6706a9e814
The indentation for setting up the authorization context for oauth1 was not indented properly, meaning it would set oauth1 variables regardless of oauth1 being used as an authentication method. This commit fixes the intendation and adds two comments to improve readability. Co-Authored-By: Steve Martinelli <stevemar@ca.ibm.com> Change-Id: I29aeaf4f97f85bbfbf33a7114b328cebc52d6479
112 lines
4.5 KiB
Python
112 lines
4.5 KiB
Python
# Copyright 2012 OpenStack Foundation
|
|
# Copyright 2010 United States Government as represented by the
|
|
# Administrator of the National Aeronautics and Space Administration.
|
|
# Copyright 2011 - 2012 Justin Santa Barbara
|
|
# All Rights Reserved.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
# not use this file except in compliance with the License. You may obtain
|
|
# a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
# License for the specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
from oslo_log import log
|
|
|
|
from keystone import exception
|
|
from keystone.i18n import _, _LW
|
|
from keystone.models import token_model
|
|
|
|
|
|
AUTH_CONTEXT_ENV = 'KEYSTONE_AUTH_CONTEXT'
|
|
"""Environment variable used to convey the Keystone auth context.
|
|
|
|
Auth context is essentially the user credential used for policy enforcement.
|
|
It is a dictionary with the following attributes:
|
|
|
|
* ``token``: Token from the request
|
|
* ``user_id``: user ID of the principal
|
|
* ``user_domain_id`` (optional): Domain ID of the principal if the principal
|
|
has a domain.
|
|
* ``project_id`` (optional): project ID of the scoped project if auth is
|
|
project-scoped
|
|
* ``project_domain_id`` (optional): Domain ID of the scoped project if auth is
|
|
project-scoped.
|
|
* ``domain_id`` (optional): domain ID of the scoped domain if auth is
|
|
domain-scoped
|
|
* ``domain_name`` (optional): domain name of the scoped domain if auth is
|
|
domain-scoped
|
|
* ``is_delegated_auth``: True if this is delegated (via trust or oauth)
|
|
* ``trust_id``: Trust ID if trust-scoped, or None
|
|
* ``trustor_id``: Trustor ID if trust-scoped, or None
|
|
* ``trustee_id``: Trustee ID if trust-scoped, or None
|
|
* ``consumer_id``: OAuth consumer ID, or None
|
|
* ``access_token_id``: OAuth access token ID, or None
|
|
* ``roles`` (optional): list of role names for the given scope
|
|
* ``group_ids`` (optional): list of group IDs for which the API user has
|
|
membership if token was for a federated user
|
|
|
|
"""
|
|
|
|
LOG = log.getLogger(__name__)
|
|
|
|
|
|
def token_to_auth_context(token):
|
|
if not isinstance(token, token_model.KeystoneToken):
|
|
raise exception.UnexpectedError(_('token reference must be a '
|
|
'KeystoneToken type, got: %s') %
|
|
type(token))
|
|
auth_context = {'token': token,
|
|
'is_delegated_auth': False}
|
|
try:
|
|
auth_context['user_id'] = token.user_id
|
|
except KeyError:
|
|
LOG.warning(_LW('RBAC: Invalid user data in token'))
|
|
raise exception.Unauthorized()
|
|
auth_context['user_domain_id'] = token.user_domain_id
|
|
|
|
if token.project_scoped:
|
|
auth_context['project_id'] = token.project_id
|
|
auth_context['project_domain_id'] = token.project_domain_id
|
|
elif token.domain_scoped:
|
|
auth_context['domain_id'] = token.domain_id
|
|
auth_context['domain_name'] = token.domain_name
|
|
else:
|
|
LOG.debug('RBAC: Proceeding without project or domain scope')
|
|
|
|
if token.trust_scoped:
|
|
auth_context['is_delegated_auth'] = True
|
|
auth_context['trust_id'] = token.trust_id
|
|
auth_context['trustor_id'] = token.trustor_user_id
|
|
auth_context['trustee_id'] = token.trustee_user_id
|
|
else:
|
|
# NOTE(lbragstad): These variables will already be set to None but we
|
|
# add the else statement here for readability.
|
|
auth_context['trust_id'] = None
|
|
auth_context['trustor_id'] = None
|
|
auth_context['trustee_id'] = None
|
|
|
|
roles = token.role_names
|
|
if roles:
|
|
auth_context['roles'] = roles
|
|
|
|
if token.oauth_scoped:
|
|
auth_context['is_delegated_auth'] = True
|
|
auth_context['consumer_id'] = token.oauth_consumer_id
|
|
auth_context['access_token_id'] = token.oauth_access_token_id
|
|
else:
|
|
# NOTE(lbragstad): These variables will already be set to None but we
|
|
# add the else statement here for readability.
|
|
auth_context['consumer_id'] = None
|
|
auth_context['access_token_id'] = None
|
|
|
|
if token.is_federated_user:
|
|
auth_context['group_ids'] = token.federation_group_ids
|
|
|
|
return auth_context
|