keystone 的pam认证方式

from __future__ import absolute_import
import pdb

try:
import pam
except ImportError:
pam = None
import PAM

from keystone import identity

def PAM_authenticate(username, password):
def _pam_conv(auth, query_list):
resp = []

for query, q_type in query_list:
if q_type in [PAM.PAM_PROMPT_ECHO_ON, PAM.PAM_PROMPT_ECHO_OFF]:
resp.append((password, 0))
elif q_type in [PAM.PAM_PROMPT_ERROR_MSG,
PAM.PAM_PROMPT_TEXT_INFO]:
resp.append(('', 0))

return resp

auth = PAM.pam()
auth.start('passwd')
auth.set_item(PAM.PAM_USER, username)
auth.set_item(PAM.PAM_CONV, _pam_conv)

try:
auth.authenticate()
auth.acct_mgmt()
except PAM.error:
raise AssertionError('Invalid user / password')

return True

class PamIdentity(identity.Driver):
"""Very basic identity based on PAM.

Tenant is always the same as User, root user has admin role.
"""

def authenticate(self, user_id, tenant_id, password):
if user_id in ['nova', 'glance', 'cinder']:
metadata = {}
metadata['roles'] = ['admin']
tenant = {'enabled': True, 'description': None, 'name': 'service', 'id': 'service'}
user = {'id': user_id, 'name': user_id, 'enabled': True, 'email':'openstack@openstack.com', 'tenantId':'service'}
return (user, tenant, metadata)
else:
auth = pam.authenticate if pam else PAM_authenticate
if auth(user_id, password):
metadata = {}
if user_id == 'root':
metadata['is_admin'] = True

tenant = None
user = {'id': user_id, 'name': user_id, 'enabled': 'true', 'email':user_id, 'tenantId':None}
return (user, tenant, metadata)

def get_tenant(self, tenant_id):
if tenant_id == 'service':
return {'enabled': True, 'description': None, 'name': 'service', 'id': 'service'}
else:
return {'enabled': True, 'description': None, 'name': tenant_id, 'id': tenant_id}

def get_tenant_by_name(self, tenant_name):
if tenant_name == 'service':
return {'enabled': True, 'description': None, 'name': 'service', 'id': 'service'}
else:
return {'enabled': True, 'description': None, 'name': tenant_name, 'id': tenant_name}

def get_user(self, user_id):
if user_id in ['nova', 'glance', 'cinder']:
return {'id': user_id, 'name': user_id, 'enabled': 'True', 'email':'test@test.com', 'tenantId':'service'}
else:
return {'id': user_id, 'name': user_id, 'enabled': 'True', 'email':user_id, 'tenantId':user_id}

def get_user_by_name(self, user_name):
if user_name in ['nova', 'glance', 'cinder']:
return {'id': user_name, 'name': user_name, 'enabled': 'True', 'email':'test@test.com', 'tenantId':'service'}
else:
return {'id': user_name, 'name': user_name, 'enabled': 'True', 'email':user_name, 'tenantId':user_name}

def get_role(self, role_id):
if role_id == 'admin':
return {'id':role_id, 'name':'admin'}
#	return {'id':role_id, 'name':role_id}

def list_users(self):
raise NotImplementedError()

def list_roles(self):
raise NotImplementedError()

def add_user_to_tenant(self, tenant_id, user_id):
raise NotImplementedError()
pass

def remove_user_from_tenant(self, tenant_id, user_id):
pass
raise NotImplementedError()

def get_tenants(self):
return [{'enabled': True, 'description': None, 'name': 'service', 'id': 'service'}]

def get_tenants_for_user(self, user_id):
return [user_id]

def get_roles_for_user_and_tenant(self, user_id, tenant_id):
raise NotImplementedError()

def add_role_to_user_and_tenant(self, user_id, tenant_id, role_id):
raise NotImplementedError()

def remove_role_from_user_and_tenant(self, user_id, tenant_id, role_id):
raise NotImplementedError()

def create_user(self, user_id, user):
raise NotImplementedError()

def update_user(self, user_id, user):
raise NotImplementedError()

def delete_user(self, user_id):
raise NotImplementedError()

def create_tenant(self, tenant_id, tenant):
raise NotImplementedError()

def update_tenant(self, tenant_id, tenant):
raise NotImplementedError()

def delete_tenant(self, tenant_id, tenant):
raise NotImplementedError()

def get_metadata(self, user_id, tenant_id):
metadata = {}
#    if user_id == 'root':# or user_id == 'nova' or user_id == 'glance':
#       metadata['is_admin'] = True
#	metadata['roles'] = ['admin']
return metadata

def create_metadata(self, user_id, tenant_id, metadata):
raise NotImplementedError()

def update_metadata(self, user_id, tenant_id, metadata):
raise NotImplementedError()

def delete_metadata(self, user_id, tenant_id, metadata):
raise NotImplementedError()

def create_role(self, role_id, role):
raise NotImplementedError()

def update_role(self, role_id, role):
raise NotImplementedError()

def delete_role(self, role_id):
raise NotImplementedError()