HEX
Server: Apache
System: Linux server2.voipitup.com.au 4.18.0-553.104.1.lve.el8.x86_64 #1 SMP Tue Feb 10 20:07:30 UTC 2026 x86_64
User: posscale (1027)
PHP: 8.2.29
Disabled: exec,passthru,shell_exec,system
$ pwd: /opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/__pycache__/
Upload Files
File: //opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/__pycache__/keystone.cpython-310.pyc
o

�N�g[��@s�dZddlZddlZdZz&ddlZddlmZdZddl	m
Z
ddlmZddlm
Z
ddlmZWn	ey;Ynwd	ad
ae�e�Zdd�Zd_d
d�Zd_dd�Zd_dd�Z					d`dd�Z	dadd�Z	dadd�Zdbdd�Zdbdd�Zd_dd�Z							dcdd �Z 	dbd!d"�Z!d_d#d$�Z"dbd%d&�Z#dbd'd(�Z$d_d)d*�Z%	ddd+d,�Z&dbd-d.�Z'dbd/d0�Z(d_d1d2�Z)	ded3d4�Z*	ded5d6�Z+dbd7d8�Z,dbd9d:�Z-dbd;d<�Z.dbd=d>�Z/d_d?d@�Z0d_dAdB�Z1					d`dCdD�Z2					d`dEdF�Z3d_dGdH�Z4d_dIdJ�Z5dbdKdL�Z6					dfdMdN�Z7dbdOdP�Z8								dgdQdR�Z9	dadSdT�Z:	dadUdV�Z;									dhdWdX�Z<									dhdYdZ�Z=							dcd[d\�Z>d_d]d^�Z?dS)iaf
Module for handling openstack keystone calls.

:optdepends:    - keystoneclient Python adapter
:configuration: This module is not usable until the following are specified
    either in a pillar or in the minion's config file:

    .. code-block:: yaml

        keystone.user: admin
        keystone.password: verybadpass
        keystone.tenant: admin
        keystone.tenant_id: f80919baedab48ec8931f200c65a50df
        keystone.auth_url: 'http://127.0.0.1:5000/v2.0/'
        keystone.verify_ssl: True

    OR (for token based authentication)

    .. code-block:: yaml

        keystone.token: 'ADMIN'
        keystone.endpoint: 'http://127.0.0.1:35357/v2.0'

    If configuration for multiple openstack accounts is required, they can be
    set up as different configuration profiles. For example:

    .. code-block:: yaml

        openstack1:
          keystone.user: admin
          keystone.password: verybadpass
          keystone.tenant: admin
          keystone.tenant_id: f80919baedab48ec8931f200c65a50df
          keystone.auth_url: 'http://127.0.0.1:5000/v2.0/'
          keystone.verify_ssl: True

        openstack2:
          keystone.user: admin
          keystone.password: verybadpass
          keystone.tenant: admin
          keystone.tenant_id: f80919baedab48ec8931f200c65a50df
          keystone.auth_url: 'http://127.0.0.2:5000/v2.0/'
          keystone.verify_ssl: True

    With this configuration in place, any of the keystone functions can make use
    of a configuration profile by declaring it explicitly.
    For example:

    .. code-block:: bash

        salt '*' keystone.tenant_list profile=openstack1
�NF)�clientT��session)�generic)�discover��tenantscCstrdSdS)zL
    Only load this module if keystone
    is installed on this minion.
    Zkeystone)FzXkeystone execution module cannot be loaded: keystoneclient python library not available.)�HAS_KEYSTONE�r
r
�I/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/keystone.py�__virtual__Psrcs�|r|d�nd�d��fdd�	}|dd�}|dd	�}|d
d�}|d�}|dd
�}|dd�}|d�}	|dd�}
|dd�}|dd�}|dd�}
|	rN|	|
d�}n|||||||d�}|r^d|d<|
|d<|S)z
    get connection args
    z
:keystone.z	keystone.Ncs��d|td�||��S)zL
        look in connection_args first, then default to config file
        Zconnection_z
config.get)�get�__salt__)�key�default��connection_args�prefixr
rr
gs�z_get_kwargs.<locals>.get�userZadmin�passwordZADMIN�tenant�	tenant_id�auth_urlzhttp://127.0.0.1:35357/v2.0/�insecureF�token�endpoint�http://127.0.0.1:35357/v2.0�user_domain_nameZDefault�project_domain_name�
verify_sslT)rr)�usernamer�tenant_namerrrr�Nr
)�profilerr
rrrrrrrrrrr�kwargsr
rr�_get_kwargs^s:









�r%cKsdtdd|i|��}|�d|�dd��}ztjjj|dd|dd�d	d
dWSty1YdSw)
z�
    Returns the API version derived from endpoint's response.

    CLI Example:

    .. code-block:: bash

        salt '*' keystone.api_version
    r#rrNT�jsonr)�decodeZdecode_typer�dict�version�idr
)r%r
�salt�utils�http�query�KeyError)r#rr$rr
r
r�api_version�s
�����r0c	Ks�tddd�tdd|i|��}tj|dd�}|�d�}|�d�}|r-d	ad
a||d<n||d<|�d�|�d�tj	di|��}t
j|d
�}|j|d�}|S)z�
    Set up keystone credentials. Only intended to be used within Keystone-enabled modules.

    CLI Example:

    .. code-block:: bash

        salt '*' keystone.auth
    zversions.warn_untilZArgonzwThe keystone module has been deprecated and will be removed in {version}.  Please update to using the keystoneng moduler#r)rzv2.0zv3.0��projectsrr)�authrNr
)
Z	__utils__r%rZDiscoverZurl_for�_OS_IDENTITY_API_VERSION�_TENANTS�poprZPasswordrZSessionZ
create_client)	r#rr$ZdiscZv2_auth_urlZv3_auth_urlr3ZsessZks_clr
r
rr3�s&
�




r3cKs�t|fi|��}|rtd||d�|��|d}|sddiS|r.td||d�|��|d}|s4ddiS|j�||�}|j|j|j|jd�S)	aL
    Create EC2-compatible credentials for user per tenant

    CLI Examples:

    .. code-block:: bash

        salt '*' keystone.ec2_credentials_create name=admin tenant=admin

        salt '*' keystone.ec2_credentials_create         user_id=c965f79c4f864eaaa9c3b41904e67082         tenant_id=722787eb540849158668370dc627ec5f
    ��namer#r*�Error�Could not resolve User IDzCould not resolve Tenant ID)�access�secretr�user_idNr
)	r3�user_get�
tenant_get�ec2�creater;r<rr=)r=r8rrr#r�kstoneZnewec2r
r
r�ec2_credentials_create�s"��rCcKs\t|fi|��}|rtd	|dd�|��|d}|sddiS|j�||�d|�d|�d�S)
aP
    Delete EC2-compatible credentials

    CLI Examples:

    .. code-block:: bash

        salt '*' keystone.ec2_credentials_delete         860f8c2c38ca4fab989f9bc56a061a64 access_key=5f66d2f24f604b8bb9cd28886106f442

        salt '*' keystone.ec2_credentials_delete name=admin         access_key=5f66d2f24f604b8bb9cd28886106f442
    Nr7r*r9r:z	ec2 key "z" deleted under user id "�"r
)r3r>r@�delete)r=r8Z
access_keyr#rrBr
r
r�ec2_credentials_delete�srFc	Ks�t|fi|��}i}|r|j��D]}|j|kr|j}nq|s$ddiS|s*ddiS|jjd|||d�|��}|j|j|j	|j
d�||j<|S)a�
    Return ec2_credentials for a user (keystone ec2-credentials-get)

    CLI Examples:

    .. code-block:: bash

        salt '*' keystone.ec2_credentials_get c965f79c4f864eaaa9c3b41904e67082 access=722787eb540849158668370
        salt '*' keystone.ec2_credentials_get user_id=c965f79c4f864eaaa9c3b41904e67082 access=722787eb540849158668370
        salt '*' keystone.ec2_credentials_get name=nova access=722787eb540849158668370dc627ec5f
    r9�Unable to resolve user idzAccess key is required)r=r;r#)r=rr;r<Nr
)r3�users�listr8r*r@r
r=rr;r<)	r=r8r;r#rrB�retrZec2_credentialsr
r
r�ec2_credentials_gets.
����rKcKszt|fi|��}i}|r|j��D]}|j|kr|j}nq|s$ddiS|j�|�D]}|j|j|j|j	d�||j<q*|S)am
    Return a list of ec2_credentials for a specific user (keystone ec2-credentials-list)

    CLI Examples:

    .. code-block:: bash

        salt '*' keystone.ec2_credentials_list 298ce377245c4ec9b70e1c639c89e654
        salt '*' keystone.ec2_credentials_list user_id=298ce377245c4ec9b70e1c639c89e654
        salt '*' keystone.ec2_credentials_list name=jack
    r9rG)r=rr;r<)
r3rHrIr8r*r@r=rr;r<)r=r8r#rrBrJrZec2_credentialr
r
r�ec2_credentials_list1s"
��rLcs�t|fi|��t|fi|��}||vrddiS||d�t|fi|��}dd����fdd�|��D�D�}t|�dkrFdd�||�iSt|�dkrP|d	Sdd
iS)z�
    Return a specific endpoint (keystone endpoint-get)

    CLI Example:

    .. code-block:: bash

        salt 'v2' keystone.endpoint_get nova [region=RegionOne]

        salt 'v3' keystone.endpoint_get nova interface=admin [region=RegionOne]
    r9�$Could not find the specified servicer*cSsg|]}|r|�qSr
r
)�.0Z_fr
r
r�
<listcomp>cs
��z endpoint_get.<locals>.<listcomp>csHg|] }|d�kr �r|d�kr n	�r|d�kr n	|nd�qS)�
service_id�regionT�	interfaceNr
)rN�e�rRrQrPr
rrOes������zHMultiple endpoints found ({}) for the {} service. Please specify region.rz1Could not find endpoint for the specified service)r3�service_list�
endpoint_list�values�len�format)�servicerQr#rRr�services�	endpointsrSr
rTr�endpoint_getPs&���r^c�Dt|fi|��}i}|j��D]��fdd�t��D�|�j<q|S)z�
    Return a list of available endpoints (keystone endpoints-list)

    CLI Example:

    .. code-block:: bash

        salt '*' keystone.endpoint_list
    c�8i|]}|�d�stt�|�tttf�r|t�|��qS��_��
startswith�
isinstance�getattr�strr(�bool�rN�value�rr
r�
<dictcomp>����
�z!endpoint_list.<locals>.<dictcomp>)r3r]rI�dirr*�r#rrBrJr
rkrrW}s

�rWcKs�t|fi|��}	td	||d�|��}
|
rd|
vrddiStdkr/|	jj|
|d|||d�n|	jj||
|d|||d�t||||fi|��S)
aI
    Create an endpoint for an Openstack service

    CLI Examples:

    .. code-block:: bash

        salt 'v2' keystone.endpoint_create nova 'http://public/url' 'http://internal/url' 'http://adminurl/url' region

        salt 'v3' keystone.endpoint_create nova url='http://public/url' interface='public' region='RegionOne'
    r7r9rMrr*)r[Z	region_id�urlrR)rQrP�	publicurl�adminurl�internalurlNr
)r3�service_getr4r]rAr^)r[rqrsrrrQr#rprRrrBZkeystone_servicer
r
r�endpoint_create�s&
�
�rucKstt|fi|��}t||||fi|��}|rd|vrddiS|j�|d�t||||fi|��}|r6d|vr8dSdS)z�
    Delete endpoints of an Openstack service

    CLI Examples:

    .. code-block:: bash

        salt 'v2' keystone.endpoint_delete nova [region=RegionOne]

        salt 'v3' keystone.endpoint_delete nova interface=admin [region=RegionOne]
    r9z,Could not find any endpoints for the servicer*TN)r3r^r]rE)r[rQr#rRrrBrr
r
r�endpoint_delete�s�rvcKsXt|fi|��}dtd||d�|��vrdd|�d�iS|j�|�td||d�|��S)zw
    Create a named role.

    CLI Example:

    .. code-block:: bash

        salt '*' keystone.role_create admin
    r9r7zRole "z" already existsNr
)r3�role_get�rolesrA)r8r#rrBr
r
r�role_create�s
rycKs�t|fi|��}|r|j��D]}|j|kr|j}nq|s"ddiS|j�|�}|j�|�d|�d�}|r>|d|�d�7}|S)a#
    Delete a role (keystone role-delete)

    CLI Examples:

    .. code-block:: bash

        salt '*' keystone.role_delete c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.role_delete role_id=c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.role_delete name=admin
    r9�Unable to resolve role idzRole ID � deleted� (�))r3rxrIr8r*r
rE)�role_idr8r#rrB�rolerJr
r
r�role_delete�s
�r�cKslt|fi|��}i}|r|j��D]}|j|kr|j}nq|s$ddiS|j�|�}|j|jd�||j<|S)a 
    Return a specific roles (keystone role-get)

    CLI Examples:

    .. code-block:: bash

        salt '*' keystone.role_get c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.role_get role_id=c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.role_get name=nova
    r9rz)r*r8)r3rxrIr8r*r
)r~r8r#rrBrJrr
r
rrw
s
�rwcr_)z�
    Return a list of available roles (keystone role-list)

    CLI Example:

    .. code-block:: bash

        salt '*' keystone.role_list
    cr`rarcri�rr
rrl2rmzrole_list.<locals>.<dictcomp>)r3rxrIrnr8ror
r�r�	role_list%�

�r�cKs8t|fi|��}|jj|||d�}t|jfd|i|��S)z�
    Add service to Keystone service catalog

    CLI Examples:

    .. code-block:: bash

        salt '*' keystone.service_create nova compute 'OpenStack Compute Service'
    )�descriptionr#)r3r\rArtr*)r8Zservice_typer�r#rrBr[r
r
r�service_create;s
r�cKsHt|fi|��}|rtd||d�|��|d}|j�|�d|�d�S)z�
    Delete a service from Keystone service catalog

    CLI Examples:

    .. code-block:: bash

        salt '*' keystone.service_delete c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.service_delete name=nova
    r7r*zKeystone service ID "z	" deletedNr
)r3rtr\rE)rPr8r#rrBr
r
r�service_deleteMs�r�cstt|fi|��}i}|r|j��D]��j|kr�j}nq|s$ddiS|j�|���fdd�t��D�|�j<|S)a2
    Return a specific services (keystone service-get)

    CLI Examples:

    .. code-block:: bash

        salt '*' keystone.service_get c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.service_get service_id=c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.service_get name=nova
    r9zUnable to resolve service idcr`rarcri�r[r
rrlwrmzservice_get.<locals>.<dictcomp>)r3r\rIr8r*r
rn)rPr8r#rrBrJr
r�rrtas
�
�rtcr_)z�
    Return a list of available services (keystone services-list)

    CLI Example:

    .. code-block:: bash

        salt '*' keystone.service_list
    cr`rarcrir�r
rrl�rmz service_list.<locals>.<dictcomp>)r3r\rIrnr8ror
r�rrV�r�rVcKs<t|fi|��}t|td��|||�}t|jfd|i|��S)z�
    Create a keystone tenant

    CLI Examples:

    .. code-block:: bash

        salt '*' keystone.tenant_create nova description='nova tenant'
        salt '*' keystone.tenant_create test enabled=False
    Nr#�r3rfr5rAr?r*)r8r��enabledr#rrB�newr
r
r�
tenant_create�s
r�cKs@t|fi|��}t|td�j||||d�}t|jfd|i|��S)a�
    Create a keystone project.
    Overrides keystone tenant_create form api V2. For keystone api V3.

    .. versionadded:: 2016.11.0

    name
        The project name, which must be unique within the owning domain.

    domain
        The domain name.

    description
        The project description.

    enabled
        Enables or disables the project.

    profile
        Configuration profile - if configuration for multiple openstack accounts required.

    CLI Examples:

    .. code-block:: bash

        salt '*' keystone.project_create nova default description='Nova Compute Project'
        salt '*' keystone.project_create test default enabled=False
    N)r8�domainr�r�r#r�)r8r�r�r�r#rrBr�r
r
r�project_create�s
�r�cKs�t|fi|��}|rt|td���D]}|j|kr|j}nq|s%ddiSt|td��|�d|�d�}|r>|d|�d�7}|S)a.
    Delete a tenant (keystone tenant-delete)

    CLI Examples:

    .. code-block:: bash

        salt '*' keystone.tenant_delete c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.tenant_delete tenant_id=c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.tenant_delete name=demo
    Nr9�Unable to resolve tenant idz
Tenant ID r{r|r})r3rfr5rIr8r*rE)rr8r#rrBrrJr
r
r�
tenant_delete�s
�r�cK�2t|fi|��tdkrtd||dd�|��SdS)aV
    Delete a project (keystone project-delete).
    Overrides keystone tenant-delete form api V2. For keystone api V3 only.

    .. versionadded:: 2016.11.0

    project_id
        The project id.

    name
        The project name.

    profile
        Configuration profile - if configuration for multiple openstack accounts required.

    CLI Examples:

    .. code-block:: bash

        salt '*' keystone.project_delete c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.project_delete project_id=c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.project_delete name=demo
    rN�rr8r#Fr
)r3r4r���
project_idr8r#rr
r
r�project_delete�s��r�cs�t|fi|��}i}|r!t|td���D]��j|kr �j}nq|s'ddiSt|td��|���fdd�t��D�|�j<|S)a,
    Return a specific tenants (keystone tenant-get)

    CLI Examples:

    .. code-block:: bash

        salt '*' keystone.tenant_get c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.tenant_get tenant_id=c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.tenant_get name=nova
    Nr9r�cr`rarcri�rr
rrl#rmztenant_get.<locals>.<dictcomp>)r3rfr5rIr8r*r
rn)rr8r#rrBrJr
r�rr?s
�
�r?cKr�)aT
    Return a specific projects (keystone project-get)
    Overrides keystone tenant-get form api V2.
    For keystone api V3 only.

    .. versionadded:: 2016.11.0

    project_id
        The project id.

    name
        The project name.

    profile
        Configuration profile - if configuration for multiple openstack accounts required.

    CLI Examples:

    .. code-block:: bash

        salt '*' keystone.project_get c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.project_get project_id=c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.project_get name=nova
    rNr�Fr
)r3r4r?r�r
r
r�project_get,s��r�csJt|fi|��}i}t|td���D]��fdd�t��D�|�j<q|S)z�
    Return a list of available tenants (keystone tenants-list)

    CLI Example:

    .. code-block:: bash

        salt '*' keystone.tenant_list
    Ncr`rarcrir�r
rrl]rmztenant_list.<locals>.<dictcomp>)r3rfr5rIrnr8ror
r�r�tenant_listOs

�r�cKs,t|fi|��tdkrt|fi|��SdS)as
    Return a list of available projects (keystone projects-list).
    Overrides keystone tenants-list form api V2.
    For keystone api V3 only.

    .. versionadded:: 2016.11.0

    profile
        Configuration profile - if configuration for multiple openstack accounts required.

    CLI Example:

    .. code-block:: bash

        salt '*' keystone.project_list
    rF)r3r4r�)r#rr
r
r�project_listfsr�cs�t|fi|��}|st|td���D]}|j|kr|j}nq|s%ddiSt|td��|�}|s3|j}|s8|j}|dur?|j}t|td�j	||||d���fdd�t
��D�S)a�
    Update a tenant's information (keystone tenant-update)
    The following fields may be updated: name, description, enabled.
    Can only update name if targeting by ID

    CLI Examples:

    .. code-block:: bash

        salt '*' keystone.tenant_update name=admin enabled=True
        salt '*' keystone.tenant_update c965f79c4f864eaaa9c3b41904e67082 name=admin email=admin@domain.com
    Nr9r�)r8r�r�cr`rarcri��updatedr
rrl�rmz!tenant_update.<locals>.<dictcomp>)r3rfr5rIr8r*r
r�r��updatern)rr8r�r�r#rrBrr
r�r�
tenant_updates,
��
�r�cKs6t|fi|��tdkrtd|||||d�|��SdS)aJ
    Update a tenant's information (keystone project-update)
    The following fields may be updated: name, description, enabled.
    Can only update name if targeting by ID

    Overrides keystone tenant_update form api V2.
    For keystone api V3 only.

    .. versionadded:: 2016.11.0

    project_id
        The project id.

    name
        The project name, which must be unique within the owning domain.

    description
        The project description.

    enabled
        Enables or disables the project.

    profile
        Configuration profile - if configuration for multiple openstack accounts required.

    CLI Examples:

    .. code-block:: bash

        salt '*' keystone.project_update name=admin enabled=True
        salt '*' keystone.project_update c965f79c4f864eaaa9c3b41904e67082 name=admin email=admin@domain.com
    r)rr8r�r�r#FNr
)r3r4r�)r�r8r�r�r#rr
r
r�project_update�s(��	r�cKs8t|fi|��}|j��}|d|d|d|dd�S)z�
    Return the configured tokens (keystone token-get)

    CLI Example:

    .. code-block:: bash

        salt '*' keystone.token_get c965f79c4f864eaaa9c3b41904e67082
    r*�expiresr=r)r*r�r=r)r3Zservice_catalogZ	get_token)r#rrBrr
r
r�	token_get�s

�r�csbt|fi|��}i}|j��D]��fdd�t��D�|�j<t�dd�}|r.||�jd<q|S)z�
    Return a list of available users (keystone user-list)

    CLI Example:

    .. code-block:: bash

        salt '*' keystone.user_list
    c�<i|]}|�d�stt�|d�tttf�r|t�|d��qS�rbNrcri�rr
rrl����zuser_list.<locals>.<dictcomp>�tenantIdNr)r3rHrIrnr8rf)r#rrBrJrr
r�r�	user_list�s

��r�cs�t|fi|��}i}|r|j��D]��j|kr�j}nq|s$ddiSz|j�|��WntjjyFd|�d�}t	�
|�d|iYSw�fdd�t��D�|�j<t�dd�}|rd||�jd	<|S)
a 
    Return a specific users (keystone user-get)

    CLI Examples:

    .. code-block:: bash

        salt '*' keystone.user_get c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.user_get user_id=c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.user_get name=nova
    r9rGzCould not find user '�'cr�r�rcrir�r
rrl0r�zuser_get.<locals>.<dictcomp>r�Nr)
r3rHrIr8r*r
�keystoneclient�
exceptionsZNotFound�log�errorrnrf)r=r8r#rrBrJ�msgrr
r�rr>s0
�
�
�r>cKsjt|fi|��}	tdkr|r|s|}|	jj||||||d�}
n|	jj|||||d�}
t|
jfd|i|��S)z�
    Create a user (keystone user-create)

    CLI Examples:

    .. code-block:: bash

        salt '*' keystone.user_create name=jack password=zero email=jack@halloweentown.org         tenant_id=a28a7b5a999a455f84b1f5210264375e enabled=True
    r)r8r�emailr�r�r�)r8rr�rr�r#)r3r4rHrAr>r*)r8rr�rr�r#r�r�rrB�itemr
r
r�user_create=s(�	�r�cKstt|fi|��}|r|j��D]}|j|kr|j}nq|s"ddiS|j�|�d|�d�}|r8|d|�d�7}|S)a"
    Delete a user (keystone user-delete)

    CLI Examples:

    .. code-block:: bash

        salt '*' keystone.user_delete c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.user_delete user_id=c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.user_delete name=nova
    r9rGzUser ID r{r|r})r3rHrIr8r*rE)r=r8r#rrBrrJr
r
r�user_deletejs
�r�cKsNt|fi|��}	|s"|	j��D]}
|
j|kr|
j}nq|s"ddiS|	j�|�}
|s-|
j}|s2|
j}|dur9|
j}tdkrw|durHt	|
dd�}nt
|�}d}|rb|	j��D]}|j|kra|j}nqU|sjt	|
dd�}|	jj||||||d�n)|	jj||||d�d}
|r�|	j
��D]}|j|kr�|j}
nq�|
r�|	j�||
�d	|��}|S)
a�
    Update a user's information (keystone user-update)
    The following fields may be updated: name, email, enabled, tenant.
    Because the name is one of the fields, a valid user id is required.

    CLI Examples:

    .. code-block:: bash

        salt '*' keystone.user_update user_id=c965f79c4f864eaaa9c3b41904e67082 name=newname
        salt '*' keystone.user_update c965f79c4f864eaaa9c3b41904e67082 name=newname email=newemail@domain.com
    r9rGNrr�r�)rr8r�r�r�r�)rr8r�r�zInfo updated for user ID )r3rHrIr8r*r
r�r�r4rfrgr2r�rZ
update_tenant)r=r8r�r�rr#�projectr�rrBrr�ZprojrZtntrJr
r
r�user_update�sb
�
��	
�
r�c		Ks�t|fi|��}d|vr|�d�}ntdkrtddd�}ntddd�}|r9|j��D]}|j|kr8|j}nq,|s?ddiS|||d	�}ztdkrUtj	d
i|��WdSt
j	d
i|��WdStjj
tjjfyoYd
Sw)a
    Verify a user's password

    CLI Examples:

    .. code-block:: bash

        salt '*' keystone.user_verify_password name=test password=foobar
        salt '*' keystone.user_verify_password user_id=c965f79c4f864eaaa9c3b41904e67082 password=foobar
    Zconnection_endpointrz
config.optionzkeystone.endpointzhttp://127.0.0.1:35357/v3rr9zUnable to resolve user name)r rrFTNr
)r3r
r4rrHrIr*r8�client3ZClientrr�r��UnauthorizedZAuthorizationFailure)	r=r8rr#rrBrrr$r
r
r�user_verify_password�s>
��
���
��r�cKs�t|fi|��}|r|j��D]}|j|kr|j}nq|s"ddiStdkr/|jj||d�n|jj||d�d|��}|rF|d|�d�7}|S)a~
    Update a user's password (keystone user-password-update)

    CLI Examples:

    .. code-block:: bash

        salt '*' keystone.user_password_update c965f79c4f864eaaa9c3b41904e67082 password=12345
        salt '*' keystone.user_password_update user_id=c965f79c4f864eaaa9c3b41904e67082 password=12345
        salt '*' keystone.user_password_update name=nova password=12345
    r9rGr)rrzPassword updated for user ID r|r})r3rHrIr8r*r4r�Zupdate_password)r=r8rr#rrBrrJr
r
r�user_password_updates 
�
r�c	Ksbt|fi|	��}
|r|s|}n|r|s|}|r'td
||d�|	��|�d�}nttt|fd|i|	������d}|s?ddiS|rQtd
||d�|	��|�d�}nttt|fd|i|	������d}|siddiS|rztd
||d�|	��|d}nttt|fd|i|	������d}|s�ddiStd	kr�|
j	j
|||d
�n|
j	�|||�d}|�|||�S)a\
    Add role for user in tenant (keystone user-role-add)

    CLI Examples:

    .. code-block:: bash

        salt '*' keystone.user_role_add user_id=298ce377245c4ec9b70e1c639c89e654 tenant_id=7167a092ece84bae8cead4bf9d15bb3b role_id=ce377245c4ec9b70e1c639c89e8cead4
        salt '*' keystone.user_role_add user=admin tenant=admin role=admin
    r7r*r#r8r9rG�#Unable to resolve tenant/project idrzr�rr�z8"{0}" role added for user "{1}" for "{2}" tenant/projectNr
)
r3r>r
�next�iter�keysr?rwr4rxZgrantZ
add_user_rolerZ�r=rrrr~rr#r��project_namerrBZret_msgr
r
r�
user_role_add%sN�������r�c	KsVt|fi|	��}
|r|s|}n|r|s|}|r'td
||d�|	��|�d�}nttt|fd|i|	������d}|s?ddiS|rQtd
||d�|	��|�d�}nttt|fd|i|	������d}|siddiS|rztd
||d�|	��|d}nttt|�����d}|s�ddiStd	kr�|
j	j
|||d
�n|
j	�|||�d}|�|||�S)ah
    Remove role for user in tenant (keystone user-role-remove)

    CLI Examples:

    .. code-block:: bash

        salt '*' keystone.user_role_remove user_id=298ce377245c4ec9b70e1c639c89e654 tenant_id=7167a092ece84bae8cead4bf9d15bb3b role_id=ce377245c4ec9b70e1c639c89e8cead4
        salt '*' keystone.user_role_remove user=admin tenant=admin role=admin
    r7r*r#r8r9rGr�rzrr�z4"{0}" role removed for user "{1}" under "{2}" tenantNr
)
r3r>r
r�r�r�r?rwr4rxZrevokeZremove_user_rolerZr�r
r
r�user_role_removelsJ������r�cst|fi|��}i}	|r|s|}n|r|s|}|r+|j��D]}
|
j|kr*|
j}nq|rBt|td���D]}|j|krA|j}nq5|rF|sJddiStdkri|jj||d�D]��fdd�t	��D�|	�j<qV|	S|jj
||d�D]��j�j||d	�|	�j<qq|	S)
a@
    Return a list of available user_roles (keystone user-roles-list)

    CLI Examples:

    .. code-block:: bash

        salt '*' keystone.user_role_list user_id=298ce377245c4ec9b70e1c639c89e654 tenant_id=7167a092ece84bae8cead4bf9d15bb3b
        salt '*' keystone.user_role_list user_name=admin tenant_name=admin
    Nr9z+Unable to resolve user or tenant/project idrr�cr`rarcrir�r
rrl�rmz"user_role_list.<locals>.<dictcomp>)rr)r*r8r=r)r3rHrIr8r*rfr5r4rxrnZroles_for_user)r=rZ	user_namer!r#r�r�rrBrJrrr
r�r�user_role_list�sB
�
�
���r�cKs4t|fi|��}g}|j��D]}|�|j�q|S)z�
    Template for writing list functions
    Return a list of available items (keystone items-list)

    CLI Example:

    .. code-block:: bash

        salt '*' keystone.item_list
    )r3�itemsrI�append�__dict__)r#rrBrJr�r
r
r�
_item_list�s
r�r")NNNNN)NNNN)NNN)NNNNNNN)NN)NTN)NTNNN)NNNNNNNN)	NNNNNNNNN)@�__doc__�loggingZsalt.utils.httpr+r	Zkeystoneclient.exceptionsr�Zkeystoneclient.v2_0rZ
keystoneauth1rZkeystoneauth1.identityrrZkeystoneclient.v3r��ImportErrorr4r5�	getLogger�__name__r�rr%r0r3rCrFrKrLr^rWrurvryr�rwr�r�r�rtrVr�r�r�r�r?r�r�r�r�r�r�r�r>r�r�r�r�r�r�r�r�r�r
r
r
r�<module>s5�


0
%
�-
�
�
%

-
�.
�




�



�
�
&

"
 
#

�2
�
7

-
�
-
�P
�0
�"
�H
�F
�>
@ Telegram