File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/libcloud/common/__pycache__/openstack_identity.cpython-310.pyc
Back
o ;j� � @ s� d Z ddlZddlmZ ddlmZ ddlmZmZm Z ddl m Z m Z m Z ddlmZ zddlZW n ey? ddlZY nw dZd Zg d �Zd Zg d �ZG d d� d�Zedg d��ZG dd� d�ZG dd� d�ZG dd� d�Z G dd� d�Z G dd� d�Z G dd � d �Z G d d � d �Z G d d � d �Z!G d!d"� d"�Z"G d#d$� d$�Z#G d%d&� d&�Z$G d'd(� d(e�Z%G d)d*� d*e�Z&G d+d,� d,e&�Z'G d-d.� d.e&�Z(G d/d0� d0e&�Z)G d1d2� d2e&�Z*G d3d4� d4e*�Z+G d5d6� d6e*�Z,G d7d8� d8e&e �Z-d9d:� Z.dS );za Common / shared code for handling authentication against OpenStack identity service (Keystone). � N)� namedtuple)�httplib)�Response�ConnectionUserAndKey�CertificateConnection)� LibcloudError�InvalidCredsError�MalformedResponseError)� parse_date�1.1z X-Auth-Token) r �2.0� 2.0_apikey� 2.0_password�2.0_voms�3.0� 3.x_password� 3.x_appcred�3.x_oidc_access_token� )� OpenStackAuthenticationCache� OpenStackAuthenticationCacheKey� OpenStackAuthenticationContext�OpenStackIdentityVersion�OpenStackIdentityDomain�OpenStackIdentityProject�OpenStackIdentityUser�OpenStackIdentityRole�OpenStackServiceCatalog� OpenStackServiceCatalogEntry�$OpenStackServiceCatalogEntryEndpoint� OpenStackIdentityEndpointType�OpenStackIdentityConnection� OpenStackIdentity_1_0_Connection� OpenStackIdentity_1_1_Connection� OpenStackIdentity_2_0_Connection�%OpenStackIdentity_2_0_Connection_VOMS� OpenStackIdentity_3_0_Connection�(OpenStackIdentity_3_0_Connection_AppCred�2OpenStackIdentity_3_0_Connection_OIDC_access_token�get_class_for_auth_versionc @ s( e Zd ZdZdd� Zdd� Zdd� ZdS ) r a� Base class for external OpenStack authentication caches. Authentication tokens are always cached in memory in :class:`OpenStackIdentityConnection`.auth_token and related fields. These tokens are lost when the driver is garbage collected. To share tokens among multiple drivers, processes, or systems, use an :class:`OpenStackAuthenticationCache` in OpenStackIdentityConnection.auth_cache. Cache implementers should inherit this class and define the methods below. c C � t �)a( Get an authentication context from the cache. :param key: Key to fetch. :type key: :class:`.OpenStackAuthenticationCacheKey` :return: The cached context for the given key, if present; None if not. :rtype: :class:`OpenStackAuthenticationContext` ��NotImplementedError��self�key� r0 �V/opt/saltstack/salt/lib/python3.10/site-packages/libcloud/common/openstack_identity.py�get` � z OpenStackAuthenticationCache.getc C r* )a& Put an authentication context into the cache. :param key: Key where the context will be stored. :type key: :class:`.OpenStackAuthenticationCacheKey` :param context: The context to cache. :type context: :class:`.OpenStackAuthenticationContext` r+ )r. r/ �contextr0 r0 r1 �putl r3 z OpenStackAuthenticationCache.putc C r* )z� Clear an authentication context from the cache. :param key: Key to clear. :type key: :class:`.OpenStackAuthenticationCacheKey` r+ r- r0 r0 r1 �clearx s z"OpenStackAuthenticationCache.clearN)�__name__� __module__� __qualname__�__doc__r2 r5 r6 r0 r0 r0 r1 r R s r r )�auth_url�user_id� token_scope� tenant_name� domain_name�tenant_domain_idc @ s e Zd ZdZddd�ZdS )r z6 An authentication token and related context. Nc C �" || _ || _|| _|| _|| _d S �N)�token� expiration�user�roles�urls)r. rC rD rE rF rG r0 r0 r1 �__init__� � z'OpenStackAuthenticationContext.__init__)NNNN)r7 r8 r9 r: rH r0 r0 r0 r1 r � s r c @ � e Zd ZdZdZdZdZdS )r z: Enum class for openstack identity endpoint type. �internal�external�adminN)r7 r8 r9 r: �INTERNAL�EXTERNAL�ADMINr0 r0 r0 r1 r � � r c @ rJ )�OpenStackIdentityTokenScopez8 Enum class for openstack identity token scope. �project�domainZunscopedN)r7 r8 r9 r: �PROJECT�DOMAIN�UNSCOPEDr0 r0 r0 r1 rR � rQ rR c @ � e Zd Zdd� Zdd� ZdS )r c C � || _ || _|| _|| _d S rB ��version�status�updated�url)r. r[ r\ r] r^ r0 r0 r1 rH � � z!OpenStackIdentityVersion.__init__c C � d| j | j| j| jf S )NzD<OpenStackIdentityVersion version=%s, status=%s, updated=%s, url=%s>rZ �r. r0 r0 r1 �__repr__� � �z!OpenStackIdentityVersion.__repr__N�r7 r8 r9 rH rb r0 r0 r0 r1 r � � r c @ rX )r c C s || _ || _|| _d S rB ��id�name�enabled)r. rg rh ri r0 r0 r1 rH � s z OpenStackIdentityDomain.__init__c C s d� | j| j| j�S )Nz4<OpenStackIdentityDomain id={}, name={}, enabled={}>)�formatrg rh ri ra r0 r0 r1 rb � s �z OpenStackIdentityDomain.__repr__Nrd r0 r0 r0 r1 r � s r c @ s e Zd Zddd�Zdd� ZdS )r Nc C rA rB �rg rh � descriptionri � domain_id)r. rg rh rl ri rm r0 r0 r1 rH � rI z!OpenStackIdentityProject.__init__c C r` )NzC<OpenStackIdentityProject id=%s, domain_id=%s, name=%s, enabled=%s>)rg rm rh ri ra r0 r0 r1 rb � rc z!OpenStackIdentityProject.__repr__rB rd r0 r0 r0 r1 r � s r c @ rX )r c C rY rB �rg rh rl ri )r. rg rh rl ri r0 r0 r1 rH � r_ z OpenStackIdentityRole.__init__c C r` )NzB<OpenStackIdentityRole id=%s, name=%s, description=%s, enabled=%s>rn ra r0 r0 r1 rb � rc z OpenStackIdentityRole.__repr__Nrd r0 r0 r0 r1 r � re r c @ rX )r c C s( || _ || _|| _|| _|| _|| _d S rB �rg rm rh �emailrl ri )r. rg rm rh rp rl ri r0 r0 r1 rH � s z OpenStackIdentityUser.__init__c C s d| j | j| j| j| jf S )NzJ<OpenStackIdentityUser id=%s, domain_id=%s, name=%s, email=%s, enabled=%s>)rg rm rh rp ri ra r0 r0 r1 rb � s �z OpenStackIdentityUser.__repr__Nrd r0 r0 r0 r1 r � s r c @ s� e Zd ZdZdZdZefdd�Zdd� Zdd� Z dd d �Z dd d �Z ddde j fd d�Zd dd�Zd dd�Zddd�Zdd� Zdd� Zdd� ZdS ) r aU http://docs.openstack.org/api/openstack-identity-service/2.0/content/ This class should be instantiated with the contents of the 'serviceCatalog' in the auth response. This will do the work of figuring out which services actually exist in the catalog as well as split them up by type, name, and region if available Nc C s� || _ d| j v r| j|d�}n$d| j v r| j|d�}nd| j v s%d| j v r,| j|d�}ntd| j ��t|dd� d �}|| _d S ) Nz3.x)�service_catalogr r �1.0z auth version "%s" not supportedc S s | j | jpd S �N� )� service_type� service_name��xr0 r0 r1 �<lambda> s z2OpenStackServiceCatalog.__init__.<locals>.<lambda>�r/ )� _auth_version� _parse_service_catalog_auth_v3� _parse_service_catalog_auth_v2� _parse_service_catalog_auth_v1r �sorted�_entries)r. rq � auth_version�entriesr0 r0 r1 rH s z OpenStackServiceCatalog.__init__c C � | j S )z� Return all the entries for this service catalog. :rtype: ``list`` of :class:`.OpenStackServiceCatalogEntry` )r� ra r0 r0 r1 � get_entries! s z#OpenStackServiceCatalog.get_entriesc C � | � � S )zD Deprecated in the favor of ``get_entries`` method. )r� ra r0 r0 r1 � get_catalog) s z#OpenStackServiceCatalog.get_catalogc C s< | j ||d�}g }|D ]}|j}|tjkr|�|j� q |S )zs Retrieve all the available public (external) URLs for the provided service type and name. )ru rh )� get_endpoints� endpoint_typer rO �appendr^ )r. ru rh � endpoints�result�endpointr� r0 r0 r1 �get_public_urls/ s �z'OpenStackServiceCatalog.get_public_urlsc C sJ g }| j D ] }|r|j|krq|r|j|krq|jD ]}|�|� qq|S )z� Retrieve all the endpoints for the provided service type and name. :rtype: ``list`` of :class:`.OpenStackServiceCatalogEntryEndpoint` )r� ru rv r� r� )r. ru rh r� �entryr� r0 r0 r1 r� > s �z%OpenStackServiceCatalog.get_endpointsc C s� g }| j D ]-}|r|j|krq|r|j|krq|jD ]}|r$|j|kr$q|r,|j|kr,q|�|� qqt|�dkr=|d S t|�dkrGtd��t d��)z� Retrieve a single endpoint using the provided criteria. Note: If no or more than one matching endpoint is found, an exception is thrown. � r z#Found more than 1 matching endpointz!Could not find specified endpoint) r� ru rv r� �regionr� r� �len� ValueErrorr )r. ru rh r� r� r� r� r� r0 r0 r1 � get_endpointV s$ � z$OpenStackServiceCatalog.get_endpointc C sL t � }| jD ]}|r|j|krq|jD ] }|jr |�|j� qqtt|��S )z� Retrieve a list of all the available regions. :param service_type: If specified, only return regions for this service type. :type service_type: ``str`` :rtype: ``list`` of ``str`` )�setr� ru r� r� �addr �list)r. ru Zregionsr� r� r0 r0 r1 � get_regions| s �� z#OpenStackServiceCatalog.get_regionsc C sT t � }| jD ] }d}|jD ] }|r|j|krd} nq |r#|�|j� qtt|��S )z� Retrieve all the available service types. :param region: Optional region to retrieve service types for. :type region: ``str`` :rtype: ``list`` of ``str`` TF)r� r� r� r� r� ru r r� )r. r� Z service_typesr� �includer� r0 r0 r1 �get_service_types� s � � z)OpenStackServiceCatalog.get_service_typesc C s� t � }d| jvrtd| j ��| jD ](}|r |j|kr qd}|jD ] }|r.|j|kr.d} nq!|r:|jr:|�|j� qt t |��S )z� Retrieve list of service names that match service type and region. :type service_type: ``str`` :type region: ``str`` :rtype: ``list`` of ``str`` r zUnsupported version: %sTF) r� r{ r� r� ru r� r� rv r� r r� )r. ru r� �namesr� r� r� r0 r0 r1 �get_service_names� s � � z)OpenStackServiceCatalog.get_service_namesc C s� g }|� � D ]F\}}g }|D ]2}|�dd �}|�dd �}|�dd �} |r1t||tjd�} |�| � | r@t|| tjd�} |�| � qt||d�} |�| � q|S )Nr� � publicURL� internalURL�r� r^ r� )ru r� )�itemsr2 r r rO r� rN r ) r. rq r� �servicer� �entry_endpointsr� r� � public_url� private_url�entry_endpointr� r0 r0 r1 r~ � s2 � � � z6OpenStackServiceCatalog._parse_service_catalog_auth_v1c C s� g }|D ]S}|d }|� dd �}g }|� dg �D ]2}|� dd �}|� dd �} |� dd �} | r;t|| tjd�} |�| � | rJt|| tjd�} |�| � qt|||d�} |�| � q|S ) N�typerh r� r� r� r� r� �ru r� rv )r2 r r rO r� rN r ) r. rq r� r� ru rv r� r� r� r� r� r� r� r0 r0 r1 r} � s> � � �� z6OpenStackServiceCatalog._parse_service_catalog_auth_v2c C s� g }|D ]R}|d }|� dd �}g }|d D ]3}|� dd �}|d } |d } | dkr.tj} n| dkr6tj} n| d kr=tj} t|| | d �} |�| � qt|||d �} |�| � q|S ) Nr� rh r� r� r^ Z interfacerK ZpublicrM r� )ru rv r� )r2 r rN rO rP r r� r ) r. rq r� �itemru rv r� r� r� r^ r� r� r� r0 r0 r1 r| s4 � � z6OpenStackServiceCatalog._parse_service_catalog_auth_v3�NNrB )r7 r8 r9 r: r{ Z_service_catalog�AUTH_API_VERSIONrH r� r� r� r� r rO r� r� r� r� r~ r} r| r0 r0 r0 r1 r s( � & 'r c @ s. e Zd Zd dd�Zdd� Zdd� Zdd � ZdS ) r Nc C s. || _ |pg | _|| _t| jdd� d�| _dS )a :param service_type: Service type. :type service_type: ``str`` :param endpoints: Endpoints belonging to this entry. :type endpoints: ``list`` :param service_name: Optional service name. :type service_name: ``str`` c S s | j pdS rs )r^ rw r0 r0 r1 ry B s z7OpenStackServiceCatalogEntry.__init__.<locals>.<lambda>rz N)ru r� rv r )r. ru r� rv r0 r0 r1 rH 2 s z%OpenStackServiceCatalogEntry.__init__c C s$ | j |j ko| j|jko|j| jkS rB r� �r. �otherr0 r0 r1 �__eq__D � � �z#OpenStackServiceCatalogEntry.__eq__c C � | j |d� S �N)r� �r� r� r0 r0 r1 �__ne__K � z#OpenStackServiceCatalogEntry.__ne__c C s d| j | jt| j�f S )NzL<OpenStackServiceCatalogEntry service_type=%s, service_name=%s, endpoints=%s)ru rv �reprr� ra r0 r0 r1 rb N s �z%OpenStackServiceCatalogEntry.__repr__r� )r7 r8 r9 rH r� r� rb r0 r0 r0 r1 r 1 s r c @ s> e Zd ZejejejgZd dd�Zdd� Z dd� Z dd � Z d S ) r rL c C s, || j vr td| ��|| _|| _|| _dS )z� :param region: Endpoint region. :type region: ``str`` :param url: Endpoint URL. :type url: ``str`` :param endpoint_type: Endpoint type (external / internal / admin). :type endpoint_type: ``str`` zInvalid type: %sN)�VALID_ENDPOINT_TYPESr� r� r^ r� )r. r� r^ r� r0 r0 r1 rH ] s z-OpenStackServiceCatalogEntryEndpoint.__init__c C s$ | j |j ko| j|jko| j|jkS rB r� r� r0 r0 r1 r� p r� z+OpenStackServiceCatalogEntryEndpoint.__eq__c C r� r� r� r� r0 r0 r1 r� w r� z+OpenStackServiceCatalogEntryEndpoint.__ne__c C s d| j | j| jf S )Nz@<OpenStackServiceCatalogEntryEndpoint region=%s, url=%s, type=%sr� ra r0 r0 r1 rb z s �z-OpenStackServiceCatalogEntryEndpoint.__repr__N)rL ) r7 r8 r9 r rN rO rP r� rH r� r� rb r0 r0 r0 r1 r V s � r c @ rX )�OpenStackAuthResponsec C s& | j tjtjtjtjtjtjtjfv S rB ) r\ r �OK�CREATED�ACCEPTED� NO_CONTENT�MULTIPLE_CHOICES� UNAUTHORIZED�INTERNAL_SERVER_ERRORra r0 r0 r1 �success� s �z OpenStackAuthResponse.successc C s� | j sd S d| jv r d}nd| jv rd}ntdtd��| j| }|�d�dkr.|�d�d }|dkrMz t�| j �}W |S tyL t}t d | j |d ��w |d krV| j }|S | j }|S ) Nz content-type� Content-TypezMissing content-type header��driver�;���r �application/json�Failed to parse JSON��bodyr� z text/plain) r� �headersr r! �find�split�json�loads� Exceptionr )r. r/ � content_type�datar� r0 r0 r1 � parse_body� s. ���z OpenStackAuthResponse.parse_bodyN)r7 r8 r9 r� r� r0 r0 r0 r1 r� � s r� c s� e Zd ZdZeZdZdZdddej ddddf� fdd� Z d'd d �Z � fd d �Z d d� Z dd� Zd(dd�Zdd� Zdd� Zdd� Zdd� Zd(dd �Zd d � Zd d � Zed!d"� �Zd#d$� Zd%d&� Z� ZS ))r! z� Base identity connection class which contains common / shared logic. Note: This class shouldn't be instantiated directly. N�default�Defaultc s� t � j||||| d� | | _| r| j| _| j| _nd | _|| _|| _|| _|| _|| _ || _ | | _ i | _ d | _ d | _d | _d | _d S )N)r< r/ r^ �timeout� proxy_url)�superrH � parent_conn� conn_classr� r; r> r? r@ r= r� � auth_cacherG � auth_token�auth_token_expires�auth_user_info�auth_user_roles� r. r; r< r/ r> r@ r? r= r� r� r� r� �� __class__r0 r1 rH � s( � z$OpenStackIdentityConnection.__init__�GETFc C sN | j std��|p i }| j |t< | j||||||d�}|jtjkr%| �� |S )zL Perform an authenticated request against the identity API. z0Need to be authenticated to perform this request)�action�paramsr� r� �method�raw)r� r� �AUTH_TOKEN_HEADER�requestr\ r r� �clear_cached_auth_context)r. r� r� r� r� r� r� �responser0 r0 r1 �authenticated_request� s � z1OpenStackIdentityConnection.authenticated_requestc s. | � | j�\}}}}|dkr|S t� j|d�S )Nrt )r� )Z_tuple_from_urlr; r� �morph_action_hook)r. r� �_Z request_pathr� r0 r1 r� � s z-OpenStackIdentityConnection.morph_action_hookc C s d|d< d|d< |S )Nr� �Acceptz application/json; charset=UTF-8r� r0 )r. r� r0 r0 r1 �add_default_headers s z/OpenStackIdentityConnection.add_default_headersc C sL | j sdS | js dS | jtjtd� }|�� }tj�� �� }||k r$dS dS )z� Return True if the current auth token is already cached and hasn't expired yet. :return: ``True`` if the token is still valid, ``False`` otherwise. :rtype: ``bool`` F)�secondsT)r� r� �datetime� timedelta� AUTH_TOKEN_EXPIRES_GRACE_SECONDS� utctimetuple�utcnow)r. �expiresZtime_tuple_expiresZtime_tuple_nowr0 r0 r1 �is_token_valid s �z*OpenStackIdentityConnection.is_token_validc C s t d��)z� Authenticate against the identity API. :param force: Forcefully update the token even if it's already cached and still valid. :type force: ``bool`` z authenticate not implementedr+ �r. �forcer0 r0 r1 � authenticate! s z(OpenStackIdentityConnection.authenticatec C s> d| _ d| _d| _d| _i | _| jdur | j�| j� dS dS )z� Clear the cached authentication context. The context is cleared from fields on this connection and from the external cache, if one is configured. N)r� r� r� r� rG r� r6 � _cache_keyra r0 r0 r1 r� + s �z5OpenStackIdentityConnection.clear_cached_auth_contextc C s8 | j ddd�}| j|jd d d�}t|dd� d �}|S ) z� Retrieve a list of all the identity versions which are supported by this installation. :rtype: ``list`` of :class:`.OpenStackIdentityVersion` �/r� �r� Zversions�values�r� c S r� rB )r[ rw r0 r0 r1 ry D s zEOpenStackIdentityConnection.list_supported_versions.<locals>.<lambda>rz )r� � _to_versions�objectr �r. r� r� r0 r0 r1 �list_supported_versions; s z3OpenStackIdentityConnection.list_supported_versionsc C �( g }|D ] }| j |d�}|�|� q|S �Nr� )� _to_versionr� )r. r� r� r� r[ r0 r0 r1 r� G � z(OpenStackIdentityConnection._to_versionsc C sp zt |d �}W n ty d }Y nw z |d d d }W n ty) d }Y nw t|d |d ||d�}|S )Nr] Zlinksr Zhrefrg r\ rZ )r r� � IndexErrorr )r. r� r] r^ r[ r0 r0 r1 r O s � ��z'OpenStackIdentityConnection._to_versionc C s: |rdS | j tvr dS | �� rdS | �� | �� rdS dS )z| Determine if the authentication is needed or if the existing token (if any exists) is still valid. TF)r� �AUTH_VERSIONS_WITH_EXPIRESr� � _load_auth_context_from_cacher� r0 r0 r1 �_is_authentication_needed_ s z5OpenStackIdentityConnection._is_authentication_neededc C r r )� _to_projectr� )r. r� r� r� rS r0 r0 r1 � _to_projectsw r z(OpenStackIdentityConnection._to_projectsc C s. t |d |d |d |d |�dd �d�}|S )Nrg rh rl ri rm rk )r r2 )r. r� rS r0 r0 r1 r s �z'OpenStackIdentityConnection._to_projectc C s t | j| j| j| j| j| j�S )z� The key where this connection's authentication context will be cached. :rtype: :class:`OpenStackAuthenticationCacheKey` )r r; r< r= r> r? r@ ra r0 r0 r1 r� � s �z&OpenStackIdentityConnection._cache_keyc C sJ |j | _ |j| _|j| _|j| _|j| _| j dur#| j � | j |� dS dS )z� Store an authentication context in memory and the cache. :param context: Authentication context to cache. :type key: :class:`.OpenStackAuthenticationContext` N) rG rC r� rD r� rE r� rF r� r� r5 r� �r. r4 r0 r0 r1 �_cache_auth_context� s �z/OpenStackIdentityConnection._cache_auth_contextc C sT | j du rdS | j �| j�}|du rdS |j| _|j| _|j| _|j| _ |j | _ |S )z� Fetch an authentication context for this connection from the cache. :rtype: :class:`OpenStackAuthenticationContext` N) r� r2 r� rG rC r� rD r� rE r� rF r� r r0 r0 r1 r � s z9OpenStackIdentityConnection._load_auth_context_from_cache)NNNr� F�F) r7 r8 r9 r: r� � responseClsr� r� rR rU rH r� r� r� r� r� r� r r� r r r r �propertyr� r r � __classcell__r0 r0 r� r1 r! � s> �* � r! c @ �& e Zd ZdZeZdZdZddd�ZdS ) r" z1 Connection class for Keystone API v1.0. �OpenStack Identity API v1.0rr Fc C s� | j |d�s| S | j| jd�}| jd|dd�}|jtjkr t� �|jtjtj fvr;d� |j|j |j �}t d|| jd��|j }i | _d |�d d �ig| jd < d |�d d �ig| jd < d |�dd �ig| jd< |�dd �| _d | _| jsvt d��| S )N�r� )z X-Auth-Userz X-Auth-Keyz/v1.0r� �r� r� zcode: {} body:{} headers:{}�Malformed responser� r� zx-server-management-urlZ cloudServerszx-cdn-management-urlZ cloudFilesCDNz x-storage-urlZ cloudFilesz x-auth-tokenz(Missing X-Auth-Token in response headers)r r< r/ r� r\ r r� r r� r� rj r� r� r r� rG r2 r� r� )r. r� r� �respr� r0 r0 r1 r� � s4 � � �z-OpenStackIdentity_1_0_Connection.authenticateNr � r7 r8 r9 r: r� r rh r� r� r0 r0 r0 r1 r" � � r" c @ r ) r# z1 Connection class for Keystone API v1.1. zOpenStack Identity API v1.1r Fc C s | j |d�s| S t�d| j| jd�i�}| jd|i dd�}|jtjkr&t � �|jtj kr<d� |j|j �}t d|| jd ��zt�|j �}W n tyU } zt d |��d }~ww z!|d d d }| �t|d d d t|�|d d d�� W | S ty� } zt d|��d }~ww )Nr Z credentials)�usernamer/ z /v1.1/auth�POST�r� r� r� �code: {} body:{}r r� r� �authrC r� rg �serviceCatalog)rD rG �\Auth JSON response is missing required elements)r r� �dumpsr< r/ r� r\ r r� r r� rj r� r r� r� r� r r r �KeyError)r. r� �reqbodyr r� �er� r0 r0 r1 r� � s@ �� ������z-OpenStackIdentity_1_1_Connection.authenticateNr r r0 r0 r0 r1 r# � r r# c @ sN e Zd ZdZeZdZdZddd�Zdd � Z d d � Z d d � Z dd� Z dd� Z dS )r$ z1 Connection class for Keystone API v2.0. r r �api_keyFc C s8 | j |d�s| S |dkr| �� S |dkr| �� S td��)Nr r$ �passwordz$Invalid value for auth_type argument)r � _authenticate_2_0_with_api_key� _authenticate_2_0_with_passwordr� )r. Z auth_typer� r0 r0 r1 r� & s z-OpenStackIdentity_2_0_Connection.authenticatec C �> dd| j | jd�ii}| jr| j|d d< t�|�}| �|�S )Nr zRAX-KSKEY:apiKeyCredentials)r ZapiKey� tenantName�r< r/ r> r� r �_authenticate_2_0_with_body�r. r� r" r0 r0 r1 r& 1 s ��� z?OpenStackIdentity_2_0_Connection._authenticate_2_0_with_api_keyc C r( )Nr ZpasswordCredentials)r r% r) r* r, r0 r0 r1 r' A s z@OpenStackIdentity_2_0_Connection._authenticate_2_0_with_passwordc C �� | j d|ddidd�}|jtjkrt� �|jtjtjfvr-d�|j|j�}t d|| j d��|j }z$|d }|d d }| � t |d d t|�|d |�di �d�� W | S tye } zt d|��d }~ww �N� /v2.0/tokensr� r� r r zcode: {} body: {}r r� �accessrC r� rg r rE )rD rG rE r �r� r\ r r� r r� � NON_AUTHORITATIVE_INFORMATIONrj r� r r� r� r r r r2 r! �r. r" r r� r0 r� r# r0 r0 r1 r+ K s> � ������z<OpenStackIdentity_2_0_Connection._authenticate_2_0_with_bodyc C �$ | j ddd�}| j|jd d�}|S )N� /v2.0/tenantsr� r� �tenantsr� �r� r r� r� r0 r0 r1 � list_projectso s z.OpenStackIdentity_2_0_Connection.list_projectsc C r� rB )r8 ra r0 r0 r1 � list_tenantst s z-OpenStackIdentity_2_0_Connection.list_tenantsN)r$ F)r7 r8 r9 r: r� r rh r� r� r& r' r+ r8 r9 r0 r0 r0 r1 r$ s $ r$ c s2 e Zd ZdZeZdZdZej ej ej gZ dddej ddddf� fdd� Z d?d d �Zd d � Zdd� Zdd� Zdd� Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d!� Zd"d#� Z $d@d%d&�Zd'd(� Z d)d*� Z d+d,� Z � fd-d.�Z dAd/d0�Z d1d2� Z!d3d4� Z"d5d6� Z#d7d8� Z$d9d:� Z%d;d<� Z&d=d>� Z'� Z(S )Br& z1 Connection class for Keystone API v3.x. zOpenStack Identity API v3.xr Nr� r� c s~ t � j||||||||| | | d� | j| jvr td| j ��| jtjkr.| jr*| js.td��| jtj kr;| js=td��dS dS )a, :param tenant_name: Name of the project this user belongs to. Note: When token_scope is set to project, this argument control to which project to scope the token to. :type tenant_name: ``str`` :param domain_name: Domain the user belongs to. Note: When token_scope is set to token, this argument controls to which domain to scope the token to. :type domain_name: ``str`` :param token_scope: Whether to scope a token to a "project", a "domain" or "unscoped" :type token_scope: ``str`` :param auth_cache: Where to cache authentication tokens. :type auth_cache: :class:`OpenStackAuthenticationCache` ) r; r< r/ r> r? r@ r= r� r� r� r� z,Invalid value for "token_scope" argument: %sz1Must provide tenant_name and domain_name argumentz!Must provide domain_name argumentN) r� rH r= �VALID_TOKEN_SCOPESr� rR rU r> r? rV � r. r; r< r/ r> r? r@ r= r� r� r� r� r� r0 r1 rH � s0 � ���z)OpenStackIdentity_3_0_Connection.__init__Fc C sJ | j |d�s| S | �� }t�|�}| jd|ddidd�}| j|dd� | S ) �) Perform authentication. r �/v3/auth/tokensr� r� r r T)�cache_it)r �_get_auth_datar� r r� �_parse_token_response)r. r� r� r� r0 r0 r1 r� � s �z-OpenStackIdentity_3_0_Connection.authenticatec C r4 )zk List the available domains. :rtype: ``list`` of :class:`OpenStackIdentityDomain` z /v3/domainsr� r� Zdomainsr� )r� � _to_domainsr� r� r0 r0 r1 � list_domains� � z-OpenStackIdentity_3_0_Connection.list_domainsc C r4 )z� List the available projects. Note: To perform this action, user you are currently authenticated with needs to be an admin. :rtype: ``list`` of :class:`OpenStackIdentityProject` z /v3/projectsr� r� �projectsr� r7 r� r0 r0 r1 r8 � s z.OpenStackIdentity_3_0_Connection.list_projectsc C r4 )zh List the available users. :rtype: ``list`` of :class:`.OpenStackIdentityUser` � /v3/usersr� r� Zusersr� )r� � _to_usersr� r� r0 r0 r1 � list_users� rC z+OpenStackIdentity_3_0_Connection.list_usersc C r4 )zh List the available roles. :rtype: ``list`` of :class:`.OpenStackIdentityRole` z /v3/rolesr� r� rF r� )r� � _to_rolesr� r� r0 r0 r1 � list_roles� rC z+OpenStackIdentity_3_0_Connection.list_rolesc C s( | j d| dd�}| j|jd d�}|S )z� Retrieve information about a single domain. :param domain_id: ID of domain to retrieve information for. :type domain_id: ``str`` :rtype: :class:`.OpenStackIdentityDomain` z/v3/domains/%sr� r� rT r� )r� � _to_domainr� )r. rm r� r� r0 r0 r1 � get_domain� s z+OpenStackIdentity_3_0_Connection.get_domainc C s$ | � d| �}| j|jd d�}|S )z� Get a user account by ID. :param user_id: User's id. :type name: ``str`` :return: Located user. :rtype: :class:`.OpenStackIdentityUser` � /v3/users/%srE r� )r� �_to_userr� )r. r< r� rE r0 r0 r1 �get_user s z)OpenStackIdentity_3_0_Connection.get_userc C s. d|j }| j|dd�}| j|jd d�}|S )z| Retrieve all the projects user belongs to. :rtype: ``list`` of :class:`.OpenStackIdentityProject` z/v3/users/%s/projectsr� r� rD r� )rg r� r r� )r. rE �pathr� r� r0 r0 r1 �list_user_projects s z3OpenStackIdentity_3_0_Connection.list_user_projectsc C s4 d� |j|j�}| j|dd�}| j|jd d�}|S )z� Retrieve all the roles for a particular user on a domain. :rtype: ``list`` of :class:`.OpenStackIdentityRole` z /v3/domains/{}/users/{}/rolesr� r� rF r� )rj rg r� rH r� )r. rT rE rO r� r� r0 r0 r1 �list_user_domain_roles" s z7OpenStackIdentity_3_0_Connection.list_user_domain_rolesc C �. d� |j|j|j�}| j|dd�}|jtjkS )a� Grant domain role to a user. Note: This function appears to be idempotent. :param domain: Domain to grant the role to. :type domain: :class:`.OpenStackIdentityDomain` :param role: Role to grant. :type role: :class:`.OpenStackIdentityRole` :param user: User to grant the role to. :type user: :class:`.OpenStackIdentityUser` :return: ``True`` on success. :rtype: ``bool`` � /v3/domains/{}/users/{}/roles/{}�PUTr� �rj rg r� r\ r r� )r. rT �rolerE rO r� r0 r0 r1 �grant_domain_role_to_user/ � z:OpenStackIdentity_3_0_Connection.grant_domain_role_to_userc C s. d� |j|j|j�}| j|dd�}|jtjkS )a� Revoke domain role from a user. :param domain: Domain to revoke the role from. :type domain: :class:`.OpenStackIdentityDomain` :param role: Role to revoke. :type role: :class:`.OpenStackIdentityRole` :param user: User to revoke the role from. :type user: :class:`.OpenStackIdentityUser` :return: ``True`` on success. :rtype: ``bool`` rS �DELETEr� rU )r. rT rE rV rO r� r0 r0 r1 � revoke_domain_role_from_userE � z=OpenStackIdentity_3_0_Connection.revoke_domain_role_from_userc C rR )a� Grant project role to a user. Note: This function appears to be idempotent. :param project: Project to grant the role to. :type project: :class:`.OpenStackIdentityDomain` :param role: Role to grant. :type role: :class:`.OpenStackIdentityRole` :param user: User to grant the role to. :type user: :class:`.OpenStackIdentityUser` :return: ``True`` on success. :rtype: ``bool`` �!/v3/projects/{}/users/{}/roles/{}rT r� rU �r. rS rV rE rO r� r0 r0 r1 �grant_project_role_to_userY rX z;OpenStackIdentity_3_0_Connection.grant_project_role_to_userc C rR )a� Revoke project role from a user. :param project: Project to revoke the role from. :type project: :class:`.OpenStackIdentityDomain` :param role: Role to revoke. :type role: :class:`.OpenStackIdentityRole` :param user: User to revoke the role from. :type user: :class:`.OpenStackIdentityUser` :return: ``True`` on success. :rtype: ``bool`` r\ rY r� rU r] r0 r0 r1 � revoke_project_role_from_usero r[ z>OpenStackIdentity_3_0_Connection.revoke_project_role_from_userTc C sf ||||d�}|r ||d< |r||d< |r||d< t �d|i�}| jd|dd�} | j| jd d �} | S ) a� Create a new user account. :param email: User's mail address. :type email: ``str`` :param password: User's password. :type password: ``str`` :param name: User's name. :type name: ``str`` :param description: Optional description. :type description: ``str`` :param domain_id: ID of the domain to add the user to (optional). :type domain_id: ``str`` :param default_project_id: ID of the default user project (optional). :type default_project_id: ``str`` :param enabled: True to enable user after creation. :type enabled: ``bool`` :return: Created user. :rtype: :class:`.OpenStackIdentityUser` )rp r% rh ri rl rm �default_project_idrE rE r �r� r� r� )r� r r� rM r� ) r. rp r% rh rl rm r` ri r� r� rE r0 r0 r1 � create_user� s %z,OpenStackIdentity_3_0_Connection.create_userc C �B ddi}t �d|i�}| jd|j |dd�}| j|jd d�}|S )a Enable user account. Note: This operation appears to be idempotent. :param user: User to enable. :type user: :class:`.OpenStackIdentityUser` :return: User account which has been enabled. :rtype: :class:`.OpenStackIdentityUser` ri TrE rL �PATCHra r� �r� r r� rg rM r� �r. rE r� r� r0 r0 r1 � enable_user� � z,OpenStackIdentity_3_0_Connection.enable_userc C rc )a" Disable user account. Note: This operation appears to be idempotent. :param user: User to disable. :type user: :class:`.OpenStackIdentityUser` :return: User account which has been disabled. :rtype: :class:`.OpenStackIdentityUser` ri FrE rL rd ra r� re rf r0 r0 r1 � disable_user� rh z-OpenStackIdentity_3_0_Connection.disable_userc C s� dddgdd| j i| j| jd�id�ii}| jtjkr,dd | ji| jd �i|d d < |S | jtjkr?d d| j ii|d d < |S | jtj krH |S t d ��)Nr �identityr% rE rh )rT rh r% )�methodsr% rS rg )rT rh �scoperT �6Token needs to be scoped either to project or a domain) r? r< r/ r= rR rU r@ r> rV rW r� �r. r� r0 r0 r1 r? � s4 ����� � � � ��z/OpenStackIdentity_3_0_Connection._get_auth_datac s: t � �� }|d u r d S z| �� W |S ty Y d S w rB )r� r �_fetch_auth_tokenr r r� r0 r1 r s ��z>OpenStackIdentity_3_0_Connection._load_auth_context_from_cachec C sP |j tjkr t� �|j tjtjfv r�|j}zt�|j �}W n t y. } zt d|��d}~ww z | � |d d �}W n t yE g }Y nw z5t |d d �}|d } |r^| �t| |d�� | | _|| _|d �dd�| _|d �d d�| _|| _W dS ty� } zt d |��d}~ww |r�|j d kr�td ��d �|j |j �}t d|| jd��)aO Parse a response from /v3/auth/tokens. :param cache_it: Should we cache the authentication context? :type cache_it: ``bool`` :param raise_ambiguous_version_error: Should an ambiguous version error be raised on a 300 response? :type raise_ambiguous_version_error: ``bool`` r� NrC rF Z expires_at�x-subject-token)rD �catalogrE r i, zyAuth request returned ambiguous version error, tryusing the version specific URL to connect, e.g. identity/v3/auth/tokensr r r� )r\ r r� r r� r� r� r� r� r� r� r rH r r r r� r� r2 rG r� r� r! r rj r� ) r. r� r> � raise_ambiguous_version_errorr� r� r# rF r� rC r0 r0 r1 r@ sP �� � � ����z6OpenStackIdentity_3_0_Connection._parse_token_responsec C s& d| j i}| jd|d�}| �|� | S )zE Fetch our authentication token and service catalog. zX-Subject-Tokenr= )r� )r� r� r@ )r. r� r� r0 r0 r1 ro Q s z2OpenStackIdentity_3_0_Connection._fetch_auth_tokenc C r r )rJ r� )r. r� r� r� rT r0 r0 r1 rA Z r z,OpenStackIdentity_3_0_Connection._to_domainsc C s t |d |d |d d�}|S )Nrg rh ri rf )r )r. r� rT r0 r0 r1 rJ b s z+OpenStackIdentity_3_0_Connection._to_domainc C r r )rM r� �r. r� r� r� rE r0 r0 r1 rF f r z*OpenStackIdentity_3_0_Connection._to_usersc C s8 t |d |d |d |�d�|�dd �|�d�d�}|S )Nrg rm rh rp rl ri ro )r r2 )r. r� rE r0 r0 r1 rM n s �z)OpenStackIdentity_3_0_Connection._to_userc C r r )�_to_roler� rs r0 r0 r1 rH y r z*OpenStackIdentity_3_0_Connection._to_rolesc C s, t |d |d |�dd �|�dd�d�}|S )Nrg rh rl ri Trn )r r2 )r. r� rV r0 r0 r1 rt � s �z)OpenStackIdentity_3_0_Connection._to_roler )NNNT)FT))r7 r8 r9 r: r� r rh r� rR rU rV rW r: rH r� rB r8 rG rI rK rN rP rQ rW rZ r^ r_ rb rg ri r? r r@ ro rA rJ rF rM rH rt r r0 r0 r� r1 r& x s` � � 8 �6 " > r& c s> e Zd ZdZdZ d� fdd� Zdd� Z� ZS ) r' z� Connection class for Keystone API v3.x using Application Credentials. 'user_id' is the application credential id and 'key' is the application credential secret. z8OpenStack Identity API v3.x with Application CredentialsNc s& t � j|||||tj|| | | d� dS )z� Tenant, domain and scope options are ignored as they are contained within the app credential itself and can't be changed. ) r; r< r/ r> r? r= r� r� r� r� N)r� rH rR rW r; r� r0 r1 rH � s �z1OpenStackIdentity_3_0_Connection_AppCred.__init__c C s" dddg| j | jd�d�ii}|S )Nr rj �application_credential)rg Zsecret)rk ru )r< r/ rn r0 r0 r1 r? � s ���z7OpenStackIdentity_3_0_Connection_AppCred._get_auth_data)NNNNNNNN)r7 r8 r9 r: rh rH r? r r0 r0 r� r1 r' � s � r' c @ s6 e Zd ZdZeZdZdZd dd�Zdd� Z d d � Z d S ) r( a Connection class for Keystone API v3.x. using OpenID Connect tokens The OIDC token must be set in the self.key attribute. The identity provider name required to get the full path must be set in the self.user_id attribute. The protocol name required to get the full path must be set in the self.tenant_name attribute. The self.domain_name attribute can be used either to select the domain name in case of domain scoped token or to select the project name in case of project scoped token z-OpenStack Identity API v3.x with OIDC supportr Fc C s� | j |d�s| S | �� }dddgd|id�ii}| jtjkr/| j|d�}dd|ii|d d < n | jtjkrAd d | jii|d d < n | jtjkrHnt d ��t � |�}| j d |ddidd�}| j |ddd� | S )r< r r rj rC rg )rk rC )rC rS rl rT rh rm r= r� r� r r TF)r> rr )r �#_get_unscoped_token_from_oidc_tokenr= rR rU �_get_project_idrV r? rW r� r� r r� r@ )r. r� Z subject_tokenr� Z project_idr� r0 r0 r1 r� � s* �z?OpenStackIdentity_3_0_Connection_OIDC_access_token.authenticatec C s� d� | j| j�}| j|dd| j d�dd�}|jtjkr t� �|jtj tj fv r9d|j v r2|j d S t d| j d ��t d | j |jd ��) z; Get unscoped token from OIDC access token z9/v3/OS-FEDERATION/identity_providers/{}/protocols/{}/authr� z Bearer %s)r� Z Authorizationr� r rp zNo x-subject-token returnedr� r �r� r� )rj r< r> r� r/ r\ r r� r r� r� r� r r� r� )r. rO r� r0 r0 r1 rv � s( ��� �zVOpenStackIdentity_3_0_Connection_OIDC_access_token._get_unscoped_token_from_oidc_tokenc C s0 d}| j |ddt|idd�}|jtjtjtjfvr'd}| j |ddt|idd�}|jtjkr0t� �|jtjtjfv r�z7t� |j �}| j rh| j dkrh|d D ]}| j |d |d fv r`|d W S qLt d | j ��|d d d W S t y~ } z|�d }~w t y� } ztd|��d }~ww td| j|j d��)zU Get the first project ID accessible with the specified access token z/v3/auth/projectsr� r� r� r z/v3/OS-FEDERATION/projectsr� rD rh rg zProject %s not foundr Nr� r rx )r� r� r\ r r� r� r� r r� r� r� r? r� r� r r� )r. rC rO r� r� rS r# r0 r0 r1 rw sF � � �� �� �zBOpenStackIdentity_3_0_Connection_OIDC_access_token._get_project_idNr ) r7 r8 r9 r: r� r rh r� r� rv rw r0 r0 r0 r1 r( � s ! r( c @ sZ e Zd ZdZeZdZdZdddej ddddfdd�Z dd d �Z d d � Z dd� Z dd� ZdS )r% z� Connection class for Keystone API v2.0. with VOMS proxy support In this case the key parameter will be the path of the VOMS proxy file. z(OpenStack Identity API v2.0 VOMS supportr Nr� r� c C s� t j| ||| |d� | | _| r| j| _| j| _nd | _|| _|| _|| _|| _|| _ || _ | | _ | | _ i | _ d | _d | _d | _d S )N)� cert_filer^ r� r� )r rH r� r� r� r; r> r@ r? r= r� r� r� rG r� r� r� r� r0 r0 r1 rH L s( � z.OpenStackIdentity_2_0_Connection_VOMS.__init__Fc C sN | j |d�s| S | j}|s| �� }| �|�}dd|d�i}t�|�}| �|�S )Nr r T)�vomsr) )r r> �_get_unscoped_token�_get_tenant_namer� r r+ )r. r� ZtenantrC r� r" r0 r0 r1 r� u s z2OpenStackIdentity_2_0_Connection_VOMS.authenticatec C s� dddii}t �|�}| jd|ddidd�}|jtjkr t� �|jtjtjfv rIzt � |j �}|d d d W S t yH } zt d |��d }~ww t d| j |j d��)z4 Get unscoped token from VOMS proxy r rz Tr/ r� r� r r r0 rC rg r� Nr rx )r� r r� r\ r r� r r� r� r� r� r� r r� )r. r� r" r� r� r# r0 r0 r1 r{ � s* � �� �z9OpenStackIdentity_2_0_Connection_VOMS._get_unscoped_tokenc C s� ddddt |i}| jd|dd�}|jtjkrt� �|jtjtjfv rCzt� |j �}|d d d W S t yB } zt d |��d }~ww t d | j |j d ��)zR Get the first available tenant name (usually there are only one) r� r� r� r5 r� r r6 r rh r� Nr rx )r� r� r\ r r� r r� r� r� r� r� r� r r� )r. rC r� r� r� r# r0 r0 r1 r| � s$ � �� �z6OpenStackIdentity_2_0_Connection_VOMS._get_tenant_namec C r- r. r1 r3 r0 r0 r1 r+ � s> � ������zAOpenStackIdentity_2_0_Connection_VOMS._authenticate_2_0_with_bodyr )r7 r8 r9 r: r� r rh r� rR rU rH r� r{ r| r+ r0 r0 r0 r1 r% B s$ � ) r% c C s� | dkrt }|S | dkrt}|S | dks| dkr t}|S | dkr$t}|S | dkr,t}|S | dkr4t}|S | dkr<t}|S | d krDt}|S td | ��) z7 Retrieve class for the provided auth version. rr r r r r r r r r z&Unsupported Auth Version requested: %s)r" r# r$ r% r& r' r( r )r� �clsr0 r0 r1 r) � s2 ��� � ��� �r) )/r: r� � collectionsr Zlibcloud.utils.py3r Zlibcloud.common.baser r r Zlibcloud.compute.typesr r r Zlibcloud.utils.iso8601r Z simplejsonr� � ImportErrorr� r� r r� �__all__r r r r rR r r r r r r r r r� r! r" r# r$ r& r' r( r% r) r0 r0 r0 r1 �<module> sj �0� 1%,) 0/[ 5
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings