keystone.tests.unit package

keystone.tests.unit package

Subpackages

Submodules

keystone.tests.unit.core module

class keystone.tests.unit.core.BaseTestCase(*args, **kwargs)[source]

Bases: testtools.testcase.TestCase

Light weight base test class.

This is a placeholder that will eventually go away once the setup/teardown in TestCase is properly trimmed down to the bare essentials. This is really just a play to speed up the tests by eliminating unnecessary work.

cleanup_instance(*names)[source]

Create a function suitable for use with self.addCleanup.

Returns:a callable that uses a closure to delete instance attributes
setUp()[source]
skip_if_env_not_set(env_var)[source]
skip_test_overrides(*args, **kwargs)[source]
class keystone.tests.unit.core.EggLoader(spec)[source]

Bases: paste.deploy.loadwsgi.EggLoader

find_egg_entry_point(object_type, name=None)[source]
class keystone.tests.unit.core.SQLDriverOverrides[source]

Bases: object

A mixin for consolidating sql-specific test overrides.

config_overrides()[source]
class keystone.tests.unit.core.TestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.BaseTestCase

assertCloseEnoughForGovernmentWork(a, b, delta=3)[source]

Assert that two datetimes are nearly equal within a small delta.

Parameters:delta – Maximum allowable time delta, defined in seconds.
assertNotEmpty(l)[source]
assertTimestampEqual(expected, value)[source]
assertUserDictEqual(expected, observed, message='')[source]

Assert that a user dict is equal to another user dict.

User dictionaries have some variable values that should be ignored in the comparison. This method is a helper that strips those elements out when comparing the user dictionary. This normalized these differences that should not change the comparison.

config(config_files)[source]
config_files()[source]
config_overrides()[source]
ipv6_enabled
load_backends()[source]

Initialize each manager and assigns them to an attribute.

load_fixtures(fixtures)[source]

Hacky basic and naive fixture loading based on a python module.

Expects that the various APIs into the various services are already defined on self.

loadapp(config, name='main')[source]
make_request(path='/', **kwargs)[source]
setUp()[source]
skip_if_no_ipv6()[source]
exception keystone.tests.unit.core.UnexpectedExit[source]

Bases: exceptions.Exception

keystone.tests.unit.core.create_user(api, domain_id, **kwargs)[source]

Create a user via the API. Keep the created password.

The password is saved and restored when api.create_user() is called. Only use this routine if there is a requirement for the user object to have a valid password after api.create_user() is called.

class keystone.tests.unit.core.dirs[source]

Bases: object

static etc(*p)[source]
static root(*p)[source]
static tests(*p)[source]
static tests_conf(*p)[source]
static tmp(*p)[source]
keystone.tests.unit.core.new_cert_credential(user_id, project_id=None, blob=None, **kwargs)[source]
keystone.tests.unit.core.new_credential_ref(user_id, project_id=None, type='cert', **kwargs)[source]
keystone.tests.unit.core.new_domain_ref(**kwargs)[source]
keystone.tests.unit.core.new_ec2_credential(user_id, project_id=None, blob=None, **kwargs)[source]
keystone.tests.unit.core.new_endpoint_ref(service_id, interface='public', region_id=<object object>, **kwargs)[source]
keystone.tests.unit.core.new_endpoint_ref_with_region(service_id, region, interface='public', **kwargs)[source]

Define an endpoint_ref having a pre-3.2 form.

Contains the deprecated ‘region’ instead of ‘region_id’.

keystone.tests.unit.core.new_federated_user_ref(idp_id=None, protocol_id=None, **kwargs)[source]
keystone.tests.unit.core.new_group_ref(domain_id, **kwargs)[source]
keystone.tests.unit.core.new_limit_ref(**kwargs)[source]
keystone.tests.unit.core.new_policy_ref(**kwargs)[source]
keystone.tests.unit.core.new_project_ref(domain_id=None, is_domain=False, **kwargs)[source]
keystone.tests.unit.core.new_region_ref(parent_region_id=None, **kwargs)[source]
keystone.tests.unit.core.new_registered_limit_ref(**kwargs)[source]
keystone.tests.unit.core.new_role_ref(**kwargs)[source]
keystone.tests.unit.core.new_service_ref(**kwargs)[source]
keystone.tests.unit.core.new_totp_credential(user_id, project_id=None, blob=None)[source]
keystone.tests.unit.core.new_trust_ref(trustor_user_id, trustee_user_id, project_id=None, impersonation=None, expires=None, role_ids=None, role_names=None, remaining_uses=None, allow_redelegation=False, redelegation_count=None, **kwargs)[source]
keystone.tests.unit.core.new_user_ref(domain_id, project_id=None, **kwargs)[source]
keystone.tests.unit.core.remove_test_databases()[source]
keystone.tests.unit.core.skip_if_cache_disabled(*sections)[source]

Skip a test if caching is disabled, this is a decorator.

Caching can be disabled either globally or for a specific section.

In the code fragment:

@skip_if_cache_is_disabled('assignment', 'token')
def test_method(*args):
    ...

The method test_method would be skipped if caching is disabled globally via the enabled option in the cache section of the configuration or if the caching option is set to false in either assignment or token sections of the configuration. This decorator can be used with no arguments to only check global caching.

If a specified configuration section does not define the caching option, this decorator makes the same assumption as the should_cache_fn in keystone.common.cache that caching should be enabled.

keystone.tests.unit.core.skip_if_cache_is_enabled(*sections)[source]
keystone.tests.unit.core.skip_if_no_multiple_domains_support(f)[source]

Decorator to skip tests for identity drivers limited to one domain.

keystone.tests.unit.default_fixtures module

keystone.tests.unit.fakeldap module

Fake LDAP server for test harness.

This class does very little error checking, and knows nothing about ldap class definitions. It implements the minimum emulation of the python ldap library to work with keystone.

class keystone.tests.unit.fakeldap.FakeLdap(conn=None)[source]

Bases: keystone.identity.backends.ldap.common.LDAPHandler

Emulate the python-ldap API.

The python-ldap API requires all strings to be UTF-8 encoded. This is assured by the caller of this interface (i.e. KeystoneLDAPHandler).

However, internally this emulation MUST process and store strings in a canonical form which permits operations on characters. Encoded strings do not provide the ability to operate on characters. Therefore this emulation accepts UTF-8 encoded strings, decodes them to unicode for operations internal to this emulation, and encodes them back to UTF-8 when returning values from the emulation.

add_s(dn, modlist)[source]

Add an object with the specified attributes at dn.

connect(url, page_size=0, alias_dereferencing=None, use_tls=False, tls_cacertfile=None, tls_cacertdir=None, tls_req_cert='demand', chase_referrals=None, debug_level=None, use_pool=None, pool_size=None, pool_retry_max=None, pool_retry_delay=None, pool_conn_timeout=None, pool_conn_lifetime=None, conn_timeout=None)[source]
delete_ext_s(dn, serverctrls, clientctrls=None)[source]

Remove the ldap object at specified dn.

delete_s(dn)[source]

Remove the ldap object at specified dn.

dn(dn)[source]
get_option(option)[source]
key(dn)[source]
modify_s(dn, modlist)[source]

Modify the object at dn using the attribute list.

Parameters:
  • dn – an LDAP DN
  • modlist – a list of tuples in the following form: ([MOD_ADD | MOD_DELETE | MOD_REPACE], attribute, value)
result3(msgid=-1, all=1, timeout=None, resp_ctrl_classes=None)[source]

Execute async request.

Only msgid param is supported. Request info is fetched from global variable PendingRequests by msgid, executed using search_s and limited if requested.

search_ext(base, scope, filterstr='(objectClass=*)', attrlist=None, attrsonly=0, serverctrls=None, clientctrls=None, timeout=-1, sizelimit=0)[source]
search_s(base, scope, filterstr='(objectClass=*)', attrlist=None, attrsonly=0)[source]

Search for all matching objects under base using the query.

Args: base – dn to search under scope – search scope (base, subtree, onelevel) filterstr – filter objects by attrlist – attrs to return. Returns all attrs if not specified

set_option(option, invalue)[source]
simple_bind_s(who='', cred='', serverctrls=None, clientctrls=None)[source]

Provide for compatibility but this method is ignored.

unbind_s()[source]

Provide for compatibility but this method is ignored.

class keystone.tests.unit.fakeldap.FakeLdapNoSubtreeDelete(conn=None)[source]

Bases: keystone.tests.unit.fakeldap.FakeLdap

FakeLdap subclass that does not support subtree delete.

Same as FakeLdap except delete will throw the LDAP error ldap.NOT_ALLOWED_ON_NONLEAF if there is an attempt to delete an entry that has children.

delete_ext_s(dn, serverctrls, clientctrls=None)[source]

Remove the ldap object at specified dn.

class keystone.tests.unit.fakeldap.FakeLdapPool(uri, retry_max=None, retry_delay=None, conn=None)[source]

Bases: keystone.tests.unit.fakeldap.FakeLdap

Emulate the python-ldap API with pooled connections.

This class is used as connector class in PooledLDAPHandler.

get_lifetime()[source]
simple_bind_s(who=None, cred=None, serverctrls=None, clientctrls=None)[source]
unbind_ext_s()[source]

Added to extend FakeLdap as connector class.

class keystone.tests.unit.fakeldap.FakeShelve[source]

Bases: dict

sync()[source]

keystone.tests.unit.federation_fixtures module

keystone.tests.unit.filtering module

class keystone.tests.unit.filtering.FilterTests[source]

Bases: object

keystone.tests.unit.identity_mapping module

keystone.tests.unit.identity_mapping.list_id_mappings()[source]

List all id_mappings for testing purposes.

keystone.tests.unit.mapping_fixtures module

Fixtures for Federation Mapping.

keystone.tests.unit.rest module

class keystone.tests.unit.rest.RestfulTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.TestCase

Performs restful tests against the WSGI app over HTTP.

This class launches public & admin WSGI servers for every test, which can be accessed by calling public_request() or admin_request(), respectfully.

restful_request() and request() methods are also exposed if you need to bypass restful conventions or access HTTP details in your test implementation.

Three new asserts are provided:

  • assertResponseSuccessful: called automatically for every request
    unless an expected_status is provided
  • assertResponseStatus: called instead of assertResponseSuccessful,
    if an expected_status is provided
  • assertValidResponseHeaders: validates that the response headers
    appear as expected

Requests are automatically serialized according to the defined content_type. Responses are automatically deserialized as well, and available in the response.body attribute. The original body content is available in the response.raw attribute.

admin_request(**kwargs)[source]
assertResponseStatus(response, expected_status)[source]

Assert a specific status code on the response.

Parameters:
  • responsehttplib.HTTPResponse
  • expected_status – The specific status result expected

example:

self.assertResponseStatus(response, http_client.NO_CONTENT)
assertResponseSuccessful(response)[source]

Assert that a status code lies inside the 2xx range.

Parameters:responsehttplib.HTTPResponse to be verified to have a status code between 200 and 299.

example:

self.assertResponseSuccessful(response)
assertValidErrorResponse(response, expected_status=400)[source]

Verify that the error response is valid.

Subclasses can override this function based on the expected response.

assertValidResponseHeaders(response)[source]

Ensure that response headers appear as expected.

auth_plugin_config_override(methods=None, **method_classes)[source]
content_type = 'json'
get_admin_token()[source]
get_scoped_token(tenant_id=None)[source]

Convenience method so that we can test authenticated requests.

get_unscoped_token()[source]

Convenience method so that we can test authenticated requests.

public_request(**kwargs)[source]
request(app, path, body=None, headers=None, token=None, expected_status=None, **kwargs)[source]
restful_request(method='GET', headers=None, body=None, content_type=None, response_content_type=None, **kwargs)[source]

Serialize/deserialize json as request/response body.

Warning

  • Existing Accept header will be overwritten.
  • Existing Content-Type header will be overwritten.
setUp(app_conf='keystone')[source]

keystone.tests.unit.test_associate_project_endpoint_extension module

class keystone.tests.unit.test_associate_project_endpoint_extension.EndpointFilterCRUDTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.test_associate_project_endpoint_extension.EndpointFilterTestCase

test_check_endpoint_project_association()[source]

HEAD /OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id}.

Valid project and endpoint id test case.

test_check_endpoint_project_association_with_invalid_endpoint()[source]

HEAD /OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id}.

Invalid endpoint id test case.

test_check_endpoint_project_association_with_invalid_project()[source]

HEAD /OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id}.

Invalid project id test case.

test_create_endpoint_project_association()[source]

PUT /OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id}.

Valid endpoint and project id test case.

test_create_endpoint_project_association_invalidates_cache(*args, **kwargs)[source]
test_create_endpoint_project_association_with_invalid_endpoint()[source]

PUT /OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id}.

Invalid endpoint id test case.

test_create_endpoint_project_association_with_invalid_project()[source]

PUT OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id}.

Invalid project id test case.

test_create_endpoint_project_association_with_unexpected_body()[source]

PUT /OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id}.

Unexpected body in request. The body should be ignored.

test_endpoint_project_association_cleanup_when_endpoint_deleted()[source]
test_endpoint_project_association_cleanup_when_project_deleted()[source]
test_get_endpoint_project_association()[source]

GET /OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id}.

Valid project and endpoint id test case.

test_get_endpoint_project_association_with_invalid_endpoint()[source]

GET /OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id}.

Invalid endpoint id test case.

test_get_endpoint_project_association_with_invalid_project()[source]

GET /OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id}.

Invalid project id test case.

test_list_endpoints_associated_with_invalid_project()[source]

GET & HEAD /OS-EP-FILTER/projects/{project_id}/endpoints.

Invalid project id test case.

test_list_endpoints_associated_with_valid_project()[source]

GET & HEAD /OS-EP-FILTER/projects/{project_id}/endpoints.

Valid project and endpoint id test case.

test_list_projects_associated_with_endpoint()[source]

GET & HEAD /OS-EP-FILTER/endpoints/{endpoint_id}/projects.

Valid endpoint-project association test case.

test_list_projects_associated_with_invalid_endpoint()[source]

GET & HEAD /OS-EP-FILTER/endpoints/{endpoint_id}/projects.

Invalid endpoint id test case.

test_list_projects_with_no_endpoint_project_association()[source]

GET & HEAD /OS-EP-FILTER/endpoints/{endpoint_id}/projects.

Valid endpoint id but no endpoint-project associations test case.

test_remove_endpoint_from_project_invalidates_cache(*args, **kwargs)[source]
test_remove_endpoint_project_association()[source]

DELETE /OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id}.

Valid project id and endpoint id test case.

test_remove_endpoint_project_association_with_invalid_endpoint()[source]

DELETE /OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id}.

Invalid endpoint id test case.

test_remove_endpoint_project_association_with_invalid_project()[source]

DELETE /OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id}.

Invalid project id test case.

class keystone.tests.unit.test_associate_project_endpoint_extension.EndpointFilterTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.test_v3.RestfulTestCase

setUp()[source]
class keystone.tests.unit.test_associate_project_endpoint_extension.EndpointFilterTokenRequestTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.test_associate_project_endpoint_extension.EndpointFilterTestCase

test_default_scoped_token_using_endpoint_filter()[source]

Verify endpoints from default scoped token filtered.

test_disabled_endpoint()[source]

Test that a disabled endpoint is handled.

test_get_auth_catalog_using_endpoint_filter()[source]
test_invalid_endpoint_project_association()[source]

Verify an invalid endpoint-project association is handled.

test_multiple_endpoint_project_associations()[source]
test_project_scoped_token_using_endpoint_filter()[source]

Verify endpoints from project scoped token filtered.

test_scoped_token_with_no_catalog_using_endpoint_filter()[source]

Verify endpoint filter does not affect no catalog.

class keystone.tests.unit.test_associate_project_endpoint_extension.EndpointGroupCRUDTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.test_associate_project_endpoint_extension.EndpointFilterTestCase

DEFAULT_ENDPOINT_GROUP_BODY = {'endpoint_group': {'description': 'endpoint group description', 'filters': {'interface': 'admin'}, 'name': 'endpoint_group_name'}}
DEFAULT_ENDPOINT_GROUP_URL = '/OS-EP-FILTER/endpoint_groups'
test_add_endpoint_group_to_project()[source]

Create a valid endpoint group and project association.

test_add_endpoint_group_to_project_invalidates_catalog_cache(*args, **kwargs)[source]
test_add_endpoint_group_to_project_with_invalid_project_id()[source]

Create an invalid endpoint group and project association.

test_check_endpoint_group()[source]

HEAD /OS-EP-FILTER/endpoint_groups/{endpoint_group_id}.

Valid endpoint_group_id test case.

test_check_endpoint_group_to_project()[source]

Test HEAD with a valid endpoint group and project association.

test_check_endpoint_group_to_project_with_invalid_project_id()[source]

Test HEAD with an invalid endpoint group and project association.

test_check_invalid_endpoint_group()[source]

HEAD /OS-EP-FILTER/endpoint_groups/{endpoint_group_id}.

Invalid endpoint_group_id test case.

test_create_endpoint_group()[source]

POST /OS-EP-FILTER/endpoint_groups.

Valid endpoint group test case.

test_create_invalid_endpoint_group()[source]

POST /OS-EP-FILTER/endpoint_groups.

Invalid endpoint group creation test case.

test_delete_endpoint_group()[source]

GET /OS-EP-FILTER/endpoint_groups/{endpoint_group}.

Valid endpoint group test case.

test_delete_invalid_endpoint_group()[source]

GET /OS-EP-FILTER/endpoint_groups/{endpoint_group}.

Invalid endpoint group test case.

test_empty_endpoint_groups_in_project()[source]

Test when no endpoint groups associated with the project.

test_endpoint_group_project_cleanup_with_endpoint_group()[source]
test_endpoint_group_project_cleanup_with_project()[source]
test_get_endpoint_group()[source]

GET /OS-EP-FILTER/endpoint_groups/{endpoint_group}.

Valid endpoint group test case.

test_get_endpoint_group_in_project()[source]

Test retrieving project endpoint group association.

test_get_invalid_endpoint_group()[source]

GET /OS-EP-FILTER/endpoint_groups/{endpoint_group}.

Invalid endpoint group test case.

test_get_invalid_endpoint_group_in_project()[source]

Test retrieving project endpoint group association.

test_list_endpoint_groups()[source]

GET & HEAD /OS-EP-FILTER/endpoint_groups.

test_list_endpoint_groups_in_invalid_project()[source]

Test retrieving from invalid project.

test_list_endpoint_groups_in_project()[source]

GET & HEAD /OS-EP-FILTER/projects/{project_id}/endpoint_groups.

test_list_endpoints_associated_with_endpoint_group()[source]

GET & HEAD /OS-EP-FILTER/endpoint_groups/{endpoint_group}/endpoints.

Valid endpoint group test case.

test_list_endpoints_associated_with_project_endpoint_group()[source]

GET & HEAD /OS-EP-FILTER/projects/{project_id}/endpoints.

Valid project, endpoint id, and endpoint group test case.

test_list_projects_associated_with_endpoint_group()[source]

GET & HEAD /OS-EP-FILTER/endpoint_groups/{endpoint_group}/projects.

Valid endpoint group test case.

test_patch_endpoint_group()[source]

PATCH /OS-EP-FILTER/endpoint_groups/{endpoint_group}.

Valid endpoint group patch test case.

test_patch_invalid_endpoint_group()[source]

PATCH /OS-EP-FILTER/endpoint_groups/{endpoint_group}.

Valid endpoint group patch test case.

test_patch_nonexistent_endpoint_group()[source]

PATCH /OS-EP-FILTER/endpoint_groups/{endpoint_group}.

Invalid endpoint group patch test case.

test_remove_endpoint_group_from_project_invalidates_cache(*args, **kwargs)[source]
test_remove_endpoint_group_with_project_association()[source]
test_removing_an_endpoint_group_project()[source]
class keystone.tests.unit.test_associate_project_endpoint_extension.JsonHomeTests(*args, **kwargs)[source]

Bases: keystone.tests.unit.test_associate_project_endpoint_extension.EndpointFilterTestCase, keystone.tests.unit.test_v3.JsonHomeTestMixin

JSON_HOME_DATA = {'https://docs.openstack.org/api/openstack-identity/3/ext/OS-EP-FILTER/1.0/rel/endpoint_group': {'href-template': '/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}', 'href-vars': {'endpoint_group_id': 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-EP-FILTER/1.0/param/endpoint_group_id'}}, 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-EP-FILTER/1.0/rel/project_endpoint_groups': {'href-template': '/OS-EP-FILTER/projects/{project_id}/endpoint_groups', 'href-vars': {'project_id': 'https://docs.openstack.org/api/openstack-identity/3/param/project_id'}}, 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-EP-FILTER/1.0/rel/endpoint_group_to_project_association': {'href-template': '/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/projects/{project_id}', 'href-vars': {'endpoint_group_id': 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-EP-FILTER/1.0/param/endpoint_group_id', 'project_id': 'https://docs.openstack.org/api/openstack-identity/3/param/project_id'}}, 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-EP-FILTER/1.0/rel/projects_associated_with_endpoint_group': {'href-template': '/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/projects', 'href-vars': {'endpoint_group_id': 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-EP-FILTER/1.0/param/endpoint_group_id'}}, 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-EP-FILTER/1.0/rel/endpoint_projects': {'href-template': '/OS-EP-FILTER/endpoints/{endpoint_id}/projects', 'href-vars': {'endpoint_id': 'https://docs.openstack.org/api/openstack-identity/3/param/endpoint_id'}}, 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-EP-FILTER/1.0/rel/endpoints_in_endpoint_group': {'href-template': '/OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/endpoints', 'href-vars': {'endpoint_group_id': 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-EP-FILTER/1.0/param/endpoint_group_id'}}, 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-EP-FILTER/1.0/rel/endpoint_groups': {'href': '/OS-EP-FILTER/endpoint_groups'}}

keystone.tests.unit.test_auth_plugin module

keystone.tests.unit.test_backend_endpoint_policy module

class keystone.tests.unit.test_backend_endpoint_policy.PolicyAssociationTests[source]

Bases: object

load_sample_data()[source]

Create sample data to test policy associations.

The following data is created:

  • 3 regions, in a hierarchy, 0 -> 1 -> 2 (where 0 is top)
  • 3 services
  • 6 endpoints, 2 in each region, with a mixture of services: 0 - region 0, Service 0 1 - region 0, Service 1 2 - region 1, Service 1 3 - region 1, Service 2 4 - region 2, Service 2 5 - region 2, Service 0
test_delete_association_by_entity()[source]
test_invalid_policy_to_endpoint_association()[source]
test_overwriting_policy_to_endpoint_association()[source]
test_policy_to_endpoint_association_crud()[source]
test_policy_to_explicit_endpoint_association()[source]
test_policy_to_region_and_service_association()[source]
test_policy_to_service_association()[source]

keystone.tests.unit.test_backend_endpoint_policy_sql module

keystone.tests.unit.test_backend_federation_sql module

keystone.tests.unit.test_backend_id_mapping_sql module

keystone.tests.unit.test_backend_ldap module

keystone.tests.unit.test_backend_ldap_pool module

keystone.tests.unit.test_backend_rules module

class keystone.tests.unit.test_backend_rules.RulesPolicy(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.TestCase, keystone.tests.unit.policy.test_backends.PolicyTests

config_overrides()[source]
setUp()[source]
test_create()[source]
test_delete()[source]
test_delete_policy_returns_not_found()[source]
test_get()[source]
test_get_policy_returns_not_found()[source]
test_list()[source]
test_update()[source]
test_update_policy_returns_not_found()[source]

keystone.tests.unit.test_backend_sql module

keystone.tests.unit.test_backend_templated module

keystone.tests.unit.test_cli module

keystone.tests.unit.test_config module

class keystone.tests.unit.test_config.ConfigTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.TestCase

config_files()[source]
test_config_default()[source]
test_paste_config()[source]
test_profiler_config_default()[source]

Check config.set_config_defaults() has set [profiler]enabled.

class keystone.tests.unit.test_config.DeprecatedOverrideTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.TestCase

Test using the deprecated AND new name for renamed options.

config_files()[source]
test_sql()[source]
class keystone.tests.unit.test_config.DeprecatedTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.TestCase

Test using the original (deprecated) name for renamed options.

config_files()[source]
test_sql()[source]

keystone.tests.unit.test_contrib_ec2_core module

class keystone.tests.unit.test_contrib_ec2_core.EC2ContribCoreV2(*args, **kwargs)[source]

Bases: keystone.tests.unit.rest.RestfulTestCase

assertValidAuthenticationResponse(r)[source]
assertValidErrorResponse(r)[source]
config_overrides()[source]
test_authenticate_with_empty_body_returns_bad_request()[source]
test_authenticate_without_json_request_returns_bad_request()[source]
test_authenticate_without_proper_secret_returns_unauthorized()[source]
test_authenticate_without_request_body_returns_bad_request()[source]
test_valid_authentication_response_with_proper_secret()[source]
class keystone.tests.unit.test_contrib_ec2_core.EC2ContribCoreV3(*args, **kwargs)[source]

Bases: keystone.tests.unit.test_v3.RestfulTestCase

setUp()[source]
test_authenticate_with_empty_body_returns_bad_request()[source]
test_authenticate_without_json_request_returns_bad_request()[source]
test_authenticate_without_proper_secret_returns_unauthorized()[source]
test_authenticate_without_request_body_returns_bad_request()[source]
test_valid_authentication_response_with_proper_secret()[source]

keystone.tests.unit.test_contrib_s3_core module

class keystone.tests.unit.test_contrib_s3_core.S3ContribCore(*args, **kwargs)[source]

Bases: keystone.tests.unit.test_v3.RestfulTestCase

setUp()[source]
test_bad_request()[source]
test_bad_response()[source]
test_bad_signature_v1()[source]
test_bad_signature_v4()[source]
test_bad_token_v4()[source]
test_good_response()[source]
test_good_signature_v1()[source]
test_good_signature_v4()[source]

keystone.tests.unit.test_contrib_simple_cert module

class keystone.tests.unit.test_contrib_simple_cert.BaseTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.test_v3.RestfulTestCase

CA_PATH = '/v3/OS-SIMPLE-CERT/ca'
CERT_PATH = '/v3/OS-SIMPLE-CERT/certificates'
class keystone.tests.unit.test_contrib_simple_cert.TestSimpleCert(*args, **kwargs)[source]

Bases: keystone.tests.unit.test_contrib_simple_cert.BaseTestCase

request_cert(path)[source]
test_ca_cert()[source]
test_missing_file()[source]
test_signing_cert()[source]

keystone.tests.unit.test_credential module

class keystone.tests.unit.test_credential.V2CredentialEc2Controller(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.TestCase

setUp()[source]
test_check_non_admin_user()[source]

Checking if user is admin causes uncaught error.

When checking if a user is an admin, keystone.exception.Unauthorized is raised but not caught if the user is not an admin.

test_signature_validate_invalid_signature()[source]

Signature is not signed on the correct data.

test_signature_validate_no_host_port()[source]

Test signature validation with the access/secret provided.

test_signature_validate_no_signature()[source]

Signature is not presented in signature reference data.

test_signature_validate_with_host_port()[source]

Test signature validation when host is bound with port.

Host is bound with a port, generally, the port here is not the standard port for the protocol, like ‘80’ for HTTP and port 443 for HTTPS, the port is not omitted by the client library.

test_signature_validate_with_missed_host_port()[source]

Test signature validation when host is bound with well-known port.

Host is bound with a port, but the port is well-know port like ‘80’ for HTTP and port 443 for HTTPS, sometimes, client library omit the port but then make the request with the port. see (How to create the string to sign): ‘http://docs.aws.amazon.com/ general/latest/gr/signature-version-2.html’.

Since “credentials[‘host’]” is not set by client library but is taken from “req.host”, so caused the differences.

class keystone.tests.unit.test_credential.V2CredentialEc2TestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.test_v3.RestfulTestCase

assertValidErrorResponse(r)[source]
test_ec2_cannot_get_non_ec2_credential()[source]
test_ec2_list_credentials()[source]

keystone.tests.unit.test_driver_hints module

class keystone.tests.unit.test_driver_hints.ListHintsTests(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.TestCase

test_create_iterate_satisfy()[source]
test_limits()[source]
test_multiple_creates()[source]

keystone.tests.unit.test_entry_points module

class keystone.tests.unit.test_entry_points.TestPasteDeploymentEntryPoints(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.TestCase

test_entry_point_middleware()[source]

Assert that our list of expected middleware is present.

keystone.tests.unit.test_exception module

class keystone.tests.unit.test_exception.ExceptionTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.BaseTestCase

assertValidJsonRendering(e)[source]
test_all_json_renderings()[source]

Everything callable in the exception module should be renderable.

… except for the base error class (exception.Error), which is not user-facing.

This test provides a custom message to bypass docstring parsing, which should be tested separately.

test_forbidden_title()[source]
test_invalid_unicode_string()[source]
test_not_found()[source]
test_unicode_message()[source]
test_unicode_string()[source]
test_validation_error()[source]
class keystone.tests.unit.test_exception.SecurityErrorTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.test_exception.ExceptionTestCase

Test whether security-related info is exposed to the API user.

setUp()[source]
test_forbidden_action_exposure()[source]
test_forbidden_action_exposure_in_debug()[source]
test_forbidden_action_no_message()[source]
test_forbidden_exposure()[source]
test_forbidden_exposure_in_debug()[source]
test_unauthorized_exposure()[source]
test_unauthorized_exposure_in_debug()[source]
test_unicode_argument_message()[source]
class keystone.tests.unit.test_exception.TestSecurityErrorTranslation(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.BaseTestCase

Test i18n for SecurityError exceptions.

exception CustomError(message=None, **kwargs)[source]

Bases: keystone.exception.Error

message_format = 'We had a failure in the %(place)r'
exception CustomSecurityError(message=None, **kwargs)[source]

Bases: keystone.exception.SecurityError

message_format = 'We had a failure in the %(place)r'
setUp()[source]
test_nested_translation_of_SecurityErrors()[source]
test_that_regular_Errors_can_be_deep_copied()[source]
class keystone.tests.unit.test_exception.UnexpectedExceptionTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.test_exception.ExceptionTestCase

Test if internal info is exposed to the API user on UnexpectedError.

exception SubClassExc(message=None, **kwargs)[source]

Bases: keystone.exception.UnexpectedError

debug_message_format = 'Debug Message: %(debug_info)s'
setUp()[source]
test_unexpected_error_custom_message_binary_debug()[source]
test_unexpected_error_custom_message_debug()[source]
test_unexpected_error_custom_message_exception_debug()[source]
test_unexpected_error_custom_message_no_debug()[source]
test_unexpected_error_debug()[source]
test_unexpected_error_no_debug()[source]
test_unexpected_error_subclass_debug()[source]
test_unexpected_error_subclass_no_debug()[source]

keystone.tests.unit.test_hacking_checks module

keystone.tests.unit.test_ldap_livetest module

keystone.tests.unit.test_ldap_pool_livetest module

keystone.tests.unit.test_ldap_tls_livetest module

keystone.tests.unit.test_limits module

class keystone.tests.unit.test_limits.LimitsTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.test_v3.RestfulTestCase

Test limits CRUD.

setUp()[source]
test_create_limit()[source]
test_create_limit_duplicate()[source]
test_create_limit_with_invalid_input()[source]
test_create_limit_without_reference_registered_limit(*args, **kwargs)[source]
test_create_limit_without_region()[source]
test_create_multi_limit()[source]
test_delete_limit()[source]
test_list_limit()[source]
test_show_limit()[source]
test_update_limit()[source]
test_update_limit_not_found()[source]
test_update_limit_with_invalid_input()[source]
test_update_multi_limit()[source]
class keystone.tests.unit.test_limits.RegisteredLimitsTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.test_v3.RestfulTestCase

Test registered_limits CRUD.

setUp()[source]
test_create_multi_registered_limit()[source]
test_create_registered_limit()[source]
test_create_registered_limit_duplicate()[source]
test_create_registered_limit_with_invalid_input()[source]
test_create_registered_limit_without_region()[source]
test_delete_registered_limit()[source]
test_delete_registered_limit_with_referenced_limit(*args, **kwargs)[source]
test_list_registered_limit()[source]
test_show_registered_limit()[source]
test_update_multi_registered_limit()[source]
test_update_registered_limit()[source]
test_update_registered_limit_not_found()[source]
test_update_registered_limit_with_invalid_input()[source]
test_update_registered_limit_with_referenced_limit(*args, **kwargs)[source]

keystone.tests.unit.test_middleware module

keystone.tests.unit.test_policy module

keystone.tests.unit.test_revoke module

keystone.tests.unit.test_shadow_users module

class keystone.tests.unit.test_shadow_users.ShadowUsersTests(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.TestCase, keystone.tests.unit.identity.shadow_users.test_backend.ShadowUsersBackendTests, keystone.tests.unit.identity.shadow_users.test_core.ShadowUsersCoreTests

setUp()[source]

keystone.tests.unit.test_sql_banned_operations module

keystone.tests.unit.test_sql_upgrade module

keystone.tests.unit.test_token_bind module

class keystone.tests.unit.test_token_bind.BindTest(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.TestCase

Test binding tokens to a Principal.

Even though everything in this file references kerberos the same concepts will apply to all future binding mechanisms.

assert_kerberos_bind(tokens, bind_level, use_kerberos=True, success=True)[source]
setUp()[source]
test_bind_disabled_with_kerb_user()[source]
test_bind_named_with_kerb_user()[source]
test_bind_named_with_regular_token()[source]
test_bind_named_with_unknown_bind()[source]
test_bind_named_with_unknown_scheme()[source]
test_bind_named_without_kerb_user()[source]
test_bind_permissive_with_kerb_user()[source]
test_bind_permissive_with_regular_token()[source]
test_bind_permissive_with_unknown_bind()[source]
test_bind_permissive_without_kerb_user()[source]
test_bind_required_with_kerb_user()[source]
test_bind_required_with_regular_token()[source]
test_bind_required_with_unknown_bind()[source]
test_bind_required_without_kerb_user()[source]
test_bind_strict_with_kerb_user()[source]
test_bind_strict_with_regular_token()[source]
test_bind_strict_with_unknown_bind()[source]
test_bind_strict_without_kerb_user()[source]

keystone.tests.unit.test_token_provider module

class keystone.tests.unit.test_token_provider.TestTokenProvider(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.TestCase

setUp()[source]
test_get_token_version()[source]
test_provider_token_expiration_validation()[source]
test_unsupported_token_provider()[source]
test_validate_v3_token_with_no_token_raises_token_not_found()[source]
keystone.tests.unit.test_token_provider.create_v3_token()[source]

keystone.tests.unit.test_url_middleware module

class keystone.tests.unit.test_url_middleware.FakeApp[source]

Bases: object

Fakes a WSGI app URL normalized.

class keystone.tests.unit.test_url_middleware.UrlMiddlewareTest(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.TestCase

setUp()[source]
start_fake_response(status, headers)[source]
test_rewrite_empty_path()[source]

Test empty path is rewritten to root.

test_trailing_slash_normalization()[source]

Test /v3/auth/tokens & /v3/auth/tokens/ normalized URLs match.

keystone.tests.unit.test_v3 module

class keystone.tests.unit.test_v3.AssignmentTestMixin[source]

Bases: object

To hold assignment helper functions.

build_role_assignment_entity(link=None, prior_role_link=None, **attribs)[source]

Build and return a role assignment entity with provided attributes.

Provided attributes are expected to contain: domain_id or project_id, user_id or group_id, role_id and, optionally, inherited_to_projects.

build_role_assignment_entity_include_names(domain_ref=None, role_ref=None, group_ref=None, user_ref=None, project_ref=None, inherited_assignment=None)[source]

Build and return a role assignment entity with provided attributes.

The expected attributes are: domain_ref or project_ref, user_ref or group_ref, role_ref and, optionally, inherited_to_projects.

Build and return a role assignment link with provided attributes.

Provided attributes are expected to contain: domain_id or project_id, user_id or group_id, role_id and, optionally, inherited_to_projects.

build_role_assignment_query_url(effective=False, **filters)[source]

Build and return a role assignment query url with provided params.

Available filters are: domain_id, project_id, user_id, group_id, role_id and inherited_to_projects.

class keystone.tests.unit.test_v3.AuthContextMiddlewareTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.test_v3.RestfulTestCase

test_auth_context_build_by_middleware()[source]
test_auth_context_override()[source]
test_domain_scoped_token_auth_context()[source]
test_oslo_context()[source]
test_project_scoped_token_auth_context()[source]
test_unscoped_token_auth_context()[source]
class keystone.tests.unit.test_v3.JsonHomeTestMixin[source]

Bases: object

JSON Home test.

Mixin this class to provide a test for the JSON-Home response for an extension.

The base class must set JSON_HOME_DATA to a dict of relationship URLs (rels) to the JSON-Home data for the relationship. The rels and associated data must be in the response.

test_get_json_home()[source]
class keystone.tests.unit.test_v3.RestfulTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.SQLDriverOverrides, keystone.tests.unit.rest.RestfulTestCase, keystone.tests.common.auth.AuthTestMixin

assertEqualTokens(a, b)[source]

Assert that two tokens are equal.

Compare two tokens except for their ids. This also truncates the time in the comparison.

assertRoleAssignmentInListResponse(resp, ref, expected=1)[source]
assertRoleAssignmentNotInListResponse(resp, ref)[source]
assertRoleInListResponse(resp, ref, expected=1)[source]
assertRoleNotInListResponse(resp, ref)[source]
assertValidCatalog(entity)[source]
assertValidCatalogResponse(resp, *args, **kwargs)[source]
assertValidCredential(entity, ref=None)[source]
assertValidCredentialListResponse(resp, *args, **kwargs)[source]
assertValidCredentialResponse(resp, *args, **kwargs)[source]
assertValidDomain(entity, ref=None)[source]
assertValidDomainListResponse(resp, *args, **kwargs)[source]
assertValidDomainResponse(resp, *args, **kwargs)[source]
assertValidDomainScopedTokenResponse(r, *args, **kwargs)[source]
assertValidEndpoint(entity, ref=None)[source]
assertValidEndpointListResponse(resp, *args, **kwargs)[source]
assertValidEndpointResponse(resp, *args, **kwargs)[source]
assertValidEntity(entity, ref=None, keys_to_check=None)[source]

Make assertions common to all API entities.

If a reference is provided, the entity will also be compared against the reference.

assertValidErrorResponse(r)[source]
assertValidGroup(entity, ref=None)[source]
assertValidGroupListResponse(resp, *args, **kwargs)[source]
assertValidGroupResponse(resp, *args, **kwargs)[source]
assertValidISO8601ExtendedFormatDatetime(dt)[source]
assertValidListResponse(resp, key, entity_validator, ref=None, expected_length=None, keys_to_check=None, resource_url=None)[source]

Make assertions common to all API list responses.

If a reference is provided, it’s ID will be searched for in the response, and asserted to be equal.

assertValidPolicy(entity, ref=None)[source]
assertValidPolicyListResponse(resp, *args, **kwargs)[source]
assertValidPolicyResponse(resp, *args, **kwargs)[source]
assertValidProject(entity, ref=None)[source]
assertValidProjectListResponse(resp, *args, **kwargs)[source]
assertValidProjectResponse(resp, *args, **kwargs)[source]
assertValidProjectScopedTokenResponse(r, *args, **kwargs)[source]
assertValidRegion(entity, ref=None)[source]
assertValidRegionListResponse(resp, *args, **kwargs)[source]
assertValidRegionResponse(resp, *args, **kwargs)[source]
assertValidResponse(resp, key, entity_validator, *args, **kwargs)[source]

Make assertions common to all API responses.

assertValidRole(entity, ref=None)[source]
assertValidRoleAssignment(entity, ref=None)[source]
assertValidRoleAssignmentListResponse(resp, expected_length=None, resource_url=None)[source]
assertValidRoleListResponse(resp, *args, **kwargs)[source]
assertValidRoleResponse(resp, *args, **kwargs)[source]
assertValidScopedTokenResponse(r, *args, **kwargs)[source]
assertValidService(entity, ref=None)[source]
assertValidServiceListResponse(resp, *args, **kwargs)[source]
assertValidServiceProvider(entity, ref=None, *args, **kwargs)[source]
assertValidServiceProviderListResponse(resp, *args, **kwargs)[source]
assertValidServiceResponse(resp, *args, **kwargs)[source]
assertValidSystemScopedTokenResponse(r, *args, **kwargs)[source]
assertValidTokenResponse(r, user=None, forbid_token_id=False)[source]
assertValidTrust(entity, ref=None, summary=False)[source]
assertValidTrustListResponse(resp, *args, **kwargs)[source]
assertValidTrustResponse(resp, *args, **kwargs)[source]
assertValidTrustSummary(entity, ref=None)[source]
assertValidUnscopedTokenResponse(r, *args, **kwargs)[source]
assertValidUser(entity, ref=None)[source]
assertValidUserListResponse(resp, *args, **kwargs)[source]
assertValidUserResponse(resp, *args, **kwargs)[source]
build_external_auth_request(remote_user, remote_domain=None, auth_data=None, kerberos=False)[source]
config_files()[source]
create_new_default_project_for_user(user_id, domain_id, enable_project=True)[source]
delete(path, expected_status=204, **kwargs)[source]
generate_token_schema(system_scoped=False, domain_scoped=False, project_scoped=False)[source]

Return a dictionary of token properties to validate against.

get(path, expected_status=200, **kwargs)[source]
get_admin_token()[source]

Convenience method so that we can test authenticated requests.

get_domain_scoped_token()[source]

Convenience method for requesting domain scoped token.

get_requested_token(auth)[source]

Request the specific token we want.

get_scoped_token()[source]

Convenience method so that we can test authenticated requests.

get_system_scoped_token()[source]

Convenience method for requesting system scoped tokens.

get_unscoped_token()[source]

Convenience method so that we can test authenticated requests.

head(path, expected_status=204, **kwargs)[source]
load_backends()[source]
load_fixtures(fixtures)[source]
load_sample_data(create_region_and_endpoints=True)[source]
patch(path, expected_status=200, **kwargs)[source]
post(path, expected_status=201, **kwargs)[source]
put(path, expected_status=204, **kwargs)[source]
setUp(app_conf='keystone')[source]

Setup for v3 Restful Test Cases.

v3_create_token(auth, expected_status=201)[source]
v3_noauth_request(path, **kwargs)[source]
v3_request(path, **kwargs)[source]
class keystone.tests.unit.test_v3.VersionTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.test_v3.RestfulTestCase

test_get_version()[source]

keystone.tests.unit.test_v3_application_credential module

class keystone.tests.unit.test_v3_application_credential.ApplicationCredentialTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.test_v3.RestfulTestCase

Test CRUD operations for application credentials.

config_overrides()[source]
test_create_application_credential()[source]
test_create_application_credential_allow_recursion()[source]
test_create_application_credential_already_expired()[source]
test_create_application_credential_bad_role()[source]
test_create_application_credential_invalid_expiration_fmt()[source]
test_create_application_credential_roles_from_token()[source]
test_create_application_credential_with_application_credential()[source]
test_create_application_credential_with_expiration()[source]
test_create_application_credential_with_secret()[source]
test_create_application_credential_wrong_user()[source]
test_delete_application_credential()[source]
test_delete_application_credential_allow_recursion()[source]
test_delete_application_credential_not_found()[source]
test_delete_application_credential_with_application_credential()[source]
test_get_head_application_credential()[source]
test_get_head_application_credential_not_found()[source]
test_list_application_credentials()[source]
test_list_application_credentials_by_name()[source]
test_update_application_credential()[source]

keystone.tests.unit.test_v3_assignment module

keystone.tests.unit.test_v3_auth module

keystone.tests.unit.test_v3_catalog module

class keystone.tests.unit.test_v3_catalog.CatalogTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.test_v3.RestfulTestCase

Test service & endpoint CRUD.

test_create_endpoint_enabled_false()[source]

Call POST /endpoints with enabled: false.

test_create_endpoint_enabled_str_false()[source]

Call POST /endpoints with enabled: ‘False’.

test_create_endpoint_enabled_str_random()[source]

Call POST /endpoints with enabled: ‘puppies’.

test_create_endpoint_enabled_str_true()[source]

Call POST /endpoints with enabled: ‘True’.

test_create_endpoint_enabled_true()[source]

Call POST /endpoints with enabled: true.

test_create_endpoint_no_enabled()[source]

Call POST /endpoints.

test_create_endpoint_with_empty_url()[source]

Call POST /endpoints.

test_create_endpoint_with_invalid_region_id()[source]

Call POST /endpoints.

test_create_endpoint_with_no_region()[source]

EndpointV3 allows to creates the endpoint without region.

test_create_endpoint_with_region()[source]

EndpointV3 creates the region before creating the endpoint.

This occurs when endpoint is provided with ‘region’ and no ‘region_id’.

test_create_region()[source]

Call POST /regions with an ID in the request body.

test_create_region_with_conflicting_ids()[source]

Call PUT /regions/{region_id} with conflicting region IDs.

test_create_region_with_duplicate_id()[source]

Call PUT /regions/{region_id}.

test_create_region_with_empty_id()[source]

Call POST /regions with an empty ID in the request body.

test_create_region_with_id()[source]

Call PUT /regions/{region_id} w/o an ID in the request body.

test_create_region_with_matching_ids()[source]

Call PUT /regions/{region_id} with an ID in the request body.

test_create_region_without_description()[source]

Call POST /regions without description in the request body.

test_create_region_without_id()[source]

Call POST /regions without an ID in the request body.

test_create_regions_with_same_description_string()[source]

Call POST /regions with duplicate descriptions.

test_create_regions_without_descriptions()[source]

Call POST /regions with no description.

test_create_service()[source]

Call POST /services.

test_create_service_enabled_false()[source]

Call POST /services.

test_create_service_enabled_str_false()[source]

Call POST /services.

test_create_service_enabled_str_random()[source]

Call POST /services.

test_create_service_enabled_str_true()[source]

Call POST /services.

test_create_service_enabled_true()[source]

Call POST /services.

test_create_service_no_enabled()[source]

Call POST /services.

test_create_service_no_name()[source]

Call POST /services.

test_delete_endpoint()[source]

Call DELETE /endpoints/{endpoint_id}.

test_delete_region()[source]

Call DELETE /regions/{region_id}.

test_delete_service()[source]

Call DELETE /services/{service_id}.

test_deleting_endpoint_with_space_in_url()[source]
test_endpoint_create_with_invalid_url()[source]

Test the invalid cases: substitutions is not exactly right.

test_endpoint_create_with_valid_url()[source]

Create endpoint with valid url should be tested,too.

test_endpoint_create_with_valid_url_project_id()[source]

Create endpoint with valid url should be tested,too.

test_filter_list_services_by_name()[source]

Call GET /services?name=<some name>.

test_filter_list_services_by_name_with_list_limit()[source]

Call GET /services?name=<some name>.

test_filter_list_services_by_type()[source]

Call GET /services?type=<some type>.

test_get_head_endpoint()[source]

Call GET & HEAD /endpoints/{endpoint_id}.

test_get_head_region()[source]

Call GET & HEAD /regions/{region_id}.

test_get_head_service()[source]

Call GET & HEAD /services/{service_id}.

test_list_endpoints_filtered_by_interface()[source]

Call GET /endpoints?interface={interface}.

test_list_endpoints_filtered_by_parent_region_id()[source]

Call GET /endpoints?region_id={region_id}.

Ensure passing the parent_region_id as filter returns an empty list.

test_list_endpoints_filtered_by_region_id()[source]

Call GET /endpoints?region_id={region_id}.

test_list_endpoints_filtered_by_service_id()[source]

Call GET /endpoints?service_id={service_id}.

test_list_endpoints_with_multiple_filters()[source]

Call GET /endpoints?interface={interface}....

Ensure passing different combinations of interface, region_id and service_id as filters will return the correct result.

test_list_endpoints_with_random_filter_values()[source]

Call GET /endpoints?interface={interface}....

Ensure passing random values for: interface, region_id and service_id will return an empty list.

test_list_head_endpoints()[source]

Call GET & HEAD /endpoints.

test_list_head_regions()[source]

Call GET & HEAD /regions.

test_list_head_services()[source]

Call GET & HEAD /services.

test_list_regions_filtered_by_parent_region_id()[source]

Call GET /regions?parent_region_id={parent_region_id}.

test_update_endpoint()[source]

Call PATCH /endpoints/{endpoint_id}.

test_update_endpoint_enabled_false()[source]

Call PATCH /endpoints/{endpoint_id} with enabled: False.

test_update_endpoint_enabled_str_false()[source]

Call PATCH /endpoints/{endpoint_id} with enabled: ‘False’.

test_update_endpoint_enabled_str_random()[source]

Call PATCH /endpoints/{endpoint_id} with enabled: ‘kitties’.

test_update_endpoint_enabled_str_true()[source]

Call PATCH /endpoints/{endpoint_id} with enabled: ‘True’.

test_update_endpoint_enabled_true()[source]

Call PATCH /endpoints/{endpoint_id} with enabled: True.

test_update_region()[source]

Call PATCH /regions/{region_id}.

test_update_region_with_null_description()[source]

Call PATCH /regions/{region_id}.

test_update_region_without_description_keeps_original()[source]

Call PATCH /regions/{region_id}.

test_update_service()[source]

Call PATCH /services/{service_id}.

class keystone.tests.unit.test_v3_catalog.TestCatalogAPISQL(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.TestCase

Test for the catalog Manager against the SQL backend.

config_overrides()[source]
create_endpoint(service_id, **kwargs)[source]
setUp()[source]
test_get_catalog_always_returns_service_name()[source]
test_get_catalog_ignores_endpoints_with_invalid_urls()[source]
class keystone.tests.unit.test_v3_catalog.TestCatalogAPISQLRegions(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.TestCase

Test for the catalog Manager against the SQL backend.

assertValidCatalogEndpoint(entity, ref=None)[source]
config_overrides()[source]
setUp()[source]
test_get_catalog_returns_proper_endpoints_with_no_region()[source]
test_get_catalog_returns_proper_endpoints_with_region()[source]
class keystone.tests.unit.test_v3_catalog.TestCatalogAPITemplatedProject(*args, **kwargs)[source]

Bases: keystone.tests.unit.test_v3.RestfulTestCase

Templated Catalog doesn’t support full API.

Eg. No region/endpoint creation.

config_overrides()[source]
load_fixtures(fixtures)[source]
test_project_delete()[source]

Deleting a project should not result in an 500 ISE.

Deleting a project will create a notification, which the EndpointFilter functionality will use to clean up any project->endpoint and project->endpoint_group relationships. The templated catalog does not support such relationships, but the act of attempting to delete them should not cause a NotImplemented exception to be exposed to an API caller.

Deleting an endpoint has a similar notification and clean up mechanism, but since we do not allow deletion of endpoints with the templated catalog, there is no testing to do for that action.

class keystone.tests.unit.test_v3_catalog.TestMultiRegion(*args, **kwargs)[source]

Bases: keystone.tests.unit.test_v3.RestfulTestCase

test_catalog_with_multi_region_reports_all_endpoints()[source]

keystone.tests.unit.test_v3_credential module

keystone.tests.unit.test_v3_domain_config module

class keystone.tests.unit.test_v3_domain_config.DomainConfigTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.test_v3.RestfulTestCase

Test domain config support.

setUp()[source]
test_create_config()[source]

Call PUT /domains/{domain_id}/config.

test_create_config_invalid_domain()[source]

Call PUT /domains/{domain_id}/config.

While creating Identity API-based domain config with an invalid domain id provided, the request shall be rejected with a response, 404 domain not found.

test_create_config_twice()[source]

Check multiple creates don’t throw error.

test_delete_config()[source]

Call DELETE /domains{domain_id}/config.

test_delete_config_by_group()[source]

Call DELETE /domains{domain_id}/config/{group}.

test_delete_config_by_group_invalid_domain()[source]

Call DELETE /domains{domain_id}/config/{group}.

While deleting Identity API-based domain config by group with an invalid domain id provided, the request shall be rejected with a response 404 domain not found.

test_delete_config_invalid_domain()[source]

Call DELETE /domains{domain_id}/config.

While deleting Identity API-based domain config with an invalid domain id provided, the request shall be rejected with a response, 404 domain not found.

test_get_head_config()[source]

Call GET & HEAD for /domains{domain_id}/config.

test_get_head_config_by_group()[source]

Call GET & HEAD /domains{domain_id}/config/{group}.

test_get_head_config_by_group_invalid_domain()[source]

Call GET & HEAD /domains{domain_id}/config/{group}.

While retrieving Identity API-based domain config by group with an invalid domain id provided, the request shall be rejected with a response 404 domain not found.

test_get_head_config_by_option()[source]

Call GET & HEAD /domains{domain_id}/config/{group}/{option}.

test_get_head_config_by_option_invalid_domain()[source]

Call GET & HEAD /domains{domain_id}/config/{group}/{option}.

While retrieving Identity API-based domain config by option with an invalid domain id provided, the request shall be rejected with a response 404 domain not found.

test_get_head_config_default()[source]

Call GET & HEAD /domains/config/default.

test_get_head_config_default_by_group()[source]

Call GET & HEAD /domains/config/{group}/default.

test_get_head_config_default_by_invalid_group()[source]

Call GET & HEAD for /domains/config/{bad-group}/default.

test_get_head_config_default_by_option()[source]

Call GET & HEAD /domains/config/{group}/{option}/default.

test_get_head_config_default_for_invalid_option()[source]

Returning invalid configuration options is invalid.

test_get_head_config_default_for_unsupported_group()[source]
test_get_head_non_existant_config()[source]

Call GET /domains{domain_id}/config when no config defined.

test_get_head_non_existant_config_group()[source]

Call GET /domains/{domain_id}/config/{group_not_exist}.

test_get_head_non_existant_config_group_invalid_domain()[source]

Call GET & HEAD /domains/{domain_id}/config/{group}.

While retrieving non-existent Identity API-based domain config group with an invalid domain id provided, the request shall be rejected with a response, 404 domain not found.

test_get_head_non_existant_config_invalid_domain()[source]

Call GET & HEAD /domains/{domain_id}/config with invalid domain.

While retrieving non-existent Identity API-based domain config with an invalid domain id provided, the request shall be rejected with a response 404 domain not found.

test_get_head_non_existant_config_option()[source]

Test that Not Found is returned when option doesn’t exist.

Call GET & HEAD /domains/{domain_id}/config/{group}/{opt_not_exist} and ensure a Not Found is returned because the option isn’t defined within the group.

test_get_head_non_existant_config_option_with_invalid_domain()[source]

Test that Domain Not Found is returned with invalid domain.

Call GET & HEAD /domains/{domain_id}/config/{group}/{opt_not_exist}

While retrieving non-existent Identity API-based domain config option with an invalid domain id provided, the request shall be rejected with a response, 404 domain not found.

test_update_config()[source]

Call PATCH /domains/{domain_id}/config.

test_update_config_group()[source]

Call PATCH /domains/{domain_id}/config/{group}.

test_update_config_group_invalid_domain()[source]

Call PATCH /domains/{domain_id}/config/{group}.

While updating Identity API-based domain config group with an invalid domain id provided, the request shall be rejected with a response, 404 domain not found.

test_update_config_invalid_domain()[source]

Call PATCH /domains/{domain_id}/config.

While updating Identity API-based domain config with an invalid domain id provided, the request shall be rejected with a response, 404 domain not found.

test_update_config_invalid_group()[source]

Call PATCH /domains/{domain_id}/config/{invalid_group}.

test_update_config_invalid_group_invalid_domain()[source]

Call PATCH /domains/{domain_id}/config/{invalid_group}.

While updating Identity API-based domain config with an invalid group and an invalid domain id provided, the request shall be rejected with a response, 404 domain not found.

test_update_config_invalid_option()[source]

Call PATCH /domains/{domain_id}/config/{group}/{invalid}.

test_update_config_invalid_option_invalid_domain()[source]

Call PATCH /domains/{domain_id}/config/{group}/{invalid}.

While updating Identity API-based domain config with an invalid option and an invalid domain id provided, the request shall be rejected with a response, 404 domain not found.

test_update_config_option()[source]

Call PATCH /domains/{domain_id}/config/{group}/{option}.

test_update_config_option_invalid_domain()[source]

Call PATCH /domains/{domain_id}/config/{group}/{option}.

While updating Identity API-based domain config option with an invalid domain id provided, the request shall be rejected with a response, 404 domain not found.

class keystone.tests.unit.test_v3_domain_config.SecurityRequirementsTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.test_v3.RestfulTestCase

setUp()[source]
test_delete_non_whitelisted_security_compliance_options_fails()[source]

The security compliance options shouldn’t be deleteable.

test_delete_security_compliance_group_fails()[source]

The security compliance group shouldn’t be deleteable.

test_delete_security_compliance_password_regex_description_fails()[source]

The security compliance options shouldn’t be deleteable.

test_delete_security_compliance_password_regex_fails()[source]

The security compliance options shouldn’t be deleteable.

test_get_head_security_compliance_config_for_default_domain()[source]

Ask for all security compliance configuration options.

Support for enforcing security compliance per domain currently doesn’t exist. Make sure when we ask for security compliance information, it’s only for the default domain and that it only returns whitelisted options.

test_get_non_whitelisted_security_compliance_opt_fails()[source]

We only support exposing a subset of security compliance options.

Given that security compliance information is sensitive in nature, we should make sure that only the options we want to expose are readable via the API.

test_get_security_compliance_config_for_non_default_domain_fails()[source]

Getting security compliance opts for other domains should fail.

Support for enforcing security compliance rules per domain currently does not exist, so exposing security compliance information for any domain other than the default domain should not be allowed.

test_get_security_compliance_config_with_user_from_other_domain()[source]

Make sure users from other domains can access password requirements.

Even though a user is in a separate domain, they should be able to see the security requirements for the deployment. This is because security compliance is not yet implemented on a per domain basis. Once that happens, then this should no longer be possible since a user should only care about the security compliance requirements for the domain that they are in.

test_get_security_compliance_password_regex()[source]

Ask for the security compliance password regular expression.

test_get_security_compliance_password_regex_desc_returns_none()[source]

When an option isn’t set, we should explicitly return None.

test_get_security_compliance_password_regex_description()[source]

Ask for the security compliance password regex description.

test_get_security_compliance_password_regex_returns_none()[source]

When an option isn’t set, we should explicitly return None.

test_update_non_whitelisted_security_compliance_option_fails()[source]

Updating security compliance options through the API is not allowed.

Requests to update anything in the security compliance group through the API should be Forbidden. This ensures that we are covering cases where the option being updated isn’t in the white list.

test_update_security_compliance_config_group_fails()[source]

Make sure that updates to the entire security group section fail.

We should only allow the ability to modify a deployments security compliance rules through configuration. Especially since it’s only enforced on the default domain.

test_update_security_compliance_password_regex_description_fails()[source]

Make sure any updates to security compliance options fail.

test_update_security_compliance_password_regex_fails()[source]

Make sure any updates to security compliance options fail.

keystone.tests.unit.test_v3_endpoint_policy module

class keystone.tests.unit.test_v3_endpoint_policy.EndpointPolicyTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.test_v3.RestfulTestCase

Test endpoint policy CRUD.

In general, the controller layer of the endpoint policy extension is really just marshalling the data around the underlying manager calls. Given that the manager layer is tested in depth by the backend tests, the tests we execute here concentrate on ensuring we are correctly passing and presenting the data.

assert_head_and_get_return_same_response(url, expected_status)[source]
setUp()[source]
test_crud_for_policy_for_explicit_endpoint()[source]

PUT, HEAD and DELETE for explicit endpoint policy.

test_crud_for_policy_for_region_and_service()[source]

PUT, HEAD and DELETE for region and service endpoint policy.

test_crud_for_policy_for_service()[source]

PUT, HEAD and DELETE for service endpoint policy.

test_endpoint_association_cleanup_when_endpoint_deleted()[source]
test_get_policy_for_endpoint()[source]

GET /endpoints/{endpoint_id}/policy.

test_list_endpoints_for_policy()[source]

GET & HEAD /policies/%(policy_id}/endpoints.

test_region_service_association_cleanup_when_region_deleted()[source]
test_region_service_association_cleanup_when_service_deleted()[source]
test_service_association_cleanup_when_policy_deleted()[source]
test_service_association_cleanup_when_service_deleted()[source]
class keystone.tests.unit.test_v3_endpoint_policy.JsonHomeTests[source]

Bases: keystone.tests.unit.test_v3.JsonHomeTestMixin

EXTENSION_LOCATION = 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-ENDPOINT-POLICY/1.0/rel'
JSON_HOME_DATA = {'https://docs.openstack.org/api/openstack-identity/3/ext/OS-ENDPOINT-POLICY/1.0/rel/policy_endpoints': {'href-template': '/policies/{policy_id}/OS-ENDPOINT-POLICY/endpoints', 'href-vars': {'policy_id': 'https://docs.openstack.org/api/openstack-identity/3/param/policy_id'}}, 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-ENDPOINT-POLICY/1.0/rel/endpoint_policy_association': {'href-template': '/policies/{policy_id}/OS-ENDPOINT-POLICY/endpoints/{endpoint_id}', 'href-vars': {'endpoint_id': 'https://docs.openstack.org/api/openstack-identity/3/param/endpoint_id', 'policy_id': 'https://docs.openstack.org/api/openstack-identity/3/param/policy_id'}}, 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-ENDPOINT-POLICY/1.0/rel/endpoint_policy': {'href-template': '/endpoints/{endpoint_id}/OS-ENDPOINT-POLICY/policy', 'href-vars': {'endpoint_id': 'https://docs.openstack.org/api/openstack-identity/3/param/endpoint_id'}}, 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-ENDPOINT-POLICY/1.0/rel/service_policy_association': {'href-template': '/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id}', 'href-vars': {'service_id': 'https://docs.openstack.org/api/openstack-identity/3/param/service_id', 'policy_id': 'https://docs.openstack.org/api/openstack-identity/3/param/policy_id'}}, 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-ENDPOINT-POLICY/1.0/rel/region_and_service_policy_association': {'href-template': '/policies/{policy_id}/OS-ENDPOINT-POLICY/services/{service_id}/regions/{region_id}', 'href-vars': {'service_id': 'https://docs.openstack.org/api/openstack-identity/3/param/service_id', 'region_id': 'https://docs.openstack.org/api/openstack-identity/3/param/region_id', 'policy_id': 'https://docs.openstack.org/api/openstack-identity/3/param/policy_id'}}}
PARAM_LOCATION = 'https://docs.openstack.org/api/openstack-identity/3/param'

keystone.tests.unit.test_v3_federation module

keystone.tests.unit.test_v3_filters module

keystone.tests.unit.test_v3_identity module

keystone.tests.unit.test_v3_oauth1 module

keystone.tests.unit.test_v3_os_revoke module

keystone.tests.unit.test_v3_policy module

class keystone.tests.unit.test_v3_policy.PolicyTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.test_v3.RestfulTestCase

Test policy CRUD.

setUp()[source]
test_create_policy()[source]

Call POST /policies.

test_delete_policy()[source]

Call DELETE /policies/{policy_id}.

test_get_head_policy()[source]

Call GET & HEAD /policies/{policy_id}.

test_list_head_policies()[source]

Call GET & HEAD /policies.

test_update_policy()[source]

Call PATCH /policies/{policy_id}.

keystone.tests.unit.test_v3_protection module

class keystone.tests.unit.test_v3_protection.IdentityTestImpliedDomainSpecificRoles(*args, **kwargs)[source]

Bases: keystone.tests.unit.test_v3_protection.IdentityTestv3CloudPolicySample

Test Domain specific Implied Roles via the REST API.

setUp()[source]
test_allowed_role_implication_different_domains_as_cloud_admin()[source]
test_check()[source]
test_delete()[source]
test_forbidden_role_implication_from_different_domain()[source]
test_get()[source]
test_list()[source]
test_put()[source]
class keystone.tests.unit.test_v3_protection.IdentityTestPolicySample(*args, **kwargs)[source]

Bases: keystone.tests.unit.test_v3.RestfulTestCase

Test policy enforcement of the policy.json file.

load_sample_data()[source]
test_admin_check_user_token()[source]
test_admin_revoke_user_token()[source]
test_admin_validate_user_token()[source]
test_list_revoke_events_is_protected()[source]
test_user_check_other_user_token_rejected()[source]
test_user_check_same_token()[source]
test_user_check_user_token()[source]
test_user_revoke_other_user_token_rejected()[source]
test_user_revoke_same_token()[source]
test_user_revoke_user_token()[source]
test_user_validate_other_user_token_rejected()[source]
test_user_validate_same_token()[source]
test_user_validate_user_token()[source]
class keystone.tests.unit.test_v3_protection.IdentityTestProtectedCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.test_v3.RestfulTestCase

Test policy enforcement on the v3 Identity API.

load_sample_data()[source]
setUp()[source]

Setup for Identity Protection Test Cases.

As well as the usual housekeeping, create a set of domains, users, roles and projects for the subsequent tests:

  • Three domains: A,B & C. C is disabled.
  • DomainA has user1, DomainB has user2 and user3
  • DomainA has group1 and group2, DomainB has group3
  • User1 has two roles on DomainA
  • User2 has one role on DomainA

Remember that there will also be a fourth domain in existence, the default domain.

test_get_user_protected_match_id()[source]

GET /users/{id} (match payload).

Test Plan:

  • Update policy to protect api by user_id
  • List users with user_id of user1 as filter, to check that this will correctly match user_id in the flattened payload
test_get_user_protected_match_target()[source]

GET /users/{id} (match target).

Test Plan:

  • Update policy to protect api by domain_id
  • Try and read a user who is in DomainB with a token scoped to Domain A - this should fail
  • Retry this for a user who is in Domain A, which should succeed.
  • Finally, try getting a user that does not exist, which should still return UserNotFound
test_list_groups_protected_by_domain()[source]

GET /groups?domain_id=mydomain (protected).

Test Plan:

  • Update policy to protect api by domain_id
  • List groups using a token scoped to domainA and make sure we only get back the two groups that are in domainA
  • Try and read the groups from domainB - this should fail since we don’t have a token scoped for domainB
test_list_groups_protected_by_domain_and_filtered()[source]

GET /groups?domain_id=mydomain&name=myname (protected).

Test Plan:

  • Update policy to protect api by domain_id
  • List groups using a token scoped to domainA with a filter specifying both domainA and the name of group.
  • We should only get back the group in domainA that matches the name
test_list_users_admin_project()[source]
test_list_users_filtered_by_domain()[source]

GET /users?domain_id=mydomain (filtered).

Test Plan:

  • Update policy so api is unprotected
  • Use an un-scoped token to make sure we can filter the users by domainB, getting back the 2 users in that domain
test_list_users_not_in_admin_project()[source]
test_list_users_protected_by_domain()[source]

GET /users?domain_id=mydomain (protected).

Test Plan:

  • Update policy to protect api by domain_id
  • List groups using a token scoped to domainA with a filter specifying domainA - we should only get back the one user that is in domainA.
  • Try and read the users from domainB - this should fail since we don’t have a token scoped for domainB
test_list_users_unprotected()[source]

GET /users (unprotected).

Test Plan:

  • Update policy so api is unprotected
  • Use an un-scoped token to make sure we can get back all the users independent of domain
test_revoke_grant_protected_match_target()[source]

DELETE /domains/{id}/users/{id}/roles/{id} (match target).

Test Plan:

  • Update policy to protect api by domain_id of entities in the grant
  • Try and delete the existing grant that has a user who is from a different domain - this should fail.
  • Retry this for a user who is in Domain A, which should succeed.
class keystone.tests.unit.test_v3_protection.IdentityTestv3CloudPolicySample(*args, **kwargs)[source]

Bases: keystone.tests.unit.test_v3.RestfulTestCase, keystone.tests.unit.test_v3.AssignmentTestMixin

Test policy enforcement of the sample v3 cloud policy file.

load_sample_data()[source]
setUp()[source]

Setup for v3 Cloud Policy Sample Test Cases.

The following data is created:

  • Three domains: domainA, domainB and admin_domain
  • One project, which name is ‘project’
  • domainA has three users: domain_admin_user, project_admin_user and just_a_user:
    • domain_admin_user has role ‘admin’ on domainA,
    • project_admin_user has role ‘admin’ on the project,
    • just_a_user has a non-admin role on both domainA and the project.
  • admin_domain has admin_project, and user cloud_admin_user, with an ‘admin’ role on admin_project.
  • domainA has two groups (group1, group2), domainB has one group (group3)

We test various api protection rules from the cloud sample policy file to make sure the sample is valid and that we correctly enforce it.

test_admin_check_user_token()[source]
test_admin_project()[source]
test_admin_project_list_assignments_of_project()[source]
test_admin_project_validate_user_token()[source]
test_admin_revoke_user_token()[source]
test_admin_validate_user_token()[source]
test_cloud_admin()[source]
test_cloud_admin_list_assignments_of_domain()[source]
test_cloud_admin_list_assignments_of_project()[source]
test_domain_admin_get_domain()[source]
test_domain_admin_list_assignment_tree()[source]
test_domain_admin_list_assignments_of_another_domain_failed()[source]
test_domain_admin_list_assignments_of_domain()[source]
test_domain_admin_list_assignments_of_project(*args, **kwargs)[source]
test_domain_grants()[source]
test_domain_grants_by_cloud_admin()[source]
test_domain_grants_by_cloud_admin_for_domain_specific_role()[source]
test_domain_grants_by_domain_admin_for_domain_specific_role()[source]
test_domain_grants_by_non_admin_for_domain_specific_role()[source]
test_domain_role_management_no_admin_no_rights()[source]
test_domain_role_management_with_cloud_admin()[source]
test_domain_role_management_with_domain_admin()[source]
test_domain_role_management_with_project_admin()[source]
test_domain_user_list_assignments_of_domain_failed()[source]
test_domain_user_list_assignments_of_project_failed()[source]
test_get_and_delete_ec2_credentials()[source]

Test getting and deleting ec2 credentials through the ec2 API.

test_group_management()[source]
test_group_management_by_cloud_admin()[source]
test_list_revoke_events_is_protected()[source]
test_list_user_credentials()[source]
test_project_admin_get_project()[source]
test_project_admin_list_assignments_of_another_project_failed()[source]
test_project_grants()[source]
test_project_grants_by_domain_admin()[source]
test_project_grants_by_domain_admin_for_domain_specific_role()[source]
test_project_grants_by_non_admin_for_domain_specific_role()[source]
test_project_grants_by_project_admin_for_domain_specific_role()[source]
test_project_management()[source]
test_project_management_by_cloud_admin()[source]
test_role_management_no_admin_no_rights()[source]
test_role_management_with_cloud_admin()[source]
test_role_management_with_domain_admin()[source]
test_role_management_with_project_admin()[source]
test_user_check_other_user_token_rejected()[source]
test_user_check_same_token()[source]
test_user_check_user_token()[source]
test_user_management()[source]
test_user_management_by_cloud_admin()[source]
test_user_management_normalized_keys()[source]

Illustrate the inconsistent handling of hyphens in keys.

To quote Morgan in bug 1526244:

the reason this is converted from “domain-id” to “domain_id” is because of how we process/normalize data. The way we have to handle specific data types for known columns requires avoiding “-” in the actual python code since “-” is not valid for attributes in python w/o significant use of “getattr” etc.

In short, historically we handle some things in conversions. The use of “extras” has long been a poor design choice that leads to odd/strange inconsistent behaviors because of other choices made in handling data from within the body. (In many cases we convert from “-” to “_” throughout openstack)

Source: https://bugs.launchpad.net/keystone/+bug/1526244/comments/9

test_user_revoke_other_user_token_rejected()[source]
test_user_revoke_same_token()[source]
test_user_revoke_user_token()[source]
test_user_validate_other_user_token_rejected()[source]
test_user_validate_same_token()[source]
test_user_validate_user_token()[source]
test_user_with_a_role_get_project()[source]

keystone.tests.unit.test_v3_resource module

class keystone.tests.unit.test_v3_resource.ResourceTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.test_v3.RestfulTestCase, keystone.tests.unit.test_v3.AssignmentTestMixin

Test domains and projects.

setUp()[source]
test_check_if_project_tag_exists()[source]
test_check_project_with_no_tags()[source]
test_create_domain()[source]

Call POST /domains.

test_create_domain_bad_request()[source]

Call POST /domains.

test_create_domain_case_sensitivity()[source]

Call POST /domains` twice with upper() and lower() cased name.

test_create_domain_creates_is_domain_project()[source]

Check a project that acts as a domain is created.

Call POST /domains.

test_create_domain_unsafe()[source]

Call POST /domains with unsafe names.

test_create_domain_unsafe_default()[source]

Check default for unsafe names for POST /domains.

test_create_hierarchical_project()[source]

Call POST /projects.

test_create_is_domain_project_creates_domain()[source]

Call POST /projects is_domain and check a domain is created.

test_create_project()[source]

Call POST /projects.

test_create_project_bad_request()[source]

Call POST /projects.

test_create_project_invalid_domain_id()[source]

Call POST /projects.

test_create_project_tag()[source]
test_create_project_tag_already_exists()[source]
test_create_project_tag_invalid_project_id()[source]
test_create_project_tag_is_case_insensitive()[source]
test_create_project_tag_name_over_character_limit()[source]
test_create_project_tag_over_tag_limit()[source]
test_create_project_tag_unsafe_name()[source]
test_create_project_unsafe()[source]

Call POST /projects with unsafe names.

test_create_project_unsafe_default()[source]

Check default for unsafe names for POST /projects.

test_create_project_with_parent_id_and_no_domain_id(*args, **kwargs)[source]

Call POST /projects.

test_create_project_with_parent_id_none_and_domain_id_none()[source]

Call POST /projects.

test_create_project_with_tags()[source]
test_create_project_without_parent_id_and_without_domain_id()[source]

Call POST /projects.

test_delete_default_domain()[source]
test_delete_domain()[source]

Call DELETE /domains/{domain_id}.

The sample data set up already has a user and project that is part of self.domain. Additionally we will create a group and a credential within it. Since we will authenticate in this domain, we create another set of entities in a second domain. Deleting this second domain should delete all these new entities. In addition, all the entities in the regular self.domain should be unaffected by the delete.

Test Plan:

  • Create domain2 and a 2nd set of entities
  • Disable domain2
  • Delete domain2
  • Check entities in domain2 have been deleted
  • Check entities in self.domain are unaffected
test_delete_domain_deletes_is_domain_project()[source]

Check the project that acts as a domain is deleted.

Call DELETE /domains.

test_delete_domain_hierarchy()[source]

Call DELETE /domains/{domain_id}.

test_delete_enabled_domain_fails()[source]

Call DELETE /domains/{domain_id} (when domain enabled).

test_delete_not_leaf_project()[source]

Call DELETE /projects/{project_id}.

test_delete_project()[source]

Call DELETE /projects/{project_id}.

As well as making sure the delete succeeds, we ensure that any credentials that reference this projects are also deleted, while other credentials are unaffected.

test_delete_project_tag()[source]
test_delete_project_tag_not_found()[source]
test_delete_project_tags()[source]
test_delete_tag_invalid_project_id()[source]
test_disable_domain()[source]

Call PATCH /domains/{domain_id} (set enabled=False).

test_disable_leaf_project()[source]

Call PATCH /projects/{project_id}.

test_disable_not_leaf_project()[source]

Call PATCH /projects/{project_id}.

test_forbid_operations_on_defined_federated_domain()[source]

Make sure one cannot operate on a user-defined federated domain.

This includes operations like create, update, delete.

test_forbid_operations_on_federated_domain()[source]

Make sure one cannot operate on federated domain.

This includes operations like create, update, delete on domain identified by id and name where difference variations of id ‘Federated’ are used.

test_get_head_domain()[source]

Call GET /domains/{domain_id}.

test_get_head_project()[source]

Call GET & HEAD /projects/{project_id}.

test_get_project_tag_that_does_not_exist()[source]
test_get_project_with_parents_as_ids()[source]

Call GET /projects/{project_id}?parents_as_ids.

test_get_project_with_parents_as_list_and_parents_as_ids()[source]

Attempt to list a project’s parents as both a list and as IDs.

This uses GET /projects/{project_id}?parents_as_list&parents_as_ids which should fail with a Bad Request due to the conflicting query strings.

test_get_project_with_parents_as_list_with_full_access()[source]

GET /projects/{project_id}?parents_as_list with full access.

Test plan:

  • Create ‘parent’, ‘project’ and ‘subproject’ projects;
  • Assign a user a role on each one of those projects;
  • Check that calling parents_as_list on ‘subproject’ returns both ‘project’ and ‘parent’.
test_get_project_with_parents_as_list_with_invalid_id()[source]

Call GET /projects/{project_id}?parents_as_list.

test_get_project_with_parents_as_list_with_partial_access()[source]

GET /projects/{project_id}?parents_as_list with partial access.

Test plan:

  • Create ‘parent’, ‘project’ and ‘subproject’ projects;
  • Assign a user a role on ‘parent’ and ‘subproject’;
  • Check that calling parents_as_list on ‘subproject’ only returns ‘parent’.
test_get_project_with_subtree_as_ids()[source]

Call GET /projects/{project_id}?subtree_as_ids.

This test creates a more complex hierarchy to test if the structured dictionary returned by using the subtree_as_ids query param correctly represents the hierarchy.

The hierarchy contains 5 projects with the following structure:

   +--A--+
   |     |
+--B--+  C
|     |
D     E
test_get_project_with_subtree_as_list_and_subtree_as_ids()[source]

Attempt to get a project subtree as both a list and as IDs.

This uses GET /projects/{project_id}?subtree_as_list&subtree_as_ids which should fail with a bad request due to the conflicting query strings.

test_get_project_with_subtree_as_list_with_full_access()[source]

GET /projects/{project_id}?subtree_as_list with full access.

Test plan:

  • Create ‘parent’, ‘project’ and ‘subproject’ projects;
  • Assign a user a role on each one of those projects;
  • Check that calling subtree_as_list on ‘parent’ returns both ‘parent’ and ‘subproject’.
test_get_project_with_subtree_as_list_with_invalid_id()[source]

Call GET /projects/{project_id}?subtree_as_list.

test_get_project_with_subtree_as_list_with_partial_access()[source]

GET /projects/{project_id}?subtree_as_list with partial access.

Test plan:

  • Create ‘parent’, ‘project’ and ‘subproject’ projects;
  • Assign a user a role on ‘parent’ and ‘subproject’;
  • Check that calling subtree_as_list on ‘parent’ returns ‘subproject’.
test_get_single_project_tag()[source]
test_list_head_domains()[source]

Call GET & HEAD /domains.

test_list_head_projects()[source]

Call GET & HEAD /projects.

test_list_project_is_domain_filter()[source]

Call GET /projects?is_domain=True/False.

test_list_project_is_domain_filter_default()[source]

Default project list should not see projects acting as domains.

test_list_project_response_returns_tags()[source]

Call GET /projects should always return tag attributes.

test_list_project_tags()[source]
test_list_project_tags_for_project_with_no_tags()[source]
test_list_projects_by_tags_and_name()[source]

Call GET /projects?tags-any={tags}&name={name}.

test_list_projects_filtering_by_not_tags()[source]

Call GET /projects?not-tags={tags}.

test_list_projects_filtering_by_not_tags_any()[source]

Call GET /projects?not-tags-any={tags}.

test_list_projects_filtering_by_parent_id()[source]

Call GET /projects?parent_id={project_id}.

test_list_projects_filtering_by_tags()[source]

Call GET /projects?tags={tags}.

test_list_projects_filtering_by_tags_any()[source]

Call GET /projects?tags-any={tags}.

test_list_projects_filtering_conflict_any_tag_filters()[source]

Call GET /projects?tags-any={tags}&not-tags-any={tags}.

test_list_projects_filtering_conflict_tag_filters()[source]

Call GET /projects?tags={tags}&not-tags={tags}.

test_list_projects_filtering_multiple_any_tag_filters()[source]

Call GET /projects?tags-any={tags}&not-tags-any={tags}.

test_list_projects_filtering_multiple_tag_filters()[source]

Call GET /projects?tags={tags}&tags-any={tags}.

test_token_revoked_once_domain_disabled()[source]

Test token from a disabled domain has been invalidated.

Test that a token that was valid for an enabled domain becomes invalid once that domain is disabled.

test_update_domain()[source]

Call PATCH /domains/{domain_id}.

test_update_domain_unsafe()[source]

Call POST /domains/{domain_id} with unsafe names.

test_update_domain_unsafe_default()[source]

Check default for unsafe names for POST /domains.

test_update_domain_updates_is_domain_project()[source]

Check the project that acts as a domain is updated.

Call PATCH /domains.

test_update_project()[source]

Call PATCH /projects/{project_id}.

test_update_project_domain_id()[source]

Call PATCH /projects/{project_id} with domain_id.

A projects’s domain_id is immutable. Ensure that any attempts to update the domain_id of a project fails.

test_update_project_is_domain_not_allowed()[source]

Call PATCH /projects/{project_id} with is_domain.

The is_domain flag is immutable.

test_update_project_parent_id()[source]

Call PATCH /projects/{project_id}.

test_update_project_tags()[source]
test_update_project_tags_removes_previous_tags()[source]
test_update_project_tags_unsafe_names()[source]
test_update_project_tags_with_too_many_tags()[source]
test_update_project_unsafe()[source]

Call POST /projects/{project_id} with unsafe names.

test_update_project_unsafe_default()[source]

Check default for unsafe names for POST /projects.

test_update_project_with_tags()[source]

keystone.tests.unit.test_v3_trust module

class keystone.tests.unit.test_v3_trust.TestTrustOperations(*args, **kwargs)[source]

Bases: keystone.tests.unit.test_v3.RestfulTestCase

Test module for create, read, update and delete operations on trusts.

This module is specific to tests for trust CRUD operations. All other tests related to trusts that are authentication or authorization specific should live in the keystone/tests/unit/test_v3_auth.py module.

setUp()[source]
test_create_trust_bad_request()[source]
test_create_trust_with_bad_remaining_uses_returns_bad_request()[source]
test_create_trust_with_expiration_in_the_past_fails()[source]
test_create_trust_with_extra_attributes_fails()[source]
test_create_trust_with_invalid_expiration_fails()[source]
test_create_trust_with_non_existant_project_returns_not_found()[source]
test_create_trust_with_non_existant_role_id_returns_not_found()[source]
test_create_trust_with_non_existant_role_name_returns_not_found()[source]
test_create_trust_with_non_existant_trustee_returns_not_found()[source]
test_create_trust_with_role_name_ambiguous_returns_bad_request()[source]
test_create_trust_with_trustee_as_trustor_returns_forbidden()[source]
test_create_trust_without_impersonation_returns_bad_request()[source]
test_create_trust_without_trustee_returns_bad_request()[source]
test_delete_trust()[source]
test_exercise_trust_scoped_token_with_impersonation()[source]
test_exercise_trust_scoped_token_without_impersonation()[source]
test_forbidden_trust_impersonation_in_redelegation()[source]

Test forbiddance of impersonation in trust redelegation.

Check that trustee not allowed to create a trust (with impersonation set to true) from a redelegated trust (with impersonation set to false)

test_list_trusts()[source]
test_trust_crud()[source]
test_trust_deleted_when_project_deleted()[source]
test_trust_deleted_when_user_deleted()[source]
class keystone.tests.unit.test_v3_trust.TrustsWithApplicationCredentials(*args, **kwargs)[source]

Bases: keystone.tests.unit.test_v3.RestfulTestCase

config_overrides()[source]
setUp()[source]
test_create_trust_with_application_credential()[source]
test_delete_trust_with_application_credential()[source]

keystone.tests.unit.test_validation module

class keystone.tests.unit.test_validation.ApplicationCredentialValidatorTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.TestCase

setUp()[source]
test_validate_app_cred_invalid_roles_fails()[source]
test_validate_app_cred_request()[source]
test_validate_app_cred_request_without_name_fails()[source]
test_validate_app_cred_with_invalid_expires_at_fails()[source]
test_validate_app_cred_with_null_expires_at_succeeds()[source]
test_validate_app_cred_with_secret_succeeds()[source]
test_validate_app_cred_with_unrestricted_flag_succeeds()[source]
class keystone.tests.unit.test_validation.CommonValidationTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.BaseTestCase

test_nullable_type_only()[source]
test_nullable_with_enum()[source]
class keystone.tests.unit.test_validation.CredentialValidationTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 Credential API validation.

setUp()[source]
test_validate_credential_ec2_without_project_id_fails()[source]

Validate project_id is required for ec2.

Test that a SchemaValidationError is raised when type is ec2 and no project_id is provided in create request.

test_validate_credential_non_ec2_without_project_id_succeeds()[source]

Validate project_id is not required for non-ec2.

Test that create request without project_id succeeds for any non-ec2 credential.

test_validate_credential_succeeds()[source]

Test that we validate a credential request.

test_validate_credential_update_succeeds()[source]

Test that a credential request is properly validated.

test_validate_credential_update_with_extra_parameters_succeeds()[source]

Validate credential update with extra parameters.

test_validate_credential_update_without_parameters_fails()[source]

Exception is raised on update without parameters.

test_validate_credential_with_extra_parameters_succeeds()[source]

Validate create request with extra parameters.

test_validate_credential_with_project_id_succeeds()[source]

Test that credential request works for all types.

test_validate_credential_without_blob_fails()[source]

Exception raised without blob in create request.

test_validate_credential_without_type_fails()[source]

Exception raised without type in create request.

test_validate_credential_without_user_id_fails()[source]

Exception raised without user_id in create request.

class keystone.tests.unit.test_validation.DomainValidationTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 Domain API validation.

setUp()[source]
test_validate_domain_create_fails_with_invalid_name()[source]

Exception when validating a create request with invalid name.

test_validate_domain_create_with_tag_name_too_long()[source]
test_validate_domain_create_with_tags()[source]
test_validate_domain_create_with_tags_invalid_char()[source]
test_validate_domain_create_with_too_many_tags()[source]
test_validate_domain_request()[source]

Make sure we successfully validate a create domain request.

test_validate_domain_request_with_enabled()[source]

Validate enabled as boolean-like values for domains.

test_validate_domain_request_with_invalid_description_fails()[source]

Exception is raised when description is a non-string value.

test_validate_domain_request_with_invalid_enabled_fails()[source]

Exception is raised when enabled isn’t a boolean-like value.

test_validate_domain_request_with_name_too_long()[source]

Exception is raised when name is too long.

test_validate_domain_request_with_valid_description()[source]

Test that we validate description in create domain requests.

test_validate_domain_request_without_name_fails()[source]

Make sure we raise an exception when name isn’t included.

test_validate_domain_update_fails_with_invalid_name()[source]

Exception when validating an update request with invalid name.

test_validate_domain_update_request()[source]

Test that we validate a domain update request.

test_validate_domain_update_request_with_name_too_long_fails()[source]

Exception raised when updating a domain with name too long.

test_validate_domain_update_request_with_no_parameters_fails()[source]

Exception is raised when updating a domain without parameters.

test_validate_domain_update_with_tag_name_too_long()[source]
test_validate_domain_update_with_tags()[source]
test_validate_domain_update_with_tags_invalid_char()[source]
test_validate_domain_update_with_too_many_tags()[source]
class keystone.tests.unit.test_validation.EndpointGroupValidationTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 Endpoint Group API validation.

setUp()[source]
test_validate_create_endpoint_group_fails_with_invalid_filters()[source]

Validate invalid filters value in endpoint group parameters.

This test ensures that exception is raised when non-dict values is used as filters in endpoint group create request.

test_validate_endpoint_group_create_fails_without_filters()[source]

Exception raised when filters isn’t in endpoint group request.

test_validate_endpoint_group_create_fails_without_name()[source]

Exception raised when name isn’t in endpoint group request.

test_validate_endpoint_group_create_succeeds_with_req_parameters()[source]

Validate required endpoint group parameters.

This test ensure that validation succeeds with only the required parameters passed for creating an endpoint group.

test_validate_endpoint_group_create_succeeds_with_valid_filters()[source]

Validate filters in endpoint group create requests.

test_validate_endpoint_group_request_succeeds()[source]

Test that we validate an endpoint group request.

test_validate_endpoint_group_update_fails_with_invalid_filters()[source]

Exception raised when passing invalid filters in request.

test_validate_endpoint_group_update_fails_with_no_parameters()[source]

Exception raised when no parameters on endpoint group update.

test_validate_endpoint_group_update_request_succeeds()[source]

Test that we validate an endpoint group update request.

test_validate_endpoint_group_update_succeeds_with_name()[source]

Validate request with only name in endpoint group update.

This test ensures that passing only a name passes validation on update endpoint group request.

test_validate_endpoint_group_update_succeeds_with_valid_filters()[source]

Validate filters as dict values.

class keystone.tests.unit.test_validation.EndpointValidationTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 Endpoint API validation.

setUp()[source]
test_validate_create_endpoint_fails_with_invalid_enabled()[source]

Exception raised when boolean-like values as enabled.

test_validate_endpoint_create_fails_with_invalid_interface()[source]

Exception raised with invalid interface.

test_validate_endpoint_create_fails_with_invalid_region_id()[source]

Exception raised when passing invalid region(_id) in request.

test_validate_endpoint_create_fails_with_invalid_url()[source]

Exception raised when passing invalid url in request.

test_validate_endpoint_create_fails_without_interface()[source]

Exception raised when interface isn’t in endpoint request.

test_validate_endpoint_create_fails_without_service_id()[source]

Exception raised when service_id isn’t in endpoint request.

test_validate_endpoint_create_fails_without_url()[source]

Exception raised when url isn’t in endpoint request.

test_validate_endpoint_create_succeeds_with_extra_parameters()[source]

Test that extra parameters pass validation on create endpoint.

test_validate_endpoint_create_succeeds_with_required_parameters()[source]

Validate an endpoint request with only the required parameters.

test_validate_endpoint_create_succeeds_with_url()[source]

Validate url attribute in endpoint create request.

test_validate_endpoint_create_succeeds_with_valid_enabled()[source]

Validate an endpoint with boolean values.

Validate boolean values as enabled in endpoint create requests.

test_validate_endpoint_request_succeeds()[source]

Test that we validate an endpoint request.

test_validate_endpoint_update_fails_with_invalid_enabled()[source]

Exception raised when enabled is boolean-like value.

test_validate_endpoint_update_fails_with_invalid_interface()[source]

Exception raised when invalid interface on endpoint update.

test_validate_endpoint_update_fails_with_invalid_region_id()[source]

Exception raised when passing invalid region(_id) in request.

test_validate_endpoint_update_fails_with_invalid_url()[source]

Exception raised when passing invalid url in request.

test_validate_endpoint_update_fails_with_no_parameters()[source]

Exception raised when no parameters on endpoint update.

test_validate_endpoint_update_request_succeeds()[source]

Test that we validate an endpoint update request.

test_validate_endpoint_update_succeeds_with_extra_parameters()[source]

Test that extra parameters pass validation on update endpoint.

test_validate_endpoint_update_succeeds_with_url()[source]

Validate url attribute in endpoint update request.

test_validate_endpoint_update_succeeds_with_valid_enabled()[source]

Validate enabled as boolean values.

class keystone.tests.unit.test_validation.EntityValidationTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.BaseTestCase

setUp()[source]
test_create_entity_with_all_valid_parameters_validates()[source]

Validate all parameter values against test schema.

test_create_entity_with_invalid_email_fails()[source]

Validate invalid email address.

Test that an exception is raised when validating improperly formatted email addresses.

test_create_entity_with_invalid_enabled_format_raises_exception()[source]

Validate invalid enabled formats.

Test that an exception is raised when passing invalid boolean-like values as enabled.

test_create_entity_with_invalid_id_strings()[source]

Exception raised when using invalid id strings.

test_create_entity_with_invalid_urls_fails()[source]

Test that an exception is raised when validating improper urls.

test_create_entity_with_name_too_long_raises_exception()[source]

Validate long names.

Validate that an exception is raised when validating a string of 255+ characters passed in as a name.

test_create_entity_with_name_too_short_raises_exception()[source]

Validate short names.

Test that an exception is raised when passing a string of length zero as a name parameter.

test_create_entity_with_null_id_string()[source]

Validate that None is an acceptable optional string type.

test_create_entity_with_null_string_succeeds()[source]

Exception raised when passing None on required id strings.

test_create_entity_with_only_required_valid_parameters_validates()[source]

Validate correct for only parameters values against test schema.

test_create_entity_with_unicode_name_validates()[source]

Test that we successfully validate a unicode string.

test_create_entity_with_valid_email_validates()[source]

Validate email address.

Test that we successfully validate properly formatted email addresses.

test_create_entity_with_valid_enabled_formats_validates()[source]

Validate valid enabled formats.

Test that we have successful validation on boolean values for enabled.

test_create_entity_with_valid_id_strings()[source]

Validate acceptable id strings.

test_create_entity_with_valid_urls_validates()[source]

Test that proper urls are successfully validated.

test_update_entity_with_a_null_optional_parameter_validates()[source]

Optional parameters can be null to removed the value.

test_update_entity_with_a_required_null_parameter_fails()[source]

The name parameter can’t be null.

test_update_entity_with_a_valid_optional_parameter_validates()[source]

Succeed with only a single valid optional parameter.

test_update_entity_with_a_valid_required_parameter_validates()[source]

Succeed if a valid required parameter is provided.

test_update_entity_with_all_parameters_valid_validates()[source]

Simulate updating an entity by ID.

test_update_entity_with_invalid_optional_parameter_fails()[source]

Fail when an optional parameter is invalid.

test_update_entity_with_invalid_required_parameter_fails()[source]

Fail if a provided required parameter is invalid.

test_update_entity_with_no_parameters_fails()[source]

At least one parameter needs to be present for an update.

class keystone.tests.unit.test_validation.FederationProtocolValidationTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 Federation Protocol API validation.

setUp()[source]
test_validate_protocol_request_fails_with_invalid_mapping_id()[source]

Exception raised when mapping_id is not string.

test_validate_protocol_request_fails_with_invalid_params()[source]

Exception raised when unknown parameter is found.

test_validate_protocol_request_no_parameters()[source]

Test that schema validation with empty request body.

test_validate_protocol_request_succeeds()[source]

Test that we validate a protocol request successfully.

test_validate_protocol_request_succeeds_on_update()[source]

Test that we validate a protocol update request successfully.

test_validate_protocol_request_succeeds_with_nonuuid_mapping_id()[source]

Test that we allow underscore in mapping_id value.

test_validate_update_protocol_request_fails_with_invalid_id()[source]

Test that updating a protocol with a non-string mapping_id fail.

test_validate_update_protocol_request_fails_with_invalid_params()[source]

Exception raised when unknown parameter in protocol update.

test_validate_update_protocol_request_succeeds_with_nonuuid_id()[source]

Test that we allow underscore in mapping_id value when updating.

test_validate_update_protocol_with_no_parameters_fails()[source]

Test that updating a protocol requires at least one attribute.

class keystone.tests.unit.test_validation.GroupValidationTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 Group API validation.

setUp()[source]
test_validate_group_create_fails_with_invalid_name()[source]

Exception when validating a create request with invalid name.

test_validate_group_create_fails_without_group_name()[source]

Exception raised when group name is not provided in request.

test_validate_group_create_succeeds()[source]

Validate create group requests.

test_validate_group_create_succeeds_with_all_parameters()[source]

Validate create group requests with all parameters.

test_validate_group_create_succeeds_with_extra_parameters()[source]

Validate extra attributes on group create requests.

test_validate_group_update_fails_with_invalid_name()[source]

Exception when validating an update request with invalid name.

test_validate_group_update_fails_with_no_parameters()[source]

Exception raised when no parameters passed in on update.

test_validate_group_update_succeeds()[source]

Validate group update requests.

test_validate_group_update_succeeds_with_extra_parameters()[source]

Validate group update requests with extra parameters.

class keystone.tests.unit.test_validation.IdentityProviderValidationTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 Identity Provider API validation.

setUp()[source]
test_validate_idp_request_fails_with_invalid_params()[source]

Exception raised when unknown parameter is found.

test_validate_idp_request_no_parameters()[source]

Test that schema validation with empty request body.

test_validate_idp_request_remote_id_nullable()[source]

Test that remote_ids could be explicitly set to None.

test_validate_idp_request_succeeds()[source]

Test that we validate an identity provider request.

test_validate_idp_request_with_duplicated_remote_id()[source]

Exception is raised when the duplicated remote_ids is found.

test_validate_idp_request_with_enabled()[source]

Validate enabled as boolean-like values.

test_validate_idp_request_with_invalid_description_fails()[source]

Exception is raised when description as a non-string value.

test_validate_idp_request_with_invalid_enabled_fails()[source]

Exception is raised when enabled isn’t a boolean-like value.

test_validate_idp_request_with_invalid_remote_id_fails()[source]

Exception is raised when remote_ids is not a array.

class keystone.tests.unit.test_validation.LimitValidationTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 Limits API validation.

setUp()[source]
test_validate_limit_create_request_succeeds()[source]
test_validate_limit_create_request_with_addition_input_fails()[source]
test_validate_limit_create_request_with_invalid_input()[source]
test_validate_limit_create_request_without_region()[source]
test_validate_limit_create_request_without_required_fails()[source]
test_validate_limit_request_with_no_parameters()[source]
test_validate_limit_update_request_succeeds()[source]
test_validate_limit_update_request_with_addition_input_fails()[source]
test_validate_limit_update_request_with_invalid_input()[source]
test_validate_limit_update_request_without_id_fails()[source]
test_validate_registered_limit_create_request_succeeds()[source]
test_validate_registered_limit_create_request_with_addition()[source]
test_validate_registered_limit_create_request_with_invalid_input()[source]
test_validate_registered_limit_create_request_without_region()[source]
test_validate_registered_limit_create_request_without_required()[source]
test_validate_registered_limit_request_with_no_parameters()[source]
test_validate_registered_limit_update_request_with_addition()[source]
test_validate_registered_limit_update_request_with_invalid_input()[source]
test_validate_registered_limit_update_request_without_id()[source]
test_validate_registered_limit_update_request_without_region()[source]
class keystone.tests.unit.test_validation.OAuth1ValidationTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 Identity OAuth1 API validation.

setUp()[source]
test_validate_authorize_request_token()[source]
test_validate_authorize_request_token_with_additional_properties()[source]
test_validate_authorize_request_token_with_id_and_name()[source]
test_validate_authorize_request_token_with_non_id_or_name()[source]
test_validate_consumer_request_succeeds()[source]

Test that we validate a consumer request successfully.

test_validate_consumer_request_with_invalid_description_fails()[source]

Exception is raised when description as a non-string value.

test_validate_consumer_request_with_no_parameters()[source]

Test that schema validation with empty request body.

test_validate_consumer_request_with_none_desc()[source]

Test that schema validation with None desc.

test_validate_update_consumer_request_fails_with_secret()[source]

Exception raised when secret is given.

class keystone.tests.unit.test_validation.PasswordValidationTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.TestCase

setUp()[source]
test_password_validate_with_invalid_password_regex()[source]
test_password_validate_with_invalid_strong_password()[source]
test_password_validate_with_valid_strong_password()[source]
class keystone.tests.unit.test_validation.PolicyValidationTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 Policy API validation.

setUp()[source]
test_validate_policy_create_with_extra_parameters_succeeds()[source]

Validate policy create with extra parameters.

test_validate_policy_create_with_invalid_type_fails()[source]

Exception raised when blob and type are boolean.

test_validate_policy_succeeds()[source]

Test that we validate a create policy request.

test_validate_policy_update_succeeds()[source]

Test that we validate a policy update request.

test_validate_policy_update_with_extra_parameters_succeeds()[source]

Validate policy update request with extra parameters.

test_validate_policy_update_with_invalid_type_fails()[source]

Exception raised when invalid type on policy update.

test_validate_policy_update_without_parameters_fails()[source]

Exception raised when updating policy without parameters.

test_validate_policy_without_blob_fails()[source]

Exception raised without blob in request.

test_validate_policy_without_type_fails()[source]

Exception raised without type in request.

class keystone.tests.unit.test_validation.ProjectValidationTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 Project API validation.

setUp()[source]
test_validate_project_create_fails_with_invalid_name()[source]

Exception when validating a create request with invalid name.

test_validate_project_create_request_with_valid_domain_id()[source]

Test that we validate domain_id in create project requests.

test_validate_project_create_with_tag_name_too_long()[source]
test_validate_project_create_with_tags()[source]
test_validate_project_create_with_tags_invalid_char()[source]
test_validate_project_create_with_too_many_tags()[source]
test_validate_project_request()[source]

Test that we validate a project with name in request.

test_validate_project_request_with_enabled()[source]

Validate enabled as boolean-like values for projects.

test_validate_project_request_with_invalid_description_fails()[source]

Exception is raised when description as a non-string value.

test_validate_project_request_with_invalid_domain_id_fails()[source]

Exception is raised when domain_id is a non-id value.

test_validate_project_request_with_invalid_enabled_fails()[source]

Exception is raised when enabled isn’t a boolean-like value.

test_validate_project_request_with_invalid_parent_id_fails()[source]

Exception is raised when parent_id as a non-id value.

test_validate_project_request_with_name_too_long()[source]

Exception is raised when name is too long.

test_validate_project_request_with_valid_description()[source]

Test that we validate description in create project requests.

test_validate_project_request_with_valid_parent_id()[source]

Test that we validate parent_id in create project requests.

test_validate_project_request_without_name_fails()[source]

Validate project request fails without name.

test_validate_project_update_fails_with_invalid_name()[source]

Exception when validating an update request with invalid name.

test_validate_project_update_request()[source]

Test that we validate a project update request.

test_validate_project_update_request_with_name_too_long_fails()[source]

Exception raised when updating a project with name too long.

test_validate_project_update_request_with_no_parameters_fails()[source]

Exception is raised when updating project without parameters.

test_validate_project_update_with_tag_name_too_long()[source]
test_validate_project_update_with_tags()[source]
test_validate_project_update_with_tags_invalid_char()[source]
test_validate_project_update_with_too_many_tags()[source]
class keystone.tests.unit.test_validation.RegionValidationTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 Region API validation.

setUp()[source]
test_validate_region_create_fails_with_invalid_region_id()[source]

Exception raised when passing invalid id in request.

test_validate_region_create_request_with_parameters()[source]

Test that we validate a region request with parameters.

test_validate_region_create_succeeds_with_extra_parameters()[source]

Validate create region request with extra values.

test_validate_region_create_succeeds_with_no_parameters()[source]

Validate create region request with no parameters.

test_validate_region_create_with_uuid()[source]

Test that we validate a region request with a UUID as the id.

test_validate_region_request()[source]

Test that we validate a basic region request.

test_validate_region_update_fails_with_no_parameters()[source]

Exception raised when passing no parameters in a region update.

test_validate_region_update_succeeds()[source]

Test that we validate a region update request.

test_validate_region_update_succeeds_with_extra_parameters()[source]

Validate extra attributes in the region update request.

class keystone.tests.unit.test_validation.RoleValidationTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 Role API validation.

setUp()[source]
test_validate_role_create_fails_with_invalid_name()[source]

Exception when validating a create request with invalid name.

test_validate_role_create_request_with_name_too_long_fails()[source]

Exception raised when creating a role with name too long.

test_validate_role_create_without_name_raises_exception()[source]

Test that we raise an exception when name isn’t included.

test_validate_role_request()[source]

Test we can successfully validate a create role request.

test_validate_role_update_fails_with_invalid_name()[source]

Exception when validating an update request with invalid name.

test_validate_role_update_request()[source]

Test that we validate a role update request.

test_validate_role_update_request_with_name_too_long_fails()[source]

Exception raised when updating a role with name too long.

class keystone.tests.unit.test_validation.ServiceProviderValidationTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 Service Provider API validation.

setUp()[source]
test_validate_sp_request()[source]

Test that we validate auth_url and sp_url in request.

test_validate_sp_request_with_enabled()[source]

Validate enabled as boolean-like values.

test_validate_sp_request_with_extra_field_fails()[source]

Exception raised when passing extra fields in the body.

test_validate_sp_request_with_invalid_auth_url_fails()[source]

Validate request fails with invalid auth_url.

test_validate_sp_request_with_invalid_description_fails()[source]

Exception is raised when description as a non-string value.

test_validate_sp_request_with_invalid_enabled_fails()[source]

Exception is raised when enabled isn’t a boolean-like value.

test_validate_sp_request_with_invalid_sp_url_fails()[source]

Validate request fails with invalid sp_url.

test_validate_sp_request_with_valid_description()[source]

Test that we validate description in create requests.

test_validate_sp_request_without_auth_url_fails()[source]

Validate request fails without auth_url.

test_validate_sp_request_without_sp_url_fails()[source]

Validate request fails without sp_url.

test_validate_sp_update_request()[source]

Test that we validate a update request.

test_validate_sp_update_request_with_invalid_auth_url_fails()[source]

Exception raised when updating with invalid auth_url.

test_validate_sp_update_request_with_invalid_sp_url_fails()[source]

Exception raised when updating with invalid sp_url.

test_validate_sp_update_request_with_no_parameters_fails()[source]

Exception is raised when updating without parameters.

class keystone.tests.unit.test_validation.ServiceValidationTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 Service API validation.

setUp()[source]
test_validate_service_create_fails_when_name_too_long()[source]

Exception raised when name is greater than 255 characters.

test_validate_service_create_fails_when_name_too_short()[source]

Exception is raised when name is too short.

test_validate_service_create_fails_when_type_too_long()[source]

Exception is raised when type is too long.

test_validate_service_create_fails_when_type_too_short()[source]

Exception is raised when type is too short.

test_validate_service_create_fails_with_invalid_enabled()[source]

Exception raised when boolean-like parameters as enabled.

On service create, make sure an exception is raised if enabled is not a boolean value.

test_validate_service_create_fails_without_type()[source]

Exception raised when trying to create a service without type.

test_validate_service_create_succeeds()[source]

Test that we validate a service create request.

test_validate_service_create_succeeds_with_extra_parameters()[source]

Test that extra parameters pass validation on create service.

test_validate_service_create_succeeds_with_required_parameters()[source]

Validate a service create request with the required parameters.

test_validate_service_create_succeeds_with_valid_enabled()[source]

Validate boolean values as enabled values on service create.

test_validate_service_update_fails_with_invalid_enabled()[source]

Exception raised when boolean-like values as enabled.

test_validate_service_update_fails_with_name_too_long()[source]

Exception is raised when name is too long on update.

test_validate_service_update_fails_with_name_too_short()[source]

Exception is raised when name is too short on update.

test_validate_service_update_fails_with_no_parameters()[source]

Exception raised when updating a service without values.

test_validate_service_update_fails_with_type_too_long()[source]

Exception is raised when type is too long on update.

test_validate_service_update_fails_with_type_too_short()[source]

Exception is raised when type is too short on update.

test_validate_service_update_request_succeeds()[source]

Test that we validate a service update request.

test_validate_service_update_succeeds_with_extra_parameters()[source]

Validate updating a service with extra parameters.

test_validate_service_update_succeeds_with_valid_enabled()[source]

Validate boolean formats as enabled on service update.

class keystone.tests.unit.test_validation.TrustValidationTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 Trust API validation.

setUp()[source]
test_validate_trust_succeeds()[source]

Test that we can validate a trust request.

test_validate_trust_with_all_parameters_succeeds()[source]

Test that we can validate a trust request with all parameters.

test_validate_trust_with_extra_parameters_succeeds()[source]

Test that we can validate a trust request with extra parameters.

test_validate_trust_with_invalid_expires_at_fails()[source]

Validate trust request with invalid expires_at fails.

test_validate_trust_with_invalid_impersonation_fails()[source]

Validate trust request with invalid impersonation fails.

test_validate_trust_with_invalid_role_type_fails()[source]

Validate trust request with invalid roles fails.

test_validate_trust_with_list_of_valid_roles_succeeds()[source]

Validate trust request with a list of valid roles.

test_validate_trust_with_null_remaining_uses_succeeds()[source]

Validate trust request with null remaining_uses.

test_validate_trust_with_period_in_user_id_string()[source]

Validate trust request with a period in the user id string.

test_validate_trust_with_remaining_uses_succeeds()[source]

Validate trust request with remaining_uses succeeds.

test_validate_trust_with_role_types_succeeds()[source]

Validate trust request with roles succeeds.

test_validate_trust_without_impersonation_fails()[source]

Validate trust request fails without impersonation.

test_validate_trust_without_trustee_id_fails()[source]

Validate trust request fails without trustee_id.

test_validate_trust_without_trustor_id_fails()[source]

Validate trust request fails without trustor_id.

class keystone.tests.unit.test_validation.UserValidationTestCase(*args, **kwargs)[source]

Bases: keystone.tests.unit.core.BaseTestCase

Test for V3 User API validation.

setUp()[source]
test_user_create_options_change_password_required_none()[source]
test_user_create_options_change_password_required_wrong_type()[source]
test_user_create_options_fails_invalid_option()[source]
test_user_create_succeeds_with_empty_options()[source]
test_user_create_with_mfa_rules()[source]
test_user_create_with_mfa_rules_enabled()[source]
test_user_create_with_options_change_password_required()[source]
test_user_create_with_options_lockout_password()[source]
test_user_create_with_two_options()[source]
test_user_option_validation_with_invalid_mfa_rules_fails()[source]
test_user_update_mfa_rules_enabled()[source]
test_user_update_with_mfa_rules()[source]
test_user_update_with_options_change_password_required()[source]
test_user_update_with_options_lockout_password()[source]
test_user_update_with_two_options()[source]
test_validate_user_create_fails_with_invalid_enabled_formats()[source]

Exception raised when enabled is not an acceptable format.

test_validate_user_create_fails_with_invalid_name()[source]

Exception when validating a create request with invalid name.

test_validate_user_create_fails_with_invalid_password_type()[source]

Exception raised when user password is of the wrong type.

test_validate_user_create_fails_without_name()[source]

Exception raised when validating a user without name.

test_validate_user_create_request_succeeds()[source]

Test that validating a user create request succeeds.

test_validate_user_create_succeeds_with_extra_attributes()[source]

Validate extra parameters on user create requests.

test_validate_user_create_succeeds_with_null_description()[source]

Validate that description can be nullable on create user.

test_validate_user_create_succeeds_with_null_password()[source]

Validate that password is nullable on create user.

test_validate_user_create_succeeds_with_password_of_zero_length()[source]

Validate empty password on user create requests.

test_validate_user_create_succeeds_with_valid_enabled_formats()[source]

Validate acceptable enabled formats in create user requests.

test_validate_user_create_with_all_valid_parameters_succeeds()[source]

Test that validating a user create request succeeds.

test_validate_user_update_fails_with_invalid_name()[source]

Exception when validating an update request with invalid name.

test_validate_user_update_fails_with_no_parameters()[source]

Exception raised when updating nothing.

test_validate_user_update_succeeds()[source]

Validate an update user request.

test_validate_user_update_succeeds_with_extra_parameters()[source]

Validate user update requests with extra parameters.

keystone.tests.unit.test_versions module

keystone.tests.unit.test_wsgi module

keystone.tests.unit.utils module

Useful utilities for tests.

keystone.tests.unit.utils.new_uuid()[source]

Return a string UUID.

keystone.tests.unit.utils.timezone(func)[source]
keystone.tests.unit.utils.wip(message, expected_exception=<type 'exceptions.Exception'>, bug=None)[source]

Mark a test as work in progress.

Based on code by Nat Pryce: https://gist.github.com/npryce/997195#file-wip-py

The test will always be run. If the test fails then a TestSkipped exception is raised. If the test passes an AssertionError exception is raised so that the developer knows they made the test pass. This is a reminder to remove the decorator.

Parameters:
  • message – a string message to help clarify why the test is marked as a work in progress
  • expected_exception – an exception class that will be checked for when @wip verifies an exception is raised. The test will fail if a different exception is raised. Default is “any” exception is valid
  • bug – (optional) a string for tracking the bug and what bug should cause the @wip decorator to be removed from the testcase
Usage:
>>> @wip('Expected Error', expected_exception=Exception, bug="#000000")
>>> def test():
>>>     pass

Module contents

Creative Commons Attribution 3.0 License

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.

Page Contents