Bases: dict
Encapsulates a raw authentication token from keystone.
Provides helper methods for extracting useful values from that token.
Return the audit chain ID if present.
In the event that a token was rescoped then this ID will be the audit_id of the initial token. Returns None if no value present.
Returns: | str or None. |
---|
Return the audit ID if present.
Returns: | str or None. |
---|
Return the token_id associated with the auth request.
To be used in headers for authenticating OpenStack API requests.
Returns: | str |
---|
Return a tuple of identity URLs.
The identity URLs are from publicURL and adminURL for the service ‘identity’ from the service catalog associated with the authorization request. If the authentication request wasn’t scoped to a tenant (project), this property will return None.
DEPRECATED: this doesn’t correctly handle region name. You should fetch it from the service catalog yourself. This may be removed in the 2.0.0 release.
Returns: | tuple of urls |
---|
Return the domain id associated with the auth request.
Returns: | str or None (if no domain associated with the token) |
---|
Return the domain name associated with the auth request.
Returns: | str or None (if no domain associated with the token) |
---|
Return true if the auth token was scoped to a domain.
Returns: | bool |
---|
Return the token expiration (as datetime object).
Returns: | datetime |
---|
Factory function to create a new AccessInfo object.
Create AccessInfo object given a successful auth response & body or a user-provided dict.
Warning
Use of the region_name argument is deprecated as of the 1.7.0 release and may be removed in the 2.0.0 release.
Return true if the authorization token has a service catalog.
Returns: | boolean |
---|
The audit ID of the initially requested token.
This is the audit_chain_id if present or the audit_id.
Return true if federation was used to get the token.
Returns: | boolean |
---|
Determine if processing valid v2 or v3 token.
Validates from the auth body or a user-provided dict.
Returns: | true if auth body matches implementing class |
---|---|
Return type: | boolean |
Return the token issue time (as datetime object).
Returns: | datetime |
---|
Return the first adminURL of the identity endpoint.
The identity endpoint is from the service catalog associated with the authorization request, or None if the authentication request wasn’t scoped to a tenant (project).
DEPRECATED: this doesn’t correctly handle region name. You should fetch it from the service catalog yourself. This may be removed in the 2.0.0 release.
Returns: | tuple of urls |
---|
Return the access token ID if OAuth authentication used.
Returns: | str or None. |
---|
Return the consumer ID if OAuth authentication used.
Returns: | str or None. |
---|
Return the project’s domain id associated with the auth request.
For v2, it returns ‘default’ if a project is scoped or None which may be different from the keystone configuration.
Returns: | str |
---|
Return the project’s domain name associated with the auth request.
For v2, it returns ‘Default’ if a project is scoped or None which may be different from the keystone configuration.
Returns: | str |
---|
Return the project ID associated with the auth request.
This returns None if the auth token wasn’t scoped to a project.
Returns: | str or None (if no project associated with the token) |
---|
Return the project name associated with the auth request.
Returns: | str or None (if no project associated with the token) |
---|
Return true if the auth token was scoped to a tenant(project).
Returns: | bool |
---|
Return a list of user’s role ids associated with the auth request.
Returns: | a list of strings of role ids |
---|
Return a list of user’s role names associated with the auth request.
Returns: | a list of strings of role names |
---|
Return true if the auth token was scoped.
Return true if scoped to a tenant(project) or domain, and contains a populated service catalog.
Warning
This is deprecated as of the 1.7.0 release in favor of project_scoped and may be removed in the 2.0.0 release.
Returns: | bool |
---|
Synonym for project_id.
Synonym for project_name.
Return the trust id associated with the auth request.
Returns: | str or None (if no trust associated with the token) |
---|
Return true if the auth token was scoped from a delegated trust.
The trust delegation is via the OS-TRUST v3 extension.
Returns: | bool |
---|
Return the trustee user id associated with a trust.
Returns: | str or None (if no trust associated with the token) |
---|
Return the trustor user id associated with a trust.
Returns: | str or None (if no trust associated with the token) |
---|
Return the user’s domain id associated with the auth request.
For v2, it always returns ‘default’ which may be different from the Keystone configuration.
Returns: | str |
---|
Return the user’s domain name associated with the auth request.
For v2, it always returns ‘Default’ which may be different from the Keystone configuration.
Returns: | str |
---|
Return the user id associated with the auth request.
Returns: | str |
---|
Return the username associated with the auth request.
Follows the pattern defined in the V2 API of first looking for ‘name’, returning that if available, and falling back to ‘username’ if name is unavailable.
Returns: | str |
---|
Return the version of the auth token from identity service.
Returns: | str |
---|
Determine if expiration is about to occur.
Returns: | true if expiration is within the given duration |
---|---|
Return type: | boolean |
Bases: keystoneclient.access.AccessInfo
An object for encapsulating raw v2 auth token from identity service.
Deprecated as of the 1.7.0 release.
Use service_catalog.get_urls() instead. It may be removed in the 2.0.0 release.
Deprecated as of the 1.7.0 release.
Use service_catalog.get_urls() instead. It may be removed in the 2.0.0 release.
Deprecated as of the 1.7.0 release.
Use project_scoped instead. It may be removed in the 2.0.0 release.
Bases: keystoneclient.access.AccessInfo
An object encapsulating raw v3 auth token from identity service.
Deprecated as of the 1.7.0 release.
Use service_catalog.get_urls() instead. It may be removed in the 2.0.0 release.
Deprecated as of the 1.7.0 release.
Use service_catalog.get_urls() instead. It may be removed in the 2.0.0 release.
Deprecated as of the 1.7.0 release.
Use project_scoped instead. It may be removed in the 2.0.0 release.
Bases: object
An instance of a session with local variables.
A session is a global object that is shared around amongst many clients. It therefore contains state that is relevant to everyone. There is a lot of state such as the service type and region_name that are only relevant to a particular client that is using the session. An adapter provides a wrapper of client local data around the global session object.
Parameters: |
|
---|
Get an endpoint as provided by the auth plugin.
Parameters: | auth (keystoneclient.auth.base.BaseAuthPlugin) – The auth plugin to use for token. Overrides the plugin on the session. (optional) |
---|---|
Raises keystoneclient.exceptions.MissingAuthPlugin: | |
if a plugin is not available. | |
Returns: | An endpoint if available or None. |
Return type: | string |
Return the authenticated project_id as provided by the auth plugin.
Parameters: | auth (keystoneclient.auth.base.BaseAuthPlugin) – The auth plugin to use for token. Overrides the plugin on the session. (optional) |
---|---|
Raises: |
|
Returns: | Current project_id or None if not supported by plugin. |
Return type: | string |
Return a token as provided by the auth plugin.
Parameters: | auth (keystoneclient.auth.base.BaseAuthPlugin) – The auth plugin to use for token. Overrides the plugin on the session. (optional) |
---|---|
Raises keystoneclient.exceptions.AuthorizationFailure: | |
if a new token fetch fails. | |
Returns: | A valid token. |
Return type: | string |
Return the authenticated user_id as provided by the auth plugin.
Parameters: | auth (keystoneclient.auth.base.BaseAuthPlugin) – The auth plugin to use for token. Overrides the plugin on the session. (optional) |
---|---|
Raises: |
|
Returns: | Current user_id or None if not supported by plugin. |
Return type: | string |
Invalidate an authentication plugin.
Bases: keystoneclient.adapter.Adapter
Make something that looks like an old HTTPClient.
A common case when using an adapter is that we want an interface similar to the HTTPClients of old which returned the body as JSON as well.
You probably don’t want this if you are starting from scratch.
Base utilities to build API operation managers and objects on top of.
Bases: keystoneclient.base.Manager
Base manager class for manipulating Keystone entities.
Children of this class are expected to define a collection_key and key.
Build a query that does not include values, just keys.
The Identity API has some calls that define queries without values, this can not be accomplished by using urllib.parse.urlencode(). This method builds a query using only the keys.
Build a resource URL for the given kwargs.
Given an example collection where collection_key = ‘entities’ and key = ‘entity’, the following URL’s could be generated.
By default, the URL will represent a collection of entities, e.g.:
/entities
If kwargs contains an entity_id, then the URL will represent a specific member, e.g.:
/entities/{entity_id}
If a base_url is provided, the generated URL will be appended to it.
If a ‘tail’ is provided, it will be appended to the end of the URL.
Find a single item with attributes matching **kwargs.
Bases: object
Basic manager type providing common operations.
Managers interact with a particular type of API (servers, flavors, images, etc.) and provide CRUD operations for them.
Parameters: | client – instance of BaseClient descendant for HTTP requests |
---|
The client.
Warning
This property is deprecated as of the 1.7.0 release in favor of client() and may be removed in the 2.0.0 release.
Bases: keystoneclient.base.Manager
Manager with additional find()/findall() methods.
Find a single item with attributes matching **kwargs.
This isn’t very efficient: it loads the entire list then filters on the Python side.
Find all items with attributes matching **kwargs.
This isn’t very efficient: it loads the entire list then filters on the Python side.
Bases: object
Base class for OpenStack resources (tenant, user, etc.).
This is pretty much just a bag for attributes.
Support for lazy loading details.
Some clients, such as novaclient have the option to lazy load the details, details which can be loaded with this function.
Human-readable ID which can be used for bash completion.
Remove any entries from a dictionary where the value is None.
Return id if argument is a Resource.
Abstracts the common pattern of allowing both an object or an object’s ID (UUID) as a parameter when dealing with relationships.
Factory function to create a new identity service client.
The returned client will be either a V3 or V2 client. Check the version using the version property or the instance’s class (with instanceof).
Parameters: |
|
---|---|
Returns: | New keystone client object. |
Return type: | keystoneclient.v3.client.Client or keystoneclient.v2_0.client.Client |
Raises: |
|
Deprecated alias for httpclient.HTTPClient.
This class is deprecated as of the 1.7.0 release in favor of keystoneclient.httpclient.HTTPClient and may be removed in the 2.0.0 release.
Bases: keystoneclient._discover.Discover
A means to discover and create clients.
Clients are created depending on the supported API versions on the server.
Querying the server is done on object creation and every subsequent method operates upon the data that was retrieved.
The connection parameters associated with this method are the same format and name as those used by a client (see keystoneclient.v2_0.client.Client and keystoneclient.v3.client.Client). If not overridden in subsequent methods they will also be what is passed to the constructed client.
In the event that auth_url and endpoint is provided then auth_url will be used in accordance with how the client operates.
Warning
Creating an instance of this class without using the session argument is deprecated as of the 1.7.0 release and may be removed in the 2.0.0 release.
Parameters: |
|
---|
Return a list of identity APIs available on the server.
The list returned includes the data associated with them.
Warning
This method is deprecated as of the 1.7.0 release in favor of raw_version_data() and may be removed in the 2.0.0 release.
Parameters: |
|
---|---|
Returns: | A List of dictionaries as presented by the server. Each dict will contain the version and the URL to use for the version. It is a direct representation of the layout presented by the identity API. |
Factory function to create a new identity service client.
Parameters: |
|
---|---|
Returns: | An instantiated identity client object. |
Raises: |
|
Get raw version information from URL.
Raw data indicates that only minimal validation processing is performed on the data, so what is returned here will be the data in the same format it was received from the endpoint.
Parameters: |
|
---|---|
Returns: | The endpoints returned from the server that match the criteria. |
Return type: | list |
Example:
>>> from keystoneclient import discover
>>> disc = discover.Discovery(auth_url='http://localhost:5000')
>>> disc.raw_version_data()
[{'id': 'v3.0',
'links': [{'href': u'http://127.0.0.1:5000/v3/',
'rel': u'self'}],
'media-types': [
{'base': 'application/json',
'type': 'application/vnd.openstack.identity-v3+json'},
{'base': 'application/xml',
'type': 'application/vnd.openstack.identity-v3+xml'}],
'status': 'stable',
'updated': '2013-03-06T00:00:00Z'},
{'id': 'v2.0',
'links': [{'href': u'http://127.0.0.1:5000/v2.0/',
'rel': u'self'},
{'href': u'...',
'rel': u'describedby',
'type': u'application/pdf'}],
'media-types': [
{'base': 'application/json',
'type': 'application/vnd.openstack.identity-v2.0+json'},
{'base': 'application/xml',
'type': 'application/vnd.openstack.identity-v2.0+xml'}],
'status': 'stable',
'updated': '2013-03-06T00:00:00Z'}]
Add a version removal rule for a particular service.
Originally deployments of OpenStack would contain a versioned endpoint in the catalog for different services. E.g. an identity service might look like http://localhost:5000/v2.0. This is a problem when we want to use a different version like v3.0 as there is no way to tell where it is located. We cannot simply change all service catalogs either so there must be a way to handle the older style of catalog.
This function adds a rule for a given service type that if part of the URL matches a given regular expression in old then it will be replaced with the new value. This will replace all instances of old with new. It should therefore contain a regex anchor.
For example the included rule states:
add_catalog_version_hack('identity', re.compile('/v2.0/?$'), '/')
so if the catalog retrieves an identity URL that ends with /v2.0 or /v2.0/ then it should replace it simply with / to fix the user’s catalog.
Parameters: |
|
---|
Retrieve raw version data from a url.
Turn a version representation into a tuple.
Takes a string, tuple or float which represent version formats we can handle and converts them into a (major, minor) version tuple that we can actually use for discovery.
Parameters: | version – Inputted version number to try and convert. |
---|---|
Returns: | A usable version tuple |
Return type: | tuple |
Raises TypeError: | |
if the inputted version cannot be converted to tuple. |
Test that an available version satisfies the required version.
To be suitable a version must be of the same major version as required and be at least a match in minor/patch level.
eg. 3.3 is a match for a required 3.1 but 4.1 is not.
Parameters: | |
---|---|
Returns: | True if candidate is suitable False otherwise. |
Return type: | bool |
Exception definitions.
Bases: keystoneauth1.exceptions.catalog.CatalogException
Found more than one matching endpoint in Service Catalog.
Bases: keystoneauth1.exceptions.auth.AuthorizationFailure
Auth plugin misses some options.
Bases: keystoneauth1.exceptions.auth.AuthorizationFailure
User has specified an AuthSystem that is not installed.
Bases: keystoneauth1.exceptions.base.ClientException
Cannot authorize API client.
An alias of keystoneauth1.exceptions.auth.AuthorizationFailure
Bases: keystoneauth1.exceptions.http.HttpServerError
HTTP 502 - Bad Gateway.
The server was acting as a gateway or proxy and received an invalid response from the upstream server. An alias of keystoneauth1.exceptions.http.BadGateway
Bases: keystoneauth1.exceptions.http.HTTPClientError
HTTP 400 - Bad Request.
The request cannot be fulfilled due to bad syntax. An alias of keystoneauth1.exceptions.http.BadRequest
Bases: exceptions.Exception
Error reading the certificate.
Bases: exceptions.Exception
Error reading the certificate.
Bases: exceptions.Exception
The base exception class for all exceptions this library raises.
An alias of keystoneauth1.exceptions.base.ClientException
Bases: keystoneauth1.exceptions.base.ClientException
Error in CLI tool.
Bases: keystoneauth1.exceptions.http.HTTPClientError
HTTP 409 - Conflict.
Indicates that the request could not be processed because of conflict in the request, such as an edit conflict. An alias of keystoneauth1.exceptions.http.Conflict
Bases: keystoneauth1.exceptions.base.ClientException
Cannot connect to API service.
An alias of keystoneauth1.exceptions.connection.ConnectionError
Connection refused while trying to connect to API service.
An alias of keystoneauth1.exceptions.connection.ConnectFailure
alias of ConnectFailure
Bases: keystoneauth1.exceptions.base.ClientException
Discovery of client versions failed.
An alias of keystoneauth1.exceptions.discovery.DiscoveryFailure
Bases: keystoneauth1.exceptions.catalog.EndpointNotFound
The service catalog is empty.
An alias of keystoneauth1.exceptions.catalog.EmptyCatalog
Something is rotten in Service Catalog.
An alias of keystoneauth1.exceptions.catalog.CatalogException
alias of CatalogException
Bases: keystoneauth1.exceptions.catalog.CatalogException
Could not find requested endpoint in Service Catalog.
An alias of keystoneauth1.exceptions.catalog.EndpointNotFound
Bases: keystoneauth1.exceptions.http.HTTPClientError
HTTP 417 - Expectation Failed.
The server cannot meet the requirements of the Expect request-header field. An alias of keystoneauth1.exceptions.http.ExpectationFailed
Bases: keystoneauth1.exceptions.http.HTTPClientError
HTTP 403 - Forbidden.
The request was a valid request, but the server is refusing to respond to it. An alias of keystoneauth1.exceptions.http.Forbidden
Bases: keystoneauth1.exceptions.http.HttpServerError
HTTP 504 - Gateway Timeout.
The server was acting as a gateway or proxy and did not receive a timely response from the upstream server. An alias of keystoneauth1.exceptions.http.GatewayTimeout
Bases: keystoneauth1.exceptions.http.HTTPClientError
HTTP 410 - Gone.
Indicates that the resource requested is no longer available and will not be available again. An alias of keystoneauth1.exceptions.http.Gone
Bases: keystoneauth1.exceptions.http.HttpError
Client-side HTTP error.
Exception for cases in which the client seems to have erred. An alias of keystoneauth1.exceptions.http.HTTPClientError
Bases: keystoneauth1.exceptions.http.HttpError
HTTP Redirection.
Bases: keystoneauth1.exceptions.base.ClientException
The base exception class for all HTTP exceptions.
An alias of keystoneauth1.exceptions.http.HttpError
Bases: keystoneauth1.exceptions.http.HttpServerError
HTTP 501 - Not Implemented.
The server either does not recognize the request method, or it lacks the ability to fulfill the request. An alias of keystoneauth1.exceptions.http.HttpNotImplemented
Bases: keystoneauth1.exceptions.http.HttpError
Server-side HTTP error.
Exception for cases in which the server is aware that it has erred or is incapable of performing the request. An alias of keystoneauth1.exceptions.http.HttpServerError
Bases: keystoneauth1.exceptions.http.HttpServerError
HTTP 505 - HttpVersion Not Supported.
The server does not support the HTTP protocol version used in the request. An alias of keystoneauth1.exceptions.http.HttpVersionNotSupported
Bases: keystoneauth1.exceptions.http.HttpServerError
HTTP 500 - Internal Server Error.
A generic error message, given when no more specific message is suitable. An alias of keystoneauth1.exceptions.http.InternalServerError
Bases: keystoneauth1.exceptions.base.ClientException
The response from the server is not valid for this request.
Bases: keystoneauth1.exceptions.http.HTTPClientError
HTTP 411 - Length Required.
The request did not specify the length of its content, which is required by the requested resource. An alias of keystoneauth1.exceptions.http.LengthRequired
Bases: keystoneauth1.exceptions.http.HTTPClientError
HTTP 405 - Method Not Allowed.
A request was made of a resource using a request method not supported by that resource. An alias of keystoneauth1.exceptions.http.MethodNotAllowed
Bases: keystoneauth1.exceptions.base.ClientException
Method not implemented by the keystoneclient API.
Bases: keystoneauth1.exceptions.auth_plugins.AuthPluginException
An authenticated request is required but no plugin available.
An alias of keystoneauth1.exceptions.auth_plugins.MissingAuthPlugin
Bases: keystoneclient.exceptions.HTTPRedirection
HTTP 300 - Multiple Choices.
Indicates multiple options for the resource that the client may follow.
Bases: keystoneauth1.exceptions.auth_plugins.AuthPluginException
There were no auth plugins that could be created from the parameters provided.
An alias of keystoneauth1.exceptions.auth_plugins.NoMatchingPlugin
Bases: keystoneauth1.exceptions.base.ClientException
Multiple entities found instead of one.
Bases: keystoneauth1.exceptions.http.HTTPClientError
HTTP 406 - Not Acceptable.
The requested resource is only capable of generating content not acceptable according to the Accept headers sent in the request. An alias of keystoneauth1.exceptions.http.NotAcceptable
Bases: keystoneauth1.exceptions.http.HTTPClientError
HTTP 404 - Not Found.
The requested resource could not be found but may be available again in the future. An alias of keystoneauth1.exceptions.http.NotFound
Bases: keystoneauth1.exceptions.http.HTTPClientError
HTTP 402 - Payment Required.
Reserved for future use. An alias of keystoneauth1.exceptions.http.PaymentRequired
Bases: keystoneauth1.exceptions.http.HTTPClientError
HTTP 412 - Precondition Failed.
The server does not meet one of the preconditions that the requester put on the request. An alias of keystoneauth1.exceptions.http.PreconditionFailed
Bases: keystoneauth1.exceptions.http.HTTPClientError
HTTP 407 - Proxy Authentication Required.
The client must first authenticate itself with the proxy. An alias of keystoneauth1.exceptions.http.ProxyAuthenticationRequired
Bases: keystoneauth1.exceptions.http.HTTPClientError
HTTP 413 - Request Entity Too Large.
The request is larger than the server is willing or able to process. An alias of keystoneauth1.exceptions.http.RequestEntityTooLarge
Bases: keystoneauth1.exceptions.http.HTTPClientError
HTTP 408 - Request Timeout.
The server timed out waiting for the request. An alias of keystoneauth1.exceptions.http.RequestTimeout
Bases: keystoneauth1.exceptions.http.HTTPClientError
HTTP 414 - Request-URI Too Long.
The URI provided was too long for the server to process. An alias of keystoneauth1.exceptions.http.RequestUriTooLong
Bases: keystoneauth1.exceptions.http.HTTPClientError
HTTP 416 - Requested Range Not Satisfiable.
The client has asked for a portion of the file, but the server cannot supply that portion. An alias of keystoneauth1.exceptions.http.RequestedRangeNotSatisfiable
Bases: keystoneauth1.exceptions.connection.ConnectionError
An SSL error occurred.
An alias of keystoneauth1.exceptions.connection.SSLError
Bases: keystoneauth1.exceptions.http.HttpServerError
HTTP 503 - Service Unavailable.
The server is currently unavailable. An alias of keystoneauth1.exceptions.http.ServiceUnavailable
Bases: keystoneauth1.exceptions.http.HTTPClientError
HTTP 401 - Unauthorized.
Similar to 403 Forbidden, but specifically for use when authentication is required and has failed or has not yet been provided. An alias of keystoneauth1.exceptions.http.Unauthorized
Bases: keystoneauth1.exceptions.http.HTTPClientError
HTTP 422 - Unprocessable Entity.
The request was well-formed but was unable to be followed due to semantic errors. An alias of keystoneauth1.exceptions.http.UnprocessableEntity
Bases: keystoneauth1.exceptions.http.HTTPClientError
HTTP 415 - Unsupported Media Type.
The request entity has a media type which the server or resource does not support. An alias of keystoneauth1.exceptions.http.UnsupportedMediaType
Bases: keystoneauth1.exceptions.base.ClientException
A parameter that was provided or returned is not supported.
Parameters: | names (list(str)) – Names of the unsupported parameters. |
---|
Names of the unsupported parameters.
Bases: keystoneauth1.exceptions.base.ClientException
User is trying to use an unsupported version of the API.
Bases: keystoneauth1.exceptions.base.ClientException
Error in validation on API client side.
Bases: keystoneauth1.exceptions.discovery.DiscoveryFailure
Discovery failed as the version you requested is not available.
An alias of keystoneauth1.exceptions.discovery.VersionNotAvailable
Return an instance of HttpError or subclass based on response.
An alias of keystoneauth1.exceptions.http.from_response()
OpenStack Client interface. Handles the REST calls and responses.
Bases: keystoneclient.baseclient.Client, keystoneclient.auth.base.BaseAuthPlugin
HTTP client.
Warning
Creating an instance of this class without using the session argument is deprecated as of the 1.7.0 release and may be removed in the 2.0.0 release.
Parameters: |
|
---|
Authenticate user.
Uses the data provided at instantiation to authenticate against the Identity server. This may use either a username and password or token for authentication. If a tenant name or id was provided then the resulting authenticated client will be scoped to that tenant and contain a service catalog of available endpoints.
With the v2.0 API, if a tenant name or ID is not provided, the authentication token returned will be ‘unscoped’ and limited in capabilities until a fully-scoped token is acquired.
With the v3 API, if a domain name or id was provided then the resulting authenticated client will be scoped to that domain. If a project name or ID is not provided, and the authenticating user has a default project configured, the authentication token returned will be ‘scoped’ to the default project. Otherwise, the authentication token returned will be ‘unscoped’ and limited in capabilities until a fully-scoped token is acquired.
With the v3 API, with the OS-TRUST extension enabled, the trust_id can be provided to allow project-specific role delegation between users
If successful, sets the self.auth_ref and self.auth_token with the returned token. If not already set, will also set self.management_url from the details provided in the token.
Returns: | True if authentication was successful. |
---|---|
Raises: |
|
If keyring is used, token is retrieved from keyring instead. Authentication will only be necessary if any of the following conditions are met:
Perform an authenticate DELETE request.
This calls request() with method set to DELETE and an authentication token if one is available.
Warning
DEPRECATED: This function is no longer used and is deprecated as of the 1.7.0 release and may be removed in the 2.0.0 release. It was designed to be used by the managers and the managers now receive an adapter so this function is no longer on the standard request path.
Perform an authenticated GET request.
This calls request() with method set to GET and an authentication token if one is available.
Warning
DEPRECATED: This function is no longer used and is deprecated as of the 1.7.0 release and may be removed in the 2.0.0 release. It was designed to be used by the managers and the managers now receive an adapter so this function is no longer on the standard request path.
Retrieve auth_ref from keyring.
If auth_ref is found in keyring, (keyring_key, auth_ref) is returned. Otherwise, (keyring_key, None) is returned.
Returns: | (keyring_key, auth_ref) or (keyring_key, None) |
---|---|
Returns: | or (None, None) if use_keyring is not set in the object |
Authenticate against the Identity API and get a token.
Not implemented here because auth protocols should be API version-specific.
Expected to authenticate or validate an existing authentication reference already associated with the client. Invoking this call always makes a call to the Identity service.
Returns: | (resp, body) |
---|
Return True if this client provides a service catalog.
Perform an authenticated HEAD request.
This calls request() with method set to HEAD and an authentication token if one is available.
Warning
DEPRECATED: This function is no longer used and is deprecated as of the 1.7.0 release and may be removed in the 2.0.0 release. It was designed to be used by the managers and the managers now receive an adapter so this function is no longer on the standard request path.
Perform an authenticate PATCH request.
This calls request() with method set to PATCH and an authentication token if one is available.
Warning
DEPRECATED: This function is no longer used and is deprecated as of the 1.7.0 release and may be removed in the 2.0.0 release. It was designed to be used by the managers and the managers now receive an adapter so this function is no longer on the standard request path.
Perform an authenticate POST request.
This calls request() with method set to POST and an authentication token if one is available.
Warning
DEPRECATED: This function is no longer used and is deprecated as of the 1.7.0 release and may be removed in the 2.0.0 release. It was designed to be used by the managers and the managers now receive an adapter so this function is no longer on the standard request path.
Extract and process information from the new auth_ref.
And set the relevant authentication information.
Perform an authenticate PUT request.
This calls request() with method set to PUT and an authentication token if one is available.
Warning
DEPRECATED: This function is no longer used and is deprecated as of the 1.7.0 release and may be removed in the 2.0.0 release. It was designed to be used by the managers and the managers now receive an adapter so this function is no longer on the standard request path.
Send an http request with the specified characteristics.
Wrapper around requests.request to handle tasks such as setting headers, JSON encoding/decoding, and error handling.
Warning
DEPRECATED: This function is no longer used. It was designed to be used only by the managers and the managers now receive an adapter so this function is no longer on the standard request path. This may be removed in the 2.0.0 release.
Return this client’s service catalog.
Store auth_ref into keyring.
Provide read-only backwards compatibility for tenant_id.
Warning
This is deprecated as of the 1.7.0 release in favor of project_id and may be removed in the 2.0.0 release.
Provide read-only backwards compatibility for tenant_name.
Warning
This is deprecated as of the 1.7.0 release in favor of project_name and may be removed in the 2.0.0 release.
Default user agent string.
This property is deprecated as of the 1.7.0 release in favor of keystoneclient.session.USER_AGENT and may be removed in the 2.0.0 release.
Make a request.
This function is deprecated as of the 1.7.0 release in favor of keystoneclient.session.request() and may be removed in the 2.0.0 release.
oslo.i18n integration module.
See http://docs.openstack.org/developer/oslo.i18n/usage.html .
Bases: object
Helper methods for dealing with a Keystone Service Catalog.
Warning
Setting region_name is deprecated in favor of passing the region name as a parameter to calls made to the service catalog as of the 1.7.0 release and may be removed in the 2.0.0 release.
Create ServiceCatalog object given an auth token.
Warning
Setting region_name is deprecated in favor of passing the region name as a parameter to calls made to the service catalog as of the 1.7.0 release and may be removed in the 2.0.0 release.
Get the raw catalog structure.
Get the version dependent catalog structure as it is presented within the resource.
Returns: | list containing raw catalog data entries or None |
---|
Fetch and filter endpoints for the specified service(s).
Returns endpoints for the specified service (or all) containing the specified type (or all) and region (or all) and service name.
If there is no name in the service catalog the service_name check will be skipped. This allows compatibility with services that existed before the name was available in the catalog.
Fetch token details from service catalog.
Returns a dictionary containing the following:
- `id`: Token's ID
- `expires`: Token's expiration
- `user_id`: Authenticated user's ID
- `tenant_id`: Authorized project's ID
- `domain_id`: Authorized domain's ID
Fetch endpoint urls from the service catalog.
Fetch the endpoints from the service catalog for a particular endpoint attribute. If no attribute is given, return the first endpoint of the specified type.
Parameters: |
|
---|---|
Returns: | tuple of urls or None (if no match found) |
Region name.
Warning
region_name is deprecated in favor of passing the region name as a parameter to calls made to the service catalog as of the 1.7.0 release and may be removed in the 2.0.0 release.
Fetch an endpoint from the service catalog.
Fetch the specified endpoint from the service catalog for a particular endpoint attribute. If no attribute is given, return the first endpoint of the specified type.
Parameters: |
---|
Bases: keystoneclient.service_catalog.ServiceCatalog
An object for encapsulating the v2 service catalog.
The object is created using raw v2 auth token from Keystone.
Bases: keystoneclient.service_catalog.ServiceCatalog
An object for encapsulating the v3 service catalog.
The object is created using raw v3 auth token from Keystone.
Bases: object
Maintains client communication state and common functionality.
As much as possible the parameters to this class reflect and are passed directly to the requests library.
Parameters: |
|
---|
This property is deprecated as of the 1.7.0 release and may be removed in the 2.0.0 release.
This property is deprecated as of the 1.7.0 release and may be removed in the 2.0.0 release.
Handle constructing a session from both old and new arguments.
Support constructing a session from the old HTTPClient args as well as the new request-style arguments.
Warning
DEPRECATED as of 1.7.0: This function is purely for bridging the gap between older client arguments and the session arguments that they relate to. It is not intended to be used as a generic Session Factory. This function may be removed in the 2.0.0 release.
This function purposefully modifies the input kwargs dictionary so that the remaining kwargs dict can be reused and passed on to other functions without session arguments.
Return auth connection params as provided by the auth plugin.
An auth plugin may specify connection parameters to the request like providing a client certificate for communication.
We restrict the values that may be returned from this function to prevent an auth plugin overriding values unrelated to connection parameters. The values that are currently accepted are:
These values are passed to the requests library and further information on accepted values may be found there.
Parameters: | auth (keystoneclient.auth.base.BaseAuthPlugin) – The auth plugin to use for tokens. Overrides the plugin on the session. (optional) |
---|---|
Raises: |
|
Returns: | Authentication headers or None for failure. |
Return type: | dict |
Return auth headers as provided by the auth plugin.
Parameters: | auth (keystoneclient.auth.base.BaseAuthPlugin) – The auth plugin to use for token. Overrides the plugin on the session. (optional) |
---|---|
Raises: |
|
Returns: | Authentication headers or None for failure. |
Return type: | dict |
Get oslo_config options that are needed for a Session.
These may be useful without being registered for config file generation or to manipulate the options before registering them yourself.
cafile: | The certificate authority filename. |
---|---|
certfile: | The client certificate file to present. |
keyfile: | The key for the client certificate. |
insecure: | Whether to ignore SSL verification. |
timeout: | The max time to wait for HTTP connections. |
Parameters: | deprecated_opts (dict) – Deprecated options that should be included in the definition of new options. This should be a dict from the name of the new option to a list of oslo.DeprecatedOpts that correspond to the new option. (optional) For example, to support the ca_file option pointing to the new cafile option name: old_opt = oslo_cfg.DeprecatedOpt('ca_file', 'old_group')
deprecated_opts={'cafile': [old_opt]}
|
---|---|
Returns: | A list of oslo_config options. |
Get an endpoint as provided by the auth plugin.
Parameters: | auth (keystoneclient.auth.base.BaseAuthPlugin) – The auth plugin to use for token. Overrides the plugin on the session. (optional) |
---|---|
Raises keystoneclient.exceptions.MissingAuthPlugin: | |
if a plugin is not available. | |
Returns: | An endpoint if available or None. |
Return type: | string |
Return the authenticated project_id as provided by the auth plugin.
Parameters: | auth (keystoneclient.auth.base.BaseAuthPlugin) – The auth plugin to use for token. Overrides the plugin on the session. (optional) |
---|---|
Raises: |
|
Returns string: | Current project_id or None if not supported by plugin. |
Return a token as provided by the auth plugin.
Parameters: | auth (keystoneclient.auth.base.BaseAuthPlugin) – The auth plugin to use for token. Overrides the plugin on the session. (optional) |
---|---|
Raises: |
|
Warning
This method is deprecated as of the 1.7.0 release in favor of get_auth_headers() and may be removed in the 2.0.0 release. This method assumes that the only header that is used to authenticate a message is ‘X-Auth-Token’ which may not be correct.
Returns: | A valid token. |
---|---|
Return type: | string |
Return the authenticated user_id as provided by the auth plugin.
Parameters: | auth (keystoneclient.auth.base.BaseAuthPlugin) – The auth plugin to use for token. Overrides the plugin on the session. (optional) |
---|---|
Raises: |
|
Returns string: | Current user_id or None if not supported by plugin. |
Invalidate an authentication plugin.
Parameters: | auth (keystoneclient.auth.base.BaseAuthPlugin) – The auth plugin to invalidate. Overrides the plugin on the session. (optional) |
---|
Create a Session object from CLI arguments.
The CLI arguments must have been registered with register_cli_options().
Parameters: | args (Namespace) – result of parsed arguments. |
---|---|
Returns: | A new session object. |
Return type: | Session |
Create a session object from an oslo_config object.
The options must have been previously registered with register_conf_options.
Parameters: | |
---|---|
Returns: | A new session object. |
Return type: |
Register the argparse arguments that are needed for a session.
Parameters: | parser (argparse.ArgumentParser) – parser to add to. |
---|
Register the oslo_config options that are needed for a session.
cafile: | The certificate authority filename. |
---|---|
certfile: | The client certificate file to present. |
keyfile: | The key for the client certificate. |
insecure: | Whether to ignore SSL verification. |
timeout: | The max time to wait for HTTP connections. |
Parameters: |
|
---|---|
Returns: | The list of options that was registered. |
Send an HTTP request with the specified characteristics.
Wrapper around requests.Session.request to handle tasks such as setting headers, JSON encoding/decoding, and error handling.
Arguments that are not handled are passed through to the requests library.
Parameters: |
|
---|---|
Raises keystoneclient.exceptions.ClientException: | |
For connection failure, or to indicate an error response code. |
|
Returns: | The response to the request. |
Bases: requests.adapters.HTTPAdapter
The custom adapter used to set TCP Keep-Alive on all connections.
This Adapter also preserves the default behaviour of Requests which disables Nagle’s Algorithm. See also: http://blogs.msdn.com/b/windowsazurestorage/archive/2010/06/25/nagle-s-algorithm-is-not-friendly-towards-small-requests.aspx
Helper for the _find_* methods.
Stringify time in ISO 8601 format.
Check if function requires authentication.
Checks to see if the function is marked as not requiring authentication with the @unauthenticated decorator.
Returns True if decorator is set to True, False otherwise.
Prompt user for password if not provided.
Prompt is used so the password doesn’t show up in the bash history.
Prompt user for a password.
Prompt for a password if stdin is a tty.
Add ‘unauthenticated’ attribute to decorated function.
Usage:
@unauthenticated
def mymethod(f):
...