67682dcd07
This change creates a /v3/users/{user_id}/access_rules endpoint to allow
users to view and delete their own access rules. Access rules are not
automatically deleted when an application credential is deleted, so they
can be re-used for other application credentials or explicitly deleted
by the user. Access rules are automatically deleted when the user is
deleted, the same way that application credentials are. Access rules
that are in use by an application credential may not be deleted.
bp whitelist-extension-for-app-creds
Change-Id: I37d243d802cd538189ccfffee6ebf0624b7785d3
722 lines
25 KiB
Python
722 lines
25 KiB
Python
# Copyright 2012 OpenStack Foundation
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
# not use this file except in compliance with the License. You may obtain
|
|
# a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
# License for the specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
from oslo_log import log
|
|
from oslo_utils import encodeutils
|
|
import six
|
|
from six.moves import http_client
|
|
|
|
import keystone.conf
|
|
from keystone.i18n import _
|
|
|
|
|
|
CONF = keystone.conf.CONF
|
|
LOG = log.getLogger(__name__)
|
|
|
|
KEYSTONE_API_EXCEPTIONS = set([])
|
|
|
|
# Tests use this to make exception message format errors fatal
|
|
_FATAL_EXCEPTION_FORMAT_ERRORS = False
|
|
|
|
|
|
def _format_with_unicode_kwargs(msg_format, kwargs):
|
|
try:
|
|
return msg_format % kwargs
|
|
except UnicodeDecodeError:
|
|
try:
|
|
kwargs = {k: encodeutils.safe_decode(v)
|
|
for k, v in kwargs.items()}
|
|
except UnicodeDecodeError:
|
|
# NOTE(jamielennox): This is the complete failure case
|
|
# at least by showing the template we have some idea
|
|
# of where the error is coming from
|
|
return msg_format
|
|
|
|
return msg_format % kwargs
|
|
|
|
|
|
class _KeystoneExceptionMeta(type):
|
|
"""Automatically Register the Exceptions in 'KEYSTONE_API_EXCEPTIONS' list.
|
|
|
|
The `KEYSTONE_API_EXCEPTIONS` list is utilized by flask to register a
|
|
handler to emit sane details when the exception occurs.
|
|
"""
|
|
|
|
def __new__(mcs, name, bases, class_dict):
|
|
"""Create a new instance and register with KEYSTONE_API_EXCEPTIONS."""
|
|
cls = type.__new__(mcs, name, bases, class_dict)
|
|
KEYSTONE_API_EXCEPTIONS.add(cls)
|
|
return cls
|
|
|
|
|
|
@six.add_metaclass(_KeystoneExceptionMeta)
|
|
class Error(Exception):
|
|
"""Base error class.
|
|
|
|
Child classes should define an HTTP status code, title, and a
|
|
message_format.
|
|
|
|
"""
|
|
|
|
code = None
|
|
title = None
|
|
message_format = None
|
|
|
|
def __init__(self, message=None, **kwargs):
|
|
try:
|
|
message = self._build_message(message, **kwargs)
|
|
except KeyError:
|
|
# if you see this warning in your logs, please raise a bug report
|
|
if _FATAL_EXCEPTION_FORMAT_ERRORS:
|
|
raise
|
|
else:
|
|
LOG.warning('missing exception kwargs (programmer error)')
|
|
message = self.message_format
|
|
|
|
super(Error, self).__init__(message)
|
|
|
|
def _build_message(self, message, **kwargs):
|
|
"""Build and returns an exception message.
|
|
|
|
:raises KeyError: given insufficient kwargs
|
|
|
|
"""
|
|
if message:
|
|
return message
|
|
return _format_with_unicode_kwargs(self.message_format, kwargs)
|
|
|
|
|
|
class ValidationError(Error):
|
|
message_format = _("Expecting to find %(attribute)s in %(target)s."
|
|
" The server could not comply with the request"
|
|
" since it is either malformed or otherwise"
|
|
" incorrect. The client is assumed to be in error.")
|
|
code = int(http_client.BAD_REQUEST)
|
|
title = http_client.responses[http_client.BAD_REQUEST]
|
|
|
|
|
|
class URLValidationError(ValidationError):
|
|
message_format = _("Cannot create an endpoint with an invalid URL:"
|
|
" %(url)s.")
|
|
|
|
|
|
class PasswordValidationError(ValidationError):
|
|
message_format = _("Password validation error: %(detail)s.")
|
|
|
|
|
|
class PasswordRequirementsValidationError(PasswordValidationError):
|
|
message_format = _("The password does not match the requirements:"
|
|
" %(detail)s.")
|
|
|
|
|
|
class PasswordHistoryValidationError(PasswordValidationError):
|
|
message_format = _("The new password cannot be identical to a "
|
|
"previous password. The total number which "
|
|
"includes the new password must be unique is "
|
|
"%(unique_count)s.")
|
|
|
|
|
|
class PasswordAgeValidationError(PasswordValidationError):
|
|
message_format = _("You cannot change your password at this time due "
|
|
"to the minimum password age. Once you change your "
|
|
"password, it must be used for %(min_age_days)d day(s) "
|
|
"before it can be changed. Please try again in "
|
|
"%(days_left)d day(s) or contact your administrator to "
|
|
"reset your password.")
|
|
|
|
|
|
class PasswordSelfServiceDisabled(PasswordValidationError):
|
|
message_format = _("You cannot change your password at this time due "
|
|
"to password policy disallowing password changes. "
|
|
"Please contact your administrator to reset your "
|
|
"password.")
|
|
|
|
|
|
class SchemaValidationError(ValidationError):
|
|
# NOTE(lbragstad): For whole OpenStack message consistency, this error
|
|
# message has been written in a format consistent with WSME.
|
|
message_format = _("%(detail)s")
|
|
|
|
|
|
class ValidationTimeStampError(Error):
|
|
message_format = _("Timestamp not in expected format."
|
|
" The server could not comply with the request"
|
|
" since it is either malformed or otherwise"
|
|
" incorrect. The client is assumed to be in error.")
|
|
code = int(http_client.BAD_REQUEST)
|
|
title = http_client.responses[http_client.BAD_REQUEST]
|
|
|
|
|
|
class InvalidOperatorError(ValidationError):
|
|
message_format = _("The given operator %(_op)s is not valid."
|
|
" It must be one of the following:"
|
|
" 'eq', 'neq', 'lt', 'lte', 'gt', or 'gte'.")
|
|
|
|
|
|
class ValidationExpirationError(Error):
|
|
message_format = _("The 'expires_at' must not be before now."
|
|
" The server could not comply with the request"
|
|
" since it is either malformed or otherwise"
|
|
" incorrect. The client is assumed to be in error.")
|
|
code = int(http_client.BAD_REQUEST)
|
|
title = http_client.responses[http_client.BAD_REQUEST]
|
|
|
|
|
|
class StringLengthExceeded(ValidationError):
|
|
message_format = _("String length exceeded. The length of"
|
|
" string '%(string)s' exceeds the limit"
|
|
" of column %(type)s(CHAR(%(length)d)).")
|
|
|
|
|
|
class AmbiguityError(ValidationError):
|
|
message_format = _("There are multiple %(resource)s entities named"
|
|
" '%(name)s'. Please use ID instead of names to"
|
|
" resolve the ambiguity.")
|
|
|
|
|
|
class ApplicationCredentialValidationError(ValidationError):
|
|
message_format = _("Invalid application credential: %(detail)s")
|
|
|
|
|
|
class CircularRegionHierarchyError(Error):
|
|
message_format = _("The specified parent region %(parent_region_id)s "
|
|
"would create a circular region hierarchy.")
|
|
code = int(http_client.BAD_REQUEST)
|
|
title = http_client.responses[http_client.BAD_REQUEST]
|
|
|
|
|
|
class ForbiddenNotSecurity(Error):
|
|
"""When you want to return a 403 Forbidden response but not security.
|
|
|
|
Use this for errors where the message is always safe to present to the user
|
|
and won't give away extra information.
|
|
|
|
"""
|
|
|
|
code = int(http_client.FORBIDDEN)
|
|
title = http_client.responses[http_client.FORBIDDEN]
|
|
|
|
|
|
class PasswordVerificationError(ForbiddenNotSecurity):
|
|
message_format = _("The password length must be less than or equal "
|
|
"to %(size)i. The server could not comply with the "
|
|
"request because the password is invalid.")
|
|
|
|
|
|
class RegionDeletionError(ForbiddenNotSecurity):
|
|
message_format = _("Unable to delete region %(region_id)s because it or "
|
|
"its child regions have associated endpoints.")
|
|
|
|
|
|
class ApplicationCredentialLimitExceeded(ForbiddenNotSecurity):
|
|
message_format = _("Unable to create additional application credentials, "
|
|
"maximum of %(limit)d already exceeded for user.")
|
|
|
|
|
|
class SecurityError(Error):
|
|
"""Security error exception.
|
|
|
|
Avoids exposing details of security errors, unless in insecure_debug mode.
|
|
|
|
"""
|
|
|
|
amendment = _('(Disable insecure_debug mode to suppress these details.)')
|
|
|
|
def __deepcopy__(self):
|
|
"""Override the default deepcopy.
|
|
|
|
Keystone :class:`keystone.exception.Error` accepts an optional message
|
|
that will be used when rendering the exception object as a string. If
|
|
not provided the object's message_format attribute is used instead.
|
|
:class:`keystone.exception.SecurityError` is a little different in
|
|
that it only uses the message provided to the initializer when
|
|
keystone is in `insecure_debug` mode. Instead it will use its
|
|
`message_format`. This is to ensure that sensitive details are not
|
|
leaked back to the caller in a production deployment.
|
|
|
|
This dual mode for string rendering causes some odd behaviour when
|
|
combined with oslo_i18n translation. Any object used as a value for
|
|
formatting a translated string is deep copied.
|
|
|
|
The copy causes an issue. The deep copy process actually creates a new
|
|
exception instance with the rendered string. Then when that new
|
|
instance is rendered as a string to use for substitution a warning is
|
|
logged. This is because the code tries to use the `message_format` in
|
|
secure mode, but the required kwargs are not in the deep copy.
|
|
|
|
The end result is not an error because when the KeyError is caught the
|
|
instance's ``message`` is used instead and this has the properly
|
|
translated message. The only indication that something is wonky is a
|
|
message in the warning log.
|
|
"""
|
|
return self
|
|
|
|
def _build_message(self, message, **kwargs):
|
|
"""Only returns detailed messages in insecure_debug mode."""
|
|
if message and CONF.insecure_debug:
|
|
if isinstance(message, six.string_types):
|
|
# Only do replacement if message is string. The message is
|
|
# sometimes a different exception or bytes, which would raise
|
|
# TypeError.
|
|
message = _format_with_unicode_kwargs(message, kwargs)
|
|
return _('%(message)s %(amendment)s') % {
|
|
'message': message,
|
|
'amendment': self.amendment}
|
|
|
|
return _format_with_unicode_kwargs(self.message_format, kwargs)
|
|
|
|
|
|
class Unauthorized(SecurityError):
|
|
message_format = _("The request you have made requires authentication.")
|
|
code = int(http_client.UNAUTHORIZED)
|
|
title = http_client.responses[http_client.UNAUTHORIZED]
|
|
|
|
|
|
class InsufficientAuthMethods(Error):
|
|
# NOTE(adriant): This is an internal only error that is built into
|
|
# an auth receipt response.
|
|
message_format = _("Insufficient auth methods received for %(user_id)s. "
|
|
"Auth Methods Provided: %(methods)s.")
|
|
code = 401
|
|
title = 'Unauthorized'
|
|
|
|
def __init__(self, message=None, user_id=None, methods=None):
|
|
methods_str = '[%s]' % ','.join(methods)
|
|
super(InsufficientAuthMethods, self).__init__(
|
|
message, user_id=user_id, methods=methods_str)
|
|
|
|
self.user_id = user_id
|
|
self.methods = methods
|
|
|
|
|
|
class ReceiptNotFound(Unauthorized):
|
|
message_format = _("Could not find auth receipt: %(receipt_id)s.")
|
|
|
|
|
|
class PasswordExpired(Unauthorized):
|
|
message_format = _("The password is expired and needs to be changed for "
|
|
"user: %(user_id)s.")
|
|
|
|
|
|
class AuthPluginException(Unauthorized):
|
|
message_format = _("Authentication plugin error.")
|
|
|
|
def __init__(self, *args, **kwargs):
|
|
super(AuthPluginException, self).__init__(*args, **kwargs)
|
|
self.authentication = {}
|
|
|
|
|
|
class UserDisabled(Unauthorized):
|
|
message_format = _("The account is disabled for user: %(user_id)s.")
|
|
|
|
|
|
class AccountLocked(Unauthorized):
|
|
message_format = _("The account is locked for user: %(user_id)s.")
|
|
|
|
|
|
class AuthMethodNotSupported(AuthPluginException):
|
|
message_format = _("Attempted to authenticate with an unsupported method.")
|
|
|
|
def __init__(self, *args, **kwargs):
|
|
super(AuthMethodNotSupported, self).__init__(*args, **kwargs)
|
|
self.authentication = {'methods': CONF.auth.methods}
|
|
|
|
|
|
class ApplicationCredentialAuthError(AuthPluginException):
|
|
message_format = _(
|
|
"Error authenticating with application credential: %(detail)s")
|
|
|
|
|
|
class AdditionalAuthRequired(AuthPluginException):
|
|
message_format = _("Additional authentications steps required.")
|
|
|
|
def __init__(self, auth_response=None, **kwargs):
|
|
super(AdditionalAuthRequired, self).__init__(message=None, **kwargs)
|
|
self.authentication = auth_response
|
|
|
|
|
|
class Forbidden(SecurityError):
|
|
message_format = _("You are not authorized to perform the"
|
|
" requested action.")
|
|
code = int(http_client.FORBIDDEN)
|
|
title = http_client.responses[http_client.FORBIDDEN]
|
|
|
|
|
|
class ForbiddenAction(Forbidden):
|
|
message_format = _("You are not authorized to perform the"
|
|
" requested action: %(action)s.")
|
|
|
|
|
|
class CrossBackendNotAllowed(Forbidden):
|
|
message_format = _("Group membership across backend boundaries is not "
|
|
"allowed. Group in question is %(group_id)s, "
|
|
"user is %(user_id)s.")
|
|
|
|
|
|
class InvalidPolicyAssociation(Forbidden):
|
|
message_format = _("Invalid mix of entities for policy association: "
|
|
"only Endpoint, Service, or Region+Service allowed. "
|
|
"Request was - Endpoint: %(endpoint_id)s, "
|
|
"Service: %(service_id)s, Region: %(region_id)s.")
|
|
|
|
|
|
class InvalidDomainConfig(Forbidden):
|
|
message_format = _("Invalid domain specific configuration: %(reason)s.")
|
|
|
|
|
|
class InvalidLimit(Forbidden):
|
|
message_format = _("Invalid resource limit: %(reason)s.")
|
|
|
|
|
|
class LimitTreeExceedError(Exception):
|
|
def __init__(self, project_id, max_limit_depth):
|
|
super(LimitTreeExceedError, self).__init__(_(
|
|
"Keystone cannot start due to project hierarchical depth in the "
|
|
"current deployment (project_ids: %(project_id)s) exceeds the "
|
|
"enforcement model's maximum limit of %(max_limit_depth)s. Please "
|
|
"use a different enforcement model to correct the issue."
|
|
) % {'project_id': project_id, 'max_limit_depth': max_limit_depth})
|
|
|
|
|
|
class NotFound(Error):
|
|
message_format = _("Could not find: %(target)s.")
|
|
code = int(http_client.NOT_FOUND)
|
|
title = http_client.responses[http_client.NOT_FOUND]
|
|
|
|
|
|
class EndpointNotFound(NotFound):
|
|
message_format = _("Could not find endpoint: %(endpoint_id)s.")
|
|
|
|
|
|
class PolicyNotFound(NotFound):
|
|
message_format = _("Could not find policy: %(policy_id)s.")
|
|
|
|
|
|
class PolicyAssociationNotFound(NotFound):
|
|
message_format = _("Could not find policy association.")
|
|
|
|
|
|
class RoleNotFound(NotFound):
|
|
message_format = _("Could not find role: %(role_id)s.")
|
|
|
|
|
|
class ImpliedRoleNotFound(NotFound):
|
|
message_format = _("%(prior_role_id)s does not imply %(implied_role_id)s.")
|
|
|
|
|
|
class InvalidImpliedRole(Forbidden):
|
|
message_format = _("%(role_id)s cannot be an implied roles.")
|
|
|
|
|
|
class DomainSpecificRoleMismatch(Forbidden):
|
|
message_format = _("Project %(project_id)s must be in the same domain "
|
|
"as the role %(role_id)s being assigned.")
|
|
|
|
|
|
class DomainSpecificRoleNotWithinIdPDomain(Forbidden):
|
|
message_format = _("role: %(role_name)s must be within the same domain as "
|
|
"the identity provider: %(identity_provider)s.")
|
|
|
|
|
|
class DomainIdInvalid(ValidationError):
|
|
message_format = _("Domain ID does not conform to required UUID format.")
|
|
|
|
|
|
class RoleAssignmentNotFound(NotFound):
|
|
message_format = _("Could not find role assignment with role: "
|
|
"%(role_id)s, user or group: %(actor_id)s, "
|
|
"project, domain, or system: %(target_id)s.")
|
|
|
|
|
|
class RegionNotFound(NotFound):
|
|
message_format = _("Could not find region: %(region_id)s.")
|
|
|
|
|
|
class ServiceNotFound(NotFound):
|
|
message_format = _("Could not find service: %(service_id)s.")
|
|
|
|
|
|
class DomainNotFound(NotFound):
|
|
message_format = _("Could not find domain: %(domain_id)s.")
|
|
|
|
|
|
class ProjectNotFound(NotFound):
|
|
message_format = _("Could not find project: %(project_id)s.")
|
|
|
|
|
|
class ProjectTagNotFound(NotFound):
|
|
message_format = _("Could not find project tag: %(project_tag)s.")
|
|
|
|
|
|
class TokenNotFound(NotFound):
|
|
message_format = _("Could not find token: %(token_id)s.")
|
|
|
|
|
|
class UserNotFound(NotFound):
|
|
message_format = _("Could not find user: %(user_id)s.")
|
|
|
|
|
|
class GroupNotFound(NotFound):
|
|
message_format = _("Could not find group: %(group_id)s.")
|
|
|
|
|
|
class MappingNotFound(NotFound):
|
|
message_format = _("Could not find mapping: %(mapping_id)s.")
|
|
|
|
|
|
class TrustNotFound(NotFound):
|
|
message_format = _("Could not find trust: %(trust_id)s.")
|
|
|
|
|
|
class TrustUseLimitReached(Forbidden):
|
|
message_format = _("No remaining uses for trust: %(trust_id)s.")
|
|
|
|
|
|
class CredentialNotFound(NotFound):
|
|
message_format = _("Could not find credential: %(credential_id)s.")
|
|
|
|
|
|
class VersionNotFound(NotFound):
|
|
message_format = _("Could not find version: %(version)s.")
|
|
|
|
|
|
class EndpointGroupNotFound(NotFound):
|
|
message_format = _("Could not find Endpoint Group: %(endpoint_group_id)s.")
|
|
|
|
|
|
class IdentityProviderNotFound(NotFound):
|
|
message_format = _("Could not find Identity Provider: %(idp_id)s.")
|
|
|
|
|
|
class ServiceProviderNotFound(NotFound):
|
|
message_format = _("Could not find Service Provider: %(sp_id)s.")
|
|
|
|
|
|
class FederatedProtocolNotFound(NotFound):
|
|
message_format = _("Could not find federated protocol %(protocol_id)s for"
|
|
" Identity Provider: %(idp_id)s.")
|
|
|
|
|
|
class PublicIDNotFound(NotFound):
|
|
# This is used internally and mapped to either User/GroupNotFound or,
|
|
# Assertion before the exception leaves Keystone.
|
|
message_format = "%(id)s"
|
|
|
|
|
|
class RegisteredLimitNotFound(NotFound):
|
|
message_format = _("Could not find registered limit for %(id)s.")
|
|
|
|
|
|
class LimitNotFound(NotFound):
|
|
message_format = _("Could not find limit for %(id)s.")
|
|
|
|
|
|
class NoLimitReference(Forbidden):
|
|
message_format = _("Unable to create a limit that has no corresponding "
|
|
"registered limit.")
|
|
|
|
|
|
class RegisteredLimitError(ForbiddenNotSecurity):
|
|
message_format = _("Unable to update or delete registered limit %(id)s "
|
|
"because there are project limits associated with it.")
|
|
|
|
|
|
class DomainConfigNotFound(NotFound):
|
|
message_format = _('Could not find %(group_or_option)s in domain '
|
|
'configuration for domain %(domain_id)s.')
|
|
|
|
|
|
class ConfigRegistrationNotFound(Exception):
|
|
# This is used internally between the domain config backend and the
|
|
# manager, so should not escape to the client. If it did, it is a coding
|
|
# error on our part, and would end up, appropriately, as a 500 error.
|
|
pass
|
|
|
|
|
|
class ApplicationCredentialNotFound(NotFound):
|
|
message_format = _("Could not find Application Credential: "
|
|
"%(application_credential_id)s.")
|
|
|
|
|
|
class AccessRuleNotFound(NotFound):
|
|
message_format = _("Could not find Access Rule: %(access_rule_id)s.")
|
|
|
|
|
|
class Conflict(Error):
|
|
message_format = _("Conflict occurred attempting to store %(type)s -"
|
|
" %(details)s.")
|
|
code = int(http_client.CONFLICT)
|
|
title = http_client.responses[http_client.CONFLICT]
|
|
|
|
|
|
class UnexpectedError(SecurityError):
|
|
"""Avoids exposing details of failures, unless in insecure_debug mode."""
|
|
|
|
message_format = _("An unexpected error prevented the server "
|
|
"from fulfilling your request.")
|
|
|
|
debug_message_format = _("An unexpected error prevented the server "
|
|
"from fulfilling your request: %(exception)s.")
|
|
|
|
def _build_message(self, message, **kwargs):
|
|
|
|
# Ensure that exception has a value to be extra defensive for
|
|
# substitutions and make sure the exception doesn't raise an
|
|
# exception.
|
|
kwargs.setdefault('exception', '')
|
|
|
|
return super(UnexpectedError, self)._build_message(
|
|
message or self.debug_message_format, **kwargs)
|
|
|
|
code = int(http_client.INTERNAL_SERVER_ERROR)
|
|
title = http_client.responses[http_client.INTERNAL_SERVER_ERROR]
|
|
|
|
|
|
class TrustConsumeMaximumAttempt(UnexpectedError):
|
|
debug_message_format = _("Unable to consume trust %(trust_id)s. Unable to "
|
|
"acquire lock.")
|
|
|
|
|
|
class MalformedEndpoint(UnexpectedError):
|
|
debug_message_format = _("Malformed endpoint URL (%(endpoint)s),"
|
|
" see ERROR log for details.")
|
|
|
|
|
|
class MappedGroupNotFound(UnexpectedError):
|
|
debug_message_format = _("Group %(group_id)s returned by mapping "
|
|
"%(mapping_id)s was not found in the backend.")
|
|
|
|
|
|
class MetadataFileError(UnexpectedError):
|
|
debug_message_format = _("Error while reading metadata file: %(reason)s.")
|
|
|
|
|
|
class DirectMappingError(UnexpectedError):
|
|
debug_message_format = _("Local section in mapping %(mapping_id)s refers "
|
|
"to a remote match that doesn't exist "
|
|
"(e.g. {0} in a local section).")
|
|
|
|
|
|
class AssignmentTypeCalculationError(UnexpectedError):
|
|
debug_message_format = _(
|
|
'Unexpected combination of grant attributes - '
|
|
'User: %(user_id)s, Group: %(group_id)s, Project: %(project_id)s, '
|
|
'Domain: %(domain_id)s.')
|
|
|
|
|
|
class NotImplemented(Error):
|
|
message_format = _("The action you have requested has not"
|
|
" been implemented.")
|
|
code = int(http_client.NOT_IMPLEMENTED)
|
|
title = http_client.responses[http_client.NOT_IMPLEMENTED]
|
|
|
|
|
|
class Gone(Error):
|
|
message_format = _("The service you have requested is no"
|
|
" longer available on this server.")
|
|
code = int(http_client.GONE)
|
|
title = http_client.responses[http_client.GONE]
|
|
|
|
|
|
class ConfigFileNotFound(UnexpectedError):
|
|
debug_message_format = _("The Keystone configuration file %(config_file)s "
|
|
"could not be found.")
|
|
|
|
|
|
class KeysNotFound(UnexpectedError):
|
|
debug_message_format = _('No encryption keys found; run keystone-manage '
|
|
'fernet_setup to bootstrap one.')
|
|
|
|
|
|
class MultipleSQLDriversInConfig(UnexpectedError):
|
|
debug_message_format = _('The Keystone domain-specific configuration has '
|
|
'specified more than one SQL driver (only one is '
|
|
'permitted): %(source)s.')
|
|
|
|
|
|
class MigrationNotProvided(Exception):
|
|
def __init__(self, mod_name, path):
|
|
super(MigrationNotProvided, self).__init__(_(
|
|
"%(mod_name)s doesn't provide database migrations. The migration"
|
|
" repository path at %(path)s doesn't exist or isn't a directory."
|
|
) % {'mod_name': mod_name, 'path': path})
|
|
|
|
|
|
class UnsupportedTokenVersionException(UnexpectedError):
|
|
debug_message_format = _('Token version is unrecognizable or '
|
|
'unsupported.')
|
|
|
|
|
|
class SAMLSigningError(UnexpectedError):
|
|
debug_message_format = _('Unable to sign SAML assertion. It is likely '
|
|
'that this server does not have xmlsec1 '
|
|
'installed or this is the result of '
|
|
'misconfiguration. Reason %(reason)s.')
|
|
|
|
|
|
class OAuthHeadersMissingError(UnexpectedError):
|
|
debug_message_format = _('No Authorization headers found, cannot proceed '
|
|
'with OAuth related calls. If running under '
|
|
'HTTPd or Apache, ensure WSGIPassAuthorization '
|
|
'is set to On.')
|
|
|
|
|
|
class TokenlessAuthConfigError(ValidationError):
|
|
message_format = _('Could not determine Identity Provider ID. The '
|
|
'configuration option %(issuer_attribute)s '
|
|
'was not found in the request environment.')
|
|
|
|
|
|
class CredentialEncryptionError(Exception):
|
|
message_format = _("An unexpected error prevented the server "
|
|
"from accessing encrypted credentials.")
|
|
|
|
|
|
class LDAPServerConnectionError(UnexpectedError):
|
|
debug_message_format = _('Unable to establish a connection to '
|
|
'LDAP Server (%(url)s).')
|
|
|
|
|
|
class LDAPInvalidCredentialsError(UnexpectedError):
|
|
message_format = _('Unable to authenticate against Identity backend - '
|
|
'Invalid username or password')
|
|
|
|
|
|
class LDAPSizeLimitExceeded(UnexpectedError):
|
|
message_format = _('Number of User/Group entities returned by LDAP '
|
|
'exceeded size limit. Contact your LDAP '
|
|
'administrator.')
|
|
|
|
|
|
class CacheDeserializationError(Exception):
|
|
|
|
def __init__(self, obj, data):
|
|
super(CacheDeserializationError, self).__init__(
|
|
_('Failed to deserialize %(obj)s. Data is %(data)s') % {
|
|
'obj': obj, 'data': data
|
|
}
|
|
)
|
|
|
|
|
|
class ResourceUpdateForbidden(ForbiddenNotSecurity):
|
|
message_format = _('Unable to update immutable %(type)s resource: '
|
|
'`%(resource_id)s. Set resource option "immutable" '
|
|
'to false first.')
|
|
|
|
|
|
class ResourceDeleteForbidden(ForbiddenNotSecurity):
|
|
message_format = _('Unable to delete immutable %(type)s resource: '
|
|
'`%(resource_id)s. Set resource option "immutable" '
|
|
'to false first.')
|