summaryrefslogtreecommitdiff
path: root/openstackclient/identity
Commit message (Collapse)AuthorAgeFilesLines
* Client should parse string to boolean for value 'is_domain'yanpuqing2020-05-291-0/+8
| | | | | | | | | | | | | When we use "--property" parameter, client get lists these the value is string type, but the type of the value 'is_domain' should be boolean, so we should judge it and parse it. The patch parse string to boolean for value 'is_domain'. Co-Authored-By: Lance Bragstad <lbragstad@gmail.com> Change-Id: I37c9eb854524bde3a1530bfe2e3a03810fb1a676 Task: 30039 Story: 2005246
* Add resource option immutableVishakha Agarwal2020-04-084-2/+50
| | | | | | | | | This patch adds the --immutable and --no-immutable option to the role, project and domain CLI. Related-Patch: https://review.opendev.org/#/c/712182/ Change-Id: I9c3bdd741f28bf558267fb217818d947597ce13e
* Adding options to user cliVishakha Agarwal2020-03-261-1/+119
| | | | | | | | | | | | | User options [1] can be set by making POST and PATCH request for /v3/users API calls but cannot by openstack CLI because of no user options defined in create and update user CLI [2]. This patch adds the user options [1] in create user and update user CLI. [1] https://docs.openstack.org/keystone/latest/admin/resource-options.html#multi-factor-auth-rules [2] https://docs.openstack.org/api-ref/identity/v3/#create-user Change-Id: I4e41bae2e8cfbe92d52b14d856991bedcd44164f
* Merge "Now we can add description for role creation in OSC"Zuul2020-03-201-2/+14
|\
| * Now we can add description for role creation in OSCM V P Nitesh2018-09-181-2/+14
| | | | | | | | | | | | | | | | | | | | | | Now user can add the description when user create's the role using OSC ``openstack role create`` command. User can add the description by adding `--description <Description>` to OSC ``openstack role create`` command. Co-Authored-By: Deepak Mourya<deepakmoriya7@gmail.com> Change-Id: I858e004c3b29c687b6a39c8a1ed5fb029eb19c67 Depends-on: I230af9cc833af13064636b5d9a7ce6334c3f6e9a Closes-Bug: #1669080
* | Fix copypaste errors in access rule commandColleen Murphy2020-01-211-2/+2
| | | | | | | | | | | | Access rules are access rules, not application credentials. Change-Id: I74d05f11ec186283e5a86d92dcbfe4eb24130eee
* | Add support for app cred access rulesColleen Murphy2020-01-172-0/+145
| | | | | | | | | | | | | | | | | | | | This commit introduces the --access-rules option for 'application credential create' as well as new 'access rule' commands for listing, showing, and deleting access rules. bp whitelist-extension-for-app-creds Change-Id: I04834b2874ec2a70da456a380b5bef03a392effa
* | Replace six.iteritems() with .items()lihaijing2020-01-0932-100/+68
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1. As mentioned in [1], we should avoid using six.iteritems to achieve iterators. We can use dict.items instead, as it will return iterators in PY3 as well. And dict.items/keys will more readable. 2. In py2, the performance about list should be negligible, see the link [2]. [1] https://wiki.openstack.org/wiki/Python3 [2] http://lists.openstack.org/pipermail/openstack-dev/2015-June/066391.html Co-Authored-By: Akihiro Motoki <amotoki@gmail.com> Change-Id: I4b9edb326444264c0f6c4ad281acaac356a07e85 Implements: blueprint replace-iteritems-with-items
* | neutron: autogenerate docsEric Fried2019-11-011-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | $namespace = openstack.network.v2 The subcommand documents for $namespace were hardcoded and thus prone to drift over time. This commit removes the hardcoded content and uses the autoprogram-cliff directive to generate them automatically from the subcommand configuration classes. This one turned out to be quite involved, because we support both neutron and nova-network. When running in a real cloud, the command classes detect whether the neutron service is present, assume nova-network if that service is not found, and only add parser options relevant to the detected service. But the docs need to present both sets of options. This was easy enough when they were hardcoded, but required a bit of additional infrastructure for generated docs. Change-Id: I426261eb1d86bcc68656aabd61f10b7f082da402
* | Merge "Add parent project filter for listing projects"Zuul2019-10-221-0/+10
|\ \
| * | Add parent project filter for listing projectsTakashi Kajinami2019-09-021-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | This patch introduces a new option --parent into project list, to specify a parent project to filter projects which has the given project as their parent. Depends-on: https://review.opendev.org/#/c/677101 Change-Id: I6725262cf040e0ec6ceca9cf0462ce59224049c6
* | | Fix osc-lib interface change: catch osc-lib ForbiddenAndreas Florath2019-09-191-1/+1
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The patch https://review.opendev.org/#/c/673389/ introduced a regression by changing the osc-lib interface. The patch https://review.opendev.org/683119 changes the exception from the generic CommandError back to a specific Forbidden exception. This patch catches this exception and passes on, i.e. re-implements the same behavior as before. Story: 2006547 Change-Id: I17b1ec7abaa5b0828ccbcad40bd928565c5c59fb Signed-off-by: Andreas Florath <Andreas.Florath@telekom.de>
* | Merge "Use cliff formattable columns in identity commands"Zuul2019-06-235-40/+67
|\ \
| * | Use cliff formattable columns in identity commandsAkihiro Motoki2019-06-225-40/+67
| | | | | | | | | | | | | | | | | | | | | Partial-Bug: #1687955 Partially implement blueprint osc-formattable-columns Change-Id: Ia13314a012b3a7363ffb24a13c79c6ecdff1ed7b
* | | Remove deprecated identity commands and argsSean McGinnis2019-05-193-286/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The following were deprecated over two years ago and can now be removed/changed: * Remove ``service create`` option ``--type`` * Remove ``role list`` options ``--project`` and ``--user`` * Remove ``user role list`` command These are backwards incompatible changes and will require a major version bump after they are merged. Change-Id: I29e2fc9516dffbfd83eef0bc91e834dde99b4105 Signed-off-by: Sean McGinnis <sean.mcginnis@gmail.com> Signed-off-by: Dean Troyer <dtroyer@gmail.com>
* | | Merge "Fix RuntimeError when showing project which has extra properties"Zuul2019-05-171-1/+1
|\ \ \
| * | | Fix RuntimeError when showing project which has extra propertiesYang Youseok2018-06-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If you use python3, items() returns iterator which is not allowed to remove item during iteration. Fix to iterate by copied list. Change-Id: I64c037d04e2b127d8f19f56cab65122af89a7200 Closes-Bug: 1740232
* | | | Fix bug in endpoint group deletionJose Castro Leon2019-05-081-3/+3
| |/ / |/| | | | | | | | | | | | | | | | | | | | | | | | | | There is a typo in the endpoint group deletion, due to this you can't remove endpoint groups once assigned. I am adding also the unit tests to avoid this kind of issues in the future Task: 30640 Story: 2005521 Change-Id: Ie938f2c9894bb39b4c0ed1f7aa3a6a751a303058
* | | Merge "Modify the help message for 'registered limit set'"Zuul2018-12-181-4/+13
|\ \ \
| * | | Modify the help message for 'registered limit set'Vishakha Agarwal2018-11-091-4/+13
| | |/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Regsitered limit set CLI takes --service, --region and --resource-name as param which can be updated along with --default limit for existing registered limit. Default limit can be updated with same value and CLI return the success. But --service, --region and --resource- name cannot be same as existing one. CLI return 409 for this case. Which is valid behaviour because more than one limit with same service and same resource cannot exist. But help message of --service, --region and --resource-name are not much clear to tell that they cannot be passed with same value. This patch clarifies the help message for resigtered limit set CLI. Reference Scenario: * openstack registered limit set --default-limit 91 64c2e97fbe904b888544ffdcab21989b limit updated sucessfully Updating limit with exsiting service and resource-name: * openstack registered limit set --default-limit 92 --resource-name snapshot 64c2e97fbe904b888544ffdcab21989b Conflict occurred attempting to store registered_limit - Duplicate entry. (HTTP 409) *openstack registered limit set --default-limit 93 --service compute 64c2e97fbe904b888544ffdcab21989b Conflict occurred attempting to store registered_limit - Duplicate entry. (HTTP 409) *openstack registered limit set --default-limit 91 --resource-name snapshot --service glance 64c2e97fbe904b888544ffdcab21989b Conflict occurred attempting to store registered_limit - Duplicate entry. (HTTP 409) Change-Id: I9e78a6250567cd981adde96946818bb016760a49
* | | Updated the take_actions for unified limitsVishakha Agarwal2018-11-093-12/+84
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When user passes --region None, the find_resource of osc_lib calls get() of region. The get API of region ignores the name param returning all the regions in result. As the find_resource checks many cases against the result returned by get API. The output comes greater than 1, thus returning "More than one region ID exist" which is incorrect. However in case of region which cannot be filtered by name we do not require to check these many cases. The solution is to directly call the get method of APIs and returning No resource name exist with the xyz" on passing invaid parameter. And returning all in case of None. Thus created a new function get_resource which can be used in future too by these types of API's. Change-Id: Ib3f881d34a82af97199ce51bfbefc6f3f08599f1 Closes-bug: #1799153
* | | Add project param in LimitList parser3.17.0Vishakha Agarwal2018-11-081-1/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | when doing openstack limit list --project xyz_id, CLI raising error unrecognized arguments, whereas in api-ref document [1], user can pass project_id as query param.This addresses the above issue, by adding param --project in parser of LimitList. [1] https://developer.openstack.org/api-ref/identity/v3/index.html Change-Id: If4644cc99a3803f61f4a688b828aeb73977fc0dd Closes-Bug: #1798744
* | | Allow endpoint filtering on both project and project-domainJulie Pichon2018-10-091-1/+1
|/ / | | | | | | | | | | | | | | | | | | | | The --project and --project-domain flags are currently mutually exclusive for listing endpoints, however the --project-domain argument is supposed to help with filtering projects with colliding names. They should be allowed together. Story: 2004018 Task: 27007 Change-Id: I7340e01f509e3515f07cb46f175fb603f1ce8b67
* | Implement support for project limitsLance Bragstad2018-07-231-0/+238
| | | | | | | | | | | | | | | | This commit let's users manage limits via the command line. bp unified-limits Change-Id: I7c44bbb60557378b66c5c43a7ba917f40dc2b633
* | Implement support for registered limitsLance Bragstad2018-07-231-0/+260
| | | | | | | | | | | | | | | | | | | | This commit adds support for users to manage registered limits via the command line. bp unified-limits Depends-On: https://review.openstack.org/#/c/574391/ Change-Id: Id8377363f7a3248b45aeeba21d2acc02684a0305
* | Fix the `role implies list` command.Sami MAKKI2018-06-241-3/+3
| | | | | | | | | | | | | | | | | | | | The code was calling an unexisting function which never existed. The module refers now to the correct `InferenceRuleManager`. It also allows the compatibility with the future python-keystoneclient in which the compatibility method will be removed from the RoleManager. Change-Id: I08f785dc9e840da2e16915683eecfe49189c44b3
* | Add system role functionalityLance Bragstad2018-06-043-13/+61
| | | | | | | | | | | | | | | | | | | | This commit adds the necessary bits to expose system role assignments to openstackclient via python-keystoneclient. bp system-scope Depends-On: Iecbcbf020a15f2bec777334c648d4477f89f3b2c Change-Id: I261e84700b51e8715eaebdc3f8f8bc46b68542c2
* | Clean up W503 and E402 pep8 errorsSean McGinnis2018-04-151-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | pycodestyle 2.40 and later enforce these rules that were not previously enforced. Rather than just skipping them, this cleans up the trivial instances of these violations. This does also include some other updates that were not triggering errors in an attempt to keep some of the style consistent. Change-Id: Id7c0a6b8f1f835e69d844b000e3ed751852ada63 Closes-bug: #1762803
* | Merge "Fix additional output encoding issues"Zuul2018-03-291-3/+2
|\ \
| * | Fix additional output encoding issuesDean Troyer2018-03-201-3/+2
| |/ | | | | | | | | | | | | | | This is a followup to https://review.openstack.org/#/c/541609/ that changes most outstanding direct uses of sys.stdout to use the encoded stdout set up by cliff. Change-Id: I07cfc418385fc787d3b7d3c32d39676cf81bb91f
* | Merge "Add CRUD support for application credentials"Zuul2018-03-142-0/+227
|\ \
| * | Add CRUD support for application credentialsColleen Murphy2018-01-302-0/+227
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add support for creating, retrieving, and deleting application credentials. Application credentials do not support updates. In order to provide a positive user experience for the `--role` option, this patch also includes an improvement to the `identity.common._get_token_resource()` function that allows it to introspect the roles list within a token. This way there is no need to make a request to keystone to retrieve a role object, which would fail most of the time anyway due to keystone's default policy prohibiting unprivileged users from retrieving roles. bp application-credentials Change-Id: I29e03b72acd931305cbdac5a9ff666854d05c6d7
* | Merge "Add support for endpoint group commands"Zuul2018-02-251-0/+324
|\ \
| * | Add support for endpoint group commandsJose Castro Leon2018-02-231-0/+324
| |/ | | | | | | | | | | | | | | | | | | Implements the commands for endpoint group filter management. Includes the CRUD management of the endpoint groups and the association management between them and the projects that are using this method. Implements: blueprint keystone-endpoint-filter Change-Id: I4265f7f8598d028191e90d76781b7b6ece6fef64
* | Add project tags functionalityGage Hugo2018-02-232-1/+124
|/ | | | | | | | | This change adds tags functionality for projects in keystone. A user can add a single tag with "--tag", chain "--tag" to add multiple tags, or clear tags with "--no-tag". Change-Id: I31cfef3e76dcefe299dacb00c11bb1a10a252628 Partially-Implements: bp project-tags
* Merge "Add support for endpoing filter commands"Zuul2017-12-131-17/+130
|\
| * Add support for endpoing filter commandsJose Castro Leon2017-11-211-17/+130
| | | | | | | | | | | | | | | | | | Implements the commands that allow to link and endpoint to a project for endpoint filter management. Implements: blueprint keystone-endpoint-filter Change-Id: Iecf61495664fb8413d35ef69f07ea929d190d002
* | Fix credentials in create, update and list.yangweiwei2017-11-171-6/+3
|/ | | | | | | | | | | | | | Now, keystone has supported serverl auth method, like 'totp'. Before we use this method, we should create the credential first. And we need create it with type 'totp'. But now we cannot create credential with this method. Also, I think the type should not have constrains. We can create any type in keystone project. So, we should do these actions too. The type would be more which We cannot control. Change-Id: Ie0482da3133fb515e4bb8e45f8c54f509589cc5e Closes-bug: #1731848
* Optimize getting endpoint listAnton Frolov2017-09-262-1/+12
| | | | | | | | | | | | | | | Currently ListEndpoint.take_action method unconditionally iterates over all endpoints and issue GET /v3/services/<ep.service_id> request for each endpoint. In case of HTTPS keystone endpoint this can take significant amout of time, and it only getting worse in case of multiple regions. This commit change this logic to making just two GET requests: first it gets endpoint list, then it gets service list, searching service in the list instead of issuing GET /v3/services/<id> request. Change-Id: I22b61c0b45b0205a2f5a4608c2473cb7814fe3cf Closes-Bug: 1719413
* Implied RolesHarry Rybacki2017-08-221-0/+129
| | | | | | | | | | | | | | | | | Allow the user to create an inference rule between two roles. The first, called the prior role is the role explicitly assigned to an individual. The second, called the implied role, is one that the user gets implicitly. For example: Role B implies Role A. User X is assigned Role B. Therefore User X also assigned Role A. The management and maintenance of the rules is performed in the Keystone server. Change-Id: If547c2f16e812bc7fffd742ec37e6a26011f3185
* Merge "Use *_as_ids instead *_as_list"Jenkins2017-07-261-9/+2
|\
| * Use *_as_ids instead *_as_listRodrigo Duarte Sousa2017-03-011-9/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The parents_as_list and subtree_as_list query parameters limit the result to only parents and subtree where the user making the call has role assignments in. Since OSC only displays the IDs, the call would be the same as the similar *_as_ids queries, the difference is that the later doesn't enforce the role assignments (making it more useful). Output example by using this patch: $ openstack project show --children root +-------------+------------------------------+ | Field | Value | +-------------+------------------------------+ | description | | | domain_id | default | | enabled | True | | id | 123 | | is_domain | False | | name | root | | parent_id | default | | subtree | {u'456': None, u'789': None} | +-------------+------------------------------+ Change-Id: Ib7b37ae8f55190a7efcc375d5be4a2823d02d1a4
* | Add optional parameter "user_id" and "type" to list credentialszhanghongtao2017-07-251-3/+34
| | | | | | | | | | | | | | | | In keystone version 3.5, "type" optional attribute has been added to list credentials. This patch add "user_id" and "type" optional parameter in openstack client. Change-Id: Ia09ee7c39204fdff2dfd7b9b606d888d007caac5
* | Add domain parameter to Identity ProviderKristi Nikolla2017-07-211-1/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Identity providers are now associated with domains. This change allows a user to specify a domain by ID or by name when creating an identity provider. [0] This also adds the column for Domain ID in listing. Updating a domain for an identity provider is not supported, so that isn't changed. [0]. Id18b8b2fe853b97631bc990df8188ed64a6e1275 Closes-Bug: 1698390 Change-Id: Icc408e2fe88f257d5863bd3df716a777d52befcc
* | Fix 'domain' filter not work well in some commandsjiangpch2017-07-183-4/+13
| | | | | | | | | | | | | | | | | | The 'domain' filter not work well in commands 'project show', 'user show' and 'user set'. Depends-On: I490900d6249f01654d4cba43bddd3e7af7928a84 Closes-Bug: #1704097 Change-Id: Ib4f47cbaba27eb56c4a41d187fee74a995e62dc7
* | When creating a trust, send role_ids instead or role_namesKristi Nikolla2017-06-221-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This changes create a trust to use ids instead of names because of the possibility of roles sharing a name. Even if the user uniquely identified a role by inputting the id, the request sent to the identity service would used the name, therefore the command would fail in the case that two roles share a name. This does not change how trusts are displayed during trust list or trust show, a name will still be shown instead of an id. Depends-On: I38e0ac35946ee6e53128babac3ea759a380572e0 Change-Id: I5bdf89f1e288954a7f5c2704231f270bc7d196f5 Closes-Bug: 1696111
* | Use _get_token_resource in role assignment listDavid Rabel2017-05-231-1/+2
| | | | | | | | | | | | | | | | | | | | | | If project matches the project from access token, we do not have to send an API request to /projects?name=..., because the project ID is already known. This API request may require additional permissions, so we want to avoid it, if possible. Change-Id: Ice1af8686bceea6b67229dcab7cf82eef821163e Closes-Bug: #1658189
* | Support to add/remove multi users for "group add/remove user"Huanxuan Ao2017-03-211-20/+48
| | | | | | | | | | | | | | | | Similar delete commands in OSC, we can also support add/remove multi users for one specified group, this review implement it. Change-Id: I8ccf99d4ee83a18778fa3ff5c0a42bc7c6ff21fb Implements: bp support-multi-add-remove
* | Non-Admin can't list own projectsadrian-turjak2017-03-201-1/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Due to a default Keystone policy until Newtown, and the use of resource_find, non-admins are unable to list their own projects. This patch bypasses this problem while also introducing better UX for non-admins wishing to get their project list. 'openstack project list' retains the default of 'list all projects' but on a forbidden error will default instead to 'list my projects'. This way for non-admins 'list my projects' feels like the default without breaking the expected admin default. Adding the '--my-projects' option allows admins to easily list their own projects or allows non-admins to be explicit and bypass the forbidden error fallback. Change-Id: I1021276f69fbbf28e13e17c4e567d932fce7ed8b Closes-Bug: #1627555
* | Merge "Narrow expected responses for CheckUserInGroup"Jenkins2017-03-161-6/+9
|\ \
View Lorry Controller Status