_with_invalid_required_parameter_fails()

Fail if a provided required parameter is invalid.

test_update_entity_with_no_parameters_fails()

At least one parameter needs to be present for an update.

class keystone.tests.unit.test_validation.FederationProtocolValidationTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 Federation Protocol API validation.

setUp()

test_validate_protocol_request_fails_with_invalid_mapping_id()

Exception raised when mapping_id is not string.

test_validate_protocol_request_fails_with_invalid_params()

Exception raised when unknown parameter is found.

test_validate_protocol_request_no_parameters()

Test that schema validation with empty request body.

test_validate_protocol_request_succeeds()

Test that we validate a protocol request successfully.

test_validate_protocol_request_succeeds_on_update()

Test that we validate a protocol update request successfully.

test_validate_protocol_request_succeeds_with_nonuuid_mapping_id()

Test that we allow underscore in mapping_id value.

test_validate_update_protocol_request_fails_with_invalid_id()

Test that updating a protocol with a non-string mapping_id fail.

test_validate_update_protocol_request_fails_with_invalid_params()

Exception raised when unknown parameter in protocol update.

test_validate_update_protocol_request_succeeds_with_nonuuid_id()

Test that we allow underscore in mapping_id value when updating.

test_validate_update_protocol_with_no_parameters_fails()

Test that updating a protocol requires at least one attribute.

class keystone.tests.unit.test_validation.GroupValidationTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 Group API validation.

setUp()

test_validate_group_create_fails_with_invalid_name()

Exception when validating a create request with invalid name.

test_validate_group_create_fails_without_group_name()

Exception raised when group name is not provided in request.

test_validate_group_create_succeeds()

Validate create group requests.

test_validate_group_create_succeeds_with_all_parameters()

Validate create group requests with all parameters.

test_validate_group_create_succeeds_with_extra_parameters()

Validate extra attributes on group create requests.

test_validate_group_update_fails_with_invalid_name()

Exception when validating an update request with invalid name.

test_validate_group_update_fails_with_no_parameters()

Exception raised when no parameters passed in on update.

test_validate_group_update_succeeds()

Validate group update requests.

test_validate_group_update_succeeds_with_extra_parameters()

Validate group update requests with extra parameters.

class keystone.tests.unit.test_validation.IdentityProviderValidationTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 Identity Provider API validation.

setUp()

test_validate_idp_request_fails_with_invalid_params()

Exception raised when unknown parameter is found.

test_validate_idp_request_no_parameters()

Test that schema validation with empty request body.

test_validate_idp_request_remote_id_nullable()

Test that remote_ids could be explicitly set to None.

test_validate_idp_request_succeeds()

Test that we validate an identity provider request.

test_validate_idp_request_with_duplicated_remote_id()

Exception is raised when the duplicated remote_ids is found.

test_validate_idp_request_with_enabled()

Validate enabled as boolean-like values.

test_validate_idp_request_with_invalid_description_fails()

Exception is raised when description as a non-string value.

test_validate_idp_request_with_invalid_enabled_fails()

Exception is raised when enabled isn’t a boolean-like value.

test_validate_idp_request_with_invalid_remote_id_fails()

Exception is raised when remote_ids is not a array.

class keystone.tests.unit.test_validation.OAuth1ValidationTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 Identity OAuth1 API validation.

setUp()

test_validate_consumer_request_succeeds()

Test that we validate a consumer request successfully.

test_validate_consumer_request_with_invalid_description_fails()

Exception is raised when description as a non-string value.

test_validate_consumer_request_with_no_parameters()

Test that schema validation with empty request body.

test_validate_consumer_request_with_none_desc()

Test that schema validation with None desc.

test_validate_update_consumer_request_fails_with_secret()

Exception raised when secret is given.

class keystone.tests.unit.test_validation.PasswordValidationTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

setUp()

test_password_validate_with_invalid_password_regex()

test_password_validate_with_invalid_strong_password()

test_password_validate_with_valid_strong_password()

class keystone.tests.unit.test_validation.PolicyValidationTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 Policy API validation.

setUp()

test_validate_policy_create_with_extra_parameters_succeeds()

Validate policy create with extra parameters.

test_validate_policy_create_with_invalid_type_fails()

Exception raised when blob and type are boolean.

test_validate_policy_succeeds()

Test that we validate a create policy request.

test_validate_policy_update_succeeds()

Test that we validate a policy update request.

test_validate_policy_update_with_extra_parameters_succeeds()

Validate policy update request with extra parameters.

test_validate_policy_update_with_invalid_type_fails()

Exception raised when invalid type on policy update.

test_validate_policy_update_without_parameters_fails()

Exception raised when updating policy without parameters.

test_validate_policy_without_blob_fails()

Exception raised without blob in request.

test_validate_policy_without_type_fails()

Exception raised without type in request.

class keystone.tests.unit.test_validation.ProjectValidationTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 Project API validation.

setUp()

test_validate_project_create_fails_with_invalid_name()

Exception when validating a create request with invalid name.

test_validate_project_create_request_with_valid_domain_id()

Test that we validate domain_id in create project requests.

test_validate_project_request()

Test that we validate a project with name in request.

test_validate_project_request_with_enabled()

Validate enabled as boolean-like values for projects.

test_validate_project_request_with_invalid_description_fails()

Exception is raised when description as a non-string value.

test_validate_project_request_with_invalid_domain_id_fails()

Exception is raised when domain_id is a non-id value.

test_validate_project_request_with_invalid_enabled_fails()

Exception is raised when enabled isn’t a boolean-like value.

test_validate_project_request_with_invalid_parent_id_fails()

Exception is raised when parent_id as a non-id value.

test_validate_project_request_with_name_too_long()

Exception is raised when name is too long.

test_validate_project_request_with_valid_description()

Test that we validate description in create project requests.

test_validate_project_request_with_valid_parent_id()

Test that we validate parent_id in create project requests.

test_validate_project_request_without_name_fails()

Validate project request fails without name.

test_validate_project_update_fails_with_invalid_name()

Exception when validating an update request with invalid name.

test_validate_project_update_request()

Test that we validate a project update request.

test_validate_project_update_request_with_name_too_long_fails()

Exception raised when updating a project with name too long.

test_validate_project_update_request_with_no_parameters_fails()

Exception is raised when updating project without parameters.

class keystone.tests.unit.test_validation.RegionValidationTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 Region API validation.

setUp()

test_validate_region_create_fails_with_invalid_region_id()

Exception raised when passing invalid id in request.

test_validate_region_create_request_with_parameters()

Test that we validate a region request with parameters.

test_validate_region_create_succeeds_with_extra_parameters()

Validate create region request with extra values.

test_validate_region_create_succeeds_with_no_parameters()

Validate create region request with no parameters.

test_validate_region_create_with_uuid()

Test that we validate a region request with a UUID as the id.

test_validate_region_request()

Test that we validate a basic region request.

test_validate_region_update_fails_with_no_parameters()

Exception raised when passing no parameters in a region update.

test_validate_region_update_succeeds()

Test that we validate a region update request.

test_validate_region_update_succeeds_with_extra_parameters()

Validate extra attributes in the region update request.

class keystone.tests.unit.test_validation.RoleValidationTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 Role API validation.

setUp()

test_validate_role_create_fails_with_invalid_name()

Exception when validating a create request with invalid name.

test_validate_role_create_request_with_name_too_long_fails()

Exception raised when creating a role with name too long.

test_validate_role_create_without_name_raises_exception()

Test that we raise an exception when name isn’t included.

test_validate_role_request()

Test we can successfully validate a create role request.

test_validate_role_update_fails_with_invalid_name()

Exception when validating an update request with invalid name.

test_validate_role_update_request()

Test that we validate a role update request.

test_validate_role_update_request_with_name_too_long_fails()

Exception raised when updating a role with name too long.

class keystone.tests.unit.test_validation.ServiceProviderValidationTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 Service Provider API validation.

setUp()

test_validate_sp_request()

Test that we validate auth_url and sp_url in request.

test_validate_sp_request_with_enabled()

Validate enabled as boolean-like values.

test_validate_sp_request_with_extra_field_fails()

Exception raised when passing extra fields in the body.

test_validate_sp_request_with_invalid_auth_url_fails()

Validate request fails with invalid auth_url.

test_validate_sp_request_with_invalid_description_fails()

Exception is raised when description as a non-string value.

test_validate_sp_request_with_invalid_enabled_fails()

Exception is raised when enabled isn’t a boolean-like value.

test_validate_sp_request_with_invalid_sp_url_fails()

Validate request fails with invalid sp_url.

test_validate_sp_request_with_valid_description()

Test that we validate description in create requests.

test_validate_sp_request_without_auth_url_fails()

Validate request fails without auth_url.

test_validate_sp_request_without_sp_url_fails()

Validate request fails without sp_url.

test_validate_sp_update_request()

Test that we validate a update request.

test_validate_sp_update_request_with_invalid_auth_url_fails()

Exception raised when updating with invalid auth_url.

test_validate_sp_update_request_with_invalid_sp_url_fails()

Exception raised when updating with invalid sp_url.

test_validate_sp_update_request_with_no_parameters_fails()

Exception is raised when updating without parameters.

class keystone.tests.unit.test_validation.ServiceValidationTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 Service API validation.

setUp()

test_validate_service_create_fails_when_name_too_long()

Exception raised when name is greater than 255 characters.

test_validate_service_create_fails_when_name_too_short()

Exception is raised when name is too short.

test_validate_service_create_fails_when_type_too_long()

Exception is raised when type is too long.

test_validate_service_create_fails_when_type_too_short()

Exception is raised when type is too short.

test_validate_service_create_fails_with_invalid_enabled()

Exception raised when boolean-like parameters as enabled.

On service create, make sure an exception is raised if enabled is not a boolean value.

test_validate_service_create_fails_without_type()

Exception raised when trying to create a service without type.

test_validate_service_create_succeeds()

Test that we validate a service create request.

test_validate_service_create_succeeds_with_extra_parameters()

Test that extra parameters pass validation on create service.

test_validate_service_create_succeeds_with_required_parameters()

Validate a service create request with the required parameters.

test_validate_service_create_succeeds_with_valid_enabled()

Validate boolean values as enabled values on service create.

test_validate_service_update_fails_with_invalid_enabled()

Exception raised when boolean-like values as enabled.

test_validate_service_update_fails_with_name_too_long()

Exception is raised when name is too long on update.

test_validate_service_update_fails_with_name_too_short()

Exception is raised when name is too short on update.

test_validate_service_update_fails_with_no_parameters()

Exception raised when updating a service without values.

test_validate_service_update_fails_with_type_too_long()

Exception is raised when type is too long on update.

test_validate_service_update_fails_with_type_too_short()

Exception is raised when type is too short on update.

test_validate_service_update_request_succeeds()

Test that we validate a service update request.

test_validate_service_update_succeeds_with_extra_parameters()

Validate updating a service with extra parameters.

test_validate_service_update_succeeds_with_valid_enabled()

Validate boolean formats as enabled on service update.

class keystone.tests.unit.test_validation.TrustValidationTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 Trust API validation.

setUp()

test_validate_trust_succeeds()

Test that we can validate a trust request.

test_validate_trust_with_all_parameters_succeeds()

Test that we can validate a trust request with all parameters.

test_validate_trust_with_extra_parameters_succeeds()

Test that we can validate a trust request with extra parameters.

test_validate_trust_with_invalid_expires_at_fails()

Validate trust request with invalid expires_at fails.

test_validate_trust_with_invalid_impersonation_fails()

Validate trust request with invalid impersonation fails.

test_validate_trust_with_invalid_role_type_fails()

Validate trust request with invalid roles fails.

test_validate_trust_with_list_of_valid_roles_succeeds()

Validate trust request with a list of valid roles.

test_validate_trust_with_null_remaining_uses_succeeds()

Validate trust request with null remaining_uses.

test_validate_trust_with_period_in_user_id_string()

Validate trust request with a period in the user id string.

test_validate_trust_with_remaining_uses_succeeds()

Validate trust request with remaining_uses succeeds.

test_validate_trust_with_role_types_succeeds()

Validate trust request with roles succeeds.

test_validate_trust_without_impersonation_fails()

Validate trust request fails without impersonation.

test_validate_trust_without_trustee_id_fails()

Validate trust request fails without trustee_id.

test_validate_trust_without_trustor_id_fails()

Validate trust request fails without trustor_id.

class keystone.tests.unit.test_validation.UserValidationTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 User API validation.

setUp()

test_user_create_options_change_password_required_none()

test_user_create_options_change_password_required_wrong_type()

test_user_create_options_fails_invalid_option()

test_user_create_succeeds_with_empty_options()

test_user_create_with_mfa_rules()

test_user_create_with_mfa_rules_enabled()

test_user_create_with_options_change_password_required()

test_user_create_with_options_lockout_password()

test_user_create_with_two_options()

test_user_option_validation_with_invalid_mfa_rules_fails()

test_user_update_mfa_rules_enabled()

test_user_update_with_mfa_rules()

test_user_update_with_options_change_password_required()

test_user_update_with_options_lockout_password()

test_user_update_with_two_options()

test_validate_user_create_fails_with_invalid_enabled_formats()

Exception raised when enabled is not an acceptable format.

test_validate_user_create_fails_with_invalid_name()

Exception when validating a create request with invalid name.

test_validate_user_create_fails_with_invalid_password_type()

Exception raised when user password is of the wrong type.

test_validate_user_create_fails_without_name()

Exception raised when validating a user without name.

test_validate_user_create_request_succeeds()

Test that validating a user create request succeeds.

test_validate_user_create_succeeds_with_extra_attributes()

Validate extra parameters on user create requests.

test_validate_user_create_succeeds_with_null_description()

Validate that description can be nullable on create user.

test_validate_user_create_succeeds_with_null_password()

Validate that password is nullable on create user.

test_validate_user_create_succeeds_with_password_of_zero_length()

Validate empty password on user create requests.

test_validate_user_create_succeeds_with_valid_enabled_formats()

Validate acceptable enabled formats in create user requests.

test_validate_user_create_with_all_valid_parameters_succeeds()

Test that validating a user create request succeeds.

test_validate_user_update_fails_with_invalid_name()

Exception when validating an update request with invalid name.

test_validate_user_update_fails_with_no_parameters()

Exception raised when updating nothing.

test_validate_user_update_succeeds()

Validate an update user request.

test_validate_user_update_succeeds_with_extra_parameters()

Validate user update requests with extra parameters.

keystone.tests.unit.test_validation.expected_validation_failure(msg)

keystone.tests.unit.test_versions module

class keystone.tests.unit.test_versions.TestClient(app=None, token=None)

Bases: object

get(path, headers=None)

post(path, headers=None, body=None)

put(path, headers=None, body=None)

request(method, path, headers=None, body=None)

class keystone.tests.unit.test_versions.VersionBehindSslTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

config_overrides()

setUp()

test_versions_with_header()

test_versions_without_headers()

class keystone.tests.unit.test_versions.VersionSingleAppTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

Test running with a single application loaded.

These are important because when Keystone is running in Apache httpd there’s only one application loaded for each instance.

config_overrides()

setUp()

test_admin()

test_public()

class keystone.tests.unit.test_versions.VersionTestCase(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

config_overrides()

setUp()

test_accept_type_handling()

test_admin_version_v2()

test_admin_version_v3(*args, **kwargs)

test_admin_versions()

test_extension_property_method_returns_none()

test_json_home_root()

test_json_home_v3()

test_no_json_home_document_returned_when_v3_disabled(*args, **keywargs)

test_public_version_v2()

test_public_version_v3()

test_public_versions()

test_use_site_url_if_endpoint_unset()

test_use_site_url_if_endpoint_unset_v2()

test_use_site_url_if_endpoint_unset_v3()

test_v2_disabled(*args, **keywargs)

test_v3_disabled(*args, **keywargs)

keystone.tests.unit.test_wsgi module

class keystone.tests.unit.test_wsgi.ApplicationTest(*args, **kwargs)

Bases: keystone.tests.unit.test_wsgi.BaseWSGITest

test_application_local_config()

test_attribute_missing_from_request()

test_base_url()

test_improperly_encoded_params()

test_no_required_attributes_present()

test_properly_encoded_params()

test_query_string_available()

test_render_exception()

test_render_exception_host()

test_render_response()

test_render_response_custom_headers()

test_render_response_custom_status()

test_render_response_head_with_body()

test_render_response_no_body()

test_render_response_non_str_headers_converted()

test_require_attribute_fail_if_attribute_not_present()

test_response_content_type()

test_successful_require_attribute()

test_successful_require_multiple_attributes()

class keystone.tests.unit.test_wsgi.BaseWSGITest(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

setUp()

class keystone.tests.unit.test_wsgi.ExtensionRouterTest(*args, **kwargs)

Bases: keystone.tests.unit.test_wsgi.BaseWSGITest

test_extensionrouter_local_config()

class keystone.tests.unit.test_wsgi.FakeApp(*args, **kwargs)

Bases: keystone.common.wsgi.Application

index(request)

class keystone.tests.unit.test_wsgi.FakeAttributeCheckerApp(*args, **kwargs)

Bases: keystone.common.wsgi.Application

assert_attribute(body, attr)

Assert that the given request has a certain attribute.

assert_attributes(body, attr)

Assert that the given request has a certain set attributes.

index(request)

class keystone.tests.unit.test_wsgi.LocalizedResponseTest(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

test_get_localized_response(*args, **keywargs)

test_request_match_default()

test_request_match_language_expected(*args, **keywargs)

test_request_match_language_unexpected(*args, **keywargs)

test_static_translated_string_is_lazy_translatable()

class keystone.tests.unit.test_wsgi.MiddlewareTest(*args, **kwargs)

Bases: keystone.tests.unit.test_wsgi.BaseWSGITest

test_middleware_bad_request()

test_middleware_exception_error()

test_middleware_request()

test_middleware_response()

test_middleware_type_error()

class keystone.tests.unit.test_wsgi.RouterTest(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

setUp()

test_invalid_status()

class keystone.tests.unit.test_wsgi.WSGIAppConfigTest(*args, **kwargs)

Bases: keystone.tests.unit.core.TestCase

custom_config_dir = '/etc/kst/'

custom_config_files = ['kst.conf', 'kst2.conf']

default_config_file = 'keystone.conf'

test_can_mix_relative_and_absolute_paths_config_file()

test_can_use_default_config_files_with_custom_config_dir()

test_can_use_multiple_absolute_path_config_files()

test_can_use_multiple_config_files_under_custom_config_dir()

test_can_use_multiple_config_files_under_default_config_dir()

test_can_use_single_absolute_path_config_file()

test_can_use_single_config_file_under_custom_config_dir()

test_can_use_single_config_file_under_default_config_dir()

test_config_files_have_default_values_when_envars_not_set()

test_config_files_have_default_values_with_empty_envars()

keystone.tests.unit.utils module

Useful utilities for tests.

keystone.tests.unit.utils.new_uuid()

Return a string UUID.

keystone.tests.unit.utils.timezone(func)

keystone.tests.unit.utils.wip(message, expected_exception=<type 'exceptions.Exception'>, bug=None)

Mark a test as work in progress.

Based on code by Nat Pryce: https://gist.github.com/npryce/997195#file-wip-py

The test will always be run. If the test fails then a TestSkipped exception is raised. If the test passes an AssertionError exception is raised so that the developer knows they made the test pass. This is a reminder to remove the decorator.

Parameters:

• message – a string message to help clarify why the test is marked as a work in progress
• expected_exception – an exception class that will be checked for when @wip verifies an exception is raised. The test will fail if a different exception is raised. Default is “any” exception is valid
• bug – (optional) a string for tracking the bug and what bug should cause the @wip decorator to be removed from the testcase

Usage:

>>> @wip('Expected Error', expected_exception=Exception, bug="#000000")
>>> def test():
>>>     pass

Module contents