keystone.auth.plugins.mapped module

class keystone.auth.plugins.mapped.Mapped[source]

Bases: AuthMethodHandler

authenticate(auth_payload)[source]

Authenticate mapped user and set an authentication context.

Parameters:

auth_payload – the content of the authentication for a given method

In addition to user_id in response_data, this plugin sets group_ids, OS-FEDERATION:identity_provider and OS-FEDERATION:protocol

keystone.auth.plugins.mapped.apply_mapping_filter(identity_provider, protocol, assertion, resource_api, federation_api, identity_api)[source]
keystone.auth.plugins.mapped.extract_assertion_data()[source]
keystone.auth.plugins.mapped.get_user_unique_id_and_display_name(mapped_properties)[source]

Setup federated username.

Function covers all the cases for properly setting user id, a primary identifier for identity objects. Initial version of the mapping engine assumed user is identified by name and his id is built from the name. We, however need to be able to accept local rules that identify user by either id or name/domain.

The following use-cases are covered:

  1. If neither user_name nor user_id is set raise exception.Unauthorized

  2. If user_id is set and user_name not, set user_name equal to user_id

  3. If user_id is not set and user_name is, set user_id as url safe version of user_name.

Parameters:

mapped_properties – Properties issued by a RuleProcessor.

Type:

dictionary

Raises:

keystone.exception.Unauthorized – If neither user_name nor user_id is set.

Returns:

tuple with user identification

Return type:

tuple

keystone.auth.plugins.mapped.handle_scoped_token(token, federation_api, identity_api)[source]
keystone.auth.plugins.mapped.handle_unscoped_token(auth_payload, resource_api, federation_api, identity_api, assignment_api, role_api)[source]