keystone.assignment.backends package

Submodules

keystone.assignment.backends.ldap module

class keystone.assignment.backends.ldap.Assignment(*args, **kwargs)[source]

Bases: keystone.assignment.core.AssignmentDriverV8

add_role_to_user_and_project(user_id, tenant_id, role_id)[source]
check_grant_role_id(role_id, user_id=None, group_id=None, domain_id=None, project_id=None, inherited_to_projects=False)[source]
create_grant(role_id, user_id=None, group_id=None, domain_id=None, project_id=None, inherited_to_projects=False)[source]
default_resource_driver()[source]
default_role_driver()[source]
delete_grant(role_id, user_id=None, group_id=None, domain_id=None, project_id=None, inherited_to_projects=False)[source]
delete_group_assignments(group_id)[source]

Called when the group was deleted.

Any role assignments for the group should be cleaned up.

delete_project_assignments(project_id)[source]
delete_role_assignments(role_id)[source]
delete_user_assignments(user_id)[source]
list_domain_ids_for_groups(group_ids, inherited=False)[source]
list_domain_ids_for_user(user_id, group_ids, hints)[source]
list_grant_role_ids(user_id=None, group_id=None, domain_id=None, project_id=None, inherited_to_projects=False)[source]
list_project_ids_for_groups(group_ids, hints, inherited=False)[source]
list_project_ids_for_user(user_id, group_ids, hints, inherited=False)[source]
list_role_assignments(role_id=None, user_id=None, group_ids=None, domain_id=None, project_ids=None, inherited_to_projects=None)[source]
list_role_ids_for_groups_on_domain(group_ids, domain_id)[source]
list_role_ids_for_groups_on_project(groups, project_id, project_domain_id, project_parents)[source]
list_user_ids_for_project(tenant_id)[source]
remove_role_from_user_and_project(user_id, tenant_id, role_id)[source]
class keystone.assignment.backends.ldap.GroupRoleAssociation(group_dn=None, role_dn=None, tenant_dn=None, *args, **kw)[source]

Bases: object

Role Grant model.

class keystone.assignment.backends.ldap.ProjectApi(conf)[source]

Bases: keystone.common.ldap.core.ProjectLdapStructureMixin, keystone.common.ldap.core.EnabledEmuMixIn, keystone.common.ldap.core.BaseLdap

get_user_dns(tenant_id, rolegrants, role_dn=None)[source]
get_user_projects(user_dn, associations)[source]

Returns the list of tenants to which a user has access.

model

alias of Project

class keystone.assignment.backends.ldap.RoleApi(conf, user_api)[source]

Bases: keystone.assignment.role_backends.ldap.RoleLdapStructureMixin, keystone.common.ldap.core.BaseLdap

add_user(role_id, role_dn, user_dn, user_id, tenant_id=None)[source]
delete_user(role_dn, user_dn, role_id)[source]
get_role_assignments(tenant_dn)[source]
list_global_roles_for_user(user_dn)[source]
list_project_roles_for_group(group_dn, project_subtree)[source]
list_project_roles_for_user(user_dn, project_subtree)[source]
list_role_assignments(project_tree_dn)[source]

List the role assignments linked to project_tree_dn attribute.

roles_delete_subtree_by_project(tenant_dn)[source]
roles_delete_subtree_by_role(role_id, tree_dn)[source]
class keystone.assignment.backends.ldap.UserRoleAssociation(user_dn=None, role_dn=None, tenant_dn=None, *args, **kw)[source]

Bases: object

Role Grant model.

keystone.assignment.backends.sql module

class keystone.assignment.backends.sql.Assignment[source]

Bases: keystone.assignment.core.AssignmentDriverV8

add_role_to_user_and_project(user_id, tenant_id, role_id)[source]
check_grant_role_id(role_id, user_id=None, group_id=None, domain_id=None, project_id=None, inherited_to_projects=False)[source]
create_grant(role_id, user_id=None, group_id=None, domain_id=None, project_id=None, inherited_to_projects=False)[source]
default_resource_driver()[source]
default_role_driver()[source]
delete_grant(role_id, user_id=None, group_id=None, domain_id=None, project_id=None, inherited_to_projects=False)[source]
delete_group_assignments(group_id)[source]
delete_project_assignments(project_id)[source]
delete_role_assignments(role_id)[source]
delete_user_assignments(user_id)[source]
list_domain_ids_for_groups(group_ids, inherited=False)[source]
list_domain_ids_for_user(user_id, group_ids, hints, inherited=False)[source]
list_grant_role_ids(user_id=None, group_id=None, domain_id=None, project_id=None, inherited_to_projects=False)[source]
list_project_ids_for_groups(group_ids, hints, inherited=False)[source]
list_project_ids_for_user(user_id, group_ids, hints, inherited=False)[source]
list_role_assignments(role_id=None, user_id=None, group_ids=None, domain_id=None, project_ids=None, inherited_to_projects=None)[source]
list_role_ids_for_groups_on_domain(group_ids, domain_id)[source]
list_role_ids_for_groups_on_project(group_ids, project_id, project_domain_id, project_parents)[source]
list_user_ids_for_project(tenant_id)[source]
remove_role_from_user_and_project(user_id, tenant_id, role_id)[source]
class keystone.assignment.backends.sql.AssignmentType[source]

Bases: object

GROUP_DOMAIN = 'GroupDomain'
GROUP_PROJECT = 'GroupProject'
USER_DOMAIN = 'UserDomain'
USER_PROJECT = 'UserProject'
classmethod calculate_type(user_id, group_id, project_id, domain_id)[source]
class keystone.assignment.backends.sql.RoleAssignment(*args, **kwargs)[source]

Bases: sqlalchemy.ext.declarative.api.Base, keystone.common.sql.core.DictBase

actor_id
attributes = ['type', 'actor_id', 'target_id', 'role_id', 'inherited']
inherited
role_id
target_id
to_dict()[source]

Override parent to_dict() method with a simpler implementation.

RoleAssignment doesn’t have non-indexed ‘extra’ attributes, so the parent implementation is not applicable.

type

Module contents