The payload data of credentials is the unfortunately named blob.
Currently when listing credentials the payload is excluded as OSC is
looking for a column called data which does not exist.
Change-Id: I6fa4579d7ec9ba393ede550191dbd8aa29767bf4
If users, projects or groups are provided by name, there is a
possibility of the existence other users/projects/groups with the same
name in other domain. Even though this is not a problem if the actual
ID is given instead of a name; this is mostly a usability enhancement.
So, three options were added, one for specifying the domain where the
user belongs, another one to specify the project's domain, and finally
one to specify the group's domain.
Change-Id: Iab04b0e04fa75ea5aa3723b8ea42a45f58a6cdb2
Closes-Bug: #1421328
Based on the comments made in this patch:
https://review.openstack.org/#/c/174908/2/
We should simplify and refactor the way we handle finding identity
resources.
Change-Id: I77db2e3564faa90a917082a6c6cb87269e93aebe
In several places we had else branches where a reasonable default
would do the job. This makes the code a mean cleaer and easier to
read.
Change-Id: I231e09aab85fd32b8300bc33c48d0899b728b96e
When using Keystone's policy.v3cloudsample.json policy file, a project admin is
supposed to be able to manage role assignments. Unfortunately, a project admin
isn't allowed to perform these operations using python-openstackclient, as we
attempt to perform list operations for any of the object types specified (users,
groups, projects). This is done in an attempt to lookup the id of the object by
name, but we perform this list operation even when the user specifies everything
by id. This causes 403 errors.
This patch still attempts to look up the object id by name, but we catch the 403
and assume that the user specified an id if the list operation is not allowed.
This is similar to what we do with the --domain option for other commands.
Closes-bug: #1445528
Change-Id: Id95a8520e935c1092d5a22ecd8ea01f572334ac8
This patch adds service providers to command-objects, and makes
a few changes to the help text, to align it more with the
already established identity provider resource.
Change-Id: Ibf3d2bc04bf5588d1fc9c37b8ca28c007496c021
Adds CRUD support for service providers as it's now available through
keystoneclient
Closes-Bug: 1435962
Depends-On: If802e8a47e45ae00112de3739334b4b5482d0500
Change-Id: Ic55101e50209070aa49ca2adc91c89ba754c8c68
The federation APIs for the identity providers introduce a new parameter
for every identity provider, named remote_ids, which contains a list of
entity ID associated with. This parameter can be provided during the creation
of the identity provider and can be updated at any time. For more information
look at the blueprint:
https://blueprints.launchpad.net/keystone/+spec/idp-id-registration
This patch add the support to this new parameter in the command line by
inserting the option "--remote-id" in the following commands:
- "identity provider create"
- "identity provider set"
Additionally, the values can be read from a file, specified by
"--remote-id-file", containing an entity id per line.
Change-Id: Ie93340ee57e54128daa70d8a7bd0a9975ff7eef4
Depends-On: I12a262c55b5f6b5cc7007865edf30f14269da537
Implements: blueprint idp-id-registration
Adding the possibility to create projects hierarchies by adding
the parent field in the create project call.
Co-Authored-By: Victor Silva <victor@lsd.ufcg.edu.br>
Implements: bp hierarchical-multitenancy
Change-Id: I4eac4f5bc067634cc38c305dacc59ab1da63c153
Some service catalogs in the wild have services without region names defined.
Let's be nice and stuff in a default value indicating this state.
Closes-Bug: #1429211
Change-Id: I3ebe2534dc6e3438aaeddc7757fb2db4117eae4b
Not returning a value is the same as returning None. In the event that
someone asks ClientManager for an attribute that doesn't exist it should
raise AttributeError in the same way as other python objects rather
than return an empty value.
Change-Id: Id0ee825e6527c831c38e3a671958ded362fb96e1
Similar to projects, we shouldn't allow users and groups to
change domains. The server side tosses up an error but osc
should restrict that behaviour in the first place.
Related-Bug: #1418384
Change-Id: I860291a5859c576021b18e35d1a12c32abfb6ca5
Keystone Server already surfaces an error for this operation, but
we should restrict the user, and not offer --domain to be changed
for a project.
Change-Id: I48317e8accfea3c285e6ad213e75b783de8070ac
Closes-Bug: #1418384
Added new module in identity v3 api to handle create, read, and delete
operations of trust resources.
Co-Authored-By: Lance Bragstad <lbragstad@gmail.com>
Co-Authored-By: Steve Martinelli <stevemar@ca.ibm.com>
Closes-Bug: #1413718
Change-Id: I2b360b141ff70d4f396466abede859a3db6644f4
We do not take into account region names for identity and volume
clients.
Change-Id: I4263e9013226b0adc6b9ad7540d6ad3efb42e809
Co-Authored-By: Eric Helgeson <erichelgeson@gmail.com>
Related-Bug: #1405416
Changes to the 'service list' commands for Identity v2 and v3:
* Document support for --long
* Add Description to v3 output with --long
* v3 output is now (ID, Name, Type), with (Description, Enabled) added with --long
* Change v2 output to match v3 output, with the absense of Enabled.
* Update doc to match
Closes-Bug: #1411337
Change-Id: I999e3df22f61350cdeba63bbb7d01145c2ffeeaf
Looks like providing a service id isn't working, so it the help
message was reduced to just type and name.
Added a bit more to the docs, too.
Change-Id: Id7f8b48bdf99773ad55ca7f204f3c779f84633d5
try and add some consistency with the show and delete commands.
replace 'show x' with 'display x'
change 'delete a y' with just 'delete y'
Change-Id: I47dfa8ee23ac5c41b355796415eb515155832f65
I think there are three issues we should fix:
1. wrong indentation of 'continue'
2. currently, name is optional for service, but according to the
currrent logic, if a service doesn't have name attribute we will
select it anyway
3. we always loop all catalogs
Change-Id: I9fce66677affa396b6a12afea76e87cab9215a58
`os user role list` does the same as v3's `os role list`.
We should rework v2's `role list` to basically call `os user role list`
under the covers.
Closes-Bug: #1409179
Change-Id: I9839f6be139d6a6a3f6bbf79957e218dd8e03fe3
Added command docs, and changed request token to take in name or
id of a project, and also support a domain option.
Change-Id: I87363274e5b7a0c687e234f5a4bcaaf166d28840
Adds a --project filter to `os user list`, which really
calls the role assignment manager behind the scenes.
Change-Id: I57a75018f12ed3acdf8f6611b6b58bd974f91da2
Closes-Bug: #1397251
