The current scheme of having auth plugins only able to specify the
X-Auth-Token header via the get_token function is too limited for all
plugins. We need to allow both the case where the plugin wants to
control additional headers, or doesn't set the X-Auth-Token header at
all.
This deprecates the get_token interface in favour of the get_headers
interface. Whilst we should promote using get_headers it is likely that
plugins that only require setting the X-Auth-Token header will continue
to only support the get_token interface.
Change-Id: Ibd750d72acc3ba4fd8a880cad69173248ec4092f
blueprint: generic-plugins
If you want to handle a NoMatchingPlugin exception rather than simply
exit then the name of the missing plugin is generally more useful than
the message.
The exception is specific enough that you can know what went wrong, but
you cannot determine the name of the missing plugin if you want to do
your own logging - only use the message that is generated.
We should keep the message but expose the plugin name as well.
Closes-Bug: #1410391
Change-Id: Ic93ec6583b8d7797529d36d63995ef0d8db754f1
The oslo.config libraries are moving away from oslo-namespaced
packages.
Note that his requires oslo.config>=1.6.0
bp drop-namespace-packages
Change-Id: Ic0d4053875da0628f2359c109f2779d12aadc3eb
This would ideally not be required however when building certain URLs
the current user_id is needed. And when communicating with certain
services we need to have access to the current project id. It seems
better to allow plugins to give up the information if they have it than
do various hacks to try and get it from them.
Change-Id: Ib61b0628702806268be623a9987a922a60b04165
Closes-Bug: #1364724
Correct the type signature of some API documentation. Add inter-sphinx
mapping to documentation to provide links to external docs. Correct some
phrases and errors.
Change-Id: Id4a71a9901e5adc695afed656e3bc84e4e54e67a
The way the argparse options were being structured, if there was a
default value set on the option it would use this value as the default
and not check the environment variables.
This is wrong, we expect the environment variables to be used and the
default value to be the final fallback.
Change-Id: Ifbd68c9de329c2e0c70824ba873caa579e8e86d0
Closes-Bug: #1388076
Keystoneclient didn't provide translated messages. With this
change, the messages are marked for translation.
DocImpact
Implements: blueprint keystoneclient-i18n
Change-Id: I85263a71671a1dffed524185266e6bb7ae559630
The argument to the :raises: directive is the class name. If the
class name is a valid reference it's rendered as a link to the
class. This change cleans up the :raises: directives to use the
reference correctly and use a valid class reference.
Change-Id: I84188b60de0ab4c6b5b2fb5a203c43bfde094707
The :returns: directive doesn't take an argument. To specify the
return type, use the :rtype: directive.
Change-Id: I3aaab824792333b3f75a10af92f5b712cc9b4ff6
Deprecated opts are supposed to be accessible via the CLI in a similar
way as they are available via CONF. Currently these values are ignored.
Add CLI flags for all the deprecated opts as well.
Change-Id: If5f23c7b30a0cacda893a5e3150bc6bdb95f3693
If the auth plugin saves into the normal namespace like .user_id and
user_id is an argument of the command then the two argument collide with
each other.
This is fairly common, particularly in keystoneclient's shell.
There is a little bit of a compatibility concern in that the variables
on the returned namespace have changed, however the usage of this
function should be if you use register_argparse_arguments you should
also use load_from_argparse_arguments and that is not changed.
Change-Id: Id1cb0983a1e78661492acd78ad9aa67ff8d49250
Split the functions that load the auth plugins from CLI so that they can
be used on a specific plugin. The intention here is to be able to turn
the existing authentication options in shells into a new auth plugin and
have that be loadable rather than maintain separate paths through the
shells.
Change-Id: I3dd5a8ed183d843246b1add3dfbf591ba4e2f94c
There are certain requests that will always want to be sent to the
auth_url.
Add a new interface type to the get_endpoint command of the base
identity plugin such that if you ask for the 'auth' interface it will
give you the auth_url.
Implements: blueprint session-auth-endpoint
Change-Id: If653970354b919fdd6e80c061611c3aad129c574
Provide a pattern for auth plugins to load themselves from a config
object. The first user of this will be auth_token middleware however it
is not likely to be the only user.
By doing this in an exportable way we are defining a single config file
format for specifying how to load a plugin for all services. We also
provide a standard way of retrieving a plugins options for loading via
other mechanisms.
Blueprint: standard-client-params
Change-Id: I353b26a1ffc04a20666e76f5bd2f1e6d7c19a22d
Fixed most of the errors reported back from hacking 0.9.2.
Specifically:
- E128 continuation line under-indented for visual indent
- E251 unexpected spaces around keyword / parameter equals
- E265 block comment should start with '# '
- H305 imports not grouped correctly
- H307 like imports should be grouped together
- H402 one line docstring needs punctuation
- H904 Wrap long lines in parentheses instead of a backslash
But opted to ignore the following for now:
- E122: continuation line missing indentation or outdented
- H405: multi line docstring summary not separated with an empty line
Change-Id: Ib8e698d85fd598fa91435538657361a1f695ce89
The catalog was recently enhanced to allow filtering based on the
service_name so this should be passed on to endpoint filtering.
Change-Id: If08fcdba9719f6aacdcbbb6b951117f4f544f9ca
To allow session to re-fetch a token on an Unauthorized call we add an
invalidate method to auth plugins that is expected to flush all the
current authentication data from the plugin such that it will be
refreshed on next request.
This is then used to reissue requests from session when an Unauthorized
is called.
Change-Id: I98fa76fd67e97dc0a8c1ec0bf734792c337b5177
blueprint: keystoneclient-auth-token
In the future clients will simply pass the service they expect to talk
to and the path. This will prevent every service trying to get their own
base urls from the service catalog individually.
This can later be extended to have the auth plugin actually contact the
URL from the service catalog which will let us have unversioned
endpoints in the catalog handled from a single location.
Change-Id: I80f0b5b1dbb45565fec09d1cb2c0552cfb9a72f5
blueprint: auth-plugin-endpoints
We don't need vim modelines in each source file, it can be set in
user's vimrc.
Change-Id: Ic7a61430a0a320ce6b0c4518d9f5d988e35f8aae
Closes-Bug: #1229324
Provides the framework for creating authentication plugins and using
them from a session object.
To allow this system to co-exist with the original client there is a bit
of a hack. The client object itself is now also an authentication
plugin, that supports the original client pattern. If a client is
created without a session object then that session object uses the
client as it's authentication plugin.
Change-Id: I682c8dcd3705148aaa804a91f4ed48a5b74bdc12
blueprint: auth-plugins
