openstacksdk/openstack/auth/identity/v2.py

# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.

"""
Identity v2 authorization plugins.  The plugin must be constructed with an
auhorization URL and a user id, user name or token.  A user id or user name
would also require a password. For example::

    from openstack.auth.identity import v2
    from openstack import transport

    args = {
        'password': 'openSesame',
        'auth_url': 'https://10.1.1.1:5000/v2.0/',
        'user_name': 'alibaba',
    }
    auth = v2.Auth(**args)
    xport = transport.Transport()
    accessInfo = auth.authorize(xport)
"""

import abc
import logging

import six

from openstack.auth import access
from openstack.auth.identity import base
from openstack import exceptions

_logger = logging.getLogger(__name__)


@six.add_metaclass(abc.ABCMeta)
class Auth(base.BaseIdentityPlugin):

    def __init__(self, auth_url,
                 trust_id=None,
                 project_id=None,
                 project_name=None,
                 tenant_id=None,
                 tenant_name=None,
                 reauthenticate=True):
        """Construct an Identity V2 Authentication Plugin.

        :param string auth_url: Identity service endpoint for authorization.
        :param string trust_id: Trust ID for trust scoping.
        :param string project_id: Project ID for scoping.
        :param string project_name: Project name for scoping.
        :param string tenant_id: Tenant ID for project scoping.
        :param string tenant_name: Tenant name for project scoping.
        :param bool reauthenticate: Allow fetching a new token if the current
                                    one is going to expire.
                                    (optional) default True
        """
        super(Auth, self).__init__(auth_url=auth_url,
                                   reauthenticate=reauthenticate)

        self.trust_id = trust_id
        self.tenant_id = project_id
        if not self.tenant_id:
            self.tenant_id = tenant_id
        self.tenant_name = project_name
        if not self.tenant_name:
            self.tenant_name = tenant_name

    def authorize(self, transport, **kwargs):
        """Obtain access information from an OpenStack Identity Service."""
        headers = {'Accept': 'application/json'}
        url = self.auth_url.rstrip('/') + '/tokens'
        params = {'auth': self.get_auth_data(headers)}

        if self.tenant_id:
            params['auth']['tenantId'] = self.tenant_id
        elif self.tenant_name:
            params['auth']['tenantName'] = self.tenant_name
        if self.trust_id:
            params['auth']['trust_id'] = self.trust_id

        _logger.debug('Making authentication request to %s', url)
        resp = transport.post(url, json=params, headers=headers)

        try:
            resp_data = resp.json()['access']
        except (KeyError, ValueError):
            raise exceptions.InvalidResponse(response=resp)

        return access.AccessInfoV2(**resp_data)

    @abc.abstractmethod
    def get_auth_data(self, headers=None):
        """Return the authentication section of an auth plugin.

        :param dict headers: The headers that will be sent with the auth
                             request if a plugin needs to add to them.
        :return dict: A dict of authentication data for the auth type.
        """


class Password(Auth):

    #: Valid options for Password plugin
    valid_options = [
        'access_info',
        'auth_url',
        'user_name',
        'user_id',
        'password',
        'project_id',
        'project_name',
        'reauthenticate',
        'trust_id',
    ]

    def __init__(self, auth_url, user_name=None, password=None, user_id=None,
                 **kwargs):
        """A plugin for authenticating with a user_name and password.

        A user_name or user_id must be provided.

        :param string auth_url: Identity service endpoint for authorization.
        :param string user_name: Username for authentication.
        :param string password: Password for authentication.
        :param string user_id: User ID for authentication.

        :raises TypeError: if a user_id or user_name is not provided.
        """
        super(Password, self).__init__(auth_url, **kwargs)

        if not (user_id or user_name):
            msg = 'You need to specify either a user_name or user_id'
            raise TypeError(msg)

        self.user_id = user_id
        self.user_name = user_name
        self.password = password

    def get_auth_data(self, headers=None):
        auth = {'password': self.password}

        if self.user_name:
            auth['username'] = self.user_name
        elif self.user_id:
            auth['userId'] = self.user_id

        return {'passwordCredentials': auth}


class Token(Auth):

    #: Valid options for this plugin
    valid_options = [
        'access_info',
        'auth_url',
        'project_id',
        'project_name',
        'reauthenticate',
        'token',
        'trust_id',
    ]

    def __init__(self, auth_url, token, **kwargs):
        """A plugin for authenticating with an existing token.

        :param string auth_url: Identity service endpoint for authorization.
        :param string token: Existing token for authentication.
        """
        super(Token, self).__init__(auth_url, **kwargs)
        self.token = token

    def get_auth_data(self, headers=None):
        if headers is not None:
            headers['X-Auth-Token'] = self.token
        return {'token': {'id': self.token}}