Modifications for test of feature 7953
[osm/NBI.git] / osm_nbi / authconn_keystone.py
1 # -*- coding: utf-8 -*-
2
3 # Copyright 2018 Whitestack, LLC
4 #
5 # Licensed under the Apache License, Version 2.0 (the "License"); you may
6 # not use this file except in compliance with the License. You may obtain
7 # a copy of the License at
8 #
9 # http://www.apache.org/licenses/LICENSE-2.0
10 #
11 # Unless required by applicable law or agreed to in writing, software
12 # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13 # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14 # License for the specific language governing permissions and limitations
15 # under the License.
16 #
17 # For those usages not covered by the Apache License, Version 2.0 please
18 # contact: esousa@whitestack.com or glavado@whitestack.com
19 ##
20
21 """
22 AuthconnKeystone implements implements the connector for
23 Openstack Keystone and leverages the RBAC model, to bring
24 it for OSM.
25 """
26
27
28 __author__ = "Eduardo Sousa <esousa@whitestack.com>, " \
29 "Pedro de la Cruz Ramos <pdelacruzramos@altran.com>"
30 __date__ = "$27-jul-2018 23:59:59$"
31
32 from osm_nbi.authconn import Authconn, AuthException, AuthconnOperationException, AuthconnNotFoundException, \
33 AuthconnConflictException
34
35 import logging
36 import requests
37 import time
38 from keystoneauth1 import session
39 from keystoneauth1.identity import v3
40 from keystoneauth1.exceptions.base import ClientException
41 from keystoneauth1.exceptions.http import Conflict
42 from keystoneclient.v3 import client
43 from http import HTTPStatus
44 from osm_nbi.validation import is_valid_uuid
45
46
47 class AuthconnKeystone(Authconn):
48 def __init__(self, config, db):
49 Authconn.__init__(self, config, db)
50
51 self.logger = logging.getLogger("nbi.authenticator.keystone")
52
53 self.auth_url = "http://{0}:{1}/v3".format(config.get("auth_url", "keystone"), config.get("auth_port", "5000"))
54 self.user_domain_name = config.get("user_domain_name", "default")
55 self.admin_project = config.get("service_project", "service")
56 self.admin_username = config.get("service_username", "nbi")
57 self.admin_password = config.get("service_password", "nbi")
58 self.project_domain_name = config.get("project_domain_name", "default")
59
60 # Waiting for Keystone to be up
61 available = None
62 counter = 300
63 while available is None:
64 time.sleep(1)
65 try:
66 result = requests.get(self.auth_url)
67 available = True if result.status_code == 200 else None
68 except Exception:
69 counter -= 1
70 if counter == 0:
71 raise AuthException("Keystone not available after 300s timeout")
72
73 self.auth = v3.Password(user_domain_name=self.user_domain_name,
74 username=self.admin_username,
75 password=self.admin_password,
76 project_domain_name=self.project_domain_name,
77 project_name=self.admin_project,
78 auth_url=self.auth_url)
79 self.sess = session.Session(auth=self.auth)
80 self.keystone = client.Client(session=self.sess)
81
82 def authenticate(self, user, password, project=None, token_info=None):
83 """
84 Authenticate a user using username/password or token_info, plus project
85 :param user: user: name, id or None
86 :param password: password or None
87 :param project: name, id, or None. If None first found project will be used to get an scope token
88 :param token_info: previous token_info to obtain authorization
89 :return: the scoped token info or raises an exception. The token is a dictionary with:
90 _id: token string id,
91 username: username,
92 project_id: scoped_token project_id,
93 project_name: scoped_token project_name,
94 expires: epoch time when it expires,
95
96 """
97 try:
98 username = None
99 user_id = None
100 project_id = None
101 project_name = None
102
103 if user:
104 if is_valid_uuid(user):
105 user_id = user
106 else:
107 username = user
108
109 # get an unscoped token firstly
110 unscoped_token = self.keystone.get_raw_token_from_identity_service(
111 auth_url=self.auth_url,
112 user_id=user_id,
113 username=username,
114 password=password,
115 user_domain_name=self.user_domain_name,
116 project_domain_name=self.project_domain_name)
117 elif token_info:
118 unscoped_token = self.keystone.tokens.validate(token=token_info.get("_id"))
119 else:
120 raise AuthException("Provide credentials: username/password or Authorization Bearer token",
121 http_code=HTTPStatus.UNAUTHORIZED)
122
123 if not project:
124 # get first project for the user
125 project_list = self.keystone.projects.list(user=unscoped_token["user"]["id"])
126 if not project_list:
127 raise AuthException("The user {} has not any project and cannot be used for authentication".
128 format(user), http_code=HTTPStatus.UNAUTHORIZED)
129 project_id = project_list[0].id
130 else:
131 if is_valid_uuid(project):
132 project_id = project
133 else:
134 project_name = project
135
136 scoped_token = self.keystone.get_raw_token_from_identity_service(
137 auth_url=self.auth_url,
138 project_name=project_name,
139 project_id=project_id,
140 user_domain_name=self.user_domain_name,
141 project_domain_name=self.project_domain_name,
142 token=unscoped_token["auth_token"])
143
144 auth_token = {
145 "_id": scoped_token.auth_token,
146 "id": scoped_token.auth_token,
147 "user_id": scoped_token.user_id,
148 "username": scoped_token.username,
149 "project_id": scoped_token.project_id,
150 "project_name": scoped_token.project_name,
151 "expires": scoped_token.expires.timestamp(),
152 "issued_at": scoped_token.issued.timestamp()
153 }
154
155 return auth_token
156 except ClientException as e:
157 # self.logger.exception("Error during user authentication using keystone. Method: basic: {}".format(e))
158 raise AuthException("Error during user authentication using Keystone: {}".format(e),
159 http_code=HTTPStatus.UNAUTHORIZED)
160
161 def validate_token(self, token):
162 """
163 Check if the token is valid.
164
165 :param token: token id to be validated
166 :return: dictionary with information associated with the token:
167 "expires":
168 "_id": token_id,
169 "project_id": project_id,
170 "username": ,
171 "roles": list with dict containing {name, id}
172 If the token is not valid an exception is raised.
173 """
174 if not token:
175 return
176
177 try:
178 token_info = self.keystone.tokens.validate(token=token)
179 ses = {
180 "_id": token_info["auth_token"],
181 "id": token_info["auth_token"],
182 "project_id": token_info["project"]["id"],
183 "project_name": token_info["project"]["name"],
184 "user_id": token_info["user"]["id"],
185 "username": token_info["user"]["name"],
186 "roles": token_info["roles"],
187 "expires": token_info.expires.timestamp(),
188 "issued_at": token_info.issued.timestamp()
189 }
190
191 return ses
192 except ClientException as e:
193 # self.logger.exception("Error during token validation using keystone: {}".format(e))
194 raise AuthException("Error during token validation using Keystone: {}".format(e),
195 http_code=HTTPStatus.UNAUTHORIZED)
196
197 def revoke_token(self, token):
198 """
199 Invalidate a token.
200
201 :param token: token to be revoked
202 """
203 try:
204 self.logger.info("Revoking token: " + token)
205 self.keystone.tokens.revoke_token(token=token)
206
207 return True
208 except ClientException as e:
209 # self.logger.exception("Error during token revocation using keystone: {}".format(e))
210 raise AuthException("Error during token revocation using Keystone: {}".format(e),
211 http_code=HTTPStatus.UNAUTHORIZED)
212
213 def create_user(self, user_info):
214 """
215 Create a user.
216
217 :param user_info: full user info.
218 :raises AuthconnOperationException: if user creation failed.
219 :return: returns the id of the user in keystone.
220 """
221 try:
222 new_user = self.keystone.users.create(user_info["username"], password=user_info["password"],
223 domain=self.user_domain_name, _admin=user_info["_admin"])
224 if "project_role_mappings" in user_info.keys():
225 for mapping in user_info["project_role_mappings"]:
226 self.assign_role_to_user(new_user.id, mapping["project"], mapping["role"])
227 return {"username": new_user.name, "_id": new_user.id}
228 except Conflict as e:
229 # self.logger.exception("Error during user creation using keystone: {}".format(e))
230 raise AuthconnOperationException(e, http_code=HTTPStatus.CONFLICT)
231 except ClientException as e:
232 # self.logger.exception("Error during user creation using keystone: {}".format(e))
233 raise AuthconnOperationException("Error during user creation using Keystone: {}".format(e))
234
235 def update_user(self, user_info):
236 """
237 Change the user name and/or password.
238
239 :param user_info: user info modifications
240 :raises AuthconnOperationException: if change failed.
241 """
242 try:
243 user = user_info.get("_id") or user_info.get("username")
244 if is_valid_uuid(user):
245 user_obj_list = [self.keystone.users.get(user)]
246 else:
247 user_obj_list = self.keystone.users.list(name=user)
248 if not user_obj_list:
249 raise AuthconnNotFoundException("User '{}' not found".format(user))
250 user_obj = user_obj_list[0]
251 user_id = user_obj.id
252 if user_info.get("password") or user_info.get("username") \
253 or user_info.get("add_project_role_mappings") or user_info.get("remove_project_role_mappings"):
254 ctime = user_obj._admin.get("created", 0) if hasattr(user_obj, "_admin") else 0
255 self.keystone.users.update(user_id, password=user_info.get("password"), name=user_info.get("username"),
256 _admin={"created": ctime, "modified": time.time()})
257 for mapping in user_info.get("remove_project_role_mappings", []):
258 self.remove_role_from_user(user_id, mapping["project"], mapping["role"])
259 for mapping in user_info.get("add_project_role_mappings", []):
260 self.assign_role_to_user(user_id, mapping["project"], mapping["role"])
261 except ClientException as e:
262 # self.logger.exception("Error during user password/name update using keystone: {}".format(e))
263 raise AuthconnOperationException("Error during user update using Keystone: {}".format(e))
264
265 def delete_user(self, user_id):
266 """
267 Delete user.
268
269 :param user_id: user identifier.
270 :raises AuthconnOperationException: if user deletion failed.
271 """
272 try:
273 result, detail = self.keystone.users.delete(user_id)
274 if result.status_code != 204:
275 raise ClientException("error {} {}".format(result.status_code, detail))
276 return True
277 except ClientException as e:
278 # self.logger.exception("Error during user deletion using keystone: {}".format(e))
279 raise AuthconnOperationException("Error during user deletion using Keystone: {}".format(e))
280
281 def get_user_list(self, filter_q=None):
282 """
283 Get user list.
284
285 :param filter_q: dictionary to filter user list by name (username is also admited) and/or _id
286 :return: returns a list of users.
287 """
288 try:
289 filter_name = None
290 if filter_q:
291 filter_name = filter_q.get("name") or filter_q.get("username")
292 users = self.keystone.users.list(name=filter_name)
293 users = [{
294 "username": user.name,
295 "_id": user.id,
296 "id": user.id,
297 "_admin": user.to_dict().get("_admin", {}) # TODO: REVISE
298 } for user in users if user.name != self.admin_username]
299
300 if filter_q and filter_q.get("_id"):
301 users = [user for user in users if filter_q["_id"] == user["_id"]]
302
303 for user in users:
304 user["project_role_mappings"] = []
305 user["projects"] = []
306 projects = self.keystone.projects.list(user=user["_id"])
307 for project in projects:
308 user["projects"].append(project.name)
309
310 roles = self.keystone.roles.list(user=user["_id"], project=project.id)
311 for role in roles:
312 prm = {
313 "project": project.id,
314 "project_name": project.name,
315 "role_name": role.name,
316 "role": role.id,
317 }
318 user["project_role_mappings"].append(prm)
319
320 return users
321 except ClientException as e:
322 # self.logger.exception("Error during user listing using keystone: {}".format(e))
323 raise AuthconnOperationException("Error during user listing using Keystone: {}".format(e))
324
325 def get_role_list(self, filter_q=None):
326 """
327 Get role list.
328
329 :param filter_q: dictionary to filter role list by _id and/or name.
330 :return: returns the list of roles.
331 """
332 try:
333 filter_name = None
334 if filter_q:
335 filter_name = filter_q.get("name")
336 roles_list = self.keystone.roles.list(name=filter_name)
337
338 roles = [{
339 "name": role.name,
340 "_id": role.id,
341 "_admin": role.to_dict().get("_admin", {}),
342 "permissions": role.to_dict().get("permissions", {})
343 } for role in roles_list if role.name != "service"]
344
345 if filter_q and filter_q.get("_id"):
346 roles = [role for role in roles if filter_q["_id"] == role["_id"]]
347
348 return roles
349 except ClientException as e:
350 # self.logger.exception("Error during user role listing using keystone: {}".format(e))
351 raise AuthException("Error during user role listing using Keystone: {}".format(e),
352 http_code=HTTPStatus.UNAUTHORIZED)
353
354 def create_role(self, role_info):
355 """
356 Create a role.
357
358 :param role_info: full role info.
359 :raises AuthconnOperationException: if role creation failed.
360 """
361 try:
362 result = self.keystone.roles.create(role_info["name"], permissions=role_info.get("permissions"),
363 _admin=role_info.get("_admin"))
364 return result.id
365 except Conflict as ex:
366 raise AuthconnConflictException(str(ex))
367 except ClientException as e:
368 # self.logger.exception("Error during role creation using keystone: {}".format(e))
369 raise AuthconnOperationException("Error during role creation using Keystone: {}".format(e))
370
371 def delete_role(self, role_id):
372 """
373 Delete a role.
374
375 :param role_id: role identifier.
376 :raises AuthconnOperationException: if role deletion failed.
377 """
378 try:
379 result, detail = self.keystone.roles.delete(role_id)
380
381 if result.status_code != 204:
382 raise ClientException("error {} {}".format(result.status_code, detail))
383
384 return True
385 except ClientException as e:
386 # self.logger.exception("Error during role deletion using keystone: {}".format(e))
387 raise AuthconnOperationException("Error during role deletion using Keystone: {}".format(e))
388
389 def update_role(self, role_info):
390 """
391 Change the name of a role
392 :param role_info: full role info
393 :return: None
394 """
395 try:
396 rid = role_info["_id"]
397 if not is_valid_uuid(rid): # Is this required?
398 role_obj_list = self.keystone.roles.list(name=rid)
399 if not role_obj_list:
400 raise AuthconnNotFoundException("Role '{}' not found".format(rid))
401 rid = role_obj_list[0].id
402 self.keystone.roles.update(rid, name=role_info["name"], permissions=role_info.get("permissions"),
403 _admin=role_info.get("_admin"))
404 except ClientException as e:
405 # self.logger.exception("Error during role update using keystone: {}".format(e))
406 raise AuthconnOperationException("Error during role updating using Keystone: {}".format(e))
407
408 def get_project_list(self, filter_q=None):
409 """
410 Get all the projects.
411
412 :param filter_q: dictionary to filter project list.
413 :return: list of projects
414 """
415 try:
416 filter_name = None
417 if filter_q:
418 filter_name = filter_q.get("name")
419 projects = self.keystone.projects.list(name=filter_name)
420
421 projects = [{
422 "name": project.name,
423 "_id": project.id,
424 "_admin": project.to_dict().get("_admin", {}), # TODO: REVISE
425 "quotas": project.to_dict().get("quotas", {}), # TODO: REVISE
426 } for project in projects]
427
428 if filter_q and filter_q.get("_id"):
429 projects = [project for project in projects
430 if filter_q["_id"] == project["_id"]]
431
432 return projects
433 except ClientException as e:
434 # self.logger.exception("Error during user project listing using keystone: {}".format(e))
435 raise AuthException("Error during user project listing using Keystone: {}".format(e),
436 http_code=HTTPStatus.UNAUTHORIZED)
437
438 def create_project(self, project_info):
439 """
440 Create a project.
441
442 :param project_info: full project info.
443 :return: the internal id of the created project
444 :raises AuthconnOperationException: if project creation failed.
445 """
446 try:
447 result = self.keystone.projects.create(project_info["name"], self.project_domain_name,
448 _admin=project_info["_admin"],
449 quotas=project_info.get("quotas", {})
450 )
451 return result.id
452 except ClientException as e:
453 # self.logger.exception("Error during project creation using keystone: {}".format(e))
454 raise AuthconnOperationException("Error during project creation using Keystone: {}".format(e))
455
456 def delete_project(self, project_id):
457 """
458 Delete a project.
459
460 :param project_id: project identifier.
461 :raises AuthconnOperationException: if project deletion failed.
462 """
463 try:
464 # projects = self.keystone.projects.list()
465 # project_obj = [project for project in projects if project.id == project_id][0]
466 # result, _ = self.keystone.projects.delete(project_obj)
467
468 result, detail = self.keystone.projects.delete(project_id)
469 if result.status_code != 204:
470 raise ClientException("error {} {}".format(result.status_code, detail))
471
472 return True
473 except ClientException as e:
474 # self.logger.exception("Error during project deletion using keystone: {}".format(e))
475 raise AuthconnOperationException("Error during project deletion using Keystone: {}".format(e))
476
477 def update_project(self, project_id, project_info):
478 """
479 Change the name of a project
480 :param project_id: project to be changed
481 :param project_info: full project info
482 :return: None
483 """
484 try:
485 self.keystone.projects.update(project_id, name=project_info["name"],
486 _admin=project_info["_admin"],
487 quotas=project_info.get("quotas", {})
488 )
489 except ClientException as e:
490 # self.logger.exception("Error during project update using keystone: {}".format(e))
491 raise AuthconnOperationException("Error during project update using Keystone: {}".format(e))
492
493 def assign_role_to_user(self, user, project, role):
494 """
495 Assigning a role to a user in a project.
496
497 :param user: username.
498 :param project: project name.
499 :param role: role name.
500 :raises AuthconnOperationException: if role assignment failed.
501 """
502 try:
503 if is_valid_uuid(user):
504 user_obj = self.keystone.users.get(user)
505 else:
506 user_obj_list = self.keystone.users.list(name=user)
507 if not user_obj_list:
508 raise AuthconnNotFoundException("User '{}' not found".format(user))
509 user_obj = user_obj_list[0]
510
511 if is_valid_uuid(project):
512 project_obj = self.keystone.projects.get(project)
513 else:
514 project_obj_list = self.keystone.projects.list(name=project)
515 if not project_obj_list:
516 raise AuthconnNotFoundException("Project '{}' not found".format(project))
517 project_obj = project_obj_list[0]
518
519 if is_valid_uuid(role):
520 role_obj = self.keystone.roles.get(role)
521 else:
522 role_obj_list = self.keystone.roles.list(name=role)
523 if not role_obj_list:
524 raise AuthconnNotFoundException("Role '{}' not found".format(role))
525 role_obj = role_obj_list[0]
526
527 self.keystone.roles.grant(role_obj, user=user_obj, project=project_obj)
528 except ClientException as e:
529 # self.logger.exception("Error during user role assignment using keystone: {}".format(e))
530 raise AuthconnOperationException("Error during role '{}' assignment to user '{}' and project '{}' using "
531 "Keystone: {}".format(role, user, project, e))
532
533 def remove_role_from_user(self, user, project, role):
534 """
535 Remove a role from a user in a project.
536
537 :param user: username.
538 :param project: project name or id.
539 :param role: role name or id.
540
541 :raises AuthconnOperationException: if role assignment revocation failed.
542 """
543 try:
544 if is_valid_uuid(user):
545 user_obj = self.keystone.users.get(user)
546 else:
547 user_obj_list = self.keystone.users.list(name=user)
548 if not user_obj_list:
549 raise AuthconnNotFoundException("User '{}' not found".format(user))
550 user_obj = user_obj_list[0]
551
552 if is_valid_uuid(project):
553 project_obj = self.keystone.projects.get(project)
554 else:
555 project_obj_list = self.keystone.projects.list(name=project)
556 if not project_obj_list:
557 raise AuthconnNotFoundException("Project '{}' not found".format(project))
558 project_obj = project_obj_list[0]
559
560 if is_valid_uuid(role):
561 role_obj = self.keystone.roles.get(role)
562 else:
563 role_obj_list = self.keystone.roles.list(name=role)
564 if not role_obj_list:
565 raise AuthconnNotFoundException("Role '{}' not found".format(role))
566 role_obj = role_obj_list[0]
567
568 self.keystone.roles.revoke(role_obj, user=user_obj, project=project_obj)
569 except ClientException as e:
570 # self.logger.exception("Error during user role revocation using keystone: {}".format(e))
571 raise AuthconnOperationException("Error during role '{}' revocation to user '{}' and project '{}' using "
572 "Keystone: {}".format(role, user, project, e))