TOKEN-BASED AUTH MIDDLEWARE
This WSGI component:
- Verifies that incoming client requests have valid tokens by validating
tokens with the auth service.
- Rejects unauthenticated requests UNLESS it is in ‘delay_auth_decision’
mode, which means the final decision is delegated to the downstream WSGI
component (usually the OpenStack service)
- Collects and forwards identity information based on a valid token
such as user name, tenant, etc
Refer to: http://keystone.openstack.org/middlewarearchitecture.html
OTHER ENVIRONMENT VARIABLES
- keystone.token_info
- Information about the token discovered in the process of
validation. This may include extended information returned by the
Keystone token validation call, as well as basic information about
the tenant and user.
-
class keystoneclient.middleware.auth_token.AuthProtocol(app, conf)
Bases: object
Auth Middleware that handles authenticating client calls.
-
cert_file_missing(called_proc_err, file_name)
-
cms_verify(data)
Verifies the signature of the provided data’s IAW CMS syntax.
If either of the certificate files are missing, fetch them and
retry.
-
fetch_ca_cert()
-
fetch_revocation_list(retry=True)
-
fetch_signing_cert()
-
get_admin_token()
Return admin token, possibly fetching a new one.
if self.admin_token_expiry is set from fetching an admin token, check
it for expiration, and request a new token is the existing token
is about to expire.
:return admin token id
:raise ServiceError when unable to retrieve token from keystone
-
is_signed_token_revoked(signed_text)
Indicate whether the token appears in the revocation list.
-
token_revocation_list
-
token_revocation_list_fetched_time
-
verify_signed_token(signed_text)
Check that the token is unrevoked and has a valid signature.
-
verify_uuid_token(user_token, retry=True)
Authenticate user token with keystone.
Parameters: |
- user_token – user’s token id
- retry – flag that forces the middleware to retry
user authentication when an indeterminate
response is received. Optional.
|
:return token object received from keystone on success
:raise InvalidUserToken if token is rejected
:raise ServiceError if unable to authenticate token
-
exception keystoneclient.middleware.auth_token.ConfigurationError
Bases: exceptions.Exception
-
exception keystoneclient.middleware.auth_token.InvalidUserToken
Bases: exceptions.Exception
-
exception keystoneclient.middleware.auth_token.ServiceError
Bases: exceptions.Exception
-
keystoneclient.middleware.auth_token.app_factory(global_conf, **local_conf)
-
keystoneclient.middleware.auth_token.filter_factory(global_conf, **local_conf)
Returns a WSGI filter app for use with paste.deploy.
-
keystoneclient.middleware.auth_token.safe_quote(s)
URL-encode strings that are not already URL-encoded.
-
keystoneclient.middleware.auth_token.will_expire_soon(expiry)
Determines if expiration is about to occur.
Parameters: | expiry – a datetime of the expected expiration |
Returns: | boolean : true if expiration is within 30 seconds |