keystone.oauth1 package¶
Subpackages¶
Submodules¶
keystone.oauth1.controllers module¶
Extensions supporting OAuth1.
-
class
keystone.oauth1.controllers.
AccessTokenCrudV3
(*args, **kwargs)[source]¶ Bases:
keystone.common.controller.V3Controller
-
collection_name
= 'access_tokens'¶
-
member_name
= 'access_token'¶
-
-
class
keystone.oauth1.controllers.
AccessTokenRolesV3
(*args, **kwargs)[source]¶ Bases:
keystone.common.controller.V3Controller
-
collection_name
= 'roles'¶
-
member_name
= 'role'¶
-
-
class
keystone.oauth1.controllers.
ConsumerCrudV3
(*args, **kwargs)[source]¶ Bases:
keystone.common.controller.V3Controller
-
classmethod
base_url
(context, path=None)[source]¶ Construct a path and pass it to V3Controller.base_url method.
-
collection_name
= 'consumers'¶
-
member_name
= 'consumer'¶
-
classmethod
-
class
keystone.oauth1.controllers.
OAuthControllerV3
(*args, **kwargs)[source]¶ Bases:
keystone.common.controller.V3Controller
An authenticated user is going to authorize a request token.
As a security precaution, the requested roles must match those in the request token. Because this is in a CLI-only world at the moment, there is not another easy way to make sure the user knows which roles are being requested before authorizing.
-
collection_name
= 'not_used'¶
-
member_name
= 'not_used'¶
keystone.oauth1.core module¶
Main entry point into the OAuth1 service.
-
class
keystone.oauth1.core.
Manager
(*args, **kwargs)[source]¶ Bases:
keystone.common.manager.Manager
Default pivot point for the OAuth1 backend.
See
keystone.common.manager.Manager
for more details on how this dynamically calls the backend.-
driver_namespace
= 'keystone.oauth1'¶
-
-
class
keystone.oauth1.core.
Oauth1DriverV8
[source]¶ Bases:
object
Interface description for an OAuth1 driver.
Authorize request token.
Parameters: - request_token_id (string) – the id of the request token, to be authorized
- user_id (string) – the id of the authorizing user
- role_ids (list) – list of role ids to authorize
Returns: verifier
-
create_access_token
(request_id, access_token_duration)[source]¶ Create access token.
Parameters: - request_id (string) – the id of the request token, to be deleted
- access_token_duration (string) – duration of an access token
Returns: access_token_ref
-
create_consumer
(consumer_ref)[source]¶ Create consumer.
Parameters: consumer_ref (dict) – consumer ref with consumer name Returns: consumer_ref
-
create_request_token
(consumer_id, requested_project, request_token_duration)[source]¶ Create request token.
Parameters: - consumer_id (string) – the id of the consumer
- requested_project_id (string) – requested project id
- request_token_duration (string) – duration of request token
Returns: request_token_ref
-
delete_access_token
(user_id, access_token_id)[source]¶ Delete access token.
Parameters: - user_id (string) – authorizing user id
- access_token_id (string) – access token to delete
Returns: None
-
delete_consumer
(consumer_id)[source]¶ Delete consumer.
Parameters: consumer_id (string) – id of consumer to get Returns: None.
-
get_access_token
(access_token_id)[source]¶ Get access token.
Parameters: access_token_id (string) – the id of the access token Returns: access_token_ref
-
get_consumer
(consumer_id)[source]¶ Get consumer, returns the consumer id (key) and description.
Parameters: consumer_id (string) – id of consumer to get Returns: consumer_ref
-
get_consumer_with_secret
(consumer_id)[source]¶ Like get_consumer(), but also returns consumer secret.
Returned dictionary consumer_ref includes consumer secret. Secrets should only be shared upon consumer creation; the consumer secret is required to verify incoming OAuth requests.
Parameters: consumer_id (string) – id of consumer to get Returns: consumer_ref containing consumer secret
-
get_request_token
(request_token_id)[source]¶ Get request token.
Parameters: request_token_id (string) – the id of the request token Returns: request_token_ref
-
keystone.oauth1.core.
filter_consumer
(consumer_ref)[source]¶ Filter out private items in a consumer dict.
‘secret’ is never returned.
Returns: consumer_ref
keystone.oauth1.routers module¶
-
class
keystone.oauth1.routers.
Routers
[source]¶ Bases:
keystone.common.wsgi.RoutersBase
API Endpoints for the OAuth1 extension.
The goal of this extension is to allow third-party service providers to acquire tokens with a limited subset of a user’s roles for acting on behalf of that user. This is done using an oauth-similar flow and api.
The API looks like:
# Basic admin-only consumer crud POST /OS-OAUTH1/consumers GET /OS-OAUTH1/consumers PATCH /OS-OAUTH1/consumers/{consumer_id} GET /OS-OAUTH1/consumers/{consumer_id} DELETE /OS-OAUTH1/consumers/{consumer_id} # User access token crud GET /users/{user_id}/OS-OAUTH1/access_tokens GET /users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id} GET /users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id}/roles GET /users/{user_id}/OS-OAUTH1/access_tokens /{access_token_id}/roles/{role_id} DELETE /users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id} # OAuth interfaces POST /OS-OAUTH1/request_token # create a request token PUT /OS-OAUTH1/authorize # authorize a request token POST /OS-OAUTH1/access_token # create an access token
keystone.oauth1.schema module¶
keystone.oauth1.validator module¶
oAuthlib request validator.