Similar delete commands in OSC, we can also support add/remove
multi users for one specified group, this review implement it.
Change-Id: I8ccf99d4ee83a18778fa3ff5c0a42bc7c6ff21fb
Implements: bp support-multi-add-remove
Due to a default Keystone policy until Newtown,
and the use of resource_find, non-admins are unable
to list their own projects.
This patch bypasses this problem while also introducing better
UX for non-admins wishing to get their project list.
'openstack project list' retains the default of 'list all projects'
but on a forbidden error will default instead to 'list my projects'.
This way for non-admins 'list my projects' feels like the default
without breaking the expected admin default.
Adding the '--my-projects' option allows admins to easily list their
own projects or allows non-admins to be explicit and bypass the
forbidden error fallback.
Change-Id: I1021276f69fbbf28e13e17c4e567d932fce7ed8b
Closes-Bug: #1627555
When checking whether a given user is in a given group, keystone will
return a 404 Not Found if all went well but the user was not in the
group. It may also return a 403 if the user and the group are in
different backends, which would also mean that the user was not in the
group[1]. Any other 400 response is a client error and any 500 response
is a server error to which the user should be alerted.
Without this patch, openstackclient treats any exception as a valid "not
found" and may end up hiding server errors. This patch reduces the
caught exceptions to 403 and 404 responses and treats everything else as
an error.
[1] https://developer.openstack.org/api-ref/identity/v3/?expanded=check-whether-user-belongs-to-group-detail#check-whether-user-belongs-to-group
Closes-bug: #1672634
Change-Id: Id3f3b2409b7cee480ee3c19b6d6c3070599ffe8f
Add sort support to project list by sorting items in the client side.
By default list will be sorted by name.
Change-Id: I00011406846b4003aff075eeeb88ac18fa5e2820
Closes-Bug: #1596818
OSC support to filter OpenStack endpoints by service type, name and ID,
but help message and document don't contain "type" for "--service"
option of "endpoint list" command.
Change-Id: I5c8bc28e037b4c6f96ec83525a319353f01f256a
Closes-Bug: #1666841
if command failed, we usually raise exception,
if command success, sometimes there is not any
output (such as set, add commands)
So modify the error handling for role and group
commands.
Change-Id: I1c0f86c04dcedd9c0d725fd73f3436be9da75ee0
Options "--parents" and "--children" don't work in "project show"
command, fix the issue and add related unit and functional tests.
Change-Id: Id9965267a037442f1077f8e1929d0527981f643d
Closes-Bug: #1499657
This patch adds the ability to specify the domain context for making
changes to a user with `--domain` flag.
Example:
$ openstack user set test_user --domain test_domain --enable
Change-Id: I2b3241785c22e72e19181394acff650422299b0e
Closes-Bug: #1658147
Without this patch, the command 'openstack mapping set <args>' will,
upon success, print the rules for the updated mapping and exit with
return code 1 (failure). This is a problem for scripts and config
management tools that depend on the return code to validate whether the
operation was successful, since even upon success the command returns a
failing error code. Moreover, the behavior of printing the new value is
completely unlike the behavior of any of the 'set' subcommands for
other entities. This patch normalizes the 'mapping set' command by
omitting any return value in the SetMapping take_action() method. This
way the client will only exit with an error code if an exception is
raised, and not upon normal operation.
Change-Id: I610ec3b2fa7561072346d46e49cfc1ae82130e0d
Currently, creating trust requires permission to list roles, but
non-admin users don't have permission to do that by default. This
commit adds exception handling on listing roles, and continue to
create trust if server returns 403.
Closes-Bug: #1658582
Change-Id: I4f016b76cb46ae07ef65ed54780881bbcd6210d3
Add missing multi deletion error handling for
identity delete commands.
All delete commands in identity support
error handling now.
Change-Id: I05626dcb5e516a423d610906347b02236ba7eeaf
The auth_with_unscoped_saml decorator existed to make sure the user
selected the right auth plugin before trying to call either a
'federation domain' or 'federation project' command. This is outdated,
because openstackclient now uses keystoneauth[1] and keystoneauth
removed its entrypoints for the federation plugins[2] since its
_Rescoped class no longer needs them. This patch removes the decorator
since that validation check was the only thing standing in the way of
the commands working correctly. Also removed the '*_list_wrong_auth'
tests since those only existed to test the decorator, and stopped
setting the plugin in the positive tests since the
automatically-determined token plugin should now be fine.
[1] http://git.openstack.org/cgit/openstack/python-openstackclient/commit/?id=6ae0d2e8a54fd5139e63a990ab4bdce634e73c5e
[2] http://git.openstack.org/cgit/openstack/keystoneauth/commit/?id=d9e4d26bb86f8d48e43188b88bab9d7fe778d2c1
Change-Id: Id981739663113447a7bba8ddba81ba9394a19e07
Closes-bug: #1624115
Leverage the new cliff command class attribute (_description)
to get the help of a command, this allows us to mark strings
for translation. We could not do this before since the help
was grabbed from the docstring.
This also depends on a new release of cliff and a bump to the
minimum level in osc's requirements.
Closes-Bug: 1636209
Depends-On: Id915f6aa7d95a0ff3dc6e2ceaac5decb3f3bf0da
Change-Id: I8673080bb5625e8e3c499feaefd42dfc7121e96f
When output to shell, the token issue time is fine; however when
selecting the json formatter (via the --format json) option, an
exception is raised when formatting the dataetime data.
Rather than pass in the datetime data, we should format the data
with the ISO 8601 formatting.
Closes-Bug: 1619937
Change-Id: Iffebb2d5413fabfd283dfa94fc560fc37270f9dd
Fix argument precedence hack
Working around issues in os-client-config <= 1.18.0
This is ugly because the issues in o-c-c 1.19.1 run even deeper
than in 1.18.0, so we're going to use 1.19.0 get_one_cloud() that
is known to work for OSC and fix o-c-c with an axe.
Remove return values for set commands
'identity provider set' and 'service provider set' were still
returning their show-like data, this is a fail for set commands
now, don't know how this ever passed before...
Constraints are ready to be used for tox.ini
Per email[1] from Andreas, we don't need to hack at install_command
any longer.
[1] http://openstack.markmail.org/thread/a4l7tokbotwqvuoh
Co-authorioed-by: Steve Martinelli <s.martinelli@gmail.com>
Depends-On: I49313dc7d4f44ec897de7a375f25b7ed864226f1
Change-Id: I426548376fc7d3cdb36501310dafd8c44d22ae30
Convert to using ClientManager and OpenStackShell from osc-lib.
* Change all internal uses of ClientManager private attributes that are
now public in osc-lib's ClientManager. Leave back-compat copies in
place in OSC's clientManager so we don't break plugins.
* Put some work-arounds in place for changes in osc-lib that we need until
a new release makes it through the g-r and u-c change process.
* Add a test for Unicode decoding of argv in shell.main() to parallel
the one in osc-lib.
Change-Id: I85289740d4ca081f2aca8c9b40ec422ad25d302c
The current identity role list command (both v2 and v3) is
overloaded with listing roles as well as assignments (if you
provide user, group, project or domain options). This is in
addition to the v3 assignment list command designed for this
purpose.
This overloading complicates the fact that roles can now be
domain specific (i.e. have a domain attribute), so the
command 'role list --domain <domain-name' will soon become
ambigious (this is in a follow on patch).
This patch:
- Adds a v2 assignments list, with support for pulling the
user and project from the auth credentials
- For comapability, adds the same auth support to the
existing v3 assignments list
- Deprecates the use of role list and user role list to list
assignments
Change-Id: I65bafdef4f8c89e863dab101369d0d629fa818b8
Partial-Bug: 1605774
if there are more than one services be found with one
name, a NoUniqueMatch exception should be raised but
we can see a NotFound Exception raised instead. It is
because in "find_service()", we use "find_resource()"
first, if "find_resource()" return a exception, we just
think it is a NotFound Exception and continue to find
by type but ignore a NoUniqueMatch exception of
"find_resource()". This patch refactor the "find_service()"
method to solve this problem.
Change-Id: Id4619092c57f276ae0698c89df0d5503b7423a4e
Co-Authored-By: Huanxuan Ao <huanxuan.ao@easystack.cn>
Closes-Bug:#1597296
Support bulk deletion for delete commands in the list below
identity/v3/consumer
identity/v3/credential
identity/v3/domain
identity/v3/ec2creds
identity/v3/endpoint
identity/v3/federation_protocol
identity/v3/identity_provider
identity/v3/mapping
identity/v3/policy
identity/v3/region
identity/v3/service_provider
identity/v3/service
The unit test in identityv3 need to be refactored, so I add
some functional tests instead. I will add all unit tests at
one time after the refactor completed.
Change-Id: I82367570f59817b47c87b6c7bfeae95ccfe5c50e
Closes-Bug: #1592906
Usually we use "(s)" to show about multi deletion in
help message. In addition, I think "EC2 credentials"
is better than "EC2 keys" in the error message.
Change-Id: I6a6461291542701d87a55d9ea0ea1fda6db04601
When an exception was caught and rethrown,
it should call 'raise' without any arguments
because it shows the place where an exception
occured initially instead of place where the exception re-raised.
Change-Id: I5fb6dea5da7fb6e1e2b339a713c7d37f8c99e407
Commands are "ec2 credentials delete", "service delete", "endpoint delete".
Also update their unit tests and functional tests.
Partial-Bug: #1592906
Change-Id: I1a0b7160b803a523646d09d030e6f112c81c4c24
Currently a user is allowed to specify either a resource ID or name
when running openstack identity comands. In some cases, when a name
is specified instead of an ID, the command will return as not able
to find the resource when it in fact does exist.
The changes here are to check the client against the token on such
requests and to extract the ID of the resource specified if enough
information exists between the two. We then use the ID associated
with the resource to complete the user requests.
Change-Id: I40713b0ded42063b786dc21247e854224b9d2fe2
Closes-Bug: #1561599
Use file logger for all command specific logs.
This patch also fixes some usage that doesn't
follow rules in:
http://docs.openstack.org/developer/oslo.i18n/guidelines.html
After this patch, all self.log and self.app.log
will be standardized to LOG().
NOTE: In shell.py, we got the log in class OpenStackShell,
which is also known as self.app.log in other classes.
This logger is used to record non-command-specific logs.
So we leave it as-is.
Change-Id: I114f73ee6c7e84593d71e724bc1ad00d343c1896
Implements: blueprint log-usage
