Performing create, list, or set operations for users, groups, and projects
with the --domain option attempts to look up the domain for name to ID
conversion. In the case of an environment using Keystone domains, it is
desired to allow a domain admin to perform these operations for objects in
their domain without allowing them to list or show domains. The current
behavior prevents the domain admin from performing these operations since
they will be forbidden to perform the underlying list_domains operation.
This patch makes the domain lookup error a soft failure, and falls back
to using the passed in domain argument directly as a domain ID in the
request that it sends to Keystone.
Change-Id: I5139097f8cedc53693f6f71297518917ac72e50a
Closes-Bug: #1378565
Update `user show` for Identity V3 to account for a domain argument,
in doing so, also update `find resource` to be more flexible by
allowing **kwargs.
Also update `group show` and `project show` since they follow the
same logic as a user within a group.
Change-Id: Ib828e4dbeb0bd31164396069ce8a64c873179779
Closes-Bug: #1378165
This patch allows the user to choose which authentication plugin
to use with the CLI. The arguments needed by the auth plugins are
automatically added to the argument parser. Some examples with
the currently available authentication plugins::
OS_USERNAME=admin OS_PROJECT_NAME=admin OS_AUTH_URL=http://keystone:5000/v2.0 \
OS_PASSWORD=admin openstack user list
OS_USERNAME=admin OS_PROJECT_DOMAIN_NAME=default OS_USER_DOMAIN_NAME=default \
OS_PROJECT_NAME=admin OS_AUTH_URL=http://keystone:5000/v3 OS_PASSWORD=admin \
OS_IDENTITY_API_VERSION=3 OS_AUTH_PLUGIN=v3password openstack project list
OS_TOKEN=1234 OS_URL=http://service_url:35357/v2.0 \
OS_IDENTITY_API_VERSION=2.0 openstack user list
The --os-auth-plugin option can be omitted; if so the CLI will attempt to
guess which plugin to use from the other options.
Change-Id: I330c20ddb8d96b3a4287c68b57c36c4a0f869669
Co-Authored-By: Florent Flament <florent.flament-ext@cloudwatt.com>
Openstackclient needs to have a capability to manage federated protocols
(like saml2, openid connect, abfab). This patch allows users to
administrate such operations from the commandline.
Change-Id: I59eef2acdda60c7ec795d1bfe31e8e960b4478a1
Implements: bp/add-openstackclient-federation-crud
Cliff 1.6.1 added CommandManager.load_commands() so we can adopt it
rather than rolling our own.
Also, that second group is Greek, not Latin. Jeez...
Change-Id: I4a63c22f37bcfd0ef5d83c2dbd08b58fda0db35c
1) Can't create instance of swiftclient. Since we now create
an API instance, creating a swiftclient instance won't work.
Trying to do any object related command fails.
2) Listing objects in a container fails, we depend on the
data returned in a specific way, during the API transition
this must have slipped through.
Needs regression/funcitonal tests to mame sure this doesn't
happen again.
Change-Id: I69079a0dc9f32b84e6f9307729d3dbbba549ac5e
The signature for users.set in keystoneclient dictates that
domain and project be sent in, not domainId and projectId,
which are being incorrectly sent in as 'extra' data.
Closes-Bug: #1376833
Change-Id: I44df3e492f61eab2241f3758dee622417bb6f399
Create a script that kicks off function tests that exercise
openstackclient commands against a cloud.
If no keystone/openstack process is detected, a devstack instance
is spun up and the tests are run against that.
There is also a hook added to tox.ini so that we can run these
tests easily from a gate job.
Change-Id: I3cc8b2b800de7ca74af506d2c7e8ee481fa985f0
api.object_store.APIv1 now contains the formerly top-level functions
implementing the object-store REST client. This replaces the old-style
ObjectClientv1 that is no longer necessary.
Change-Id: I7d8fea326b214481e7d6b24119bd41777c6aa968
Adds the foundation of a low-level REST API client. This is the final prep
stage in the conversion of the object-store commands from the old restapi
interface to the keystoneclient.session-based API.
* api.api.BaseAPI holds the common operations
Change-Id: I8fba980e3eb2d787344f766507a9d0dae49dcadf
Replicate the object-store container command tests but use requests_mock
to test the entire stack down to the requests module.
These will be useful regressions tests when the existing object-store lib
modules are moved to the low-level API object.
Change-Id: Ibf25be46156eb1009f1b66f02f2073d3913b846d
Currently, utils.find_resource catch NotFound exception defined in
openstackclient. However, different client libraries raise different
exceptions defined in thire own library.
Change-Id: Idc40428e30e59f71dbdbfa0555c0066fddc441c2
Closes-Bug: #1371924
Module `importutils` from common code was graduated to oslo.utils,
so it would be great if we reuse this library.
Remove unused strutils.py and gettextutils.py
Change-Id: Iaae19fc5018d83103e5f15ff76d6da686bfdf5f8
This should make it easier to understand the
purpose of find_domain - I believe the reason
for which find_resource wasn't enough was not
quite clear.
Change-Id: I6a1cdfa86f52401d95c6da2cd38d7c95a140b4a1
If non-admin user attempts 'project show' or 'user show' on the currently
authenticated project or user return the information that is already in the
service catalog rather than throwing a Forbidden error.
Change-Id: Ieeb6eacf71a471e410fbd3c09e7871740547e890
