Skip to content

Commit cf23fd5

Browse files
author
Steve Martinelli
committed
Implement trust in identity v3 api
Added new module in identity v3 api to handle create, read, and delete operations of trust resources. Co-Authored-By: Lance Bragstad <lbragstad@gmail.com> Co-Authored-By: Steve Martinelli <stevemar@ca.ibm.com> Closes-Bug: #1413718 Change-Id: I2b360b141ff70d4f396466abede859a3db6644f4
1 parent b02cce5 commit cf23fd5

5 files changed

Lines changed: 582 additions & 1 deletion

File tree

‎doc/source/command-objects/trust.rst‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
=====
2+
trust
3+
=====
4+
5+
Identity v3
6+
7+
trust create
8+
------------
9+
10+
Create new trust
11+
12+
.. program:: trust create
13+
.. code:: bash
14+
15+
os trust create
16+
--project <project>
17+
--role <role>
18+
[--impersonate]
19+
[--expiration <expiration>]
20+
[--project-domain <domain>]
21+
[--trustor-domain <domain>]
22+
[--trustee-domain <domain>]
23+
<trustor>
24+
<trustee>
25+
26+
.. option:: --project <project>
27+
28+
Project being delegated (name or ID) (required)
29+
30+
.. option:: --role <role>
31+
32+
Roles to authorize (name or ID) (repeat to set multiple values) (required)
33+
34+
.. option:: --impersonate
35+
36+
Tokens generated from the trust will represent <trustor> (defaults to False)
37+
38+
.. option:: --expiration <expiration>
39+
40+
Sets an expiration date for the trust (format of YYYY-mm-ddTHH:MM:SS)
41+
42+
.. option:: --project-domain <domain>
43+
44+
Domain that contains <project> (name or ID)
45+
46+
.. option:: --trustor-domain <domain>
47+
48+
Domain that contains <trustor> (name or ID)
49+
50+
.. option:: --trustee-domain <domain>
51+
52+
Domain that contains <trustee> (name or ID)
53+
54+
.. describe:: <trustor-user>
55+
56+
User that is delegating authorization (name or ID)
57+
58+
.. describe:: <trustee-user>
59+
60+
User that is assuming authorization (name or ID)
61+
62+
63+
trust delete
64+
------------
65+
66+
Delete trust(s)
67+
68+
.. program:: trust delete
69+
.. code:: bash
70+
71+
os trust delete
72+
<trust> [<trust> ...]
73+
74+
.. describe:: <trust>
75+
76+
Trust(s) to delete
77+
78+
trust list
79+
----------
80+
81+
List trusts
82+
83+
.. program:: trust list
84+
.. code:: bash
85+
86+
os trust list
87+
88+
trust show
89+
----------
90+
91+
Display trust details
92+
93+
.. program:: trust show
94+
.. code:: bash
95+
96+
os trust show
97+
<trust>
98+
99+
.. describe:: <trust>
100+
101+
Trust to display

‎openstackclient/identity/v3/trust.py‎

Lines changed: 228 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,228 @@
1+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
2+
# not use this file except in compliance with the License. You may obtain
3+
# a copy of the License at
4+
#
5+
# http://www.apache.org/licenses/LICENSE-2.0
6+
#
7+
# Unless required by applicable law or agreed to in writing, software
8+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
9+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
10+
# License for the specific language governing permissions and limitations
11+
# under the License.
12+
#
13+
14+
"""Identity v3 Trust action implementations"""
15+
16+
import datetime
17+
import logging
18+
import six
19+
20+
from cliff import command
21+
from cliff import lister
22+
from cliff import show
23+
24+
from openstackclient.common import utils
25+
from openstackclient.identity import common
26+
27+
28+
class CreateTrust(show.ShowOne):
29+
"""Create new trust"""
30+
31+
log = logging.getLogger(__name__ + '.CreateTrust')
32+
33+
def get_parser(self, prog_name):
34+
parser = super(CreateTrust, self).get_parser(prog_name)
35+
parser.add_argument(
36+
'trustor',
37+
metavar='<trustor-user>',
38+
help='User that is delegating authorization (name or ID)',
39+
)
40+
parser.add_argument(
41+
'trustee',
42+
metavar='<trustee-user>',
43+
help='User that is assuming authorization (name or ID)',
44+
)
45+
parser.add_argument(
46+
'--project',
47+
metavar='<project>',
48+
required=True,
49+
help='Project being delegated (name or ID) (required)',
50+
)
51+
parser.add_argument(
52+
'--role',
53+
metavar='<role>',
54+
action='append',
55+
default=[],
56+
help='Roles to authorize (name or ID) '
57+
'(repeat to set multiple values) (required)',
58+
required=True
59+
)
60+
parser.add_argument(
61+
'--impersonate',
62+
dest='impersonate',
63+
action='store_true',
64+
default=False,
65+
help='Tokens generated from the trust will represent <trustor>'
66+
' (defaults to False)',
67+
)
68+
parser.add_argument(
69+
'--expiration',
70+
metavar='<expiration>',
71+
help='Sets an expiration date for the trust'
72+
' (format of YYYY-mm-ddTHH:MM:SS)',
73+
)
74+
parser.add_argument(
75+
'--project-domain',
76+
metavar='<domain>',
77+
help='Domain that contains <project> (name or ID)',
78+
)
79+
parser.add_argument(
80+
'--trustor-domain',
81+
metavar='<domain>',
82+
help='Domain that contains <trustor> (name or ID)',
83+
)
84+
parser.add_argument(
85+
'--trustee-domain',
86+
metavar='<domain>',
87+
help='Domain that contains <trustee> (name or ID)',
88+
)
89+
return parser
90+
91+
def take_action(self, parsed_args):
92+
self.log.debug('take_action(%s)' % parsed_args)
93+
identity_client = self.app.client_manager.identity
94+
95+
if parsed_args.project_domain:
96+
project_domain = common.find_domain(identity_client,
97+
parsed_args.project_domain).id
98+
else:
99+
project_domain = None
100+
101+
if parsed_args.trustor_domain:
102+
trustor_domain = common.find_domain(identity_client,
103+
parsed_args.trustor_domain).id
104+
else:
105+
trustor_domain = None
106+
107+
if parsed_args.trustee_domain:
108+
trustee_domain = common.find_domain(identity_client,
109+
parsed_args.trustee_domain).id
110+
else:
111+
trustee_domain = None
112+
113+
# NOTE(stevemar): Find the two users, project and roles that
114+
# are necessary for making a trust usable, the API dictates that
115+
# trustee, project and role are optional, but that makes the trust
116+
# pointless, and trusts are immutable, so let's enforce it at the
117+
# client level.
118+
trustor_id = utils.find_resource(identity_client.users,
119+
parsed_args.trustor,
120+
domain_id=trustor_domain).id
121+
trustee_id = utils.find_resource(identity_client.users,
122+
parsed_args.trustee,
123+
domain_id=trustee_domain).id
124+
project_id = utils.find_resource(identity_client.projects,
125+
parsed_args.project,
126+
domain_id=project_domain).id
127+
128+
role_names = []
129+
for role in parsed_args.role:
130+
role_name = utils.find_resource(
131+
identity_client.roles,
132+
role,
133+
).name
134+
role_names.append(role_name)
135+
136+
expires_at = None
137+
if parsed_args.expiration:
138+
expires_at = datetime.datetime.strptime(parsed_args.expiration,
139+
'%Y-%m-%dT%H:%M:%S')
140+
141+
trust = identity_client.trusts.create(
142+
trustee_id, trustor_id,
143+
impersonation=parsed_args.impersonate,
144+
project=project_id,
145+
role_names=role_names,
146+
expires_at=expires_at,
147+
)
148+
149+
trust._info.pop('roles_links', None)
150+
trust._info.pop('links', None)
151+
152+
# Format roles into something sensible
153+
roles = trust._info.pop('roles')
154+
msg = ''.join([r['name'] + ' ' for r in roles])
155+
trust._info['roles'] = msg
156+
157+
return zip(*sorted(six.iteritems(trust._info)))
158+
159+
160+
class DeleteTrust(command.Command):
161+
"""Delete trust(s)"""
162+
163+
log = logging.getLogger(__name__ + '.DeleteTrust')
164+
165+
def get_parser(self, prog_name):
166+
parser = super(DeleteTrust, self).get_parser(prog_name)
167+
parser.add_argument(
168+
'trust',
169+
metavar='<trust>',
170+
help='Trust(s) to delete',
171+
nargs="+",
172+
)
173+
return parser
174+
175+
def take_action(self, parsed_args):
176+
self.log.debug('take_action(%s)' % parsed_args)
177+
identity_client = self.app.client_manager.identity
178+
for t in parsed_args.trust:
179+
trust_obj = utils.find_resource(identity_client.trusts, t)
180+
identity_client.trusts.delete(trust_obj.id)
181+
182+
183+
class ListTrust(lister.Lister):
184+
"""List trusts"""
185+
186+
log = logging.getLogger(__name__ + '.ListTrust')
187+
188+
def take_action(self, parsed_args):
189+
self.log.debug('take_action(%s)' % parsed_args)
190+
columns = ('ID', 'Expires At', 'Impersonation', 'Project ID',
191+
'Trustee User ID', 'Trustor User ID')
192+
data = self.app.client_manager.identity.trusts.list()
193+
return (columns,
194+
(utils.get_item_properties(
195+
s, columns,
196+
formatters={},
197+
) for s in data))
198+
199+
200+
class ShowTrust(show.ShowOne):
201+
"""Display trust details"""
202+
203+
log = logging.getLogger(__name__ + '.ShowTrust')
204+
205+
def get_parser(self, prog_name):
206+
parser = super(ShowTrust, self).get_parser(prog_name)
207+
parser.add_argument(
208+
'trust',
209+
metavar='<trust>',
210+
help='Trust to display',
211+
)
212+
return parser
213+
214+
def take_action(self, parsed_args):
215+
self.log.debug('take_action(%s)' % parsed_args)
216+
identity_client = self.app.client_manager.identity
217+
trust = utils.find_resource(identity_client.trusts,
218+
parsed_args.trust)
219+
220+
trust._info.pop('roles_links', None)
221+
trust._info.pop('links', None)
222+
223+
# Format roles into something sensible
224+
roles = trust._info.pop('roles')
225+
msg = ''.join([r['name'] + ' ' for r in roles])
226+
trust._info['roles'] = msg
227+
228+
return zip(*sorted(six.iteritems(trust._info)))

‎openstackclient/tests/identity/v3/fakes.py‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -181,7 +181,7 @@
181181
'links': base_url + 'endpoints/' + endpoint_id,
182182
}
183183

184-
user_id = 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa'
184+
user_id = 'bbbbbbb-aaaa-aaaa-aaaa-bbbbbbbaaaa'
185185
user_name = 'paul'
186186
user_description = 'Sir Paul'
187187
user_email = 'paul@applecorps.com'
@@ -196,6 +196,22 @@
196196
'links': base_url + 'users/' + user_id,
197197
}
198198

199+
trust_id = 't-456'
200+
trust_expires = None
201+
trust_impersonation = False
202+
trust_roles = {"id": role_id, "name": role_name},
203+
204+
TRUST = {
205+
'expires_at': trust_expires,
206+
'id': trust_id,
207+
'impersonation': trust_impersonation,
208+
'links': base_url + 'trusts/' + trust_id,
209+
'project_id': project_id,
210+
'roles': trust_roles,
211+
'trustee_user_id': user_id,
212+
'trustor_user_id': user_id,
213+
}
214+
199215
token_expires = '2014-01-01T00:00:00Z'
200216
token_id = 'tttttttt-tttt-tttt-tttt-tttttttttttt'
201217

@@ -342,6 +358,8 @@ def __init__(self, **kwargs):
342358
self.session = mock.Mock()
343359
self.session.auth.auth_ref.service_catalog.resource_class = \
344360
fakes.FakeResource(None, {})
361+
self.trusts = mock.Mock()
362+
self.trusts.resource_class = fakes.FakeResource(None, {})
345363
self.users = mock.Mock()
346364
self.users.resource_class = fakes.FakeResource(None, {})
347365
self.role_assignments = mock.Mock()

0 commit comments

Comments
 (0)