# keystone.cmd.cli module

class keystone.cmd.cli.BaseApp

  Bases: `object`

  classmethod add_argument_parser(subparsers)
  name: str

class keystone.cmd.cli.BasePermissionsSetup

  Bases: `BaseApp`

  Common user/group setup for file permissions.

  classmethod add_argument_parser(subparsers)
  static get_user_group()
  classmethod initialize_fernet_repository(keystone_user_id, keystone_group_id, config_group=None)
  classmethod rotate_fernet_repository(keystone_user_id, keystone_group_id, config_group=None)

class keystone.cmd.cli.BootStrap

  Bases: `BaseApp`

  Perform the basic bootstrap process.

  classmethod add_argument_parser(subparsers)
  do_bootstrap()

    Perform the bootstrap actions.

    Create bootstrap user, project, and role so that CMS, humans, or scripts can continue to perform initial setup (domains, projects, services, endpoints, etc) of Keystone when standing up a new deployment.

  classmethod main()
  name: str = 'bootstrap'

class keystone.cmd.cli.CreateJWSKeyPair

  Bases: `BasePermissionsSetup`

  Create a key pair for signing and validating JWS tokens.

  This command creates a public and private key pair to use for signing and validating JWS token signatures. The key pair is written to the directory where the command is invoked.

  classmethod add_argument_parser(subparsers)
  classmethod main()
  name: str = 'create_jws_keypair'

class keystone.cmd.cli.CredentialMigrate

  Bases: `BasePermissionsSetup`

  Provides the ability to encrypt credentials using a new primary key.

  This assumes that there is already a credential key repository in place and that the database backend has been upgraded to at least the Newton schema. If the credential repository doesn’t exist yet, you can use `keystone-manage credential_setup` to create one.

  classmethod main()
  migrate_credentials()
  name: str = 'credential_migrate'

class keystone.cmd.cli.CredentialRotate

  Bases: `BasePermissionsSetup`

  Rotate Fernet encryption keys for credential encryption.

  This assumes you have already run keystone-manage credential_setup.

  A new primary key is placed into rotation only if all credentials are encrypted with the current primary key. If any credentials are encrypted with a secondary key the rotation will abort. This protects against removing a key that is still required to decrypt credentials. Once a key is removed from the repository, it is impossible to recover the original data without restoring from a backup external to keystone (more on backups below). To make sure all credentials are encrypted with the latest primary key, please see the keystone-manage credential_migrate command. Since the maximum number of keys in the credential repository is 3, once all credentials are encrypted with the latest primary key we can safely introduce a new primary key. All credentials will still be decryptable since they are all encrypted with the only secondary key in the repository.

  It is imperitive to understand the importance of backing up keys used to encrypt credentials. In the event keys are overrotated, applying a key repository from backup can help recover otherwise useless credentials. Persisting snapshots of the key repository in secure and encrypted source control, or a dedicated key management system are good examples of encryption key backups.

  The keystone-manage credential_rotate and keystone-manage credential_migrate commands are intended to be done in sequence. After performing a rotation, a migration must be done before performing another rotation. This ensures we don’t over-rotate encryption keys.

  classmethod main()
  name: str = 'credential_rotate'
  validate_primary_key()

class keystone.cmd.cli.CredentialSetup

  Bases: `BasePermissionsSetup`

  Setup a Fernet key repository for credential encryption.

  The purpose of this command is very similar to keystone-manage fernet_setup only the keys included in this repository are for encrypting and decrypting credential secrets instead of token payloads. Keys can be rotated using keystone-manage credential_rotate.

  classmethod main()
  name: str = 'credential_setup'

class keystone.cmd.cli.DbSync

  Bases: `BaseApp`

  Sync the database.

  classmethod add_argument_parser(subparsers)
  classmethod check_db_sync_status()
  static main()
  name: str = 'db_sync'

class keystone.cmd.cli.DbVersion

  Bases: `BaseApp`

  Print the current migration version of the database.

  static main()
  name: str = 'db_version'

class keystone.cmd.cli.Doctor

  Bases: `BaseApp`

  Diagnose common problems with keystone deployments.

  classmethod add_argument_parser(subparsers)
  static main()
  name: str = 'doctor'

class keystone.cmd.cli.DomainConfigUpload

  Bases: `BaseApp`

  Upload the domain specific configuration files to the database.

  classmethod add_argument_parser(subparsers)
  static main()
  name: str = 'domain_config_upload'

class keystone.cmd.cli.DomainConfigUploadFiles(domain_config_finder=<function _domain_config_finder>)

  Bases: `object`

  load_backends()
  read_domain_configs_from_files()

    Read configs from file(s) and load into database.

    The command line parameters have already been parsed and the CONF command option will have been set. It is either set to the name of an explicit domain, or it’s None to indicate that we want all domain config files.

  run()
  valid_options()

    Validate the options, returning True if they are indeed valid.

    It would be nice to use the argparse automated checking for this validation, but the only way I can see doing that is to make the default (i.e. if no optional parameters are specified) to upload all configuration files - and that sounds too dangerous as a default. So we use it in a slightly unconventional way, where all parameters are optional, but you must specify at least one.

class keystone.cmd.cli.FernetRotate

  Bases: `BasePermissionsSetup`

  Rotate Fernet encryption keys.

  This assumes you have already run keystone-manage fernet_setup.

  A new primary key is placed into rotation, which is used for new tokens. The old primary key is demoted to secondary, which can then still be used for validating tokens. Excess secondary keys (beyond [fernet_tokens] max_active_keys) are revoked. Revoked keys are permanently deleted. A new staged key will be created and used to validate tokens. The next time key rotation takes place, the staged key will be put into rotation as the primary key.

  Rotating keys too frequently, or with [fernet_tokens] max_active_keys set too low, will cause tokens to become invalid prior to their expiration.

  classmethod main()
  name: str = 'fernet_rotate'

class keystone.cmd.cli.FernetSetup

  Bases: `BasePermissionsSetup`

  Setup key repositories for Fernet tokens and auth receipts.

  This also creates a primary key used for both creating and validating Fernet tokens and auth receipts. To improve security, you should rotate your keys (using keystone-manage fernet_rotate, for example).

  classmethod main()
  name: str = 'fernet_setup'

class keystone.cmd.cli.MappingEngineTester

  Bases: `BaseApp`

  Execute mapping engine locally.

  classmethod add_argument_parser(subparsers)
  classmethod main()
  name: str = 'mapping_engine'
  normalize_assertion()
  normalize_rules()
  read_assertion(path)
  read_rules(path)

class keystone.cmd.cli.MappingPopulate

  Bases: `BaseApp`

  Pre-populate entries from domain-specific backends.

  Running this command is not required. It should only be run right after the LDAP was configured, when many new users were added, or when “mapping_purge” is run.

  This command will take a while to run. It is perfectly fine for it to run more than several minutes.

  classmethod add_argument_parser(subparsers)
  classmethod load_backends()
  classmethod main()

    Process entries for id_mapping_api.

  name: str = 'mapping_populate'

class keystone.cmd.cli.MappingPurge

  Bases: `BaseApp`

  Purge the mapping table.

  classmethod add_argument_parser(subparsers)
  static main()
  name: str = 'mapping_purge'

class keystone.cmd.cli.ProjectSetup

  Bases: `BaseApp`

  Create project with specified UUID.

  classmethod add_argument_parser(subparsers)
  do_project_setup()

    Create project with specified UUID.

  classmethod main()
  name: str = 'project_setup'

class keystone.cmd.cli.ReceiptRotate

  Bases: `BasePermissionsSetup`

  Rotate auth receipts encryption keys.

  This assumes you have already run keystone-manage receipt_setup.

  A new primary key is placed into rotation, which is used for new receipts. The old primary key is demoted to secondary, which can then still be used for validating receipts. Excess secondary keys (beyond [receipt] max_active_keys) are revoked. Revoked keys are permanently deleted. A new staged key will be created and used to validate receipts. The next time key rotation takes place, the staged key will be put into rotation as the primary key.

  Rotating keys too frequently, or with [receipt] max_active_keys set too low, will cause receipts to become invalid prior to their expiration.

  classmethod main()
  name: str = 'receipt_rotate'

class keystone.cmd.cli.ReceiptSetup

  Bases: `BasePermissionsSetup`

  Setup a key repository for auth receipts.

  This also creates a primary key used for both creating and validating receipts. To improve security, you should rotate your keys (using keystone-manage receipt_rotate, for example).

  classmethod main()
  name: str = 'receipt_setup'

class keystone.cmd.cli.ResetLastActive

  Bases: `BaseApp`

  Reset null values for all users to current time.

  classmethod add_argument_parser(subparsers)
  static main()
  name: str = 'reset_last_active'

class keystone.cmd.cli.SamlIdentityProviderMetadata

  Bases: `BaseApp`

  Generate Identity Provider metadata.

  static main()
  name: str = 'saml_idp_metadata'

class keystone.cmd.cli.TokenRotate

  Bases: `BasePermissionsSetup`

  Rotate token encryption keys.

  This assumes you have already run keystone-manage token_setup.

  A new primary key is placed into rotation, which is used for new tokens. The old primary key is demoted to secondary, which can then still be used for validating tokens. Excess secondary keys (beyond [token] max_active_keys) are revoked. Revoked keys are permanently deleted. A new staged key will be created and used to validate tokens. The next time key rotation takes place, the staged key will be put into rotation as the primary key.

  Rotating keys too frequently, or with [token] max_active_keys set too low, will cause tokens to become invalid prior to their expiration.

  classmethod main()
  name: str = 'token_rotate'

class keystone.cmd.cli.TokenSetup

  Bases: `BasePermissionsSetup`

  Setup a key repository for tokens.

  This also creates a primary key used for both creating and validating tokens. To improve security, you should rotate your keys (using keystone-manage token_rotate, for example).

  classmethod main()
  name: str = 'token_setup'

class keystone.cmd.cli.TrustFlush

  Bases: `BaseApp`

  Flush expired and non-expired soft deleted trusts from the backend.

  classmethod add_argument_parser(subparsers)
  classmethod main()
  name: str = 'trust_flush'

class keystone.cmd.cli.UserSetup

  Bases: `BaseApp`

  Create user with specified UUID.

  classmethod add_argument_parser(subparsers)
  do_user_setup()

    Create user with specified UUID.

  classmethod main()
  name: str = 'user_setup'

keystone.cmd.cli.add_command_parsers(subparsers)

keystone.cmd.cli.main(argv=None, developer_config_file=None)

  Main entry point into the keystone-manage CLI utility.

  Parameters:

    - argv (list) – Arguments supplied via the command line using the `sys` standard library.

    - developer_config_file (string) – The location of a configuration file normally found in development environments.

this page last updated: 2026-08-17 12:45:24

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.

found an error? report a bug