# keystone.auth.plugins.mapped module

class keystone.auth.plugins.mapped.Mapped

  Bases: `AuthMethodHandler`

  authenticate(auth_payload)

    Authenticate mapped user and set an authentication context.

    Parameters:

      auth_payload – the content of the authentication for a given method

    In addition to `user_id` in `response_data`, this plugin sets `group_ids`, `OS-FEDERATION:identity_provider` and `OS-FEDERATION:protocol`

keystone.auth.plugins.mapped.apply_mapping_filter(identity_provider, protocol, assertion, resource_api, federation_api, identity_api)

keystone.auth.plugins.mapped.configure_federated_projects(shadow_projects, idp_domain_id, existing_roles, user, assignment_api, resource_api, schema_version)

keystone.auth.plugins.mapped.configure_project_domain(shadow_project, idp_domain_id, resource_api)

  Configure federated projects domain.

  We set the domain to be the default (idp_domain_id) if the project from the attribute mapping comes without a domain.

keystone.auth.plugins.mapped.create_new_grants(all_roles, project, user, assignment_api)

keystone.auth.plugins.mapped.create_or_show_project(shadow_project, user, resource_api)

keystone.auth.plugins.mapped.extract_assertion_data()

keystone.auth.plugins.mapped.handle_projects_from_mapping(shadow_projects, existing_roles, user, schema_version, assignment_api, resource_api)

keystone.auth.plugins.mapped.handle_scoped_token(token, federation_api, identity_api)

keystone.auth.plugins.mapped.handle_unscoped_token(auth_payload, resource_api, federation_api, identity_api, assignment_api, role_api)

keystone.auth.plugins.mapped.remove_left_over_project_assignments(all_projects_ids_processed, project_assignments_for_user, shadow_projects, user, assignment_api)

keystone.auth.plugins.mapped.retrieve_all_project_assignments(user, assignment_api)

keystone.auth.plugins.mapped.should_sync_project_assignment_with_idp(schema_version)

keystone.auth.plugins.mapped.update_assignments(idp_user_project_shadow_role_ids, project, user, schema_version, current_user_assignments, assignment_api)

keystone.auth.plugins.mapped.validate_and_prepare_federated_user(mapped_properties, idp_domain_id, resource_api)

  Setup federated username.

  Function covers all the cases for properly setting user id, a primary identifier for identity objects. Initial version of the mapping engine assumed user is identified by `name` and his `id` is built from the name. We, however need to be able to accept local rules that identify user by either id or name/domain.

  The following use-cases are covered:

  1. If neither user_name nor user_id is set raise exception.Unauthorized

  2. If user_id is set and user_name not, set user_name equal to user_id

  3. If user_id is not set and user_name is, set user_id as url safe version of user_name.

  Furthermore, we set the IdP as the user domain, if the user definition does not come with a domain definition.

  Parameters:

    - mapped_properties – Properties issued by a RuleProcessor.

    - idp_domain_id – The domain ID of the IdP registered in OpenStack.

    - resource_api – The resource API used to access the database layer.

  Type:

    dictionary

  Type:

    string

  Type:

    object

  Raises:

    keystone.exception.Unauthorized – If neither user_name nor user_id is set.

  Returns:

    tuple with user identification

  Return type:

    tuple

this page last updated: 2026-06-11 21:52:50

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.

found an error? report a bug