Файловый менеджер - Редактировать - /opt/imh-python/lib/python3.9/site-packages/libcloud/common/__pycache__/openstack_identity.cpython-39.pyc
Ðазад
a q�h,� � @ s� d Z ddlZddlmZ ddlmZ ddlmZmZm Z ddl m Z m Z m Z z ddlZW n eyr ddlZY n0 dZg d�Zd Zg d �ZG d d � d e�ZG d d� de�ZG dd� de�ZG dd� de�ZG dd� de�ZG dd� de�ZG dd� de�Z G dd� de�Z G dd � d e�Z G d d � d e�Z G d d � d e�Z G d!d"� d"e�Z!G d#d$� d$e!�Z"G d%d&� d&e!�Z#G d'd(� d(e!�Z$G d)d*� d*e!�Z%G d+d,� d,e%�Z&G d-d.� d.e!e �Z'd/d0� Z(dS )1za Common / shared code for handling authentication against OpenStack identity service (Keystone). � N)�httplib)� parse_date)�ConnectionUserAndKey�Response�CertificateConnection)� LibcloudError�InvalidCredsError�MalformedResponseError�1.1)r �2.0� 2.0_apikey� 2.0_password�2.0_voms�3.0� 3.x_password�3.x_oidc_access_token� )�OpenStackIdentityVersion�OpenStackIdentityDomain�OpenStackIdentityProject�OpenStackIdentityUser�OpenStackIdentityRole�OpenStackServiceCatalog� OpenStackServiceCatalogEntry�$OpenStackServiceCatalogEntryEndpoint� OpenStackIdentityEndpointType�OpenStackIdentityConnection� OpenStackIdentity_1_0_Connection� OpenStackIdentity_1_1_Connection� OpenStackIdentity_2_0_Connection�%OpenStackIdentity_2_0_Connection_VOMS� OpenStackIdentity_3_0_Connection�2OpenStackIdentity_3_0_Connection_OIDC_access_token�get_class_for_auth_versionc @ s e Zd ZdZdZdZdZdS )r z: Enum class for openstack identity endpoint type. �internal�external�adminN)�__name__� __module__� __qualname__�__doc__�INTERNAL�EXTERNAL�ADMIN� r. r. ��/root/rpmbuild/BUILDROOT/imh-python39-modules-3.9.7-92.el8.x86_64/opt/imh-python/lib/python3.9/site-packages/libcloud/common/openstack_identity.pyr Q s r c @ s e Zd ZdZdZdZdZdS )�OpenStackIdentityTokenScopez8 Enum class for openstack identity token scope. �project�domainZunscopedN)r' r( r) r* �PROJECT�DOMAIN�UNSCOPEDr. r. r. r/ r0 Z s r0 c @ s e Zd Zdd� Zdd� ZdS )r c C s || _ || _|| _|| _d S �N��version�status�updated�url)�selfr8 r9 r: r; r. r. r/ �__init__d s z!OpenStackIdentityVersion.__init__c C s d| j | j| j| jf S )NzD<OpenStackIdentityVersion version=%s, status=%s, updated=%s, url=%s>r7 �r< r. r. r/ �__repr__j s �z!OpenStackIdentityVersion.__repr__N�r' r( r) r= r? r. r. r. r/ r c s r c @ s e Zd Zdd� Zdd� ZdS )r c C s || _ || _|| _d S r6 ��id�name�enabled)r< rB rC rD r. r. r/ r= q s z OpenStackIdentityDomain.__init__c C s d| j | j| jf S )Nz4<OpenStackIdentityDomain id=%s, name=%s, enabled=%s>rA r> r. r. r/ r? v s �z OpenStackIdentityDomain.__repr__Nr@ r. r. r. r/ r p s r c @ s e Zd Zddd�Zdd� ZdS )r Nc C s" || _ || _|| _|| _|| _d S r6 �rB rC � descriptionrD � domain_id)r< rB rC rF rD rG r. r. r/ r= | s z!OpenStackIdentityProject.__init__c C s d| j | j| j| jf S )NzC<OpenStackIdentityProject id=%s, domain_id=%s, name=%s, enabled=%s>)rB rG rC rD r> r. r. r/ r? � s �z!OpenStackIdentityProject.__repr__)Nr@ r. r. r. r/ r { s r c @ s e Zd Zdd� Zdd� ZdS )r c C s || _ || _|| _|| _d S r6 �rB rC rF rD )r< rB rC rF rD r. r. r/ r= � s z OpenStackIdentityRole.__init__c C s d| j | j| j| jf S )NzB<OpenStackIdentityRole id=%s, name=%s, description=%s, enabled=%s>rH r> r. r. r/ r? � s ��z OpenStackIdentityRole.__repr__Nr@ r. r. r. r/ r � s r c @ s e Zd Zdd� Zdd� ZdS )r c C s( || _ || _|| _|| _|| _|| _d S r6 �rB rG rC �emailrF rD )r< rB rG rC rJ rF rD r. r. r/ r= � s z OpenStackIdentityUser.__init__c C s d| j | j| j| j| jf S )NzJ<OpenStackIdentityUser id=%s, domain_id=%s, name=%s, email=%s, enabled=%s>)rB rG rC rJ rD r> r. r. r/ r? � s ��z OpenStackIdentityUser.__repr__Nr@ r. r. r. r/ r � s r c @ s� e Zd ZdZdZdZefdd�Zdd� Zdd� Z dd d �Z d d d �Z ddde j fd d�Zd dd�Zd dd�Zd dd�Zdd� Zdd� Zdd� ZdS ) r aU http://docs.openstack.org/api/openstack-identity-service/2.0/content/ This class should be instantiated with the contents of the 'serviceCatalog' in the auth response. This will do the work of figuring out which services actually exist in the catalog as well as split them up by type, name, and region if available Nc C s� || _ d| j v r | j|d�}nHd| j v r6| j|d�}n0d| j v sJd| j v rX| j|d�}ntd| j ��t|dd� d �}|| _d S ) Nz3.x)�service_catalogr r �1.0z auth version "%s" not supportedc S s | j | jp d S �N� )� service_type� service_name��xr. r. r/ �<lambda>� � z2OpenStackServiceCatalog.__init__.<locals>.<lambda>��key)� _auth_version� _parse_service_catalog_auth_v3� _parse_service_catalog_auth_v2� _parse_service_catalog_auth_v1r �sorted�_entries)r< rK � auth_version�entriesr. r. r/ r= � s( � ����z OpenStackServiceCatalog.__init__c C s | j S )z� Return all the entries for this service catalog. :rtype: ``list`` of :class:`.OpenStackServiceCatalogEntry` )r\ r> r. r. r/ � get_entries� s z#OpenStackServiceCatalog.get_entriesc C s | � � S )zD Deprecated in the favor of ``get_entries`` method. )r_ r> r. r. r/ � get_catalog� s z#OpenStackServiceCatalog.get_catalogc C s< | j ||d�}g }|D ] }|j}|tjkr|�|j� q|S )zs Retrieve all the available public (external) URLs for the provided service type and name. )rO rC )� get_endpoints� endpoint_typer r, �appendr; )r< rO rC � endpoints�result�endpointrb r. r. r/ �get_public_urls� s � z'OpenStackServiceCatalog.get_public_urlsc C sJ g }| j D ]:}|r |j|kr q |r.|j|kr.q |jD ]}|�|� q4q |S )z� Retrieve all the endpoints for the provided service type and name. :rtype: ``list`` of :class:`.OpenStackServiceCatalogEntryEndpoint` )r\ rO rP rd rc )r< rO rC rd �entryrf r. r. r/ ra � s z%OpenStackServiceCatalog.get_endpointsc C s� g }| j D ]Z}|r |j|kr q |r.|j|kr.q |jD ].}|rH|j|krHq4|rX|j|krXq4|�|� q4q t|�dkrz|d S t|�dkr�td��nt d��dS )z� Retrieve a single endpoint using the provided criteria. Note: If no or more than one matching endpoint is found, an exception is thrown. � r z#Found more than 1 matching endpointz!Could not find specified endpointN) r\ rO rP rd �regionrb rc �len� ValueErrorr )r< rO rC rj rb rd rh rf r. r. r/ � get_endpoint� s" z$OpenStackServiceCatalog.get_endpointc C sL t � }| jD ]2}|r |j|kr q |jD ]}|jr&|�|j� q&q tt|��S )z� Retrieve a list of all the available regions. :param service_type: If specified, only return regions for this service type. :type service_type: ``str`` :rtype: ``list`` of ``str`` )�setr\ rO rd rj �addr[ �list)r< rO Zregionsrh rf r. r. r/ � get_regions s z#OpenStackServiceCatalog.get_regionsc C sT t � }| jD ]:}d}|jD ]}|r|j|krd} q6q|r |�|j� q tt|��S )z� Retrieve all the available service types. :param region: Optional region to retrieve service types for. :type region: ``str`` :rtype: ``list`` of ``str`` TF)rn r\ rd rj ro rO r[ rp )r< rj Z service_typesrh �includerf r. r. r/ �get_service_types6 s z)OpenStackServiceCatalog.get_service_typesc C s� t � }d| jvr td| j ��| jD ]P}|r8|j|kr8q$d}|jD ]}|rB|j|krBd} q^qB|r$|jr$|�|j� q$t t |��S )z� Retrieve list of service names that match service type and region. :type service_type: ``str`` :type region: ``str`` :rtype: ``list`` of ``str`` r zUnsupported version: %sTF) rn rW rl r\ rO rd rj rP ro r[ rp )r< rO rj �namesrh rr rf r. r. r/ �get_service_namesN s z)OpenStackServiceCatalog.get_service_namesc C s� g }|� � D ]�\}}g }|D ]d}|�dd �}|�dd �}|�dd �} |rbt||tjd�} |�| � | r t|| tjd�} |�| � q t||d�} |�| � q |S )Nrj � publicURL� internalURL�rj r; rb )rO rd )�items�getr r r, rc r+ r ) r< rK r^ �servicerd �entry_endpointsrf rj � public_url� private_url�entry_endpointrh r. r. r/ rZ k s0 � � � z6OpenStackServiceCatalog._parse_service_catalog_auth_v1c C s� g }|D ]�}|d }|� dd �}g }|� dg �D ]d}|� dd �}|� dd �} |� dd �} | rvt|| tjd�} |�| � | r0t|| tjd�} |�| � q0t|||d�} |�| � q|S ) N�typerC rd rj rv rw rx �rO rd rP )rz r r r, rc r+ r ) r< rK r^ r{ rO rP r| rf rj r} r~ r rh r. r. r/ rY � s6 � � � z6OpenStackServiceCatalog._parse_service_catalog_auth_v2c C s� g }|D ]�}|d }|� dd �}g }|d D ]f}|� dd �}|d } |d } | dkr\tj} n | dkrltj} n| d krztj} t|| | d �} |�| � q,t|||d �} |�| � q|S ) Nr� rC rd rj r; Z interfacer$ �publicr& rx )rO rP rd )rz r r+ r, r- r rc r ) r< rK r^ �itemrO rP r| rf rj r; rb r rh r. r. r/ rX � s2 � � z6OpenStackServiceCatalog._parse_service_catalog_auth_v3)NN)NN)N)N)NN)r' r( r) r* rW Z_service_catalog�AUTH_API_VERSIONr= r_ r` rg ra r r, rm rq rs ru rZ rY rX r. r. r. r/ r � s" � ! !r c @ s. e Zd Zd dd�Zdd� Zdd� Zdd � ZdS ) r Nc C s. || _ |p g | _|| _t| jdd� d�| _dS )a :param service_type: Service type. :type service_type: ``str`` :param endpoints: Endpoints belonging to this entry. :type endpoints: ``list`` :param service_name: Optional service name. :type service_name: ``str`` c S s | j pdS rM )r; rQ r. r. r/ rS � rT z7OpenStackServiceCatalogEntry.__init__.<locals>.<lambda>rU N)rO rd rP r[ )r< rO rd rP r. r. r/ r= � s z%OpenStackServiceCatalogEntry.__init__c C s$ | j |j ko"| j|jko"|j| jkS r6 r� �r< �otherr. r. r/ �__eq__� s � �z#OpenStackServiceCatalogEntry.__eq__c C s | j |d� S �N)r� �r� r� r. r. r/ �__ne__� s z#OpenStackServiceCatalogEntry.__ne__c C s d| j | jt| j�f S )NzL<OpenStackServiceCatalogEntry service_type=%s, service_name=%s, endpoints=%s)rO rP �reprrd r> r. r. r/ r? � s �z%OpenStackServiceCatalogEntry.__repr__)NN)r' r( r) r= r� r� r? r. r. r. r/ r � s r c @ s> e Zd ZejejejgZd dd�Zdd� Z dd� Z dd � Z d S ) r r% c C s, || j vrtd| ��|| _|| _|| _dS )z� :param region: Endpoint region. :type region: ``str`` :param url: Endpoint URL. :type url: ``str`` :param endpoint_type: Endpoint type (external / internal / admin). :type endpoint_type: ``str`` zInvalid type: %sN)�VALID_ENDPOINT_TYPESrl rj r; rb )r< rj r; rb r. r. r/ r= � s z-OpenStackServiceCatalogEntryEndpoint.__init__c C s$ | j |j ko"| j|jko"| j|jkS r6 rx r� r. r. r/ r� s �z+OpenStackServiceCatalogEntryEndpoint.__eq__c C s | j |d� S r� r� r� r. r. r/ r� s z+OpenStackServiceCatalogEntryEndpoint.__ne__c C s d| j | j| jf S )Nz@<OpenStackServiceCatalogEntryEndpoint region=%s, url=%s, type=%srx r> r. r. r/ r? s �z-OpenStackServiceCatalogEntryEndpoint.__repr__N)r% ) r' r( r) r r+ r, r- r� r= r� r� r? r. r. r. r/ r � s � r c @ s e Zd Zdd� Zdd� ZdS )�OpenStackAuthResponsec C s& | j tjtjtjtjtjtjtjfv S r6 ) r9 r �OK�CREATED�ACCEPTED� NO_CONTENT�MULTIPLE_CHOICES� UNAUTHORIZED�INTERNAL_SERVER_ERRORr> r. r. r/ �success s �z OpenStackAuthResponse.successc C s� | j s d S d| jv rd}n d| jv r*d}n tdtd��| j| }|�d�dkr\|�d�d }|dkr�zt�| j �}W q� ty� t}t d | j |d ��Y q�0 n|d kr�| j }n| j }|S ) Nz content-type� Content-TypezMissing content-type header��driver�;���r �application/json�Failed to parse JSON��bodyr� z text/plain) r� �headersr r �find�split�json�loads� Exceptionr )r< rV � content_type�datar� r. r. r/ � parse_body s2 � �z OpenStackAuthResponse.parse_bodyN)r' r( r) r� r� r. r. r. r/ r� s r� c s� e Zd ZdZeZdZdZdddej dddf� fdd� Z d d d �Z d d � Z d d� Z dd� Zd dd�Zdd� Zdd� Zdd� Zd!dd�Zdd � Zd d � Z� ZS )"r z� Base identity connection class which contains common / shared logic. Note: This class shouldn't be instantiated directly. N�default�Defaultc sv t t| �j||||| d� | | _| r6| j| _| j| _nd | _|| _|| _|| _|| _ || _ i | _ d | _ d | _ d | _d S )N)�user_idrV r; �timeout� proxy_url)�superr r= � parent_conn� conn_classr� �auth_url� tenant_name� domain_name� token_scoper� �urls� auth_token�auth_token_expires�auth_user_info) r< r� r� rV r� �tenant_domain_idr� r� r� r� r� �� __class__r. r/ r= B s( � z$OpenStackIdentityConnection.__init__�GETFc C s6 | j std��|pi }| j |d< | j||||||d�S )zL Perform an authenticated request against the identity API. z/Not to be authenticated to perform this request� X-Auth-Token)�action�paramsr� r� �method�raw)r� rl �request)r< r� r� r� r� r� r� r. r. r/ �authenticated_request` s �z1OpenStackIdentityConnection.authenticated_requestc C s$ | � | j�\}}}}|dkr |S |S rM )Z_tuple_from_urlr� )r< r� �_� request_pathr. r. r/ �morph_action_hookn s z-OpenStackIdentityConnection.morph_action_hookc C s d|d< d|d< |S )Nr� �Acceptz application/json; charset=UTF-8r� r. )r< r� r. r. r/ �add_default_headersx s z/OpenStackIdentityConnection.add_default_headersc C sL | j s dS | jsdS | jtjtd� }|�� }tj�� �� }||k rHdS dS )z� Return True if the current auth token is already cached and hasn't expired yet. :return: ``True`` if the token is still valid, ``False`` otherwise. :rtype: ``bool`` F)�secondsT)r� r� �datetime� timedelta� AUTH_TOKEN_EXPIRES_GRACE_SECONDS� utctimetuple�utcnow)r< �expiresZtime_tuple_expiresZtime_tuple_nowr. r. r/ �is_token_valid} s �z*OpenStackIdentityConnection.is_token_validc C s t d��dS )z� Authenticate against the identity API. :param force: Forcefully update the token even if it's already cached and still valid. :type force: ``bool`` z authenticate not implementedN)�NotImplementedError�r< �forcer. r. r/ � authenticate� s z(OpenStackIdentityConnection.authenticatec C s8 | j ddd�}| j|jd d d�}t|dd� d �}|S ) z� Retrieve a list of all the identity versions which are supported by this installation. :rtype: ``list`` of :class:`.OpenStackIdentityVersion` �/r� �r� �versions�values�r� c S s | j S r6 )r8 rQ r. r. r/ rS � rT zEOpenStackIdentityConnection.list_supported_versions.<locals>.<lambda>rU )r� � _to_versions�objectr[ �r< �responsere r. r. r/ �list_supported_versions� s z3OpenStackIdentityConnection.list_supported_versionsc C s( g }|D ]}| j |d�}|�|� q|S �Nr� )� _to_versionrc )r< r� re r� r8 r. r. r/ r� � s z(OpenStackIdentityConnection._to_versionsc C sp zt |d �}W n ty& d }Y n0 z|d d d }W n tyR d }Y n0 t|d |d ||d�}|S )Nr: �linksr �hrefrB r9 r7 )r r� � IndexErrorr )r< r� r: r; r8 r. r. r/ r� � s �z'OpenStackIdentityConnection._to_versionc C s& |rdS | j tvrdS | �� r"dS dS )z| Determine if the authentication is needed or if the existing token (if any exists) is still valid. TF)r] �AUTH_VERSIONS_WITH_EXPIRESr� r� r. r. r/ �_is_authentication_needed� s z5OpenStackIdentityConnection._is_authentication_neededc C s( g }|D ]}| j |d�}|�|� q|S r� )� _to_projectrc )r< r� re r� r1 r. r. r/ � _to_projects� s z(OpenStackIdentityConnection._to_projectsc C s. t |d |d |d |d |�dd �d�}|S )NrB rC rF rD rG rE )r rz )r< r� r1 r. r. r/ r� � s ��z'OpenStackIdentityConnection._to_project)NNNr� F)F)F)r' r( r) r* r� � responseClsr� r] r0 r3 r= r� r� r� r� r� r� r� r� r� r� r� � __classcell__r. r. r� r/ r 8 s, � � r c @ s& e Zd ZdZeZdZdZddd�ZdS ) r z1 Connection class for Keystone API v1.0. �OpenStack Identity API v1.0rL Fc C s� | j |d�s| S | j| jd�}| jd|dd�}|jtjkrBt� �n�|jtjtj fvrzd|j|j |j f }t d|| j d��nv|j }i | _d |�d d �ig| jd < d |�d d �ig| jd < d |�dd �ig| jd< |�dd �| _d | _| js�t d��| S )N�r� )z X-Auth-Userz X-Auth-Keyz/v1.0r� �r� r� zcode: %s body:%s headers:%s�Malformed responser� rv zx-server-management-urlZ cloudServerszx-cdn-management-urlZ cloudFilesCDNz x-storage-urlZ cloudFilesz x-auth-tokenz(Missing X-Auth-Token in response headers)r� r� rV r� r9 r r� r r� r� r� r� r r� r� rz r� r� )r< r� r� �respr� r. r. r/ r� � s: � �����z-OpenStackIdentity_1_0_Connection.authenticateN)F� r' r( r) r* r� r� rC r] r� r. r. r. r/ r � s r c @ s& e Zd ZdZeZdZdZddd�ZdS ) r z1 Connection class for Keystone API v1.1. zOpenStack Identity API v1.1r Fc C s6 | j |d�s| S t�d| j| jd�i�}| jd|i dd�}|jtjkrNt � �n�|jtj kr|d|j|j f }t d|| j d ��n�zt�|j �}W n. ty� } zt d |��W Y d }~n d }~0 0 zD|d d d }|d d d | _t|�| _|d d | _d | _W n0 t�y0 } zt d|��W Y d }~n d }~0 0 | S )Nr� � credentials)�usernamerV z /v1.1/auth�POST�r� r� r� �code: %s body:%sr� r� r� �auth�tokenr� rB �serviceCatalog�\Auth JSON response is missing required elements)r� r� �dumpsr� rV r� r9 r r� r r� r� r r� r� r� r� r r� r� r� �KeyError)r< r� �reqbodyr� r� �er� r. r. r/ r� ! s< � � � �z-OpenStackIdentity_1_1_Connection.authenticateN)Fr� r. r. r. r/ r s r c @ sN e Zd ZdZeZdZdZddd�Zdd � Z d d � Z d d � Z dd� Z dd� Z dS )r z1 Connection class for Keystone API v2.0. r� r �api_keyFc C s< | j |d�s| S |dkr | �� S |dkr0| �� S td��d S )Nr� r� �passwordz$Invalid value for auth_type argument)r� � _authenticate_2_0_with_api_key� _authenticate_2_0_with_passwordrl )r< Z auth_typer� r. r. r/ r� N s z-OpenStackIdentity_2_0_Connection.authenticatec C s> dd| j | jd�ii}| jr*| j|d d< t�|�}| �|�S )Nr� zRAX-KSKEY:apiKeyCredentials)r� ZapiKey� tenantName�r� rV r� r� r� �_authenticate_2_0_with_body�r< r� r� r. r. r/ r� Y s �� z?OpenStackIdentity_2_0_Connection._authenticate_2_0_with_api_keyc C s> dd| j | jd�ii}| jr*| j|d d< t�|�}| �|�S )Nr� ZpasswordCredentials)r� r� r r r r. r. r/ r� d s �� z@OpenStackIdentity_2_0_Connection._authenticate_2_0_with_passwordc C s� | j d|ddidd�}|jtjkr*t� �n�|jtjtjfvr^d|j|jf }td|| j d��n~|j }zH|d }|d d }|d d | _ t |�| _ |d | _|�di �| _W n. ty� } ztd|��W Y d }~n d }~0 0 | S �N� /v2.0/tokensr� r� r� r� zcode: %s body: %sr� r� �accessr� r� rB r� �userr� �r� r9 r r� r r� � NON_AUTHORITATIVE_INFORMATIONr� r r� r� r� r r� r� rz r� r� �r< r� r� r� r r� r� r. r. r/ r p s4 � �� �z<OpenStackIdentity_2_0_Connection._authenticate_2_0_with_bodyc C s$ | j ddd�}| j|jd d�}|S )N� /v2.0/tenantsr� r� �tenantsr� �r� r� r� r� r. r. r/ � list_projects� s z.OpenStackIdentity_2_0_Connection.list_projectsc C s | � � S r6 )r r> r. r. r/ � list_tenants� s z-OpenStackIdentity_2_0_Connection.list_tenantsN)r� F)r' r( r) r* r� r� rC r] r� r� r� r r r r. r. r. r/ r E s r c s e Zd ZdZeZdZdZej ej ej gZ dddej dddf� fdd� Z d7d d �Zd d � Zdd� Zdd� Zdd� Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d!� Zd"d#� Zd8d%d&�Zd'd(� Z d)d*� Z d+d,� Z d-d.� Z d/d0� Z d1d2� Z!d3d4� Z"d5d6� Z#� Z$S )9r! z1 Connection class for Keystone API v3.x. zOpenStack Identity API v3.xr Nr� r� c s� t t| �j|||||||| | d� | j| jvr<td| j ��| jtjkr^| jrT| j s^td��n| jtj krx| j sxtd��d| _ || _ dS )a� :param tenant_name: Name of the project this user belongs to. Note: When token_scope is set to project, this argument control to which project to scope the token to. :type tenant_name: ``str`` :param domain_name: Domain the user belongs to. Note: Then token_scope is set to token, this argument controls to which domain to scope the token to. :type domain_name: ``str`` :param token_scope: Whether to scope a token to a "project", a "domain" or "unscoped" :type token_scope: ``str`` ) r� r� rV r� r� r� r� r� r� z,Invalid value for "token_scope" argument: %sz1Must provide tenant_name and domain_name argumentz!Must provide domain_name argumentN) r� r! r= r� �VALID_TOKEN_SCOPESrl r0 r3 r� r� r4 �auth_user_rolesr� ) r< r� r� rV r� r� r� r� r� r� r� r� r. r/ r= � s: �� � �� �z)OpenStackIdentity_3_0_Connection.__init__Fc C s. | j |d�s| S dddgdd| ji| j| jd�id�ii}| jtjkrfd d | ji| jd �i|d d < n:| jtj kr�d d| jii|d d < n| jtj kr�nt d��t � |�}| jd|ddidd�}|jtjkr�t� ��nT|jtjtjfv �r�|j}zt �|j�}W n0 t�y0 } ztd|��W Y d}~n d}~0 0 z| �|d d �}W n t�y` g }Y n0 zN|d d }|d | _t |�| _ |d � dd�| _ |d � dd�| _ || _!W n0 t"�y� } ztd|��W Y d}~n d}~0 0 d |j|jf }n6|jd k�r t#d ��n d |j|jf }td || j$d ��| S )!�) Perform authentication. r� r� �identityr� r rC )r2 rC r� )�methodsr� r1 rB )r2 rC �scoper2 �6Token needs to be scoped either to project or a domain�/v3/auth/tokensr� r� r� r� r� Nr� �roles� expires_at�x-subject-token�catalogr� r� i, zyAuth request returned ambiguous version error, tryusing the version specific URL to connect, e.g. identity/v3/auth/tokensr� r� )%r� r� r� rV r� r0 r3 r� r� r4 r5 rl r� r� r� r9 r r� r r� r� r� r� r� r� r � _to_rolesr� r r� rz r� r� r r� r r� ) r< r� r� r� r� r� r� r r� r. r. r/ r� � s� ������ ��� �� � � ��z-OpenStackIdentity_3_0_Connection.authenticatec C s$ | j ddd�}| j|jd d�}|S )zk List the available domains. :rtype: ``list`` of :class:`OpenStackIdentityDomain` z /v3/domainsr� r� �domainsr� )r� � _to_domainsr� r� r. r. r/ � list_domains0 s z-OpenStackIdentity_3_0_Connection.list_domainsc C s$ | j ddd�}| j|jd d�}|S )z� List the available projects. Note: To perform this action, user you are currently authenticated with needs to be an admin. :rtype: ``list`` of :class:`OpenStackIdentityProject` z /v3/projectsr� r� �projectsr� r r� r. r. r/ r : s z.OpenStackIdentity_3_0_Connection.list_projectsc C s$ | j ddd�}| j|jd d�}|S )zh List the available users. :rtype: ``list`` of :class:`.OpenStackIdentityUser` � /v3/usersr� r� Zusersr� )r� � _to_usersr� r� r. r. r/ � list_usersG s z+OpenStackIdentity_3_0_Connection.list_usersc C s$ | j ddd�}| j|jd d�}|S )zh List the available roles. :rtype: ``list`` of :class:`.OpenStackIdentityRole` z /v3/rolesr� r� r r� )r� r r� r� r. r. r/ � list_rolesQ s z+OpenStackIdentity_3_0_Connection.list_rolesc C s( | j d| dd�}| j|jd d�}|S )z� Retrieve information about a single domain. :param domain_id: ID of domain to retrieve information for. :type domain_id: ``str`` :rtype: :class:`.OpenStackIdentityDomain` z/v3/domains/%sr� r� r2 r� )r� � _to_domainr� )r< rG r� re r. r. r/ � get_domain[ s �z+OpenStackIdentity_3_0_Connection.get_domainc C s$ | � d| �}| j|jd d�}|S )z� Get a user account by ID. :param user_id: User's id. :type name: ``str`` :return: Located user. :rtype: :class:`.OpenStackIdentityUser` � /v3/users/%sr r� )r� �_to_userr� )r< r� r� r r. r. r/ �get_useri s z)OpenStackIdentity_3_0_Connection.get_userc C s. d|j }| j|dd�}| j|jd d�}|S )z| Retrieve all the projects user belongs to. :rtype: ``list`` of :class:`.OpenStackIdentityProject` z/v3/users/%s/projectsr� r� r r� )rB r� r� r� )r< r �pathr� re r. r. r/ �list_user_projectsw s z3OpenStackIdentity_3_0_Connection.list_user_projectsc C s4 d|j |j f }| j|dd�}| j|jd d�}|S )z� Retrieve all the roles for a particular user on a domain. :rtype: ``list`` of :class:`.OpenStackIdentityRole` z /v3/domains/%s/users/%s/rolesr� r� r r� )rB r� r r� )r< r2 r r* r� re r. r. r/ �list_user_domain_roles� s z7OpenStackIdentity_3_0_Connection.list_user_domain_rolesc C s. d|j |j |j f }| j|dd�}|jtjkS )a� Grant domain role to a user. Note: This function appears to be idempotent. :param domain: Domain to grant the role to. :type domain: :class:`.OpenStackIdentityDomain` :param role: Role to grant. :type role: :class:`.OpenStackIdentityRole` :param user: User to grant the role to. :type user: :class:`.OpenStackIdentityUser` :return: ``True`` on success. :rtype: ``bool`` � /v3/domains/%s/users/%s/roles/%s�PUTr� �rB r� r9 r r� )r< r2 �roler r* r� r. r. r/ �grant_domain_role_to_user� s �z:OpenStackIdentity_3_0_Connection.grant_domain_role_to_userc C s. d|j |j |j f }| j|dd�}|jtjkS )a� Revoke domain role from a user. :param domain: Domain to revoke the role from. :type domain: :class:`.OpenStackIdentityDomain` :param role: Role to revoke. :type role: :class:`.OpenStackIdentityRole` :param user: User to revoke the role from. :type user: :class:`.OpenStackIdentityUser` :return: ``True`` on success. :rtype: ``bool`` r- �DELETEr� r/ )r< r2 r r0 r* r� r. r. r/ � revoke_domain_role_from_user� s �z=OpenStackIdentity_3_0_Connection.revoke_domain_role_from_userc C s. d|j |j |j f }| j|dd�}|jtjkS )a� Grant project role to a user. Note: This function appears to be idempotent. :param project: Project to grant the role to. :type project: :class:`.OpenStackIdentityDomain` :param role: Role to grant. :type role: :class:`.OpenStackIdentityRole` :param user: User to grant the role to. :type user: :class:`.OpenStackIdentityUser` :return: ``True`` on success. :rtype: ``bool`` �!/v3/projects/%s/users/%s/roles/%sr. r� r/ �r< r1 r0 r r* r� r. r. r/ �grant_project_role_to_user� s �z;OpenStackIdentity_3_0_Connection.grant_project_role_to_userc C s. d|j |j |j f }| j|dd�}|jtjkS )a� Revoke project role from a user. :param project: Project to revoke the role from. :type project: :class:`.OpenStackIdentityDomain` :param role: Role to revoke. :type role: :class:`.OpenStackIdentityRole` :param user: User to revoke the role from. :type user: :class:`.OpenStackIdentityUser` :return: ``True`` on success. :rtype: ``bool`` r4 r2 r� r/ r5 r. r. r/ � revoke_project_role_from_user� s �z>OpenStackIdentity_3_0_Connection.revoke_project_role_from_userTc C sf ||||d�}|r||d< |r&||d< |r2||d< t �d|i�}| jd|dd�} | j| jd d �} | S ) a� Create a new user account. :param email: User's mail address. :type email: ``str`` :param password: User's password. :type password: ``str`` :param name: User's name. :type name: ``str`` :param description: Optional description. :type description: ``str`` :param domain_id: ID of the domain to add the user to (optional). :type domain_id: ``str`` :param default_project_id: ID of the default user project (optional). :type default_project_id: ``str`` :param enabled: True to enable user after creation. :type enabled: ``bool`` :return: Created user. :rtype: :class:`.OpenStackIdentityUser` )rJ r� rC rD rF rG �default_project_idr r! r� �r� r� r� )r� r� r� r( r� ) r< rJ r� rC rF rG r8 rD r� r� r r. r. r/ � create_user� s" ��z,OpenStackIdentity_3_0_Connection.create_userc C sB ddi}t �d|i�}| jd|j |dd�}| j|jd d�}|S )a Enable user account. Note: This operation appears to be idempotent. :param user: User to enable. :type user: :class:`.OpenStackIdentityUser` :return: User account which has been enabled. :rtype: :class:`.OpenStackIdentityUser` rD Tr r' �PATCHr9 r� �r� r� r� rB r( r� �r< r r� r� r. r. r/ � enable_user s � �z,OpenStackIdentity_3_0_Connection.enable_userc C sB ddi}t �d|i�}| jd|j |dd�}| j|jd d�}|S )a" Disable user account. Note: This operation appears to be idempotent. :param user: User to disable. :type user: :class:`.OpenStackIdentityUser` :return: User account which has been disabled. :rtype: :class:`.OpenStackIdentityUser` rD Fr r' r; r9 r� r< r= r. r. r/ � disable_user2 s � �z-OpenStackIdentity_3_0_Connection.disable_userc C s( g }|D ]}| j |d�}|�|� q|S r� )r% rc )r< r� re r� r2 r. r. r/ r I s z,OpenStackIdentity_3_0_Connection._to_domainsc C s t |d |d |d d�}|S )NrB rC rD rA )r )r< r� r2 r. r. r/ r% Q s �z+OpenStackIdentity_3_0_Connection._to_domainc C s( g }|D ]}| j |d�}|�|� q|S r� )r( rc �r< r� re r� r r. r. r/ r" W s z*OpenStackIdentity_3_0_Connection._to_usersc C s8 t |d |d |d |�d�|�dd �|�d�d�}|S )NrB rG rC rJ rF rD rI )r rz )r< r� r r. r. r/ r( _ s ��z)OpenStackIdentity_3_0_Connection._to_userc C s( g }|D ]}| j |d�}|�|� q|S r� )�_to_rolerc r@ r. r. r/ r i s z*OpenStackIdentity_3_0_Connection._to_rolesc C s, t |d |d |�dd �|�dd�d�}|S )NrB rC rF rD TrH )r rz )r< r� r0 r. r. r/ rA q s � �z)OpenStackIdentity_3_0_Connection._to_role)F)NNNT)%r' r( r) r* r� r� rC r] r0 r3 r4 r5 r r= r� r r r# r$ r& r) r+ r, r1 r3 r6 r7 r: r> r? r r% r" r( r rA r� r. r. r� r/ r! � sJ ��- ^ � 4 r! c @ s6 e Zd ZdZeZdZdZd dd�Zdd� Z d d � Z d S ) r" a Connection class for Keystone API v3.x. using OpenID Connect tokens The OIDC token must be set in the self.key attribute. The identity provider name required to get the full path must be set in the self.user_id attribute. The protocol name required to get the full path must be set in the self.tenant_name attribute. The self.domain_name attribute can be used either to select the domain name in case of domain scoped token or to select the project name in case of project scoped token z-OpenStack Identity API v3.x with OIDC supportr Fc C s | j |d�s| S | �� }dddgd|id�ii}| jtjkr^| j|d�}dd|ii|d d < n:| jtjkr�d d | jii|d d < n| jtjkr�nt d ��t � |�}| j d |ddidd�}|j tjkr�t� ��n>|j tjtjfv �r�|j}zt �|j�}W n0 t�y( } ztd|��W Y d}~n d}~0 0 z| �|d d �} W n t�yX g } Y n0 zN|d d } |d | _t| �| _|d � dd�| _ |d � dd�| _ | | _ W n0 t �y� } ztd|��W Y d}~n d}~0 0 d|j |jf }n d|j |jf }td|| j!d ��| S ) r r� r� r r� rB )r r� )r� r1 r r2 rC r r r� r� r� r� r� Nr r r r r r� r� r� r� )"r� �#_get_unscoped_token_from_oidc_tokenr� r0 r3 �_get_project_idr4 r� r5 rl r� r� r� r9 r r� r r� r� r� r� r� r� r r r� r r� rz r� r� r r� r� ) r< r� Z subject_tokenr� Z project_idr� r� r� r� r r� r. r. r/ r� � sv ���� �� �� � ��z?OpenStackIdentity_3_0_Connection_OIDC_access_token.authenticatec C s� d| j | jf }| j|dd| j d�dd�}|jtjkr@t� �nH|jtjtj fv rvd|j v rf|j d S t d| j d ��nt d | j |j d ��d S ) z; Get unscoped token from OIDC access token z9/v3/OS-FEDERATION/identity_providers/%s/protocols/%s/authr� z Bearer %s)r� � Authorizationr� r� r zNo x-subject-token returnedr� r� �r� r� N)r� r� r� rV r9 r r� r r� r� r� r r� r� )r< r* r� r. r. r/ rB � s. ���� ��zVOpenStackIdentity_3_0_Connection_OIDC_access_token._get_unscoped_token_from_oidc_tokenc C sX d}| j |d|d�dd�}|jtjtjtjfvrJd}| j |d|d�dd�}|jtjkr^t� �n�|jtjtjfv �rBztt�|j �}| j r�| j dkr�|d D ](}| j |d |d fv r�|d W S q�t d | j ��n|d d d W S W nX t �y } z|�W Y d }~n8d }~0 t �y> } zt d|��W Y d }~n d }~0 0 nt d| j|j d��d S )zU Get the first project ID accessible with the specified access token z/v3/auth/projectsr� )r� r� r� r� z/v3/OS-FEDERATION/projectsr� r rC rB zProject %s not foundr Nr� r� rE )r� r9 r r� r� r� r r� r� r� r� rl r� r r� )r< r� r* r� r� r1 r� r. r. r/ rC � sP �� ��� ��"�zBOpenStackIdentity_3_0_Connection_OIDC_access_token._get_project_idN)F) r' r( r) r* r� r� rC r] r� rB rC r. r. r. r/ r" z s Rr" c @ sV e Zd ZdZeZdZdZddej dddfdd�Z dd d �Z d d � Z d d� Z dd� ZdS )r z� Connection class for Keystone API v2.0. with VOMS proxy support In this case the key parameter will be the path of the VOMS proxy file. z(OpenStack Identity API v2.0 VOMS supportr Nr� c C sv t j| ||||d� | | _| r0| j| _| j| _nd | _|| _|| _|| _|| _|| _ || _ i | _ d | _ d | _ d | _d S )N)� cert_filer; r� r� )r r= r� r� r� r� r� r� r� r� r� r� r� r� r� ) r< r� r� rV r� r� r� r� r� r� r. r. r/ r= 7 s( � z.OpenStackIdentity_2_0_Connection_VOMS.__init__Fc C sN | j |d�s| S | j}|s,| �� }| �|�}dd|d�i}t�|�}| �|�S )Nr� r� T)�vomsr )r� r� �_get_unscoped_token�_get_tenant_namer� r� r )r< r� Ztenantr� r� r� r. r. r/ r� U s z2OpenStackIdentity_2_0_Connection_VOMS.authenticatec C s� dddii}t �|�}| jd|ddidd�}|jtjkr@t� �nt|jtjtjfv r�z t � |j �}|d d d W S t y� } zt d |��W Y d }~q�d }~0 0 nt d| j |j d��d S )z4 Get unscoped token from VOMS proxy r� rG Tr r� r� r� r� r r� rB r� Nr� rE )r� r� r� r9 r r� r r� r� r� r� r� r r� )r< r� r� r� r� r� r. r. r/ rH d s$ � "�z9OpenStackIdentity_2_0_Connection_VOMS._get_unscoped_tokenc C s� dd|d�}| j d|dd�}|jtjkr0t� �nt|jtjtjfv r�z t�|j �}|d d d W S t y� } zt d |��W Y d }~q�d }~0 0 nt d | j |j d ��d S ) zR Get the first available tenant name (usually there are only one) r� )r� r� r� r r� r� r r rC r� Nr� rE ) r� r9 r r� r r� r� r� r� r� r� r r� )r< r� r� r� r� r� r. r. r/ rI } s" � "�z6OpenStackIdentity_2_0_Connection_VOMS._get_tenant_namec C s� | j d|ddidd�}|jtjkr*t� �n�|jtjtjfvr^d|j|jf }td|| j d��n~|j }zH|d }|d d }|d d | _ t |�| _ |d | _|�di �| _W n. ty� } ztd|��W Y d }~n d }~0 0 | S r r r r. r. r/ r � s4 � �� �zAOpenStackIdentity_2_0_Connection_VOMS._authenticate_2_0_with_body)F)r' r( r) r* r� r� rC r] r0 r3 r= r� rH rI r r. r. r. r/ r , s � r c C sz | dkrt }nh| dkr t}nZ| dks,| dkr2t}nD| dkr@t}n6| dkrNt}n(| dkr\t}n| dkrjt}n td | ��|S ) z7 Retrieve class for the provided auth version. rL r r r r r r r z&Unsupported Auth Version requested: %s)r r r r r! r" r )r] �clsr. r. r/ r# � s$ �r# ))r* r� Zlibcloud.utils.py3r Zlibcloud.utils.iso8601r Zlibcloud.common.baser r r Zlibcloud.compute.typesr r r Z simplejsonr� � ImportErrorr� r� r� �__all__r� r r0 r r r r r r r r r� r r r r r! r" r r# r. r. r. r/ �<module> sX &!&( 01-Q g � 3 �
| ver. 1.1 | |
.
| PHP 8.3.30 | Ð“ÐµÐ½ÐµÑ€Ð°Ñ†Ð¸Ñ Ñтраницы: 0 |
proxy
|
phpinfo
|
ÐаÑтройка