# keystoneauth1.identity.v3 package

## Submodules

- keystoneauth1.identity.v3.application_credential module
  - `ApplicationCredential`
    - `ApplicationCredential.__abstractmethods__`
    - `ApplicationCredential.__annotate_func__`
    - `ApplicationCredential.__annotations_cache__`
    - `ApplicationCredential.__doc__`
    - `ApplicationCredential.__firstlineno__`
    - `ApplicationCredential.__init__()`
    - `ApplicationCredential.__module__`
    - `ApplicationCredential.__static_attributes__`
    - `ApplicationCredential._abc_impl`
    - `ApplicationCredential._auth_method_class`
  - `ApplicationCredentialMethod`
    - `ApplicationCredentialMethod.__abstractmethods__`
    - `ApplicationCredentialMethod.__annotations_cache__`
    - `ApplicationCredentialMethod.__doc__`
    - `ApplicationCredentialMethod.__firstlineno__`
    - `ApplicationCredentialMethod.__init__()`
    - `ApplicationCredentialMethod.__module__`
    - `ApplicationCredentialMethod.__static_attributes__`
    - `ApplicationCredentialMethod._abc_impl`
    - `ApplicationCredentialMethod.application_credential_id`
    - `ApplicationCredentialMethod.application_credential_name`
    - `ApplicationCredentialMethod.application_credential_secret`
    - `ApplicationCredentialMethod.get_auth_data()`
    - `ApplicationCredentialMethod.get_cache_id_elements()`
    - `ApplicationCredentialMethod.user_domain_id`
    - `ApplicationCredentialMethod.user_domain_name`
    - `ApplicationCredentialMethod.user_id`
    - `ApplicationCredentialMethod.username`
- keystoneauth1.identity.v3.base module
  - `Auth`
    - `Auth.__abstractmethods__`
    - `Auth.__annotate_func__`
    - `Auth.__annotations_cache__`
    - `Auth.__doc__`
    - `Auth.__firstlineno__`
    - `Auth.__init__()`
    - `Auth.__module__`
    - `Auth.__static_attributes__`
    - `Auth._abc_impl`
    - `Auth.add_method()`
    - `Auth.get_auth_ref()`
    - `Auth.get_cache_id_elements()`
  - `AuthConstructor`
    - `AuthConstructor.__abstractmethods__`
    - `AuthConstructor.__annotations_cache__`
    - `AuthConstructor.__doc__`
    - `AuthConstructor.__firstlineno__`
    - `AuthConstructor.__init__()`
    - `AuthConstructor.__module__`
    - `AuthConstructor.__static_attributes__`
    - `AuthConstructor._abc_impl`
    - `AuthConstructor._auth_method_class`
  - `AuthMethod`
    - `AuthMethod.__abstractmethods__`
    - `AuthMethod.__annotations_cache__`
    - `AuthMethod.__dict__`
    - `AuthMethod.__doc__`
    - `AuthMethod.__firstlineno__`
    - `AuthMethod.__init__()`
    - `AuthMethod.__module__`
    - `AuthMethod.__static_attributes__`
    - `AuthMethod.__weakref__`
    - `AuthMethod._abc_impl`
    - `AuthMethod._extract_kwargs()`
    - `AuthMethod._method_parameters`
    - `AuthMethod.get_auth_data()`
    - `AuthMethod.get_cache_id_elements()`
  - `BaseAuth`
    - `BaseAuth.__abstractmethods__`
    - `BaseAuth.__annotations_cache__`
    - `BaseAuth.__doc__`
    - `BaseAuth.__firstlineno__`
    - `BaseAuth.__init__()`
    - `BaseAuth.__module__`
    - `BaseAuth.__static_attributes__`
    - `BaseAuth._abc_impl`
    - `BaseAuth.auth_url`
    - `BaseAuth.has_scope_parameters`
    - `BaseAuth.token_url`
- keystoneauth1.identity.v3.federation module
  - `FederationBaseAuth`
    - `FederationBaseAuth.__abstractmethods__`
    - `FederationBaseAuth.__annotate_func__`
    - `FederationBaseAuth.__annotations_cache__`
    - `FederationBaseAuth.__doc__`
    - `FederationBaseAuth.__firstlineno__`
    - `FederationBaseAuth.__init__()`
    - `FederationBaseAuth.__module__`
    - `FederationBaseAuth.__static_attributes__`
    - `FederationBaseAuth._abc_impl`
    - `FederationBaseAuth.federated_token_url`
- keystoneauth1.identity.v3.k2k module
  - `Keystone2Keystone`
    - `Keystone2Keystone.HTTP_MOVED_TEMPORARILY`
    - `Keystone2Keystone.HTTP_SEE_OTHER`
    - `Keystone2Keystone.REQUEST_ECP_URL`
    - `Keystone2Keystone.__abstractmethods__`
    - `Keystone2Keystone.__annotate_func__`
    - `Keystone2Keystone.__annotations_cache__`
    - `Keystone2Keystone.__doc__`
    - `Keystone2Keystone.__firstlineno__`
    - `Keystone2Keystone.__init__()`
    - `Keystone2Keystone.__module__`
    - `Keystone2Keystone.__static_attributes__`
    - `Keystone2Keystone._abc_impl`
    - `Keystone2Keystone._get_ecp_assertion()`
    - `Keystone2Keystone._remote_auth_url()`
    - `Keystone2Keystone._send_service_provider_ecp_authn_response()`
    - `Keystone2Keystone.get_unscoped_auth_ref()`
- keystoneauth1.identity.v3.multi_factor module
  - `MultiFactor`
    - `MultiFactor.__abstractmethods__`
    - `MultiFactor.__annotate_func__`
    - `MultiFactor.__annotations_cache__`
    - `MultiFactor.__doc__`
    - `MultiFactor.__firstlineno__`
    - `MultiFactor.__init__()`
    - `MultiFactor.__module__`
    - `MultiFactor.__static_attributes__`
    - `MultiFactor._abc_impl`
- keystoneauth1.identity.v3.oauth2_client_credential module
  - `OAuth2ClientCredential`
    - `OAuth2ClientCredential.__abstractmethods__`
    - `OAuth2ClientCredential.__annotate_func__`
    - `OAuth2ClientCredential.__annotations_cache__`
    - `OAuth2ClientCredential.__doc__`
    - `OAuth2ClientCredential.__firstlineno__`
    - `OAuth2ClientCredential.__init__()`
    - `OAuth2ClientCredential.__module__`
    - `OAuth2ClientCredential.__static_attributes__`
    - `OAuth2ClientCredential._abc_impl`
    - `OAuth2ClientCredential._auth_method_class`
    - `OAuth2ClientCredential.get_headers()`
  - `OAuth2ClientCredentialMethod`
    - `OAuth2ClientCredentialMethod.__abstractmethods__`
    - `OAuth2ClientCredentialMethod.__annotations_cache__`
    - `OAuth2ClientCredentialMethod.__doc__`
    - `OAuth2ClientCredentialMethod.__firstlineno__`
    - `OAuth2ClientCredentialMethod.__init__()`
    - `OAuth2ClientCredentialMethod.__module__`
    - `OAuth2ClientCredentialMethod.__static_attributes__`
    - `OAuth2ClientCredentialMethod._abc_impl`
    - `OAuth2ClientCredentialMethod.get_auth_data()`
    - `OAuth2ClientCredentialMethod.get_cache_id_elements()`
    - `OAuth2ClientCredentialMethod.oauth2_client_id`
    - `OAuth2ClientCredentialMethod.oauth2_client_secret`
    - `OAuth2ClientCredentialMethod.oauth2_endpoint`
- keystoneauth1.identity.v3.oauth2_mtls_client_credential module
  - `OAuth2mTlsClientCredential`
    - `OAuth2mTlsClientCredential.__abstractmethods__`
    - `OAuth2mTlsClientCredential.__annotate_func__`
    - `OAuth2mTlsClientCredential.__annotations_cache__`
    - `OAuth2mTlsClientCredential.__doc__`
    - `OAuth2mTlsClientCredential.__firstlineno__`
    - `OAuth2mTlsClientCredential.__init__()`
    - `OAuth2mTlsClientCredential.__module__`
    - `OAuth2mTlsClientCredential.__static_attributes__`
    - `OAuth2mTlsClientCredential._abc_impl`
    - `OAuth2mTlsClientCredential.get_auth_ref()`
    - `OAuth2mTlsClientCredential.get_headers()`
- keystoneauth1.identity.v3.oidc module
  - `OidcAccessToken`
    - `OidcAccessToken.__abstractmethods__`
    - `OidcAccessToken.__annotate_func__`
    - `OidcAccessToken.__annotations_cache__`
    - `OidcAccessToken.__doc__`
    - `OidcAccessToken.__firstlineno__`
    - `OidcAccessToken.__init__()`
    - `OidcAccessToken.__module__`
    - `OidcAccessToken.__static_attributes__`
    - `OidcAccessToken._abc_impl`
    - `OidcAccessToken.get_payload()`
    - `OidcAccessToken.get_unscoped_auth_ref()`
  - `OidcAuthorizationCode`
    - `OidcAuthorizationCode.__abstractmethods__`
    - `OidcAuthorizationCode.__annotate_func__`
    - `OidcAuthorizationCode.__annotations_cache__`
    - `OidcAuthorizationCode.__doc__`
    - `OidcAuthorizationCode.__firstlineno__`
    - `OidcAuthorizationCode.__init__()`
    - `OidcAuthorizationCode.__module__`
    - `OidcAuthorizationCode.__static_attributes__`
    - `OidcAuthorizationCode._abc_impl`
    - `OidcAuthorizationCode.get_payload()`
    - `OidcAuthorizationCode.grant_type`
  - `OidcClientCredentials`
    - `OidcClientCredentials.__abstractmethods__`
    - `OidcClientCredentials.__annotate_func__`
    - `OidcClientCredentials.__annotations_cache__`
    - `OidcClientCredentials.__doc__`
    - `OidcClientCredentials.__firstlineno__`
    - `OidcClientCredentials.__init__()`
    - `OidcClientCredentials.__module__`
    - `OidcClientCredentials.__static_attributes__`
    - `OidcClientCredentials._abc_impl`
    - `OidcClientCredentials.get_payload()`
    - `OidcClientCredentials.grant_type`
  - `OidcPassword`
    - `OidcPassword.__abstractmethods__`
    - `OidcPassword.__annotate_func__`
    - `OidcPassword.__annotations_cache__`
    - `OidcPassword.__doc__`
    - `OidcPassword.__firstlineno__`
    - `OidcPassword.__init__()`
    - `OidcPassword.__module__`
    - `OidcPassword.__static_attributes__`
    - `OidcPassword._abc_impl`
    - `OidcPassword.get_payload()`
    - `OidcPassword.grant_type`
    - `OidcPassword.manage_otp_from_session_or_request_to_the_user()`
- keystoneauth1.identity.v3.password module
  - `Password`
    - `Password.__abstractmethods__`
    - `Password.__annotate_func__`
    - `Password.__annotations_cache__`
    - `Password.__doc__`
    - `Password.__firstlineno__`
    - `Password.__init__()`
    - `Password.__module__`
    - `Password.__static_attributes__`
    - `Password._abc_impl`
    - `Password._auth_method_class`
  - `PasswordMethod`
    - `PasswordMethod.__abstractmethods__`
    - `PasswordMethod.__annotations_cache__`
    - `PasswordMethod.__doc__`
    - `PasswordMethod.__firstlineno__`
    - `PasswordMethod.__init__()`
    - `PasswordMethod.__module__`
    - `PasswordMethod.__static_attributes__`
    - `PasswordMethod._abc_impl`
    - `PasswordMethod.get_auth_data()`
    - `PasswordMethod.get_cache_id_elements()`
    - `PasswordMethod.password`
    - `PasswordMethod.user_domain_id`
    - `PasswordMethod.user_domain_name`
    - `PasswordMethod.user_id`
    - `PasswordMethod.username`
- keystoneauth1.identity.v3.receipt module
  - `ReceiptMethod`
    - `ReceiptMethod.__abstractmethods__`
    - `ReceiptMethod.__annotate_func__`
    - `ReceiptMethod.__annotations_cache__`
    - `ReceiptMethod.__doc__`
    - `ReceiptMethod.__firstlineno__`
    - `ReceiptMethod.__init__()`
    - `ReceiptMethod.__module__`
    - `ReceiptMethod.__static_attributes__`
    - `ReceiptMethod._abc_impl`
    - `ReceiptMethod.get_auth_data()`
    - `ReceiptMethod.get_cache_id_elements()`
    - `ReceiptMethod.receipt`
- keystoneauth1.identity.v3.token module
  - `Token`
    - `Token.__abstractmethods__`
    - `Token.__annotate_func__`
    - `Token.__annotations_cache__`
    - `Token.__doc__`
    - `Token.__firstlineno__`
    - `Token.__init__()`
    - `Token.__module__`
    - `Token.__static_attributes__`
    - `Token._abc_impl`
    - `Token._auth_method_class`
  - `TokenMethod`
    - `TokenMethod.__abstractmethods__`
    - `TokenMethod.__annotations_cache__`
    - `TokenMethod.__doc__`
    - `TokenMethod.__firstlineno__`
    - `TokenMethod.__init__()`
    - `TokenMethod.__module__`
    - `TokenMethod.__static_attributes__`
    - `TokenMethod._abc_impl`
    - `TokenMethod.get_auth_data()`
    - `TokenMethod.get_cache_id_elements()`
    - `TokenMethod.token`
- keystoneauth1.identity.v3.tokenless_auth module
  - `TokenlessAuth`
    - `TokenlessAuth.__abstractmethods__`
    - `TokenlessAuth.__annotate_func__`
    - `TokenlessAuth.__annotations_cache__`
    - `TokenlessAuth.__doc__`
    - `TokenlessAuth.__firstlineno__`
    - `TokenlessAuth.__init__()`
    - `TokenlessAuth.__module__`
    - `TokenlessAuth.__static_attributes__`
    - `TokenlessAuth._abc_impl`
    - `TokenlessAuth.get_endpoint()`
    - `TokenlessAuth.get_headers()`
- keystoneauth1.identity.v3.totp module
  - `TOTP`
    - `TOTP.__abstractmethods__`
    - `TOTP.__annotate_func__`
    - `TOTP.__annotations_cache__`
    - `TOTP.__doc__`
    - `TOTP.__firstlineno__`
    - `TOTP.__init__()`
    - `TOTP.__module__`
    - `TOTP.__static_attributes__`
    - `TOTP._abc_impl`
    - `TOTP._auth_method_class`
  - `TOTPMethod`
    - `TOTPMethod.__abstractmethods__`
    - `TOTPMethod.__annotations_cache__`
    - `TOTPMethod.__doc__`
    - `TOTPMethod.__firstlineno__`
    - `TOTPMethod.__init__()`
    - `TOTPMethod.__module__`
    - `TOTPMethod.__static_attributes__`
    - `TOTPMethod._abc_impl`
    - `TOTPMethod.get_auth_data()`
    - `TOTPMethod.get_cache_id_elements()`
    - `TOTPMethod.passcode`
    - `TOTPMethod.user_domain_id`
    - `TOTPMethod.user_domain_name`
    - `TOTPMethod.user_id`
    - `TOTPMethod.username`

## Module contents

class keystoneauth1.identity.v3.ApplicationCredential(auth_url: str, application_credential_secret: str, application_credential_id: str | None = None, application_credential_name: str | None = None, user_id: str | None = None, username: str | None = None, user_domain_id: str | None = None, user_domain_name: str | None = None, *, unscoped: bool = False, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True)

  Bases: `Auth`

  A plugin for authenticating with an application credential.

  Parameters:

    - auth_url (string) – Identity service endpoint for authentication.

    - application_credential_secret (string) – Application credential secret.

    - application_credential_id (string) – Application credential ID.

    - application_credential_name (string) – Application credential name.

    - username (string) – Username for authentication.

    - user_id (string) – User ID for authentication.

    - user_domain_id (string) – User’s domain ID for authentication.

    - user_domain_name (string) – User’s domain name for authentication.

    - reauthenticate (bool) – Allow fetching a new token if the current one is going to expire. (optional) default True

  __abstractmethods__ = frozenset({})
  __annotate_func__ = None
  __annotations_cache__ = {}
  __doc__ = "A plugin for authenticating with an application credential.\n\n:param string auth_url: Identity service endpoint for authentication.\n:param string application_credential_secret: Application credential secret.\n:param string application_credential_id: Application credential ID.\n:param string application_credential_name: Application credential name.\n:param string username: Username for authentication.\n:param string user_id: User ID for authentication.\n:param string user_domain_id: User's domain ID for authentication.\n:param string user_domain_name: User's domain name for authentication.\n:param bool reauthenticate: Allow fetching a new token if the current one\n is going to expire. (optional) default True\n"
  __firstlineno__ = 118
  __init__(auth_url: str, application_credential_secret: str, application_credential_id: str | None = None, application_credential_name: str | None = None, user_id: str | None = None, username: str | None = None, user_domain_id: str | None = None, user_domain_name: str | None = None, *, unscoped: bool = False, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True) → None
  __module__ = 'keystoneauth1.identity.v3.application_credential'
  __static_attributes__ = ()
  _abc_impl = <_abc._abc_data object>
  _auth_method_class

    alias of `ApplicationCredentialMethod`

class keystoneauth1.identity.v3.ApplicationCredentialMethod(*, application_credential_secret: str, application_credential_id: str | None = None, application_credential_name: str | None = None, user_id: str | None = None, username: str | None = None, user_domain_id: str | None = None, user_domain_name: str | None = None)

  Bases: `AuthMethod`

  Construct a User/Passcode based authentication method.

  Parameters:

    - application_credential_secret (string) – Application credential secret.

    - application_credential_id (string) – Application credential id.

    - application_credential_name (string) – The name of the application credential, if an ID is not provided.

    - username (string) – Username for authentication, if an application credential ID is not provided.

    - user_id (string) – User ID for authentication, if an application credential ID is not provided.

    - user_domain_id (string) – User’s domain ID for authentication, if an application credential ID is not provided.

    - user_domain_name (string) – User’s domain name for authentication, if an application credential ID is not provided.

  __abstractmethods__ = frozenset({})
  __annotations_cache__ = {'application_credential_id': str | None, 'application_credential_name': str | None, 'application_credential_secret': <class 'str'>, 'user_domain_id': str | None, 'user_domain_name': str | None, 'user_id': str | None, 'username': str | None}
  __doc__ = "Construct a User/Passcode based authentication method.\n\n:param string application_credential_secret: Application credential secret.\n:param string application_credential_id: Application credential id.\n:param string application_credential_name: The name of the application\n credential, if an ID is not\n provided.\n:param string username: Username for authentication, if an application\n credential ID is not provided.\n:param string user_id: User ID for authentication, if an application\n credential ID is not provided.\n:param string user_domain_id: User's domain ID for authentication, if an\n application credential ID is not provided.\n:param string user_domain_name: User's domain name for authentication, if\n an application credential ID is not\n provided.\n"
  __firstlineno__ = 24
  __init__(*, application_credential_secret: str, application_credential_id: str | None = None, application_credential_name: str | None = None, user_id: str | None = None, username: str | None = None, user_domain_id: str | None = None, user_domain_name: str | None = None) → None
  __module__ = 'keystoneauth1.identity.v3.application_credential'
  __static_attributes__ = ('application_credential_id', 'application_credential_name', 'application_credential_secret', 'user_domain_id', 'user_domain_name', 'user_id', 'username')
  _abc_impl = <_abc._abc_data object>
  application_credential_id: str | None = None
  application_credential_name: str | None = None
  application_credential_secret: str
  get_auth_data(session: Session, auth: Auth, headers: dict[str, str], request_kwargs: dict[str, object]) → tuple[None, None] | tuple[str, Mapping[str, object]]

    Return the authentication section of an auth plugin.

    Parameters:

      - session (keystoneauth1.session.Session) – The communication session.

      - auth (base.Auth) – The auth plugin calling the method.

      - headers (dict) – The headers that will be sent with the auth request if a plugin needs to add to them.

    Returns:

      The identifier of this plugin and a dict of authentication data for the auth type.

    Return type:

      tuple(string, dict)

  get_cache_id_elements() → dict[str, str | None]

    Get the elements for this auth method that make it unique.

    These elements will be used as part of the `keystoneauth1.plugin.BaseIdentityPlugin.get_cache_id()` to allow caching of the auth plugin.

    Plugins should override this if they want to allow caching of their state.

    To avoid collision or overrides the keys of the returned dictionary should be prefixed with the plugin identifier. For example the password plugin returns its username value as ‘password_username’.

  user_domain_id: str | None = None
  user_domain_name: str | None = None
  user_id: str | None = None
  username: str | None = None

class keystoneauth1.identity.v3.Auth(auth_url: str, auth_methods: list[AuthMethod], *, unscoped: bool = False, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True)

  Bases: `BaseAuth`

  Identity V3 Authentication Plugin.

  Parameters:

    - auth_url (string) – Identity service endpoint for authentication.

    - auth_methods (list) – A collection of methods to authenticate with.

    - trust_id (string) – Trust ID for trust scoping.

    - domain_id (string) – Domain ID for domain scoping.

    - domain_name (string) – Domain name for domain scoping.

    - project_id (string) – Project ID for project scoping.

    - project_name (string) – Project name for project scoping.

    - project_domain_id (string) – Project’s domain ID for project.

    - project_domain_name (string) – Project’s domain name for project.

    - reauthenticate (bool) – Allow fetching a new token if the current one is going to expire. (optional) default True

    - include_catalog (bool) – Include the service catalog in the returned token. (optional) default True.

    - unscoped (bool) – Force the return of an unscoped token. This will make the keystone server return an unscoped token even if a default_project_id is set for this user.

  __abstractmethods__ = frozenset({})
  __annotate_func__ = None
  __annotations_cache__ = {}
  __doc__ = "Identity V3 Authentication Plugin.\n\n:param string auth_url: Identity service endpoint for authentication.\n:param list auth_methods: A collection of methods to authenticate with.\n:param string trust_id: Trust ID for trust scoping.\n:param string domain_id: Domain ID for domain scoping.\n:param string domain_name: Domain name for domain scoping.\n:param string project_id: Project ID for project scoping.\n:param string project_name: Project name for project scoping.\n:param string project_domain_id: Project's domain ID for project.\n:param string project_domain_name: Project's domain name for project.\n:param bool reauthenticate: Allow fetching a new token if the current one\n is going to expire. (optional) default True\n:param bool include_catalog: Include the service catalog in the returned\n token. (optional) default True.\n:param bool unscoped: Force the return of an unscoped token. This will make\n the keystone server return an unscoped token even if\n a default_project_id is set for this user.\n"
  __firstlineno__ = 105
  __init__(auth_url: str, auth_methods: list[AuthMethod], *, unscoped: bool = False, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True)
  __module__ = 'keystoneauth1.identity.v3.base'
  __static_attributes__ = ('auth_methods', 'unscoped')
  _abc_impl = <_abc._abc_data object>
  add_method(method: AuthMethod) → None

    Add an additional initialized AuthMethod instance.

  get_auth_ref(session: Session) → AccessInfoV3

    Obtain a token from an OpenStack Identity Service.

    This method is overridden by the various token version plugins.

    This function should not be called independently and is expected to be invoked via the do_authenticate function.

    This function will be invoked if the AcessInfo object cached by the plugin is not valid. Thus plugins should always fetch a new AccessInfo when invoked. If you are looking to just retrieve the current auth data then you should use get_access.

    Parameters:

      session (keystoneauth1.session.Session) – A session object that can be used for communication.

    Raises:

      - keystoneauth1.exceptions.response.InvalidResponse – The response returned wasn’t appropriate.

      - keystoneauth1.exceptions.http.HttpError – An error from an invalid HTTP response.

    Returns:

      Token access information.

    Return type:

      `keystoneauth1.access.AccessInfo`

  get_cache_id_elements() → dict[str, str | None]

    Get the elements for this auth plugin that make it unique.

    As part of the get_cache_id requirement we need to determine what aspects of this plugin and its values that make up the unique elements.

    This should be overridden by plugins that wish to allow caching.

    Returns:

      The unique attributes and values of this plugin.

    Return type:

      A flat dict with a str key and str or None value. This is required as we feed these values into a hash. Pairs where the value is None are ignored in the hashed id.

class keystoneauth1.identity.v3.AuthConstructor(auth_url: str, *args: Any, unscoped: bool = False, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True, **kwargs: Any)

  Bases: `Auth`

  Abstract base class for creating an Auth Plugin.

  The Auth Plugin created contains only one authentication method. This is generally the required usage.

  An AuthConstructor creates an AuthMethod based on the method’s arguments and the auth_method_class defined by the plugin. It then creates the auth plugin with only that authentication method.

  __abstractmethods__ = frozenset({})
  __annotations_cache__ = {'_auth_method_class': typing.ClassVar[type[keystoneauth1.identity.v3.base.AuthMethod]]}
  __doc__ = "Abstract base class for creating an Auth Plugin.\n\nThe Auth Plugin created contains only one authentication method. This\nis generally the required usage.\n\nAn AuthConstructor creates an AuthMethod based on the method's\narguments and the auth_method_class defined by the plugin. It then\ncreates the auth plugin with only that authentication method.\n"
  __firstlineno__ = 368
  __init__(auth_url: str, *args: Any, unscoped: bool = False, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True, **kwargs: Any)
  __module__ = 'keystoneauth1.identity.v3.base'
  __static_attributes__ = ()
  _abc_impl = <_abc._abc_data object>
  _auth_method_class: ClassVar[type[AuthMethod]]

class keystoneauth1.identity.v3.AuthMethod(**kwargs: object)

  Bases: `object`

  One part of a V3 Authentication strategy.

  The v3 ‘/tokens’ API allow multiple methods to be presented when authentication against the server. Each one of these methods is implemented by an AuthMethod.

  Note: When implementing an AuthMethod use keyword arguments to ensure they are supported by the MultiFactor auth plugin.

  __abstractmethods__ = frozenset({'get_auth_data'})
  __annotations_cache__ = {'_method_parameters': list[str] | None}
  __dict__ = mappingproxy({'__module__': 'keystoneauth1.identity.v3.base', '__firstlineno__': 286, '__doc__': "One part of a V3 Authentication strategy.\n\nThe v3 '/tokens' API allow multiple methods to be presented when\nauthentication against the server. Each one of these methods is implemented\nby an AuthMethod.\n\nNote: When implementing an AuthMethod use keyword arguments to ensure they\nare supported by the MultiFactor auth plugin.\n", '_method_parameters': None, '__init__': <function AuthMethod.__init__>, '_extract_kwargs': <classmethod(<function AuthMethod._extract_kwargs>)>, 'get_auth_data': <function AuthMethod.get_auth_data>, 'get_cache_id_elements': <function AuthMethod.get_cache_id_elements>, '__static_attributes__': (), '__dict__': <attribute '__dict__' of 'AuthMethod' objects>, '__weakref__': <attribute '__weakref__' of 'AuthMethod' objects>, '__abstractmethods__': frozenset({'get_auth_data'}), '_abc_impl': <_abc._abc_data object>, '__annotations_cache__': {'_method_parameters': list[str] | None}})
  __doc__ = "One part of a V3 Authentication strategy.\n\nThe v3 '/tokens' API allow multiple methods to be presented when\nauthentication against the server. Each one of these methods is implemented\nby an AuthMethod.\n\nNote: When implementing an AuthMethod use keyword arguments to ensure they\nare supported by the MultiFactor auth plugin.\n"
  __firstlineno__ = 286
  __init__(**kwargs: object)
  __module__ = 'keystoneauth1.identity.v3.base'
  __static_attributes__ = ()
  __weakref__

    list of weak references to the object

  _abc_impl = <_abc._abc_data object>
  classmethod _extract_kwargs(kwargs: dict[str, object]) → dict[str, object]

    Remove parameters related to this method from other kwargs.

  _method_parameters: list[str] | None = None

    Deprecated parameter for defining the parameters supported by the plugin. These should now be defined by typed class attributes.

  abstractmethod get_auth_data(session: Session, auth: Auth, headers: dict[str, str], request_kwargs: dict[str, object]) → tuple[None, None] | tuple[str, Mapping[str, object]]

    Return the authentication section of an auth plugin.

    Parameters:

      - session (keystoneauth1.session.Session) – The communication session.

      - auth (base.Auth) – The auth plugin calling the method.

      - headers (dict) – The headers that will be sent with the auth request if a plugin needs to add to them.

    Returns:

      The identifier of this plugin and a dict of authentication data for the auth type.

    Return type:

      tuple(string, dict)

  get_cache_id_elements() → dict[str, str | None]

    Get the elements for this auth method that make it unique.

    These elements will be used as part of the `keystoneauth1.plugin.BaseIdentityPlugin.get_cache_id()` to allow caching of the auth plugin.

    Plugins should override this if they want to allow caching of their state.

    To avoid collision or overrides the keys of the returned dictionary should be prefixed with the plugin identifier. For example the password plugin returns its username value as ‘password_username’.

class keystoneauth1.identity.v3.BaseAuth(auth_url: str, *, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True)

  Bases: `BaseIdentityPlugin`

  Identity V3 Authentication Plugin.

  Parameters:

    - auth_url (string) – Identity service endpoint for authentication.

    - trust_id (string) – Trust ID for trust scoping.

    - system_scope (string) – System information to scope to.

    - domain_id (string) – Domain ID for domain scoping.

    - domain_name (string) – Domain name for domain scoping.

    - project_id (string) – Project ID for project scoping.

    - project_name (string) – Project name for project scoping.

    - project_domain_id (string) – Project’s domain ID for project.

    - project_domain_name (string) – Project’s domain name for project.

    - reauthenticate (bool) – Allow fetching a new token if the current one is going to expire. (optional) default True

    - include_catalog (bool) – Include the service catalog in the returned token. (optional) default True.

  __abstractmethods__ = frozenset({'get_auth_ref'})
  __annotations_cache__ = {'auth_url': <class 'str'>}
  __doc__ = "Identity V3 Authentication Plugin.\n\n:param string auth_url: Identity service endpoint for authentication.\n:param string trust_id: Trust ID for trust scoping.\n:param string system_scope: System information to scope to.\n:param string domain_id: Domain ID for domain scoping.\n:param string domain_name: Domain name for domain scoping.\n:param string project_id: Project ID for project scoping.\n:param string project_name: Project name for project scoping.\n:param string project_domain_id: Project's domain ID for project.\n:param string project_domain_name: Project's domain name for project.\n:param bool reauthenticate: Allow fetching a new token if the current one\n is going to expire. (optional) default True\n:param bool include_catalog: Include the service catalog in the returned\n token. (optional) default True.\n"
  __firstlineno__ = 31
  __init__(auth_url: str, *, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True)
  __module__ = 'keystoneauth1.identity.v3.base'
  __static_attributes__ = ('domain_id', 'domain_name', 'include_catalog', 'project_domain_id', 'project_domain_name', 'project_id', 'project_name', 'system_scope', 'trust_id')
  _abc_impl = <_abc._abc_data object>
  auth_url: str
  property has_scope_parameters: bool

    Return true if parameters can be used to create a scoped token.

  property token_url: str

    The full URL where we will send authentication data.

class keystoneauth1.identity.v3.FederationBaseAuth(auth_url: str, identity_provider: str, protocol: str, *, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True)

  Bases: `_Rescoped`

  Federation authentication plugin.

  Parameters:

    - auth_url (string) – URL of the Identity Service

    - identity_provider (string) – name of the Identity Provider the client will authenticate against. This parameter will be used to build a dynamic URL used to obtain unscoped OpenStack token.

    - protocol (string) – name of the protocol the client will authenticate against.

  __abstractmethods__ = frozenset({'get_unscoped_auth_ref'})
  __annotate_func__ = None
  __annotations_cache__ = {}
  __doc__ = 'Federation authentication plugin.\n\n:param auth_url: URL of the Identity Service\n:type auth_url: string\n:param identity_provider: name of the Identity Provider the client\n will authenticate against. This parameter\n will be used to build a dynamic URL used to\n obtain unscoped OpenStack token.\n:type identity_provider: string\n:param protocol: name of the protocol the client will authenticate\n against.\n:type protocol: string\n\n'
  __firstlineno__ = 94
  __init__(auth_url: str, identity_provider: str, protocol: str, *, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True)
  __module__ = 'keystoneauth1.identity.v3.federation'
  __static_attributes__ = ('identity_provider', 'protocol')
  _abc_impl = <_abc._abc_data object>
  property federated_token_url: str

    Full URL where authorization data is sent.

class keystoneauth1.identity.v3.Keystone2Keystone(base_plugin: BaseIdentityPlugin, service_provider: str, *, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True)

  Bases: `_Rescoped`

  Plugin to execute the Keystone to Keyestone authentication flow.

  In this plugin, an ECP wrapped SAML assertion provided by a keystone Identity Provider (IdP) is used to request an OpenStack unscoped token from a keystone Service Provider (SP).

  Parameters:

    - base_plugin (keystoneauth1.identity.v3.base.BaseAuth) – Auth plugin already authenticated against the keystone IdP.

    - service_provider (str) – The Service Provider ID as returned by ServiceProviderManager.list()

  HTTP_MOVED_TEMPORARILY = 302
  HTTP_SEE_OTHER = 303
  REQUEST_ECP_URL = '/auth/OS-FEDERATION/saml2/ecp'

    Path where the ECP wrapped SAML assertion should be presented to the Keystone Service Provider.

  __abstractmethods__ = frozenset({})
  __annotate_func__ = None
  __annotations_cache__ = {}
  __doc__ = 'Plugin to execute the Keystone to Keyestone authentication flow.\n\nIn this plugin, an ECP wrapped SAML assertion provided by a keystone\nIdentity Provider (IdP) is used to request an OpenStack unscoped token\nfrom a keystone Service Provider (SP).\n\n:param base_plugin: Auth plugin already authenticated against the keystone\n IdP.\n:type base_plugin: keystoneauth1.identity.v3.base.BaseAuth\n\n:param service_provider: The Service Provider ID as returned by\n ServiceProviderManager.list()\n:type service_provider: str\n\n'
  __firstlineno__ = 26
  __init__(base_plugin: BaseIdentityPlugin, service_provider: str, *, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True)
  __module__ = 'keystoneauth1.identity.v3.k2k'
  __static_attributes__ = ('_local_cloud_plugin', '_sp_id', 'auth_url')
  _abc_impl = <_abc._abc_data object>
  _get_ecp_assertion(session: Session) → str
  classmethod _remote_auth_url(auth_url: str) → str

    Return auth_url of the remote Keystone Service Provider.

    Remote cloud’s auth_url is an endpoint for getting federated unscoped token, typically that would be `https://remote.example.com:5000/v3/OS-FEDERATION/identity_providers/ <idp>/protocols/<protocol_id>/auth`. However we need to generate a real auth_url, used for token scoping. This function assumes there are static values today in the remote auth_url stored in the Service Provider attribute and those can be used as a delimiter. If the sp_auth_url doesn’t comply with standard federation auth url the function will simply return whole string.

    Parameters:

      auth_url (str) – auth_url of the remote cloud

    Returns:

      auth_url of remote cloud where a token can be validated or scoped.

    Return type:

      str

  _send_service_provider_ecp_authn_response(session: Session, sp_url: str, sp_auth_url: str) → Response

    Present ECP wrapped SAML assertion to the keystone SP.

    The assertion is issued by the keystone IdP and it is targeted to the keystone that will serve as Service Provider.

    Parameters:

      - session – a session object to send out HTTP requests.

      - sp_url (str) – URL where the ECP wrapped SAML assertion will be presented to the keystone SP. Usually, something like: https://sp.com/Shibboleth.sso/SAML2/ECP

      - sp_auth_url (str) – Federated authentication URL of the keystone SP. It is specified by IdP, for example: https://sp.com/v3/OS-FEDERATION/identity_providers/ idp_id/protocols/protocol_id/auth

  get_unscoped_auth_ref(session: Session) → AccessInfoV3

    Fetch unscoped federated token.

class keystoneauth1.identity.v3.MultiFactor(auth_url: str, auth_methods: list[str], *, unscoped: bool = False, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True, **kwargs: Any)

  Bases: `Auth`

  A plugin for authenticating with multiple auth methods.

  Parameters:

    - auth_url (string) – Identity service endpoint for authentication.

    - auth_methods (string) – names of the methods to authenticate with.

    - trust_id (string) – Trust ID for trust scoping.

    - system_scope (string) – System information to scope to.

    - domain_id (string) – Domain ID for domain scoping.

    - domain_name (string) – Domain name for domain scoping.

    - project_id (string) – Project ID for project scoping.

    - project_name (string) – Project name for project scoping.

    - project_domain_id (string) – Project’s domain ID for project.

    - project_domain_name (string) – Project’s domain name for project.

    - reauthenticate (bool) – Allow fetching a new token if the current one is going to expire. (optional) default True

  Also accepts various keyword args based on which methods are specified.

  __abstractmethods__ = frozenset({})
  __annotate_func__ = None
  __annotations_cache__ = {}
  __doc__ = "A plugin for authenticating with multiple auth methods.\n\n:param string auth_url: Identity service endpoint for authentication.\n:param string auth_methods: names of the methods to authenticate with.\n:param string trust_id: Trust ID for trust scoping.\n:param string system_scope: System information to scope to.\n:param string domain_id: Domain ID for domain scoping.\n:param string domain_name: Domain name for domain scoping.\n:param string project_id: Project ID for project scoping.\n:param string project_name: Project name for project scoping.\n:param string project_domain_id: Project's domain ID for project.\n:param string project_domain_name: Project's domain name for project.\n:param bool reauthenticate: Allow fetching a new token if the current one\n is going to expire. (optional) default True\n\nAlso accepts various keyword args based on which methods are specified.\n"
  __firstlineno__ = 23
  __init__(auth_url: str, auth_methods: list[str], *, unscoped: bool = False, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True, **kwargs: Any)
  __module__ = 'keystoneauth1.identity.v3.multi_factor'
  __static_attributes__ = ()
  _abc_impl = <_abc._abc_data object>

class keystoneauth1.identity.v3.OAuth2ClientCredential(auth_url: str, oauth2_endpoint: str, oauth2_client_id: str, oauth2_client_secret: str, *, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True)

  Bases: `Auth`

  A plugin for authenticating via an OAuth2.0 client credential.

  Parameters:

    - auth_url (string) – Identity service endpoint for authentication.

    - oauth2_endpoint (string) – OAuth2.0 endpoint.

    - oauth2_client_id (string) – OAuth2.0 client credential id.

    - oauth2_client_secret (string) – OAuth2.0 client credential secret.

  __abstractmethods__ = frozenset({})
  __annotate_func__ = None
  __annotations_cache__ = {}
  __doc__ = 'A plugin for authenticating via an OAuth2.0 client credential.\n\n:param string auth_url: Identity service endpoint for authentication.\n:param string oauth2_endpoint: OAuth2.0 endpoint.\n:param string oauth2_client_id: OAuth2.0 client credential id.\n:param string oauth2_client_secret: OAuth2.0 client credential secret.\n'
  __firstlineno__ = 96
  __init__(auth_url: str, oauth2_endpoint: str, oauth2_client_id: str, oauth2_client_secret: str, *, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True) → None
  __module__ = 'keystoneauth1.identity.v3.oauth2_client_credential'
  __static_attributes__ = ('oauth2_client_id', 'oauth2_client_secret', 'oauth2_endpoint')
  _abc_impl = <_abc._abc_data object>
  _auth_method_class

    alias of `OAuth2ClientCredentialMethod`

  get_headers(session: Session) → dict[str, str] | None

    Fetch authentication headers for message.

    Parameters:

      session (keystoneauth1.session.Session) – The session object that the auth_plugin belongs to.

    Returns:

      Headers that are set to authenticate a message or None for failure. Note that when checking this value that the empty dict is a valid, non-failure response.

    Return type:

      dict

class keystoneauth1.identity.v3.OAuth2ClientCredentialMethod(*, oauth2_endpoint: str, oauth2_client_id: str, oauth2_client_secret: str)

  Bases: `AuthMethod`

  An auth method to fetch a token via an OAuth2.0 client credential.

  Parameters:

    - oauth2_endpoint (string) – OAuth2.0 endpoint.

    - oauth2_client_id (string) – OAuth2.0 client credential id.

    - oauth2_client_secret (string) – OAuth2.0 client credential secret.

  __abstractmethods__ = frozenset({})
  __annotations_cache__ = {'oauth2_client_id': <class 'str'>, 'oauth2_client_secret': <class 'str'>, 'oauth2_endpoint': <class 'str'>}
  __doc__ = 'An auth method to fetch a token via an OAuth2.0 client credential.\n\n:param string oauth2_endpoint: OAuth2.0 endpoint.\n:param string oauth2_client_id: OAuth2.0 client credential id.\n:param string oauth2_client_secret: OAuth2.0 client credential secret.\n'
  __firstlineno__ = 26
  __init__(*, oauth2_endpoint: str, oauth2_client_id: str, oauth2_client_secret: str) → None
  __module__ = 'keystoneauth1.identity.v3.oauth2_client_credential'
  __static_attributes__ = ('oauth2_client_id', 'oauth2_client_secret', 'oauth2_endpoint')
  _abc_impl = <_abc._abc_data object>
  get_auth_data(session: Session, auth: Auth, headers: dict[str, str], request_kwargs: dict[str, object]) → tuple[None, None] | tuple[str, Mapping[str, object]]

    Return the authentication section of an auth plugin.

    Parameters:

      - session (keystoneauth1.session.Session) – The communication session.

      - auth (base.Auth) – The auth plugin calling the method.

      - headers (dict) – The headers that will be sent with the auth request if a plugin needs to add to them.

    Returns:

      The identifier of this plugin and a dict of authentication data for the auth type.

    Return type:

      tuple(string, dict)

  get_cache_id_elements() → dict[str, str | None]

    Get the elements for this auth method that make it unique.

    These elements will be used as part of the `keystoneauth1.plugin.BaseIdentityPlugin.get_cache_id()` to allow caching of the auth plugin.

    Plugins should override this if they want to allow caching of their state.

    To avoid collision or overrides the keys of the returned dictionary should be prefixed with the plugin identifier. For example the password plugin returns its username value as ‘password_username’.

  oauth2_client_id: str
  oauth2_client_secret: str
  oauth2_endpoint: str

class keystoneauth1.identity.v3.OAuth2mTlsClientCredential(auth_url: str, oauth2_endpoint: str, oauth2_client_id: str, *, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True)

  Bases: `BaseAuth`

  A plugin for authenticating via an OAuth2.0 mTLS client credential.

  Parameters:

    - auth_url (string) – keystone authorization endpoint.

    - oauth2_endpoint (string) – OAuth2.0 endpoint.

    - oauth2_client_id (string) – OAuth2.0 client credential id.

  __abstractmethods__ = frozenset({})
  __annotate_func__ = None
  __annotations_cache__ = {}
  __doc__ = 'A plugin for authenticating via an OAuth2.0 mTLS client credential.\n\n:param string auth_url: keystone authorization endpoint.\n:param string oauth2_endpoint: OAuth2.0 endpoint.\n:param string oauth2_client_id: OAuth2.0 client credential id.\n'
  __firstlineno__ = 23
  __init__(auth_url: str, oauth2_endpoint: str, oauth2_client_id: str, *, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True)
  __module__ = 'keystoneauth1.identity.v3.oauth2_mtls_client_credential'
  __static_attributes__ = ('oauth2_access_token', 'oauth2_client_id', 'oauth2_endpoint')
  _abc_impl = <_abc._abc_data object>
  get_auth_ref(session: Session) → AccessInfoV3

    Obtain a token from an OpenStack Identity Service.

    This method is overridden by the various token version plugins.

    This function should not be called independently and is expected to be invoked via the do_authenticate function.

    This function will be invoked if the AcessInfo object cached by the plugin is not valid. Thus plugins should always fetch a new AccessInfo when invoked. If you are looking to just retrieve the current auth data then you should use get_access.

    Parameters:

      session (keystoneauth1.session.Session) – A session object that can be used for communication.

    Raises:

      - keystoneauth1.exceptions.response.InvalidResponse – The response returned wasn’t appropriate.

      - keystoneauth1.exceptions.http.HttpError – An error from an invalid HTTP response.

      - keystoneauth1.exceptions.ClientException – An error from getting OAuth2.0 access token.

    Returns:

      Token access information.

    Return type:

      `keystoneauth1.access.AccessInfo`

  get_headers(session: Session) → dict[str, str] | None

    Fetch authentication headers for message.

    Parameters:

      session (keystoneauth1.session.Session) – The session object that the auth_plugin belongs to.

    Returns:

      Headers that are set to authenticate a message or None for failure. Note that when checking this value that the empty dict is a valid, non-failure response.

    Return type:

      dict

class keystoneauth1.identity.v3.OidcAccessToken(auth_url: str, identity_provider: str, protocol: str, access_token_type: str = 'access_token', scope: str = 'openid profile', access_token_endpoint: str | None = None, discovery_endpoint: str | None = None, access_token: str | None = None, *, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True)

  Bases: `_OidcBase`

  Implementation for OpenID Connect access token reuse.

  __abstractmethods__ = frozenset({})
  __annotate_func__ = None
  __annotations_cache__ = {}
  __doc__ = 'Implementation for OpenID Connect access token reuse.'
  __firstlineno__ = 645
  __init__(auth_url: str, identity_provider: str, protocol: str, access_token_type: str = 'access_token', scope: str = 'openid profile', access_token_endpoint: str | None = None, discovery_endpoint: str | None = None, access_token: str | None = None, *, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True)

    The OpenID Connect plugin based on the Access Token.

    It expects the following:

    Parameters:

      - auth_url (string) – URL of the Identity Service

      - identity_provider (string) – Name of the Identity Provider the client will authenticate against

      - protocol (string) – Protocol name as configured in keystone

      - access_token (string) – OpenID Connect Access token

  __module__ = 'keystoneauth1.identity.v3.oidc'
  __static_attributes__ = ('access_token',)
  _abc_impl = <_abc._abc_data object>
  get_payload(session: Session) → dict[str, str | None]

    OidcAccessToken does not require a payload.

  get_unscoped_auth_ref(session: Session) → AccessInfoV3

    Authenticate with OpenID Connect and get back claims.

    We exchange the access token upon accessing the protected Keystone endpoint (federated auth URL). This will trigger the OpenID Connect Provider to perform a user introspection and retrieve information (specified in the scope) about the user in the form of an OpenID Connect Claim. These claims will be sent to Keystone in the form of environment variables.

    Parameters:

      session (keystoneauth1.session.Session) – a session object to send out HTTP requests.

    Returns:

      a token data representation

    Return type:

      `keystoneauth1.access.AccessInfoV3`

class keystoneauth1.identity.v3.OidcAuthorizationCode(auth_url: str, identity_provider: str, protocol: str, client_id: str, client_secret: str, access_token_type: str = 'access_token', scope: str = 'openid profile', access_token_endpoint: str | None = None, discovery_endpoint: str | None = None, code: str | None = None, *, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True, redirect_uri: str | None = None)

  Bases: `_OidcBase`

  Implementation for OpenID Connect Authorization Code.

  __abstractmethods__ = frozenset({})
  __annotate_func__ = None
  __annotations_cache__ = {}
  __doc__ = 'Implementation for OpenID Connect Authorization Code.'
  __firstlineno__ = 566
  __init__(auth_url: str, identity_provider: str, protocol: str, client_id: str, client_secret: str, access_token_type: str = 'access_token', scope: str = 'openid profile', access_token_endpoint: str | None = None, discovery_endpoint: str | None = None, code: str | None = None, *, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True, redirect_uri: str | None = None)

    The OpenID Authorization Code plugin expects the following.

    Parameters:

      - redirect_uri (string) – OpenID Connect Client Redirect URL

      - code (string) – OAuth 2.0 Authorization Code

  __module__ = 'keystoneauth1.identity.v3.oidc'
  __static_attributes__ = ('code', 'redirect_uri')
  _abc_impl = <_abc._abc_data object>
  get_payload(session: Session) → dict[str, str | None]

    Get an authorization grant for the “authorization_code” grant type.

    Parameters:

      session (keystoneauth1.session.Session) – a session object to send out HTTP requests.

    Returns:

      a python dictionary containing the payload to be exchanged

    Return type:

      dict

  grant_type: ClassVar[str] = 'authorization_code'

class keystoneauth1.identity.v3.OidcClientCredentials(auth_url: str, identity_provider: str, protocol: str, client_id: str, client_secret: str, access_token_type: str = 'access_token', scope: str = 'openid profile', access_token_endpoint: str | None = None, discovery_endpoint: str | None = None, *, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True)

  Bases: `_OidcBase`

  Implementation for OpenID Connect Client Credentials.

  __abstractmethods__ = frozenset({})
  __annotate_func__ = None
  __annotations_cache__ = {}
  __doc__ = 'Implementation for OpenID Connect Client Credentials.'
  __firstlineno__ = 493
  __init__(auth_url: str, identity_provider: str, protocol: str, client_id: str, client_secret: str, access_token_type: str = 'access_token', scope: str = 'openid profile', access_token_endpoint: str | None = None, discovery_endpoint: str | None = None, *, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True)

    The OpenID Client Credentials expects the following.

    Parameters:

      - client_id – Client ID used to authenticate

      - client_secret – Client Secret used to authenticate

  __module__ = 'keystoneauth1.identity.v3.oidc'
  __static_attributes__ = ()
  _abc_impl = <_abc._abc_data object>
  get_payload(session: Session) → dict[str, str | None]

    Get an authorization grant for the client credentials grant type.

    Parameters:

      session (keystoneauth1.session.Session) – a session object to send out HTTP requests.

    Returns:

      a python dictionary containing the payload to be exchanged

    Return type:

      dict

  grant_type: ClassVar[str] = 'client_credentials'

class keystoneauth1.identity.v3.OidcPassword(auth_url: str, identity_provider: str, protocol: str, client_id: str, client_secret: str, access_token_type: str = 'access_token', scope: str = 'openid profile', access_token_endpoint: str | None = None, discovery_endpoint: str | None = None, username: str | None = None, password: str | None = None, idp_otp_key: str | None = None, *, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True)

  Bases: `_OidcBase`

  Implementation for OpenID Connect Resource Owner Password Credential.

  __abstractmethods__ = frozenset({})
  __annotate_func__ = None
  __annotations_cache__ = {}
  __doc__ = 'Implementation for OpenID Connect Resource Owner Password Credential.'
  __firstlineno__ = 374
  __init__(auth_url: str, identity_provider: str, protocol: str, client_id: str, client_secret: str, access_token_type: str = 'access_token', scope: str = 'openid profile', access_token_endpoint: str | None = None, discovery_endpoint: str | None = None, username: str | None = None, password: str | None = None, idp_otp_key: str | None = None, *, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True)

    The OpenID Password plugin expects the following.

    Parameters:

      - username (string) – Username used to authenticate

      - password (string) – Password used to authenticate

  __module__ = 'keystoneauth1.identity.v3.oidc'
  __static_attributes__ = ('idp_otp_key', 'password', 'username')
  _abc_impl = <_abc._abc_data object>
  get_payload(session: Session) → dict[str, str | None]

    Get an authorization grant for the “password” grant type.

    Parameters:

      session (keystoneauth1.session.Session) – a session object to send out HTTP requests.

    Returns:

      a python dictionary containing the payload to be exchanged

    Return type:

      dict

  grant_type: ClassVar[str] = 'password'
  manage_otp_from_session_or_request_to_the_user(payload: dict[str, str | None], session: Session) → None

    Get the OTP code from the session or else request to the user.

    When the OS_IDP_OTP_KEY environment variable is set, this method will verify if there is an OTP value in the current session, if it exists, we use it (the OTP from session) to send to the Identity Provider when retrieving the access token. If there is no OTP in the current session, we ask the user to enter it (the OTP), and we add it to the session to execute the authentication flow.

    The OTP is being stored in the session because in some flows, the CLI is doing the authentication process two times, so saving the OTP in the session, allow us to use the same OTP in a short time interval, avoiding to request it to the user twice in a row.

    Parameters:

      - payload

      - session

    Returns:

class keystoneauth1.identity.v3.Password(auth_url: str, password: str, user_id: str | None = None, username: str | None = None, user_domain_id: str | None = None, user_domain_name: str | None = None, *, unscoped: bool = False, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True)

  Bases: `Auth`

  A plugin for authenticating with a username and password.

  Parameters:

    - auth_url (string) – Identity service endpoint for authentication.

    - password (string) – Password for authentication.

    - user_id (string) – User ID for authentication.

    - username (string) – Username for authentication.

    - user_domain_id (string) – User’s domain ID for authentication.

    - user_domain_name (string) – User’s domain name for authentication.

    - trust_id (string) – Trust ID for trust scoping.

    - system_scope (string) – System information to scope to.

    - domain_id (string) – Domain ID for domain scoping.

    - domain_name (string) – Domain name for domain scoping.

    - project_id (string) – Project ID for project scoping.

    - project_name (string) – Project name for project scoping.

    - project_domain_id (string) – Project’s domain ID for project.

    - project_domain_name (string) – Project’s domain name for project.

    - reauthenticate (bool) – Allow fetching a new token if the current one is going to expire. (optional) default True

  __abstractmethods__ = frozenset({})
  __annotate_func__ = None
  __annotations_cache__ = {}
  __doc__ = "A plugin for authenticating with a username and password.\n\n:param string auth_url: Identity service endpoint for authentication.\n:param string password: Password for authentication.\n:param string user_id: User ID for authentication.\n:param string username: Username for authentication.\n:param string user_domain_id: User's domain ID for authentication.\n:param string user_domain_name: User's domain name for authentication.\n:param string trust_id: Trust ID for trust scoping.\n:param string system_scope: System information to scope to.\n:param string domain_id: Domain ID for domain scoping.\n:param string domain_name: Domain name for domain scoping.\n:param string project_id: Project ID for project scoping.\n:param string project_name: Project name for project scoping.\n:param string project_domain_id: Project's domain ID for project.\n:param string project_domain_name: Project's domain name for project.\n:param bool reauthenticate: Allow fetching a new token if the current one\n is going to expire. (optional) default True\n"
  __firstlineno__ = 83
  __init__(auth_url: str, password: str, user_id: str | None = None, username: str | None = None, user_domain_id: str | None = None, user_domain_name: str | None = None, *, unscoped: bool = False, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True) → None
  __module__ = 'keystoneauth1.identity.v3.password'
  __static_attributes__ = ()
  _abc_impl = <_abc._abc_data object>
  _auth_method_class

    alias of `PasswordMethod`

class keystoneauth1.identity.v3.PasswordMethod(*, password: str, user_id: str | None = None, username: str | None = None, user_domain_id: str | None = None, user_domain_name: str | None = None)

  Bases: `AuthMethod`

  Construct a User/Password based authentication method.

  Parameters:

    - password (string) – Password for authentication.

    - username (string) – Username for authentication.

    - user_id (string) – User ID for authentication.

    - user_domain_id (string) – User’s domain ID for authentication.

    - user_domain_name (string) – User’s domain name for authentication.

  __abstractmethods__ = frozenset({})
  __annotations_cache__ = {'password': <class 'str'>, 'user_domain_id': str | None, 'user_domain_name': str | None, 'user_id': str | None, 'username': str | None}
  __doc__ = "Construct a User/Password based authentication method.\n\n:param string password: Password for authentication.\n:param string username: Username for authentication.\n:param string user_id: User ID for authentication.\n:param string user_domain_id: User's domain ID for authentication.\n:param string user_domain_name: User's domain name for authentication.\n"
  __firstlineno__ = 21
  __init__(*, password: str, user_id: str | None = None, username: str | None = None, user_domain_id: str | None = None, user_domain_name: str | None = None) → None
  __module__ = 'keystoneauth1.identity.v3.password'
  __static_attributes__ = ('password', 'user_domain_id', 'user_domain_name', 'user_id', 'username')
  _abc_impl = <_abc._abc_data object>
  get_auth_data(session: Session, auth: Auth, headers: dict[str, str], request_kwargs: dict[str, object]) → tuple[None, None] | tuple[str, Mapping[str, object]]

    Return the authentication section of an auth plugin.

    Parameters:

      - session (keystoneauth1.session.Session) – The communication session.

      - auth (base.Auth) – The auth plugin calling the method.

      - headers (dict) – The headers that will be sent with the auth request if a plugin needs to add to them.

    Returns:

      The identifier of this plugin and a dict of authentication data for the auth type.

    Return type:

      tuple(string, dict)

  get_cache_id_elements() → dict[str, str | None]

    Get the elements for this auth method that make it unique.

    These elements will be used as part of the `keystoneauth1.plugin.BaseIdentityPlugin.get_cache_id()` to allow caching of the auth plugin.

    Plugins should override this if they want to allow caching of their state.

    To avoid collision or overrides the keys of the returned dictionary should be prefixed with the plugin identifier. For example the password plugin returns its username value as ‘password_username’.

  password: str
  user_domain_id: str | None = None
  user_domain_name: str | None = None
  user_id: str | None = None
  username: str | None = None

class keystoneauth1.identity.v3.ReceiptMethod(*, receipt: str)

  Bases: `AuthMethod`

  Construct an Auth plugin to continue authentication with a receipt.

  Parameters:

    receipt (string) – Receipt for authentication.

  __abstractmethods__ = frozenset({})
  __annotate_func__()

    The type of the None singleton.

  __annotations_cache__ = {'receipt': <class 'str'>}
  __doc__ = 'Construct an Auth plugin to continue authentication with a receipt.\n\n:param string receipt: Receipt for authentication.\n'
  __firstlineno__ = 22
  __init__(*, receipt: str) → None
  __module__ = 'keystoneauth1.identity.v3.receipt'
  __static_attributes__ = ('receipt',)
  _abc_impl = <_abc._abc_data object>
  get_auth_data(session: Session, auth: Auth, headers: dict[str, str], request_kwargs: dict[str, object]) → tuple[None, None] | tuple[str, Mapping[str, object]]

    Add the auth receipt to the headers.

    We explicitly return None to avoid being added to the request methods, or body.

  get_cache_id_elements() → dict[str, str | None]

    Get the elements for this auth method that make it unique.

    These elements will be used as part of the `keystoneauth1.plugin.BaseIdentityPlugin.get_cache_id()` to allow caching of the auth plugin.

    Plugins should override this if they want to allow caching of their state.

    To avoid collision or overrides the keys of the returned dictionary should be prefixed with the plugin identifier. For example the password plugin returns its username value as ‘password_username’.

  receipt: str

class keystoneauth1.identity.v3.TOTP(auth_url: str, passcode: str, user_id: str | None = None, username: str | None = None, user_domain_id: str | None = None, user_domain_name: str | None = None, *, unscoped: bool = False, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True)

  Bases: `Auth`

  A plugin for authenticating with a username and TOTP passcode.

  Parameters:

    - auth_url (string) – Identity service endpoint for authentication.

    - passcode (string) – TOTP passcode for authentication.

    - user_id (string) – User ID for authentication.

    - username (string) – Username for authentication.

    - user_domain_id (string) – User’s domain ID for authentication.

    - user_domain_name (string) – User’s domain name for authentication.

    - trust_id (string) – Trust ID for trust scoping.

    - domain_id (string) – Domain ID for domain scoping.

    - domain_name (string) – Domain name for domain scoping.

    - project_id (string) – Project ID for project scoping.

    - project_name (string) – Project name for project scoping.

    - project_domain_id (string) – Project’s domain ID for project.

    - project_domain_name (string) – Project’s domain name for project.

    - reauthenticate (bool) – Allow fetching a new token if the current one is going to expire. (optional) default True

  __abstractmethods__ = frozenset({})
  __annotate_func__ = None
  __annotations_cache__ = {}
  __doc__ = "A plugin for authenticating with a username and TOTP passcode.\n\n:param string auth_url: Identity service endpoint for authentication.\n:param string passcode: TOTP passcode for authentication.\n:param string user_id: User ID for authentication.\n:param string username: Username for authentication.\n:param string user_domain_id: User's domain ID for authentication.\n:param string user_domain_name: User's domain name for authentication.\n:param string trust_id: Trust ID for trust scoping.\n:param string domain_id: Domain ID for domain scoping.\n:param string domain_name: Domain name for domain scoping.\n:param string project_id: Project ID for project scoping.\n:param string project_name: Project name for project scoping.\n:param string project_domain_id: Project's domain ID for project.\n:param string project_domain_name: Project's domain name for project.\n:param bool reauthenticate: Allow fetching a new token if the current one\n is going to expire. (optional) default True\n"
  __firstlineno__ = 85
  __init__(auth_url: str, passcode: str, user_id: str | None = None, username: str | None = None, user_domain_id: str | None = None, user_domain_name: str | None = None, *, unscoped: bool = False, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True) → None
  __module__ = 'keystoneauth1.identity.v3.totp'
  __static_attributes__ = ()
  _abc_impl = <_abc._abc_data object>
  _auth_method_class

    alias of `TOTPMethod`

class keystoneauth1.identity.v3.TOTPMethod(*, passcode: str, user_id: str | None = None, username: str | None = None, user_domain_id: str | None = None, user_domain_name: str | None = None)

  Bases: `AuthMethod`

  Construct a User/Passcode based authentication method.

  Parameters:

    - passcode (string) – TOTP passcode for authentication.

    - username (string) – Username for authentication.

    - user_id (string) – User ID for authentication.

    - user_domain_id (string) – User’s domain ID for authentication.

    - user_domain_name (string) – User’s domain name for authentication.

  __abstractmethods__ = frozenset({})
  __annotations_cache__ = {'passcode': <class 'str'>, 'user_domain_id': str | None, 'user_domain_name': str | None, 'user_id': str | None, 'username': str | None}
  __doc__ = "Construct a User/Passcode based authentication method.\n\n:param string passcode: TOTP passcode for authentication.\n:param string username: Username for authentication.\n:param string user_id: User ID for authentication.\n:param string user_domain_id: User's domain ID for authentication.\n:param string user_domain_name: User's domain name for authentication.\n"
  __firstlineno__ = 22
  __init__(*, passcode: str, user_id: str | None = None, username: str | None = None, user_domain_id: str | None = None, user_domain_name: str | None = None) → None
  __module__ = 'keystoneauth1.identity.v3.totp'
  __static_attributes__ = ('passcode', 'user_domain_id', 'user_domain_name', 'user_id', 'username')
  _abc_impl = <_abc._abc_data object>
  get_auth_data(session: Session, auth: Auth, headers: dict[str, str], request_kwargs: dict[str, object]) → tuple[None, None] | tuple[str, Mapping[str, object]]

    Return the authentication section of an auth plugin.

    Parameters:

      - session (keystoneauth1.session.Session) – The communication session.

      - auth (base.Auth) – The auth plugin calling the method.

      - headers (dict) – The headers that will be sent with the auth request if a plugin needs to add to them.

    Returns:

      The identifier of this plugin and a dict of authentication data for the auth type.

    Return type:

      tuple(string, dict)

  get_cache_id_elements() → dict[str, str | None]

    Get the elements for this auth method that make it unique.

    These elements will be used as part of the `keystoneauth1.plugin.BaseIdentityPlugin.get_cache_id()` to allow caching of the auth plugin.

    Plugins should override this if they want to allow caching of their state.

    To avoid collision or overrides the keys of the returned dictionary should be prefixed with the plugin identifier. For example the password plugin returns its username value as ‘password_username’.

  passcode: str
  user_domain_id: str | None = None
  user_domain_name: str | None = None
  user_id: str | None = None
  username: str | None = None

class keystoneauth1.identity.v3.Token(auth_url: str, token: str, *, unscoped: bool = False, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True)

  Bases: `Auth`

  A plugin for authenticating with an existing Token.

  Parameters:

    - auth_url (string) – Identity service endpoint for authentication.

    - token (string) – Token for authentication.

    - trust_id (string) – Trust ID for trust scoping.

    - domain_id (string) – Domain ID for domain scoping.

    - domain_name (string) – Domain name for domain scoping.

    - project_id (string) – Project ID for project scoping.

    - project_name (string) – Project name for project scoping.

    - project_domain_id (string) – Project’s domain ID for project.

    - project_domain_name (string) – Project’s domain name for project.

    - reauthenticate (bool) – Allow fetching a new token if the current one is going to expire. (optional) default True

  __abstractmethods__ = frozenset({})
  __annotate_func__ = None
  __annotations_cache__ = {}
  __doc__ = "A plugin for authenticating with an existing Token.\n\n:param string auth_url: Identity service endpoint for authentication.\n:param string token: Token for authentication.\n:param string trust_id: Trust ID for trust scoping.\n:param string domain_id: Domain ID for domain scoping.\n:param string domain_name: Domain name for domain scoping.\n:param string project_id: Project ID for project scoping.\n:param string project_name: Project name for project scoping.\n:param string project_domain_id: Project's domain ID for project.\n:param string project_domain_name: Project's domain name for project.\n:param bool reauthenticate: Allow fetching a new token if the current one\n is going to expire. (optional) default True\n"
  __firstlineno__ = 47
  __init__(auth_url: str, token: str, *, unscoped: bool = False, trust_id: str | None = None, system_scope: str | None = None, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None, reauthenticate: bool = True, include_catalog: bool = True) → None
  __module__ = 'keystoneauth1.identity.v3.token'
  __static_attributes__ = ()
  _abc_impl = <_abc._abc_data object>
  _auth_method_class

    alias of `TokenMethod`

class keystoneauth1.identity.v3.TokenMethod(*, token: str)

  Bases: `AuthMethod`

  Construct an Auth plugin to fetch a token from a token.

  Parameters:

    token (string) – Token for authentication.

  __abstractmethods__ = frozenset({})
  __annotations_cache__ = {'token': <class 'str'>}
  __doc__ = 'Construct an Auth plugin to fetch a token from a token.\n\n:param string token: Token for authentication.\n'
  __firstlineno__ = 22
  __init__(*, token: str) → None
  __module__ = 'keystoneauth1.identity.v3.token'
  __static_attributes__ = ('token',)
  _abc_impl = <_abc._abc_data object>
  get_auth_data(session: Session, auth: Auth, headers: dict[str, str], request_kwargs: dict[str, object]) → tuple[None, None] | tuple[str, Mapping[str, object]]

    Return the authentication section of an auth plugin.

    Parameters:

      - session (keystoneauth1.session.Session) – The communication session.

      - auth (base.Auth) – The auth plugin calling the method.

      - headers (dict) – The headers that will be sent with the auth request if a plugin needs to add to them.

    Returns:

      The identifier of this plugin and a dict of authentication data for the auth type.

    Return type:

      tuple(string, dict)

  get_cache_id_elements() → dict[str, str | None]

    Get the elements for this auth method that make it unique.

    These elements will be used as part of the `keystoneauth1.plugin.BaseIdentityPlugin.get_cache_id()` to allow caching of the auth plugin.

    Plugins should override this if they want to allow caching of their state.

    To avoid collision or overrides the keys of the returned dictionary should be prefixed with the plugin identifier. For example the password plugin returns its username value as ‘password_username’.

  token: str

class keystoneauth1.identity.v3.TokenlessAuth(auth_url: str, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None)

  Bases: `BaseAuthPlugin`

  A plugin for authenticating with Tokenless Auth.

  This is for Tokenless Authentication. Scoped information like domain name and project ID will be passed in the headers and token validation request will be authenticated based on the provided HTTPS certificate along with the scope information.

  __abstractmethods__ = frozenset({})
  __annotate_func__ = None
  __annotations_cache__ = {}
  __doc__ = 'A plugin for authenticating with Tokenless Auth.\n\nThis is for Tokenless Authentication. Scoped information\nlike domain name and project ID will be passed in the headers and\ntoken validation request will be authenticated based on\nthe provided HTTPS certificate along with the scope information.\n'
  __firstlineno__ = 25
  __init__(auth_url: str, domain_id: str | None = None, domain_name: str | None = None, project_id: str | None = None, project_name: str | None = None, project_domain_id: str | None = None, project_domain_name: str | None = None)

    A init method for TokenlessAuth.

    Parameters:

      - auth_url (string) – Identity service endpoint for authentication. The URL must include a version or any request will result in a 404 NotFound error.

      - domain_id (string) – Domain ID for domain scoping.

      - domain_name (string) – Domain name for domain scoping.

      - project_id (string) – Project ID for project scoping.

      - project_name (string) – Project name for project scoping.

      - project_domain_id (string) – Project’s domain ID for project.

      - project_domain_name (string) – Project’s domain name for project.

  __module__ = 'keystoneauth1.identity.v3.tokenless_auth'
  __static_attributes__ = ('auth_url', 'domain_id', 'domain_name', 'project_domain_id', 'project_domain_name', 'project_id', 'project_name')
  _abc_impl = <_abc._abc_data object>
  get_endpoint(session: ks_session.Session, service_type: str | None = None, **kwargs: Any) → str | None

    Return a valid endpoint for a service.

    Parameters:

      - session (keystoneauth1.session.Session) – A session object that can be used for communication.

      - service_type (string) – The type of service to lookup the endpoint for. This plugin will return None (failure) if service_type is not provided.

    Returns:

      A valid endpoint URL or None if not available.

    Return type:

      string or None

  get_headers(session: ks_session.Session) → dict[str, str] | None

    Fetch authentication headers for message.

    This is to override the default get_headers method to provide tokenless auth scope headers if token is not provided in the session.

    Parameters:

      session (keystoneauth1.session.Session) – The session object that the auth_plugin belongs to.

    Returns:

      Headers that are set to authenticate a message or None for failure. Note that when checking this value that the empty dict is a valid, non-failure response.

    Return type:

      dict

this page last updated: 2026-07-14 15:48:40

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.

found an error? report a bug