WARNING: This code is deprecated and will be removed. Keystone is the recommended solution for auth management.
Nova authentication management
Bases: object
Base class for objects relating to auth
Objects derived from this class should be stupid data objects with an id member. They may optionally contain methods that delegate to AuthManager, but should not implement logic themselves.
Safely get object id.
This method will return the id of the object if the object is of this class, otherwise it will return the original object. This allows methods to accept objects or ids as paramaters.
Bases: object
Manager Singleton for dealing with Users, Projects, and Keypairs
Methods accept objects or ids.
AuthManager uses a driver object to make requests to the data backend. See ldapdriver for reference.
AuthManager also manages associated data related to Auth objects that need to be more accessible, such as vpn ips and ports.
Adds role for user
If project is not specified, adds a global role. If project is specified, adds a local role.
The ‘projectmanager’ role is special and can’t be added or removed.
@type user: User or uid @param user: User to which to add role.
@type role: str @param role: Role to add.
@type project: Project or project_id @param project: Project in which to add local role.
Add user to project
Authenticates AWS request using access key and signature
If the project is not specified, attempts to authenticate to a project with the same name as the user. This way, older tools that have no project knowledge will still work.
@type access: str @param access: Access key for user in the form “access:project”.
@type signature: str @param signature: Signature of the request.
@type params: list of str @param params: Web paramaters used for the signature.
@type verb: str @param verb: Web request verb (‘GET’ or ‘POST’).
@type server_string: str @param server_string: Web request server string.
@type path: str @param path: Web request path.
@type check_type: str @param check_type: Type of signature to check. ‘ec2’ for EC2, ‘s3’ for
S3. Any other value will cause signature not to be checked.
@type headers: list @param headers: HTTP headers passed with the request (only needed for
s3 signature checks)
@rtype: tuple (User, Project) @return: User and project that the request represents.
Create a project
@type name: str @param name: Name of the project to create. The name will also be used as the project id.
@type manager_user: User or uid @param manager_user: This user will be the project manager.
@type description: str @param project: Description of the project. If no description is specified, the name of the project will be used.
@type member_users: list of User or uid @param: Initial project members. The project manager will always be added as a member, even if he isn’t specified in this list.
@rtype: Project @return: The new project.
Creates a user
@type name: str @param name: Name of the user to create.
@type access: str @param access: Access Key (defaults to a random uuid)
@type secret: str @param secret: Secret Key (defaults to a random uuid)
@type admin: bool @param admin: Whether to set the admin flag. The admin flag gives superuser status regardless of roles specifed for the user.
@type create_project: bool @param: Whether to create a project for the user with the same name.
@rtype: User @return: The new user.
Deletes a project
Deletes a user
Additionally deletes all users key_pairs
Get an access key that includes user and project
Get all active roles for context
Get credential zip for user in project
Get environment rc for user in project
Get project object by id
Gets vpn ip and port for project
@type project: Project or project_id @param project: Project from which to get associated vpn data
@rvalue: tuple of (str, str) @return: A tuple containing (ip, port) or None, None if vpn has not been allocated for user.
Retrieves list of projects, optionally filtered by user
Get list of allowed roles
Retrieves a user by id
Retrieves a user by access key
Get user global or per-project roles
Retrieves a list of all users
Checks existence of role for user
If project is not specified, checks for a global role. If project is specified, checks for the union of the global role and the project role.
Role ‘projectmanager’ only works for projects and simply checks to see if the user is the project_manager of the specified project. It is the same as calling is_project_manager(user, project).
@type user: User or uid @param user: User to check.
@type role: str @param role: Role to check.
@type project: Project or project_id @param project: Project in which to look for local role.
@rtype: bool @return: True if the user has the role.
Checks for admin status, allowing user to access all projects
@type user: User or uid @param user: User to check.
@rtype: bool @return: True for admin.
Checks if user is project manager
Checks to see if user is a member of project
Checks for superuser status, allowing user to bypass authorization
@type user: User or uid @param user: User to check.
@rtype: bool @return: True for superuser.
Modify a project
@type name: Project or project_id @param project: The project to modify.
@type manager_user: User or uid @param manager_user: This user will be the new project manager.
@type description: str @param project: This will be the new description of the project.
Modify credentials for a user
Removes a user from a project
Removes role for user
If project is not specified, removes a global role. If project is specified, removes a local role.
The ‘projectmanager’ role is special and can’t be added or removed.
@type user: User or uid @param user: User from which to remove role.
@type role: str @param role: Role to remove.
@type project: Project or project_id @param project: Project in which to remove local role.
Bases: nova.auth.manager.AuthBase
Represents a Project returned from the datastore
Bases: nova.auth.manager.AuthBase
Object representing a user
The following attributes are defined: :id: A system identifier for the user. A string (for LDAP) :name: The user name, potentially in some more friendly format :access: The ‘username’ for EC2 authentication :secret: The ‘password’ for EC2 authenticatoin :admin: ???