# keystone.auth.core module

class keystone.auth.core.AuthContext

  Bases: `dict`

  Retrofitting auth_context to reconcile identity attributes.

  The identity attributes must not have conflicting values among the auth plug-ins. The only exception is expires_at, which is set to its earliest value.

  IDENTITY_ATTRIBUTES = frozenset({'access_token_id', 'domain_id', 'expires_at', 'project_id', 'user_id'})
  update(E=None, **F)

    Override update to prevent conflicting values.

class keystone.auth.core.AuthInfo(auth=None)

  Bases: `ProviderAPIMixin`

  Encapsulation of “auth” request.

  static create(auth=None, scope_only=False)
  get_method_data(method)

    Get the auth method payload.

    Returns:

      auth method payload

  get_method_names()

    Return the identity method names.

    Returns:

      list of auth method names

  get_scope()

    Get scope information.

    Verify and return the scoping information.

    Returns:

      (domain_id, project_id, trust_ref, unscoped, system). If scope to a project, (None, project_id, None, None, None) will be returned. If scoped to a domain, (domain_id, None, None, None, None) will be returned. If scoped to a trust, (None, project_id, trust_ref, None, None), Will be returned, where the project_id comes from the trust definition. If unscoped, (None, None, None, ‘unscoped’, None) will be returned. If system_scoped, (None, None, None, None, ‘all’) will be returned.

  set_scope(domain_id=None, project_id=None, trust=None, unscoped=None, system=None)

    Set scope information.

class keystone.auth.core.UserMFARulesValidator

  Bases: `ProviderAPIMixin`

  Helper object that can validate the MFA Rules.

  classmethod check_auth_methods_against_rules(user_id, auth_methods)

    Validate the MFA rules against the successful auth methods.

    Parameters:

      - user_id (str) – The user’s ID (uuid).

      - auth_methods (set) – List of methods that were used for auth

    Returns:

      Boolean, `True` means rules match and auth may proceed, `False` means rules do not match.

keystone.auth.core.get_auth_method(method_name)

keystone.auth.core.load_auth_method(method)

keystone.auth.core.load_auth_methods()

this page last updated: 2026-04-01 20:09:17

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.

found an error? report a bug