keystoneauth1.identity.v3.federation module

class keystoneauth1.identity.v3.federation.FederationBaseAuth(auth_url: str, identity_provider: str, protocol: str, *, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True)

Bases: _Rescoped

Federation authentication plugin.

Parameters:

  • auth_url (string) – URL of the Identity Service

  • identity_provider (string) – name of the Identity Provider the client will authenticate against. This parameter will be used to build a dynamic URL used to obtain unscoped OpenStack token.

  • protocol (string) – name of the protocol the client will authenticate against.

__abstractmethods__ = frozenset({'get_unscoped_auth_ref'})
__annotations__ = {'MIN_TOKEN_LIFE_SECONDS': 'int', '_discovery_cache': 'dict[str, discover.Discover]', '_unscoped_auth_ref': 'access.AccessInfoV3 | None', 'auth_ref': 'access.AccessInfo | None', 'auth_url': 'str', 'interactive_unscoped_auth': 'ty.ClassVar[bool]', 'reauthenticate': 'bool'}
__doc__ = 'Federation authentication plugin.\n\n:param auth_url: URL of the Identity Service\n:type auth_url: string\n:param identity_provider: name of the Identity Provider the client\n                          will authenticate against. This parameter\n                          will be used to build a dynamic URL used to\n                          obtain unscoped OpenStack token.\n:type identity_provider: string\n:param protocol: name of the protocol the client will authenticate\n                 against.\n:type protocol: string\n\n'
__firstlineno__ = 268
__init__(auth_url: str, identity_provider: str, protocol: str, *, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True)
__module__ = 'keystoneauth1.identity.v3.federation'
__static_attributes__ = ('identity_provider', 'protocol')
_abc_impl = <_abc._abc_data object>
_discovery_cache: dict[str, discover.Discover]
auth_ref: access.AccessInfo | None
auth_url: str
property federated_token_url: str

Full URL where authorization data is sent.

get_unscoped_cache_id_elements() → dict[str, str | None]

What identifies the unscoped token a federated plugin obtains.

The identity service issues it for a given identity provider and protocol at a given endpoint, so those describe it. The scope is applied afterwards and is deliberately left out.

reauthenticate: bool
class keystoneauth1.identity.v3.federation._Rescoped(auth_url: str, *, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True)

Bases: BaseAuth

A plugin that is always going to go through a rescope process.

The original keystone plugins could simply pass a project or domain to along with the credentials and get a scoped token. For federation, K2K and newer mechanisms we always get an unscoped token first and then rescope.

This is currently not public as it’s generally an abstraction of a flow used by plugins within keystoneauth1.

It also cannot go in base as it depends on token.Token for rescoping which would create a circular dependency.

Because the unscoped token outlives any single scope, this class extends the base caching with a parallel set of methods - get_unscoped_cache_id(), get_unscoped_auth_state() and set_unscoped_auth_state() - that identify and carry that token without reference to the scope. The scope-aware get_cache_id and get_auth_state inherited from the base continue to describe the scoped token.

__abstractmethods__ = frozenset({'get_unscoped_auth_ref'})
__annotations__ = {'MIN_TOKEN_LIFE_SECONDS': 'int', '_discovery_cache': 'dict[str, discover.Discover]', '_unscoped_auth_ref': keystoneauth1.access.access.AccessInfoV3 | None, 'auth_ref': 'access.AccessInfo | None', 'auth_url': 'str', 'interactive_unscoped_auth': 'ty.ClassVar[bool]', 'reauthenticate': 'bool'}
__doc__ = "A plugin that is always going to go through a rescope process.\n\nThe original keystone plugins could simply pass a project or domain to\nalong with the credentials and get a scoped token. For federation, K2K and\nnewer mechanisms we always get an unscoped token first and then rescope.\n\nThis is currently not public as it's generally an abstraction of a flow\nused by plugins within keystoneauth1.\n\nIt also cannot go in base as it depends on token.Token for rescoping which\nwould create a circular dependency.\n\nBecause the unscoped token outlives any single scope, this class extends\nthe base caching with a parallel set of methods -\n:py:meth:`get_unscoped_cache_id`, :py:meth:`get_unscoped_auth_state` and\n:py:meth:`set_unscoped_auth_state` - that identify and carry that token\nwithout reference to the scope. The scope-aware ``get_cache_id`` and\n``get_auth_state`` inherited from the base continue to describe the\nscoped token.\n"
__firstlineno__ = 30
__module__ = 'keystoneauth1.identity.v3.federation'
__static_attributes__ = ('_unscoped_auth_ref',)
_abc_impl = <_abc._abc_data object>
_authenticate(session: Session) → AccessInfoV3

Fetch a new unscoped token and keep it.

_rescope(session: Session, auth_ref: AccessInfoV3) → AccessInfoV3

Rescope an unscoped token, if any scope was asked for.

_unscoped_auth_ref: AccessInfoV3 | None = None

The unscoped token, kept so that a caller can take it out and put it back on a later run. Not populated until an unscoped token has been obtained or installed.

get_auth_ref(session: Session) → AccessInfoV3

Authenticate retrieve token information.

This is a multi-step process where a client does federated authn receives an unscoped token.

If an unscoped token is successfully received and scoping information is present then the token is rescoped to that target.

Parameters:

session (keystoneauth1.session.Session) – a session object to send out HTTP requests.

Returns:

a token data representation

Return type:

keystoneauth1.access.AccessInfo

abstract get_unscoped_auth_ref(session: Session) → AccessInfoV3

Fetch unscoped federated token.

get_unscoped_auth_state() → str | None

Retrieve the unscoped token, for a caller that wants to store it.

Obtaining an unscoped token can be expensive, and for an interactive flow it cannot be repeated without the user. A caller that hands the result back through set_unscoped_auth_state() on a later run skips that step and pays only for the rescope.

This does not fetch anything: it returns None until an unscoped token has been obtained.

Returns:

A string to store, or None if there is nothing to store.

get_unscoped_cache_id() → str | None

Fetch an identifier for the unscoped token this plugin obtains.

Unlike get_cache_id(), this deliberately does not vary with the scope, so a caller can store one unscoped token and rescope it to any project, domain or system.

Note that this identifies the plugin’s configuration, not whoever ends up authenticating with it. For an interactive flow the identity is chosen in the browser and is not knowable here, so a caller storing tokens for more than one account has to add something of its own to distinguish them.

Returns:

A unique string, or None if the unscoped token cannot be identified and so must not be stored.

get_unscoped_cache_id_elements() → dict[str, str | None]

Return what identifies this plugin’s unscoped token.

A plugin that can describe its unscoped token overrides this; one that leaves it raising cannot describe it and so must not be cached.

The elements must not include the scope. The point of the unscoped token is that it can be rescoped to any target, so one stored copy serves every scope.

invalidate() → bool

Discard the current tokens, the unscoped one included.

A session invalidates the plugin when a request comes back unauthorized. Keeping the unscoped token would mean rescoping from something the identity service has already rejected.

rescoping_plugin

alias of Token

set_unscoped_auth_state(data: str | None) → None

Install a previously stored unscoped token.

Takes what get_unscoped_auth_state() returned. An expired token is accepted and simply discarded when it is next needed, so a caller does not have to check before installing one.

Raises:

ValueError – The data is not something this method produced.