summaryrefslogtreecommitdiff
path: root/openstackclient/api/auth.py
Commit message (Collapse)AuthorAgeFilesLines
* Add importing file to import warningsDean Troyer2016-08-301-1/+4
| | | | | | | | Add the Python file doing the import to the warnings emitted by the modules moved to osc-lib. Users will at least have a hint as to which package is out-of-date. Change-Id: I633b440c30b2b15cfde7a9013e30dfa39ab200bc
* osc-lib: api.authDean Troyer2016-06-301-222/+8
| | | | | | Move auth plugin checking to osc-lib. Change-Id: I673d9c2d6e8bbf724c3000459a729e831d747814
* Remove OSCGenericPassword pluginDean Troyer2016-06-221-2/+2
| | | | | | | The need for this has passed plus with 3.0 we can take the breakage hit, if any. Change-Id: Ic019842f00033d2cd67b75f036e7e817e4b7c075
* Refactor setting defaults for some scope parametersAlvaro Lopez Garcia2016-06-211-1/+4
| | | | | | | | | | The code is setting defaults for some scope parameters, cheking if the name ends with some specific substring (namely ending in "password") causing failures in some plugins that end with the same string, but do not allow those parameters (like "user_domain_id" in "v3oidcpassword"). Closes-Bug: #1582774 Change-Id: Id7036db3b783b135353d035dc4c1df7c808d6474
* Refactor check_valid_auth_options functionAlvaro Lopez Garcia2016-06-211-22/+21
| | | | | | | | | | | | The functions check_valid_auth_options() function was relying on the name for checking the set of required options, but this could cause errors with external auth plugins. If somebody defines an auth plugin plugin named "footoken" the check function would check for a "token" option, even if the plugin has not defined that option. This change tries to improve this situation, cheking for some options only if they have been defined in the plugin. Change-Id: I4255f2e7d4d23449c95be957ea7b6b60983f2608
* Do not prompt for scope options with default scoped tokensDolph Mathews2016-06-171-18/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | This changes the scope validation to occur after a token has already been created. Previous flow: 1. Validate authentication options. 2. Validate authorization options if the command requires a scope. 3. Create a token (using authentication + authorization options) 4. Run command. This means that scope was being checked, even if a default scope was applied in step 3 by Keystone. New flow: 1. Validate authentication options. 2. Create token (using authentication + authorization options) 3 Validate authorization options if the command requires a scope and the token is not scoped. 4. Run command. Change-Id: Idae368a11249f425b14b891fc68b4176e2b3e981 Closes-Bug: 1592062
* Fix missing i18n supports in api/ and shell.pyHuanxuan Ao2016-06-141-9/+9
| | | | | Change-Id: I28d79d7f44b27d2b600dedad2a3601180650ad83 Partial-bug: #1574965
* osc-lib: utilsDean Troyer2016-06-131-1/+1
| | | | | | | | Use osc-lib directly for utils. Leave openstackclient.common.utils for deprecation period. Change-Id: I5bd9579abc4e07f45219ccd0565626e6667472f7
* osc-lib: exceptionsDean Troyer2016-06-131-1/+1
| | | | | | | | Use osc-lib directly for exceptions. Leave openstackclient.common.exceptions for deprecation period. Change-Id: Iea3e862302372e1b31ccd27f69db59b4953ca828
* Moving authentication from keystoneclient to keystoneauthNavid Pustchi2016-06-091-18/+11
| | | | | | | | | | | | | | | | | Currently OpenStackClient uses keystoneclient for authentication. This change will update OpenStackClient to use keystoneauth for authentication. All dependant test have been updated. Updating how auth_ref is set in the tests to use KSA fixtures had some racy side-effects. The user_role_list tests failed when they picked up an auth_ref that was a fixture. This exposed a weakness in ListUserRole that needed to be fixed at the same time re handling of unscoped tokens and options. Change-Id: I4ddb2dbbb3bf2ab37494468eaf65cef9213a6e00 Closes-Bug: 1533369
* Avoid TypeError on message object additionsMadhu Mohan Nelemane2016-05-191-16/+20
| | | | | Change-Id: I634c1e158e93eeb55ab17fef8a0715b6678dffec Closes-Bug: #1575787
* Clean redundant argument to dict.getting.wang2016-02-211-15/+15
| | | | | | | `dict.get()` returns `None` by default, if a key wasn't found. Removing `None` as second argument to avoid redundancy. Change-Id: Ia82f7469cd019509bbeccbfe54b15eeedc7bb6ea
* Merge "Support unscoped token request"Jenkins2016-02-211-3/+8
|\
| * Support unscoped token requestguang-yee2016-02-191-3/+8
| | | | | | | | | | | | | | | | Make scope check optional for the "token issue" command as unscoped token is a valid Keystone V2/V3 API. Change-Id: Ie1cded4dbfdafd3a78c0ebdf89e3f66762509930 Closes-Bug: #1543214
* | Replace string format arguments with function parametersting.wang2016-02-201-2/+2
|/ | | | | | | | There are files containing string format arguments inside logging messages. Using logging function parameters should be preferred. Change-Id: I15b405bf4d4715263fe1e1262982467b3d4bc1f4 Closes-Bug: #1321274
* Fix 'auhentication' spelling error/mistakeJoshua Harlow2015-09-011-1/+1
| | | | Change-Id: Iba58c188d2ae44170539534eea1415cf8eb65ac4
* Improve the hint messageDave Chen2015-06-141-2/+4
| | | | | | | | | | | | | | | Currently, we can get scoped token (domain scoped, project scoped) as well as unscoped token. When we use OSC to get a domain scoped token without explicitly set domain information, the hint message show us we need to set a scoped domain or project, but it miss that the parameters to be set in order to get project or domain scoped token is not the same. Thus, the hint message could be improved to make it more clear to end user. Change-Id: I94768c619b30be18737fec189ae6d81e81ba090d
* Set tenant options on parsed namespaceJamie Lennox2015-05-311-1/+3
| | | | | | | | | | | | | | | | | | | | | | | Because of the way OSC registers all plugins together we end up with os-tenant-X parameters being saved to the project-X attribute after parsing. If you are using the v2 plugins directly then they and os-client-config expect the tenant_X values and will assuming no scoping information if they are not present. Validating options for scope will also fail in this situation, not just because the resultant auth dictionary is missing the tenant-X attributes, but because OSC validates that either project or domain scope information is present. Fix this by just always setting the v2 parameters if the v3 parameters are present. This will have no effect on the generic or v3 case but fix the v2 case. Expand validation to include the tenant options so it knows that v2 plugins are scoped. Change-Id: I8cab3e423663f801cbf2d83106c671bddc58d7e6 Closes-Bug: #1460369
* Add --os-cloud supportDean Troyer2015-04-181-46/+58
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds a new option --os-cloud that allows the configuration values for multiple clouds to be stored in a local file and selected with a single option. Internal option names have had 'os_' removed to be comptible with the options returned from OpenStackConfig().get_one_cloud(). The config file is ~/.config/openstack/clouds.yaml: Sample ------ clouds: devstack: auth: auth_url: http://192.168.122.10:35357/ project_name: demo username: demo password: 0penstack region_name: RegionOne devstack: auth: auth_url: http://192.168.122.10:35357/ project_name: demo username: demo password: 0penstack region_name: RegionOne Co-Authored-By: Monty Taylor <mordred@inaugust.com> Change-Id: I4939acf8067e44ffe06a2e26fc28f1adf8985b7d Depends-On: I45e2550af58aee616ca168d20a557077beeab007
* Defer client importsDean Troyer2015-04-151-22/+42
| | | | | | | | | | | | So we really weren't deferring the loading of client libs dadgummit, do that for real where possible. This shaves a couple of tenths off the static import times. Also defer as much import-time procesing as possible. This is a little ugly in api.auth but this also eliminates import of the auth plugins until they are needed. Change-Id: Ia11d4b9cf98231d37449103fc29101dc17afb009
* Move OSC auth plugins so they can be foundDean Troyer2015-03-101-97/+0
| | | | | | | | | | | | | | The plugin detection at the top of openstackclient.api.auth did not detect the plugins at the bottom of that file because, surprise, they had not been declared yet so the entry points were ignored. Move both plugin subclasses into openstackclient.api.auth_plugin. Fix a problem with the password callback that was otherwise made worse with this change. Closes-Bug: 1428912 Change-Id: Idc3b72534071e0013c8922884a8bc14137509a0f
* Merge "Fix auth-required for help command"Jenkins2015-03-021-3/+3
|\
| * Fix auth-required for help commandDean Troyer2015-02-271-3/+3
| | | | | | | | | | | | | | | | | | | | When we got picky with the auth arguments we broke using help without any auth config supplied. This rearranges things a bit to do the argument checking when the deferred auth request to Identity occurs so commands that do not need auth have a chance to live short but useful lives. Closes-Bug: #1399588 Change-Id: I8ceac491cf65e25eddb62ab2713f471fe686756d
* | change oslo namespace to avoid warningTerry Howe2015-02-251-1/+1
|/ | | | Change-Id: Ieff86f841623e1ce34b79c66bc5e8b1b239fa3e9
* Merge "Add version url config workaround"Jenkins2015-01-191-1/+45
|\
| * Add version url config workaroundDean Troyer2015-01-151-1/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This subclasses KSC's generic Password plugin to allow version discovery with default Keystone configurations that leave admin_endpoint and public_endpoint at the default values (http://localhost:xxxx). This patch copies the scheme and netloc from the original auth_url into the URL returned from version discovery if the returned netloc begins with 'localhost'. Due to the specific nature of this review, the Keystone team is not inclned to include it in keystoneclient so it is addressed here. Closes-bug: #1410364 Change-Id: I877fe74d86aab3a63122a07b77d1302a007f5b30
* | Add helpful messages when authN'ing with passwordSteve Martinelli2015-01-161-1/+21
|/ | | | | | | | | | Setting up auth options can be complicated, and we currently don't do any checking before we build all our auth parameters to send off to keystoneclient. We should do some basic checking to guide new users. Change-Id: I9c88f1c9637b3870c151952ecc797aaf65be271a Closes-Bug: #1400531
* Add environment variable in the os-auth-type helpMarek Denis2014-11-171-1/+2
| | | | | | | Help for option --os-auth-type doesn't specify what environment variable configures it. This patch fixes that. Change-Id: Id2e29e477d5ca56339bd777fb73b5af13788615b
* Change --os-auth-plugin to --os-auth-typeDean Troyer2014-10-231-33/+31
| | | | | | | | | | | | | | | | | | | | User's don't know what a plugin is. * Internally, os_auth_type and/or auth_type represents what the user supplied. * auth_plugin_name is the name of the selected plugin * auth_plugin is the actual plugin object Plugin selection process: * if --os-auth-type is supplied: * if it matches against an available plugin, done * (if it can map to an availble plugin type, done; TODO in a followup) * if --os-auth-type is not supplied: * if --os-url and --os-token are supplied, select 'token_endpoint' * if --os-username supplied, select identity_api_version + 'password' * if --os-token supplied, select identity_api_version + 'token' Change-Id: Ice4535214e311ebf924087cf77f6d84d76f5f3ee
* Clean up shell authenticationDean Troyer2014-10-211-1/+1
| | | | | | | | | | | | | | | | | | | | | * Remove the auth option checks as the auth plugins will validate their own options * Move the initialization of client_manager to the end of initialize_app() so it is always called. Note that no attempts to actually authenticate occur until the first use of one of the client attributes in client_manager. This leaves initialize_clientmanager() (formerly uathenticate_user()) empty so remove it. * Remove interact() as the client_manager has already been created And there is nothing left. * prepare_to_run_command() is reduced to trigger an authentication attempt for the best_effort auth commands, currently the only one is 'complete'. * Add prompt_for_password() to ask the user to enter a password when necessary. Passed to ClientManager in a new kward pw_func. Bug: 1355838 Change-Id: I9fdec9144c4c84f65aed1cf91ce41fe1895089b2
* Add plugin to support token-endpoint authDean Troyer2014-10-121-8/+61
| | | | | | | | | | | | | | | | | The ksc auth plugins do not have support for the original token-endpoint (aka token flow) auth where the user supplies a token (possibly the Keystone admin_token) and an API endpoint. This is used for bootstrapping Keystone but also has other uses when a scoped user token is provided. The api.auth:TokenEndpoint class is required to provide the same interface methods so all of the special-case code branches to support token-endpoint can be removed. Some additional cleanups related to ClientManager and creating the Compute client also were done to streamline using sessions. Change-Id: I1a6059afa845a591eff92567ca346c09010a93af
* Support for keystone auth pluginsMatthieu Huin2014-10-091-0/+180
This patch allows the user to choose which authentication plugin to use with the CLI. The arguments needed by the auth plugins are automatically added to the argument parser. Some examples with the currently available authentication plugins:: OS_USERNAME=admin OS_PROJECT_NAME=admin OS_AUTH_URL=http://keystone:5000/v2.0 \ OS_PASSWORD=admin openstack user list OS_USERNAME=admin OS_PROJECT_DOMAIN_NAME=default OS_USER_DOMAIN_NAME=default \ OS_PROJECT_NAME=admin OS_AUTH_URL=http://keystone:5000/v3 OS_PASSWORD=admin \ OS_IDENTITY_API_VERSION=3 OS_AUTH_PLUGIN=v3password openstack project list OS_TOKEN=1234 OS_URL=http://service_url:35357/v2.0 \ OS_IDENTITY_API_VERSION=2.0 openstack user list The --os-auth-plugin option can be omitted; if so the CLI will attempt to guess which plugin to use from the other options. Change-Id: I330c20ddb8d96b3a4287c68b57c36c4a0f869669 Co-Authored-By: Florent Flament <florent.flament-ext@cloudwatt.com>
View Lorry Controller Status