keystone.credential.core module

Main entry point into the Credential service.

class keystone.credential.core.Manager

Bases: Manager

Default pivot point for the Credential backend.

See keystone.common.manager.Manager for more details on how this dynamically calls the backend.

create_credential(credential_id, credential, initiator=None)

Create a credential.

delete_credential(credential_id, initiator=None)

Delete a credential.

delete_credentials_for_project(project_id)

Delete all credentials for a project.

delete_credentials_for_user(user_id)

Delete all credentials for a user.

driver_namespace: str = 'keystone.credential'

get_credential(credential_id)

Return a credential reference.

list_credentials(hints=None)

list_credentials_for_user(user_id, type=None)

update_credential(credential_id, credential)

Update an existing credential.

Only blob is accepted here: the API layer’s PATCH schema enforces this (see LP#2159643 – retyping, rescoping, or reassigning a credential in place was a repeated source of security issues), so type, user_id, and project_id are never present in credential. There is currently no other caller of this method that passes those fields either (keystone-manage credential_migrate only ever passes blob). Do not reintroduce type/project_id/ user_id-specific validation here without also reintroducing a way for a caller to actually change them.