# keystone.federation.utils module

Utilities for Federation Extension.

class keystone.federation.utils.DirectMaps

  Bases: `object`

  An abstraction around the remote matches.

  Each match is treated internally as a list.

  add(values)

    Add a matched value to the list of matches.

    Parameters:

      value (list) – the match to save

class keystone.federation.utils.RuleProcessor(mapping_id, rules)

  Bases: `object`

  A class to process assertions and mapping rules.

  extract_groups(groups_by_domain)
  extract_projects(identity_value)
  normalize_user(user, default_mapping_domain)

    Parse and validate user mapping.

  process(assertion_data)

    Transform assertion to a dictionary.

    The dictionary contains mapping of user name and group ids based on mapping rules.

    This function will iterate through the mapping rules to find assertions that are valid.

    Parameters:

      assertion_data (dict) – an assertion containing values from an IdP

    Example assertion_data:

        {
            'Email': 'testacct@example.com',
            'UserName': 'testacct',
            'FirstName': 'Test',
            'LastName': 'Account',
            'orgPersonType': 'Tester',
        }

    Returns:

      dictionary with user and group_ids

    The expected return structure is:

        {
            'name': 'foobar',
            'group_ids': ['abc123', 'def456'],
            'group_names': [
                {'name': 'group_name_1', 'domain': {'name': 'domain1'}},
                {'name': 'group_name_1_1', 'domain': {'name': 'domain1'}},
                {'name': 'group_name_2', 'domain': {'id': 'xyz132'}},
            ],
        }

  process_group_by_name(group, groups_by_domain)
  process_rule_mapping(direct_maps, key, rule)

class keystone.federation.utils.RuleProcessorForProjectJsonAttribute(mapping_id, rules)

  Bases: `RuleProcessorToHonorDomainOption`

  Handles the ‘project_json’ property in the attribute mapping

  This rule processor is designed to handle the project_json attribute configured at the root of the attribute mapping. When this attribute is configured, we load it (the JSON that it contains), and append to the possible set of hard-coded projects that we find at projects property.

  PATTERN_PROJECT_JSON_INDEX = '\\{?(\\d+)\\}?'
  extract_projects(identity_value)
  process_rule_mapping(direct_maps, key, rule)
  static validate_projects_json(projects_json)

class keystone.federation.utils.RuleProcessorToHonorDomainOption(mapping_id, rules)

  Bases: `RuleProcessor`

  Handles the default domain configured in the attribute mapping.

  This rule processor is designed to handle the domain attribute configured at the root of the attribute mapping. When this attribute is configured, we should take it as the default one for the attribute mapping, instead of the domain of the IdP. Moreover, we should respect the override to it that can take place at the groups, user, and projects attributes definition.

  extract_projects(identity_value)
  normalize_projects(identity_value, projects)
  normalize_user(user, default_mapping_domain)

    Parse and validate user mapping.

class keystone.federation.utils.UserType

  Bases: `object`

  User mapping type.

  EPHEMERAL = 'ephemeral'
  LOCAL = 'local'

keystone.federation.utils.assert_enabled_identity_provider(federation_api, idp_id)

keystone.federation.utils.assert_enabled_service_provider_object(service_provider)

keystone.federation.utils.create_attribute_mapping_rules_processor(mapping)

keystone.federation.utils.get_assertion_params_from_env()

keystone.federation.utils.get_default_attribute_mapping_schema_version()

keystone.federation.utils.get_remote_id_parameter(idp, protocol)

keystone.federation.utils.transform_to_group_ids(group_names, mapping_id, identity_api, resource_api)

  Transform groups identified by name/domain to their ids.

  Function accepts list of groups identified by a name and domain giving a list of group ids in return. A message is logged if the group doesn’t exist in the backend.

  Example of group_names parameter:

      [
          {"name": "group_name", "domain": {"id": "domain_id"}},
          {"name": "group_name_2", "domain": {"name": "domain_name"}},
      ]

  Parameters:

    - group_names (list) – list of group identified by name and its domain.

    - mapping_id (str) – id of the mapping used for mapping assertion into local credentials

    - identity_api – identity_api object

    - resource_api – resource manager object

  Returns:

    generator object with group ids

keystone.federation.utils.validate_expiration(token)

keystone.federation.utils.validate_idp(idp, protocol, assertion)

  The IdP providing the assertion should be registered for the mapping.

keystone.federation.utils.validate_mapped_group_ids(group_ids, mapping_id, identity_api)

  Iterate over group ids and make sure they are present in the backend.

  This call is not transactional. :param group_ids: IDs of the groups to be checked :type group_ids: list of str

  Parameters:

    - mapping_id (str) – id of the mapping used for this operation

    - identity_api (identity.Manager) – Identity Manager object used for communication with backend

  Raises:

    keystone.exception.MappedGroupNotFound – If the group returned by mapping was not found in the backend.

keystone.federation.utils.validate_mapping_structure(ref)

this page last updated: 2026-06-11 21:52:50

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.

found an error? report a bug