keystone.policy.backends package

Submodules

keystone.policy.backends.rules module

Policy engine for keystone

class keystone.policy.backends.rules.Policy

Bases: keystone.policy.core.PolicyDriverV8

create_policy(policy_id, policy)

delete_policy(policy_id)

enforce(credentials, action, target)

get_policy(policy_id)

list_policies()

update_policy(policy_id, policy)

keystone.policy.backends.rules.enforce(credentials, action, target, do_raise=True)

Verifies that the action is valid on the target in this context.

Parameters:

• credentials – user credentials
• action – string representing the action to be checked, which should be colon separated for clarity.
• target – dictionary representing the object of the action for object creation this should be a dictionary representing the location of the object e.g. {‘project_id’: object.project_id}

Raises keystone.exception.Forbidden:  

If verification fails.

Actions should be colon separated for clarity. For example:

• identity:list_users

keystone.policy.backends.rules.init()

keystone.policy.backends.rules.reset()

keystone.policy.backends.sql module

class keystone.policy.backends.sql.Policy

Bases: keystone.policy.backends.rules.Policy

create_policy(*args, **kwargs)

delete_policy(policy_id)

get_policy(policy_id)

list_policies()

update_policy(*args, **kwargs)

class keystone.policy.backends.sql.PolicyModel(*args, **kwargs)

Bases: sqlalchemy.ext.declarative.api.Base, keystone.common.sql.core.DictBase

attributes = ['id', 'blob', 'type']

blob

extra

id

type

Module contents