identity methods

class ecl.identity.v3._proxy.Proxy(session)

Bases: ecl.proxy.BaseProxy

create_credential(**attrs)

Create a new credential from attributes

Parameters:attrs (dict) – Keyword arguments which will be used to create a Credential, comprised of the properties on the Credential class. Returns:The results of credential creation Return type:Credential

create_domain(**attrs)

Create a new domain from attributes

Parameters:attrs (dict) – Keyword arguments which will be used to create a Domain, comprised of the properties on the Domain class. Returns:The results of domain creation Return type:Domain

create_endpoint(**attrs)

Create a new endpoint from attributes

Parameters:attrs (dict) – Keyword arguments which will be used to create a Endpoint, comprised of the properties on the Endpoint class. Returns:The results of endpoint creation Return type:Endpoint

create_group(**attrs)

Create a new group from attributes

Parameters:attrs (dict) – Keyword arguments which will be used to create a Group, comprised of the properties on the Group class. Returns:The results of group creation Return type:Group

create_policy(**attrs)

Create a new policy from attributes

Parameters:attrs (dict) – Keyword arguments which will be used to create a Policy, comprised of the properties on the Policy class. Returns:The results of policy creation Return type:Policy

create_project(**attrs)

Create a new project from attributes

Parameters:attrs (dict) – Keyword arguments which will be used to create a Project, comprised of the properties on the Project class. Returns:The results of project creation Return type:Project

create_region(**attrs)

Create a new region from attributes

Parameters:attrs (dict) – Keyword arguments which will be used to create a Region, comprised of the properties on the Region class. Returns:The results of region creation. Return type:Region

create_service(**attrs)

Create a new service from attributes

Parameters:attrs (dict) – Keyword arguments which will be used to create a Service, comprised of the properties on the Service class. Returns:The results of service creation Return type:Service

create_trust(**attrs)

Create a new trust from attributes

Parameters:attrs (dict) – Keyword arguments which will be used to create a Trust, comprised of the properties on the Trust class. Returns:The results of trust creation Return type:Trust

create_user(**attrs)

Create a new user from attributes

Parameters:attrs (dict) – Keyword arguments which will be used to create a User, comprised of the properties on the User class. Returns:The results of user creation Return type:User

credentials(**query)

Retrieve a generator of credentials

Parameters:**query (kwargs) – Optional query parameters to be sent to limit the resources being returned. Returns:A generator of credentials instances. Return type:Credential

delete_credential(credential, ignore_missing=True)

Delete a credential

Parameters:

• credential – The value can be either the ID of a credential or a Credential instance.
• ignore_missing (bool) – When set to False ResourceNotFound will be raised when the credential does not exist. When set to True, no exception will be set when attempting to delete a nonexistent credential.

Returns:

None

delete_domain(domain, ignore_missing=True)

Delete a domain

Parameters:

• domain – The value can be either the ID of a domain or a Domain instance.
• ignore_missing (bool) – When set to False ResourceNotFound will be raised when the domain does not exist. When set to True, no exception will be set when attempting to delete a nonexistent domain.

Returns:

None

delete_endpoint(endpoint, ignore_missing=True)

Delete an endpoint

Parameters:

• endpoint – The value can be either the ID of an endpoint or a Endpoint instance.
• ignore_missing (bool) – When set to False ResourceNotFound will be raised when the endpoint does not exist. When set to True, no exception will be set when attempting to delete a nonexistent endpoint.

Returns:

None

delete_group(group, ignore_missing=True)

Delete a group

Parameters:

• group – The value can be either the ID of a group or a Group instance.
• ignore_missing (bool) – When set to False ResourceNotFound will be raised when the group does not exist. When set to True, no exception will be set when attempting to delete a nonexistent group.

Returns:

None

delete_policy(policy, ignore_missing=True)

Delete a policy

Parameters:

• policy – The value can be either the ID of a policy or a Policy instance.
• ignore_missing (bool) – When set to False ResourceNotFound will be raised when the policy does not exist. When set to True, no exception will be set when attempting to delete a nonexistent policy.

Returns:

None

delete_project(project, ignore_missing=True)

Delete a project

Parameters:

• project – The value can be either the ID of a project or a Project instance.
• ignore_missing (bool) – When set to False ResourceNotFound will be raised when the project does not exist. When set to True, no exception will be set when attempting to delete a nonexistent project.

Returns:

None

delete_region(region, ignore_missing=True)

Delete a region

Parameters:

• region – The value can be either the ID of a region or a Region instance.
• ignore_missing (bool) – When set to False ResourceNotFound will be raised when the region does not exist. When set to True, no exception will be thrown when attempting to delete a nonexistent region.

Returns:

None

delete_service(service, ignore_missing=True)

Delete a service

Parameters:

• service – The value can be either the ID of a service or a Service instance.
• ignore_missing (bool) – When set to False ResourceNotFound will be raised when the service does not exist. When set to True, no exception will be set when attempting to delete a nonexistent service.

Returns:

None

delete_trust(trust, ignore_missing=True)

Delete a trust

Parameters:

• trust – The value can be either the ID of a trust or a Trust instance.
• ignore_missing (bool) – When set to False ResourceNotFound will be raised when the credential does not exist. When set to True, no exception will be set when attempting to delete a nonexistent credential.

Returns:

None

delete_user(user, ignore_missing=True)

Delete a user

Parameters:

• user – The value can be either the ID of a user or a User instance.
• ignore_missing (bool) – When set to False ResourceNotFound will be raised when the user does not exist. When set to True, no exception will be set when attempting to delete a nonexistent user.

Returns:

None

domains(**query)

Retrieve a generator of domains

Parameters:**query (kwargs) – Optional query parameters to be sent to limit the resources being returned. Returns:A generator of domain instances. Return type:Domain

endpoints(**query)

Retrieve a generator of endpoints

Parameters:**query (kwargs) – Optional query parameters to be sent to limit the resources being returned. Returns:A generator of endpoint instances. Return type:Endpoint

find_credential(name_or_id, ignore_missing=True)

Find a single credential

Parameters:

• name_or_id – The name or ID of a credential.
• ignore_missing (bool) – When set to False ResourceNotFound will be raised when the resource does not exist. When set to True, None will be returned when attempting to find a nonexistent resource.

Returns:

One Credential or None

find_domain(name_or_id, ignore_missing=True)

Find a single domain

Parameters:

• name_or_id – The name or ID of a domain.
• ignore_missing (bool) – When set to False ResourceNotFound will be raised when the resource does not exist. When set to True, None will be returned when attempting to find a nonexistent resource.

Returns:

One Domain or None

find_endpoint(name_or_id, ignore_missing=True)

Find a single endpoint

Parameters:

• name_or_id – The name or ID of a endpoint.
• ignore_missing (bool) – When set to False ResourceNotFound will be raised when the resource does not exist. When set to True, None will be returned when attempting to find a nonexistent resource.

Returns:

One Endpoint or None

find_group(name_or_id, ignore_missing=True)

Find a single group

Parameters:

• name_or_id – The name or ID of a group.
• ignore_missing (bool) – When set to False ResourceNotFound will be raised when the resource does not exist. When set to True, None will be returned when attempting to find a nonexistent resource.

Returns:

One Group or None

find_policy(name_or_id, ignore_missing=True)

Find a single policy

Parameters:

• name_or_id – The name or ID of a policy.
• ignore_missing (bool) – When set to False ResourceNotFound will be raised when the resource does not exist. When set to True, None will be returned when attempting to find a nonexistent resource.

Returns:

One Policy or None

find_project(name_or_id, ignore_missing=True)

Find a single project

Parameters:

• name_or_id – The name or ID of a project.
• ignore_missing (bool) – When set to False ResourceNotFound will be raised when the resource does not exist. When set to True, None will be returned when attempting to find a nonexistent resource.

Returns:

One Project or None

find_region(name_or_id, ignore_missing=True)

Find a single region

Parameters:

• name_or_id – The name or ID of a region.
• ignore_missing (bool) – When set to False ResourceNotFound will be raised when the region does not exist. When set to True, None will be returned when attempting to find a nonexistent region.

Returns:

One Region or None

find_service(name_or_id, ignore_missing=True)

Find a single service

Parameters:

• name_or_id – The name or ID of a service.
• ignore_missing (bool) – When set to False ResourceNotFound will be raised when the resource does not exist. When set to True, None will be returned when attempting to find a nonexistent resource.

Returns:

One Service or None

find_trust(name_or_id, ignore_missing=True)

Find a single trust

Parameters:

• name_or_id – The name or ID of a trust.
• ignore_missing (bool) – When set to False ResourceNotFound will be raised when the resource does not exist. When set to True, None will be returned when attempting to find a nonexistent resource.

Returns:

One Trust or None

find_user(name_or_id, ignore_missing=True)

Find a single user

Parameters:

• name_or_id – The name or ID of a user.
• ignore_missing (bool) – When set to False ResourceNotFound will be raised when the resource does not exist. When set to True, None will be returned when attempting to find a nonexistent resource.

Returns:

One User or None

get_credential(credential)

Get a single credential

Parameters:credential – The value can be the ID of a credential or a Credential instance. Returns:One Credential Raises:ResourceNotFound when no resource can be found.

get_domain(domain)

Get a single domain

Parameters:domain – The value can be the ID of a domain or a Domain instance. Returns:One Domain Raises:ResourceNotFound when no resource can be found.

get_endpoint(endpoint)

Get a single endpoint

Parameters:endpoint – The value can be the ID of an endpoint or a Endpoint instance. Returns:One Endpoint Raises:ResourceNotFound when no resource can be found.

get_group(group)

Get a single group

Parameters:group – The value can be the ID of a group or a Group instance. Returns:One Group Raises:ResourceNotFound when no resource can be found.

get_policy(policy)

Get a single policy

Parameters:policy – The value can be the ID of a policy or a Policy instance. Returns:One Policy Raises:ResourceNotFound when no resource can be found.

get_project(project)

Get a single project

Parameters:project – The value can be the ID of a project or a Project instance. Returns:One Project Raises:ResourceNotFound when no resource can be found.

get_region(region)

Get a single region

Parameters:region – The value can be the ID of a region or a Region instance. Returns:One Region Raises:ResourceNotFound when no matching region can be found.

get_service(service)

Get a single service

Parameters:service – The value can be the ID of a service or a Service instance. Returns:One Service Raises:ResourceNotFound when no resource can be found.

get_trust(trust)

Get a single trust

Parameters:trust – The value can be the ID of a trust or a Trust instance. Returns:One Trust Raises:ResourceNotFound when no resource can be found.

get_user(user)

Get a single user

Parameters:user – The value can be the ID of a user or a User instance. Returns:One User Raises:ResourceNotFound when no resource can be found.

groups(**query)

Retrieve a generator of groups

Parameters:**query (kwargs) – Optional query parameters to be sent to limit the resources being returned. Returns:A generator of group instances. Return type:Group

policies(**query)

Retrieve a generator of policies

Parameters:**query (kwargs) – Optional query parameters to be sent to limit the resources being returned. Returns:A generator of policy instances. Return type:Policy

projects(**query)

Retrieve a generator of projects

Parameters:**query (kwargs) – Optional query parameters to be sent to limit the resources being returned. Returns:A generator of project instances. Return type:Project

regions(**query)

Retrieve a generator of regions

Parameters:**query (kwargs) – Optional query parameters to be sent to limit the regions being returned. Returns:A generator of region instances. Return type:Region

services(**query)

Retrieve a generator of services

Parameters:**query (kwargs) – Optional query parameters to be sent to limit the resources being returned. Returns:A generator of service instances. Return type:Service

trusts(**query)

Retrieve a generator of trusts

Parameters:**query (kwargs) – Optional query parameters to be sent to limit the resources being returned. Returns:A generator of trust instances. Return type:Trust

update_credential(credential, **attrs)

Update a credential

Parameters:credential – Either the ID of a credential or a Credential instance. Attrs kwargs:The attributes to update on the credential represented by value. Returns:The updated credential Return type:Credential

update_domain(domain, **attrs)

Update a domain

Parameters:domain – Either the ID of a domain or a Domain instance. Attrs kwargs:The attributes to update on the domain represented by value. Returns:The updated domain Return type:Domain

update_endpoint(endpoint, **attrs)

Update a endpoint

Parameters:endpoint – Either the ID of a endpoint or a Endpoint instance. Attrs kwargs:The attributes to update on the endpoint represented by value. Returns:The updated endpoint Return type:Endpoint

update_group(group, **attrs)

Update a group

Parameters:group – Either the ID of a group or a Group instance. Attrs kwargs:The attributes to update on the group represented by value. Returns:The updated group Return type:Group

update_policy(policy, **attrs)

Update a policy

Parameters:policy – Either the ID of a policy or a Policy instance. Attrs kwargs:The attributes to update on the policy represented by value. Returns:The updated policy Return type:Policy

update_project(project, **attrs)

Update a project

Parameters:project – Either the ID of a project or a Project instance. Attrs kwargs:The attributes to update on the project represented by value. Returns:The updated project Return type:Project

update_region(region, **attrs)

Update a region

Parameters:region – Either the ID of a region or a Region instance. Attrs kwargs:The attributes to update on the region represented by value. Returns:The updated region. Return type:Region

update_service(service, **attrs)

Update a service

Parameters:service – Either the ID of a service or a Service instance. Attrs kwargs:The attributes to update on the service represented by value. Returns:The updated service Return type:Service

update_user(user, **attrs)

Update a user

Parameters:user – Either the ID of a user or a User instance. Attrs kwargs:The attributes to update on the user represented by value. Returns:The updated user Return type:User

users(**query)

Retrieve a generator of users

Parameters:**query (kwargs) – Optional query parameters to be sent to limit the resources being returned. Returns:A generator of user instances. Return type:User

credential

class ecl.identity.v3.credential.Credential(attrs=None, loaded=False)

Bases: ecl.resource.Resource

allow_create = True

allow_delete = True

allow_list = True

allow_retrieve = True

allow_update = True

base_path = '/credentials'

blob = None

Arbitrary blob of the credential data, to be parsed according to the type. Type: string

patch_update = True

project_id = None

References a project ID which limits the scope the credential applies to. This attribute is mandatory if the credential type is ec2. Type: string

resource_key = 'credential'

resources_key = 'credentials'

service = {'region_name': None, 'service_name': None, 'interface': 'public', 'version': None, 'service_type': 'identity', 'requires_project_id': False, 'api_version': None}

type = None

Representing the credential type, such as ec2 or cert. A specific implementation may determine the list of supported types. Type: string

user_id = None

References the user ID which owns the credential. Type: string

domain

class ecl.identity.v3.domain.Domain(attrs=None, loaded=False)

Bases: ecl.resource.Resource

allow_create = True

allow_delete = True

allow_list = True

allow_retrieve = True

allow_update = True

base_path = '/domains'

description = None

The description of this domain. Type: string

is_enabled = None

Setting this attribute to False prevents users from authorizing against this domain or any projects owned by this domain, and prevents users owned by this domain from authenticating or receiving any other authorization. Additionally, all pre-existing tokens applicable to the above entities are immediately invalidated. Re-enabling a domain does not re-enable pre-existing tokens. Type: bool

name = None

The globally unique name of this domain. Type: string

patch_update = True

resource_key = 'domain'

resources_key = 'domains'

service = {'region_name': None, 'service_name': None, 'interface': 'public', 'version': None, 'service_type': 'identity', 'requires_project_id': False, 'api_version': None}

endpoint

class ecl.identity.v3.endpoint.Endpoint(attrs=None, loaded=False)

Bases: ecl.resource.Resource

allow_create = True

allow_delete = True

allow_list = True

allow_retrieve = True

allow_update = True

base_path = '/endpoints'

interface = None

Describes the interface of the endpoint according to one of the following values:

• public: intended for consumption by end users, generally on a

  publicly available network interface

• internal: not intended for consumption by end users, generally on an

  unmetered internal network interface

• admin: intended only for consumption by those needing administrative

  access to the service, generally on a secure network interface

Type: string

is_enabled = None

Setting this value to False prevents the endpoint from appearing in the service catalog. Type: bool

patch_update = True

region_id = None

Represents the containing region ID of the service endpoint. New in v3.2 Type: string

resource_key = 'endpoint'

resources_key = 'endpoints'

service = {'region_name': None, 'service_name': None, 'interface': 'public', 'version': None, 'service_type': 'identity', 'requires_project_id': False, 'api_version': None}

service_id = None

References the service ID to which the endpoint belongs. Type: string

url = None

Fully qualified URL of the service endpoint. Type: string

group

class ecl.identity.v3.group.Group(attrs=None, loaded=False)

Bases: ecl.resource.Resource

allow_create = True

allow_delete = True

allow_list = True

allow_retrieve = True

allow_update = True

base_path = '/groups'

description = None

The description of this group. Type: string

domain_id = None

References the domain ID which owns the group; if a domain ID is not specified by the client, the Identity service implementation will default it to the domain ID to which the client’s token is scoped. Type: string

name = None

Unique group name, within the owning domain. Type: string

patch_update = True

resource_key = 'group'

resources_key = 'groups'

service = {'region_name': None, 'service_name': None, 'interface': 'public', 'version': None, 'service_type': 'identity', 'requires_project_id': False, 'api_version': None}

policy

class ecl.identity.v3.policy.Policy(attrs=None, loaded=False)

Bases: ecl.resource.Resource

allow_create = True

allow_delete = True

allow_list = True

allow_retrieve = True

allow_update = True

base_path = '/policies'

blob = None

The policy rule set itself, as a serialized blob. Type: string

patch_update = True

resource_key = 'policy'

resources_key = 'policies'

service = {'region_name': None, 'service_name': None, 'interface': 'public', 'version': None, 'service_type': 'identity', 'requires_project_id': False, 'api_version': None}

type = None

The MIME Media Type of the serialized policy blob. Type: string

project

class ecl.identity.v3.project.Project(attrs=None, loaded=False)

Bases: ecl.resource.Resource

allow_create = True

allow_delete = True

allow_list = True

allow_retrieve = True

allow_update = True

base_path = '/projects'

description = None

The description of the project. Type: string

domain_id = None

References the domain ID which owns the project; if a domain ID is not specified by the client, the Identity service implementation will default it to the domain ID to which the client’s token is scoped. Type: string

is_enabled = None

Setting this attribute to False prevents users from authorizing against this project. Additionally, all pre-existing tokens authorized for the project are immediately invalidated. Re-enabling a project does not re-enable pre-existing tokens. Type: bool

name = None

Unique project name, within the owning domain. Type: string

patch_update = True

resource_key = 'project'

resources_key = 'projects'

service = {'region_name': None, 'service_name': None, 'interface': 'public', 'version': None, 'service_type': 'identity', 'requires_project_id': False, 'api_version': None}

region

class ecl.identity.v3.region.Region(attrs=None, loaded=False)

Bases: ecl.resource.Resource

allow_create = True

allow_delete = True

allow_list = True

allow_retrieve = True

allow_update = True

base_path = '/regions'

description = None

User-facing description of the region. Type: string

parent_region_id = None

ID of parent region, if any. Type: string

patch_update = True

resource_key = 'region'

resources_key = 'regions'

service = {'region_name': None, 'service_name': None, 'interface': 'public', 'version': None, 'service_type': 'identity', 'requires_project_id': False, 'api_version': None}

service

class ecl.identity.v3.service.Service(attrs=None, loaded=False)

Bases: ecl.resource.Resource

allow_create = True

allow_delete = True

allow_list = True

allow_retrieve = True

allow_update = True

base_path = '/services'

description = None

User-facing description of the service. Type: string

is_enabled = None

Setting this value to False prevents the service and its endpoints from appearing in the service catalog. Type: bool

name = None

User-facing name of the service. Type: string

patch_update = True

resource_key = 'service'

resources_key = 'services'

service = {'region_name': None, 'service_name': None, 'interface': 'public', 'version': None, 'service_type': 'identity', 'requires_project_id': False, 'api_version': None}

type = None

Describes the API implemented by the service. The following values are recognized within the OpenStack ecosystem: compute, image, ec2, identity, volume, network. To support non-core and future projects, the value should not be validated against this list. Type: string

trust

class ecl.identity.v3.trust.Trust(attrs=None, loaded=False)

Bases: ecl.resource.Resource

allow_create = True

allow_delete = True

allow_list = True

allow_retrieve = True

base_path = '/OS-TRUST/trusts'

expires_at = None

Specifies the expiration time of the trust. A trust may be revoked ahead of expiration. If the value represents a time in the past, the trust is deactivated.

id = None

ID of the trust object. Type: string

is_impersonation = None

If impersonation is set to true, then the user attribute of tokens that are generated based on the trust will represent that of the trustor rather than the trustee, thus allowing the trustee to impersonate the trustor. If impersonation is set to False, then the token’s user attribute will represent that of the trustee. Type: bool

project_id = None

ID of the project upon which the trustor is delegating authorization. Type: string

redelegation_count = None

Redelegation count

resource_key = 'trust'

resources_key = 'trusts'

roles = None

Specifies the subset of the trustor’s roles on the project_id to be granted to the trustee when the token in consumed. The trustor must already be granted these roles in the project referenced by the project_id attribute. Type: list

service = {'region_name': None, 'service_name': None, 'interface': 'public', 'version': None, 'service_type': 'identity', 'requires_project_id': False, 'api_version': None}

trustee_user_id = None

Represents the user ID who is capable of consuming the trust. Type: string

trustor_user_id = None

Represents the user ID who created the trust, and who’s authorization is being delegated. Type: string

user

class ecl.identity.v3.user.User(attrs=None, loaded=False)

Bases: ecl.resource.Resource

allow_create = True

allow_delete = True

allow_list = True

allow_retrieve = True

allow_update = True

base_path = '/users'

default_project_id = None

References the user’s default project ID against which to authorize, if the API user does not explicitly specify one when creating a token. Setting this attribute does not grant any actual authorization on the project, and is merely provided for the user’s convenience. Therefore, the referenced project does not need to exist within the user’s domain.

New in version 3.1 If the user does not have authorization to their default project, the default project will be ignored at token creation. Type: string

description = None

The description of this user. Type: string

domain_id = None

References the domain ID which owns the user; if a domain ID is not specified by the client, the Identity service implementation will default it to the domain ID to which the client’s token is scoped. Type: string

email = None

The email of this user. Type: string

is_enabled = None

Setting this value to False prevents the user from authenticating or receiving authorization. Additionally, all pre-existing tokens held by the user are immediately invalidated. Re-enabling a user does not re-enable pre-existing tokens. Type: bool

name = None

Unique user name, within the owning domain. Type: string

password = None

The default form of credential used during authentication. Type: string

patch_update = True

resource_key = 'user'

resources_key = 'users'

service = {'region_name': None, 'service_name': None, 'interface': 'public', 'version': None, 'service_type': 'identity', 'requires_project_id': False, 'api_version': None}