keystone.auth package¶
Subpackages¶
- keystone.auth.plugins package
- Submodules
- keystone.auth.plugins.core module
- keystone.auth.plugins.external module
- keystone.auth.plugins.mapped module
- keystone.auth.plugins.oauth1 module
- keystone.auth.plugins.password module
- keystone.auth.plugins.saml2 module
- keystone.auth.plugins.token module
- keystone.auth.plugins.totp module
- Module contents
Submodules¶
keystone.auth.controllers module¶
-
class
keystone.auth.controllers.
Auth
(*args, **kw)[source]¶ Bases:
keystone.common.controller.V3Controller
-
collection_name
= 'tokens'¶
-
member_name
= 'token'¶
-
-
class
keystone.auth.controllers.
AuthContext
[source]¶ Bases:
dict
Retrofitting auth_context to reconcile identity attributes.
The identity attributes must not have conflicting values among the auth plug-ins. The only exception is expires_at, which is set to its earliest value.
-
IDENTITY_ATTRIBUTES
= frozenset(['access_token_id', 'project_id', 'user_id', 'domain_id', 'expires_at'])¶
-
-
class
keystone.auth.controllers.
AuthInfo
(*args, **kwargs)[source]¶ Bases:
object
Encapsulation of “auth” request.
-
get_scope
()[source]¶ Get scope information.
Verify and return the scoping information.
Returns: (domain_id, project_id, trust_ref, unscoped). If scope to a project, (None, project_id, None, None) will be returned. If scoped to a domain, (domain_id, None, None, None) will be returned. If scoped to a trust, (None, project_id, trust_ref, None), Will be returned, where the project_id comes from the trust definition. If unscoped, (None, None, None, ‘unscoped’) will be returned.
-
keystone.auth.core module¶
-
class
keystone.auth.core.
AuthMethodHandler
[source]¶ Bases:
object
Abstract base class for an authentication plugin.
-
authenticate
(context, auth_payload, auth_context)[source]¶ Authenticate user and return an authentication context.
Parameters: - context – keystone’s request context
- auth_payload – the content of the authentication for a given method
- auth_context – user authentication context, a dictionary shared by all plugins. It contains “method_names” and “extras” by default. “method_names” is a list and “extras” is a dictionary.
If successful, plugin must set
user_id
inauth_context
.method_name
is used to convey any additional authentication methods in case authentication is for re-scoping. For example, if the authentication is for re-scoping, plugin must append the previous method names intomethod_names
. Also, plugin may add any additional information intoextras
. Anything inextras
will be conveyed in the token’sextras
attribute. Here’s an example ofauth_context
on successful authentication:{ "extras": {}, "methods": [ "password", "token" ], "user_id": "abc123" }
Plugins are invoked in the order in which they are specified in the
methods
attribute of theidentity
object. For example,custom-plugin
is invoked beforepassword
, which is invoked beforetoken
in the following authentication request:{ "auth": { "identity": { "custom-plugin": { "custom-data": "sdfdfsfsfsdfsf" }, "methods": [ "custom-plugin", "password", "token" ], "password": { "user": { "id": "s23sfad1", "password": "secrete" } }, "token": { "id": "sdfafasdfsfasfasdfds" } } } }
Returns: None if authentication is successful. Authentication payload in the form of a dictionary for the next authentication step if this is a multi step authentication. Raises: keystone.exception.Unauthorized – for authentication failure
-