Class: Occi::Api::Client::Http::AuthnPlugins::KeystoneV3

Inherits:
Object
  • Object
show all
Defined in:
lib/occi/api/client/http/authn_plugins/keystone.rb

Instance Method Summary collapse

Constructor Details

#initialize(base_url, env_ref, options = {}) ⇒ KeystoneV3

Returns a new instance of KeystoneV3.



194
195
196
197
198
 
# File 'lib/occi/api/client/http/authn_plugins/keystone.rb', line 194

def initialize(base_url, env_ref, options = {})
  @base_url = base_url
  @env_ref = env_ref
  @options = options
end

Instance Method Details

#get_first_working_project ⇒ Object 



254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
 
# File 'lib/occi/api/client/http/authn_plugins/keystone.rb', line 254

def get_first_working_project
  response = @env_ref.class.get(
    "#{@base_url}/auth/projects",
    :headers => get_req_headers
  )
  Occi::Api::Log.debug response.inspect

  if !response.success? || response['projects'].blank?
    raise ::Occi::Api::Client::Errors::AuthnError,
          "Keystone didn't return any projects, fallback failed!"
  end

  response['projects'].each do |project|
    begin
      Occi::Api::Log.debug "Authenticating for project #{project['name'].inspect}"
      set_scoped_token project['id']
      break # found a working project, stop looking
    rescue ::Occi::Api::Client::Errors::AuthnError
      # ignoring and trying the next tenant
    end
  end
end

#get_req_headers ⇒ Object 



305
306
307
308
309
310
311
 
# File 'lib/occi/api/client/http/authn_plugins/keystone.rb', line 305

def get_req_headers
  headers = @env_ref.class.headers.clone
  headers['Content-Type'] = 'application/json'
  headers['Accept'] = headers['Content-Type']

  headers
end

#passwd_authenticate ⇒ Object

Raises:



215
216
217
218
 
# File 'lib/occi/api/client/http/authn_plugins/keystone.rb', line 215

def passwd_authenticate
  raise ::Occi::Api::Client::Errors::AuthnError,
        "Needs to be implemented, check http://developer.openstack.org/api-ref-identity-v3.html#authenticatePasswordUnscoped"
end

#set_auth_token(tenant = nil) ⇒ Object 



200
201
202
203
204
205
206
207
208
209
210
211
212
213
 
# File 'lib/occi/api/client/http/authn_plugins/keystone.rb', line 200

def set_auth_token(tenant = nil)
  if @options[:original_type] == "x509"
    set_voms_unscoped_token
  elsif @options[:type] == "oauth2"
    set_oauth2_unscoped_token
  elsif @options[:username] && @options[:password]
    passwd_authenticate
  else
    raise ::Occi::Api::Client::Errors::AuthnError,
          "Unable to request a token from Keystone! Chosen AuthN is not supported, fallback failed!"
  end

  tenant.blank? ? get_first_working_project : set_scoped_token(tenant)
end

#set_oauth2_unscoped_token ⇒ Object 



236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
 
# File 'lib/occi/api/client/http/authn_plugins/keystone.rb', line 236

def set_oauth2_unscoped_token
  headers = get_req_headers
  headers['Authorization'] = "Bearer #{@options[:token]}"
  response = @env_ref.class.get(
    # FIXME(enolfc) egi.eu and oidc below should be configurable
    "#{@base_url}/OS-FEDERATION/identity_providers/egi.eu/protocols/oidc/auth",
    :headers => headers
  )
  Occi::Api::Log.debug response.inspect

  if !response.success? || response.headers['x-subject-token'].blank?
    raise ::Occi::Api::Client::Errors::AuthnError,
          "Unable to get a token from Keystone, fallback failed!"
  end

  @env_ref.class.headers['X-Auth-Token'] = response.headers['x-subject-token']
end

#set_scoped_token(project) ⇒ Object 



277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
 
# File 'lib/occi/api/client/http/authn_plugins/keystone.rb', line 277

def set_scoped_token(project)
  body = {
    "auth" => {
      "identity" => {
        "methods" => ["token"],
        "token" => { "id" => @env_ref.class.headers['X-Auth-Token'] }
      },
      "scope" => {
        "project" => { "id" => project }
      }
    }
  }

  response = @env_ref.class.post(
    "#{@base_url}/auth/tokens",
    :body => body.to_json,
    :headers => get_req_headers
  )
  Occi::Api::Log.debug response.inspect

  if !response.success? || response.headers['x-subject-token'].blank?
    raise ::Occi::Api::Client::Errors::AuthnError,
          "Unable to get a token from Keystone, fallback failed!"
  end

  @env_ref.class.headers['X-Auth-Token'] = response.headers['x-subject-token']
end

#set_voms_unscoped_token ⇒ Object 



220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
 
# File 'lib/occi/api/client/http/authn_plugins/keystone.rb', line 220

def set_voms_unscoped_token
  response = @env_ref.class.get(
    # FIXME(enolfc) egi.eu and mapped below should be configurable
    "#{@base_url}/OS-FEDERATION/identity_providers/egi.eu/protocols/mapped/auth",
    :headers => get_req_headers
  )
  Occi::Api::Log.debug response.inspect

  if !response.success? || response.headers['x-subject-token'].blank?
    raise ::Occi::Api::Client::Errors::AuthnError,
          "Unable to get a token from Keystone, fallback failed!"
  end

  @env_ref.class.headers['X-Auth-Token'] = response.headers['x-subject-token']
end