X-Auth-Token
+ request header.
password or token, the credentials, and,
+ optionally, the authorization scope. You can scope a token to a
+ project or domain, or the token can be unscoped. You cannot scope
+ a token to both a project and domain.
+ X-Subject-Token response header.
+ X-Auth-Token request header.
+ | Response code | +Description | +
|---|---|
+ Bad Request (400)
+ |
+
+ |
+
+ Unauthorized (401)
+ |
+
+ X-Auth-Token
+ header is not valid.
+ |
+
+ Forbidden (403)
+ |
+
+ |
+
+ Not Found (404)
+ |
+
+ |
+
+ Conflict (409)
+ |
+
+ /users request two times for the
+ unique, user-defined name attribute for a user
+ entity.
+ |
+
identity and
+ ldap groups. These groups override the default
+ configuration settings for the storage of users and groups by the
+ Identity server.
+ password option within
+ the ldap group.
+ url option.
+ identitycode> or ldap
+ groups, the Forbidden (403) response code is
+ returned.
+ type to
- application/json and specify policy rules as JSON strings in a
- blob. For example:
+ application/json and specify policy rules as JSON
+ strings in a blob. For example:
us-east.
include_subtree=true, you must
+ also specify the scope.project.id. Otherwise,
+ this call returns the Bad Request (400)
+ response code.
+ effective query parameter to list effective
+ assignments at the user, project, and domain level. This parameter
+ allows for the effects of group membership. The group role
+ assignment entities themselves are not returned in the collection.
+ This represents the effective role assignments that would be
+ included in a scoped token.
+ links entity section for
+ entities for group members also contains a URL that enables access
+ to the membership of the group.
+ effective parameter, such as:
+ password or token, the credentials, and,
+ optionally, the authorization scope. You can scope a token to a
+ project or domain, or the token can be unscoped. You cannot scope
+ a token to both a project and domain.
±hh:mm value, if included, is the time zone as an
- offset from UTC.
- 2015-08-27T09:49:58-05:00.
- null value indicates that the token never expires.
- ±hh:mm value, if included, is the time zone as an
+ offset from UTC.
+ 2015-08-27T09:49:58-05:00.
+ null value indicates that the token never expires.
+ 2015-08-27T09:49:58-05:00.
+ ±hh:mm value, if included, is the time zone as an offset from UTC.
+ id, name, and links for any roles.roles object. Includes
+ id, name, and
+ links for any roles.
+ ;) character to
+ separate multiple schemes. See Accept.
+ Accept request header value is
+ application/json-home, the call returns a JSON
+ Home document. The JSON Home document includes all core
+ components and the resources for any enabled extensions and excludes
+ the resources for disabled extensions.
+ Content-Type
+ header value in the response because earlier servers return a
+ normal JSON response rather than a JSON Home document.
+ true, the service
- is enabled. If false, the service is disabled.
- Default is true.
+ The authentication token.
policy.json blob
- (type="application/json") is the conventional
- solution. However, you might want to use an alternative policy
- engine that uses a different policy language type. For example,
- type="application/xacml+xml".
+ An authentication response returns the token ID in this header
+ rather than in the response body.
experimental or
- stable.version object.
- media-types object, which shows the
- supported media types.v3.0.true,
- the domain is enabled. If false, the domain is
- disabled.true or false.auth object.identity object.password or token.password object.token object. With token authentication, the
- id uniquely identifies the token. This method is
- typically used in combination with a request to change
- authorization scope.
+ The UUID for the credential.
id uniquely
- identifies the user. However, name uniquely
- identifies the user when used in conjunction with a domain
- id or name.user object. Specify id or name to uniquely
- identify the user and password. Use
- name only in conjunction with a domain
- id or name.id or name to
- uniquely identify the domain.id or name to uniquely
- identify the domain or project. Use project name only in
- conjunction with a domain id or
- name.admin, public, or internal.endpoint object.endpoints object.true,
- the endpoint is enabled. If false, the endpoint is
- disabled.admin, public, or
- internal.token object.service object.services object.true,
- the service is enabled. If false, the service is
- disabled.domains object.true to enable the domain or false to disable the
- domain.
+ The group name, which is ldap or
+ identity.
role object.roles object.roles resource.group object.group object.true to enable the project or
- false to disable the project. Default is
- true.
- true, project is enabled. If set to
- false, project is disabled.
- user object.true. To disable the user, set to false.
- Default is true.
- user object.true. If the
- user is disabled, this value is false.
- region object.regions object.ldap group, a valid value is
+ url or user_tree_dn. For the
+ identity group, a valid value is driver.
true) or
+ disabled (false) domains.
+ true) or
+ disabled (false) groups.
+ true) or
+ disabled (false) projects.
+ true) or
+ disabled (false) roles.
+ true) or
+ disabled (false) users.
+ application/json.
+ compute, ec2, identity,
+ image, network, or volume.
+ v3.4.
+ stable or deprecated.
+ version object.
+ versions object.
+ credential object.
+ credentials object.
+ ec2 or
+ cert. The implementation determines the list of
+ supported types.
+ ec2 or
+ cert. The implementation determines the list of
+ supported types.
+ ec2 or
+ cert. The implementation determines the list of
+ supported types.
+ credential resource.
+ credentials resource.
+ domain object.
+ domains object.
+ true. To disable the domain,
+ set to false. Default is true.
+ true, the domain is enabled. Users can
+ authorize against an enabled domain and any of its projects. Users
+ that are owned by an enabled domain can authenticate and receive
+ additional authorization.
+ false, the domain is disabled. Users cannot
+ authorize against a disabled domain or any of its projects. Users
+ that are owned by a disabled domain cannot authenticate or receive
+ additional authorization. All tokens that are authorized for a
+ disabled domain or its projects become no longer valid. If you
+ reenable the domain, these tokens are not reenabled.
+ domain resource.
+ domains resource.
+ config object.
+ identity object. Required to set the identity group configuration options.
+ ldap object. Required to set the LDAP group configuration options.
+ ou=Users,dc=root,dc=org.
+ ou=Users,dc=root,dc=org.
+ endpoint object.
+ endpoints object.
+ false. The endpoint does not appear
+ in the service catalog.
+ true. The endpoint appears in the service
+ catalog.
+ true.
+ public. Visible by end users on a
+ publicly available network interface.
+ internal. Visible by end users on
+ an unmetered internal network interface.
+ admin. Visible by administrative users on a
+ secure network interface.
+ region_id parameter instead.
+ false. The endpoint does not appear
+ in the service catalog.
+ true. The endpoint appears in the service
+ catalog.
+ public. Visible by end users on a
+ publicly available network interface.
+ internal. Visible by end users on
+ an unmetered internal network interface.
+ admin. Visible by administrative users on a
+ secure network interface.
+ endpoint resource.
+ endpoints resource.
+ group object.
+ groups object.
+ true, the domain is enabled. If
+ false, the domain is disabled.
+ group resource.
+ groups resource.
+ policy object.
+ policies object.
+ policy.json blob
+ (type="application/json") is the conventional
+ solution. However, you might want to use an alternative policy
+ engine that uses a different policy language type. For example,
+ type="application/xacml+xml".
+ policy resource.
+ policies resource.
+ project object.
+ projects object.
+ true. To disable the project,
+ set to false. Default is true.
+ true.
+ To disable the project and its subtree, set to false.
+ Default is true.
+ true to define this project as both a project
+ and domain. As a domain, the project provides a name space in
+ which you can create users, groups, and other projects.
+ false to define this project as a regular
+ project that contains only resources.
+ false.
+ true, project is enabled. If set to
+ false, project is disabled.
+ true, this project acts as both a project
+ and domain. As a domain, the project provides a name space in
+ which you can create users, groups, and other projects.
+ project resource.
+ projects resource.
+ null,
+ the project is a top-level project.
+ region object.
+ regions object.
+ region resource.
+ regions resource.
+ null.
role object.
+ roles object.
+ role resource.
+ roles resource.
+ service object.
+ services object.
+ false. The service and its endpoints do not appear
+ in the service catalog.
+ true. The service and its endpoints appear in the service
+ catalog.
+ true.
+ compute, ec2,
+ identity, image, network,
+ or volume.
+ false. The service and its endpoints do not appear
+ in the service catalog.
+ true. The service and its endpoints appear in the service
+ catalog.
+ service resource.
+ services resource.
+ compute, ec2,
+ identity, image, network,
+ or volume.
+ auth object.
+ token.
+ password.
+ project to scope to a project, by ID
+ or name. If you specify the project by name, you must also
+ specify the project domain to uniquely identify the
+ project. Because a project can have the same name as its
+ owning domain, the scope is determined, as follows:
+ domain to scope to a domain, by ID
+ or name with equivalent results to project scoping. The
+ catalog returned from a domain-scoped request contains all
+ endpoints of a project-scoped catalog, excluding ones that
+ require a project ID as part of their URL.
+ unscoped to make an explicit
+ unscoped token request, which returns an unscoped response without any
+ authorization. This request behaves the same as a token request with no scope
+ where the user has no default project defined.
+ unscoped token request
+ and your role has a default project, the response might return a
+ project-scoped token. If a default project is not defined, a token
+ is issued without an explicit scope of authorization, which is the
+ same as asking for an explicit unscoped token.
+ identity object.
+ password object. If specified, the password
+ authentication method is used.
+ password object. The password authentication method
+ is used.
+ token object. The token authentication method is
+ used. This method is typically used in combination with a request
+ to change authorization scope.
+ token object.
+ domain object. Required if you specify a user name.
+ id or name to uniquely
+ identify the domain.
+ domain resource.
+ password,
+ token, or both methods.
+ password.
+ Later, if the token is exchanged by using the token authentication
+ method one or more times, the subsequently created tokens contain
+ both password and token in their
+ methods attribute.
+ methods
+ attribute merely indicates the methods that were used to
+ authenticate the user for a specified token. The client is
+ responsible for determining the total number of authentication
+ factors.
+ catalog object.
+ roles object.
+ user resource.
+ token object.
+ user object.
+ domain object.
+ user object.
+ users object.
+ true. To disable the user,
+ set to false. Default is true.
+ true. If the
+ user is disabled, this value is false.
+ user resource.
+ users resource.
+ group.id={group_id}
- to list all role assignments for the
- group.group.id={group_id}.
+ role.id={role_id} to
- list all role assignments for the
- role.role.id={role_id}.
+ scope.domain.id={domain_id}
- to list all role assignments for the
- domain.scope.domain.id={domain_id}.
+ scope.project.id={project_id}
- to list all role assignments for the
- project.scope.project.id={project_id}.
+ user.id={user_id} to
- list all role assignments for the
- user.user.id={user_id}.
+ effective
- parameter.effective parameter.
+ GET /role_assignments?scope.project.id={project_id}?include_subtree=trueinclude_subtree=true only in
+ combination with scope.project.id. If you do not
+ include the project ID, this call returns the Bad Request
+ (400) response code.
+ X-Auth-Token header. Clients obtain this token
- and the URL endpoints for other service APIs by supplying
- their valid credentials to the authentication service.
- auth/tokens the path. The body
- of the request must include a payload of credentials including
- the authentication method and, optionally, the authorization
- scope. The scope includes either a project or domain. If you
- include both project and domain, this call returns the HTTP
- Bad Request (400) status code because a token
- cannot be simultaneously scoped as both a project and domain.
- default_project_id attribute for the user),
- that default project is treated as the preferred
- authorization scope.
- scope is included, project id
- uniquely identifies the project. However,
- project name uniquely identifies the
- project only when used in conjunction with a
- domain ID or a domain name.
- 401 status code.
- 404 status code.X-Subject-Token header
- instead of in the token data.catalog,
- project, domain, or
- roles fields. However, the response still
- uniquely identifies the user.
- project also has both a
- service catalog and the user's roles applicable
- to the project.
- domain also has
- both a service catalog and the user's
- roles applicable to the project.authentication attribute to indicate the
- supported authentication methods.
- Unauthorized (401) status code with additional
- information for the next authentication step.
- Unauthorized (401) authentication errors. Other
- errors, like HTTP Forbidden (403), are also
- possible.
+ The following example shows how to create an EC2-style
+ credential. The credential blob is a string that contains a
+ JSON-serialized dictionary with the access and
+ secret keys. This format is required when you
+ specify the ec2 type. To specify other credentials,
+ such as access_key, change the type and contents of
+ the data blob.
X-Auth-Token header.
- Pass the token to be validated in the X-Subject-Token
- header. The Identity API returns the same
- response as when the subject token was issued by POST
- /auth/tokens.
+ Optionally, you can include the user_id query
+ parameter in the URI to filter the response by a specified
+ user.
Bad
+ Request (400) response code.
+ Forbidden (403) response code.
+ identity and
+ ldap groups.
+ identity and
+ ldap groups. If you try to set configuration
+ options for other groups, this call fails with the
+ Forbidden (403) response code.
+ identity and
+ ldap groups.
+ identity and
+ ldap groups. For the ldap group, a
+ valid value is url or user_tree_dn.
+ For the identity group, a valid value is
+ driver.
+ identity and
+ ldap groups. For the ldap group, a
+ valid value is url or user_tree_dn.
+ For the identity group, a valid value is
+ driver.
+ identity and
+ ldap groups. For the ldap group, a
+ valid value is url or user_tree_dn.
+ For the identity group, a valid value is
+ driver.
+ Not Implemented (501)
+ response code.
+ enabled
+ attribute, this call fails and returns the Bad Request
+ (400) response code.
+ is_domain is set to true,
+ this call fails and returns the Forbidden (403)
+ response code.
+ Not Found (404). The specified parent
+ region ID does not exist.
+ Conflict (409). The specified
+ parent region ID would form a circular relationship.
+ Conflict (409). The specified user-defined
+ region ID is not unique to the OpenStack deployment.
+ Not Found (404). The specified parent
+ region ID does not exist.
+ Conflict (409). The specified region
+ cannot be deleted because it has child regions.
+ role_assignments object.
+ password, and
+ the user, by ID or name, and password credentials.
+ password authentication method, the credentials,
+ and the project or domain
+ authorization scope.
+ password authentication method, the credentials,
+ and the unscoped authorization scope.
+ project or
+ domain authorization scope.
+ X-Auth-Token request header.
+ X-Subject-Token request header.
+ POST /auth/tokens
even if an error occurs because the token is not valid. An
- HTTP 204 status code indicates that the
+ HTTP 204 response code indicates that the
X-Subject-Token is valid.
@@ -813,14 +3328,22 @@
xml:lang="EN">
HEAD /auth/tokens except
- that the X-Subject-Token token is immediately not
- valid, regardless of the expires_at attribute
- value. An additional X-Auth-Token is not
+ This call is similar to the &HEAD; /auth/tokens
+ call except that the X-Subject-Token token is
+ immediately not valid, regardless of the expires_at
+ attribute value. An additional X-Auth-Token is not
required.
Forbidden (403) status code.
- Not Implemented (501)
- status code.
+ Lists users.
Not Implemented (501)
+ response code.
+ Not Implemented
- (501) status code.
- access and
- secret keys. This format is required when you
- specify the ec2 type. To specify other
- credentials such as access_key, change the type
- and contents of the data blob.
- GET /role_assignments?user.id={user_id} lists
- role assignments for a user.
- GET
- /role_assignments?scope.project.id={project_id}
- lists role assignments for a project.
- effective query parameter to list
- effective assignments at the user, project, and domain level.
- This parameter allows for the effects of group membership. The
- group role assignment entities themselves are not returned in
- the collection. This represents the effective role assignments
- that would be included in a scoped token. You can use the
- other query parameters with the effective
- parameter.
- GET
- /role_assignments?user.id={user_id}&effective
- request.
- GET /role_assignments?user.id={user_id}&s
- cope.project.id={project_id}&effective request.
- links entity section for
- entities that are included by virtue of group members also
- contains a URL that you can use to access the membership of
- the group.
- Not Found
- (404) status code.
- Conflict (409) status code.
- Conflict (409) status code.
- Not Found
- (404) status code.
- Conflict (409) status code.
- Conflict (409) status code.
- Not Found
- (404) status code.
- Conflict (409) status
- code.
-