Plugin Options¶
Using plugins via config file¶
When using the plugins via config file you define the plugin name as
auth_type
. The options of the plugin are then specified while replacing
-
with _
to be valid in configuration.
For example to use the password plugin in a config file you would specify:
[section]
auth_url = http://keystone.example.com:5000/
auth_type = password
username = myuser
password = mypassword
project_name = myproject
default_domain_name = mydomain
Using plugins via CLI¶
When using auth plugins via CLI via os-client-config
or shade
you can
specify parameters via environment configuration by using the pattern OS_
followed by the uppercase parameter name replacing -
with _
.
For example to use the password plugin via environment variable you specify:
export OS_AUTH_TYPE=password
export OS_AUTH_URL=http://keystone.example.com:5000/
export OS_USERNAME=myuser
export OS_PASSWORD=mypassword
export OS_PROJECT_NAME=myproject
export OS_DEFAULT_DOMAIN_NAME=mydomain
Specifying operations via CLI parameter will override the environment
parameter. These are specified with the pattern --os-
and the parameter
name. Using the password example again:
openstack --os-auth-type password \
--os-auth-url http://keystone.example.com:5000/ \
--os-username myuser \
--os-password mypassword \
--os-project-name myproject \
--os-default-domain-name mydomain \
operation
Additional loaders¶
The configuration and CLI loaders are quite commonly used however similar
concepts are found in other situations such as os-client-config
in which
you specify authentication and other cloud parameters in a clouds.yaml
file.
Loaders such as these use the same plugin options listed below, but via their
own mechanism. In os-client-config
the password plugin looks like:
clouds:
mycloud:
auth_type: password
auth:
auth_url: http://keystone.example.com:5000/
auth_type: password
username: myuser
password: mypassword
project_name: myproject
default_domain_name: mydomain
However different services may implement loaders in their own way and you should consult their relevant documentation. The same auth options will be available.
Available Plugins¶
This is a listing of all included plugins and the options that they accept. Plugins are listed alphabetically and not in any order of priority.
admin_token¶
Use an existing token and a known endpoint to perform requests.
This plugin is primarily useful for development or for use with identity service ADMIN tokens. Because this token is used directly there is no fetching a service catalog or determining scope information and so it cannot be used by clients that expect use this scope information.
Because there is no service catalog the endpoint that is supplied with initialization is used for all operations performed with this plugin so must be the full base URL to an actual service.
- endpoint:
The endpoint that will always be used
- token:
The token that will always be used
http_basic¶
Use HTTP Basic authentication to perform requests.
This can be used to instantiate clients for services deployed in standalone mode.
There is no fetching a service catalog or determining scope information and so it cannot be used by clients that expect to use this scope information.
- username:
Username
- password:
User’s password
- endpoint:
The endpoint that will always be used
none¶
Use no tokens to perform requests.
This can be used to instantiate clients for services deployed in noauth/standalone mode.
There is no fetching a service catalog or determining scope information and so it cannot be used by clients that expect to use this scope information.
- endpoint:
The endpoint that will always be used
password¶
Authenticate via a username and password.
Authenticate to the identity service using an inbuilt username and password. This is the standard and most common form of authentication.
As a generic plugin this plugin is identity version independent and will discover available versions before use. This means it expects to be providen an unversioned URL to operate against.
- auth-url:
Authentication URL
- system-scope:
Scope for system operations
- domain-id:
Domain ID to scope to
- domain-name:
Domain name to scope to
- project-id:
Project ID to scope to
- project-name:
Project name to scope to
- project-domain-id:
Domain ID containing project
- project-domain-name:
Domain name containing project
- trust-id:
ID of the trust to use as a trustee use
- default-domain-id:
Optional domain ID to use with v3 and v2 parameters. It will be used for both the user and project domain in v3 and ignored in v2 authentication.
- default-domain-name:
Optional domain name to use with v3 API and v2 parameters. It will be used for both the user and project domain in v3 and ignored in v2 authentication.
- user-id:
User id
- username:
Username
- user-domain-id:
User’s domain id
- user-domain-name:
User’s domain name
- password:
User’s password
token¶
Given an existing token rescope it to another target.
This plugin uses the Identity service’s rescope mechanism to get a new token based upon an existing token. Because an auth plugin requires a service catalog and scope information it is often easier to fetch a new token based on an existing one than validate and reuse the one you already have.
As a generic plugin this plugin is identity version independent and will discover available versions before use. This means it expects to be providen an unversioned URL to operate against.
- auth-url:
Authentication URL
- system-scope:
Scope for system operations
- domain-id:
Domain ID to scope to
- domain-name:
Domain name to scope to
- project-id:
Project ID to scope to
- project-name:
Project name to scope to
- project-domain-id:
Domain ID containing project
- project-domain-name:
Domain name containing project
- trust-id:
ID of the trust to use as a trustee use
- default-domain-id:
Optional domain ID to use with v3 and v2 parameters. It will be used for both the user and project domain in v3 and ignored in v2 authentication.
- default-domain-name:
Optional domain name to use with v3 API and v2 parameters. It will be used for both the user and project domain in v3 and ignored in v2 authentication.
- token:
Token to authenticate with
v2password¶
- auth-url:
Authentication URL
- tenant-id:
Tenant ID
- tenant-name:
Tenant Name
- trust-id:
ID of the trust to use as a trustee use
- username:
Username to login with
- user-id:
User ID to login with
- password:
Password to use
v2token¶
- auth-url:
Authentication URL
- tenant-id:
Tenant ID
- tenant-name:
Tenant Name
- trust-id:
ID of the trust to use as a trustee use
- token:
Token
v3adfspassword¶
- auth-url:
Authentication URL
- system-scope:
Scope for system operations
- domain-id:
Domain ID to scope to
- domain-name:
Domain name to scope to
- project-id:
Project ID to scope to
- project-name:
Project name to scope to
- project-domain-id:
Domain ID containing project
- project-domain-name:
Domain name containing project
- trust-id:
ID of the trust to use as a trustee use
- identity-provider:
Identity Provider’s name
- protocol:
Protocol for federated plugin
- identity-provider-url:
An Identity Provider URL, where the SAML authentication request will be sent.
- service-provider-endpoint:
Service Provider’s Endpoint
- service-provider-entity-id:
Service Provider’s SAML Entity ID
- username:
Username
- password:
Password
v3applicationcredential¶
- auth-url:
Authentication URL
- system-scope:
Scope for system operations
- domain-id:
Domain ID to scope to
- domain-name:
Domain name to scope to
- project-id:
Project ID to scope to
- project-name:
Project name to scope to
- project-domain-id:
Domain ID containing project
- project-domain-name:
Domain name containing project
- trust-id:
ID of the trust to use as a trustee use
- user-id:
User ID
- username:
Username
- user-domain-id:
User’s domain id
- user-domain-name:
User’s domain name
- application_credential_secret:
Application credential auth secret
- application_credential_id:
Application credential ID
- application_credential_name:
Application credential name
v3fedkerb¶
- auth-url:
Authentication URL
- system-scope:
Scope for system operations
- domain-id:
Domain ID to scope to
- domain-name:
Domain name to scope to
- project-id:
Project ID to scope to
- project-name:
Project name to scope to
- project-domain-id:
Domain ID containing project
- project-domain-name:
Domain name containing project
- trust-id:
ID of the trust to use as a trustee use
- identity-provider:
Identity Provider’s name
- protocol:
Protocol for federated plugin
- mutual-auth:
Configures Kerberos Mutual Authentication
v3kerberos¶
- auth-url:
Authentication URL
- system-scope:
Scope for system operations
- domain-id:
Domain ID to scope to
- domain-name:
Domain name to scope to
- project-id:
Project ID to scope to
- project-name:
Project name to scope to
- project-domain-id:
Domain ID containing project
- project-domain-name:
Domain name containing project
- trust-id:
ID of the trust to use as a trustee use
- mutual-auth:
Configures Kerberos Mutual Authentication
v3multifactor¶
- auth-url:
Authentication URL
- system-scope:
Scope for system operations
- domain-id:
Domain ID to scope to
- domain-name:
Domain name to scope to
- project-id:
Project ID to scope to
- project-name:
Project name to scope to
- project-domain-id:
Domain ID containing project
- project-domain-name:
Domain name containing project
- trust-id:
ID of the trust to use as a trustee use
- auth_methods:
Methods to authenticate with.
v3oauth1¶
- auth-url:
Authentication URL
- consumer-key:
OAuth Consumer ID/Key
- consumer-secret:
OAuth Consumer Secret
- access-key:
OAuth Access Key
- access-secret:
OAuth Access Secret
v3oauth2clientcredential¶
- auth-url:
Authentication URL
- system-scope:
Scope for system operations
- domain-id:
Domain ID to scope to
- domain-name:
Domain name to scope to
- project-id:
Project ID to scope to
- project-name:
Project name to scope to
- project-domain-id:
Domain ID containing project
- project-domain-name:
Domain name containing project
- trust-id:
ID of the trust to use as a trustee use
- oauth2_endpoint:
Endpoint for OAuth2.0
- oauth2_client_id:
Client id for OAuth2.0
- oauth2_client_secret:
Client secret for OAuth2.0
v3oauth2mtlsclientcredential¶
- auth-url:
Authentication URL
- system-scope:
Scope for system operations
- domain-id:
Domain ID to scope to
- domain-name:
Domain name to scope to
- project-id:
Project ID to scope to
- project-name:
Project name to scope to
- project-domain-id:
Domain ID containing project
- project-domain-name:
Domain name containing project
- trust-id:
ID of the trust to use as a trustee use
- oauth2-endpoint:
Endpoint for OAuth2.0 Mutual-TLS Authorization
- oauth2-client-id:
Client credential ID for OAuth2.0 Mutual-TLS Authorization
v3oidcaccesstoken¶
- auth-url:
Authentication URL
- system-scope:
Scope for system operations
- domain-id:
Domain ID to scope to
- domain-name:
Domain name to scope to
- project-id:
Project ID to scope to
- project-name:
Project name to scope to
- project-domain-id:
Domain ID containing project
- project-domain-name:
Domain name containing project
- trust-id:
ID of the trust to use as a trustee use
- identity-provider:
Identity Provider’s name
- protocol:
Protocol for federated plugin
- access-token:
OAuth 2.0 Access Token
v3oidcauthcode¶
- auth-url:
Authentication URL
- system-scope:
Scope for system operations
- domain-id:
Domain ID to scope to
- domain-name:
Domain name to scope to
- project-id:
Project ID to scope to
- project-name:
Project name to scope to
- project-domain-id:
Domain ID containing project
- project-domain-name:
Domain name containing project
- trust-id:
ID of the trust to use as a trustee use
- identity-provider:
Identity Provider’s name
- protocol:
Protocol for federated plugin
- client-id:
OAuth 2.0 Client ID
- client-secret:
OAuth 2.0 Client Secret
- openid-scope:
OpenID Connect scope that is requested from authorization server. Note that the OpenID Connect specification states that “openid” must be always specified.
- access-token-endpoint:
OpenID Connect Provider Token Endpoint. Note that if a discovery document is being passed this option will override the endpoint provided by the server in the discovery document.
- discovery-endpoint:
OpenID Connect Discovery Document URL. The discovery document will be used to obtain the values of the access token endpoint and the authentication endpoint. This URL should look like https://idp.example.org/.well-known/openid-configuration
- access-token-type:
OAuth 2.0 Authorization Server Introspection token type, it is used to decide which type of token will be used when processing token introspection. Valid values are: “access_token” or “id_token”
- redirect-uri:
OpenID Connect Redirect URL
- code:
OAuth 2.0 Authorization Code
v3oidcclientcredentials¶
- auth-url:
Authentication URL
- system-scope:
Scope for system operations
- domain-id:
Domain ID to scope to
- domain-name:
Domain name to scope to
- project-id:
Project ID to scope to
- project-name:
Project name to scope to
- project-domain-id:
Domain ID containing project
- project-domain-name:
Domain name containing project
- trust-id:
ID of the trust to use as a trustee use
- identity-provider:
Identity Provider’s name
- protocol:
Protocol for federated plugin
- client-id:
OAuth 2.0 Client ID
- client-secret:
OAuth 2.0 Client Secret
- openid-scope:
OpenID Connect scope that is requested from authorization server. Note that the OpenID Connect specification states that “openid” must be always specified.
- access-token-endpoint:
OpenID Connect Provider Token Endpoint. Note that if a discovery document is being passed this option will override the endpoint provided by the server in the discovery document.
- discovery-endpoint:
OpenID Connect Discovery Document URL. The discovery document will be used to obtain the values of the access token endpoint and the authentication endpoint. This URL should look like https://idp.example.org/.well-known/openid-configuration
- access-token-type:
OAuth 2.0 Authorization Server Introspection token type, it is used to decide which type of token will be used when processing token introspection. Valid values are: “access_token” or “id_token”
v3oidcdeviceauthz¶
- auth-url:
Authentication URL
- system-scope:
Scope for system operations
- domain-id:
Domain ID to scope to
- domain-name:
Domain name to scope to
- project-id:
Project ID to scope to
- project-name:
Project name to scope to
- project-domain-id:
Domain ID containing project
- project-domain-name:
Domain name containing project
- trust-id:
ID of the trust to use as a trustee use
- identity-provider:
Identity Provider’s name
- protocol:
Protocol for federated plugin
- client-id:
OAuth 2.0 Client ID
- client-secret:
OAuth 2.0 Client Secret
- openid-scope:
OpenID Connect scope that is requested from authorization server. Note that the OpenID Connect specification states that “openid” must be always specified.
- access-token-endpoint:
OpenID Connect Provider Token Endpoint. Note that if a discovery document is being passed this option will override the endpoint provided by the server in the discovery document.
- discovery-endpoint:
OpenID Connect Discovery Document URL. The discovery document will be used to obtain the values of the access token endpoint and the authentication endpoint. This URL should look like https://idp.example.org/.well-known/openid-configuration
- device-authorization-endpoint:
OAuth 2.0 Device Authorization Endpoint. Note that if a discovery document is being passed this option will override the endpoint provided by the server in the discovery document.
- code-challenge-method:
PKCE Challenge Method (RFC 7636)
v3oidcpassword¶
- auth-url:
Authentication URL
- system-scope:
Scope for system operations
- domain-id:
Domain ID to scope to
- domain-name:
Domain name to scope to
- project-id:
Project ID to scope to
- project-name:
Project name to scope to
- project-domain-id:
Domain ID containing project
- project-domain-name:
Domain name containing project
- trust-id:
ID of the trust to use as a trustee use
- identity-provider:
Identity Provider’s name
- protocol:
Protocol for federated plugin
- client-id:
OAuth 2.0 Client ID
- client-secret:
OAuth 2.0 Client Secret
- openid-scope:
OpenID Connect scope that is requested from authorization server. Note that the OpenID Connect specification states that “openid” must be always specified.
- access-token-endpoint:
OpenID Connect Provider Token Endpoint. Note that if a discovery document is being passed this option will override the endpoint provided by the server in the discovery document.
- discovery-endpoint:
OpenID Connect Discovery Document URL. The discovery document will be used to obtain the values of the access token endpoint and the authentication endpoint. This URL should look like https://idp.example.org/.well-known/openid-configuration
- access-token-type:
OAuth 2.0 Authorization Server Introspection token type, it is used to decide which type of token will be used when processing token introspection. Valid values are: “access_token” or “id_token”
- username:
Username
- password:
Password
- idp_otp_key:
A key to be used in the Identity Provider access token endpoint to pass the OTP value. E.g. totp
v3password¶
- auth-url:
Authentication URL
- system-scope:
Scope for system operations
- domain-id:
Domain ID to scope to
- domain-name:
Domain name to scope to
- project-id:
Project ID to scope to
- project-name:
Project name to scope to
- project-domain-id:
Domain ID containing project
- project-domain-name:
Domain name containing project
- trust-id:
ID of the trust to use as a trustee use
- user-id:
User ID
- username:
Username
- user-domain-id:
User’s domain id
- user-domain-name:
User’s domain name
- password:
User’s password
v3samlpassword¶
- auth-url:
Authentication URL
- system-scope:
Scope for system operations
- domain-id:
Domain ID to scope to
- domain-name:
Domain name to scope to
- project-id:
Project ID to scope to
- project-name:
Project name to scope to
- project-domain-id:
Domain ID containing project
- project-domain-name:
Domain name containing project
- trust-id:
ID of the trust to use as a trustee use
- identity-provider:
Identity Provider’s name
- protocol:
Protocol for federated plugin
- identity-provider-url:
An Identity Provider URL, where the SAML2 authentication request will be sent.
- username:
Username
- password:
Password
v3token¶
- auth-url:
Authentication URL
- system-scope:
Scope for system operations
- domain-id:
Domain ID to scope to
- domain-name:
Domain name to scope to
- project-id:
Project ID to scope to
- project-name:
Project name to scope to
- project-domain-id:
Domain ID containing project
- project-domain-name:
Domain name containing project
- trust-id:
ID of the trust to use as a trustee use
- token:
Token to authenticate with
v3tokenlessauth¶
- auth-url:
Authentication URL
- domain-id:
Domain ID to scope to
- domain-name:
Domain name to scope to
- project-id:
Project ID to scope to
- project-name:
Project name to scope to
- project-domain-id:
Domain ID containing project
- project-domain-name:
Domain name containing project
v3totp¶
- auth-url:
Authentication URL
- system-scope:
Scope for system operations
- domain-id:
Domain ID to scope to
- domain-name:
Domain name to scope to
- project-id:
Project ID to scope to
- project-name:
Project name to scope to
- project-domain-id:
Domain ID containing project
- project-domain-name:
Domain name containing project
- trust-id:
ID of the trust to use as a trustee use
- user-id:
User ID
- username:
Username
- user-domain-id:
User’s domain id
- user-domain-name:
User’s domain name
- passcode:
User’s TOTP passcode