This Page

Psst... hey. You're reading the latest content, but it might be out of sync with code. You can read Nova 2011.1 docs or all OpenStack docs too.

The nova.auth.manager Module

Nova authentication management

class nova.auth.manager.AuthBase

Bases: object

Base class for objects relating to auth

Objects derived from this class should be stupid data objects with an id member. They may optionally contain methods that delegate to AuthManager, but should not implement logic themselves.

classmethod safe_id(obj)

Safely get object id.

This method will return the id of the object if the object is of this class, otherwise it will return the original object. This allows methods to accept objects or ids as paramaters.

class nova.auth.manager.AuthManager(driver=None, *args, **kwargs)

Bases: object

Manager Singleton for dealing with Users, Projects, and Keypairs

Methods accept objects or ids.

AuthManager uses a driver object to make requests to the data backend. See ldapdriver for reference.

AuthManager also manages associated data related to Auth objects that need to be more accessible, such as vpn ips and ports.

add_role(user, role, project=None)

Adds role for user

If project is not specified, adds a global role. If project is specified, adds a local role.

The ‘projectmanager’ role is special and can’t be added or removed.

@type user: User or uid @param user: User to which to add role.

@type role: str @param role: Role to add.

@type project: Project or project_id @param project: Project in which to add local role.

add_to_project(user, project)

Add user to project

authenticate(access, signature, params, verb='GET', server_string='127.0.0.1:8773', path='/', check_type='ec2', headers=None)

Authenticates AWS request using access key and signature

If the project is not specified, attempts to authenticate to a project with the same name as the user. This way, older tools that have no project knowledge will still work.

@type access: str @param access: Access key for user in the form “access:project”.

@type signature: str @param signature: Signature of the request.

@type params: list of str @param params: Web paramaters used for the signature.

@type verb: str @param verb: Web request verb (‘GET’ or ‘POST’).

@type server_string: str @param server_string: Web request server string.

@type path: str @param path: Web request path.

@type check_type: str @param check_type: Type of signature to check. ‘ec2’ for EC2, ‘s3’ for

S3. Any other value will cause signature not to be checked.

@type headers: list @param headers: HTTP headers passed with the request (only needed for

s3 signature checks)

@rtype: tuple (User, Project) @return: User and project that the request represents.

create_project(name, manager_user, description=None, member_users=None)

Create a project

@type name: str @param name: Name of the project to create. The name will also be used as the project id.

@type manager_user: User or uid @param manager_user: This user will be the project manager.

@type description: str @param project: Description of the project. If no description is specified, the name of the project will be used.

@type member_users: list of User or uid @param: Initial project members. The project manager will always be added as a member, even if he isn’t specified in this list.

@rtype: Project @return: The new project.

create_user(name, access=None, secret=None, admin=False)

Creates a user

@type name: str @param name: Name of the user to create.

@type access: str @param access: Access Key (defaults to a random uuid)

@type secret: str @param secret: Secret Key (defaults to a random uuid)

@type admin: bool @param admin: Whether to set the admin flag. The admin flag gives superuser status regardless of roles specifed for the user.

@type create_project: bool @param: Whether to create a project for the user with the same name.

@rtype: User @return: The new user.

delete_project(project)

Deletes a project

delete_user(user)

Deletes a user

Additionally deletes all users key_pairs

get_access_key(user, project)

Get an access key that includes user and project

get_credentials(user, project=None, use_dmz=True)

Get credential zip for user in project

get_environment_rc(user, project=None, use_dmz=True)

Get credential zip for user in project

static get_key_pairs(context)
get_project(pid)

Get project object by id

static get_project_vpn_data(project)

Gets vpn ip and port for project

@type project: Project or project_id @param project: Project from which to get associated vpn data

@rvalue: tuple of (str, str) @return: A tuple containing (ip, port) or None, None if vpn has not been allocated for user.

get_projects(user=None)

Retrieves list of projects, optionally filtered by user

static get_roles(project_roles=True)

Get list of allowed roles

get_user(uid)

Retrieves a user by id

get_user_from_access_key(access_key)

Retrieves a user by access key

get_user_roles(user, project=None)

Get user global or per-project roles

get_users()

Retrieves a list of all users

has_role(user, role, project=None)

Checks existence of role for user

If project is not specified, checks for a global role. If project is specified, checks for the union of the global role and the project role.

Role ‘projectmanager’ only works for projects and simply checks to see if the user is the project_manager of the specified project. It is the same as calling is_project_manager(user, project).

@type user: User or uid @param user: User to check.

@type role: str @param role: Role to check.

@type project: Project or project_id @param project: Project in which to look for local role.

@rtype: bool @return: True if the user has the role.

is_admin(user)

Checks for admin status, allowing user to access all projects

@type user: User or uid @param user: User to check.

@rtype: bool @return: True for admin.

is_project_manager(user, project)

Checks if user is project manager

is_project_member(user, project)

Checks to see if user is a member of project

is_superuser(user)

Checks for superuser status, allowing user to bypass authorization

@type user: User or uid @param user: User to check.

@rtype: bool @return: True for superuser.

modify_project(project, manager_user=None, description=None)

Modify a project

@type name: Project or project_id @param project: The project to modify.

@type manager_user: User or uid @param manager_user: This user will be the new project manager.

@type description: str @param project: This will be the new description of the project.

modify_user(user, access_key=None, secret_key=None, admin=None)

Modify credentials for a user

remove_from_project(user, project)

Removes a user from a project

remove_role(user, role, project=None)

Removes role for user

If project is not specified, removes a global role. If project is specified, removes a local role.

The ‘projectmanager’ role is special and can’t be added or removed.

@type user: User or uid @param user: User from which to remove role.

@type role: str @param role: Role to remove.

@type project: Project or project_id @param project: Project in which to remove local role.

class nova.auth.manager.Project(id, name, project_manager_id, description, member_ids)

Bases: nova.auth.manager.AuthBase

Represents a Project returned from the datastore

add_role(user, role)
get_credentials(user)
has_manager(user)
has_member(user)
has_role(user, role)
project_manager
remove_role(user, role)
vpn_ip
vpn_port
class nova.auth.manager.User(id, name, access, secret, admin)

Bases: nova.auth.manager.AuthBase

Object representing a user

The following attributes are defined: :id: A system identifier for the user. A string (for LDAP) :name: The user name, potentially in some more friendly format :access: The ‘username’ for EC2 authentication :secret: The ‘password’ for EC2 authenticatoin :admin: ???

add_role(role)
has_role(role)
is_admin()
is_project_manager(project)
is_project_member(project)
is_superuser()
remove_role(role)