"""Make a request.

"""This object is a temporary hack that should be removed later.

def request(self, *args, **kwargs):

"""A wrapper layer to interface keystoneclient with a session.

@property

def user_id(self):

"""Best effort to retrieve the user_id from the plugin.

# the identity plugin case

try:

return self.session.auth.get_access(self.session).user_id

except AttributeError: # nosec(cjschaef): attempt legacy retrival, or

# return None

pass

# there is a case that we explicitly allow (tested by our unit tests)

# that says you should be able to set the user_id on a legacy client

# and it should overwrite the one retrieved via authentication. If it's

# a legacy then self.session.auth is a client and we retrieve user_id.

try:

return self.session.auth.user_id

except AttributeError: # nosec(cjschaef): retrivals failed, return

# None

pass

"""HTTP client.

version = None

@renames.renamed_kwarg('tenant_name', 'project_name', version='1.7.0',

@renames.renamed_kwarg('tenant_id', 'project_id', version='1.7.0',

def __init__(self, username=None, tenant_id=None, tenant_name=None,

password=None, auth_url=None, region_name=None, endpoint=None,

token=None, auth_ref=None, use_keyring=False,

force_new_token=False, stale_duration=None, user_id=None,

user_domain_id=None, user_domain_name=None, domain_id=None,

domain_name=None, project_id=None, project_name=None,

project_domain_id=None, project_domain_name=None,

trust_id=None, session=None, service_name=None,

interface='default', endpoint_override=None, auth=None,

user_agent=USER_AGENT, connect_retries=None, **kwargs):

# set baseline defaults

self.user_id = None

self.username = None

self.user_domain_id = None

self.user_domain_name = None

self.domain_id = None

self.domain_name = None

self.project_id = None

self.project_name = None

self.project_domain_id = None

self.project_domain_name = None

self.auth_url = None

self._endpoint = None

self._management_url = None

self.trust_id = None

# if loading from a dictionary passed in via auth_ref,

# load values from AccessInfo parsing that dictionary

if auth_ref:

self.auth_ref = access.AccessInfo.factory(**auth_ref)

self.version = self.auth_ref.version

self.user_id = self.auth_ref.user_id

self.username = self.auth_ref.username

self.user_domain_id = self.auth_ref.user_domain_id

self.domain_id = self.auth_ref.domain_id

self.domain_name = self.auth_ref.domain_name

self.project_id = self.auth_ref.project_id

self.project_name = self.auth_ref.project_name

self.project_domain_id = self.auth_ref.project_domain_id

auth_urls = self.auth_ref.service_catalog.get_urls(

service_type='identity', endpoint_type='public',

region_name=region_name)

self.auth_url = auth_urls[0]

management_urls = self.auth_ref.service_catalog.get_urls(

service_type='identity', endpoint_type='admin',

region_name=region_name)

self._management_url = management_urls[0]

self.auth_token_from_user = self.auth_ref.auth_token

self.trust_id = self.auth_ref.trust_id

# TODO(blk-u): Using self.auth_ref.service_catalog._region_name is

# deprecated and this code must be removed when the property is

# actually removed.

if self.auth_ref.has_service_catalog() and not region_name:

region_name = self.auth_ref.service_catalog._region_name

else:

self.auth_ref = None

# allow override of the auth_ref defaults from explicit

# values provided to the client

# apply deprecated variables first, so modern variables override them

if tenant_id:

self.project_id = tenant_id

if tenant_name:

self.project_name = tenant_name

# user-related attributes

self.password = password

if user_id:

self.user_id = user_id

if username:

self.username = username

if user_domain_id:

self.user_domain_id = user_domain_id

elif not (user_id or user_domain_name):

self.user_domain_id = 'default'

if user_domain_name:

self.user_domain_name = user_domain_name

# domain-related attributes

if domain_id:

self.domain_id = domain_id

if domain_name:

self.domain_name = domain_name

# project-related attributes

if project_id:

self.project_id = project_id

if project_name:

self.project_name = project_name

if project_domain_id:

self.project_domain_id = project_domain_id

elif not (project_id or project_domain_name):

self.project_domain_id = 'default'

if project_domain_name:

self.project_domain_name = project_domain_name

# trust-related attributes

if trust_id:

self.trust_id = trust_id

# endpoint selection

if auth_url:

self.auth_url = auth_url.rstrip('/')

if token:

self.auth_token_from_user = token

else:

self.auth_token_from_user = None

if endpoint:

self._endpoint = endpoint.rstrip('/')

self._auth_token = None

if not session:

warnings.warn(

'Constructing an HTTPClient instance without using a session '

'is deprecated as of the 1.7.0 release and may be removed in '

'the 2.0.0 release.', DeprecationWarning)

kwargs['session'] = _FakeRequestSession()

session = client_session.Session._construct(kwargs)

session.auth = self

self.session = session

self.domain = ''

version = (

_discover.normalize_version_number(self.version) if self.version

else None)

# NOTE(frickler): If we know we have v3, use the public interface as

# default, otherwise keep the historic default of admin

if interface == 'default':

if version == (3, 0):

interface = 'public'

else:

interface = 'admin'

# NOTE(jamielennox): unfortunately we can't just use **kwargs here as

# it would incompatibly limit the kwargs that can be passed to __init__

# try and keep this list in sync with adapter.Adapter.__init__

self._adapter = _KeystoneAdapter(session,

service_type='identity',

service_name=service_name,

interface=interface,

region_name=region_name,

endpoint_override=endpoint_override,

version=version,

auth=auth,

user_agent=user_agent,

connect_retries=connect_retries)

# NOTE(dstanek): This allows me to not have to change keystoneauth or

# to write an adapter to the adapter here. Splitting thing into

# multiple project isn't always all sunshine and roses.

self._adapter.include_metadata = kwargs.pop('include_metadata', False)

# keyring setup

if use_keyring and keyring is None:

_logger.warning('Failed to load keyring modules.')

self.use_keyring = use_keyring and keyring is not None

self.force_new_token = force_new_token

self.stale_duration = stale_duration or access.STALE_TOKEN_DURATION

self.stale_duration = int(self.stale_duration)

def get_token(self, session, **kwargs):

return self.auth_token

@property

def auth_token(self):

if self._auth_token:

return self._auth_token

if self.auth_ref:

if self.auth_ref.will_expire_soon(self.stale_duration):

self.authenticate()

return self.auth_ref.auth_token

if self.auth_token_from_user:

return self.auth_token_from_user

def get_endpoint(self, session, interface=None, **kwargs):

if interface == 'public' or interface is base.AUTH_INTERFACE:

return self.auth_url

else:

return self.management_url

def get_user_id(self, session, **kwargs):

return self.auth_ref.user_id

def get_project_id(self, session, **kwargs):

return self.auth_ref.project_id

@auth_token.setter

def auth_token(self, value):

"""Override the auth_token.

self._auth_token = value

@auth_token.deleter

def auth_token(self):

self._auth_token = None

self.auth_token_from_user = None

@property

def service_catalog(self):

"""Return this client's service catalog."""

try:

return self.auth_ref.service_catalog

except AttributeError:

return None

def has_service_catalog(self):

"""Return True if this client provides a service catalog."""

return self.auth_ref and self.auth_ref.has_service_catalog()

@property

def tenant_id(self):

"""Provide read-only backwards compatibility for tenant_id.

warnings.warn(

'tenant_id is deprecated as of the 1.7.0 release in favor of '

'project_id and may be removed in the 2.0.0 release.',

DeprecationWarning)

return self.project_id

@property

def tenant_name(self):

"""Provide read-only backwards compatibility for tenant_name.

warnings.warn(

'tenant_name is deprecated as of the 1.7.0 release in favor of '

'project_name and may be removed in the 2.0.0 release.',

DeprecationWarning)

return self.project_name

def authenticate(self, username=None, password=None, tenant_name=None,

tenant_id=None, auth_url=None, token=None,

user_id=None, domain_name=None, domain_id=None,

project_name=None, project_id=None, user_domain_id=None,

user_domain_name=None, project_domain_id=None,

project_domain_name=None, trust_id=None,

region_name=None):

"""Authenticate user.

auth_url = auth_url or self.auth_url

user_id = user_id or self.user_id

username = username or self.username

password = password or self.password

user_domain_id = user_domain_id or self.user_domain_id

user_domain_name = user_domain_name or self.user_domain_name

domain_id = domain_id or self.domain_id

domain_name = domain_name or self.domain_name

project_id = project_id or tenant_id or self.project_id

project_name = project_name or tenant_name or self.project_name

project_domain_id = project_domain_id or self.project_domain_id

project_domain_name = project_domain_name or self.project_domain_name

trust_id = trust_id or self.trust_id

region_name = region_name or self._adapter.region_name

if not token:

token = self.auth_token_from_user

if (not token and self.auth_ref and not

self.auth_ref.will_expire_soon(self.stale_duration)):

token = self.auth_ref.auth_token

kwargs = {

'auth_url': auth_url,

'user_id': user_id,

'username': username,

'user_domain_id': user_domain_id,

'user_domain_name': user_domain_name,

'domain_id': domain_id,

'domain_name': domain_name,

'project_id': project_id,

'project_name': project_name,

'project_domain_id': project_domain_id,

'project_domain_name': project_domain_name,

'token': token,

'trust_id': trust_id,

}

(keyring_key, auth_ref) = self.get_auth_ref_from_keyring(**kwargs)

new_token_needed = False

if auth_ref is None or self.force_new_token:

new_token_needed = True

kwargs['password'] = password

resp = self.get_raw_token_from_identity_service(**kwargs)

if isinstance(resp, access.AccessInfo):

self.auth_ref = resp

else:

self.auth_ref = access.AccessInfo.factory(*resp)

# NOTE(jamielennox): The original client relies on being able to

# push the region name into the service catalog but new auth

# it in.

if region_name:

self.auth_ref.service_catalog._region_name = region_name

else:

self.auth_ref = auth_ref

self.process_token(region_name=region_name)

if new_token_needed:

self.store_auth_ref_into_keyring(keyring_key)

return True

def _build_keyring_key(self, **kwargs):

"""Create a unique key for keyring.

return '/'.join([kwargs[k] or '?' for k in sorted(kwargs)])

def get_auth_ref_from_keyring(self, **kwargs):

"""Retrieve auth_ref from keyring.

keyring_key = None

auth_ref = None

if self.use_keyring:

keyring_key = self._build_keyring_key(**kwargs)

try:

auth_ref = keyring.get_password("keystoneclient_auth",

keyring_key)

if auth_ref:

auth_ref = pickle.loads(auth_ref) # nosec(cjschaef): see

# bug 1534288

if auth_ref.will_expire_soon(self.stale_duration):

# token has expired, don't use it

auth_ref = None

except Exception as e:

auth_ref = None

_logger.warning('Unable to retrieve token from keyring %s', e)

return (keyring_key, auth_ref)

def store_auth_ref_into_keyring(self, keyring_key):

"""Store auth_ref into keyring."""

if self.use_keyring:

try:

keyring.set_password("keystoneclient_auth",

keyring_key,

pickle.dumps(self.auth_ref)) # nosec

# (cjschaef): see bug 1534288

except Exception as e:

_logger.warning("Failed to store token into keyring %s", e)

def _process_management_url(self, region_name):

try:

self._management_url = self.auth_ref.service_catalog.url_for(

service_type='identity',

endpoint_type='admin',

region_name=region_name)

except exceptions.EndpointNotFound as e:

_logger.debug("Failed to find endpoint for management url %s", e)

def process_token(self, region_name=None):

"""Extract and process information from the new auth_ref.

# if we got a response without a service catalog, set the local

# list of tenants for introspection, and leave to client user

# to determine what to do. Otherwise, load up the service catalog

if self.auth_ref.project_scoped:

if not self.auth_ref.tenant_id:

raise exceptions.AuthorizationFailure(

_("Token didn't provide tenant_id"))

self._process_management_url(region_name)

self.project_name = self.auth_ref.tenant_name

self.project_id = self.auth_ref.tenant_id

if not self.auth_ref.user_id:

raise exceptions.AuthorizationFailure(

_("Token didn't provide user_id"))

self.user_id = self.auth_ref.user_id

self.auth_domain_id = self.auth_ref.domain_id

self.auth_tenant_id = self.auth_ref.tenant_id

self.auth_user_id = self.auth_ref.user_id

@property

def management_url(self):

return self._endpoint or self._management_url

@management_url.setter

def management_url(self, value):

# NOTE(jamielennox): it's debatable here whether we should set

# _endpoint or _management_url. As historically management_url was set

# permanently setting _endpoint would better match that behaviour.

self._endpoint = value

def get_raw_token_from_identity_service(self, auth_url, username=None,

password=None, tenant_name=None,

tenant_id=None, token=None,

user_id=None, user_domain_id=None,

user_domain_name=None,

domain_id=None, domain_name=None,

project_id=None, project_name=None,

project_domain_id=None,

project_domain_name=None,

trust_id=None):

"""Authenticate against the Identity API and get a token.

raise NotImplementedError

def serialize(self, entity):

return jsonutils.dumps(entity)

@removals.remove(version='1.7.0', removal_version='2.0.0')

def request(self, *args, **kwargs):

"""Send an http request with the specified characteristics.

return self._request(*args, **kwargs)

def _request(self, *args, **kwargs):

kwargs.setdefault('authenticated', False)

return self._adapter.request(*args, **kwargs)

def _cs_request(self, url, method, management=True, **kwargs):

"""Make an authenticated request to keystone endpoint.

if not management:

endpoint_filter = kwargs.setdefault('endpoint_filter', {})

endpoint_filter.setdefault('interface', 'public')

kwargs.setdefault('authenticated', None)

return self._request(url, method, **kwargs)

@removals.remove(version='1.7.0', removal_version='2.0.0')

def get(self, url, **kwargs):

"""Perform an authenticated GET request.

return self._cs_request(url, 'GET', **kwargs)

@removals.remove(version='1.7.0', removal_version='2.0.0')

def head(self, url, **kwargs):

"""Perform an authenticated HEAD request.

return self._cs_request(url, 'HEAD', **kwargs)

@removals.remove(version='1.7.0', removal_version='2.0.0')

def post(self, url, **kwargs):

"""Perform an authenticate POST request.

return self._cs_request(url, 'POST', **kwargs)

@removals.remove(version='1.7.0', removal_version='2.0.0')

def put(self, url, **kwargs):

"""Perform an authenticate PUT request.

return self._cs_request(url, 'PUT', **kwargs)

@removals.remove(version='1.7.0', removal_version='2.0.0')

def patch(self, url, **kwargs):

"""Perform an authenticate PATCH request.

return self._cs_request(url, 'PATCH', **kwargs)

@removals.remove(version='1.7.0', removal_version='2.0.0')

def delete(self, url, **kwargs):

"""Perform an authenticate DELETE request.

return self._cs_request(url, 'DELETE', **kwargs)

deprecated_session_variables = {'original_ip': None,

'cert': None,

'timeout': None,

'verify_cert': 'verify'}

deprecated_adapter_variables = {'region_name': None}

def __getattr__(self, name):

"""Fetch deprecated session variables."""

try:

var_name = self.deprecated_session_variables[name]

except KeyError: # nosec(cjschaef): try adapter variable or raise

# an AttributeError

pass

else:

warnings.warn(

'The %s session variable is deprecated as of the 1.7.0 '

'release and may be removed in the 2.0.0 release' % name,

DeprecationWarning)

return getattr(self.session, var_name or name)

try:

var_name = self.deprecated_adapter_variables[name]

except KeyError: # nosec(cjschaef): raise an AttributeError

pass

else:

warnings.warn(

'The %s adapter variable is deprecated as of the 1.7.0 '

'release and may be removed in the 2.0.0 release' % name,

DeprecationWarning)

return getattr(self._adapter, var_name or name)

raise AttributeError(_("Unknown Attribute: %s") % name)

def __setattr__(self, name, val):

"""Assign value to deprecated seesion variables."""

try:

var_name = self.deprecated_session_variables[name]

except KeyError: # nosec(cjschaef): try adapter variable or call

# parent class's __setattr__

pass

else:

warnings.warn(

'The %s session variable is deprecated as of the 1.7.0 '

'release and may be removed in the 2.0.0 release' % name,

DeprecationWarning)

return setattr(self.session, var_name or name)

try:

var_name = self.deprecated_adapter_variables[name]

except KeyError: # nosec(cjschaef): call parent class's __setattr__

pass

else:

warnings.warn(

'The %s adapter variable is deprecated as of the 1.7.0 '

'release and may be removed in the 2.0.0 release' % name,

DeprecationWarning)

return setattr(self._adapter, var_name or name)