keystoneauth1.service_token module

A wrapper plugin to send service tokens with requests.

class keystoneauth1.service_token.ServiceTokenAuthWrapper(user_auth: BaseAuthPlugin, service_auth: BaseAuthPlugin)

Bases: BaseAuthPlugin

A wrapper plugin that sends both a user token and a service token.

This plugin combines a primary user authentication plugin and a secondary service authentication plugin. On outgoing HTTP requests, it injects both the standard user token (via X-Auth-Token) and a service token (via X-Service-Token).

All other operations (such as token retrieval, endpoint discovery, version negotiation, and project/user ID resolution) are delegated to the underlying user_auth plugin.

Parameters:

  • user_auth – The primary authentication plugin representing the user.

  • service_auth – The secondary authentication plugin representing the service account.

__annotations__ = {}
__doc__ = 'A wrapper plugin that sends both a user token and a service token.\n\n    This plugin combines a primary user authentication plugin and a secondary\n    service authentication plugin. On outgoing HTTP requests, it injects both\n    the standard user token (via ``X-Auth-Token``) and a service token (via\n    ``X-Service-Token``).\n\n    All other operations (such as token retrieval, endpoint discovery, version\n    negotiation, and project/user ID resolution) are delegated to the\n    underlying ``user_auth`` plugin.\n\n    :param user_auth: The primary authentication plugin representing the user.\n    :param service_auth: The secondary authentication plugin representing the\n        service account.\n    '
__init__(user_auth: BaseAuthPlugin, service_auth: BaseAuthPlugin)
__module__ = 'keystoneauth1.service_token'
get_api_major_version(session: Session, **kwargs: Any) → tuple[int | float, ...] | None

Get the major API version from the endpoint.

Parameters:

  • session – A session object that can be used for communication.

  • endpoint_override – URL to use for version discovery.

  • kwargs – Ignored.

Raises:

keystoneauth1.exceptions.http.HttpError – An error from an invalid HTTP response.

Returns:

Valid EndpointData or None if not available.

get_connection_params(session: Session) → ConnectionParams

Return connection params from both plugins.

Parameters from user_auth take priority over service_auth parameters.

get_endpoint(session: Session, **kwargs: Any) → str | None

Return an endpoint for the client.

There are no required keyword arguments to get_endpoint as a plugin implementation should use best effort with the information available to determine the endpoint. However there are certain standard options that will be generated by the clients and should be used by plugins:

  • service_type: what sort of service is required.

  • service_name: the name of the service in the catalog.

  • interface: what visibility the endpoint should have.

  • region_name: the region the endpoint exists in.

Parameters:

  • session – The session object that the auth_plugin belongs to.

  • kwargs – Ignored.

Returns:

The base URL that will be used to talk to the required service or None if not available.

get_endpoint_data(session: Session, *, endpoint_override: str | None = None, discover_versions: bool = True, **kwargs: Any) → EndpointData | None

Return a valid endpoint data for a service.

Parameters:

  • session – A session object that can be used for communication.

  • endpoint_override – URL to use for version discovery.

  • discover_versions – Whether to get version metadata from the version discovery document even if it major api version info can be inferred from the url. (optional, defaults to True)

  • kwargs – Ignored

Raises:

keystoneauth1.exceptions.http.HttpError – An error from an invalid HTTP response.

Returns:

Valid EndpointData or None if not available.

get_headers(session: Session) → dict[str, str] | None

Fetch current headers for a request.

This calls get_headers() on user_auth and appends the service token retrieved from service_auth.get_token() under the X-Service-Token header name.

get_project_id(session: Session) → str | None

Return the project id that we are authenticated to.

Wherever possible the project id should be inferred from the token however there are certain URLs and other places that require access to the currently authenticated project id.

Parameters:

session – A session object so the plugin can make HTTP calls.

Returns:

A project identifier or None if one is not available.

get_sp_auth_url(session: Session, sp_id: str) → str | None

Return auth_url from the Service Provider object.

This url is used for obtaining unscoped federated token from remote cloud.

Parameters:

  • session – A session object that can be used for communication.

  • sp_id – ID of the Service Provider to be queried.

Returns:

A Service Provider auth_url or None if one is not available.

get_sp_url(session: Session, sp_id: str) → str | None

Return sp_url from the Service Provider object.

This url is used for passing SAML2 assertion to the remote cloud.

Parameters:

  • session – A session object that can be used for communication.

  • sp_id – ID of the Service Provider to be queried.

Returns:

A Service Provider sp_url or None if one is not available.

get_token(session: Session) → str | None

Obtain a token.

How the token is obtained is up to the plugin. If it is still valid it may be reused, retrieved from cache or invoke an authentication request against a server.

Returning None will indicate that no token was able to be retrieved.

This function is misplaced as it should only be required for auth plugins that use the ‘X-Auth-Token’ header. However due to the way plugins evolved this method is required and often called to trigger an authentication request on a new plugin.

When implementing a new plugin it is advised that you implement this method, however if you don’t require the ‘X-Auth-Token’ header override the get_headers method instead.

Parameters:

session – A session object so the plugin can make HTTP calls.

Returns:

A token to use.

get_user_id(session: Session) → str | None

Return a unique user identifier of the plugin.

Wherever possible the user id should be inferred from the token however there are certain URLs and other places that require access to the currently authenticated user id.

Parameters:

session – A session object so the plugin can make HTTP calls.

Returns:

A user identifier or None if one is not available.

invalidate() → bool

Invalidate the cache of both the user and service auth plugins.

Returns:

True if either plugin’s cache was invalidated, False otherwise.