keystoneauth1.identity.v3.k2k module

class keystoneauth1.identity.v3.k2k.Keystone2Keystone(base_plugin: keystoneauth1.identity.base.BaseIdentityPlugin, service_provider: str, *, trust_id: Optional[str] = None, system_scope: Optional[str] = None, domain_id: Optional[str] = None, domain_name: Optional[str] = None, project_id: Optional[str] = None, project_name: Optional[str] = None, project_domain_id: Optional[str] = None, project_domain_name: Optional[str] = None, reauthenticate: bool = True, include_catalog: bool = True)

Bases: keystoneauth1.identity.v3.federation._Rescoped

Plugin to execute the Keystone to Keyestone authentication flow.

In this plugin, an ECP wrapped SAML assertion provided by a keystone Identity Provider (IdP) is used to request an OpenStack unscoped token from a keystone Service Provider (SP).

Parameters
  • base_plugin (keystoneauth1.identity.v3.base.BaseAuth) – Auth plugin already authenticated against the keystone IdP.

  • service_provider (str) – The Service Provider ID as returned by ServiceProviderManager.list()

HTTP_MOVED_TEMPORARILY = 302
HTTP_SEE_OTHER = 303
REQUEST_ECP_URL = '/auth/OS-FEDERATION/saml2/ecp'

Path where the ECP wrapped SAML assertion should be presented to the Keystone Service Provider.

__abstractmethods__ = frozenset({})
__annotations__ = {'MIN_TOKEN_LIFE_SECONDS': 'int', '_discovery_cache': 'dict[str, discover.Discover]', 'auth_ref': 'ty.Optional[access.AccessInfo]', 'auth_url': <class 'str'>, 'reauthenticate': 'bool'}
__doc__ = 'Plugin to execute the Keystone to Keyestone authentication flow.\n\n In this plugin, an ECP wrapped SAML assertion provided by a keystone\n Identity Provider (IdP) is used to request an OpenStack unscoped token\n from a keystone Service Provider (SP).\n\n :param base_plugin: Auth plugin already authenticated against the keystone\n IdP.\n :type base_plugin: keystoneauth1.identity.v3.base.BaseAuth\n\n :param service_provider: The Service Provider ID as returned by\n ServiceProviderManager.list()\n :type service_provider: str\n\n '
__init__(base_plugin: keystoneauth1.identity.base.BaseIdentityPlugin, service_provider: str, *, trust_id: Optional[str] = None, system_scope: Optional[str] = None, domain_id: Optional[str] = None, domain_name: Optional[str] = None, project_id: Optional[str] = None, project_name: Optional[str] = None, project_domain_id: Optional[str] = None, project_domain_name: Optional[str] = None, reauthenticate: bool = True, include_catalog: bool = True)

Initialize self. See help(type(self)) for accurate signature.

__module__ = 'keystoneauth1.identity.v3.k2k'
_abc_impl = <_abc._abc_data object>
_discovery_cache: dict[str, discover.Discover]
_get_ecp_assertion(session: keystoneauth1.session.Session) → str
classmethod _remote_auth_url(auth_url: str) → str

Return auth_url of the remote Keystone Service Provider.

Remote cloud’s auth_url is an endpoint for getting federated unscoped token, typically that would be https://remote.example.com:5000/v3/OS-FEDERATION/identity_providers/ <idp>/protocols/<protocol_id>/auth. However we need to generate a real auth_url, used for token scoping. This function assumes there are static values today in the remote auth_url stored in the Service Provider attribute and those can be used as a delimiter. If the sp_auth_url doesn’t comply with standard federation auth url the function will simply return whole string.

Parameters

auth_url (str) – auth_url of the remote cloud

Returns

auth_url of remote cloud where a token can be validated or scoped.

Return type

str

_send_service_provider_ecp_authn_response(session: keystoneauth1.session.Session, sp_url: str, sp_auth_url: str) → requests.models.Response

Present ECP wrapped SAML assertion to the keystone SP.

The assertion is issued by the keystone IdP and it is targeted to the keystone that will serve as Service Provider.

Parameters
auth_ref: ty.Optional[access.AccessInfo]
auth_url: str
get_unscoped_auth_ref(session: keystoneauth1.session.Session) → keystoneauth1.access.access.AccessInfoV3

Fetch unscoped federated token.

reauthenticate: bool