keystone.oauth1 package

keystone.oauth1 package

Submodules

keystone.oauth1.controllers module

Extensions supporting OAuth1.

class keystone.oauth1.controllers.AccessTokenCrudV3[source]

Bases: keystone.common.controller.V3Controller

collection_name = 'access_tokens'
delete_access_token(request, *args, **kwargs)[source]
get_access_token(request, *args, **kwargs)[source]
list_access_tokens(request, *args, **kwargs)[source]
member_name = 'access_token'
class keystone.oauth1.controllers.AccessTokenRolesV3[source]

Bases: keystone.common.controller.V3Controller

collection_name = 'roles'
get_access_token_role(request, *args, **kwargs)[source]
list_access_token_roles(request, *args, **kwargs)[source]
member_name = 'role'
class keystone.oauth1.controllers.ConsumerCrudV3[source]

Bases: keystone.common.controller.V3Controller

classmethod base_url(context, path=None)[source]

Construct a path and pass it to V3Controller.base_url method.

collection_name = 'consumers'
create_consumer(request, *args, **kwargs)[source]
delete_consumer(request, *args, **kwargs)[source]
get_consumer(request, *args, **kwargs)[source]
list_consumers(request, *args, **kwargs)[source]
member_name = 'consumer'
update_consumer(request, *args, **kwargs)[source]
class keystone.oauth1.controllers.OAuthControllerV3[source]

Bases: keystone.common.controller.V3Controller

authorize_request_token(request, *args, **kwargs)[source]

An authenticated user is going to authorize a request token.

As a security precaution, the requested roles must match those in the request token. Because this is in a CLI-only world at the moment, there is not another easy way to make sure the user knows which roles are being requested before authorizing.

collection_name = 'not_used'
create_access_token(request)[source]
create_request_token(request)[source]
member_name = 'not_used'

keystone.oauth1.core module

Main entry point into the OAuth1 service.

class keystone.oauth1.core.Manager[source]

Bases: keystone.common.manager.Manager

Default pivot point for the OAuth1 backend.

See keystone.common.manager.Manager for more details on how this dynamically calls the backend.

create_access_token(*args, **kwargs)[source]
create_consumer(*args, **kwargs)[source]
create_request_token(*args, **kwargs)[source]
delete_access_token(*args, **kwargs)[source]
delete_consumer(*args, **kwargs)[source]
driver_namespace = 'keystone.oauth1'
update_consumer(*args, **kwargs)[source]
class keystone.oauth1.core.Token(key, secret)[source]

Bases: object

set_verifier(verifier)[source]
keystone.oauth1.core.get_oauth_headers(headers)[source]
keystone.oauth1.core.token_generator(*args, **kwargs)[source]
keystone.oauth1.core.validate_oauth_params(query_string)[source]

keystone.oauth1.routers module

class keystone.oauth1.routers.Routers[source]

Bases: keystone.common.wsgi.RoutersBase

API Endpoints for the OAuth1 extension.

The goal of this extension is to allow third-party service providers to acquire tokens with a limited subset of a user’s roles for acting on behalf of that user. This is done using an oauth-similar flow and api.

The API looks like:

# Basic admin-only consumer crud
POST /OS-OAUTH1/consumers
GET /OS-OAUTH1/consumers
PATCH /OS-OAUTH1/consumers/{consumer_id}
GET /OS-OAUTH1/consumers/{consumer_id}
DELETE /OS-OAUTH1/consumers/{consumer_id}

# User access token crud
GET /users/{user_id}/OS-OAUTH1/access_tokens
GET /users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id}
GET /users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id}/roles
GET /users/{user_id}/OS-OAUTH1/access_tokens
    /{access_token_id}/roles/{role_id}
DELETE /users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id}

# OAuth interfaces
POST /OS-OAUTH1/request_token  # create a request token
PUT /OS-OAUTH1/authorize  # authorize a request token
POST /OS-OAUTH1/access_token  # create an access token
append_v3_routers(mapper, routers)[source]

keystone.oauth1.schema module

keystone.oauth1.validator module

oAuthlib request validator.

class keystone.oauth1.validator.OAuthValidator[source]

Bases: keystone.common.provider_api.ProviderAPIMixin, oauthlib.oauth1.rfc5849.request_validator.RequestValidator

check_access_token(access_token)[source]
check_client_key(client_key)[source]
check_nonce(nonce)[source]
check_request_token(request_token)[source]
check_verifier(verifier)[source]
enforce_ssl
get_access_token_secret(client_key, token, request)[source]
get_client_secret(client_key, request)[source]
get_default_realms(client_key, request)[source]
get_realms(token, request)[source]
get_redirect_uri(token, request)[source]
get_request_token_secret(client_key, token, request)[source]
get_rsa_key(client_key, request)[source]
invalidate_request_token(client_key, request_token, request)[source]
safe_characters
save_access_token(token, request)[source]
save_request_token(token, request)[source]
save_verifier(token, verifier, request)[source]
validate_access_token(client_key, token, request)[source]
validate_client_key(client_key, request)[source]
validate_realms(client_key, token, request, uri=None, realms=None)[source]
validate_redirect_uri(client_key, redirect_uri, request)[source]
validate_request_token(client_key, token, request)[source]
validate_requested_realms(client_key, realms, request)[source]
validate_timestamp_and_nonce(client_key, timestamp, nonce, request, request_token=None, access_token=None)[source]
validate_verifier(client_key, token, verifier, request)[source]
verify_realms(token, realms, request)[source]
verify_request_token(token, request)[source]

Module contents

Creative Commons Attribution 3.0 License

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.