301 lines
13 KiB
Python
301 lines
13 KiB
Python
|
import logging
|
||
|
|
import os
|
||
|
|
|
||
|
|
from keystoneauth1.identity import v2 as keystone_v2_auth
|
||
|
|
from keystoneauth1.identity import v3 as keystone_v3_auth
|
||
|
|
from keystoneauth1 import session
|
||
|
|
from keystoneauth1.exceptions import ClientException
|
||
|
|
from keystoneclient.v2_0 import client as client_v2
|
||
|
|
from keystoneclient.v3 import client as client_v3
|
||
|
|
from keystoneclient.exceptions import AuthorizationFailure as KeystoneAuthorizationFailure
|
||
|
|
from keystoneclient.exceptions import Unauthorized as KeystoneUnauthorized
|
||
|
|
from keystoneclient.exceptions import NotFound as KeystoneNotFound
|
||
|
|
from data.users.federated import FederatedUsers, UserInformation
|
||
|
|
from util.itertoolrecipes import take
|
||
|
|
|
||
|
|
logger = logging.getLogger(__name__)
|
||
|
|
|
||
|
|
DEFAULT_TIMEOUT = 10 # seconds
|
||
|
|
|
||
|
|
def get_keystone_users(auth_version, auth_url, admin_username, admin_password, admin_tenant,
|
||
|
|
timeout=None, requires_email=True):
|
||
|
|
if auth_version == 3:
|
||
|
|
return KeystoneV3Users(auth_url, admin_username, admin_password, admin_tenant, timeout,
|
||
|
|
requires_email)
|
||
|
|
else:
|
||
|
|
return KeystoneV2Users(auth_url, admin_username, admin_password, admin_tenant, timeout,
|
||
|
|
requires_email)
|
||
|
|
|
||
|
|
|
||
|
|
class KeystoneV2Users(FederatedUsers):
|
||
|
|
""" Delegates authentication to OpenStack Keystone V2. """
|
||
|
|
def __init__(self, auth_url, admin_username, admin_password, admin_tenant, timeout=None,
|
||
|
|
requires_email=True):
|
||
|
|
super(KeystoneV2Users, self).__init__('keystone', requires_email)
|
||
|
|
self.auth_url = auth_url
|
||
|
|
self.admin_username = admin_username
|
||
|
|
self.admin_password = admin_password
|
||
|
|
self.admin_tenant = admin_tenant
|
||
|
|
self.timeout = timeout or DEFAULT_TIMEOUT
|
||
|
|
self.debug = os.environ.get('USERS_DEBUG') == '1'
|
||
|
|
self.requires_email = requires_email
|
||
|
|
|
||
|
|
def _get_client(self, username, password, tenant_name=None):
|
||
|
|
if tenant_name:
|
||
|
|
auth = keystone_v2_auth.Password(auth_url=self.auth_url,
|
||
|
|
username=username,
|
||
|
|
password=password,
|
||
|
|
tenant_name=tenant_name)
|
||
|
|
else:
|
||
|
|
auth = keystone_v2_auth.Password(auth_url=self.auth_url,
|
||
|
|
username=username,
|
||
|
|
password=password)
|
||
|
|
|
||
|
|
sess = session.Session(auth=auth)
|
||
|
|
client = client_v2.Client(session=sess,
|
||
|
|
timeout=self.timeout,
|
||
|
|
debug=self.debug)
|
||
|
|
return client, sess
|
||
|
|
|
||
|
|
def ping(self):
|
||
|
|
try:
|
||
|
|
_, sess = self._get_client(self.admin_username, self.admin_password, self.admin_tenant)
|
||
|
|
assert sess.get_user_id() # Make sure we loaded a valid user.
|
||
|
|
except KeystoneUnauthorized as kut:
|
||
|
|
logger.exception('Keystone unauthorized admin')
|
||
|
|
return (False, 'Keystone admin credentials are invalid: %s' % kut.message)
|
||
|
|
except ClientException as e:
|
||
|
|
logger.exception('Keystone unauthorized admin')
|
||
|
|
return (False, 'Keystone ping check failed: %s' % e.message)
|
||
|
|
|
||
|
|
return (True, None)
|
||
|
|
|
||
|
|
def at_least_one_user_exists(self):
|
||
|
|
logger.debug('Checking if any users exist in Keystone')
|
||
|
|
try:
|
||
|
|
keystone_client, _ = self._get_client(self.admin_username, self.admin_password,
|
||
|
|
self.admin_tenant)
|
||
|
|
user_list = keystone_client.users.list(tenant_id=self.admin_tenant, limit=1)
|
||
|
|
|
||
|
|
if len(user_list) < 1:
|
||
|
|
return (False, None)
|
||
|
|
|
||
|
|
return (True, None)
|
||
|
|
except ClientException as e:
|
||
|
|
# Catch exceptions to give the user our custom error message
|
||
|
|
logger.exception('Unable to list users in Keystone')
|
||
|
|
return (False, e.message)
|
||
|
|
|
||
|
|
def verify_credentials(self, username_or_email, password):
|
||
|
|
try:
|
||
|
|
_, sess = self._get_client(username_or_email, password)
|
||
|
|
user_id = sess.get_user_id()
|
||
|
|
except KeystoneAuthorizationFailure as kaf:
|
||
|
|
logger.exception('Keystone auth failure for user: %s', username_or_email)
|
||
|
|
return (None, 'Invalid username or password')
|
||
|
|
except KeystoneUnauthorized as kut:
|
||
|
|
logger.exception('Keystone unauthorized for user: %s', username_or_email)
|
||
|
|
return (None, 'Invalid username or password')
|
||
|
|
except ClientException as ex:
|
||
|
|
logger.exception('Keystone unauthorized for user: %s', username_or_email)
|
||
|
|
return (None, 'Invalid username or password')
|
||
|
|
|
||
|
|
if user_id is None:
|
||
|
|
return (None, 'Invalid username or password')
|
||
|
|
|
||
|
|
try:
|
||
|
|
admin_client, _ = self._get_client(self.admin_username, self.admin_password,
|
||
|
|
self.admin_tenant)
|
||
|
|
user = admin_client.users.get(user_id)
|
||
|
|
except KeystoneUnauthorized as kut:
|
||
|
|
logger.exception('Keystone unauthorized admin')
|
||
|
|
return (None, 'Keystone admin credentials are invalid: %s' % kut.message)
|
||
|
|
|
||
|
|
if self.requires_email and not hasattr(user, 'email'):
|
||
|
|
return (None, 'Missing email field for user %s' % user_id)
|
||
|
|
|
||
|
|
email = user.email if hasattr(user, 'email') else None
|
||
|
|
return (UserInformation(username=username_or_email, email=email, id=user_id), None)
|
||
|
|
|
||
|
|
def query_users(self, query, limit=20):
|
||
|
|
return (None, self.federated_service, 'Unsupported in Keystone V2')
|
||
|
|
|
||
|
|
def get_user(self, username_or_email):
|
||
|
|
return (None, 'Unsupported in Keystone V2')
|
||
|
|
|
||
|
|
|
||
|
|
class KeystoneV3Users(FederatedUsers):
|
||
|
|
""" Delegates authentication to OpenStack Keystone V3. """
|
||
|
|
def __init__(self, auth_url, admin_username, admin_password, admin_tenant, timeout=None,
|
||
|
|
requires_email=True, project_domain_id='default', user_domain_id='default'):
|
||
|
|
super(KeystoneV3Users, self).__init__('keystone', requires_email)
|
||
|
|
self.auth_url = auth_url
|
||
|
|
self.admin_username = admin_username
|
||
|
|
self.admin_password = admin_password
|
||
|
|
self.admin_tenant = admin_tenant
|
||
|
|
self.project_domain_id = project_domain_id
|
||
|
|
self.user_domain_id = user_domain_id
|
||
|
|
self.timeout = timeout or DEFAULT_TIMEOUT
|
||
|
|
self.debug = os.environ.get('USERS_DEBUG') == '1'
|
||
|
|
self.requires_email = requires_email
|
||
|
|
|
||
|
|
def _get_client(self, username, password, project_name=None):
|
||
|
|
if project_name:
|
||
|
|
auth = keystone_v3_auth.Password(auth_url=self.auth_url,
|
||
|
|
username=username,
|
||
|
|
password=password,
|
||
|
|
project_name=project_name,
|
||
|
|
project_domain_id=self.project_domain_id,
|
||
|
|
user_domain_id=self.user_domain_id)
|
||
|
|
else:
|
||
|
|
auth = keystone_v3_auth.Password(auth_url=self.auth_url,
|
||
|
|
username=username,
|
||
|
|
password=password,
|
||
|
|
user_domain_id=self.user_domain_id)
|
||
|
|
|
||
|
|
sess = session.Session(auth=auth)
|
||
|
|
client = client_v3.Client(session=sess,
|
||
|
|
timeout=self.timeout,
|
||
|
|
debug=self.debug)
|
||
|
|
return client, sess
|
||
|
|
|
||
|
|
def ping(self):
|
||
|
|
try:
|
||
|
|
_, sess = self._get_client(self.admin_username, self.admin_password)
|
||
|
|
assert sess.get_user_id() # Make sure we loaded a valid user.
|
||
|
|
except KeystoneUnauthorized as kut:
|
||
|
|
logger.exception('Keystone unauthorized admin')
|
||
|
|
return (False, 'Keystone admin credentials are invalid: %s' % kut.message)
|
||
|
|
except ClientException as cle:
|
||
|
|
logger.exception('Keystone unauthorized admin')
|
||
|
|
return (False, 'Keystone ping check failed: %s' % cle.message)
|
||
|
|
|
||
|
|
return (True, None)
|
||
|
|
|
||
|
|
def at_least_one_user_exists(self):
|
||
|
|
logger.debug('Checking if any users exist in admin tenant in Keystone')
|
||
|
|
try:
|
||
|
|
# Just make sure the admin can connect to the project.
|
||
|
|
self._get_client(self.admin_username, self.admin_password, self.admin_tenant)
|
||
|
|
return (True, None)
|
||
|
|
except ClientException as cle:
|
||
|
|
# Catch exceptions to give the user our custom error message
|
||
|
|
logger.exception('Unable to list users in Keystone')
|
||
|
|
return (False, cle.message)
|
||
|
|
|
||
|
|
def verify_credentials(self, username_or_email, password):
|
||
|
|
try:
|
||
|
|
keystone_client, sess = self._get_client(username_or_email, password)
|
||
|
|
user_id = sess.get_user_id()
|
||
|
|
assert user_id
|
||
|
|
|
||
|
|
keystone_client, sess = self._get_client(self.admin_username, self.admin_password,
|
||
|
|
self.admin_tenant)
|
||
|
|
user = keystone_client.users.get(user_id)
|
||
|
|
if self.requires_email and not hasattr(user, 'email'):
|
||
|
|
return (None, 'Missing email field for user %s' % user_id)
|
||
|
|
|
||
|
|
return (self._user_info(user), None)
|
||
|
|
except KeystoneAuthorizationFailure as kaf:
|
||
|
|
logger.exception('Keystone auth failure for user: %s', username_or_email)
|
||
|
|
return (None, 'Invalid username or password')
|
||
|
|
except KeystoneUnauthorized as kut:
|
||
|
|
logger.exception('Keystone unauthorized for user: %s', username_or_email)
|
||
|
|
return (None, 'Invalid username or password')
|
||
|
|
except ClientException as cle:
|
||
|
|
logger.exception('Keystone unauthorized for user: %s', username_or_email)
|
||
|
|
return (None, 'Invalid username or password')
|
||
|
|
|
||
|
|
def get_user(self, username_or_email):
|
||
|
|
users_found, _, err_msg = self.query_users(username_or_email)
|
||
|
|
if err_msg is not None:
|
||
|
|
return (None, err_msg)
|
||
|
|
|
||
|
|
if len(users_found) != 1:
|
||
|
|
return (None, 'Single user not found')
|
||
|
|
|
||
|
|
user = users_found[0]
|
||
|
|
if self.requires_email and not user.email:
|
||
|
|
return (None, 'Missing email field for user %s' % user.id)
|
||
|
|
|
||
|
|
return (user, None)
|
||
|
|
|
||
|
|
def check_group_lookup_args(self, group_lookup_args):
|
||
|
|
if not group_lookup_args.get('group_id'):
|
||
|
|
return (False, 'Missing group_id')
|
||
|
|
|
||
|
|
group_id = group_lookup_args['group_id']
|
||
|
|
return self._check_group(group_id)
|
||
|
|
|
||
|
|
def _check_group(self, group_id):
|
||
|
|
try:
|
||
|
|
admin_client, _ = self._get_client(self.admin_username, self.admin_password,
|
||
|
|
self.admin_tenant)
|
||
|
|
return (bool(admin_client.groups.get(group_id)), None)
|
||
|
|
except KeystoneNotFound:
|
||
|
|
return (False, 'Group not found')
|
||
|
|
except KeystoneAuthorizationFailure as kaf:
|
||
|
|
logger.exception('Keystone auth failure for admin user for group lookup %s', group_id)
|
||
|
|
return (False, kaf.message or 'Invalid admin username or password')
|
||
|
|
except KeystoneUnauthorized as kut:
|
||
|
|
logger.exception('Keystone unauthorized for admin user for group lookup %s', group_id)
|
||
|
|
return (False, kut.message or 'Invalid admin username or password')
|
||
|
|
except ClientException as cle:
|
||
|
|
logger.exception('Keystone unauthorized for admin user for group lookup %s', group_id)
|
||
|
|
return (False, cle.message or 'Invalid admin username or password')
|
||
|
|
|
||
|
|
def iterate_group_members(self, group_lookup_args, page_size=None, disable_pagination=False):
|
||
|
|
group_id = group_lookup_args['group_id']
|
||
|
|
|
||
|
|
(status, err) = self._check_group(group_id)
|
||
|
|
if not status:
|
||
|
|
return (None, err)
|
||
|
|
|
||
|
|
try:
|
||
|
|
admin_client, _ = self._get_client(self.admin_username, self.admin_password,
|
||
|
|
self.admin_tenant)
|
||
|
|
user_info_iterator = admin_client.users.list(group=group_id)
|
||
|
|
def iterator():
|
||
|
|
for user in user_info_iterator:
|
||
|
|
yield (self._user_info(user), None)
|
||
|
|
|
||
|
|
return (iterator(), None)
|
||
|
|
except KeystoneAuthorizationFailure as kaf:
|
||
|
|
logger.exception('Keystone auth failure for admin user for group lookup %s', group_id)
|
||
|
|
return (False, kaf.message or 'Invalid admin username or password')
|
||
|
|
except KeystoneUnauthorized as kut:
|
||
|
|
logger.exception('Keystone unauthorized for admin user for group lookup %s', group_id)
|
||
|
|
return (False, kut.message or 'Invalid admin username or password')
|
||
|
|
except ClientException as cle:
|
||
|
|
logger.exception('Keystone unauthorized for admin user for group lookup %s', group_id)
|
||
|
|
return (False, cle.message or 'Invalid admin username or password')
|
||
|
|
|
||
|
|
@staticmethod
|
||
|
|
def _user_info(user):
|
||
|
|
email = user.email if hasattr(user, 'email') else None
|
||
|
|
return UserInformation(user.name, email, user.id)
|
||
|
|
|
||
|
|
def query_users(self, query, limit=20):
|
||
|
|
if len(query) < 3:
|
||
|
|
return ([], self.federated_service, None)
|
||
|
|
|
||
|
|
try:
|
||
|
|
admin_client, _ = self._get_client(self.admin_username, self.admin_password,
|
||
|
|
self.admin_tenant)
|
||
|
|
|
||
|
|
found_users = list(take(limit, admin_client.users.list(name=query)))
|
||
|
|
logger.debug('For Keystone query %s found users: %s', query, found_users)
|
||
|
|
if not found_users:
|
||
|
|
return ([], self.federated_service, None)
|
||
|
|
|
||
|
|
return ([self._user_info(user) for user in found_users], self.federated_service, None)
|
||
|
|
except KeystoneAuthorizationFailure as kaf:
|
||
|
|
logger.exception('Keystone auth failure for admin user for query %s', query)
|
||
|
|
return (None, self.federated_service, kaf.message or 'Invalid admin username or password')
|
||
|
|
except KeystoneUnauthorized as kut:
|
||
|
|
logger.exception('Keystone unauthorized for admin user for query %s', query)
|
||
|
|
return (None, self.federated_service, kut.message or 'Invalid admin username or password')
|
||
|
|
except ClientException as cle:
|
||
|
|
logger.exception('Keystone unauthorized for admin user for query %s', query)
|
||
|
|
return (None, self.federated_service, cle.message or 'Invalid admin username or password')
|