Plugin Options¶

Using plugins via config file¶

When using the plugins via config file you define the plugin name as auth_type. The options of the plugin are then specified while replacing - with _ to be valid in configuration.

For example to use the password plugin in a config file you would specify:

[section]
auth_url = http://keystone.example.com:5000/
auth_type = password
username = myuser
password = mypassword
project_name = myproject
default_domain_name = mydomain

Using plugins via CLI¶

When using auth plugins via CLI via os-client-config or shade you can specify parameters via environment configuration by using the pattern OS_ followed by the uppercase parameter name replacing - with _.

For example to use the password plugin via environment variable you specify:

export OS_AUTH_TYPE=password
export OS_AUTH_URL=http://keystone.example.com:5000/
export OS_USERNAME=myuser
export OS_PASSWORD=mypassword
export OS_PROJECT_NAME=myproject
export OS_DEFAULT_DOMAIN_NAME=mydomain

Specifying operations via CLI parameter will override the environment parameter. These are specified with the pattern --os- and the parameter name. Using the password example again:

openstack --os-auth-type password \
          --os-auth-url http://keystone.example.com:5000/ \
          --os-username myuser \
          --os-password mypassword \
          --os-project-name myproject \
          --os-default-domain-name mydomain \
          operation

Additional loaders¶

The configuration and CLI loaders are quite commonly used however similar concepts are found in other situations such as os-client-config in which you specify authentication and other cloud parameters in a clouds.yaml file.

Loaders such as these use the same plugin options listed below, but via their own mechanism. In os-client-config the password plugin looks like:

clouds:
  mycloud:
    auth_type: password
    auth:
      auth_url: http://keystone.example.com:5000/
      auth_type: password
      username: myuser
      password: mypassword
      project_name: myproject
      default_domain_name: mydomain

However different services may implement loaders in their own way and you should consult their relevant documentation. The same auth options will be available.

Available Plugins¶

This is a listing of all included plugins and the options that they accept. Plugins are listed alphabetically and not in any order of priority.

admin_token¶

Use an existing token and a known endpoint to perform requests.

This plugin is primarily useful for development or for use with identity service ADMIN tokens. Because this token is used directly there is no fetching a service catalog or determining scope information and so it cannot be used by clients that expect use this scope information.

Because there is no service catalog the endpoint that is supplied with initialization is used for all operations performed with this plugin so must be the full base URL to an actual service.

endpoint:: The endpoint that will always be used
token:: The token that will always be used

http_basic¶

Use HTTP Basic authentication to perform requests.

This can be used to instantiate clients for services deployed in standalone mode.

There is no fetching a service catalog or determining scope information and so it cannot be used by clients that expect to use this scope information.

username:: Username
password:: User’s password
endpoint:: The endpoint that will always be used

none¶

Use no tokens to perform requests.

This can be used to instantiate clients for services deployed in noauth/standalone mode.

There is no fetching a service catalog or determining scope information and so it cannot be used by clients that expect to use this scope information.

endpoint:: The endpoint that will always be used

password¶

Authenticate via a username and password.

Authenticate to the identity service using an inbuilt username and password. This is the standard and most common form of authentication.

As a generic plugin this plugin is identity version independent and will discover available versions before use. This means it expects to be providen an unversioned URL to operate against.

auth-url:: Authentication URL
system-scope:: Scope for system operations
domain-id:: Domain ID to scope to
domain-name:: Domain name to scope to
project-id:: Project ID to scope to
project-name:: Project name to scope to
project-domain-id:: Domain ID containing project
project-domain-name:: Domain name containing project
trust-id:: ID of the trust to use as a trustee use
default-domain-id:: Optional domain ID to use with v3 and v2 parameters. It will be used for both the user and project domain in v3 and ignored in v2 authentication.
default-domain-name:: Optional domain name to use with v3 API and v2 parameters. It will be used for both the user and project domain in v3 and ignored in v2 authentication.
user-id:: User id
username:: Username
user-domain-id:: User’s domain id
user-domain-name:: User’s domain name
password:: User’s password

token¶

Given an existing token rescope it to another target.

This plugin uses the Identity service’s rescope mechanism to get a new token based upon an existing token. Because an auth plugin requires a service catalog and scope information it is often easier to fetch a new token based on an existing one than validate and reuse the one you already have.

As a generic plugin this plugin is identity version independent and will discover available versions before use. This means it expects to be providen an unversioned URL to operate against.

auth-url:: Authentication URL
system-scope:: Scope for system operations
domain-id:: Domain ID to scope to
domain-name:: Domain name to scope to
project-id:: Project ID to scope to
project-name:: Project name to scope to
project-domain-id:: Domain ID containing project
project-domain-name:: Domain name containing project
trust-id:: ID of the trust to use as a trustee use
default-domain-id:: Optional domain ID to use with v3 and v2 parameters. It will be used for both the user and project domain in v3 and ignored in v2 authentication.
default-domain-name:: Optional domain name to use with v3 API and v2 parameters. It will be used for both the user and project domain in v3 and ignored in v2 authentication.
token:: Token to authenticate with

v2password¶

auth-url:: Authentication URL
tenant-id:: Tenant ID
tenant-name:: Tenant Name
trust-id:: ID of the trust to use as a trustee use
username:: Username to login with
user-id:: User ID to login with
password:: Password to use

v2token¶

auth-url:: Authentication URL
tenant-id:: Tenant ID
tenant-name:: Tenant Name
trust-id:: ID of the trust to use as a trustee use
token:: Token

v3adfspassword¶

auth-url:: Authentication URL
system-scope:: Scope for system operations
domain-id:: Domain ID to scope to
domain-name:: Domain name to scope to
project-id:: Project ID to scope to
project-name:: Project name to scope to
project-domain-id:: Domain ID containing project
project-domain-name:: Domain name containing project
trust-id:: ID of the trust to use as a trustee use
identity-provider:: Identity Provider’s name
protocol:: Protocol for federated plugin
identity-provider-url:: An Identity Provider URL, where the SAML authentication request will be sent.
service-provider-endpoint:: Service Provider’s Endpoint
service-provider-entity-id:: Service Provider’s SAML Entity ID
username:: Username
password:: Password

v3applicationcredential¶

auth-url:: Authentication URL
system-scope:: Scope for system operations
domain-id:: Domain ID to scope to
domain-name:: Domain name to scope to
project-id:: Project ID to scope to
project-name:: Project name to scope to
project-domain-id:: Domain ID containing project
project-domain-name:: Domain name containing project
trust-id:: ID of the trust to use as a trustee use
user-id:: User ID
username:: Username
user-domain-id:: User’s domain id
user-domain-name:: User’s domain name
application_credential_secret:: Application credential auth secret
application_credential_id:: Application credential ID
application_credential_name:: Application credential name

v3fedkerb¶

auth-url:: Authentication URL
system-scope:: Scope for system operations
domain-id:: Domain ID to scope to
domain-name:: Domain name to scope to
project-id:: Project ID to scope to
project-name:: Project name to scope to
project-domain-id:: Domain ID containing project
project-domain-name:: Domain name containing project
trust-id:: ID of the trust to use as a trustee use
identity-provider:: Identity Provider’s name
protocol:: Protocol for federated plugin
mutual-auth:: Configures Kerberos Mutual Authentication

v3kerberos¶

auth-url:: Authentication URL
system-scope:: Scope for system operations
domain-id:: Domain ID to scope to
domain-name:: Domain name to scope to
project-id:: Project ID to scope to
project-name:: Project name to scope to
project-domain-id:: Domain ID containing project
project-domain-name:: Domain name containing project
trust-id:: ID of the trust to use as a trustee use
mutual-auth:: Configures Kerberos Mutual Authentication

v3multifactor¶

auth-url:: Authentication URL
system-scope:: Scope for system operations
domain-id:: Domain ID to scope to
domain-name:: Domain name to scope to
project-id:: Project ID to scope to
project-name:: Project name to scope to
project-domain-id:: Domain ID containing project
project-domain-name:: Domain name containing project
trust-id:: ID of the trust to use as a trustee use
auth_methods:: Methods to authenticate with.

v3oauth1¶

auth-url:: Authentication URL
consumer-key:: OAuth Consumer ID/Key
consumer-secret:: OAuth Consumer Secret
access-key:: OAuth Access Key
access-secret:: OAuth Access Secret

v3oauth2clientcredential¶

auth-url:: Authentication URL
system-scope:: Scope for system operations
domain-id:: Domain ID to scope to
domain-name:: Domain name to scope to
project-id:: Project ID to scope to
project-name:: Project name to scope to
project-domain-id:: Domain ID containing project
project-domain-name:: Domain name containing project
trust-id:: ID of the trust to use as a trustee use
oauth2_endpoint:: Endpoint for OAuth2.0
oauth2_client_id:: Client id for OAuth2.0
oauth2_client_secret:: Client secret for OAuth2.0

v3oauth2mtlsclientcredential¶

auth-url:: Authentication URL
system-scope:: Scope for system operations
domain-id:: Domain ID to scope to
domain-name:: Domain name to scope to
project-id:: Project ID to scope to
project-name:: Project name to scope to
project-domain-id:: Domain ID containing project
project-domain-name:: Domain name containing project
trust-id:: ID of the trust to use as a trustee use
oauth2-endpoint:: Endpoint for OAuth2.0 Mutual-TLS Authorization
oauth2-client-id:: Client credential ID for OAuth2.0 Mutual-TLS Authorization

v3oidcaccesstoken¶

auth-url:: Authentication URL
system-scope:: Scope for system operations
domain-id:: Domain ID to scope to
domain-name:: Domain name to scope to
project-id:: Project ID to scope to
project-name:: Project name to scope to
project-domain-id:: Domain ID containing project
project-domain-name:: Domain name containing project
trust-id:: ID of the trust to use as a trustee use
identity-provider:: Identity Provider’s name
protocol:: Protocol for federated plugin
access-token:: OAuth 2.0 Access Token

v3oidcauthcode¶

auth-url:: Authentication URL
system-scope:: Scope for system operations
domain-id:: Domain ID to scope to
domain-name:: Domain name to scope to
project-id:: Project ID to scope to
project-name:: Project name to scope to
project-domain-id:: Domain ID containing project
project-domain-name:: Domain name containing project
trust-id:: ID of the trust to use as a trustee use
identity-provider:: Identity Provider’s name
protocol:: Protocol for federated plugin
client-id:: OAuth 2.0 Client ID
client-secret:: OAuth 2.0 Client Secret
openid-scope:: OpenID Connect scope that is requested from authorization server. Note that the OpenID Connect specification states that “openid” must be always specified.
access-token-endpoint:: OpenID Connect Provider Token Endpoint. Note that if a discovery document is being passed this option will override the endpoint provided by the server in the discovery document.
discovery-endpoint:: OpenID Connect Discovery Document URL. The discovery document will be used to obtain the values of the access token endpoint and the authentication endpoint. This URL should look like https://idp.example.org/.well-known/openid-configuration
access-token-type:: OAuth 2.0 Authorization Server Introspection token type, it is used to decide which type of token will be used when processing token introspection. Valid values are: “access_token” or “id_token”
redirect-uri:: OpenID Connect Redirect URL
code:: OAuth 2.0 Authorization Code

v3oidcclientcredentials¶

auth-url:: Authentication URL
system-scope:: Scope for system operations
domain-id:: Domain ID to scope to
domain-name:: Domain name to scope to
project-id:: Project ID to scope to
project-name:: Project name to scope to
project-domain-id:: Domain ID containing project
project-domain-name:: Domain name containing project
trust-id:: ID of the trust to use as a trustee use
identity-provider:: Identity Provider’s name
protocol:: Protocol for federated plugin
client-id:: OAuth 2.0 Client ID
client-secret:: OAuth 2.0 Client Secret
openid-scope:: OpenID Connect scope that is requested from authorization server. Note that the OpenID Connect specification states that “openid” must be always specified.
access-token-endpoint:: OpenID Connect Provider Token Endpoint. Note that if a discovery document is being passed this option will override the endpoint provided by the server in the discovery document.
discovery-endpoint:: OpenID Connect Discovery Document URL. The discovery document will be used to obtain the values of the access token endpoint and the authentication endpoint. This URL should look like https://idp.example.org/.well-known/openid-configuration
access-token-type:: OAuth 2.0 Authorization Server Introspection token type, it is used to decide which type of token will be used when processing token introspection. Valid values are: “access_token” or “id_token”

v3oidcdeviceauthz¶

auth-url:: Authentication URL
system-scope:: Scope for system operations
domain-id:: Domain ID to scope to
domain-name:: Domain name to scope to
project-id:: Project ID to scope to
project-name:: Project name to scope to
project-domain-id:: Domain ID containing project
project-domain-name:: Domain name containing project
trust-id:: ID of the trust to use as a trustee use
identity-provider:: Identity Provider’s name
protocol:: Protocol for federated plugin
client-id:: OAuth 2.0 Client ID
client-secret:: OAuth 2.0 Client Secret
openid-scope:: OpenID Connect scope that is requested from authorization server. Note that the OpenID Connect specification states that “openid” must be always specified.
access-token-endpoint:: OpenID Connect Provider Token Endpoint. Note that if a discovery document is being passed this option will override the endpoint provided by the server in the discovery document.
discovery-endpoint:: OpenID Connect Discovery Document URL. The discovery document will be used to obtain the values of the access token endpoint and the authentication endpoint. This URL should look like https://idp.example.org/.well-known/openid-configuration
device-authorization-endpoint:: OAuth 2.0 Device Authorization Endpoint. Note that if a discovery document is being passed this option will override the endpoint provided by the server in the discovery document.
code-challenge-method:: PKCE Challenge Method (RFC 7636)

v3oidcpassword¶

auth-url:: Authentication URL
system-scope:: Scope for system operations
domain-id:: Domain ID to scope to
domain-name:: Domain name to scope to
project-id:: Project ID to scope to
project-name:: Project name to scope to
project-domain-id:: Domain ID containing project
project-domain-name:: Domain name containing project
trust-id:: ID of the trust to use as a trustee use
identity-provider:: Identity Provider’s name
protocol:: Protocol for federated plugin
client-id:: OAuth 2.0 Client ID
client-secret:: OAuth 2.0 Client Secret
openid-scope:: OpenID Connect scope that is requested from authorization server. Note that the OpenID Connect specification states that “openid” must be always specified.
access-token-endpoint:: OpenID Connect Provider Token Endpoint. Note that if a discovery document is being passed this option will override the endpoint provided by the server in the discovery document.
discovery-endpoint:: OpenID Connect Discovery Document URL. The discovery document will be used to obtain the values of the access token endpoint and the authentication endpoint. This URL should look like https://idp.example.org/.well-known/openid-configuration
access-token-type:: OAuth 2.0 Authorization Server Introspection token type, it is used to decide which type of token will be used when processing token introspection. Valid values are: “access_token” or “id_token”
username:: Username
password:: Password
idp_otp_key:: A key to be used in the Identity Provider access token endpoint to pass the OTP value. E.g. totp

v3password¶

auth-url:: Authentication URL
system-scope:: Scope for system operations
domain-id:: Domain ID to scope to
domain-name:: Domain name to scope to
project-id:: Project ID to scope to
project-name:: Project name to scope to
project-domain-id:: Domain ID containing project
project-domain-name:: Domain name containing project
trust-id:: ID of the trust to use as a trustee use
user-id:: User ID
username:: Username
user-domain-id:: User’s domain id
user-domain-name:: User’s domain name
password:: User’s password

v3samlpassword¶

auth-url:: Authentication URL
system-scope:: Scope for system operations
domain-id:: Domain ID to scope to
domain-name:: Domain name to scope to
project-id:: Project ID to scope to
project-name:: Project name to scope to
project-domain-id:: Domain ID containing project
project-domain-name:: Domain name containing project
trust-id:: ID of the trust to use as a trustee use
identity-provider:: Identity Provider’s name
protocol:: Protocol for federated plugin
identity-provider-url:: An Identity Provider URL, where the SAML2 authentication request will be sent.
username:: Username
password:: Password

v3token¶

auth-url:: Authentication URL
system-scope:: Scope for system operations
domain-id:: Domain ID to scope to
domain-name:: Domain name to scope to
project-id:: Project ID to scope to
project-name:: Project name to scope to
project-domain-id:: Domain ID containing project
project-domain-name:: Domain name containing project
trust-id:: ID of the trust to use as a trustee use
token:: Token to authenticate with

v3tokenlessauth¶

auth-url:: Authentication URL
domain-id:: Domain ID to scope to
domain-name:: Domain name to scope to
project-id:: Project ID to scope to
project-name:: Project name to scope to
project-domain-id:: Domain ID containing project
project-domain-name:: Domain name containing project

v3totp¶

auth-url:: Authentication URL
system-scope:: Scope for system operations
domain-id:: Domain ID to scope to
domain-name:: Domain name to scope to
project-id:: Project ID to scope to
project-name:: Project name to scope to
project-domain-id:: Domain ID containing project
project-domain-name:: Domain name containing project
trust-id:: ID of the trust to use as a trustee use
user-id:: User ID
username:: Username
user-domain-id:: User’s domain id
user-domain-name:: User’s domain name
passcode:: User’s TOTP passcode

Plugin Options