|
| 1 | +# Licensed under the Apache License, Version 2.0 (the "License"); you may |
| 2 | +# not use this file except in compliance with the License. You may obtain |
| 3 | +# a copy of the License at |
| 4 | +# |
| 5 | +# http://www.apache.org/licenses/LICENSE-2.0 |
| 6 | +# |
| 7 | +# Unless required by applicable law or agreed to in writing, software |
| 8 | +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
| 9 | +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the |
| 10 | +# License for the specific language governing permissions and limitations |
| 11 | +# under the License. |
| 12 | +# |
| 13 | + |
| 14 | +"""Authentication Plugin Library""" |
| 15 | + |
| 16 | +import logging |
| 17 | + |
| 18 | +from oslo_config import cfg |
| 19 | +from six.moves.urllib import parse as urlparse |
| 20 | + |
| 21 | +from keystoneclient.auth import base |
| 22 | +from keystoneclient.auth.identity.generic import password as ksc_password |
| 23 | + |
| 24 | + |
| 25 | +LOG = logging.getLogger(__name__) |
| 26 | + |
| 27 | + |
| 28 | +class TokenEndpoint(base.BaseAuthPlugin): |
| 29 | + """Auth plugin to handle traditional token/endpoint usage |
| 30 | +
|
| 31 | + Implements the methods required to handle token authentication |
| 32 | + with a user-specified token and service endpoint; no Identity calls |
| 33 | + are made for re-scoping, service catalog lookups or the like. |
| 34 | +
|
| 35 | + The purpose of this plugin is to get rid of the special-case paths |
| 36 | + in the code to handle this authentication format. Its primary use |
| 37 | + is for bootstrapping the Keystone database. |
| 38 | + """ |
| 39 | + |
| 40 | + def __init__(self, url, token, **kwargs): |
| 41 | + """A plugin for static authentication with an existing token |
| 42 | +
|
| 43 | + :param string url: Service endpoint |
| 44 | + :param string token: Existing token |
| 45 | + """ |
| 46 | + super(TokenEndpoint, self).__init__() |
| 47 | + self.endpoint = url |
| 48 | + self.token = token |
| 49 | + |
| 50 | + def get_endpoint(self, session, **kwargs): |
| 51 | + """Return the supplied endpoint""" |
| 52 | + return self.endpoint |
| 53 | + |
| 54 | + def get_token(self, session): |
| 55 | + """Return the supplied token""" |
| 56 | + return self.token |
| 57 | + |
| 58 | + def get_auth_ref(self, session, **kwargs): |
| 59 | + """Stub this method for compatibility""" |
| 60 | + return None |
| 61 | + |
| 62 | + # Override this because it needs to be a class method... |
| 63 | + @classmethod |
| 64 | + def get_options(self): |
| 65 | + options = super(TokenEndpoint, self).get_options() |
| 66 | + |
| 67 | + options.extend([ |
| 68 | + # Maintain name 'url' for compatibility |
| 69 | + cfg.StrOpt('url', |
| 70 | + help='Specific service endpoint to use'), |
| 71 | + cfg.StrOpt('token', |
| 72 | + secret=True, |
| 73 | + help='Authentication token to use'), |
| 74 | + ]) |
| 75 | + |
| 76 | + return options |
| 77 | + |
| 78 | + |
| 79 | +class OSCGenericPassword(ksc_password.Password): |
| 80 | + """Auth plugin hack to work around broken Keystone configurations |
| 81 | +
|
| 82 | + The default Keystone configuration uses http://localhost:xxxx in |
| 83 | + admin_endpoint and public_endpoint and are returned in the links.href |
| 84 | + attribute by the version routes. Deployments that do not set these |
| 85 | + are unusable with newer keystoneclient version discovery. |
| 86 | +
|
| 87 | + """ |
| 88 | + |
| 89 | + def create_plugin(self, session, version, url, raw_status=None): |
| 90 | + """Handle default Keystone endpoint configuration |
| 91 | +
|
| 92 | + Build the actual API endpoint from the scheme, host and port of the |
| 93 | + original auth URL and the rest from the returned version URL. |
| 94 | + """ |
| 95 | + |
| 96 | + ver_u = urlparse.urlparse(url) |
| 97 | + |
| 98 | + # Only hack this if it is the default setting |
| 99 | + if ver_u.netloc.startswith('localhost'): |
| 100 | + auth_u = urlparse.urlparse(self.auth_url) |
| 101 | + # from original auth_url: scheme, netloc |
| 102 | + # from api_url: path, query (basically, the rest) |
| 103 | + url = urlparse.urlunparse(( |
| 104 | + auth_u.scheme, |
| 105 | + auth_u.netloc, |
| 106 | + ver_u.path, |
| 107 | + ver_u.params, |
| 108 | + ver_u.query, |
| 109 | + ver_u.fragment, |
| 110 | + )) |
| 111 | + LOG.debug('Version URL updated: %s' % url) |
| 112 | + |
| 113 | + return super(OSCGenericPassword, self).create_plugin( |
| 114 | + session=session, |
| 115 | + version=version, |
| 116 | + url=url, |
| 117 | + raw_status=raw_status, |
| 118 | + ) |
0 commit comments