The keystoneclient.middleware.auth_token Module

TOKEN-BASED AUTH MIDDLEWARE

This WSGI component:

  • Verifies that incoming client requests have valid tokens by validating tokens with the auth service.
  • Rejects unauthenticated requests UNLESS it is in ‘delay_auth_decision’ mode, which means the final decision is delegated to the downstream WSGI component (usually the OpenStack service)
  • Collects and forwards identity information based on a valid token such as user name, tenant, etc

Refer to: http://keystone.openstack.org/middlewarearchitecture.html

HEADERS

  • Headers starting with HTTP_ is a standard http header
  • Headers starting with HTTP_X is an extended http header

Coming in from initial call from client or customer

HTTP_X_AUTH_TOKEN
The client token being passed in.
HTTP_X_STORAGE_TOKEN
The client token being passed in (legacy Rackspace use) to support swift/cloud files

Used for communication between components

WWW-Authenticate
HTTP header returned to a user indicating which endpoint to use to retrieve a new token

What we add to the request for use by the OpenStack service

HTTP_X_IDENTITY_STATUS
‘Confirmed’ or ‘Invalid’ The underlying service will only see a value of ‘Invalid’ if the Middleware is configured to run in ‘delay_auth_decision’ mode
HTTP_X_TENANT_ID
Identity service managed unique identifier, string
HTTP_X_TENANT_NAME
Unique tenant identifier, string
HTTP_X_USER_ID
Identity-service managed unique identifier, string
HTTP_X_USER_NAME
Unique user identifier, string
HTTP_X_ROLES
Comma delimited list of case-sensitive Roles
HTTP_X_SERVICE_CATALOG
json encoded keystone service catalog (optional).
HTTP_X_TENANT
Deprecated in favor of HTTP_X_TENANT_ID and HTTP_X_TENANT_NAME Keystone-assigned unique identifier, deprecated
HTTP_X_USER
Deprecated in favor of HTTP_X_USER_ID and HTTP_X_USER_NAME Unique user name, string
HTTP_X_ROLE
Deprecated in favor of HTTP_X_ROLES This is being renamed, and the new header contains the same data.

OTHER ENVIRONMENT VARIABLES

keystone.token_info
Information about the token discovered in the process of validation. This may include extended information returned by the Keystone token validation call, as well as basic information about the tenant and user.
class keystoneclient.middleware.auth_token.AuthProtocol(app, conf)

Bases: object

Auth Middleware that handles authenticating client calls.

cert_file_missing(called_proc_err, file_name)
cms_verify(data)

Verifies the signature of the provided data’s IAW CMS syntax.

If either of the certificate files are missing, fetch them and retry.

fetch_ca_cert()
fetch_revocation_list(retry=True)
fetch_signing_cert()
get_admin_token()

Return admin token, possibly fetching a new one.

if self.admin_token_expiry is set from fetching an admin token, check it for expiration, and request a new token is the existing token is about to expire.

:return admin token id :raise ServiceError when unable to retrieve token from keystone

is_signed_token_revoked(signed_text)

Indicate whether the token appears in the revocation list.

token_revocation_list
token_revocation_list_fetched_time
verify_signed_token(signed_text)

Check that the token is unrevoked and has a valid signature.

verify_uuid_token(user_token, retry=True)

Authenticate user token with keystone.

Parameters:
  • user_token – user’s token id
  • retry – flag that forces the middleware to retry user authentication when an indeterminate response is received. Optional.

:return token object received from keystone on success :raise InvalidUserToken if token is rejected :raise ServiceError if unable to authenticate token

exception keystoneclient.middleware.auth_token.ConfigurationError

Bases: exceptions.Exception

exception keystoneclient.middleware.auth_token.InvalidUserToken

Bases: exceptions.Exception

exception keystoneclient.middleware.auth_token.ServiceError

Bases: exceptions.Exception

keystoneclient.middleware.auth_token.app_factory(global_conf, **local_conf)
keystoneclient.middleware.auth_token.filter_factory(global_conf, **local_conf)

Returns a WSGI filter app for use with paste.deploy.

keystoneclient.middleware.auth_token.safe_quote(s)

URL-encode strings that are not already URL-encoded.

keystoneclient.middleware.auth_token.will_expire_soon(expiry)

Determines if expiration is about to occur.

Parameters:expiry – a datetime of the expected expiration
Returns:boolean : true if expiration is within 30 seconds