keystone.credential.core module¶

Main entry point into the Credential service.

class keystone.credential.core.Manager[source]¶

Bases: Manager

Default pivot point for the Credential backend.

See keystone.common.manager.Manager for more details on how this dynamically calls the backend.

create_credential(credential_id, credential, initiator=None)[source]¶

Create a credential.

delete_credential(credential_id, initiator=None)[source]¶

Delete a credential.

delete_credentials_for_project(project_id)[source]¶

Delete all credentials for a project.

delete_credentials_for_user(user_id)[source]¶

Delete all credentials for a user.

driver_namespace = 'keystone.credential'¶

get_credential(credential_id)[source]¶

Return a credential reference.

list_credentials(hints=None)[source]¶

list_credentials_for_user(user_id, type=None)[source]¶

update_credential(credential_id, credential)[source]¶

Update an existing credential.

Only blob is accepted here: the API layer’s PATCH schema enforces this (see LP#2159643 – retyping, rescoping, or reassigning a credential in place was a repeated source of security issues), so type, user_id, and project_id are never present in credential. There is currently no other caller of this method that passes those fields either (keystone-manage credential_migrate only ever passes blob). Do not reintroduce type/project_id/ user_id-specific validation here without also reintroducing a way for a caller to actually change them.