# keystoneauth1.identity package

## Subpackages

- keystoneauth1.identity.generic package
  - Submodules
    - keystoneauth1.identity.generic.base module
      - `BaseGenericPlugin`
    - keystoneauth1.identity.generic.password module
      - `Password`
    - keystoneauth1.identity.generic.token module
      - `Token`
  - Module contents
    - `BaseGenericPlugin`
      - `BaseGenericPlugin.__abstractmethods__`
      - `BaseGenericPlugin.__annotate_func__()`
      - `BaseGenericPlugin.__annotations_cache__`
      - `BaseGenericPlugin.__doc__`
      - `BaseGenericPlugin.__firstlineno__`
      - `BaseGenericPlugin.__init__()`
      - `BaseGenericPlugin.__module__`
      - `BaseGenericPlugin.__static_attributes__`
      - `BaseGenericPlugin._abc_impl`
      - `BaseGenericPlugin._do_create_plugin()`
      - `BaseGenericPlugin._has_domain_scope`
      - `BaseGenericPlugin.auth_url`
      - `BaseGenericPlugin.create_plugin()`
      - `BaseGenericPlugin.get_auth_ref()`
      - `BaseGenericPlugin.get_cache_id_elements()`
      - `BaseGenericPlugin.project_domain_id`
      - `BaseGenericPlugin.project_domain_name`
    - `Password`
      - `Password.__abstractmethods__`
      - `Password.__annotations_cache__`
      - `Password.__doc__`
      - `Password.__firstlineno__`
      - `Password.__init__()`
      - `Password.__module__`
      - `Password.__static_attributes__`
      - `Password._abc_impl`
      - `Password._discovery_cache`
      - `Password._plugin`
      - `Password.auth_ref`
      - `Password.auth_url`
      - `Password.create_plugin()`
      - `Password.get_cache_id_elements()`
      - `Password.reauthenticate`
      - `Password.user_domain_id`
      - `Password.user_domain_name`
    - `Token`
      - `Token.__abstractmethods__`
      - `Token.__annotations_cache__`
      - `Token.__doc__`
      - `Token.__firstlineno__`
      - `Token.__init__()`
      - `Token.__module__`
      - `Token.__static_attributes__`
      - `Token._abc_impl`
      - `Token._discovery_cache`
      - `Token._plugin`
      - `Token.auth_ref`
      - `Token.auth_url`
      - `Token.create_plugin()`
      - `Token.get_cache_id_elements()`
      - `Token.reauthenticate`
- keystoneauth1.identity.v3 package
  - Submodules
    - keystoneauth1.identity.v3.application_credential module
      - `ApplicationCredential`
      - `ApplicationCredentialMethod`
    - keystoneauth1.identity.v3.base module
      - `Auth`
      - `AuthConstructor`
      - `AuthMethod`
      - `BaseAuth`
      - `SupportsMultiFactor`
      - `_AuthBody`
      - `_AuthIdentity`
    - keystoneauth1.identity.v3.federation module
      - `FederationBaseAuth`
      - `_Rescoped`
    - keystoneauth1.identity.v3.k2k module
      - `Keystone2Keystone`
    - keystoneauth1.identity.v3.multi_factor module
      - `MultiFactor`
    - keystoneauth1.identity.v3.oauth2_client_credential module
      - `ClientException`
      - `OAuth2ClientCredential`
      - `OAuth2ClientCredentialMethod`
    - keystoneauth1.identity.v3.oauth2_mtls_client_credential module
      - `OAuth2mTlsClientCredential`
    - keystoneauth1.identity.v3.oidc module
      - `OidcAccessToken`
      - `OidcAuthorizationCode`
      - `OidcClientCredentials`
      - `OidcDeviceAuthorization`
      - `OidcPassword`
      - `_OidcBase`
    - keystoneauth1.identity.v3.password module
      - `Password`
      - `PasswordMethod`
    - keystoneauth1.identity.v3.receipt module
      - `ReceiptMethod`
    - keystoneauth1.identity.v3.token module
      - `Token`
      - `TokenMethod`
    - keystoneauth1.identity.v3.tokenless_auth module
      - `TokenlessAuth`
    - keystoneauth1.identity.v3.totp module
      - `TOTP`
      - `TOTPMethod`
  - Module contents
    - `ApplicationCredential`
      - `ApplicationCredential.__abstractmethods__`
      - `ApplicationCredential.__annotate_func__`
      - `ApplicationCredential.__annotations_cache__`
      - `ApplicationCredential.__doc__`
      - `ApplicationCredential.__firstlineno__`
      - `ApplicationCredential.__init__()`
      - `ApplicationCredential.__module__`
      - `ApplicationCredential.__static_attributes__`
      - `ApplicationCredential._abc_impl`
      - `ApplicationCredential._auth_method_class`
    - `ApplicationCredentialMethod`
      - `ApplicationCredentialMethod.__abstractmethods__`
      - `ApplicationCredentialMethod.__annotate_func__()`
      - `ApplicationCredentialMethod.__annotations_cache__`
      - `ApplicationCredentialMethod.__doc__`
      - `ApplicationCredentialMethod.__firstlineno__`
      - `ApplicationCredentialMethod.__init__()`
      - `ApplicationCredentialMethod.__module__`
      - `ApplicationCredentialMethod.__static_attributes__`
      - `ApplicationCredentialMethod._abc_impl`
      - `ApplicationCredentialMethod.application_credential_id`
      - `ApplicationCredentialMethod.application_credential_name`
      - `ApplicationCredentialMethod.application_credential_secret`
      - `ApplicationCredentialMethod.get_auth_data()`
      - `ApplicationCredentialMethod.get_cache_id_elements()`
      - `ApplicationCredentialMethod.user_domain_id`
      - `ApplicationCredentialMethod.user_domain_name`
      - `ApplicationCredentialMethod.user_id`
      - `ApplicationCredentialMethod.username`
    - `Auth`
      - `Auth.__abstractmethods__`
      - `Auth.__annotate_func__`
      - `Auth.__annotations_cache__`
      - `Auth.__doc__`
      - `Auth.__firstlineno__`
      - `Auth.__init__()`
      - `Auth.__module__`
      - `Auth.__static_attributes__`
      - `Auth._abc_impl`
      - `Auth.add_method()`
      - `Auth.get_auth_ref()`
      - `Auth.get_cache_id_elements()`
    - `AuthConstructor`
      - `AuthConstructor.__abstractmethods__`
      - `AuthConstructor.__annotate_func__()`
      - `AuthConstructor.__doc__`
      - `AuthConstructor.__firstlineno__`
      - `AuthConstructor.__init__()`
      - `AuthConstructor.__module__`
      - `AuthConstructor.__static_attributes__`
      - `AuthConstructor._abc_impl`
      - `AuthConstructor._auth_method_class`
    - `AuthMethod`
      - `AuthMethod.__abstractmethods__`
      - `AuthMethod.__annotations_cache__`
      - `AuthMethod.__dict__`
      - `AuthMethod.__doc__`
      - `AuthMethod.__firstlineno__`
      - `AuthMethod.__init__()`
      - `AuthMethod.__module__`
      - `AuthMethod.__static_attributes__`
      - `AuthMethod.__weakref__`
      - `AuthMethod._abc_impl`
      - `AuthMethod._extract_kwargs()`
      - `AuthMethod._method_parameters`
      - `AuthMethod.get_auth_data()`
      - `AuthMethod.get_cache_id_elements()`
    - `BaseAuth`
      - `BaseAuth.__abstractmethods__`
      - `BaseAuth.__annotate_func__()`
      - `BaseAuth.__annotations_cache__`
      - `BaseAuth.__doc__`
      - `BaseAuth.__firstlineno__`
      - `BaseAuth.__init__()`
      - `BaseAuth.__module__`
      - `BaseAuth.__static_attributes__`
      - `BaseAuth._abc_impl`
      - `BaseAuth.auth_url`
      - `BaseAuth.has_scope_parameters`
      - `BaseAuth.token_url`
    - `FederationBaseAuth`
      - `FederationBaseAuth.__abstractmethods__`
      - `FederationBaseAuth.__annotate_func__`
      - `FederationBaseAuth.__annotations_cache__`
      - `FederationBaseAuth.__doc__`
      - `FederationBaseAuth.__firstlineno__`
      - `FederationBaseAuth.__init__()`
      - `FederationBaseAuth.__module__`
      - `FederationBaseAuth.__static_attributes__`
      - `FederationBaseAuth._abc_impl`
      - `FederationBaseAuth.federated_token_url`
    - `Keystone2Keystone`
      - `Keystone2Keystone.HTTP_MOVED_TEMPORARILY`
      - `Keystone2Keystone.HTTP_SEE_OTHER`
      - `Keystone2Keystone.REQUEST_ECP_URL`
      - `Keystone2Keystone.__abstractmethods__`
      - `Keystone2Keystone.__doc__`
      - `Keystone2Keystone.__firstlineno__`
      - `Keystone2Keystone.__init__()`
      - `Keystone2Keystone.__module__`
      - `Keystone2Keystone.__static_attributes__`
      - `Keystone2Keystone._abc_impl`
      - `Keystone2Keystone._get_ecp_assertion()`
      - `Keystone2Keystone._remote_auth_url()`
      - `Keystone2Keystone._send_service_provider_ecp_authn_response()`
      - `Keystone2Keystone.get_unscoped_auth_ref()`
    - `MultiFactor`
      - `MultiFactor.__abstractmethods__`
      - `MultiFactor.__doc__`
      - `MultiFactor.__firstlineno__`
      - `MultiFactor.__init__()`
      - `MultiFactor.__module__`
      - `MultiFactor.__static_attributes__`
      - `MultiFactor._abc_impl`
    - `OAuth2ClientCredential`
      - `OAuth2ClientCredential.__abstractmethods__`
      - `OAuth2ClientCredential.__doc__`
      - `OAuth2ClientCredential.__firstlineno__`
      - `OAuth2ClientCredential.__init__()`
      - `OAuth2ClientCredential.__module__`
      - `OAuth2ClientCredential.__static_attributes__`
      - `OAuth2ClientCredential._abc_impl`
      - `OAuth2ClientCredential._auth_method_class`
      - `OAuth2ClientCredential.get_headers()`
    - `OAuth2ClientCredentialMethod`
      - `OAuth2ClientCredentialMethod.__abstractmethods__`
      - `OAuth2ClientCredentialMethod.__annotate_func__()`
      - `OAuth2ClientCredentialMethod.__annotations_cache__`
      - `OAuth2ClientCredentialMethod.__doc__`
      - `OAuth2ClientCredentialMethod.__firstlineno__`
      - `OAuth2ClientCredentialMethod.__init__()`
      - `OAuth2ClientCredentialMethod.__module__`
      - `OAuth2ClientCredentialMethod.__static_attributes__`
      - `OAuth2ClientCredentialMethod._abc_impl`
      - `OAuth2ClientCredentialMethod.get_auth_data()`
      - `OAuth2ClientCredentialMethod.get_cache_id_elements()`
      - `OAuth2ClientCredentialMethod.oauth2_client_id`
      - `OAuth2ClientCredentialMethod.oauth2_client_secret`
      - `OAuth2ClientCredentialMethod.oauth2_endpoint`
    - `OAuth2mTlsClientCredential`
      - `OAuth2mTlsClientCredential.__abstractmethods__`
      - `OAuth2mTlsClientCredential.__doc__`
      - `OAuth2mTlsClientCredential.__firstlineno__`
      - `OAuth2mTlsClientCredential.__init__()`
      - `OAuth2mTlsClientCredential.__module__`
      - `OAuth2mTlsClientCredential.__static_attributes__`
      - `OAuth2mTlsClientCredential._abc_impl`
      - `OAuth2mTlsClientCredential.get_auth_ref()`
      - `OAuth2mTlsClientCredential.get_headers()`
    - `OidcAccessToken`
      - `OidcAccessToken.__abstractmethods__`
      - `OidcAccessToken.__doc__`
      - `OidcAccessToken.__firstlineno__`
      - `OidcAccessToken.__init__()`
      - `OidcAccessToken.__module__`
      - `OidcAccessToken.__static_attributes__`
      - `OidcAccessToken._abc_impl`
      - `OidcAccessToken.get_payload()`
      - `OidcAccessToken.get_unscoped_auth_ref()`
    - `OidcAuthorizationCode`
      - `OidcAuthorizationCode.__abstractmethods__`
      - `OidcAuthorizationCode.__doc__`
      - `OidcAuthorizationCode.__firstlineno__`
      - `OidcAuthorizationCode.__init__()`
      - `OidcAuthorizationCode.__module__`
      - `OidcAuthorizationCode.__static_attributes__`
      - `OidcAuthorizationCode._abc_impl`
      - `OidcAuthorizationCode.get_payload()`
      - `OidcAuthorizationCode.grant_type`
    - `OidcClientCredentials`
      - `OidcClientCredentials.__abstractmethods__`
      - `OidcClientCredentials.__doc__`
      - `OidcClientCredentials.__firstlineno__`
      - `OidcClientCredentials.__init__()`
      - `OidcClientCredentials.__module__`
      - `OidcClientCredentials.__static_attributes__`
      - `OidcClientCredentials._abc_impl`
      - `OidcClientCredentials.get_payload()`
      - `OidcClientCredentials.grant_type`
    - `OidcPassword`
      - `OidcPassword.__abstractmethods__`
      - `OidcPassword.__doc__`
      - `OidcPassword.__firstlineno__`
      - `OidcPassword.__init__()`
      - `OidcPassword.__module__`
      - `OidcPassword.__static_attributes__`
      - `OidcPassword._abc_impl`
      - `OidcPassword.get_payload()`
      - `OidcPassword.grant_type`
      - `OidcPassword.manage_otp_from_session_or_request_to_the_user()`
    - `Password`
      - `Password.__abstractmethods__`
      - `Password.__doc__`
      - `Password.__firstlineno__`
      - `Password.__init__()`
      - `Password.__module__`
      - `Password.__static_attributes__`
      - `Password._abc_impl`
      - `Password._auth_method_class`
    - `PasswordMethod`
      - `PasswordMethod.__abstractmethods__`
      - `PasswordMethod.__annotate_func__()`
      - `PasswordMethod.__annotations_cache__`
      - `PasswordMethod.__doc__`
      - `PasswordMethod.__firstlineno__`
      - `PasswordMethod.__init__()`
      - `PasswordMethod.__module__`
      - `PasswordMethod.__static_attributes__`
      - `PasswordMethod._abc_impl`
      - `PasswordMethod.get_auth_data()`
      - `PasswordMethod.get_cache_id_elements()`
      - `PasswordMethod.password`
      - `PasswordMethod.user_domain_id`
      - `PasswordMethod.user_domain_name`
      - `PasswordMethod.user_id`
      - `PasswordMethod.username`
    - `ReceiptMethod`
      - `ReceiptMethod.__abstractmethods__`
      - `ReceiptMethod.__annotate_func__()`
      - `ReceiptMethod.__annotations_cache__`
      - `ReceiptMethod.__doc__`
      - `ReceiptMethod.__firstlineno__`
      - `ReceiptMethod.__init__()`
      - `ReceiptMethod.__module__`
      - `ReceiptMethod.__static_attributes__`
      - `ReceiptMethod._abc_impl`
      - `ReceiptMethod.get_auth_data()`
      - `ReceiptMethod.get_cache_id_elements()`
      - `ReceiptMethod.receipt`
    - `TOTP`
      - `TOTP.__abstractmethods__`
      - `TOTP.__doc__`
      - `TOTP.__firstlineno__`
      - `TOTP.__init__()`
      - `TOTP.__module__`
      - `TOTP.__static_attributes__`
      - `TOTP._abc_impl`
      - `TOTP._auth_method_class`
    - `TOTPMethod`
      - `TOTPMethod.__abstractmethods__`
      - `TOTPMethod.__annotate_func__()`
      - `TOTPMethod.__annotations_cache__`
      - `TOTPMethod.__doc__`
      - `TOTPMethod.__firstlineno__`
      - `TOTPMethod.__init__()`
      - `TOTPMethod.__module__`
      - `TOTPMethod.__static_attributes__`
      - `TOTPMethod._abc_impl`
      - `TOTPMethod.get_auth_data()`
      - `TOTPMethod.get_cache_id_elements()`
      - `TOTPMethod.passcode`
      - `TOTPMethod.user_domain_id`
      - `TOTPMethod.user_domain_name`
      - `TOTPMethod.user_id`
      - `TOTPMethod.username`
    - `Token`
      - `Token.__abstractmethods__`
      - `Token.__doc__`
      - `Token.__firstlineno__`
      - `Token.__init__()`
      - `Token.__module__`
      - `Token.__static_attributes__`
      - `Token._abc_impl`
      - `Token._auth_method_class`
    - `TokenMethod`
      - `TokenMethod.__abstractmethods__`
      - `TokenMethod.__annotate_func__()`
      - `TokenMethod.__annotations_cache__`
      - `TokenMethod.__doc__`
      - `TokenMethod.__firstlineno__`
      - `TokenMethod.__init__()`
      - `TokenMethod.__module__`
      - `TokenMethod.__static_attributes__`
      - `TokenMethod._abc_impl`
      - `TokenMethod.get_auth_data()`
      - `TokenMethod.get_cache_id_elements()`
      - `TokenMethod.token`
    - `TokenlessAuth`
      - `TokenlessAuth.__abstractmethods__`
      - `TokenlessAuth.__annotate_func__`
      - `TokenlessAuth.__annotations_cache__`
      - `TokenlessAuth.__doc__`
      - `TokenlessAuth.__firstlineno__`
      - `TokenlessAuth.__init__()`
      - `TokenlessAuth.__module__`
      - `TokenlessAuth.__static_attributes__`
      - `TokenlessAuth._abc_impl`
      - `TokenlessAuth.get_endpoint()`
      - `TokenlessAuth.get_headers()`

## Submodules

- keystoneauth1.identity.access module
  - `AccessInfoPlugin`
    - `AccessInfoPlugin.__abstractmethods__`
    - `AccessInfoPlugin.__annotate_func__()`
    - `AccessInfoPlugin.__annotations_cache__`
    - `AccessInfoPlugin.__doc__`
    - `AccessInfoPlugin.__firstlineno__`
    - `AccessInfoPlugin.__init__()`
    - `AccessInfoPlugin.__module__`
    - `AccessInfoPlugin.__static_attributes__`
    - `AccessInfoPlugin._abc_impl`
    - `AccessInfoPlugin.auth_ref`
    - `AccessInfoPlugin.get_auth_ref()`
    - `AccessInfoPlugin.invalidate()`
- keystoneauth1.identity.base module
  - `BaseIdentityPlugin`
    - `BaseIdentityPlugin.MIN_TOKEN_LIFE_SECONDS`
    - `BaseIdentityPlugin.__abstractmethods__`
    - `BaseIdentityPlugin.__annotate_func__`
    - `BaseIdentityPlugin.__annotations_cache__`
    - `BaseIdentityPlugin.__doc__`
    - `BaseIdentityPlugin.__firstlineno__`
    - `BaseIdentityPlugin.__init__()`
    - `BaseIdentityPlugin.__module__`
    - `BaseIdentityPlugin.__static_attributes__`
    - `BaseIdentityPlugin._abc_impl`
    - `BaseIdentityPlugin._discovery_cache`
    - `BaseIdentityPlugin._needs_reauthenticate()`
    - `BaseIdentityPlugin.auth_ref`
    - `BaseIdentityPlugin.auth_url`
    - `BaseIdentityPlugin.get_access()`
    - `BaseIdentityPlugin.get_all_version_data()`
    - `BaseIdentityPlugin.get_api_major_version()`
    - `BaseIdentityPlugin.get_auth_ref()`
    - `BaseIdentityPlugin.get_auth_state()`
    - `BaseIdentityPlugin.get_cache_id()`
    - `BaseIdentityPlugin.get_cache_id_elements()`
    - `BaseIdentityPlugin.get_discovery()`
    - `BaseIdentityPlugin.get_endpoint()`
    - `BaseIdentityPlugin.get_endpoint_data()`
    - `BaseIdentityPlugin.get_project_id()`
    - `BaseIdentityPlugin.get_sp_auth_url()`
    - `BaseIdentityPlugin.get_sp_url()`
    - `BaseIdentityPlugin.get_token()`
    - `BaseIdentityPlugin.get_user_id()`
    - `BaseIdentityPlugin.invalidate()`
    - `BaseIdentityPlugin.reauthenticate`
    - `BaseIdentityPlugin.set_auth_state()`
- keystoneauth1.identity.v2 module
  - `Auth`
    - `Auth.__abstractmethods__`
    - `Auth.__annotate_func__()`
    - `Auth.__annotations_cache__`
    - `Auth.__doc__`
    - `Auth.__firstlineno__`
    - `Auth.__init__()`
    - `Auth.__module__`
    - `Auth.__static_attributes__`
    - `Auth._abc_impl`
    - `Auth.auth_url`
    - `Auth.get_auth_data()`
    - `Auth.get_auth_ref()`
    - `Auth.has_scope_parameters`
  - `Password`
    - `Password.__abstractmethods__`
    - `Password.__doc__`
    - `Password.__firstlineno__`
    - `Password.__init__()`
    - `Password.__module__`
    - `Password.__static_attributes__`
    - `Password._abc_impl`
    - `Password.get_auth_data()`
    - `Password.get_cache_id_elements()`
  - `Token`
    - `Token.__abstractmethods__`
    - `Token.__doc__`
    - `Token.__firstlineno__`
    - `Token.__init__()`
    - `Token.__module__`
    - `Token.__static_attributes__`
    - `Token._abc_impl`
    - `Token.get_auth_data()`
    - `Token.get_cache_id_elements()`
  - `Unset`
    - `Unset.__doc__`
    - `Unset.__module__`
    - `Unset.token`

## Module contents

class keystoneauth1.identity.BaseIdentityPlugin(auth_url: str | None = None, reauthenticate: bool = True)

  Bases: `BaseAuthPlugin`

  MIN_TOKEN_LIFE_SECONDS: int = 120
  __abstractmethods__ = frozenset({'get_auth_ref'})
  __annotate_func__()

    The type of the None singleton.

  __annotations_cache__ = {'MIN_TOKEN_LIFE_SECONDS': <class 'int'>, '_discovery_cache': 'dict[str, discover.Discover]', 'auth_ref': keystoneauth1.access.access.AccessInfo | None, 'auth_url': str | None, 'reauthenticate': <class 'bool'>}
  __doc__ = None
  __firstlineno__ = 31
  __init__(auth_url: str | None = None, reauthenticate: bool = True)
  __module__ = 'keystoneauth1.identity.base'
  __static_attributes__ = ('_lock', 'auth_ref', 'auth_url', 'reauthenticate')
  _abc_impl = <_abc._abc_data object>
  _needs_reauthenticate() → bool

    Return if the existing token needs to be re-authenticated.

    The token should be refreshed if it is about to expire.

    Returns:

      True if the plugin should fetch a new token. False otherwise.

  auth_ref: AccessInfo | None
  auth_url: str | None
  get_access(session: Session, **kwargs: Any) → AccessInfo

    Fetch or return a current AccessInfo object.

    If a valid AccessInfo is present then it is returned otherwise a new one will be fetched.

    Parameters:

      session (keystoneauth1.session.Session) – A session object that can be used for communication.

    Raises:

      keystoneauth1.exceptions.http.HttpError – An error from an invalid HTTP response.

    Returns:

      Valid AccessInfo

    Return type:

      `keystoneauth1.access.AccessInfo`

  get_all_version_data(session: Session, interface: str | list[str] | None = 'public', region_name: str | None = None, service_type: str | None = None) → dict[str, dict[str, dict[str, list[VersionData]]]]

    Get version data for all services in the catalog.

    Parameters:

      - session (keystoneauth1.session.Session) – A session object that can be used for communication.

      - interface – Type of endpoint to get version data for. Can be a single value or a list of values. A value of None indicates that all interfaces should be queried. (optional, defaults to public)

      - region_name (string) – Region of endpoints to get version data for. A valueof None indicates that all regions should be queried. (optional, defaults to None)

      - service_type (string) – Limit the version data to a single service. (optional, defaults to None)

    Returns:

      A dictionary keyed by region_name with values containing dictionaries keyed by interface with values being a list of `VersionData`.

  get_api_major_version(session: Session, *, endpoint_override: str | None = None, service_type: str | None = None, interface: str | None = None, region_name: str | None = None, service_name: str | None = None, version: str | None = None, allow: dict[str, Any] | None = None, allow_version_hack: bool = True, skip_discovery: bool = False, discover_versions: bool = False, min_version: str | int | float | Iterable[str | int | float] | None = None, max_version: str | int | float | Iterable[str | int | float] | None = None, **kwargs: Any) → tuple[int | float, ...] | None

    Return the major API version for a service.

    If a valid token is not present then a new one will be fetched using the session and kwargs.

    version, min_version and max_version can all be given either as a string or a tuple.

    Valid interface types: public or publicURL,

      internal or internalURL, admin or ‘adminURL`

    Parameters:

      - session (keystoneauth1.session.Session) – A session object that can be used for communication.

      - endpoint_override (str) – URL to use for version discovery.

      - service_type (string) – The type of service to lookup the endpoint for. This plugin will return None (failure) if service_type is not provided.

      - interface – Type of endpoint. Can be a single value or a list of values. If it’s a list of values, they will be looked for in order of preference. Can also be keystoneauth1.plugin.AUTH_INTERFACE to indicate that the auth_url should be used instead of the value in the catalog. (optional, defaults to public)

      - region_name (string) – The region the endpoint should exist in. (optional)

      - service_name (string) – The name of the service in the catalog. (optional)

      - version – The minimum version number required for this endpoint. (optional)

      - allow (dict) – Extra filters to pass when discovering API versions. (optional)

      - allow_version_hack (bool) – Allow keystoneauth to hack up catalog URLS to support older schemes. (optional, default True)

      - skip_discovery (bool) – Whether to skip version discovery even if a version has been given. This is useful if endpoint_override or similar has been given and grabbing additional information about the endpoint is not useful.

      - discover_versions (bool) – Whether to get version metadata from the version discovery document even if it’s not neccessary to fulfill the major version request. Defaults to False because get_endpoint doesn’t need metadata. (optional, defaults to False)

      - min_version – The minimum version that is acceptable. Mutually exclusive with version. If min_version is given with no max_version it is as if max version is ‘latest’. (optional)

      - max_version – The maximum version that is acceptable. Mutually exclusive with version. If min_version is given with no max_version it is as if max version is ‘latest’. (optional)

    Raises:

      keystoneauth1.exceptions.http.HttpError – An error from an invalid HTTP response.

    Returns:

      The major version of the API of the service discovered.

    Return type:

      tuple or None

    Note

    Implementation notes follow. Users should not need to wrap their head around these implementation notes. get_api_major_version should do what is expected with the least possible cost while still consistently returning a value if possible.

    There are many cases when major version can be satisfied without actually calling the discovery endpoint (like when the version is in the url). If the user has a cloud with the versioned endpoint `https://volume.example.com/v3` in the catalog for the `block-storage` service and they do:

        client = adapter.Adapter(
            session,
            service_type='block-storage',
            min_version=2,
            max_version=3,
        )
        volume_version = client.get_api_major_version()

    The version actually be returned with no api calls other than getting the token. For that reason, `get_api_major_version()` first calls `get_endpoint_data()` with `discover_versions=False`.

    If their catalog has an unversioned endpoint `https://volume.example.com` for the `block-storage` service and they do this:

        client = adapter.Adapter(session, service_type='block-storage')

    client is now set up to “use whatever is in the catalog”. Since the url doesn’t have a version, `get_endpoint_data()` with `discover_versions=False` will result in `api_version=None`. (No version was requested so it didn’t need to do the round trip)

    In order to find out what version the endpoint actually is, we must make a round trip. Therefore, if `api_version` is `None` after the first call, `get_api_major_version()` will make a second call to `get_endpoint_data()` with `discover_versions=True`.

  abstractmethod get_auth_ref(session: Session) → AccessInfo

    Obtain a token from an OpenStack Identity Service.

    This method is overridden by the various token version plugins.

    This function should not be called independently and is expected to be invoked via the do_authenticate function.

    This function will be invoked if the AcessInfo object cached by the plugin is not valid. Thus plugins should always fetch a new AccessInfo when invoked. If you are looking to just retrieve the current auth data then you should use get_access.

    Parameters:

      session (keystoneauth1.session.Session) – A session object that can be used for communication.

    Raises:

      - keystoneauth1.exceptions.response.InvalidResponse – The response returned wasn’t appropriate.

      - keystoneauth1.exceptions.http.HttpError – An error from an invalid HTTP response.

    Returns:

      Token access information.

    Return type:

      `keystoneauth1.access.AccessInfo`

  get_auth_state() → str | None

    Retrieve the current authentication state for the plugin.

    Retrieve any internal state that represents the authenticated plugin.

    This should not fetch any new data if it is not present.

    Returns:

      a string that can be stored or None if there is no auth state present in the plugin. This string can be reloaded with set_auth_state to set the same authentication.

    Return type:

      str or None if no auth present.

  get_cache_id() → str | None

    Fetch an identifier that uniquely identifies the auth options.

    The returned identifier need not be decomposable or otherwise provide any way to recreate the plugin.

    This string MUST change if any of the parameters that are used to uniquely identity this plugin change. It should not change upon a reauthentication of the plugin.

    Returns:

      A unique string for the set of options

    Return type:

      str or None if this is unsupported or unavailable.

  get_cache_id_elements() → dict[str, str | None]

    Get the elements for this auth plugin that make it unique.

    As part of the get_cache_id requirement we need to determine what aspects of this plugin and its values that make up the unique elements.

    This should be overridden by plugins that wish to allow caching.

    Returns:

      The unique attributes and values of this plugin.

    Return type:

      A flat dict with a str key and str or None value. This is required as we feed these values into a hash. Pairs where the value is None are ignored in the hashed id.

  get_discovery(session: Session, url: str, authenticated: bool | None = None) → Discover

    Return the discovery object for a URL.

    Check the session and the plugin cache to see if we have already performed discovery on the URL and if so return it, otherwise create a new discovery object, cache it and return it.

    This function is expected to be used by subclasses and should not be needed by users.

    Parameters:

      - session (keystoneauth1.session.Session) – A session object to discover with.

      - url (str) – The url to lookup.

      - authenticated (bool) – Include a token in the discovery call. (optional) Defaults to None (use a token if a plugin is installed).

    Raises:

      - keystoneauth1.exceptions.discovery.DiscoveryFailure – if for some reason the lookup fails.

      - keystoneauth1.exceptions.http.HttpError – An error from an invalid HTTP response.

    Returns:

      A discovery object with the results of looking up that URL.

  get_endpoint(session: Session, service_type: str | None = None, interface: str | None = None, region_name: str | None = None, service_name: str | None = None, version: str | int | float | Iterable[str | int | float] | None = None, allow: dict[str, Any] | None = None, allow_version_hack: bool = True, skip_discovery: bool = False, min_version: str | int | float | Iterable[str | int | float] | None = None, max_version: str | int | float | Iterable[str | int | float] | None = None, **kwargs: Any) → str | None

    Return a valid endpoint for a service.

    If a valid token is not present then a new one will be fetched using the session and kwargs.

    version, min_version and max_version can all be given either as a string or a tuple.

    Valid interface types: public or publicURL,

      internal or internalURL, admin or ‘adminURL`

    Parameters:

      - session (keystoneauth1.session.Session) – A session object that can be used for communication.

      - service_type (string) – The type of service to lookup the endpoint for. This plugin will return None (failure) if service_type is not provided.

      - interface – Type of endpoint. Can be a single value or a list of values. If it’s a list of values, they will be looked for in order of preference. Can also be keystoneauth1.plugin.AUTH_INTERFACE to indicate that the auth_url should be used instead of the value in the catalog. (optional, defaults to public)

      - region_name (string) – The region the endpoint should exist in. (optional)

      - service_name (string) – The name of the service in the catalog. (optional)

      - version – The minimum version number required for this endpoint. (optional)

      - allow (dict) – Extra filters to pass when discovering API versions. (optional)

      - allow_version_hack (bool) – Allow keystoneauth to hack up catalog URLS to support older schemes. (optional, default True)

      - skip_discovery (bool) – Whether to skip version discovery even if a version has been given. This is useful if endpoint_override or similar has been given and grabbing additional information about the endpoint is not useful.

      - min_version – The minimum version that is acceptable. Mutually exclusive with version. If min_version is given with no max_version it is as if max version is ‘latest’. (optional)

      - max_version – The maximum version that is acceptable. Mutually exclusive with version. If min_version is given with no max_version it is as if max version is ‘latest’. (optional)

    Raises:

      keystoneauth1.exceptions.http.HttpError – An error from an invalid HTTP response.

    Returns:

      A valid endpoint URL or None if not available.

    Return type:

      string or None

  get_endpoint_data(session: Session, *, endpoint_override: str | None = None, discover_versions: bool = True, service_type: str | None = None, interface: str | None = None, region_name: str | None = None, service_name: str | None = None, allow: dict[str, Any] | None = None, allow_version_hack: bool = True, skip_discovery: bool = False, min_version: str | int | float | Iterable[str | int | float] | None = None, max_version: str | int | float | Iterable[str | int | float] | None = None, **kwargs: Any) → EndpointData | None

    Return a valid endpoint data for a service.

    If a valid token is not present then a new one will be fetched using the session and kwargs.

    version, min_version and max_version can all be given either as a string or a tuple.

    Valid interface types: public or publicURL,

      internal or internalURL, admin or ‘adminURL`

    Parameters:

      - session (keystoneauth1.session.Session) – A session object that can be used for communication.

      - endpoint_override (str) – URL to use instead of looking in the catalog. Catalog lookup will be skipped, but version discovery will be run. Sets allow_version_hack to False (optional)

      - discover_versions (bool) – Whether to get version metadata from the version discovery document even if it’s not neccessary to fulfill the major version request. (optional, defaults to True)

      - service_type (string) – The type of service to lookup the endpoint for. This plugin will return None (failure) if service_type is not provided.

      - interface – Type of endpoint. Can be a single value or a list of values. If it’s a list of values, they will be looked for in order of preference. Can also be keystoneauth1.plugin.AUTH_INTERFACE to indicate that the auth_url should be used instead of the value in the catalog. (optional, defaults to public)

      - region_name (string) – The region the endpoint should exist in. (optional)

      - service_name (string) – The name of the service in the catalog. (optional)

      - allow (dict) – Extra filters to pass when discovering API versions. (optional)

      - allow_version_hack (bool) – Allow keystoneauth to hack up catalog URLS to support older schemes. (optional, default True)

      - skip_discovery (bool) – Whether to skip version discovery even if a version has been given. This is useful if endpoint_override or similar has been given and grabbing additional information about the endpoint is not useful.

      - min_version – The minimum version that is acceptable. Mutually exclusive with version. If min_version is given with no max_version it is as if max version is ‘latest’. (optional)

      - max_version – The maximum version that is acceptable. Mutually exclusive with version. If min_version is given with no max_version it is as if max version is ‘latest’. (optional)

      - kwargs – Ignored.

    Raises:

      keystoneauth1.exceptions.http.HttpError – An error from an invalid HTTP response.

    Returns:

      Valid EndpointData or None if not available.

    Return type:

      keystoneauth1.discover.EndpointData or None

  get_project_id(session: Session) → str | None

    Return the project id that we are authenticated to.

    Wherever possible the project id should be inferred from the token however there are certain URLs and other places that require access to the currently authenticated project id.

    Parameters:

      session (keystoneauth1.session.Session) – A session object so the plugin can make HTTP calls.

    Returns:

      A project identifier or None if one is not available.

    Return type:

      str

  get_sp_auth_url(session: Session, sp_id: str) → str | None

    Return auth_url from the Service Provider object.

    This url is used for obtaining unscoped federated token from remote cloud.

    Parameters:

      sp_id (string) – ID of the Service Provider to be queried.

    Returns:

      A Service Provider auth_url or None if one is not available.

    Return type:

      str

  get_sp_url(session: Session, sp_id: str) → str | None

    Return sp_url from the Service Provider object.

    This url is used for passing SAML2 assertion to the remote cloud.

    Parameters:

      sp_id (str) – ID of the Service Provider to be queried.

    Returns:

      A Service Provider sp_url or None if one is not available.

    Return type:

      str

  get_token(session: Session) → str | None

    Return a valid auth token.

    If a valid token is not present then a new one will be fetched.

    Parameters:

      session (keystoneauth1.session.Session) – A session object that can be used for communication.

    Raises:

      keystoneauth1.exceptions.http.HttpError – An error from an invalid HTTP response.

    Returns:

      A valid token.

    Return type:

      string

  get_user_id(session: Session) → str | None

    Return a unique user identifier of the plugin.

    Wherever possible the user id should be inferred from the token however there are certain URLs and other places that require access to the currently authenticated user id.

    Parameters:

      session (keystoneauth1.session.Session) – A session object so the plugin can make HTTP calls.

    Returns:

      A user identifier or None if one is not available.

    Return type:

      str

  invalidate() → bool

    Invalidate the current authentication data.

    This should result in fetching a new token on next call.

    A plugin may be invalidated if an Unauthorized HTTP response is returned to indicate that the token may have been revoked or is otherwise now invalid.

    Returns:

      True if there was something that the plugin did to invalidate. This means that it makes sense to try again. If nothing happens returns False to indicate give up.

    Return type:

      bool

  reauthenticate: bool
  set_auth_state(data: str) → None

    Install existing authentication state for a plugin.

    Take the output of get_auth_state and install that authentication state into the current authentication plugin.

class keystoneauth1.identity.Password(auth_url: str, username: str | None = None, user_id: str | None = None, password: str | None = None, user_domain_id: str | None = None, user_domain_name: str | None = None, *, tenant_id: str | None = None, tenant_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, domain_id: str | None = None, domain_name: str | None = None, system_scope: str | None = None, trust_id: str | None = None, default_domain_id: str | None = None, default_domain_name: str | None = None, reauthenticate: bool = True)

  Bases: `BaseGenericPlugin`

  See `keystoneauth1.identity.generic.Password`

  __abstractmethods__ = frozenset({})
  __annotate_func__ = <function BaseGenericPlugin.__annotate__>
  __annotations_cache__ = {'MIN_TOKEN_LIFE_SECONDS': 'int', '_discovery_cache': 'dict[str, discover.Discover]', '_plugin': 'v2.Auth | v3.Auth | None', 'auth_ref': 'access.AccessInfo | None', 'auth_url': 'str', 'reauthenticate': 'bool'}
  __doc__ = "A common user/password authentication plugin.\n\n:param string username: Username for authentication.\n:param string user_id: User ID for authentication.\n:param string password: Password for authentication.\n:param string user_domain_id: User's domain ID for authentication.\n:param string user_domain_name: User's domain name for authentication.\n"
  __firstlineno__ = 21
  __init__(auth_url: str, username: str | None = None, user_id: str | None = None, password: str | None = None, user_domain_id: str | None = None, user_domain_name: str | None = None, *, tenant_id: str | None = None, tenant_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, domain_id: str | None = None, domain_name: str | None = None, system_scope: str | None = None, trust_id: str | None = None, default_domain_id: str | None = None, default_domain_name: str | None = None, reauthenticate: bool = True)
  __module__ = 'keystoneauth1.identity.generic.password'
  __static_attributes__ = ('_password', '_user_domain_id', '_user_domain_name', '_user_id', '_username')
  _abc_impl = <_abc._abc_data object>
  create_plugin(session: Session, version: tuple[int | float, ...], url: str, raw_status: str | None = None) → None | Password | Password

    Create a plugin from the given parameters.

    This function will be called multiple times with the version and url of a potential endpoint. If a plugin can be constructed that fits the params then it should return it. If not return None and then another call will be made with other available URLs.

    Parameters:

      - session (keystoneauth1.session.Session) – A session object.

      - version (tuple) – A tuple of the API version at the URL.

      - url (str) – The base URL for this version.

      - raw_status (str) – The status that was in the discovery field.

    Returns:

      A plugin that can match the parameters or None if nothing.

  get_cache_id_elements() → dict[str, str | None]

    Get the elements for this auth plugin that make it unique.

    As part of the get_cache_id requirement we need to determine what aspects of this plugin and its values that make up the unique elements.

    This should be overridden by plugins that wish to allow caching.

    Returns:

      The unique attributes and values of this plugin.

    Return type:

      A flat dict with a str key and str or None value. This is required as we feed these values into a hash. Pairs where the value is None are ignored in the hashed id.

  property user_domain_id: str | None
  property user_domain_name: str | None

class keystoneauth1.identity.Token(auth_url: str, token: str, *, tenant_id: str | None = None, tenant_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, domain_id: str | None = None, domain_name: str | None = None, system_scope: str | None = None, trust_id: str | None = None, default_domain_id: str | None = None, default_domain_name: str | None = None, reauthenticate: bool = True)

  Bases: `BaseGenericPlugin`

  See `keystoneauth1.identity.generic.Token`

  __abstractmethods__ = frozenset({})
  __annotate_func__ = <function BaseGenericPlugin.__annotate__>
  __annotations_cache__ = {'MIN_TOKEN_LIFE_SECONDS': 'int', '_discovery_cache': 'dict[str, discover.Discover]', '_plugin': 'v2.Auth | v3.Auth | None', 'auth_ref': 'access.AccessInfo | None', 'auth_url': 'str', 'reauthenticate': 'bool'}
  __doc__ = 'Generic token auth plugin.\n\n:param string token: Token for authentication.\n'
  __firstlineno__ = 21
  __init__(auth_url: str, token: str, *, tenant_id: str | None = None, tenant_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, domain_id: str | None = None, domain_name: str | None = None, system_scope: str | None = None, trust_id: str | None = None, default_domain_id: str | None = None, default_domain_name: str | None = None, reauthenticate: bool = True)
  __module__ = 'keystoneauth1.identity.generic.token'
  __static_attributes__ = ('_token',)
  _abc_impl = <_abc._abc_data object>
  create_plugin(session: Session, version: tuple[int | float, ...], url: str, raw_status: str | None = None) → None | Token | Token

    Create a plugin from the given parameters.

    This function will be called multiple times with the version and url of a potential endpoint. If a plugin can be constructed that fits the params then it should return it. If not return None and then another call will be made with other available URLs.

    Parameters:

      - session (keystoneauth1.session.Session) – A session object.

      - version (tuple) – A tuple of the API version at the URL.

      - url (str) – The base URL for this version.

      - raw_status (str) – The status that was in the discovery field.

    Returns:

      A plugin that can match the parameters or None if nothing.

  get_cache_id_elements() → dict[str, str | None]

    Get the elements for this auth plugin that make it unique.

    As part of the get_cache_id requirement we need to determine what aspects of this plugin and its values that make up the unique elements.

    This should be overridden by plugins that wish to allow caching.

    Returns:

      The unique attributes and values of this plugin.

    Return type:

      A flat dict with a str key and str or None value. This is required as we feed these values into a hash. Pairs where the value is None are ignored in the hashed id.

keystoneauth1.identity.V2Password

  See `keystoneauth1.identity.v2.Password`

keystoneauth1.identity.V2Token

  See `keystoneauth1.identity.v2.Token`

keystoneauth1.identity.V3ApplicationCredential

  See `keystoneauth1.identity.v3.ApplicationCredential`

keystoneauth1.identity.V3MultiFactor

  See `keystoneauth1.identity.v3.MultiFactor`

keystoneauth1.identity.V3OAuth2ClientCredential

  See `keystoneauth1.identity.v3.OAuth2ClientCredential`

keystoneauth1.identity.V3OAuth2mTlsClientCredential

  See `keystoneauth1.identity.v3.OAuth2mTlsClientCredential`

keystoneauth1.identity.V3OidcAccessToken

  See `keystoneauth1.identity.v3.oidc.OidcAccessToken`

keystoneauth1.identity.V3OidcAuthorizationCode

  See `keystoneauth1.identity.v3.oidc.OidcAuthorizationCode`

keystoneauth1.identity.V3OidcClientCredentials

  See `keystoneauth1.identity.v3.oidc.OidcClientCredentials`

keystoneauth1.identity.V3OidcDeviceAuthorization

  See `keystoneauth1.identity.v3.oidc.OidcDeviceAuthorization`

keystoneauth1.identity.V3OidcPassword

  See `keystoneauth1.identity.v3.oidc.OidcPassword`

keystoneauth1.identity.V3Password

  See `keystoneauth1.identity.v3.Password`

keystoneauth1.identity.V3TOTP

  See `keystoneauth1.identity.v3.TOTP`

keystoneauth1.identity.V3Token

  See `keystoneauth1.identity.v3.Token`

keystoneauth1.identity.V3TokenlessAuth

  See `keystoneauth1.identity.v3.TokenlessAuth`

this page last updated: 2026-03-25 21:01:07

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.

found an error? report a bug