keystone.models package

Submodules

keystone.models.revoke_model module

class keystone.models.revoke_model.RevokeEvent(**kwargs)

Bases: object

to_dict()

keystone.models.revoke_model.blank_token_data(issued_at)

keystone.models.revoke_model.build_token_values(token_data)

keystone.models.revoke_model.build_token_values_v2(access, default_domain_id)

keystone.models.revoke_model.is_revoked(events, token_data)

Check if a token matches a revocation event.

Compare a token against every revocation event. If the token matches an event in the events list, the token is revoked. If the token is compared against every item in the list without a match, it is not considered revoked from the revoke_api.

Parameters:

• events – a list of RevokeEvent instances
• token_data – map based on a flattened view of the token. The required fields are expires_at,`user_id`, project_id, identity_domain_id, assignment_domain_id, trust_id, trustor_id, trustee_id consumer_id and access_token_id

Returns:

True if the token matches an existing revocation event, meaning the token is revoked. False is returned if the token does not match any revocation events, meaning the token is considered valid by the revocation API.

keystone.models.revoke_model.matches(event, token_values)

See if the token matches the revocation event.

A brute force approach to checking. Compare each attribute from the event with the corresponding value from the token. If the event does not have a value for the attribute, a match is still possible. If the event has a value for the attribute, and it does not match the token, no match is possible, so skip the remaining checks.

Parameters:

• event – a RevokeEvent instance
• token_values – dictionary with set of values taken from the token

Returns:

True if the token matches the revocation event, indicating the token has been revoked

keystone.models.token_model module

Unified in-memory token model.

class keystone.models.token_model.KeystoneToken(token_id, token_data)

Bases: dict

An in-memory representation that unifies v2 and v3 tokens.

audit_chain_id None

audit_id None

auth_token None

bind None

domain_id None

domain_name None

domain_scoped None

expires None

federation_group_ids None

federation_idp_id None

federation_protocol_id None

is_domain None

is_federated_user None

issued None

metadata None

methods None

oauth_access_token_id None

oauth_consumer_id None

oauth_scoped None

project_domain_id None

project_domain_name None

project_id None

project_name None

project_scoped None

role_ids None

role_names None

scoped None

trust_id None

trust_impersonation None

trust_scoped None

trustee_user_id None

trustor_user_id None

user_domain_id None

user_domain_name None

user_id None

user_name None

Module contents