User's don't know what a plugin is.
* Internally, os_auth_type and/or auth_type represents what the
user supplied.
* auth_plugin_name is the name of the selected plugin
* auth_plugin is the actual plugin object
Plugin selection process:
* if --os-auth-type is supplied:
* if it matches against an available plugin, done
* (if it can map to an availble plugin type, done; TODO in a followup)
* if --os-auth-type is not supplied:
* if --os-url and --os-token are supplied, select 'token_endpoint'
* if --os-username supplied, select identity_api_version + 'password'
* if --os-token supplied, select identity_api_version + 'token'
Change-Id: Ice4535214e311ebf924087cf77f6d84d76f5f3ee
Anything that needs a service catalog can get it directly from
auth_ref.service_catalog, no need to carry the extra attribute.
ClientManager.get_endpoint_for_service_type() reamins the proper
method to get an endpoint for clients that still need one directly.
Change-Id: I809091c9c71d08f29606d7fd8b500898ff2cb8ae
Clients that can use ksc Session don't need the old junk to
fake auth anymore:
* compute
* volume
Clients that still need to be fed credentials can pick directly
from the auth object in clientmanager. The _token attribute is
removed, the token can be retrieved from the auth object:
openstackclient/tests/common/test_clientmanager.py
This change will break any plugin that relies on getting a token
from instance._token. They should be updated to use the above, or
preferable, to use keystoneclient.session.Session to create its
HTTP interface object.
Change-Id: I877a29de97a42f85f12a14c274fc003e6fba5135
keystoneclient/openstack/common/jsonutils.py is removed in this patch
https://review.openstack.org/#/c/128454/
Now, we should use jsonutils in oslo.serialization package.
Change-Id: I7c8e8e6d5dffa85244368fd578616c9b19f4fd21
The ksc auth plugins do not have support for the original
token-endpoint (aka token flow) auth where the user supplies
a token (possibly the Keystone admin_token) and an API endpoint.
This is used for bootstrapping Keystone but also has other uses
when a scoped user token is provided.
The api.auth:TokenEndpoint class is required to provide the
same interface methods so all of the special-case code branches
to support token-endpoint can be removed.
Some additional cleanups related to ClientManager and creating
the Compute client also were done to streamline using sessions.
Change-Id: I1a6059afa845a591eff92567ca346c09010a93af
This patch allows the user to choose which authentication plugin
to use with the CLI. The arguments needed by the auth plugins are
automatically added to the argument parser. Some examples with
the currently available authentication plugins::
OS_USERNAME=admin OS_PROJECT_NAME=admin OS_AUTH_URL=http://keystone:5000/v2.0 \
OS_PASSWORD=admin openstack user list
OS_USERNAME=admin OS_PROJECT_DOMAIN_NAME=default OS_USER_DOMAIN_NAME=default \
OS_PROJECT_NAME=admin OS_AUTH_URL=http://keystone:5000/v3 OS_PASSWORD=admin \
OS_IDENTITY_API_VERSION=3 OS_AUTH_PLUGIN=v3password openstack project list
OS_TOKEN=1234 OS_URL=http://service_url:35357/v2.0 \
OS_IDENTITY_API_VERSION=2.0 openstack user list
The --os-auth-plugin option can be omitted; if so the CLI will attempt to
guess which plugin to use from the other options.
Change-Id: I330c20ddb8d96b3a4287c68b57c36c4a0f869669
Co-Authored-By: Florent Flament <florent.flament-ext@cloudwatt.com>
* Add method to CommandManager to retrieve command names by group
* Add ListCommands
To list command groups loaded by cliff
Change-Id: I37fe2471aa2fafa8aa223159452d52b1981021d6
Cliff 1.6.1 added CommandManager.load_commands() so we can adopt it
rather than rolling our own.
Also, that second group is Greek, not Latin. Jeez...
Change-Id: I4a63c22f37bcfd0ef5d83c2dbd08b58fda0db35c
This replaces the restapi requests wrapper with the one from Keystone client so
we can take advantage of the auth plugins.
As a first step only the v2 and v3 token and password plugins are supported.
This maintainis no changes to the command options or environment variables.
The next steps will include reworking the other API client interfaces to
fully utilize the single auth session.
Blueprint: ksc-session-auth
Change-Id: I47ec63291e4c3cf36c8061299a4764f60b36ab89
The unordered dict and lists causes variable results. The user
may see different results and tests can fail. Might as well make
this more consistent.
Change-Id: I7045b40b44cbf3ee0f2ca79c6ea0d279b6d8cfe3
This is step 1 toward using Keystone client's session.Session as the
primary session/requests interface in OSC.
* Move the session create into ClientManager and rename 'restapi' attribute to 'session'
* Set up ClientManager and session loggers
* Fix container and object command references to restapi/api
Change-Id: I013d81520b336c7a6422cd22c05d1d65655e64f8
Add support for --timing options. Use cliff via a pseudo-command
'Timing' to support multiple outputformats.
If an output format other than the default 'table' is selected
use CSV since the timing data is in list form.
Will pick up timing data for any client object that has a method
similar to novaclient's get_timings().
TODO:
* Stop instantiating all of the clientmanager client objects just
to check for timing data. Descriptor magic required?
Change-Id: I7f1076b7a250fba6a8b24b2ae9353a7f51b792b2
The find_resource method had two hacks in in to support cinder
and keystone and I have removed those in favor of a monkey patch
for cinder.
The find_resource method used to attempt to UUID parse the id, but
it would do a manager.get anyway. I changed it to skip the UUID
parsing. This will make things run minorly faster and it supports
LDAP for keystone.
The find_resource used to attempt to use display_name=name_or_id
when finding. This was a hack for cinder support, but it breaks
keystone because keystone totally messes up with the bogus filter
and keystone refuses to fix it.
Change-Id: I66e45a6341f704900f1d5321a0e70eac3d051665
Closes-Bug: #1306699
So we can update requriements.txt. But fix a couple of easy ones:
* Fix E251 (1 occurrance)
* Fix E131 (1 occurrance)
Change-Id: I62aaa423aa6da9e9f0ca026ec586b51cc6a6df03
- Add support in the common section for extension list. This only
supports Identity for now. Once the APIs for volume and compute
are supported in the respective APIs, they will be added. Once
network is added to this client, it will be added (the API already
supports it).
- Include extension fakes for volume and compute for pre-enablement.
Change-Id: Iebb0156a779887d2ab06488a2a27b70b56369376
Closes-Bug: #1319115
Most of the CLIs use a NoUniqueMatch, so produce a useful
error message if that happens. Added some tests for
find_resource as well.
Change-Id: I85ba61d5f6d1be5bd336a1cc4b02501492905f33
Closes-Bug: #1293846
* Add get_password method to the utilities
* Add --password-prompt option
* Call the get_password method if a prompt is requested
* Various tests
Change-Id: I1786ad531e2a2fbcc21b8bc86aac0ccd7985995a
Closes-Bug: 1100116
When running some tests from test_restapi.py, the following error happens:
TypeError: unorderable types: NoneType() < int()
In Python 2, comparing NoneType and integers is possible:
>>> None < 2
True
But in Python 3, it's not allowed. Fix this by using a default status code.
Change-Id: Ic0fad5c68f3bf2dd8a2b98423549903f982192c9
cliff.commandmanager.CommandManager gained an option, update
openstackclient.common.commandmanager.ComamndManager to match.
Also add CommandManager.get_command_groups() to return a list of the
currently loaded command groups. I expect this to be useful in
upcoming client diagnostic commands for plugins/extensions.
If these turn out to be generally useful we'll propose them to
upstream cliff.
Change-Id: Ic15a7ca0ef975ca679e753be861be7c628b8e10c
Prepare to use the (soon to be) common Session from keystoneclient
* Rework RESTApi to eventually be a subclass of keystoneclient.Session
Change-Id: I68e610f8b19a3f6267a93f7bf3de54a228be68aa
* restapi module provides basic REST API support
* uses dicts rather than Resource classes
* JSON serialization/deserialization
* log requests in 'curl' format
* basic API boilerplate for create/delete/list/set/show verbs
* ignore H302 due to urllib import
Change-Id: I3cb91e44e631ee19e9f5dea19b6bac5d599d19ce
There are several reasons for this. One is that the majority of
OpenStack packages behave this way. The second is that it makes writing
software that extends something easier to test (which is a clear usecase
for openstackclient) And third, tests/__init__.py implies a global
package named "tests" - which I'm pretty sure we're not providing.
Change-Id: Ic708ffd92aea78c2ffc1a8579af0587af4fca4ff