# keystone.assignment.backends.base module

class keystone.assignment.backends.base.AssignmentDriverBase

  Bases: `object`

  abstractmethod add_role_to_user_and_project(user_id, project_id, role_id)

    Add a role to a user within given project.

    Raises:

      keystone.exception.Conflict – If a duplicate role assignment exists.

  abstractmethod check_grant_role_id(role_id, user_id=None, group_id=None, domain_id=None, project_id=None, inherited_to_projects=False)

    Check an assignment/grant role id.

    Raises:

      keystone.exception.RoleAssignmentNotFound – If the role assignment doesn’t exist.

    Returns:

      None or raises an exception if grant not found

  abstractmethod check_system_grant(role_id, actor_id, target_id, inherited)

    Check if a user or group has a specific role on the system.

    Parameters:

      - role_id – the unique ID of the role to grant to the user

      - actor_id – the unique ID of the user or group

      - target_id – the unique ID or string representing the target

      - inherited – a boolean denoting if the assignment is inherited or not

  abstractmethod create_grant(role_id, user_id=None, group_id=None, domain_id=None, project_id=None, inherited_to_projects=False)

    Create a new assignment/grant.

    If the assignment is to a domain, then optionally it may be specified as inherited to owned projects (this requires the OS-INHERIT extension to be enabled).

  abstractmethod create_system_grant(role_id, actor_id, target_id, assignment_type, inherited)

    Grant a user or group a role on the system.

    Parameters:

      - role_id – the unique ID of the role to grant to the user

      - actor_id – the unique ID of the user or group

      - target_id – the unique ID or string representing the target

      - assignment_type – a string describing the relationship of the assignment

      - inherited – a boolean denoting if the assignment is inherited or not

  abstractmethod delete_domain_assignments(domain_id)

    Delete all assignments for a domain.

  abstractmethod delete_grant(role_id, user_id=None, group_id=None, domain_id=None, project_id=None, inherited_to_projects=False)

    Delete assignments/grants.

    Raises:

      keystone.exception.RoleAssignmentNotFound – If the role assignment doesn’t exist.

  abstractmethod delete_group_assignments(group_id)

    Delete all assignments for a group.

    Raises:

      keystone.exception.RoleNotFound – If the role doesn’t exist.

  abstractmethod delete_project_assignments(project_id)

    Delete all assignments for a project.

    Raises:

      keystone.exception.ProjectNotFound – If the project doesn’t exist.

  abstractmethod delete_role_assignments(role_id)

    Delete all assignments for a role.

  abstractmethod delete_system_grant(role_id, actor_id, target_id, inherited)

    Remove a system assignment from a user or group.

    Parameters:

      - role_id – the unique ID of the role to grant to the user

      - actor_id – the unique ID of the user or group

      - target_id – the unique ID or string representing the target

      - inherited – a boolean denoting if the assignment is inherited or not

  abstractmethod delete_user_assignments(user_id)

    Delete all assignments for a user.

    Raises:

      keystone.exception.RoleNotFound – If the role doesn’t exist.

  abstractmethod list_grant_role_ids(user_id=None, group_id=None, domain_id=None, project_id=None, inherited_to_projects=False)

    List role ids for assignments/grants.

  abstractmethod list_role_assignments(role_id=None, user_id=None, group_ids=None, domain_id=None, project_ids=None, inherited_to_projects=None)

    Return a list of role assignments for actors on targets.

    Available parameters represent values in which the returned role assignments attributes need to be filtered on.

  abstractmethod list_system_grants(actor_id, target_id, assignment_type)

    Return a list of all system assignments for a specific entity.

    Parameters:

      - actor_id – the unique ID of the actor

      - target_id – the unique ID of the target

      - assignment_type – the type of assignment to return

  abstractmethod list_system_grants_by_role(role_id)

    Return a list of system assignments associated to a role.

    Parameters:

      role_id – the unique ID of the role to grant to the user

this page last updated: 2026-08-17 12:45:24

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.

found an error? report a bug