openstack
/
keystone
Code Issues Proposed changes

Convert OS-AUTH1 paths to flask dispatching 

Convert OS-AUTH1 paths to native flask dispatching.

Change-Id: Iad54005b4dbfafa52ac241cdc4d1cae63c99f151
Partial-Bug: #1776504
This commit is contained in:
Morgan Fainberg 2018-08-01 11:47:33 -07:00
parent a4d9a4f13b
commit 6f07b4c1ff
8 changed files with 413 additions and 365 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
keystone/api/__init__.py
View File

@ -12,8 +12,9 @@
from keystone.api import credentials
from keystone.api import discovery
from keystone.api import os_oauth1
from keystone.api import os_revoke
from keystone.api import trusts
__all__ = ('discovery', 'credentials', 'os_revoke', 'trusts')
__apis__ = (discovery, credentials, os_revoke, trusts)
__all__ = ('discovery', 'credentials', 'os_oauth1', 'os_revoke', 'trusts')
__apis__ = (discovery, credentials, os_oauth1, os_revoke, trusts)

377
keystone/api/os_oauth1.py Normal file
View File

@ -0,0 +1,377 @@
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
# This file handles all flask-restful resources for /v3/OS-OAUTH1/
import functools
import flask
import flask_restful
from oslo_log import log
from oslo_utils import timeutils
from six.moves import http_client
from six.moves.urllib import parse as urlparse
from werkzeug import exceptions
from keystone.common import authorization
from keystone.common import context
from keystone.common import json_home
from keystone.common import provider_api
from keystone.common import rbac_enforcer
from keystone.common import validation
import keystone.conf
from keystone import exception
from keystone.i18n import _
from keystone import notifications
from keystone.oauth1 import core as oauth1
from keystone.oauth1 import schema
from keystone.oauth1 import validator
from keystone.server import flask as ks_flask
LOG = log.getLogger(__name__)
PROVIDERS = provider_api.ProviderAPIs
ENFORCER = rbac_enforcer.RBACEnforcer
CONF = keystone.conf.CONF
_build_resource_relation = functools.partial(
json_home.build_v3_extension_resource_relation,
extension_name='OS-OAUTH1', extension_version='1.0')
_build_parameter_relation = functools.partial(
json_home.build_v3_extension_parameter_relation,
extension_name='OS-OAUTH1', extension_version='1.0')
_ACCESS_TOKEN_ID_PARAMETER_RELATION = _build_parameter_relation(
parameter_name='access_token_id')
def _normalize_role_list(authorize_roles):
roles = set()
for role in authorize_roles:
if role.get('id'):
roles.add(role['id'])
else:
roles.add(PROVIDERS.role_api.get_unique_role_by_name(
role['name'])['id'])
return roles
def _update_url_scheme():
"""Update request url scheme with base url scheme."""
url = ks_flask.base_url()
url_scheme = list(urlparse.urlparse(url))[0]
req_url_list = list(urlparse.urlparse(flask.request.url))
req_url_list[0] = url_scheme
req_url = urlparse.urlunparse(req_url_list)
return req_url
class _OAuth1ResourceBase(flask_restful.Resource):
def get(self):
# GET is not allowed, however flask restful doesn't handle "GET" not
# being allowed cleanly. Here we explicitly mark is as not allowed. All
# other methods not defined would raise a method NotAllowed error and
# this would not be needed.
raise exceptions.MethodNotAllowed(valid_methods=['POST'])
class ConsumerResource(ks_flask.ResourceBase):
collection_key = 'consumers'
member_key = 'consumer'
api_prefix = '/OS-OAUTH1'
json_home_resource_rel_func = _build_resource_relation
json_home_parameter_rel_func = _build_parameter_relation
def _list_consumers(self):
ENFORCER.enforce_call(action='identity:list_consumers')
return self.wrap_collection(PROVIDERS.oauth_api.list_consumers())
def _get_consumer(self, consumer_id):
ENFORCER.enforce_call(action='identity:get_consumer')
return self.wrap_member(PROVIDERS.oauth_api.get_consumer(consumer_id))
def get(self, consumer_id=None):
if consumer_id is None:
return self._list_consumers()
return self._get_consumer(consumer_id)
def post(self):
ENFORCER.enforce_call(action='identity:create_consumer')
consumer = (flask.request.get_json(force=True, silent=True) or {}).get(
'consumer', {})
consumer = self._normalize_dict(consumer)
validation.lazy_validate(schema.consumer_create, consumer)
consumer = self._assign_unique_id(consumer)
ref = PROVIDERS.oauth_api.create_consumer(
consumer, initiator=self.audit_initiator)
return self.wrap_member(ref), http_client.CREATED
def delete(self, consumer_id):
ENFORCER.enforce_call(action='identity:delete_consumer')
reason = (
'Invalidating token cache because consumer %(consumer_id)s has '
'been deleted. Authorization for users with OAuth tokens will be '
'recalculated and enforced accordingly the next time they '
'authenticate or validate a token.' %
{'consumer_id': consumer_id}
)
notifications.invalidate_token_cache_notification(reason)
PROVIDERS.oauth_api.delete_consumer(
consumer_id, initiator=self.audit_initiator)
return None, http_client.NO_CONTENT
def patch(self, consumer_id):
ENFORCER.enforce_call(action='identity:update_consumer')
consumer = (flask.request.get_json(force=True, silent=True) or {}).get(
'consumer', {})
validation.lazy_validate(schema.consumer_update, consumer)
consumer = self._normalize_dict(consumer)
self._require_matching_id(consumer)
ref = PROVIDERS.oauth_api.update_consumer(
consumer_id, consumer, initiator=self.audit_initiator)
return self.wrap_member(ref)
class RequestTokenResource(_OAuth1ResourceBase):
@ks_flask.unenforced_api
def post(self):
oauth_headers = oauth1.get_oauth_headers(flask.request.headers)
consumer_id = oauth_headers.get('oauth_consumer_key')
requested_project_id = flask.request.headers.get(
'Requested-Project-Id')
if not consumer_id:
raise exception.ValidationError(
attribute='oauth_consumer_key', target='request')
if not requested_project_id:
raise exception.ValidationError(
attribute='Requested-Project-Id', target='request')
# NOTE(stevemar): Ensure consumer and requested project exist
PROVIDERS.resource_api.get_project(requested_project_id)
PROVIDERS.oauth_api.get_consumer(consumer_id)
url = _update_url_scheme()
req_headers = {'Requested-Project-Id': requested_project_id}
req_headers.update(flask.request.headers)
request_verifier = oauth1.RequestTokenEndpoint(
request_validator=validator.OAuthValidator(),
token_generator=oauth1.token_generator)
h, b, s = request_verifier.create_request_token_response(
url, http_method='POST', body=flask.request.args,
headers=req_headers)
if not b:
msg = _('Invalid signature')
raise exception.Unauthorized(message=msg)
# show the details of the failure.
oauth1.validate_oauth_params(b)
request_token_duration = CONF.oauth1.request_token_duration
token_ref = PROVIDERS.oauth_api.create_request_token(
consumer_id,
requested_project_id,
request_token_duration,
initiator=ks_flask.build_audit_initiator())
result = ('oauth_token=%(key)s&oauth_token_secret=%(secret)s'
% {'key': token_ref['id'],
'secret': token_ref['request_secret']})
if CONF.oauth1.request_token_duration > 0:
expiry_bit = '&oauth_expires_at=%s' % token_ref['expires_at']
result += expiry_bit
resp = flask.make_response(result, http_client.CREATED)
resp.headers['Content-Type'] = 'application/x-www-form-urlencoded'
return resp
class AccessTokenResource(_OAuth1ResourceBase):
@ks_flask.unenforced_api
def post(self):
oauth_headers = oauth1.get_oauth_headers(flask.request.headers)
consumer_id = oauth_headers.get('oauth_consumer_key')
request_token_id = oauth_headers.get('oauth_token')
oauth_verifier = oauth_headers.get('oauth_verifier')
if not consumer_id:
raise exception.ValidationError(
attribute='oauth_consumer_key', target='request')
if not request_token_id:
raise exception.ValidationError(
attribute='oauth_token', target='request')
if not oauth_verifier:
raise exception.ValidationError(
attribute='oauth_verifier', target='request')
req_token = PROVIDERS.oauth_api.get_request_token(
request_token_id)
expires_at = req_token['expires_at']
if expires_at:
now = timeutils.utcnow()
expires = timeutils.normalize_time(
timeutils.parse_isotime(expires_at))
if now > expires:
raise exception.Unauthorized(_('Request token is expired'))
url = _update_url_scheme()
access_verifier = oauth1.AccessTokenEndpoint(
request_validator=validator.OAuthValidator(),
token_generator=oauth1.token_generator)
try:
h, b, s = access_verifier.create_access_token_response(
url,
http_method='POST',
body=flask.request.args,
headers=flask.request.headers)
except NotImplementedError:
# Client key or request token validation failed, since keystone
# does not yet support dummy client or dummy request token,
# so we will raise unauthorized exception instead.
try:
PROVIDERS.oauth_api.get_consumer(consumer_id)
except exception.NotFound:
msg = _('Provided consumer does not exist.')
LOG.warning('Provided consumer does not exist.')
raise exception.Unauthorized(message=msg)
if req_token['consumer_id'] != consumer_id:
msg = ('Provided consumer key does not match stored consumer '
'key.')
tr_msg = _('Provided consumer key does not match stored '
'consumer key.')
LOG.warning(msg)
raise exception.Unauthorized(message=tr_msg)
# The response body is empty since either one of the following reasons
if not b:
if req_token['verifier'] != oauth_verifier:
msg = 'Provided verifier does not match stored verifier'
tr_msg = _('Provided verifier does not match stored verifier')
else:
msg = 'Invalid signature'
tr_msg = _('Invalid signature')
LOG.warning(msg)
raise exception.Unauthorized(message=tr_msg)
# show the details of the failure
oauth1.validate_oauth_params(b)
if not req_token.get('authorizing_user_id'):
msg = _('Request Token does not have an authorizing user id.')
LOG.warning('Request Token does not have an authorizing user id.')
raise exception.Unauthorized(message=msg)
access_token_duration = CONF.oauth1.access_token_duration
token_ref = PROVIDERS.oauth_api.create_access_token(
request_token_id,
access_token_duration,
initiator=ks_flask.build_audit_initiator())
result = ('oauth_token=%(key)s&oauth_token_secret=%(secret)s'
% {'key': token_ref['id'],
'secret': token_ref['access_secret']})
if CONF.oauth1.access_token_duration > 0:
expiry_bit = '&oauth_expires_at=%s' % (token_ref['expires_at'])
result += expiry_bit
resp = flask.make_response(result, http_client.CREATED)
resp.headers['Content-Type'] = 'application/x-www-form-urlencoded'
return resp
class AuthorizeResource(_OAuth1ResourceBase):
def put(self, request_token_id):
ENFORCER.enforce_call(action='identity:authorize_request_token')
roles = (flask.request.get_json(force=True, silent=True) or {}).get(
'roles', [])
validation.lazy_validate(schema.request_token_authorize, roles)
ctx = flask.request.environ[context.REQUEST_CONTEXT_ENV]
if ctx.is_delegated_auth:
raise exception.Forbidden(
_('Cannot authorize a request token with a token issued via '
'delegation.'))
req_token = PROVIDERS.oauth_api.get_request_token(request_token_id)
expires_at = req_token['expires_at']
if expires_at:
now = timeutils.utcnow()
expires = timeutils.normalize_time(
timeutils.parse_isotime(expires_at))
if now > expires:
raise exception.Unauthorized(_('Request token is expired'))
authed_roles = _normalize_role_list(roles)
# verify the authorizing user has the roles
try:
auth_context = flask.request.environ[
authorization.AUTH_CONTEXT_ENV]
user_token_ref = auth_context['token']
except KeyError:
LOG.warning("Couldn't find the auth context.")
raise exception.Unauthorized()
user_id = user_token_ref.user_id
project_id = req_token['requested_project_id']
user_roles = PROVIDERS.assignment_api.get_roles_for_user_and_project(
user_id, project_id)
cred_set = set(user_roles)
if not cred_set.issuperset(authed_roles):
msg = _('authorizing user does not have role required')
raise exception.Unauthorized(message=msg)
# create least of just the id's for the backend
role_ids = list(authed_roles)
# finally authorize the token
authed_token = PROVIDERS.oauth_api.authorize_request_token(
request_token_id, user_id, role_ids)
to_return = {'token': {'oauth_verifier': authed_token['verifier']}}
return to_return
class OSAuth1API(ks_flask.APIBase):
_name = 'OS-OAUTH1'
_import_name = __name__
_api_url_prefix = '/OS-OAUTH1'
resources = [ConsumerResource]
resource_mapping = [
ks_flask.construct_resource_map(
resource=RequestTokenResource,
url='/request_token',
resource_kwargs={},
rel='request_tokens',
resource_relation_func=_build_resource_relation
),
ks_flask.construct_resource_map(
resource=AccessTokenResource,
url='/access_token',
rel='access_tokens',
resource_kwargs={},
resource_relation_func=_build_resource_relation
),
ks_flask.construct_resource_map(
resource=AuthorizeResource,
url='/authorize/<string:request_token_id>',
resource_kwargs={},
rel='authorize_request_token',
resource_relation_func=_build_resource_relation,
path_vars={
'request_token_id': _build_parameter_relation(
parameter_name='request_token_id')
})]
APIs = (OSAuth1API,)

285
keystone/oauth1/controllers.py
View File

@ -16,22 +16,13 @@
from oslo_log import log
from oslo_serialization import jsonutils
from oslo_utils import timeutils
from six.moves import http_client
from six.moves.urllib import parse as urlparse
from keystone.common import authorization
from keystone.common import controller
from keystone.common import provider_api
from keystone.common import validation
from keystone.common import wsgi
import keystone.conf
from keystone import exception
from keystone.i18n import _
from keystone import notifications
from keystone.oauth1 import core as oauth1
from keystone.oauth1 import schema
from keystone.oauth1 import validator
CONF = keystone.conf.CONF
@ -39,62 +30,6 @@ LOG = log.getLogger(__name__)
PROVIDERS = provider_api.ProviderAPIs
class ConsumerCrudV3(controller.V3Controller):
collection_name = 'consumers'
member_name = 'consumer'
@classmethod
def base_url(cls, context, path=None):
"""Construct a path and pass it to V3Controller.base_url method."""
# NOTE(stevemar): Overriding path to /OS-OAUTH1/consumers so that
# V3Controller.base_url handles setting the self link correctly.
path = '/OS-OAUTH1/' + cls.collection_name
return controller.V3Controller.base_url(context, path=path)
@controller.protected()
def create_consumer(self, request, consumer):
validation.lazy_validate(schema.consumer_create, consumer)
ref = self._assign_unique_id(self._normalize_dict(consumer))
consumer_ref = PROVIDERS.oauth_api.create_consumer(
ref, initiator=request.audit_initiator
)
return ConsumerCrudV3.wrap_member(request.context_dict, consumer_ref)
@controller.protected()
def update_consumer(self, request, consumer_id, consumer):
validation.lazy_validate(schema.consumer_update, consumer)
self._require_matching_id(consumer_id, consumer)
ref = self._normalize_dict(consumer)
ref = PROVIDERS.oauth_api.update_consumer(
consumer_id, ref, initiator=request.audit_initiator
)
return ConsumerCrudV3.wrap_member(request.context_dict, ref)
@controller.protected()
def list_consumers(self, request):
ref = PROVIDERS.oauth_api.list_consumers()
return ConsumerCrudV3.wrap_collection(request.context_dict, ref)
@controller.protected()
def get_consumer(self, request, consumer_id):
ref = PROVIDERS.oauth_api.get_consumer(consumer_id)
return ConsumerCrudV3.wrap_member(request.context_dict, ref)
@controller.protected()
def delete_consumer(self, request, consumer_id):
reason = (
'Invalidating token cache because consumer %(consumer_id)s has '
'been deleted. Authorization for users with OAuth tokens will be '
'recalculated and enforced accordingly the next time they '
'authenticate or validate a token.' %
{'consumer_id': consumer_id}
)
notifications.invalidate_token_cache_notification(reason)
PROVIDERS.oauth_api.delete_consumer(
consumer_id, initiator=request.audit_initiator
)
class AccessTokenCrudV3(controller.V3Controller):
collection_name = 'access_tokens'
member_name = 'access_token'
@ -206,223 +141,3 @@ class AccessTokenRolesV3(controller.V3Controller):
if 'enabled' in role:
formatted_entity.pop('enabled')
return formatted_entity
class OAuthControllerV3(controller.V3Controller):
collection_name = 'not_used'
member_name = 'not_used'
def _update_url_scheme(self, request):
"""Update request url scheme with base url scheme."""
url = self.base_url(request.context_dict, request.context_dict['path'])
url_scheme = list(urlparse.urlparse(url))[0]
req_url_list = list(urlparse.urlparse(request.url))
req_url_list[0] = url_scheme
req_url = urlparse.urlunparse(req_url_list)
return req_url
def create_request_token(self, request):
oauth_headers = oauth1.get_oauth_headers(request.headers)
consumer_id = oauth_headers.get('oauth_consumer_key')
requested_project_id = request.headers.get('Requested-Project-Id')
if not consumer_id:
raise exception.ValidationError(
attribute='oauth_consumer_key', target='request')
if not requested_project_id:
raise exception.ValidationError(
attribute='Requested-Project-Id', target='request')
# NOTE(stevemar): Ensure consumer and requested project exist
PROVIDERS.resource_api.get_project(requested_project_id)
PROVIDERS.oauth_api.get_consumer(consumer_id)
url = self._update_url_scheme(request)
req_headers = {'Requested-Project-Id': requested_project_id}
req_headers.update(request.headers)
request_verifier = oauth1.RequestTokenEndpoint(
request_validator=validator.OAuthValidator(),
token_generator=oauth1.token_generator)
h, b, s = request_verifier.create_request_token_response(
url,
http_method='POST',
body=request.params,
headers=req_headers)
if not b:
msg = _('Invalid signature')
raise exception.Unauthorized(message=msg)
# show the details of the failure.
oauth1.validate_oauth_params(b)
request_token_duration = CONF.oauth1.request_token_duration
token_ref = PROVIDERS.oauth_api.create_request_token(
consumer_id,
requested_project_id,
request_token_duration,
initiator=request.audit_initiator)
result = ('oauth_token=%(key)s&oauth_token_secret=%(secret)s'
% {'key': token_ref['id'],
'secret': token_ref['request_secret']})
if CONF.oauth1.request_token_duration > 0:
expiry_bit = '&oauth_expires_at=%s' % token_ref['expires_at']
result += expiry_bit
headers = [('Content-Type', 'application/x-www-form-urlencoded')]
response = wsgi.render_response(
result,
status=(http_client.CREATED,
http_client.responses[http_client.CREATED]),
headers=headers)
return response
def create_access_token(self, request):
oauth_headers = oauth1.get_oauth_headers(request.headers)
consumer_id = oauth_headers.get('oauth_consumer_key')
request_token_id = oauth_headers.get('oauth_token')
oauth_verifier = oauth_headers.get('oauth_verifier')
if not consumer_id:
raise exception.ValidationError(
attribute='oauth_consumer_key', target='request')
if not request_token_id:
raise exception.ValidationError(
attribute='oauth_token', target='request')
if not oauth_verifier:
raise exception.ValidationError(
attribute='oauth_verifier', target='request')
req_token = PROVIDERS.oauth_api.get_request_token(
request_token_id)
expires_at = req_token['expires_at']
if expires_at:
now = timeutils.utcnow()
expires = timeutils.normalize_time(
timeutils.parse_isotime(expires_at))
if now > expires:
raise exception.Unauthorized(_('Request token is expired'))
url = self._update_url_scheme(request)
access_verifier = oauth1.AccessTokenEndpoint(
request_validator=validator.OAuthValidator(),
token_generator=oauth1.token_generator)
try:
h, b, s = access_verifier.create_access_token_response(
url,
http_method='POST',
body=request.params,
headers=request.headers)
except NotImplementedError:
# Client key or request token validation failed, since keystone
# does not yet support dummy client or dummy request token,
# so we will raise Unauthorized exception instead.
try:
PROVIDERS.oauth_api.get_consumer(consumer_id)
except exception.NotFound:
msg = _('Provided consumer does not exist.')
LOG.warning(msg)
raise exception.Unauthorized(message=msg)
if req_token['consumer_id'] != consumer_id:
msg = _('Provided consumer key does not match stored '
'consumer key.')
LOG.warning(msg)
raise exception.Unauthorized(message=msg)
# The response body is empty since either one of the following reasons
if not b:
if req_token['verifier'] != oauth_verifier:
msg = _('Provided verifier does not match stored verifier')
else:
msg = _('Invalid signature.')
LOG.warning(msg)
raise exception.Unauthorized(message=msg)
# show the details of the failure.
oauth1.validate_oauth_params(b)
if not req_token.get('authorizing_user_id'):
msg = _('Request Token does not have an authorizing user id.')
LOG.warning(msg)
raise exception.Unauthorized(message=msg)
access_token_duration = CONF.oauth1.access_token_duration
token_ref = PROVIDERS.oauth_api.create_access_token(
request_token_id,
access_token_duration,
initiator=request.audit_initiator
)
result = ('oauth_token=%(key)s&oauth_token_secret=%(secret)s'
% {'key': token_ref['id'],
'secret': token_ref['access_secret']})
if CONF.oauth1.access_token_duration > 0:
expiry_bit = '&oauth_expires_at=%s' % (token_ref['expires_at'])
result += expiry_bit
headers = [('Content-Type', 'application/x-www-form-urlencoded')]
response = wsgi.render_response(
result,
status=(http_client.CREATED,
http_client.responses[http_client.CREATED]),
headers=headers)
return response
def _normalize_role_list(self, authorize_roles):
roles = set()
for role in authorize_roles:
if role.get('id'):
roles.add(role['id'])
else:
roles.add(PROVIDERS.role_api.get_unique_role_by_name(
role['name'])['id'])
return roles
@controller.protected()
def authorize_request_token(self, request, request_token_id, roles):
"""An authenticated user is going to authorize a request token.
As a security precaution, the requested roles must match those in
the request token. Because this is in a CLI-only world at the moment,
there is not another easy way to make sure the user knows which roles
are being requested before authorizing.
"""
validation.lazy_validate(schema.request_token_authorize, roles)
if request.context.is_delegated_auth:
raise exception.Forbidden(
_('Cannot authorize a request token'
' with a token issued via delegation.'))
req_token = PROVIDERS.oauth_api.get_request_token(request_token_id)
expires_at = req_token['expires_at']
if expires_at:
now = timeutils.utcnow()
expires = timeutils.normalize_time(
timeutils.parse_isotime(expires_at))
if now > expires:
raise exception.Unauthorized(_('Request token is expired'))
authed_roles = self._normalize_role_list(roles)
# verify the authorizing user has the roles
user_token = authorization.get_token_ref(request.context_dict)
user_id = user_token.user_id
project_id = req_token['requested_project_id']
user_roles = PROVIDERS.assignment_api.get_roles_for_user_and_project(
user_id, project_id)
cred_set = set(user_roles)
if not cred_set.issuperset(authed_roles):
msg = _('authorizing user does not have role required')
raise exception.Unauthorized(message=msg)
# create list of just the id's for the backend
role_ids = list(authed_roles)
# finally authorize the token
authed_token = PROVIDERS.oauth_api.authorize_request_token(
request_token_id, user_id, role_ids)
to_return = {'token': {'oauth_verifier': authed_token['verifier']}}
return to_return

57
keystone/oauth1/routers.py
View File

@ -41,13 +41,6 @@ class Routers(wsgi.RoutersBase):
The API looks like::
# Basic admin-only consumer crud
POST /OS-OAUTH1/consumers
GET /OS-OAUTH1/consumers
PATCH /OS-OAUTH1/consumers/{consumer_id}
GET /OS-OAUTH1/consumers/{consumer_id}
DELETE /OS-OAUTH1/consumers/{consumer_id}
# User access token crud
GET /users/{user_id}/OS-OAUTH1/access_tokens
GET /users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id}
@ -56,39 +49,13 @@ class Routers(wsgi.RoutersBase):
/{access_token_id}/roles/{role_id}
DELETE /users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id}
# OAuth interfaces
POST /OS-OAUTH1/request_token # create a request token
PUT /OS-OAUTH1/authorize # authorize a request token
POST /OS-OAUTH1/access_token # create an access token
"""
_path_prefixes = ('users', 'OS-OAUTH1')
_path_prefixes = ('users',)
def append_v3_routers(self, mapper, routers):
consumer_controller = controllers.ConsumerCrudV3()
access_token_controller = controllers.AccessTokenCrudV3()
access_token_roles_controller = controllers.AccessTokenRolesV3()
oauth_controller = controllers.OAuthControllerV3()
# basic admin-only consumer crud
self._add_resource(
mapper, consumer_controller,
path='/OS-OAUTH1/consumers',
get_head_action='list_consumers',
post_action='create_consumer',
rel=build_resource_relation(resource_name='consumers'))
self._add_resource(
mapper, consumer_controller,
path='/OS-OAUTH1/consumers/{consumer_id}',
get_head_action='get_consumer',
patch_action='update_consumer',
delete_action='delete_consumer',
rel=build_resource_relation(resource_name='consumer'),
path_vars={
'consumer_id':
build_parameter_relation(parameter_name='consumer_id'),
})
# user access token crud
self._add_resource(
@ -132,25 +99,3 @@ class Routers(wsgi.RoutersBase):
'role_id': json_home.Parameters.ROLE_ID,
'user_id': json_home.Parameters.USER_ID,
})
# oauth flow calls
self._add_resource(
mapper, oauth_controller,
path='/OS-OAUTH1/request_token',
post_action='create_request_token',
rel=build_resource_relation(resource_name='request_tokens'))
self._add_resource(
mapper, oauth_controller,
path='/OS-OAUTH1/access_token',
post_action='create_access_token',
rel=build_resource_relation(resource_name='access_tokens'))
self._add_resource(
mapper, oauth_controller,
path='/OS-OAUTH1/authorize/{request_token_id}',
path_vars={
'request_token_id':
build_parameter_relation(parameter_name='request_token_id')
},
put_action='authorize_request_token',
rel=build_resource_relation(
resource_name='authorize_request_token'))

5
keystone/server/flask/__init__.py
View File

@ -16,6 +16,7 @@
from keystone.server.flask.common import APIBase # noqa
from keystone.server.flask.common import base_url # noqa
from keystone.server.flask.common import build_audit_initiator # noqa
from keystone.server.flask.common import construct_json_home_data # noqa
from keystone.server.flask.common import construct_resource_map # noqa
from keystone.server.flask.common import full_url # noqa
@ -28,5 +29,5 @@ from keystone.server.flask.common import unenforced_api # noqa
# NOTE(morgan): This allows for from keystone.flask import * and have all the
# cool stuff needed to develop new APIs within a module/subsystem
__all__ = ('APIBase', 'JsonHomeData', 'ResourceBase', 'ResourceMap',
'base_url', 'construct_json_home_data', 'construct_resource_map',
'full_url', 'unenforced_api')
'base_url', 'build_audit_initiator', 'construct_json_home_data',
'construct_resource_map', 'full_url', 'unenforced_api')

3
keystone/server/flask/application.py
View File

@ -42,7 +42,8 @@ from keystone.token import _simple_cert as simple_cert_ext
# TODO(morgan): _MOVED_API_PREFIXES to be removed when the legacy dispatch
# support is removed.
_MOVED_API_PREFIXES = frozenset(['credentials', 'OS-REVOKE', 'OS-TRUST'])
_MOVED_API_PREFIXES = frozenset(['credentials', 'OS-OAUTH1', 'OS-REVOKE',
'OS-TRUST'])
LOG = log.getLogger(__name__)

43
keystone/server/flask/common.py
View File

@ -151,6 +151,26 @@ def _remove_content_type_on_204(resp):
return resp
def build_audit_initiator():
"""A pyCADF initiator describing the current authenticated context."""
pycadf_host = host.Host(address=flask.request.remote_addr,
agent=str(flask.request.user_agent))
initiator = resource.Resource(typeURI=taxonomy.ACCOUNT_USER,
host=pycadf_host)
oslo_context = flask.request.environ.get(context.REQUEST_CONTEXT_ENV)
if oslo_context.user_id:
initiator.id = utils.resource_uuid(oslo_context.user_id)
initiator.user_id = oslo_context.user_id
if oslo_context.project_id:
initiator.project_id = oslo_context.project_id
if oslo_context.domain_id:
initiator.domain_id = oslo_context.domain_id
return initiator
@six.add_metaclass(abc.ABCMeta)
class APIBase(object):
@ -565,7 +585,9 @@ class ResourceBase(flask_restful.Resource):
cls._add_self_referential_link(ref)
container = {cls.collection_key: refs}
self_url = full_url()
pfx = getattr(cls, 'api_prefix', '').lstrip('/')
parts = [p for p in (full_url(), 'v3', pfx, cls.collection_key) if p]
self_url = '/'.join(parts)
container['links'] = {
'next': None,
'self': self_url,
@ -661,22 +683,11 @@ class ResourceBase(flask_restful.Resource):
@property
def audit_initiator(self):
"""A pyCADF initiator describing the current authenticated context."""
pycadf_host = host.Host(address=flask.request.remote_addr,
agent=str(flask.request.user_agent))
initiator = resource.Resource(typeURI=taxonomy.ACCOUNT_USER,
host=pycadf_host)
if self.oslo_context.user_id:
initiator.id = utils.resource_uuid(self.oslo_context.user_id)
initiator.user_id = self.oslo_context.user_id
"""A pyCADF initiator describing the current authenticated context.
if self.oslo_context.project_id:
initiator.project_id = self.oslo_context.project_id
if self.oslo_context.domain_id:
initiator.domain_id = self.oslo_context.domain_id
return initiator
As a property.
"""
return build_audit_initiator()
@staticmethod
def build_driver_hints(supported_filters):

3
keystone/tests/unit/test_v3_oauth1.py
View File

@ -30,7 +30,6 @@ import keystone.conf
from keystone import exception
from keystone import oauth1
from keystone.oauth1.backends import base
from keystone.oauth1 import controllers
from keystone.tests import unit
from keystone.tests.unit.common import test_notifications
from keystone.tests.unit import ksfixtures
@ -53,10 +52,8 @@ class OAuth1Tests(test_v3.RestfulTestCase):
def setUp(self):
super(OAuth1Tests, self).setUp()
# Now that the app has been served, we can query CONF values
self.base_url = 'http://localhost/v3'
self.controller = controllers.OAuthControllerV3()
def _create_single_consumer(self):
ref = {'description': uuid.uuid4().hex}