common Package

bufferedhttp Module

cms Module

keystone.common.cms.cms_hash_token(token_id)

return: for ans1_token, returns the hash of the passed in token otherwise, returns what it was passed in.

keystone.common.cms.cms_sign_text(text, signing_cert_file_name, signing_key_file_name)

Uses OpenSSL to sign a document Produces a Base64 encoding of a DER formatted CMS Document http://en.wikipedia.org/wiki/Cryptographic_Message_Syntax

keystone.common.cms.cms_sign_token(text, signing_cert_file_name, signing_key_file_name)
keystone.common.cms.cms_to_token(cms_text)
keystone.common.cms.cms_verify(formatted, signing_cert_file_name, ca_file_name)

verifies the signature of the contents IAW CMS syntax

keystone.common.cms.is_ans1_token(token)

thx to ayoung for sorting this out.

base64 decoded hex representation of MII is 3082 In [3]: binascii.hexlify(base64.b64decode(‘MII=’)) Out[3]: ‘3082’

re: http://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf

pg4: For tags from 0 to 30 the first octet is the identfier pg10: Hex 30 means sequence, followed by the length of that sequence. pg5: Second octet is the length octet

first bit indicates short or long form, next 7 bits encode the number of subsequent octets that make up the content length octets as an unsigned binary int

82 = 10000010 (first bit indicates long form) 0000010 = 2 octets of content length so read the next 2 octets to get the length of the content.

In the case of a very large content length there could be a requirement to have more than 2 octets to designate the content length, therefore requiring us to check for MIM, MIQ, etc. In [4]: base64.b64encode(binascii.a2b_hex(‘3083’)) Out[4]: ‘MIM=’ In [5]: base64.b64encode(binascii.a2b_hex(‘3084’)) Out[5]: ‘MIQ=’ Checking for MI would become invalid at 16 octets of content length 10010000 = 90 In [6]: base64.b64encode(binascii.a2b_hex(‘3090’)) Out[6]: ‘MJA=’ Checking for just M is insufficient

But we will only check for MII: Max length of the content using 2 octets is 7FFF or 32767 It’s not practical to support a token of this length or greater in http therefore, we will check for MII only and ignore the case of larger tokens

keystone.common.cms.token_to_cms(signed_text)
keystone.common.cms.verify_token(token, signing_cert_file_name, ca_file_name)

config Module

controller Module

dependency Module

exception keystone.common.dependency.UnresolvableDependencyException(name)

Bases: exceptions.Exception

keystone.common.dependency.provider(name)

Register the wrapped dependency provider under the specified name.

keystone.common.dependency.requires(*dependencies)

Inject specified dependencies from the registry into the instance.

kvs Module

logging Module

Wrapper for built-in logging module.

keystone.common.logging.fail_gracefully(f)

Logs exceptions and aborts.

keystone.common.logging.log_debug(f)

manager Module

class keystone.common.manager.Manager(driver_name)

Bases: object

Base class for intermediary request layer.

The Manager layer exists to support additional logic that applies to all or some of the methods exposed by a service that are not specific to the HTTP interface.

It also provides a stable entry point to dynamic backends.

An example of a probable use case is logging all the calls.

models Module

Base model for keystone internal services

Unless marked otherwise, all fields are strings.

class keystone.common.models.Domain

Bases: keystone.common.models.Model

Domain object.

Required keys:
id name

Optional keys:

description enabled (bool, default True)
optional_keys = ('description', 'enabled')
required_keys = ('id', 'name')
class keystone.common.models.Endpoint

Bases: keystone.common.models.Model

Endpoint object

Required keys:
id region service_id
Optional keys:
internalurl publicurl adminurl
optional_keys = ('internalurl', 'publicurl', 'adminurl')
required_keys = ('id', 'region', 'service_id')
class keystone.common.models.Group

Bases: keystone.common.models.Model

Group object.

Required keys:
id name domain_id

Optional keys:

description
optional_keys = ('description',)
required_keys = ('id', 'name', 'domain_id')
class keystone.common.models.Model

Bases: dict

Base model class.

known_keys
class keystone.common.models.Project

Bases: keystone.common.models.Model

Project object.

Required keys:
id name domain_id
Optional Keys:
description enabled (bool, default True)
optional_keys = ('description', 'enabled')
required_keys = ('id', 'name', 'domain_id')
class keystone.common.models.Role

Bases: keystone.common.models.Model

Role object.

Required keys:
id name
optional_keys = ()
required_keys = ('id', 'name')
class keystone.common.models.Service

Bases: keystone.common.models.Model

Service object.

Required keys:
id type name

Optional keys:

optional_keys = ()
required_keys = ('id', 'type', 'name')
class keystone.common.models.Token

Bases: keystone.common.models.Model

Token object.

Required keys:
id expires (datetime)
Optional keys:
user tenant metadata trust_id
optional_keys = ('extra',)
required_keys = ('id', 'expires')
class keystone.common.models.Trust

Bases: keystone.common.models.Model

Trust object.

Required keys:
id trustor_user_id trustee_user_id project_id
optional_keys = ('e', 'x', 'p', 'i', 'r', 'e', 's', '_', 'a', 't')
required_keys = ('id', 'trustor_user_id', 'trustee_user_id', 'project_id')
class keystone.common.models.User

Bases: keystone.common.models.Model

User object.

Required keys:
id name domain_id
Optional keys:
password description email enabled (bool, default True)
optional_keys = ('password', 'description', 'email', 'enabled')
required_keys = ('id', 'name', 'domain_id')

openssl Module

router Module

serializer Module

systemd Module

Helper module for systemd start-up completion notification. Used for “onready” configuration parameter in keystone.conf

keystone.common.systemd.notify()

utils Module

wsgi Module