/usr/lib/python2.6/site-packages/keystoneclient/middleware
Edit: /usr/lib/python2.6/site-packages/keystoneclient/middleware/auth_token.pyc (55618B)
d? d d@ e
i dA d dB d dC e
i dD d dE d dF e
i dG d e d dH e
i dI d e d) e" d dJ e
i dK d e" d dL e
i dM d dN d dO e
i dP d e! d dQ e
i# dR d dS g d dT g Z$ e
i% Z% e% i& e$ dU dV dW dX g Z' dY Z( dZ e) f d[ YZ* d\ Z+ d] Z, d^ Z- d_ Z. d` Z/ da Z0 db Z1 dc e2 f dd YZ3 de e2 f df YZ4 dg e2 f dh YZ5 di e2 f dj YZ6 dk e) f dl YZ7 dm e) f dn YZ8 do e9 f dp YZ: dq e) f dr YZ; ds Z< dt Z= e> du j od dv Z? d dw k@ lA ZA h dx d 6dy d( 6ZB e8 e? eB ZC eA iD d dz eC ZE d{ GHeE iF n d S(| s
TOKEN-BASED AUTH MIDDLEWARE
.. warning::
This module is DEPRECATED. The auth_token middleware has been moved to the
`keystonemiddleware repository
`_.
This WSGI component:
* Verifies that incoming client requests have valid tokens by validating
tokens with the auth service.
* Rejects unauthenticated requests UNLESS it is in 'delay_auth_decision'
mode, which means the final decision is delegated to the downstream WSGI
component (usually the OpenStack service)
* Collects and forwards identity information based on a valid token
such as user name, tenant, etc
HEADERS
-------
* Headers starting with HTTP\_ is a standard http header
* Headers starting with HTTP_X is an extended http header
Coming in from initial call from client or customer
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
HTTP_X_AUTH_TOKEN
The client token being passed in.
HTTP_X_STORAGE_TOKEN
The client token being passed in (legacy Rackspace use) to support
swift/cloud files
Used for communication between components
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
WWW-Authenticate
HTTP header returned to a user indicating which endpoint to use
to retrieve a new token
What we add to the request for use by the OpenStack service
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
HTTP_X_IDENTITY_STATUS
'Confirmed' or 'Invalid'
The underlying service will only see a value of 'Invalid' if the Middleware
is configured to run in 'delay_auth_decision' mode
HTTP_X_DOMAIN_ID
Identity service managed unique identifier, string. Only present if
this is a domain-scoped v3 token.
HTTP_X_DOMAIN_NAME
Unique domain name, string. Only present if this is a domain-scoped
v3 token.
HTTP_X_PROJECT_ID
Identity service managed unique identifier, string. Only present if
this is a project-scoped v3 token, or a tenant-scoped v2 token.
HTTP_X_PROJECT_NAME
Project name, unique within owning domain, string. Only present if
this is a project-scoped v3 token, or a tenant-scoped v2 token.
HTTP_X_PROJECT_DOMAIN_ID
Identity service managed unique identifier of owning domain of
project, string. Only present if this is a project-scoped v3 token. If
this variable is set, this indicates that the PROJECT_NAME can only
be assumed to be unique within this domain.
HTTP_X_PROJECT_DOMAIN_NAME
Name of owning domain of project, string. Only present if this is a
project-scoped v3 token. If this variable is set, this indicates that
the PROJECT_NAME can only be assumed to be unique within this domain.
HTTP_X_USER_ID
Identity-service managed unique identifier, string
HTTP_X_USER_NAME
User identifier, unique within owning domain, string
HTTP_X_USER_DOMAIN_ID
Identity service managed unique identifier of owning domain of
user, string. If this variable is set, this indicates that the USER_NAME
can only be assumed to be unique within this domain.
HTTP_X_USER_DOMAIN_NAME
Name of owning domain of user, string. If this variable is set, this
indicates that the USER_NAME can only be assumed to be unique within
this domain.
HTTP_X_ROLES
Comma delimited list of case-sensitive role names
HTTP_X_SERVICE_CATALOG
json encoded keystone service catalog (optional).
For compatibility reasons this catalog will always be in the V2 catalog
format even if it is a v3 token.
HTTP_X_TENANT_ID
*Deprecated* in favor of HTTP_X_PROJECT_ID
Identity service managed unique identifier, string. For v3 tokens, this
will be set to the same value as HTTP_X_PROJECT_ID
HTTP_X_TENANT_NAME
*Deprecated* in favor of HTTP_X_PROJECT_NAME
Project identifier, unique within owning domain, string. For v3 tokens,
this will be set to the same value as HTTP_X_PROJECT_NAME
HTTP_X_TENANT
*Deprecated* in favor of HTTP_X_TENANT_ID and HTTP_X_TENANT_NAME
Keystone-assigned unique identifier, string. For v3 tokens, this
will be set to the same value as HTTP_X_PROJECT_ID
HTTP_X_USER
*Deprecated* in favor of HTTP_X_USER_ID and HTTP_X_USER_NAME
User name, unique within owning domain, string
HTTP_X_ROLE
*Deprecated* in favor of HTTP_X_ROLES
Will contain the same values as HTTP_X_ROLES.
OTHER ENVIRONMENT VARIABLES
---------------------------
keystone.token_info
Information about the token discovered in the process of
validation. This may include extended information returned by the
Keystone token validation call, as well as basic information about
the tenant and user.
iN( t cfg( t jsonutils( t timeutils( t urllib( t access( t cms( t
exceptions( t memcache_crypt( t memorycache( t utilst auth_admin_prefixt defaultt t helpsM Prefix to prepend at the beginning of the path. Deprecated, use identity_uri.t auth_hosts 127.0.0.1sM Host providing the admin Identity API endpoint. Deprecated, use identity_uri.t auth_porti sF Port of the admin Identity API endpoint. Deprecated, use identity_uri.t
auth_protocolt httpssZ Protocol of the admin Identity API endpoint (http or https). Deprecated, use identity_uri.t auth_uris% Complete public Identity API endpointt identity_urisu Complete admin Identity API endpoint. This should specify the unversioned root endpoint e.g. https://localhost:35357/t auth_versions. API version of the admin Identity API endpointt delay_auth_decisions Do not handle authorization requests within the middleware, but delegate the authorization decision to downstream WSGI componentst http_connect_timeoutsA Request timeout value for communicating with Identity API server.t http_request_max_retriesi sV How many times are we trying to reconnect when communicating with Identity API Server.t admin_tokent secrets/ This option is deprecated and may be removed in a future release. Single shared secret with the Keystone configuration used for bootstrapping a Keystone installation, or otherwise bypassing the normal authentication process. This option should not be used, use `admin_user` and `admin_password` instead.t
admin_users Keystone account usernamet admin_passwords Keystone account passwordt admin_tenant_namet admins< Keystone service account tenant name to validate user tokenst caches Env key for the swift cachet certfiles7 Required if Keystone server requires client certificatet keyfilet cafilesd A PEM encoded Certificate Authority to use when verifying HTTPs connections. Defaults to system CAs.t insecures Verify HTTPS connections.t signing_dirs3 Directory used to cache files related to PKI tokenst memcached_serverst deprecated_namet memcache_serverss Optionally specify a list of memcached server(s) to use for caching. If left undefined, tokens will instead be cached in-process.t token_cache_timei, s In order to prevent excessive effort spent validating tokens, the middleware caches previously-seen tokens for a configurable duration (in seconds). Set to -1 to disable caching completely.t revocation_cache_timei
s Determines the frequency at which the list of revoked tokens is retrieved from the Identity service (in seconds). A high number of revocation events combined with a low cache duration may significantly reduce performance.t memcache_security_strategys| (optional) if defined, indicate whether token data should be authenticated or authenticated and encrypted. Acceptable values are MAC or ENCRYPT. If MAC, token data is authenticated (with HMAC) in the cache. If ENCRYPT, token data is encrypted and authenticated in the cache. If the value is not one of these options or empty, auth_token will raise an exception on initialization.t memcache_secret_keysf (optional, mandatory if memcache_security_strategy is defined) this string is used for key derivation.t include_service_catalogs (optional) indicate whether to set the X-Service-Catalog header. If False, middleware will not ask for service catalog on token validation and will not set the X-Service-Catalog header.t enforce_token_bindt
permissives Used to control the use and type of token binding. Can be set to: "disabled" to not check token binding. "permissive" (default) to validate binding information if the bind type is of a form known to the server and ignore it if not. "strict" like "permissive" but if the bind type is unknown the token will be rejected. "required" any form of token binding is needed to be allowed. Finally the name of a binding method that must be present in tokens.t check_revocations_for_cacheds If true, the revocation list will be checked for cached tokens. This requires that PKI tokens are configured on the Keystone server.t hash_algorithmst md5s Hash algorithms to use for hashing PKI tokens. This may be a single algorithm or multiple. The algorithms are those supported by Python standard hashlib.new(). The hashes will be tried in the order given, so put the preferred one first for performance. The result of the first hash will be stored in the cache. This will typically be set to multiple values only while migrating from a less secure algorithm to a more secure one. Once all the old tokens are expired this option should be set to a single value for better performance.t groupt keystone_authtokens v2.0s v3.0s tokens/%st BIND_MODEc B s& e Z d Z d Z d Z d Z d Z RS( t disabledR- t strictt requiredt kerberos( t __name__t
__module__t DISABLEDt
PERMISSIVEt STRICTt REQUIREDt KERBEROS( ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR3 Z s
c C s& t i t i d d } | | j S( s Determines if expiration is about to occur.
:param expiry: a datetime of the expected expiration
:returns: boolean : true if expiration is within 30 seconds
t secondsi ( R t utcnowt datetimet timedelta( t expiryt soon( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyt will_expire_soonb s c C s
d | j S( NR ( ( t
token_info( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyt _token_is_v2l s c C s
d | j S( Nt token( ( RF ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyt _token_is_v3p s c C s | p t d n t | o | d d d } n, t | o | d d } n
t d t i | } t i | } t i } | | j o t d n t i d | d t S( Ns Token authorization failedR RH t expirest
expires_att att subsecond(
t InvalidUserTokenRG RI R t
parse_isotimet normalize_timeR@ R t isotimet True( t datat timestampRJ R@ ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyt confirm_token_not_expiredt s
c C s g } x| D] } h | d d 6} y | d | d s s> Unable to convert the value of %s option into correct type: %sN( t dictt optst sixt iteritemst NoneR] t
ValueErrort ConfigurationError( t conft _optst opt_typest kt vt e( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyt _conf_values_type_convert s"
RN c B s e Z RS( ( R8 R9 ( ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyRN s t ServiceErrorc B s e Z RS( ( R8 R9 ( ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR s R| c B s e Z RS( ( R8 R9 ( ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR| s t NetworkErrorc B s e Z RS( ( R8 R9 ( ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR s t MiniRespc B s e Z g d Z RS( c C sP | d d j o d g | _ n
| g | _ t | | _ | i i d d S( Nt REQUEST_METHODt HEADR s Content-types
text/plain( s Content-types
text/plain( t bodyR` t headersRb ( t selft
error_messaget envR ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyt __init__ s
( R8 R9 R ( ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR s t AuthProtocolc B s e Z d Z d Z d Z d Z d Z d Z d Z d Z d Z
d Z d
Z d% d% d Z d Z e d
Z d Z d Z d Z d Z d% d Z e d Z d Z e d Z d Z d Z e i d Z d Z d Z! d Z" e# d Z$ e$ i% d Z$ e# d Z& d Z' e& i% d Z& e d! Z( d" Z) d# Z* d$ Z+ RS(& s9 Auth Middleware that handles authenticating client calls.c
C s2 t i | i d t | _ | i i d | i i d t | | _ | | _ | i
d t d d d d d d
f j | _ | i
d | _
| i
d | _ | i
p | i i d
| i
d } t | i
d } | i
d } | i
d } t i | o d | } n d | | | f | _
| o# d | i
| i d f | _
qzn | i
i d | _
| i d j oD | i i d t i i | i
d | _ | i i d | _ n | i
d | _ | i
d | _ | i
d | _ | i
d | _ | i
d | _ | i d j o t i d d | _ n | i i d | i | i d | i } | | _ d | i } | | _! d! | i } | | _" | i
d" | _# | i# o | i i d# n d | _$ | i
d$ | _% | i
d% | _& | i
d& | _' | i
d' } t( | i d( t | i
d) d* | i
d* d+ | i
d, d- | i
d- d' | d. | i
d. | _) d | _* d | _+ t, i- d/ | i
d0 | _. | i
d1 } | o
t | | _/ d | _0 | i
d2 | _1 | i
d3 | _2 | i
d4 | _3 d S(5 Nt log_names' Starting keystone auth_token middlewares This middleware module is deprecated as of v0.10.0 in favor of keystonemiddleware.auth_token - please update your WSGI pipeline to reference the new middleware package.R t truet tt 1t ont yest yR R s[ Configuring admin URI using auth fragments. This is deprecated, use 'identity_uri' instead.R R R R
s [%s]s
%s://%s:%ss %s/%st /s Configuring auth_uri to point to the public identity endpoint is required; clients may not be able to authenticate against an admin endpointR R R! R" R# t prefixs keystone-signing-s3 Using %s as cache directory for signing certificates %s/signing_cert.pems
%s/cacert.pems %s/revoked.pemR s The admin_token option in the auth_token middleware is deprecated and should not be used. The admin_user and admin_password options should be used instead. The admin_token option may be removed in a future release.R R R R) t
cache_timeR' R/ t env_cache_nameR R$ R* R? R( R R R+ R. (4 t loggingt getLoggerR^ R8 t LOGt infot warningR R} t appt _conf_getRR R R R t intt netaddrt
valid_ipv6t stript rstripRz R Rl t urljoint cert_filet key_filet ssl_ca_filet ssl_insecuret signing_dirnamet tempfilet mkdtempt verify_signing_dirt signing_cert_file_namet signing_ca_file_namet revoked_file_nameR t admin_token_expiryR R R t
TokenCachet _token_cachet _token_revocation_listt# _token_revocation_list_fetched_timeRA RB t# token_revocation_list_cache_timeoutR R R R+ R. (
R R R} R R R R
t valR) t http_connect_timeout_cfg( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR s !
c C s+ | | i j o | i | St i | Sd S( N( R} t CONFR2 ( R RW ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR a s c C s | i d o& | i d } | i i d | n d } | i } | o- x* t D] } | | j o | } PqV qV Wn | o | i i d | n5 | i i d d i t d i | t d | S( s- Determine the api version that we should use.R s, Auth Token proceeding with requested %s apiss# Auth Token confirmed use of %s apiss< Attempted versions [%s] not in list supported by server [%s]s , s& No compatible apis supported by serverN( R R R Rz t _get_supported_versionst LIST_OF_VERSIONS_TO_ATTEMPTt errort joinR ( R t version_to_uset versions_supported_by_servert version( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyt _choose_api_versionh s*
c C s g } | i d d \ } } | i d j o! | i i d | i d n | i d j o& | i i d | i t d na y. x' | d d
D] } | i | d q WWn/ t j
o# | i i d t d
n X| i i d d i | | S( Nt GETR i s/ Old keystone installation found...assuming v2.0s v2.0i, s, Unable to get version info from keystone: %ss( Unable to get version info from keystonet versionsRa t ids+ Invalid version response format from servers. Unable to parse version response from keystones+ Server reports support for api versions: %ss , (
t
_json_requestt status_codeR R Rb R R R] t debugR ( R R t responseRS R ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR s(
c C sQ | i i d | i i | yk | i | | i | } | i | | } | | d <| i | } | i | | | i | | SWn t
j
oi | i o8 | i i d | i | h d d 6 | i | | S| i i d | i
| | SnL t j
o? } | i i d | t d | } | d | i | i SXd
S( s Handle incoming request.
Authenticate send downstream on success. Reject request if
we can't authenticate.
s Authenticating user tokens keystone.token_infos0 Invalid user token - deferring reject downstreamt Invalids X-Identity-Statuss& Invalid user token - rejecting requests Unable to obtain admin token: %ss Service unavailables 503 Service UnavailableN( R R R t
initializet _remove_auth_headerst _get_user_token_from_headert _validate_user_tokent _build_user_headerst _add_headersR RN R R t _reject_requestR t criticalR R R ( R R t start_responset
user_tokenRF t user_headersR t resp( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyt __call__ s.
c C s6 d } | i i d d i | | i | | d S( sk Remove headers so a user can't fake authentication.
:param env: wsgi request environment
s X-Identity-Statuss X-Domain-Ids
X-Domain-Names X-Project-Ids X-Project-Names X-Project-Domain-Ids X-Project-Domain-Names X-User-Ids X-User-Names X-User-Domain-Ids X-User-Domain-Names X-Roless X-Service-Catalogs X-Users X-Tenant-Ids
X-Tenant-Names X-Tenants X-Roles- Removing headers from request environment: %st ,N( s X-Identity-Statuss X-Domain-Ids
X-Domain-Names X-Project-Ids X-Project-Names X-Project-Domain-Ids X-Project-Domain-Names X-User-Ids X-User-Names X-User-Domain-Ids X-User-Domain-Names X-Roless X-Service-Catalogs X-Users X-Tenant-Ids
X-Tenant-Names X-Tenants X-Role( R R R t _remove_headers( R R t auth_headers( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR s* c C sn | i | d | i | d } | o | S| i p' | i i d | i i d | n t d d S( s Get token id from request.
:param env: wsgi request environment
:return token id
:raises InvalidUserToken if no token is provided in request
s X-Auth-Tokens X-Storage-Tokens. Unable to find authentication token in headerss Headers: %ss Unable to find token in headersN( t _get_headerR R R R RN ( R R RH ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR s
c C s? d d | i f g } t d | | } | d | i | i S( s Redirect client to auth server.
:param env: wsgi request environment
:param start_response: wsgi response callback
:returns HTTPUnauthorized http response
s WWW-Authenticates Keystone uri='%s's Authentication requireds 401 Unauthorized( R R R R ( R R R R R ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR s c C sX | i o! t | i o
d | _ q+ n | i p | i \ | _ | _ n | i S( sV Return admin token, possibly fetching a new one.
if self.admin_token_expiry is set from fetching an admin token, check
it for expiration, and request a new token is the existing token
is about to expire.
:return admin token id
:raise ServiceError when unable to retrieve token from keystone
N( R RE Rz R t _request_admin_token( R ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyt get_admin_token s
c K sg d | i | i d f } | i d | i | i o$ | i o | i | i f | d s. Unable to parse expiration time from token: %sN(
R R R R t AssertionErrorR RO RP R] R R R R{ ( R t paramsR RS RH RC t datetime_expiry( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR d s2
c C s d } y>| i i | \ } } | d } | o_ | } | i oK xH | D]< } | i | } | o | i i d t d qI qI Wq
n} t i | o% | i
| | }
t i |
} nH t i
| o% | i | | }
t i |
} n | i | | } t | } | i | | | i i | | | | SWn t j
o9 | i i d d t | i i d t d na t j
oT | i i d d t | o | i i | n | i i d t d n Xd S( sD Authenticate user token
:param user_token: user's token id
:param retry: Ignored, as it is not longer relevant
:return uncrypted body of the token if the token is valid
:raise InvalidUserToken if token is rejected
:no longer raises ServiceError since it no longer makes RPC
i s& Token is marked as having been revokeds Token authorization faileds Token validation failure.t exc_infos Authorization failed for tokenN( Rz R R^ R. t _is_token_id_in_revoked_listR R RN R t is_pkizt verify_pkiz_tokenR R t
is_asn1_tokent verify_signed_tokent verify_uuid_tokenRU t _confirm_token_bindt storeR RR R R t
store_invalid( R R R R t token_idt token_idst cachedRS t tidt
is_revokedt verifiedRJ ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR sH
c C ss t i i d | } d i | i } t | o | i o t d n h d d 6| i d 6| i d 6| i d 6| i
d 6| i d
6| i d 6| i
d 6| i d
6| i d 6| i d 6| d 6| i d 6| i d 6| i
d 6| i
d 6| d 6} | i i d | i
| i | | i oP | i oC | i i } t | o t | } n t i | | d | D]6 } | i | } y | | =Wq t j
o q Xq Wd S( s% Remove http headers from environment.N( R' R] ( R R t keysR R( ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR s c C s | i | } | i | | S( s! Get http header from environment.( R' R^ ( R R R& R R( ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR s c C s' | t j o
d } n t | d S( Ns Token authorization failed( R RN ( R t msg( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyt _invalid_user_token s
c C sN | i d } | t i j o d SyP t | o | d d d } n* t | o | d d } n | i Wn t j
o
h } n X| t i t i f j } | p* | o d S| i i
d | i n | p | t i j o
d } n | } | o. | | j o! | i i
d | | i n xt
i | D]\ } } | t i j o | i d d i d j p | i i
d
| i n | i d | j p | i i
d | i n | i i d
qE| t i j o% | i i d h | d 6| d 6 qE| i i
d h | d 6| d 6 | i qEWd S( NR, R RH t binds% No bind information present in token.s* Named bind mode %s not in bind informationt AUTH_TYPER t negotiates. Kerberos credentials required and not present.t REMOTE_USERs0 Kerberos credentials do not match those in bind.s( Kerberos bind authentication successful.sI Ignoring Unknown bind for permissive mode: %(bind_type)s: %(identifier)s.t bind_typet
identifiers< Couldn`t verify unknown bind: %(bind_type)s: %(identifier)s.( R R3 R: RG RI R+ R] R; R< R R R= Rz Rx Ry R> R^ R_ R ( R RS R t bind_modeR, R- RW R0 R1 ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR sR
c C s | i p | i | _ n | i d j o` h | i d 6t | d 6} d } | i p | d } n | i d | d | \ } } n< h | i d 6} | i d d t | d | \ } } | i d j o | S| i d
j o | i i d t d n | i d
j o | i i
d d | _ n | i i
d | i | o! | i i
d | i | t S| i i d | t d S( s Authenticate user token with keystone.
:param user_token: user's token id
:param retry: flag that forces the middleware to retry
user authentication when an indeterminate
response is received. Optional.
:returns: token object received from keystone on success
:raise InvalidUserToken: if token is rejected
:raise ServiceError: if unable to authenticate token
s v3.0s X-Auth-Tokens X-Subject-Tokens /v3/auth/tokenss
?nocatalogR R s /v2.0/tokens/%si i s Authorization failed for tokens Token authorization failedi s( Keystone rejected admin token, resettings, Bad response code while validating token: %ss Retrying validations) Invalid user token. Keystone response: %sN( R R R Rp R+ R R R R RN R Rz R R R R ( R R R R R R RS ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR W sB
c C s: x3 | D]+ } | i | o | i i d t Sq Wt S( s: Indicate whether the token appears in the revocation list.s& Token is marked as having been revoked( R R R RR R ( R R
R ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyt is_signed_token_revoked s c C sA | i } | i d d } | p t Sd | D } | | j S( s= Indicate whether the token_id appears in the revocation list.t revokedc s s x | ] } | d Vq Wd S( R N( ( Rt t x( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pys s N( t token_revocation_listR^ Rz R ( R R t revocation_listt revoked_tokenst revoked_ids( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR s c s f d } y | SWni t i j
oZ i i y | SWq t i j
o" } i i d | i q Xn Xd S( s Verifies the signature of the provided data's IAW CMS syntax.
If either of the certificate files might be missing, fetch them and
retry.
c sd y, t i i i d i d SWn1 t i i j
o } i i d | n Xd S( Nt informs utf-8s Verify error: %s( R t
cms_verifyR R t decodet
subprocesst CalledProcessErrorR R ( t err( RS R R: ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR s s CMS Verify output: %sN( R t CertificateConfigErrort fetch_signing_certt
fetch_ca_certR R t output( R RS R: R R? ( ( R R: RS sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR; s
c C sB | i | o t d n t i | } | i | } | S( s< Check that the token is unrevoked and has a valid signature.s Token has been revoked( R3 RN R t token_to_cmsR; ( R t signed_textR
t formattedR ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR s
c C su | i | o t d n y/ t i | } | i | d t i } | SWn t j
o t | n Xd S( Ns Token has been revokedR: ( R3 RN R t pkiz_uncompressR; t
PKIZ_CMS_FORMt TypeError( R RE R
t uncompressedR ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR s c C s t i i | i o t i | i t i p t d | i n t i } t i | i i | j o | i
i d | n t i t i | i i
} | t i j o) | i
i d t | t t i q n t i | i t i d S( Ns unable to access signing_dir %ss signing_dir is not owned by %ss$ signing_dir mode is %s instead of %s( t osR t existsR R t W_OKR| t getuidt statt st_uidR R t S_IMODEt st_modet S_IRWXUt octt makedirs( R t uidt current_mode( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR s !c C sk | i pZ t i i | i o+ t i i | i } t i i | } n
t i i } | | _ n | i S( N( R RK R RL R t getmtimeRA t utcfromtimestampt min( R t mtimet fetched_time( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyt" token_revocation_list_fetched_time s
c C s
| | _ d S( N( R ( R t value( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR] s c C s | i | i } t i | j } | oz | i pl t i o h d d 6n h } t | i d | i i
} z% | ~ } t i | i
| _ Wd QXq n | i | _ | i S( Ns utf-8t encodingt r( R] R R R@ R Rx t PY3t openR t __exit__t __enter__R R t readt fetch_revocation_listR6 ( R R t list_is_currentt open_kwargst _[1]t f( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR6 s
,&c s} t | t i o | i d } n f d } y | | | Wn0 t t f j
o i | | | n Xd S( Ns utf-8c s\ t i d i d t i i } z | ~ } | i | Wd QXt i | i | d S( Nt dirt delete(
R t NamedTemporaryFileR R Rc Rd t writeRK t renameRW ( t destinationRS Ri Rj ( R ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyt
_atomic_write s ( t
isinstanceRx t text_typet encodet OSErrort IOErrorR ( R t file_nameR^ Rq ( ( R sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyt _atomic_write_to_signing_dir s
c C s8 t i | | _ t i | _ | i | i | d S( sm Save a revocation list to memory and to disk.
:param value: A json-encoded revocation list
N( R R R R R@ R] Rx R ( R R^ ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR6 s c C s h | i d 6} | i d d d | \ } } | i d j o5 | o* | i i d d | _ | i d t Sn | i d j o t d n d
| j o t d n | i
| d
S( Ns X-Auth-TokenR s /v2.0/tokens/revokedR i s4 Keystone rejected admin token, resetting admin tokenR i s& Unable to fetch token revocation list.t signeds% Revocation list improperly formatted.( R R R R R Rz R Rf R R R; ( R R R R RS ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyRf " s
c C s | i p | i | _ n | i d j o% | d j o
d } n d | } n d | } | i d | } | i d j o t i | i n | i | | i d S( Ns v3.0t signingt certificatess /v3/OS-SIMPLE-CERT/s /v2.0/certificates/R i ( R R R R R R@ R Rx ( R t cert_file_namet cert_typeR R ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyt _fetch_cert_file2 s
c C s | i | i d d S( NRz ( R~ R ( R ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyRA A s c C s | i | i d d S( Nt ca( R~ R ( R ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyRB D s N(, R8 R9 t __doc__R R R R R R R R R R Rz R R RR R R R' R R R R R+ R R R3 R R t
PKI_ASN1_FORMR; R R R t propertyR] t setterR6 Rx Rf R~ RA RB ( ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR sJ ~ ! $
(# * 4 1 @ 6
t CachePoolc B s) e Z d Z d Z e i d Z RS( s A lazy pool of cache references.c C s | | _ | | _ d S( N( t _environment_cachet _memcached_servers( R R R$ ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR K s c c ss | i d j o
| i Vd Sy | i } Wn% t j
o t i | i } n Xz | VWd | i | Xd S( s3 Context manager to manage a pooled cache reference.N( R Rz t popt
IndexErrorR t
get_clientR Rb ( R t c( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyt reserveO s ( R8 R9 R R t
contextlibt contextmanagerR ( ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR H s R c B sn e Z d Z d Z d
d
d
d
d
d
d Z d Z d Z d Z d Z d Z
d Z d Z RS( s Encapsulates the auth_token token cache functionality.
auth_token caches tokens that it's seen so that when a token is re-used the
middleware doesn't have to do a more expensive operation (like going to the
identity server) to validate the token.
initialize() must be called before calling the other methods.
Store a valid token in the cache using store(); mark a token as invalid in
the cache using store_invalid().
Check if a token is in the cache and retrieve it using get().
t invalidc C s | | _ | | _ | | _ | | _ | | _ | | _ | i d j o | i i | _ n | | _ d | _ t
| _ | i d S( N(
R t _cache_timet _hash_algorithmst _env_cache_nameR t _memcache_security_strategyRz R% t _memcache_secret_keyt _cache_poolR t _initializedt( _assert_valid_memcache_protection_config( R t logR R/ R R$ R) R* ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR u s c C s= | i o d St | i | i | i | _ t | _ d S( N( R R R^ R R R RR ( R R ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR s
c s t i p t i o\ t f d | i D } x/ | D]' } | i | } | o | | f SqF W| d f S } | i | } | g | f S( sS Check if the token is cached already.
Returns a tuple. The first element is a list of token IDs, where the
first one is the preferred hash.
The second element is the token data from the cache if the token was
cached, otherwise ``None``.
:raises InvalidUserToken: if the token is invalid
c 3 s( x! | ] } t i d | Vq Wd S( t modeN( R t cms_hash_token( Rt t algo( R ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pys s N( R R R R` R t
_cache_getRz ( R R t token_hashest
token_hashR R ( ( R sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR^ s
c C s* | i i d | i | | | f d S( s Put token data into the cache.
Stores the parsed expire date in cache allowing
quick check of token freshness on retrieval.
s Storing token in cacheN( R R t _cache_store( R R RS RJ ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR s c C s' | i i d | i | | i d S( s Store invalid token in cache.s& Marking token as unauthorized in cacheN( R R R t _INVALID_INDICATOR( R R ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR s c C sL | i o> | i d j o t d n | i p t d qH n d S( Nt MACt ENCRYPTs1 memcache_security_strategy must be ENCRYPT or MACsP memcache_secret_key must be defined when a memcache_security_strategy is defined( R R ( R R| R ( R ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR s
c C sx | p d S| i d j oI t | } | i i i i } z | ~ } | i | } Wd QXn
| i } t | t
i o | i d } n | i } t | t
i o | i d } n t
i | | | } t t
i | } | i i i i }
z |
~
} | i | } Wd QXy t
i | | } Wn/ t j
o# d } | i i | d } n X| d j o d St | t
i p | i d } n t i | }
|
| i j o | i i d t d n |
\ } } y t i | } Wn t j
o d SXt i | } t i } | | j o | i i d | S| i i d t d d S( s Return token information from cache.
If token is invalid raise InvalidUserToken
return token only if fresh (not expired).
Ns utf-8s# Failed to decrypt/verify cache datas# Cached Token is marked unauthorizeds Token authorization faileds Returning cached tokens Cached Token seems expired( R Rz t CACHE_KEY_TEMPLATER R Rc Rd R^ R Rr Rx t string_typesRt R t derive_keyst
get_cache_keyt unprotect_dataR R t exceptionR< R R R R RN R RO R{ RP R@ ( R R R& Ri R t
serializedt
secret_keyt security_strategyR) t cache_keyt _[2]t
raw_cachedR* R RS RJ R@ ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR s^
& &
c C s: t i | } t | t i o | i d } n | i d j o t | } | } n | i } t | t i
o | i d } n | i } t | t i
o | i d } n t i | | | } t t i
| } t i | | } | i i i i } z& | ~ }
|
i | | d | i Wd QXd S( sl Store value into memcache.
data may be _INVALID_INDICATOR or a tuple like (data, expires)
s utf-8R N( R R Rr Rx Rs Rt R Rz R R R R R R t protect_dataR R Rc Rd t setR ( R R RS t serialized_dataR t
data_to_storeR R R) Ri R ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR s$
&N(
R8 R9 R R Rz R R R^ R R R R R ( ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyR c s
Ic s, | i i | f d } | S( s4 Returns a WSGI filter app for use with paste.deploy.c s
t | S( N( R ( R ( R} ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyt auth_filter5 s ( t copyR ( t global_conft
local_confR ( ( R} sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyt filter_factory0 s
c K s& | i } | i | t d | S( N( R R R Rz ( R R R} ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyt app_factory: s
t __main__c c sA | d d g t d t i | D } t i | Vd S( s? A WSGI application that echoes the CGI environment to the user.s 200 OKs Content-Types application/jsonc s s9 x2 | ]+ \ } } | i d o | | f Vq q Wd S( t HTTP_X_N( t
startswith( Rt R R ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pys M s N( s Content-Types application/json( Rv Rx Ry R R ( t environR t environment( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyt echo_appJ s ( t
simple_servert httpt ADMINi@ s' Serving on port 8000 (Ctrl+C to end)...(G R R RA R RK RO R R R t oslo_configR t oslo_serializationR t
oslo_utilsR R Rx t six.movesR t keystoneclientR t keystoneclient.commonR R t keystoneclient.middlewareR t keystoneclient.openstack.commonR R t StrOptt IntOptRz t BoolOptR RR t ListOptRw R t
register_optsR R t objectR3 RE RG RI RU Rk Rp R R RN R R| R R R R` R R R R R8 R t wsgirefR R} R t make_servert servert
serve_forever( ( ( sS /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/middleware/auth_token.pyt s
$
k