#NEWLINE# def authenticate( self , auth_url = None , **kwargs ) : #NEWLINE# #INDENT# 'Authenticates a user via the Keystone Identity API.' #NEWLINE# LOG . debug ( 'Beginning user authentication' ) #NEWLINE# if ( not auth_url ) : #NEWLINE# #INDENT# auth_url = settings . OPENSTACK_KEYSTONE_URL #NEWLINE# #UNINDENT# auth_url = utils . fix_auth_url_version ( auth_url ) #NEWLINE# for plugin in self . auth_plugins : #NEWLINE# #INDENT# unscoped_auth = plugin . get_plugin ( auth_url = auth_url , ** kwargs ) #NEWLINE# if unscoped_auth : #NEWLINE# #INDENT# break #NEWLINE# #UNINDENT# #UNINDENT# else : #NEWLINE# #INDENT# msg = _ ( 'No authentication backend could be determined to handle the provided credentials.' ) #NEWLINE# LOG . warning ( 'No authentication backend could be determined to handle the provided credentials. This is likely a configuration error that should be addressed.' ) #NEWLINE# raise exceptions . KeystoneAuthException ( msg ) #NEWLINE# #UNINDENT# session = utils . get_session ( ) #NEWLINE# keystone_client_class = utils . get_keystone_client ( ) . Client #NEWLINE# try : #NEWLINE# #INDENT# unscoped_auth_ref = unscoped_auth . get_access ( session ) #NEWLINE# #UNINDENT# except keystone_exceptions . ConnectFailure as exc : #NEWLINE# #INDENT# LOG . error ( str ( exc ) ) #NEWLINE# msg = _ ( 'Unable to establish connection to keystone endpoint.' ) #NEWLINE# raise exceptions . KeystoneAuthException ( msg ) #NEWLINE# #UNINDENT# except ( keystone_exceptions . Unauthorized , keystone_exceptions . Forbidden , keystone_exceptions . NotFound ) as exc : #NEWLINE# #INDENT# LOG . debug ( str ( exc ) ) #NEWLINE# raise exceptions . KeystoneAuthException ( _ ( 'Invalid credentials.' ) ) #NEWLINE# #UNINDENT# except ( keystone_exceptions . ClientException , keystone_exceptions . AuthorizationFailure ) as exc : #NEWLINE# #INDENT# msg = _ ( 'An error occurred authenticating. Please try again later.' ) #NEWLINE# LOG . debug ( str ( exc ) ) #NEWLINE# raise exceptions . KeystoneAuthException ( msg ) #NEWLINE# #UNINDENT# self . check_auth_expiry ( unscoped_auth_ref ) #NEWLINE# domain_auth = None #NEWLINE# domain_auth_ref = None #NEWLINE# if ( ( utils . get_keystone_version ( ) >= 3 ) and ( 'user_domain_name' in kwargs ) ) : #NEWLINE# #INDENT# try : #NEWLINE# #INDENT# token = unscoped_auth_ref . auth_token #NEWLINE# domain_auth = utils . get_token_auth_plugin ( auth_url , token , domain_name = kwargs [ 'user_domain_name' ] ) #NEWLINE# domain_auth_ref = domain_auth . get_access ( session ) #NEWLINE# #UNINDENT# except Exception : #NEWLINE# #INDENT# LOG . debug ( 'Error getting domain scoped token.' , exc_info = True ) #NEWLINE# #UNINDENT# #UNINDENT# projects = plugin . list_projects ( session , unscoped_auth , unscoped_auth_ref ) #NEWLINE# projects = [ project for project in projects if project . enabled ] #NEWLINE# if ( ( not projects ) and ( not domain_auth_ref ) ) : #NEWLINE# #INDENT# msg = _ ( 'You are not authorized for any projects.' ) #NEWLINE# if ( utils . get_keystone_version ( ) >= 3 ) : #NEWLINE# #INDENT# msg = _ ( 'You are not authorized for any projects or domains.' ) #NEWLINE# #UNINDENT# raise exceptions . KeystoneAuthException ( msg ) #NEWLINE# #UNINDENT# recent_project = None #NEWLINE# request = kwargs . get ( 'request' ) #NEWLINE# if request : #NEWLINE# #INDENT# recent_project = request . COOKIES . get ( 'recent_project' ) #NEWLINE# #UNINDENT# if recent_project : #NEWLINE# #INDENT# for ( pos , project ) in enumerate ( projects ) : #NEWLINE# #INDENT# if ( project . id == recent_project ) : #NEWLINE# #INDENT# projects . pop ( pos ) #NEWLINE# projects . insert ( 0 , project ) #NEWLINE# break #NEWLINE# #UNINDENT# #UNINDENT# #UNINDENT# for project in projects : #NEWLINE# #INDENT# token = unscoped_auth_ref . auth_token #NEWLINE# scoped_auth = utils . get_token_auth_plugin ( auth_url , token = token , project_id = project . id ) #NEWLINE# try : #NEWLINE# #INDENT# scoped_auth_ref = scoped_auth . get_access ( session ) #NEWLINE# #UNINDENT# except ( keystone_exceptions . ClientException , keystone_exceptions . AuthorizationFailure ) : #NEWLINE# #INDENT# pass #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# break #NEWLINE# #UNINDENT# #UNINDENT# else : #NEWLINE# #INDENT# if domain_auth_ref : #NEWLINE# #INDENT# scoped_auth = domain_auth #NEWLINE# scoped_auth_ref = domain_auth_ref #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# msg = _ ( 'Unable to authenticate to any available projects.' ) #NEWLINE# raise exceptions . KeystoneAuthException ( msg ) #NEWLINE# #UNINDENT# #UNINDENT# self . check_auth_expiry ( scoped_auth_ref ) #NEWLINE# region_name = None #NEWLINE# id_endpoints = scoped_auth_ref . service_catalog . get_endpoints ( service_type = 'identity' ) #NEWLINE# for id_endpoint in [ cat for cat in id_endpoints [ 'identity' ] ] : #NEWLINE# #INDENT# if ( auth_url in id_endpoint . values ( ) ) : #NEWLINE# #INDENT# region_name = id_endpoint [ 'region' ] #NEWLINE# break #NEWLINE# #UNINDENT# #UNINDENT# interface = getattr ( settings , 'OPENSTACK_ENDPOINT_TYPE' , 'public' ) #NEWLINE# endpoint = utils . fix_auth_url_version ( scoped_auth_ref . service_catalog . url_for ( service_type = 'identity' , interface = interface , region_name = region_name ) ) #NEWLINE# unscoped_token = unscoped_auth_ref . auth_token #NEWLINE# user = auth_user . create_user_from_token ( request , auth_user . Token ( scoped_auth_ref , unscoped_token = unscoped_token ) , endpoint , services_region = region_name ) #NEWLINE# if ( request is not None ) : #NEWLINE# #INDENT# request . session [ 'unscoped_token' ] = unscoped_token #NEWLINE# if domain_auth_ref : #NEWLINE# #INDENT# if utils . using_cookie_backed_sessions ( ) : #NEWLINE# #INDENT# LOG . error ( 'Using signed cookies as SESSION_ENGINE with OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT is enabled. This disables the ability to perform identity operations due to cookie size constraints.' ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# request . session [ 'domain_token' ] = domain_auth_ref #NEWLINE# #UNINDENT# #UNINDENT# request . user = user #NEWLINE# timeout = getattr ( settings , 'SESSION_TIMEOUT' , 3600 ) #NEWLINE# token_life = ( user . token . expires - datetime . datetime . now ( pytz . utc ) ) #NEWLINE# session_time = min ( timeout , token_life . seconds ) #NEWLINE# request . session . set_expiry ( session_time ) #NEWLINE# scoped_client = keystone_client_class ( session = session , auth = scoped_auth ) #NEWLINE# setattr ( request , KEYSTONE_CLIENT_ATTR , scoped_client ) #NEWLINE# #UNINDENT# LOG . debug ( 'Authentication completed.' ) #NEWLINE# return user