keystone.assignment.backends package

Submodules

keystone.assignment.backends.kvs module

class keystone.assignment.backends.kvs.Assignment(*args, **kwargs)

Bases: keystone.common.kvs.legacy.Base, keystone.assignment.core.Driver

KVS Assignment backend.

This backend uses the following mappings to store data:

• Domains:
  • domain_list -> [domain_id, ...]
  • domain-{id} -> domain_ref
  • domain_name-{name} -> domain_ref
• Projects:
  • tenant-{id} -> project_ref
  • tenant_name-{name} -> project_ref
• Roles:
  • role_list -> [role_id, ...]
  • role-{id} -> role_ref
• Role assignments:
  • metadata_user-{target}-{user_id} -> {‘roles’: [{‘id’: role-id, ...}, ...]}
  • metadata_group-{target}-{group_id} -> {‘roles’: [{‘id’: role-id, ...}, ...]}

add_role_to_user_and_project(user_id, tenant_id, role_id)

create_domain(domain_id, domain)

create_grant(role_id, user_id=None, group_id=None, domain_id=None, project_id=None, inherited_to_projects=False)

create_project(tenant_id, tenant)

create_role(role_id, role)

delete_domain(domain_id)

delete_grant(role_id, user_id=None, group_id=None, domain_id=None, project_id=None, inherited_to_projects=False)

delete_group(group_id)

Deletes all assignments for a group.

Raises:keystone.exception.RoleNotFound

delete_project(tenant_id)

delete_role(role_id)

delete_user(user_id)

Deletes all assignments for a user.

Raises:keystone.exception.RoleNotFound

get_domain(domain_id)

get_domain_by_name(domain_name)

get_grant(role_id, user_id=None, group_id=None, domain_id=None, project_id=None, inherited_to_projects=False)

get_group_project_roles(groups, project_id, project_domain_id)

get_project(tenant_id)

get_project_by_name(tenant_name, domain_id)

get_role(role_id)

get_roles_for_groups(group_ids, project_id=None, domain_id=None)

list_domains(hints)

list_domains_for_groups(group_ids)

list_domains_for_user(user_id, group_ids, hints)

list_grants(user_id=None, group_id=None, domain_id=None, project_id=None, inherited_to_projects=False)

list_projects(hints)

list_projects_for_groups(group_ids)

list_projects_for_user(user_id, group_ids, hints)

list_projects_in_domain(domain_id)

list_role_assignments()

List the role assignments.

We enumerate the metadata entries and extract the targets, actors, and roles.

list_roles(hints)

list_user_ids_for_project(tenant_id)

remove_role_from_user_and_project(user_id, tenant_id, role_id)

update_domain(domain_id, domain)

update_project(tenant_id, tenant)

update_role(role_id, role)

keystone.assignment.backends.ldap module

keystone.assignment.backends.sql module

class keystone.assignment.backends.sql.Assignment

Bases: keystone.assignment.core.Driver

add_role_to_user_and_project(user_id, tenant_id, role_id)

create_domain(*args, **kwargs)

create_grant(role_id, user_id=None, group_id=None, domain_id=None, project_id=None, inherited_to_projects=False)

create_project(*args, **kwargs)

create_role(*args, **kwargs)

delete_domain(domain_id)

delete_grant(role_id, user_id=None, group_id=None, domain_id=None, project_id=None, inherited_to_projects=False)

delete_group(group_id)

delete_project(*args, **kwargs)

delete_role(role_id)

delete_user(user_id)

get_domain(domain_id)

get_domain_by_name(domain_name)

get_grant(role_id, user_id=None, group_id=None, domain_id=None, project_id=None, inherited_to_projects=False)

get_group_project_roles(groups, project_id, project_domain_id)

get_project(tenant_id)

get_project_by_name(tenant_name, domain_id)

get_role(role_id)

get_roles_for_groups(group_ids, project_id=None, domain_id=None)

list_domains(hints, *args, **kwargs)

list_domains_for_groups(group_ids)

list_domains_for_user(user_id, group_ids, hints)

list_grants(user_id=None, group_id=None, domain_id=None, project_id=None, inherited_to_projects=False)

list_projects(hints, *args, **kwargs)

list_projects_for_groups(group_ids)

list_projects_for_user(user_id, group_ids, hints)

list_projects_in_domain(domain_id)

list_role_assignments()

list_roles(hints, *args, **kwargs)

list_user_ids_for_project(tenant_id)

remove_role_from_user_and_project(user_id, tenant_id, role_id)

update_domain(*args, **kwargs)

update_project(*args, **kwargs)

update_role(*args, **kwargs)

class keystone.assignment.backends.sql.AssignmentType

GROUP_DOMAIN = 'GroupDomain'

GROUP_PROJECT = 'GroupProject'

USER_DOMAIN = 'UserDomain'

USER_PROJECT = 'UserProject'

class keystone.assignment.backends.sql.Domain(*args, **kwargs)

Bases: sqlalchemy.ext.declarative.api.Base, keystone.common.sql.core.DictBase

attributes = ['id', 'name', 'enabled']

enabled

extra

id

name

class keystone.assignment.backends.sql.Project(*args, **kwargs)

Bases: sqlalchemy.ext.declarative.api.Base, keystone.common.sql.core.DictBase

attributes = ['id', 'name', 'domain_id', 'description', 'enabled']

description

domain_id

enabled

extra

id

name

class keystone.assignment.backends.sql.Role(*args, **kwargs)

Bases: sqlalchemy.ext.declarative.api.Base, keystone.common.sql.core.DictBase

attributes = ['id', 'name']

extra

id

name

class keystone.assignment.backends.sql.RoleAssignment(*args, **kwargs)

Bases: sqlalchemy.ext.declarative.api.Base, keystone.common.sql.core.DictBase

actor_id

attributes = ['type', 'actor_id', 'target_id', 'role_id', 'inherited']

inherited

role_id

target_id

to_dict()

Override parent to_dict() method with a simpler implementation.

RoleAssignment doesn’t have non-indexed ‘extra’ attributes, so the parent implementation is not applicable.

type

keystone.assignment.backends.sql.false()

Return a constant False_ construct.

E.g.:

>>> from sqlalchemy import false
>>> print select([t.c.x]).where(false())
SELECT x FROM t WHERE false

A backend which does not support true/false constants will render as an expression against 1 or 0:

>>> print select([t.c.x]).where(false())
SELECT x FROM t WHERE 0 = 1

The true() and false() constants also feature “short circuit” operation within an and_() or or_() conjunction:

>>> print select([t.c.x]).where(or_(t.c.x > 5, true()))
SELECT x FROM t WHERE true

>>> print select([t.c.x]).where(and_(t.c.x > 5, false()))
SELECT x FROM t WHERE false

Changed in version 0.9: true() and false() feature better integrated behavior within conjunctions and on dialects that don’t support true/false constants.

See also

true()

Module contents