ca3166707b
When a federated user logs in, openstack_auth receives an unscoped token and no user_domain_name parameter. Currently, if the federated user has a role in one or more domains, but no roles in any projects, openstack_auth prevents authorization and denies the user's login with the error "You are not authorized for any projects or domains." This is a problem because first, it's inaccurate, as the user is authorized for at least one domain, and second, a keystone administrator may want to give federated users access to a domain without any projects in it, for example so delegate the creation of projects to the federated users themselves. This patch allows federated users without project roles to log in by looking up domains as well as projects when attempting to scope the token. This lookup is skipped if the domain was passed as part of the request. This patch also slightly restructures the OpenStackAuthTestsWebSSO and OpenStackAuthTestsV3 tests because mox needs to simulate only one instance of the plugin but two instances of the client objects for every call to authenticate(). Closes-bug: #1649101 Change-Id: I151218ff28c0728898ed5315d63dd8122ce3b166
Team and repository tags
Django OpenStack Auth
Django OpenStack Auth is a pluggable Django authentication backend
that works with Django's contrib.auth framework to
authenticate a user against OpenStack's Keystone Identity API.
The current version is designed to work with the Keystone v2.0 and v3 API.
You can view the installation instructions on Read The Docs.
- License: Apache License, Version 2.0
- Documentation: http://django-openstack-auth.readthedocs.org/en/latest/
- Source: http://git.openstack.org/cgit/openstack/django_openstack_auth/
- Bugs: https://bugs.launchpad.net/django-openstack-auth