# keystone.identity.shadow_backends.sql module

class keystone.identity.shadow_backends.sql.ShadowUsers

  Bases: `ShadowUsersDriverBase`

  add_user_to_group_expires(user_id, group_id)
  cleanup_stale_group_memberships(user_id, idp_id, current_group_ids)

    Remove expiring group memberships that are no longer in the IdP assertion.

  create_federated_object(fed_dict)

    Create a new federated object.

    Parameters:

      federated_dict (dict) – Reference to the federated user

  create_federated_user(domain_id, federated_dict, email=None)

    Create a new user with the federated identity.

    Parameters:

      - domain_id – The domain ID of the IdP used for the federated user

      - federated_dict (dict) – Reference to the federated user

      - email – Federated user’s email

    Returns dict:

      Containing the user reference

  create_nonlocal_user(user_dict)

    Create a new non-local user.

    Parameters:

      user_dict (dict) – Reference to the non-local user

    Returns dict:

      Containing the user reference

  delete_federated_object(user_id)

    Delete a user’s federated objects.

    Parameters:

      user_id – Unique identifier of the user

  delete_user(user_id)
  get_federated_objects(user_id)

    Get all federated objects for a user.

    Parameters:

      user_id – Unique identifier of the user

    Returns list:

      Containing the user’s federated objects

  get_federated_user(idp_id, protocol_id, unique_id)

    Return the found user for the federated identity.

    Parameters:

      - idp_id – The identity provider ID

      - protocol_id – The federation protocol ID

      - unique_id – The unique ID for the user

    Returns dict:

      Containing the user reference

  get_federated_users(hints)
  get_user(user_id)

    Return the found user.

    Parameters:

      user_id – Unique identifier of the user

    Returns dict:

      Containing the user reference

  list_federated_users_info(hints=None)

    Get the shadow users info with the specified filters.

    Parameters:

      hints – contains the list of filters yet to be satisfied. Any filters satisfied here will be removed so that the caller will know if any filters remain.

    Returns list:

      A list of objects that containing the shadow users reference.

  set_last_active_at(user_id)

    Set the last active at date for the user.

    Parameters:

      user_id – Unique identifier of the user

  update_federated_user_display_name(idp_id, protocol_id, unique_id, display_name)

    Update federated user’s display name if changed.

    Parameters:

      - idp_id – The identity provider ID

      - protocol_id – The federation protocol ID

      - unique_id – The unique ID for the user

      - display_name – The user’s display name

this page last updated: 2026-04-01 20:09:17

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.

found an error? report a bug