Bases: keystone.cli.BasePermissionsSetup
Provides common options for certificate setup.
Bases: keystone.cli.BaseApp
Common user/group setup for file permissions.
Bases: keystone.cli.BaseApp
Sync the database.
Bases: keystone.cli.BaseApp
Print the current migration version of the database.
Bases: keystone.cli.BaseApp
Upload the domain specific configuration files to the database.
Bases: object
Read configs from file(s) and load into database.
The command line parameters have already been parsed and the CONF command option will have been set. It is either set to the name of an explicit domain, or it’s None to indicate that we want all domain config files.
Upload a single config file to the database.
Parameters: |
|
---|---|
Raises: | ValueError: the domain does not exist or already has domain specific configurations defined |
Raises: | Exceptions from oslo config: there is an issue with options defined in the config file or its format |
The caller of this method should catch the errors raised and handle appropriately in order that the best UX experience can be provided for both the case of when a user has asked for a specific config file to be uploaded, as well as all config files in a directory.
Upload configs from file and load into database.
This method will be called repeatedly for all the config files in the config directory. To provide a better UX, we differentiate the error handling in this case (versus when the user has asked for a single config file to be uploaded).
Validate the options, returning True if they are indeed valid.
It would be nice to use the argparse automated checking for this validation, but the only way I can see doing that is to make the default (i.e. if no optional parameters are specified) to upload all configuration files - and that sounds too dangerous as a default. So we use it in a slightly unconventional way, where all parameters are optional, but you must specify at least one.
Bases: keystone.cli.BasePermissionsSetup
Rotate Fernet encryption keys.
This assumes you have already run keystone-manage fernet_setup.
A new primary key is placed into rotation, which is used for new tokens. The old primary key is demoted to secondary, which can then still be used for validating tokens. Excess secondary keys (beyond [fernet_tokens] max_active_keys) are revoked. Revoked keys are permanently deleted. A new staged key will be created and used to validate tokens. The next time key rotation takes place, the staged key will be put into rotation as the primary key.
Rotating keys too frequently, or with [fernet_tokens] max_active_keys set too low, will cause tokens to become invalid prior to their expiration.
Bases: keystone.cli.BasePermissionsSetup
Setup a key repository for Fernet tokens.
This also creates a primary key used for both creating and validating Keystone Lightweight tokens. To improve security, you should rotate your keys (using keystone-manage fernet_rotate, for example).
Bases: keystone.cli.BaseApp
Purge the mapping table.
Bases: keystone.cli.BaseCertificateSetup
Set up Key pairs and certificates for token signing and verification.
This is NOT intended for production use, see Keystone Configuration documentation for details.
Bases: keystone.cli.BaseCertificateSetup
Create key pairs and certificates for HTTPS connections.
This is NOT intended for production use, see Keystone Configuration documentation for details.
Bases: keystone.cli.BaseApp
Generate Identity Provider metadata.
Bases: keystone.cli.BaseApp
Flush expired tokens from the backend.
Wrapper for keystone.common.config that configures itself on import.
Find Keystone’s paste.deploy configuration file.
Keystone’s paste.deploy configuration file is specified in the [paste_deploy] section of the main Keystone configuration file, keystone.conf.
For example:
[paste_deploy]
config_file = keystone-paste.ini
Returns: | The selected configuration filename |
---|---|
Raises: | exception.ConfigFileNotFound |
Set the default for the default_log_levels option for keystone.
Keystone uses some packages that other OpenStack services don’t use that do logging. This will set the default_log_levels default level for those packages.
This function needs to be called before CONF().
Bases: keystone.common.wsgi.Application
Base extensions controller to be extended by public and admin API’s.
Bases: object
Bases: keystone.exception.AuthPluginException
Bases: keystone.exception.UnexpectedError
Bases: keystone.exception.AuthPluginException
Bases: keystone.exception.Unauthorized
Bases: keystone.exception.Error
Bases: keystone.exception.UnexpectedError
Bases: keystone.exception.Error
Bases: keystone.exception.NotFound
Bases: keystone.exception.Forbidden
Bases: keystone.exception.NotFound
Bases: keystone.exception.NotFound
Bases: keystone.exception.NotFound
Bases: keystone.exception.NotFound
Bases: exceptions.Exception
Base error class.
Child classes should define an HTTP status code, title, and a message_format.
Bases: keystone.exception.NotFound
Bases: keystone.exception.SecurityError
Bases: keystone.exception.Forbidden
Bases: keystone.exception.Error
Bases: keystone.exception.NotFound
Bases: keystone.exception.NotFound
Bases: keystone.exception.Forbidden
Bases: keystone.exception.Forbidden
Bases: keystone.exception.NotFound
Bases: keystone.exception.Forbidden
Bases: keystone.exception.UnexpectedError
Bases: keystone.exception.UnexpectedError
Bases: keystone.exception.UnexpectedError
Bases: keystone.exception.NotFound
Bases: keystone.exception.UnexpectedError
Bases: keystone.exception.NotFound
(dolph): metadata is not a user-facing concept, so this exception should not be exposed
Bases: exceptions.Exception
Bases: keystone.exception.Unauthorized
Bases: keystone.exception.UnexpectedError
Bases: keystone.exception.Error
Bases: keystone.exception.Error
Bases: keystone.exception.UnexpectedError
Bases: keystone.exception.Error
Bases: keystone.exception.Error
Bases: keystone.exception.NotFound
Bases: keystone.exception.NotFound
Bases: keystone.exception.NotFound
Bases: keystone.exception.NotFound
Bases: keystone.exception.Error
Bases: keystone.exception.NotFound
Bases: keystone.exception.NotFound
Bases: keystone.exception.NotFound
Bases: keystone.exception.UnexpectedError
Bases: keystone.exception.ValidationError
Bases: keystone.exception.Error
Avoids exposing details of security failures, unless in debug mode.
Bases: keystone.exception.NotFound
Bases: keystone.exception.NotFound
Bases: keystone.exception.ValidationError
Bases: keystone.exception.NotFound
Bases: keystone.exception.UnexpectedError
Bases: keystone.exception.NotFound
Bases: keystone.exception.Forbidden
Bases: keystone.exception.SecurityError
Avoids exposing details of failures, unless in debug mode.
Bases: exceptions.Exception
Token version is unrecognizable or unsupported.
Bases: keystone.exception.NotFound
Bases: keystone.exception.Error
Bases: keystone.exception.Error
Bases: keystone.exception.Error
Bases: keystone.exception.NotFound
oslo.i18n integration module.
See http://docs.openstack.org/developer/oslo.i18n/usage.html .
Notifications module for OpenStack Identity Service resources
Bases: object
Namespace for audit notification functions.
This is a namespace object to contain all of the direct notification functions utilized for Manager methods.
Bases: object
Send CADF event notifications for various methods.
This function is only used for Authentication events. Its action and event_type are dictated below.
Sends CADF notifications for events such as whether an authentication was successful or not.
Parameters: | operation – The authentication related action being performed |
---|
Bases: object
Send CADF notifications for role_assignment methods.
This function is only used for role assignment events. Its action and event_type are dictated below.
action: created.role_assignment or deleted.role_assignment
identity.role_assignment.deleted
Sends a CADF notification if the wrapped method does not raise an Exception (such as keystone.exception.NotFound).
Parameters: | operation – one of the values from ACTIONS (create or delete) |
---|
Bases: object
Send event notifications for Manager methods.
Sends a notification if the wrapped Manager method does not raise an Exception (such as keystone.exception.NotFound).
Parameters: |
|
---|
Empty subscribers dictionary.
This effectively stops notifications since there will be no subscribers to publish to.
Decorator to send notifications for Manager.create_* methods.
Decorator to send notifications for Manager.delete_* methods.
Decorator to send notifications when an object is disabled.
alias of CadfNotificationWrapper
Decorator to send notifications for internal notifications only.
Sends a notification to registered extensions.
Register each callback with the event.
Parameters: |
|
---|---|
Raises: |
|
Reset the notifications internal state.
This is used only for testing purposes.
Send notification to inform observers about SAML events.
Parameters: |
|
---|
The only types of routers in this file should be ComposingRouters.
The routers for the backends should be in the backend-specific router modules. For example, the ComposableRouter for identity belongs in:
keystone.identity.routers