<s> import collections <EOL> import logging <EOL> from django . conf import settings <EOL> from django . utils . translation import ugettext_lazy as _ <EOL> import six <EOL> import six . moves . urllib . parse as urlparse <EOL> from keystoneclient import exceptions as keystone_exceptions <EOL> from openstack_auth import backend <EOL> from openstack_auth import utils as auth_utils <EOL> from horizon import exceptions <EOL> from horizon import messages <EOL> from horizon . utils import functions as utils <EOL> from openstack_dashboard . api import base <EOL> from openstack_dashboard import policy <EOL> LOG = logging . getLogger ( __name__ ) <EOL> DEFAULT_ROLE = None <EOL> DEFAULT_DOMAIN = getattr ( settings , '<STR_LIT>' , <EOL> '<STR_LIT:default>' ) <EOL> class IdentityAPIVersionManager ( base . APIVersionManager ) : <EOL> def upgrade_v2_user ( self , user ) : <EOL> if getattr ( user , "<STR_LIT>" , None ) is None : <EOL> user . project_id = getattr ( user , "<STR_LIT>" , <EOL> getattr ( user , "<STR_LIT>" , None ) ) <EOL> return user <EOL> def get_project_manager ( self , * args , ** kwargs ) : <EOL> if VERSIONS . active < <NUM_LIT:3> : <EOL> manager = keystoneclient ( * args , ** kwargs ) . tenants <EOL> else : <EOL> manager = keystoneclient ( * args , ** kwargs ) . projects <EOL> return manager <EOL> VERSIONS = IdentityAPIVersionManager ( <EOL> "<STR_LIT>" , preferred_version = auth_utils . get_keystone_version ( ) ) <EOL> try : <EOL> from keystoneclient . v2_0 import client as keystone_client_v2 <EOL> VERSIONS . load_supported_version ( <NUM_LIT> , { "<STR_LIT>" : keystone_client_v2 } ) <EOL> except ImportError : <EOL> pass <EOL> try : <EOL> from keystoneclient . v3 import client as keystone_client_v3 <EOL> VERSIONS . load_supported_version ( <NUM_LIT:3> , { "<STR_LIT>" : keystone_client_v3 } ) <EOL> except ImportError : <EOL> pass <EOL> @ six . python_2_unicode_compatible <EOL> class Service ( base . APIDictWrapper ) : <EOL> """<STR_LIT>""" <EOL> _attrs = [ '<STR_LIT:id>' , '<STR_LIT:type>' , '<STR_LIT:name>' ] <EOL> def __init__ ( self , service , region , * args , ** kwargs ) : <EOL> super ( Service , self ) . __init__ ( service , * args , ** kwargs ) <EOL> self . public_url = base . get_url_for_service ( service , region , <EOL> '<STR_LIT>' ) <EOL> self . url = base . get_url_for_service ( service , region , '<STR_LIT>' ) <EOL> if self . url : <EOL> self . host = urlparse . urlparse ( self . url ) . hostname <EOL> else : <EOL> self . host = None <EOL> self . disabled = None <EOL> self . region = region <EOL> def __str__ ( self ) : <EOL> if ( self . type == "<STR_LIT>" ) : <EOL> return _ ( "<STR_LIT>" ) % { "<STR_LIT:type>" : self . type , "<STR_LIT>" : keystone_backend_name ( ) } <EOL> else : <EOL> return self . type <EOL> def __repr__ ( self ) : <EOL> return "<STR_LIT>" % six . text_type ( self ) <EOL> def _get_endpoint_url ( request , endpoint_type , catalog = None ) : <EOL> if getattr ( request . user , "<STR_LIT>" , None ) : <EOL> url = base . url_for ( request , <EOL> service_type = '<STR_LIT>' , <EOL> endpoint_type = endpoint_type ) <EOL> else : <EOL> auth_url = getattr ( settings , '<STR_LIT>' ) <EOL> url = request . session . get ( '<STR_LIT>' , auth_url ) <EOL> url = url . rstrip ( '<STR_LIT:/>' ) <EOL> url = urlparse . urljoin ( url , '<STR_LIT>' % VERSIONS . active ) <EOL> return url <EOL> def keystoneclient ( request , admin = False ) : <EOL> """<STR_LIT>""" <EOL> api_version = VERSIONS . get_active_version ( ) <EOL> user = request . user <EOL> token_id = user . token . id <EOL> if is_multi_domain_enabled : <EOL> if is_domain_admin ( request ) : <EOL> domain_token = request . session . get ( '<STR_LIT>' ) <EOL> if domain_token : <EOL> token_id = getattr ( domain_token , '<STR_LIT>' , None ) <EOL> if admin : <EOL> if not policy . check ( ( ( "<STR_LIT>" , "<STR_LIT>" ) , ) , request ) : <EOL> raise exceptions . NotAuthorized <EOL> endpoint_type = '<STR_LIT>' <EOL> else : <EOL> endpoint_type = getattr ( settings , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' ) <EOL> cache_attr = "<STR_LIT>" if admin else backend . KEYSTONE_CLIENT_ATTR <EOL> if ( hasattr ( request , cache_attr ) and <EOL> ( not user . token . id or <EOL> getattr ( request , cache_attr ) . auth_token == user . token . id ) ) : <EOL> conn = getattr ( request , cache_attr ) <EOL> else : <EOL> endpoint = _get_endpoint_url ( request , endpoint_type ) <EOL> insecure = getattr ( settings , '<STR_LIT>' , False ) <EOL> cacert = getattr ( settings , '<STR_LIT>' , None ) <EOL> LOG . debug ( "<STR_LIT>" % endpoint ) <EOL> remote_addr = request . environ . get ( '<STR_LIT>' , '<STR_LIT>' ) <EOL> conn = api_version [ '<STR_LIT>' ] . Client ( token = token_id , <EOL> endpoint = endpoint , <EOL> original_ip = remote_addr , <EOL> insecure = insecure , <EOL> cacert = cacert , <EOL> auth_url = endpoint , <EOL> debug = settings . DEBUG ) <EOL> setattr ( request , cache_attr , conn ) <EOL> return conn <EOL> def domain_create ( request , name , description = None , enabled = None ) : <EOL> manager = keystoneclient ( request , admin = True ) . domains <EOL> return manager . create ( name = name , <EOL> description = description , <EOL> enabled = enabled ) <EOL> def domain_get ( request , domain_id ) : <EOL> manager = keystoneclient ( request , admin = True ) . domains <EOL> return manager . get ( domain_id ) <EOL> def domain_delete ( request , domain_id ) : <EOL> manager = keystoneclient ( request , admin = True ) . domains <EOL> return manager . delete ( domain_id ) <EOL> def domain_list ( request ) : <EOL> manager = keystoneclient ( request , admin = True ) . domains <EOL> return manager . list ( ) <EOL> def domain_lookup ( request ) : <EOL> if policy . check ( ( ( "<STR_LIT>" , "<STR_LIT>" ) , ) , request ) : <EOL> try : <EOL> domains = domain_list ( request ) <EOL> return dict ( ( d . id , d . name ) for d in domains ) <EOL> except Exception : <EOL> LOG . warning ( "<STR_LIT>" ) <EOL> return None <EOL> else : <EOL> domain = get_default_domain ( request ) <EOL> return { domain . id : domain . name } <EOL> def domain_update ( request , domain_id , name = None , description = None , <EOL> enabled = None ) : <EOL> manager = keystoneclient ( request , admin = True ) . domains <EOL> try : <EOL> response = manager . update ( domain_id , name = name , <EOL> description = description , enabled = enabled ) <EOL> except Exception as e : <EOL> LOG . exception ( "<STR_LIT>" % domain_id ) <EOL> raise e <EOL> return response <EOL> def tenant_create ( request , name , description = None , enabled = None , <EOL> domain = None , ** kwargs ) : <EOL> manager = VERSIONS . get_project_manager ( request , admin = True ) <EOL> try : <EOL> if VERSIONS . active < <NUM_LIT:3> : <EOL> return manager . create ( name , description , enabled , ** kwargs ) <EOL> else : <EOL> return manager . create ( name , domain , <EOL> description = description , <EOL> enabled = enabled , ** kwargs ) <EOL> except keystone_exceptions . Conflict : <EOL> raise exceptions . Conflict ( ) <EOL> def get_default_domain ( request , get_name = True ) : <EOL> """<STR_LIT>""" <EOL> domain_id = request . session . get ( "<STR_LIT>" , None ) <EOL> domain_name = request . session . get ( "<STR_LIT>" , None ) <EOL> if VERSIONS . active >= <NUM_LIT:3> and domain_id is None : <EOL> domain_id = request . user . user_domain_id <EOL> domain_name = request . user . user_domain_name <EOL> if get_name : <EOL> try : <EOL> domain = domain_get ( request , domain_id ) <EOL> domain_name = domain . name <EOL> except Exception : <EOL> LOG . warning ( "<STR_LIT>" % domain_id ) <EOL> domain = base . APIDictWrapper ( { "<STR_LIT:id>" : domain_id , <EOL> "<STR_LIT:name>" : domain_name } ) <EOL> return domain <EOL> def get_effective_domain_id ( request ) : <EOL> """<STR_LIT>""" <EOL> domain_id = get_default_domain ( request ) . get ( '<STR_LIT:id>' ) <EOL> return None if domain_id == DEFAULT_DOMAIN else domain_id <EOL> def is_cloud_admin ( request ) : <EOL> return policy . check ( ( ( "<STR_LIT>" , "<STR_LIT>" ) , ) , request ) <EOL> def is_domain_admin ( request ) : <EOL> return policy . check ( <EOL> ( ( "<STR_LIT>" , "<STR_LIT>" ) , ) , request ) <EOL> def tenant_get ( request , project , admin = True ) : <EOL> manager = VERSIONS . get_project_manager ( request , admin = admin ) <EOL> return manager . get ( project ) <EOL> def tenant_delete ( request , project ) : <EOL> manager = VERSIONS . get_project_manager ( request , admin = True ) <EOL> return manager . delete ( project ) <EOL> def tenant_list ( request , paginate = False , marker = None , domain = None , user = None , <EOL> admin = True , filters = None ) : <EOL> manager = VERSIONS . get_project_manager ( request , admin = admin ) <EOL> page_size = utils . get_page_size ( request ) <EOL> limit = None <EOL> if paginate : <EOL> limit = page_size + <NUM_LIT:1> <EOL> has_more_data = False <EOL> if user == request . user . id : <EOL> tenants = request . user . authorized_tenants <EOL> elif VERSIONS . active < <NUM_LIT:3> : <EOL> tenants = manager . list ( limit , marker ) <EOL> if paginate and len ( tenants ) > page_size : <EOL> tenants . pop ( - <NUM_LIT:1> ) <EOL> has_more_data = True <EOL> else : <EOL> domain_id = get_effective_domain_id ( request ) <EOL> kwargs = { <EOL> "<STR_LIT>" : domain_id , <EOL> "<STR_LIT:user>" : user <EOL> } <EOL> if filters is not None : <EOL> kwargs . update ( filters ) <EOL> tenants = manager . list ( ** kwargs ) <EOL> return tenants , has_more_data <EOL> def tenant_update ( request , project , name = None , description = None , <EOL> enabled = None , domain = None , ** kwargs ) : <EOL> manager = VERSIONS . get_project_manager ( request , admin = True ) <EOL> try : <EOL> if VERSIONS . active < <NUM_LIT:3> : <EOL> return manager . update ( project , name , description , enabled , <EOL> ** kwargs ) <EOL> else : <EOL> return manager . update ( project , name = name , description = description , <EOL> enabled = enabled , domain = domain , ** kwargs ) <EOL> except keystone_exceptions . Conflict : <EOL> raise exceptions . Conflict ( ) <EOL> def user_list ( request , project = None , domain = None , group = None , filters = None ) : <EOL> if VERSIONS . active < <NUM_LIT:3> : <EOL> kwargs = { "<STR_LIT>" : project } <EOL> else : <EOL> kwargs = { <EOL> "<STR_LIT>" : project , <EOL> "<STR_LIT>" : domain , <EOL> "<STR_LIT>" : group <EOL> } <EOL> if filters is not None : <EOL> kwargs . update ( filters ) <EOL> users = keystoneclient ( request , admin = True ) . users . list ( ** kwargs ) <EOL> return [ VERSIONS . upgrade_v2_user ( user ) for user in users ] <EOL> def user_create ( request , name = None , email = None , password = None , project = None , <EOL> enabled = None , domain = None , description = None ) : <EOL> manager = keystoneclient ( request , admin = True ) . users <EOL> try : <EOL> if VERSIONS . active < <NUM_LIT:3> : <EOL> user = manager . create ( name , password , email , project , enabled ) <EOL> return VERSIONS . upgrade_v2_user ( user ) <EOL> else : <EOL> return manager . create ( name , password = password , email = email , <EOL> default_project = project , enabled = enabled , <EOL> domain = domain , description = description ) <EOL> except keystone_exceptions . Conflict : <EOL> raise exceptions . Conflict ( ) <EOL> def user_delete ( request , user_id ) : <EOL> return keystoneclient ( request , admin = True ) . users . delete ( user_id ) <EOL> def user_get ( request , user_id , admin = True ) : <EOL> user = keystoneclient ( request , admin = admin ) . users . get ( user_id ) <EOL> return VERSIONS . upgrade_v2_user ( user ) <EOL> def user_update ( request , user , ** data ) : <EOL> manager = keystoneclient ( request , admin = True ) . users <EOL> error = None <EOL> if not keystone_can_edit_user ( ) : <EOL> raise keystone_exceptions . ClientException ( <EOL> <NUM_LIT> , _ ( "<STR_LIT>" ) ) <EOL> if VERSIONS . active < <NUM_LIT:3> : <EOL> try : <EOL> user = manager . update ( user , ** data ) <EOL> except keystone_exceptions . Conflict : <EOL> raise exceptions . Conflict ( ) <EOL> except Exception : <EOL> error = exceptions . handle ( request , ignore = True ) <EOL> if "<STR_LIT>" in data : <EOL> project = data . pop ( '<STR_LIT>' ) <EOL> try : <EOL> user_update_tenant ( request , user , project ) <EOL> user . tenantId = project <EOL> except Exception : <EOL> error = exceptions . handle ( request , ignore = True ) <EOL> user_roles = roles_for_user ( request , user , project ) <EOL> if not user_roles : <EOL> messages . warning ( request , <EOL> _ ( '<STR_LIT>' <EOL> '<STR_LIT>' ) <EOL> % data . get ( '<STR_LIT:name>' , None ) ) <EOL> if error is not None : <EOL> raise error <EOL> else : <EOL> try : <EOL> user = manager . update ( user , ** data ) <EOL> except keystone_exceptions . Conflict : <EOL> raise exceptions . Conflict ( ) <EOL> def user_update_enabled ( request , user , enabled ) : <EOL> manager = keystoneclient ( request , admin = True ) . users <EOL> if VERSIONS . active < <NUM_LIT:3> : <EOL> return manager . update_enabled ( user , enabled ) <EOL> else : <EOL> return manager . update ( user , enabled = enabled ) <EOL> def user_update_password ( request , user , password , admin = True ) : <EOL> if not keystone_can_edit_user ( ) : <EOL> raise keystone_exceptions . ClientException ( <EOL> <NUM_LIT> , _ ( "<STR_LIT>" ) ) <EOL> manager = keystoneclient ( request , admin = admin ) . users <EOL> if VERSIONS . active < <NUM_LIT:3> : <EOL> return manager . update_password ( user , password ) <EOL> else : <EOL> return manager . update ( user , password = password ) <EOL> def user_verify_admin_password ( request , admin_password ) : <EOL> client = keystone_client_v2 if VERSIONS . active < <NUM_LIT:3> else keystone_client_v3 <EOL> try : <EOL> endpoint = _get_endpoint_url ( request , '<STR_LIT>' ) <EOL> insecure = getattr ( settings , '<STR_LIT>' , False ) <EOL> cacert = getattr ( settings , '<STR_LIT>' , None ) <EOL> client . Client ( <EOL> username = request . user . username , <EOL> password = admin_password , <EOL> insecure = insecure , <EOL> cacert = cacert , <EOL> auth_url = endpoint <EOL> ) <EOL> return True <EOL> except Exception : <EOL> exceptions . handle ( request , ignore = True ) <EOL> return False <EOL> def user_update_own_password ( request , origpassword , password ) : <EOL> client = keystoneclient ( request , admin = False ) <EOL> client . user_id = request . user . id <EOL> if VERSIONS . active < <NUM_LIT:3> : <EOL> return client . users . update_own_password ( origpassword , password ) <EOL> else : <EOL> return client . users . update_password ( origpassword , password ) <EOL> def user_update_tenant ( request , user , project , admin = True ) : <EOL> manager = keystoneclient ( request , admin = admin ) . users <EOL> if VERSIONS . active < <NUM_LIT:3> : <EOL> return manager . update_tenant ( user , project ) <EOL> else : <EOL> return manager . update ( user , project = project ) <EOL> def group_create ( request , domain_id , name , description = None ) : <EOL> manager = keystoneclient ( request , admin = True ) . groups <EOL> return manager . create ( domain = domain_id , <EOL> name = name , <EOL> description = description ) <EOL> def group_get ( request , group_id , admin = True ) : <EOL> manager = keystoneclient ( request , admin = admin ) . groups <EOL> return manager . get ( group_id ) <EOL> def group_delete ( request , group_id ) : <EOL> manager = keystoneclient ( request , admin = True ) . groups <EOL> return manager . delete ( group_id ) <EOL> def group_list ( request , domain = None , project = None , user = None ) : <EOL> manager = keystoneclient ( request , admin = True ) . groups <EOL> groups = manager . list ( user = user , domain = domain ) <EOL> if project : <EOL> project_groups = [ ] <EOL> for group in groups : <EOL> roles = roles_for_group ( request , group = group . id , project = project ) <EOL> if roles and len ( roles ) > <NUM_LIT:0> : <EOL> project_groups . append ( group ) <EOL> groups = project_groups <EOL> return groups <EOL> def group_update ( request , group_id , name = None , description = None ) : <EOL> manager = keystoneclient ( request , admin = True ) . groups <EOL> return manager . update ( group = group_id , <EOL> name = name , <EOL> description = description ) <EOL> def add_group_user ( request , group_id , user_id ) : <EOL> manager = keystoneclient ( request , admin = True ) . users <EOL> return manager . add_to_group ( group = group_id , user = user_id ) <EOL> def remove_group_user ( request , group_id , user_id ) : <EOL> manager = keystoneclient ( request , admin = True ) . users <EOL> return manager . remove_from_group ( group = group_id , user = user_id ) <EOL> def get_project_groups_roles ( request , project ) : <EOL> """<STR_LIT>""" <EOL> groups_roles = collections . defaultdict ( list ) <EOL> project_role_assignments = role_assignments_list ( request , <EOL> project = project ) <EOL> for role_assignment in project_role_assignments : <EOL> if not hasattr ( role_assignment , '<STR_LIT>' ) : <EOL> continue <EOL> group_id = role_assignment . group [ '<STR_LIT:id>' ] <EOL> role_id = role_assignment . role [ '<STR_LIT:id>' ] <EOL> if ( '<STR_LIT>' in role_assignment . scope and <EOL> role_assignment . scope [ '<STR_LIT>' ] [ '<STR_LIT:id>' ] == project ) : <EOL> groups_roles [ group_id ] . append ( role_id ) <EOL> return groups_roles <EOL> def role_assignments_list ( request , project = None , user = None , role = None , <EOL> group = None , domain = None , effective = False , <EOL> include_subtree = True ) : <EOL> if VERSIONS . active < <NUM_LIT:3> : <EOL> raise exceptions . NotAvailable <EOL> if include_subtree : <EOL> domain = None <EOL> manager = keystoneclient ( request , admin = True ) . role_assignments <EOL> return manager . list ( project = project , user = user , role = role , group = group , <EOL> domain = domain , effective = effective , <EOL> include_subtree = include_subtree ) <EOL> def role_create ( request , name ) : <EOL> manager = keystoneclient ( request , admin = True ) . roles <EOL> return manager . create ( name ) <EOL> def role_get ( request , role_id ) : <EOL> manager = keystoneclient ( request , admin = True ) . roles <EOL> return manager . get ( role_id ) <EOL> def role_update ( request , role_id , name = None ) : <EOL> manager = keystoneclient ( request , admin = True ) . roles <EOL> return manager . update ( role_id , name ) <EOL> def role_delete ( request , role_id ) : <EOL> manager = keystoneclient ( request , admin = True ) . roles <EOL> return manager . delete ( role_id ) <EOL> def role_list ( request ) : <EOL> """<STR_LIT>""" <EOL> return keystoneclient ( request , admin = True ) . roles . list ( ) <EOL> def roles_for_user ( request , user , project = None , domain = None ) : <EOL> """<STR_LIT>""" <EOL> manager = keystoneclient ( request , admin = True ) . roles <EOL> if VERSIONS . active < <NUM_LIT:3> : <EOL> return manager . roles_for_user ( user , project ) <EOL> else : <EOL> return manager . list ( user = user , domain = domain , project = project ) <EOL> def get_domain_users_roles ( request , domain ) : <EOL> users_roles = collections . defaultdict ( list ) <EOL> domain_role_assignments = role_assignments_list ( request , <EOL> domain = domain , <EOL> include_subtree = False ) <EOL> for role_assignment in domain_role_assignments : <EOL> if not hasattr ( role_assignment , '<STR_LIT:user>' ) : <EOL> continue <EOL> user_id = role_assignment . user [ '<STR_LIT:id>' ] <EOL> role_id = role_assignment . role [ '<STR_LIT:id>' ] <EOL> if ( '<STR_LIT>' in role_assignment . scope and <EOL> role_assignment . scope [ '<STR_LIT>' ] [ '<STR_LIT:id>' ] == domain ) : <EOL> users_roles [ user_id ] . append ( role_id ) <EOL> return users_roles <EOL> def add_domain_user_role ( request , user , role , domain ) : <EOL> """<STR_LIT>""" <EOL> manager = keystoneclient ( request , admin = True ) . roles <EOL> return manager . grant ( role , user = user , domain = domain ) <EOL> def remove_domain_user_role ( request , user , role , domain = None ) : <EOL> """<STR_LIT>""" <EOL> manager = keystoneclient ( request , admin = True ) . roles <EOL> return manager . revoke ( role , user = user , domain = domain ) <EOL> def get_project_users_roles ( request , project ) : <EOL> users_roles = collections . defaultdict ( list ) <EOL> if VERSIONS . active < <NUM_LIT:3> : <EOL> project_users = user_list ( request , project = project ) <EOL> for user in project_users : <EOL> roles = roles_for_user ( request , user . id , project ) <EOL> roles_ids = [ role . id for role in roles ] <EOL> users_roles [ user . id ] . extend ( roles_ids ) <EOL> else : <EOL> project_role_assignments = role_assignments_list ( request , <EOL> project = project ) <EOL> for role_assignment in project_role_assignments : <EOL> if not hasattr ( role_assignment , '<STR_LIT:user>' ) : <EOL> continue <EOL> user_id = role_assignment . user [ '<STR_LIT:id>' ] <EOL> role_id = role_assignment . role [ '<STR_LIT:id>' ] <EOL> if ( '<STR_LIT>' in role_assignment . scope and <EOL> role_assignment . scope [ '<STR_LIT>' ] [ '<STR_LIT:id>' ] == project ) : <EOL> users_roles [ user_id ] . append ( role_id ) <EOL> return users_roles <EOL> def add_tenant_user_role ( request , project = None , user = None , role = None , <EOL> group = None , domain = None ) : <EOL> """<STR_LIT>""" <EOL> manager = keystoneclient ( request , admin = True ) . roles <EOL> if VERSIONS . active < <NUM_LIT:3> : <EOL> return manager . add_user_role ( user , role , project ) <EOL> else : <EOL> return manager . grant ( role , user = user , project = project , <EOL> group = group , domain = domain ) <EOL> def remove_tenant_user_role ( request , project = None , user = None , role = None , <EOL> group = None , domain = None ) : <EOL> """<STR_LIT>""" <EOL> manager = keystoneclient ( request , admin = True ) . roles <EOL> if VERSIONS . active < <NUM_LIT:3> : <EOL> return manager . remove_user_role ( user , role , project ) <EOL> else : <EOL> return manager . revoke ( role , user = user , project = project , <EOL> group = group , domain = domain ) <EOL> def remove_tenant_user ( request , project = None , user = None , domain = None ) : <EOL> """<STR_LIT>""" <EOL> client = keystoneclient ( request , admin = True ) <EOL> roles = client . roles . roles_for_user ( user , project ) <EOL> for role in roles : <EOL> remove_tenant_user_role ( request , user = user , role = role . id , <EOL> project = project , domain = domain ) <EOL> def roles_for_group ( request , group , domain = None , project = None ) : <EOL> manager = keystoneclient ( request , admin = True ) . roles <EOL> return manager . list ( group = group , domain = domain , project = project ) <EOL> def add_group_role ( request , role , group , domain = None , project = None ) : <EOL> """<STR_LIT>""" <EOL> manager = keystoneclient ( request , admin = True ) . roles <EOL> return manager . grant ( role = role , group = group , domain = domain , <EOL> project = project ) <EOL> def remove_group_role ( request , role , group , domain = None , project = None ) : <EOL> """<STR_LIT>""" <EOL> manager = keystoneclient ( request , admin = True ) . roles <EOL> return manager . revoke ( role = role , group = group , project = project , <EOL> domain = domain ) <EOL> def remove_group_roles ( request , group , domain = None , project = None ) : <EOL> """<STR_LIT>""" <EOL> client = keystoneclient ( request , admin = True ) <EOL> roles = client . roles . list ( group = group , domain = domain , project = project ) <EOL> for role in roles : <EOL> remove_group_role ( request , role = role . id , group = group , <EOL> domain = domain , project = project ) <EOL> def get_default_role ( request ) : <EOL> """<STR_LIT>""" <EOL> global DEFAULT_ROLE <EOL> default = getattr ( settings , "<STR_LIT>" , None ) <EOL> if default and DEFAULT_ROLE is None : <EOL> try : <EOL> roles = keystoneclient ( request , admin = True ) . roles . list ( ) <EOL> except Exception : <EOL> roles = [ ] <EOL> exceptions . handle ( request ) <EOL> for role in roles : <EOL> if role . id == default or role . name == default : <EOL> DEFAULT_ROLE = role <EOL> break <EOL> return DEFAULT_ROLE <EOL> def ec2_manager ( request ) : <EOL> client = keystoneclient ( request ) <EOL> if hasattr ( client , '<STR_LIT>' ) : <EOL> return client . ec2 <EOL> from keystoneclient . v2_0 import ec2 <EOL> return ec2 . CredentialsManager ( client ) <EOL> def list_ec2_credentials ( request , user_id ) : <EOL> return ec2_manager ( request ) . list ( user_id ) <EOL> def create_ec2_credentials ( request , user_id , tenant_id ) : <EOL> return ec2_manager ( request ) . create ( user_id , tenant_id ) <EOL> def get_user_ec2_credentials ( request , user_id , access_token ) : <EOL> return ec2_manager ( request ) . get ( user_id , access_token ) <EOL> def delete_user_ec2_credentials ( request , user_id , access_token ) : <EOL> return ec2_manager ( request ) . delete ( user_id , access_token ) <EOL> def keystone_can_edit_domain ( ) : <EOL> backend_settings = getattr ( settings , "<STR_LIT>" , { } ) <EOL> can_edit_domain = backend_settings . get ( '<STR_LIT>' , True ) <EOL> multi_domain_support = getattr ( settings , <EOL> '<STR_LIT>' , <EOL> False ) <EOL> return can_edit_domain and multi_domain_support <EOL> def keystone_can_edit_user ( ) : <EOL> backend_settings = getattr ( settings , "<STR_LIT>" , { } ) <EOL> return backend_settings . get ( '<STR_LIT>' , True ) <EOL> def keystone_can_edit_project ( ) : <EOL> backend_settings = getattr ( settings , "<STR_LIT>" , { } ) <EOL> return backend_settings . get ( '<STR_LIT>' , True ) <EOL> def keystone_can_edit_group ( ) : <EOL> backend_settings = getattr ( settings , "<STR_LIT>" , { } ) <EOL> return backend_settings . get ( '<STR_LIT>' , True ) <EOL> def keystone_can_edit_role ( ) : <EOL> backend_settings = getattr ( settings , "<STR_LIT>" , { } ) <EOL> return backend_settings . get ( '<STR_LIT>' , True ) <EOL> def keystone_backend_name ( ) : <EOL> if hasattr ( settings , "<STR_LIT>" ) : <EOL> return settings . OPENSTACK_KEYSTONE_BACKEND [ '<STR_LIT:name>' ] <EOL> else : <EOL> return '<STR_LIT>' <EOL> def get_version ( ) : <EOL> return VERSIONS . active <EOL> def is_multi_domain_enabled ( ) : <EOL> return ( VERSIONS . active >= <NUM_LIT:3> and <EOL> getattr ( settings , '<STR_LIT>' , False ) ) <EOL> def is_federation_management_enabled ( ) : <EOL> return getattr ( settings , '<STR_LIT>' , False ) <EOL> def identity_provider_create ( request , idp_id , description = None , <EOL> enabled = False , remote_ids = None ) : <EOL> manager = keystoneclient ( request , admin = True ) . federation . identity_providers <EOL> try : <EOL> return manager . create ( id = idp_id , <EOL> description = description , <EOL> enabled = enabled , <EOL> remote_ids = remote_ids ) <EOL> except keystone_exceptions . Conflict : <EOL> raise exceptions . Conflict ( ) <EOL> def identity_provider_get ( request , idp_id ) : <EOL> manager = keystoneclient ( request , admin = True ) . federation . identity_providers <EOL> return manager . get ( idp_id ) <EOL> def identity_provider_update ( request , idp_id , description = None , <EOL> enabled = False , remote_ids = None ) : <EOL> manager = keystoneclient ( request , admin = True ) . federation . identity_providers <EOL> try : <EOL> return manager . update ( idp_id , <EOL> description = description , <EOL> enabled = enabled , <EOL> remote_ids = remote_ids ) <EOL> except keystone_exceptions . Conflict : <EOL> raise exceptions . Conflict ( ) <EOL> def identity_provider_delete ( request , idp_id ) : <EOL> manager = keystoneclient ( request , admin = True ) . federation . identity_providers <EOL> return manager . delete ( idp_id ) <EOL> def identity_provider_list ( request ) : <EOL> manager = keystoneclient ( request , admin = True ) . federation . identity_providers <EOL> return manager . list ( ) <EOL> def mapping_create ( request , mapping_id , rules ) : <EOL> manager = keystoneclient ( request , admin = True ) . federation . mappings <EOL> try : <EOL> return manager . create ( mapping_id = mapping_id , rules = rules ) <EOL> except keystone_exceptions . Conflict : <EOL> raise exceptions . Conflict ( ) <EOL> def mapping_get ( request , mapping_id ) : <EOL> manager = keystoneclient ( request , admin = True ) . federation . mappings <EOL> return manager . get ( mapping_id ) <EOL> def mapping_update ( request , mapping_id , rules ) : <EOL> manager = keystoneclient ( request , admin = True ) . federation . mappings <EOL> return manager . update ( mapping_id , rules = rules ) <EOL> def mapping_delete ( request , mapping_id ) : <EOL> manager = keystoneclient ( request , admin = True ) . federation . mappings <EOL> return manager . delete ( mapping_id ) <EOL> def mapping_list ( request ) : <EOL> manager = keystoneclient ( request , admin = True ) . federation . mappings <EOL> return manager . list ( ) <EOL> def protocol_create ( request , protocol_id , identity_provider , mapping ) : <EOL> manager = keystoneclient ( request ) . federation . protocols <EOL> try : <EOL> return manager . create ( protocol_id , identity_provider , mapping ) <EOL> except keystone_exceptions . Conflict : <EOL> raise exceptions . Conflict ( ) <EOL> def protocol_get ( request , identity_provider , protocol ) : <EOL> manager = keystoneclient ( request ) . federation . protocols <EOL> return manager . get ( identity_provider , protocol ) <EOL> def protocol_update ( request , identity_provider , protocol , mapping ) : <EOL> manager = keystoneclient ( request ) . federation . protocols <EOL> return manager . update ( identity_provider , protocol , mapping ) <EOL> def protocol_delete ( request , identity_provider , protocol ) : <EOL> manager = keystoneclient ( request ) . federation . protocols <EOL> return manager . delete ( identity_provider , protocol ) <EOL> def protocol_list ( request , identity_provider ) : <EOL> manager = keystoneclient ( request ) . federation . protocols <EOL> return manager . list ( identity_provider ) </s>
