Keystone Middleware

https://docs.openstack.org/keystonemiddleware/latest/
Admin
Keystone Middleware is a Python middleware for OpenStack Identity API that handles authorization...
Tokens:10,042
Snippets:110
Trust Score:10
Update:6 months ago
Show doc for...
Tokens:
Raw
### Install keystonemiddleware in a virtual environment

Source: https://docs.openstack.org/keystonemiddleware/latest/installation.html

This demonstrates installing keystonemiddleware within a virtualenvwrapper environment. Ensure you have virtualenvwrapper installed.

```bash
$ mkvirtualenv keystonemiddleware
$ pip install keystonemiddleware
```

--------------------------------

### Install keystonemiddleware using pip

Source: https://docs.openstack.org/keystonemiddleware/latest/installation.html

Use this command to install the basic keystonemiddleware package. It is recommended to use a virtual environment.

```bash
$ pip install keystonemiddleware
```

--------------------------------

### Configure password-based authentication

Source: https://docs.openstack.org/keystonemiddleware/latest/middlewarearchitecture.html

Example configuration for using password-based authentication within the [keystone_authtoken] section.

```ini
[keystone_authtoken]
auth_type = password
project_domain_name = Default
project_name = service
user_domain_name = Default
username = nova
password = ServicePassword
interface = public
auth_url = http://127.0.0.1:5000
```

--------------------------------

### Install keystonemiddleware with memcache encryption support

Source: https://docs.openstack.org/keystonemiddleware/latest/installation.html

Install the keystonemiddleware package with the necessary dependencies to enable memcache encryption. This requires the '[memcache_encryption]' extra.

```bash
$ pip install keystonemiddleware[memcache_encryption]
```

--------------------------------

### Install keystonemiddleware with audit notifications support

Source: https://docs.openstack.org/keystonemiddleware/latest/installation.html

Install the keystonemiddleware package with the necessary dependencies to enable audit notification features. This requires the '[audit_notifications]' extra.

```bash
$ pip install keystonemiddleware[audit_notifications]
```

--------------------------------

### AuthTokenFixture.setUp()

Source: https://docs.openstack.org/keystonemiddleware/latest/api/keystonemiddleware.fixture.html

Prepare the Fixture for use. This method should not be overridden by concrete fixtures.

```APIDOC
## POST /setup

### Description
Prepare the Fixture for use. This should not be overridden. Concrete fixtures should implement _setUp. Overriding of setUp is still supported, just not recommended.

### Method
POST

### Endpoint
/setup

### Parameters
N/A

### Request Example
```json
{}
```

### Response
#### Success Response (200)
None.

#### Response Example
```json
{}
```

### Errors
- **MultipleExceptions** - Raised if _setUp fails. The last exception captured within the MultipleExceptions will be a SetupError exception.
```

--------------------------------

### Configuration Options

Source: https://docs.openstack.org/keystonemiddleware/latest/api/keystonemiddleware.auth_token.html

Function to list available configuration options for the auth_token middleware.

```APIDOC
## keystonemiddleware.auth_token.list_opts()

Return a list of oslo_config options available in auth_token middleware.
The returned list includes all oslo_config options which may be registered at runtime by the project.
Each element of the list is a tuple. The first element is the name of the group under which the list of elements in the second element will be registered. A group name of None corresponds to the [DEFAULT] group in config files.
NOTE: This function is no longer used for oslo_config sample generation. Some services rely on this function for listing ALL (including deprecated) options and registering them into their own config objects which we do not want for sample config files.
See: `keystonemiddleware.auth_token._opts.list_opts()` for sample config files.

**Returns:**
a list of (group_name, opts) tuples

```

--------------------------------

### Configure keystone authentication in nova.conf

Source: https://docs.openstack.org/keystonemiddleware/latest/middlewarearchitecture.html

Sets the authentication strategy and keystone credentials in the main service configuration file.

```ini
[DEFAULT]
auth_strategy=keystone

[keystone_authtoken]
identity_uri = http://127.0.0.1:5000
admin_user = admin
admin_password = SuperSekretPassword
admin_tenant_name = service
```

--------------------------------

### keystonemiddleware.opts.list_auth_token_opts

Source: https://docs.openstack.org/keystonemiddleware/latest/api/modules.html

Retrieves the list of configuration options available for the auth_token middleware.

```APIDOC
## GET /keystonemiddleware/opts/list_auth_token_opts

### Description
Returns a list of configuration options used for configuring the auth_token middleware in OpenStack services.

### Method
GET

### Response
#### Success Response (200)
- **options** (list) - A list of configuration option objects containing name, default value, and help text.
```

--------------------------------

### Define keystone_authtoken configuration options

Source: https://docs.openstack.org/keystonemiddleware/latest/middlewarearchitecture.html

Lists common configuration parameters for the auth_token middleware, including endpoint URIs, interface selection, and connection settings.

```ini
[DEFAULT]


[keystone_authtoken]

#
# From keystonemiddleware.auth_token
#

# Complete "public" Identity API endpoint. This endpoint should not be an
# "admin" endpoint, as it should be accessible by all end users.
# Unauthenticated clients are redirected to this endpoint to authenticate.
# Although this endpoint should ideally be unversioned, client support in the
# wild varies. (string value)
#www_authenticate_uri = <None>

# API version of the Identity API endpoint. (string value)
#auth_version = <None>

# Interface to use for the Identity API endpoint. Valid values are "public",
# "internal" (default) or "admin". (string value)
#interface = internal

# Do not handle authorization requests within the middleware, but delegate the
# authorization decision to downstream WSGI components. (boolean value)
#delay_auth_decision = false

# Request timeout value for communicating with Identity API server. (integer
# value)
#http_connect_timeout = <None>

# How many times are we trying to reconnect when communicating with Identity
# API Server. (integer value)
#http_request_max_retries = 3

# Request environment key where the Swift cache object is stored. When
# auth_token middleware is deployed with a Swift cache, use this option to have
# the middleware share a caching backend with swift. Otherwise, use the
```

--------------------------------

### Configure Keystone Auth Token Middleware

Source: https://docs.openstack.org/keystonemiddleware/latest/api/keystonemiddleware.auth_token.html

Use this configuration in your service's INI file (e.g., nova.conf or api-paste.ini) to set up the Keystone auth_token middleware. Ensure sensitive information like passwords are handled securely.

```ini
[keystone_authtoken]
auth_plugin = password
auth_url = http://keystone:5000/
username = nova
user_domain_id = default
password = whyarewestillusingpasswords
project_name = service
project_domain_id = default

```

--------------------------------

### Configure oslo_config_project in paste config

Source: https://docs.openstack.org/keystonemiddleware/latest/middlewarearchitecture.html

Allows keystonemiddleware to load project configuration when the service does not use the global oslo.config object.

```ini
[filter:authtoken]
paste.filter_factory = keystonemiddleware.auth_token:filter_factory
oslo_config_project = nova
```

--------------------------------

### list_auth_token_opts()

Source: https://docs.openstack.org/keystonemiddleware/latest/api/keystonemiddleware.opts.html

Retrieves the list of configuration options available for the auth_token middleware.

```APIDOC
## list_auth_token_opts()

### Description
Returns a list of configuration options required or supported by the auth_token middleware component.

### Method
Python Function Call

### Parameters
None
```

--------------------------------

### AuthTokenFixture.fetch_token()

Source: https://docs.openstack.org/keystonemiddleware/latest/api/keystonemiddleware.fixture.html

Low-level replacement of fetch_token for AuthProtocol.

```APIDOC
## POST /fetch_token

### Description
Low-level replacement of fetch_token for AuthProtocol.

### Method
POST

### Endpoint
/fetch_token

### Parameters
#### Request Body
- **token** (str) - Required - The token to fetch.
- **kwargs** (dict) - Optional - Additional keyword arguments.

### Request Example
```json
{
  "token": "a_valid_token_string",
  "kwargs": {
    "some_option": "value"
  }
}
```

### Response
#### Success Response (200)
- **token_data** (dict) - The fetched token data.

#### Response Example
```json
{
  "token_data": {
    "user_id": "some_user_id",
    "expires_at": "2024-12-31T10:00:00Z"
  }
}
```
```

--------------------------------

### Configure external OAuth2 token pipeline

Source: https://docs.openstack.org/keystonemiddleware/latest/middlewarearchitecture.html

Updates the pipeline to use the ext_oauth2_token filter instead of the standard authtoken filter.

```ini
[pipeline:main]
pipeline = ext_oauth2_token myService

[filter:ext_oauth2_token]
paste.filter_factory = keystonemiddleware.external_oauth2_token:filter_factory
```

--------------------------------

### Run the echo service via command line

Source: https://docs.openstack.org/keystonemiddleware/latest/api/keystonemiddleware.echo.service.html

Executes the echo service on port 8000 using the python module flag.

```bash
$ python -m keystonemiddleware.echo
```

--------------------------------

### Middleware Factory Methods

Source: https://docs.openstack.org/keystonemiddleware/latest/api/keystonemiddleware.auth_token.html

Factory methods used for initializing the middleware components.

```APIDOC
## Middleware Factory Methods

### Description
Functions used to instantiate the middleware within the application pipeline.

### Methods
- **app_factory()**: Factory for creating the application middleware.
- **filter_factory()**: Factory for creating the filter middleware.
- **list_opts()**: Returns a list of configuration options for the middleware.
```

--------------------------------

### Configure auth_token middleware in Paste pipeline

Source: https://docs.openstack.org/keystonemiddleware/latest/middlewarearchitecture.html

Defines the application factory and includes the authtoken filter in the WSGI pipeline configuration.

```ini
[app:myService]
paste.app_factory = myService:app_factory

[pipeline:main]
pipeline = authtoken myService

[filter:authtoken]
paste.filter_factory = keystonemiddleware.auth_token:filter_factory
```

--------------------------------

### Configure Audit Middleware Options

Source: https://docs.openstack.org/keystonemiddleware/latest/audit.html

Set additional options such as service name and ignored request methods.

```ini
[filter:audit]
paste.filter_factory = pycadf.middleware.audit:filter_factory
audit_map_file = /etc/nova/api_audit_map.conf
service_name = test # opt to set HTTP_X_SERVICE_NAME environ variable
ignore_req_list = GET,POST # opt to ignore specific requests

```

--------------------------------

### AuditMiddleware Configuration and Usage

Source: https://docs.openstack.org/keystonemiddleware/latest/api/keystonemiddleware.audit.html

Details on the AuditMiddleware class and its associated factory and configuration methods.

```APIDOC
## AuditMiddleware

### Description
AuditMiddleware creates an audit event based on request/response cycles. It should be placed after keystonemiddleware.auth_token in the WSGI pipeline to utilize identity information.

### Methods
- **filter_factory(global_conf, **local_conf)**: Returns a WSGI filter app for use with paste.deploy.
- **list_opts()**: Returns a list of oslo_config options available in the audit middleware. Returns a list of (group_name, opts) tuples where group_name None corresponds to the [DEFAULT] group.
```

--------------------------------

### Swift Memcache Integration

Source: https://docs.openstack.org/keystonemiddleware/latest/api/keystonemiddleware.auth_token.html

Configuration details for using Swift memcache with the auth_token middleware. This involves setting the `cache` option to the environment key where the Swift cache object is stored.

```APIDOC
## Swift Memcache Configuration

When deploy auth_token middleware with Swift, user may elect to use Swift memcache instead of the local auth_token memcache. Swift memcache is passed in from the request environment and it’s identified by the `swift.cache` key. However it could be different, depending on deployment. To use Swift memcache, you must set the `cache` option to the environment key where the Swift cache object is stored.
```

--------------------------------

### Configure external OAuth2 authentication server

Source: https://docs.openstack.org/keystonemiddleware/latest/middlewarearchitecture.html

Settings for the external OAuth2 authentication server group.

```ini
[ext_oauth2_auth]
# Required if identity server requires client certificate.
#certfile = <None>

# Required if identity server requires client private key.
#keyfile = <None>

# A PEM encoded Certificate Authority to use when verifying HTTPs
# connections. Defaults to system CAs.
#cafile = <None>

# Verify HTTPS connections.
#insecure = False

# Request timeout value for communicating with Identity API server.
#http_connect_timeout = <None>

# The endpoint for introspect API, it is used to verify that the OAuth 2.0
# access token is valid.
#introspect_endpoint = <None>

# The Audience should be the URL of the Authorization Server's Token
# Endpoint. The Authorization Server will verify that it is an intended
# audience for the token.
#audience = <None>

# The auth_method must use the authentication method specified by the
```

--------------------------------

### BaseAuthProtocol Class Methods

Source: https://docs.openstack.org/keystonemiddleware/latest/api/keystonemiddleware.auth_token.html

Core methods for the base authentication protocol implementation.

```APIDOC
## BaseAuthProtocol Methods

### Description
Defines the base interface and logic for authentication protocols.

### Methods
- **fetch_token()**: Base implementation for token retrieval.
- **process_request()**: Base implementation for request processing.
- **process_response()**: Base implementation for response processing.
- **validate_allowed_request()**: Validates if a request is permitted based on authentication rules.
```

--------------------------------

### Enable Audit Middleware in api-paste.ini

Source: https://docs.openstack.org/keystonemiddleware/latest/audit.html

Define the audit filter in the project's api-paste.ini file to enable auditing.

```ini
[filter:audit]
paste.filter_factory = keystonemiddleware.audit:filter_factory
audit_map_file = /etc/nova/api_audit_map.conf

```

--------------------------------

### Integrate Audit Middleware into Nova Pipeline

Source: https://docs.openstack.org/keystonemiddleware/latest/audit.html

Add the audit filter to the WSGI pipeline after the authtoken middleware.

```ini
[composite:openstack_compute_api_v2]
use = call:nova.api.auth:pipeline_factory
noauth = faultwrap sizelimit noauth ratelimit osapi_compute_api_v2
keystone = faultwrap sizelimit authtoken keystonecontext ratelimit audit osapi_compute_api_v2
keystone_nolimit = faultwrap sizelimit authtoken keystonecontext audit osapi_compute_api_v2

```

--------------------------------

### Configure authtoken filter in api-paste.ini

Source: https://docs.openstack.org/keystonemiddleware/latest/middlewarearchitecture.html

Defines the filter factory for the authtoken middleware in the paste configuration file.

```ini
[filter:authtoken]
paste.filter_factory = keystonemiddleware.auth_token:filter_factory
```

--------------------------------

### keystonemiddleware.external_oauth2_token.filter_factory

Source: https://docs.openstack.org/keystonemiddleware/latest/api/modules.html

Factory function for initializing the external OAuth2 token middleware.

```APIDOC
## POST /keystonemiddleware/external_oauth2_token/filter_factory

### Description
Initializes the middleware filter for external OAuth2 token authentication.

### Method
POST

### Request Body
- **global_conf** (dict) - Global configuration settings.
- **local_conf** (dict) - Local configuration settings for the filter.
```

--------------------------------

### Factory Functions

Source: https://docs.openstack.org/keystonemiddleware/latest/api/keystonemiddleware.auth_token.html

Factory functions for creating WSGI applications and filters for the auth_token middleware.

```APIDOC
## Factory Functions

### keystonemiddleware.auth_token.app_factory(_global_conf_, _**local_conf_)

### keystonemiddleware.auth_token.filter_factory(_global_conf_, _**local_conf_)

Return a WSGI filter app for use with paste.deploy.

```

--------------------------------

### AuthTokenFixture.add_token()

Source: https://docs.openstack.org/keystonemiddleware/latest/api/keystonemiddleware.fixture.html

Adds an existing token to the middleware fixture.

```APIDOC
## POST /add_token

### Description
Add an existing token to the middleware fixture.

### Method
POST

### Endpoint
/add_token

### Parameters
#### Request Body
- **token_data** (dict) - Required - token data to add to the fixture
- **token_id** (str) - Optional - the token ID to add this token as

### Request Example
```json
{
  "token_data": {
    "user_id": "some_user_id",
    "expires_at": "2024-12-31T10:00:00Z"
  },
  "token_id": "unique_token_identifier"
}
```

### Response
#### Success Response (200)
- **token_id** (str) - The token_id that the token was added as.

#### Response Example
```json
{
  "token_id": "unique_token_identifier"
}
```
```

--------------------------------

### Keystone Middleware Factory Functions

Source: https://docs.openstack.org/keystonemiddleware/latest/api/keystonemiddleware.auth_token.html

Provides factory functions for creating WSGI filter apps and listing configuration options for the auth_token middleware.

```python
keystonemiddleware.auth_token.app_factory(_global_conf_ , _** local_conf_)
```

```python
keystonemiddleware.auth_token.filter_factory(_global_conf_ , _** local_conf_)
```

```python
keystonemiddleware.auth_token.list_opts()
```

--------------------------------

### AuthProtocol Class Methods

Source: https://docs.openstack.org/keystonemiddleware/latest/api/keystonemiddleware.auth_token.html

Methods available within the AuthProtocol class for handling authentication requests and responses.

```APIDOC
## AuthProtocol Methods

### Description
Provides methods for processing authentication requests and responses within the middleware pipeline.

### Methods
- **fetch_token()**: Retrieves an authentication token.
- **process_request()**: Processes incoming requests for authentication validation.
- **process_response()**: Processes outgoing responses.
- **www_authenticate_uri**: Property representing the URI for WWW-Authenticate challenges.
```

--------------------------------

### BaseAuthProtocol Class Definition

Source: https://docs.openstack.org/keystonemiddleware/latest/api/keystonemiddleware.auth_token.html

A base class for AuthProtocol token checking implementations. It provides a foundation for token fetching and request/response processing.

```python
class _keystonemiddleware.auth_token.BaseAuthProtocol(_app_ , _log= <KeywordArgumentAdapter keystonemiddleware.auth_token (WARNING)>_, _enforce_token_bind='permissive'_ , _service_token_roles=None_ , _service_token_roles_required=False_ , _service_type=None_):
    
    Bases: `object`
    A base class for AuthProtocol token checking implementations. 

    Parameters:
        
      * **app** (_Callable_) – The next application to call after middleware.
      * **log** (_logging.Logger_) – The logging object to use for output. By default it will use a logger in the keystonemiddleware.auth_token namespace.
      * **enforce_token_bind** (_str_) – The style of token binding enforcement to perform.



    fetch_token(_token_ , _** kwargs_):
        
        Fetch the token data based on the value in the header.
        Retrieve the data associated with the token value that was in the header. This can be from PKI, contacting the identity server or whatever is required. 

        Parameters:
            
          * **token** (_str_) – The token present in the request header.
          * **kwargs** (_dict_) – Additional keyword arguments may be passed through here to support new features. If an implementation is not aware of how to use these arguments it should ignore them.



        Raises:
            
          **exc.InvalidToken** – if token is invalid. 

        Returns:
            
          The token data 

        Return type:
            
          dict 

    process_request(_request_):
        
        Process request.
        If this method returns a value then that value will be used as the response. The next application down the stack will not be executed and process_response will not be called.
        Otherwise, the next application down the stack will be executed and process_response will be called with the generated response.
        By default this method does not return a value. 

        Parameters:
            
          **request** (__request.AuthTokenRequest_) – Incoming request 

    process_response(_response_):
        
        Do whatever you’d like to the response.
        By default the response is returned unmodified. 

        Parameters:
            
          **response** (_._request._AuthTokenResponse_) – Response object 

    validate_allowed_request(_request_ , _token_)
```

--------------------------------

### AuthProtocol Class

Source: https://docs.openstack.org/keystonemiddleware/latest/api/keystonemiddleware.auth_token.html

The AuthProtocol class is the core middleware that handles client authentication. It provides methods for fetching tokens, processing incoming requests, and modifying outgoing responses.

```APIDOC
## Class _keystonemiddleware.auth_token.AuthProtocol

Bases: `BaseAuthProtocol`

Middleware that handles authenticating client calls.

### Methods

#### fetch_token(_token_, _allow_expired=False_)

Retrieve a token from either a PKI bundle or the identity server.

**Parameters:**

* **token** (_str_) – token id

**Raises:**

* **exc.InvalidToken** – if token is rejected

#### process_request(_request_)

Process request.
Evaluate the headers in a request and attempt to authenticate the request. If authenticated then additional headers are added to the request for use by applications. If not authenticated the request will be rejected or marked unauthenticated depending on configuration.

#### process_response(_response_)

Process Response.
Add `WWW-Authenticate` headers to requests that failed with `401 Unauthenticated` so users know where to authenticate for future requests.

### Properties

#### _www_authenticate_uri


```

--------------------------------

### AuthProtocol Class Definition

Source: https://docs.openstack.org/keystonemiddleware/latest/api/keystonemiddleware.auth_token.html

Represents the middleware that handles authenticating client calls. It defines methods for processing requests and responses, and fetching tokens.

```python
class _keystonemiddleware.auth_token.AuthProtocol(_app_ , _conf_):
    
    Bases: `BaseAuthProtocol`
    Middleware that handles authenticating client calls. 

    fetch_token(_token_ , _allow_expired =False_):
        
        Retrieve a token from either a PKI bundle or the identity server. 

        Parameters:
            
            **token** (_str_) – token id 

        Raises:
            
            **exc.InvalidToken** – if token is rejected 

    process_request(_request_):
        
        Process request.
        Evaluate the headers in a request and attempt to authenticate the request. If authenticated then additional headers are added to the request for use by applications. If not authenticated the request will be rejected or marked unauthenticated depending on configuration. 

    process_response(_response_):
        
        Process Response.
        Add `WWW-Authenticate` headers to requests that failed with `401 Unauthenticated` so users know where to authenticate for future requests. 

    _property _www_authenticate_uri
```

--------------------------------

### ExternalAuth2Protocol Middleware

Source: https://docs.openstack.org/keystonemiddleware/latest/api/keystonemiddleware.external_oauth2_token.html

Middleware component for handling External Server OAuth2.0 authentication within a WSGI pipeline.

```APIDOC
## Middleware Processing

### Description
Handles incoming requests and outgoing responses for OAuth2 authentication.

### Methods
- **process_request(request)**: Processes the incoming AuthTokenRequest.
- **process_response(response)**: Adds 'WWW-Authenticate' headers to 401 Unauthenticated responses to guide users on authentication requirements.
```

--------------------------------

### OAuth2Protocol.process_request

Source: https://docs.openstack.org/keystonemiddleware/latest/api/keystonemiddleware.oauth2_token.html

Processes an incoming request for OAuth2.0 client credentials authentication.

```APIDOC
## process_request(request)

### Description
Processes an incoming request to handle OAuth2.0 client credentials authentication.

### Parameters
#### Path Parameters
- **request** (AuthTokenRequest) - Required - Incoming request object to be processed.
```

--------------------------------

### AuthTokenFixture.add_token_data()

Source: https://docs.openstack.org/keystonemiddleware/latest/api/keystonemiddleware.fixture.html

Adds token data to the auth_token fixture.

```APIDOC
## POST /add_token_data

### Description
Add token data to the auth_token fixture.

### Method
POST

### Endpoint
/add_token_data

### Parameters
#### Request Body
- **token_id** (str) - Optional - The ID of the token.
- **expires** (datetime) - Optional - The expiration time of the token.
- **user_id** (str) - Optional - The ID of the user associated with the token.
- **user_name** (str) - Optional - The username associated with the token.
- **user_domain_id** (str) - Optional - The domain ID of the user.
- **user_domain_name** (str) - Optional - The domain name of the user.
- **project_id** (str) - Optional - The ID of the project.
- **project_name** (str) - Optional - The name of the project.
- **project_domain_id** (str) - Optional - The domain ID of the project.
- **project_domain_name** (str) - Optional - The domain name of the project.
- **role_list** (list) - Optional - A list of roles associated with the token.
- **is_v2** (bool) - Optional - Flag indicating if it's a v2 token (default: False).

### Request Example
```json
{
  "token_id": "abc-123",
  "expires": "2024-12-31T10:00:00Z",
  "user_id": "user123",
  "user_name": "test_user",
  "project_name": "test_project",
  "role_list": ["member", "admin"]
}
```

### Response
#### Success Response (200)
None

#### Response Example
```json
{}
```
```

--------------------------------

### filter_factory Function

Source: https://docs.openstack.org/keystonemiddleware/latest/api/keystonemiddleware.oauth2_mtls_token.html

The filter_factory function returns a WSGI filter app for use with paste.deploy.

```APIDOC
## Function filter_factory(global_conf, **local_conf)

### Description
Return a WSGI filter app for use with paste.deploy.
```

--------------------------------

### OAuth2mTlsProtocol Class

Source: https://docs.openstack.org/keystonemiddleware/latest/api/keystonemiddleware.oauth2_mtls_token.html

The OAuth2mTlsProtocol class is a middleware that handles OAuth2.0 mutual-TLS client authentication. It inherits from AuthProtocol.

```APIDOC
## Class OAuth2mTlsProtocol

### Description
Middleware that handles OAuth2.0 mutual-TLS client authentication.

### Methods
#### process_request(request)

##### Description
Process request.

##### Parameters
- **request** (request.AuthTokenRequest_) - Incoming request
```

--------------------------------

### AuthTokenFixture Class

Source: https://docs.openstack.org/keystonemiddleware/latest/api/keystonemiddleware.fixture.html

The AuthTokenFixture class overrides what keystonemiddleware will return to the app behind it, primarily used for testing.

```APIDOC
## Class AuthTokenFixture

### Description
Overrides what keystonemiddleware will return to the app behind it.

### Method
N/A (Class Definition)

### Endpoint
N/A (Class Definition)

### Parameters
N/A (Class Definition)

### Request Example
N/A (Class Definition)

### Response
N/A (Class Definition)
```

--------------------------------

### BaseAuthProtocol Class

Source: https://docs.openstack.org/keystonemiddleware/latest/api/keystonemiddleware.auth_token.html

The BaseAuthProtocol class serves as a base for implementing token checking logic within the auth_token middleware. It defines the fundamental methods for token retrieval and request/response processing.

```APIDOC
## Class _keystonemiddleware.auth_token.BaseAuthProtocol

Bases: `object`

A base class for AuthProtocol token checking implementations.

**Parameters:**

* **app** (_Callable_) – The next application to call after middleware.
* **log** (_logging.Logger_) – The logging object to use for output. By default it will use a logger in the keystonemiddleware.auth_token namespace.
* **enforce_token_bind** (_str_) – The style of token binding enforcement to perform.

### Methods

#### fetch_token(_token_, _**kwargs_)

Fetch the token data based on the value in the header.
Retrieve the data associated with the token value that was in the header. This can be from PKI, contacting the identity server or whatever is required.

**Parameters:**

* **token** (_str_) – The token present in the request header.
* **kwargs** (_dict_) – Additional keyword arguments may be passed through here to support new features. If an implementation is not aware of how to use these arguments it should ignore them.

**Raises:**

* **exc.InvalidToken** – if token is invalid.

**Returns:**
The token data

**Return type:**
dict

#### process_request(_request_)

Process request.
If this method returns a value then that value will be used as the response. The next application down the stack will not be executed and process_response will not be called.
Otherwise, the next application down the stack will be executed and process_response will be called with the generated response.
By default this method does not return a value.

**Parameters:**

* **request** (__request.AuthTokenRequest_) – Incoming request

#### process_response(_response_)

Do whatever you’d like to the response.
By default the response is returned unmodified.

**Parameters:**

* **response** (_._request._AuthTokenResponse_) – Response object

#### validate_allowed_request(_request_, _token_)


```

--------------------------------

### Configure Audit Notification Driver

Source: https://docs.openstack.org/keystonemiddleware/latest/audit.html

Specify an exclusive notification driver for audit events.

```ini
[audit_middleware_notifications]
driver = log

```

--------------------------------

### Auth Token Headers Added by Keystone Middleware

Source: https://docs.openstack.org/keystonemiddleware/latest/api/keystonemiddleware.auth_token.html

This section details the HTTP headers that the Keystone middleware adds to requests when using composite authentication. These headers provide information about the authenticated user and their scope, which are then used by OpenStack services.

```APIDOC
## Auth Token Headers Added by Keystone Middleware

### Description
These headers are added to requests by the Keystone middleware to provide authentication and authorization information to downstream OpenStack services. They are particularly relevant when composite authentication (user and service tokens) is used.

### Headers

- **HTTP_X_IDENTITY_STATUS** (string) - Indicates the status of the identity token, either `Confirmed` or `Invalid`. Always set, even if no user token is presented.
- **HTTP_X_SERVICE_IDENTITY_STATUS** (string) - Indicates the status of the service identity token, either `Confirmed` or `Invalid`. Only present if a service token is presented and `delay_auth_decision` mode is configured.
- **HTTP_OPENSTACK_SYSTEM_SCOPE** (string) - Relays system information about the token's scope. Value is `all` if the token is system-scoped.
- **HTTP_X_DOMAIN_ID** (string) - Identity service managed unique identifier for the domain. Only present for domain-scoped tokens.
- **HTTP_X_SERVICE_DOMAIN_ID** (string) - Service-specific domain identifier. Only present for domain-scoped service tokens.
- **HTTP_X_DOMAIN_NAME** (string) - Unique domain name. Only present for domain-scoped tokens.
- **HTTP_X_SERVICE_DOMAIN_NAME** (string) - Service-specific domain name. Only present for domain-scoped service tokens.
- **HTTP_X_PROJECT_ID** (string) - Identity service managed unique identifier for the project. Only present for project-scoped tokens.
- **HTTP_X_SERVICE_PROJECT_ID** (string) - Service-specific project identifier. Only present for project-scoped service tokens.
- **HTTP_X_PROJECT_NAME** (string) - Project name, unique within its owning domain. Only present for project-scoped tokens.
- **HTTP_X_SERVICE_PROJECT_NAME** (string) - Service-specific project name. Only present for project-scoped service tokens.
- **HTTP_X_PROJECT_DOMAIN_ID** (string) - Identity service managed unique identifier of the owning domain of the project. Only present for project-scoped v3 tokens.
- **HTTP_X_SERVICE_PROJECT_DOMAIN_ID** (string) - Service-specific project domain identifier. Only present for project-scoped v3 service tokens.
- **HTTP_X_PROJECT_DOMAIN_NAME** (string) - Name of the owning domain of the project. Only present for project-scoped v3 tokens.
- **HTTP_X_SERVICE_PROJECT_DOMAIN_NAME** (string) - Service-specific project domain name. Only present for project-scoped v3 service tokens.
- **HTTP_X_USER_ID** (string) - Identity service managed unique identifier for the user.
- **HTTP_X_SERVICE_USER_ID** (string) - Service-specific user identifier. Only present for service tokens.
- **HTTP_X_USER_NAME** (string) - User identifier, unique within its owning domain.
- **HTTP_X_SERVICE_USER_NAME** (string) - Service-specific user name. Only present for service tokens.
- **HTTP_X_USER_DOMAIN_ID** (string) - Identity service managed unique identifier of the owning domain of the user.
- **HTTP_X_SERVICE_USER_DOMAIN_ID** (string) - Service-specific user domain identifier. Only present for service tokens.
- **HTTP_X_USER_DOMAIN_NAME** (string) - Name of the owning domain of the user.
- **HTTP_X_SERVICE_USER_DOMAIN_NAME** (string) - Service-specific user domain name. Only present for service tokens.
- **HTTP_X_ROLES** (string) - Comma-delimited list of case-sensitive role names.
- **HTTP_X_SERVICE_ROLES** (string) - Service-specific role names. Only present for service tokens.
- **HTTP_X_IS_ADMIN_PROJECT** (string) - Indicates if the user's token is scoped to the admin project. Values are `True` or `False`.
- **HTTP_X_SERVICE_CATALOG** (string) - Service catalog in JSON string format (optional). Always in V2 format for compatibility.
- **HTTP_X_TENANT_ID** (string) - Deprecated. Equivalent to `HTTP_X_PROJECT_ID`.
- **HTTP_X_TENANT_NAME** (string) - Deprecated. Equivalent to `HTTP_X_PROJECT_NAME`.
- **HTTP_X_TENANT** (string) - Deprecated. Equivalent to `HTTP_X_TENANT_ID` and `HTTP_X_TENANT_NAME`.
- **HTTP_X_USER** (string) - Deprecated. Equivalent to `HTTP_X_USER_ID` and `HTTP_X_USER_NAME`.
- **HTTP_X_ROLE** (string) - Deprecated. Equivalent to `HTTP_X_ROLES`.
```

--------------------------------

### AuthTokenFixture.tokens property

Source: https://docs.openstack.org/keystonemiddleware/latest/api/keystonemiddleware.fixture.html

Property to access the tokens managed by the fixture.

```APIDOC
## GET /tokens

### Description
Provides access to the tokens managed by the fixture.

### Method
GET

### Endpoint
/tokens

### Parameters
N/A

### Request Example
```json
{}
```

### Response
#### Success Response (200)
- **tokens** (dict) - A dictionary containing the tokens.

#### Response Example
```json
{
  "tokens": {
    "token_id_1": { ... token data ... },
    "token_id_2": { ... token data ... }
  }
}
```
```

--------------------------------

### OAuth2 Token Introspection

Source: https://docs.openstack.org/keystonemiddleware/latest/api/keystonemiddleware.external_oauth2_token.html

Methods for verifying access tokens against an OAuth2 server using various authentication strategies.

```APIDOC
## POST /introspect

### Description
Access the Introspect API to verify an access token using a specific authentication method.

### Parameters
#### Request Body
- **access_token** (string) - Required - The OAuth2 access token to be verified.

### Supported Clients
- **ClientSecretBasicAuthClient**: Uses 'client_secret_basic' auth method.
- **ClientSecretJwtAuthClient**: Uses 'client_secret_jwt' auth method.
- **ClientSecretPostAuthClient**: Uses 'client_secret_post' auth method.
- **PrivateKeyJwtAuthClient**: Uses 'private_key_jwt' auth method.
- **TlsClientAuthClient**: Uses 'tls_client_auth' auth method.
```

--------------------------------

### External OAuth2 Protocol Processing

Source: https://docs.openstack.org/keystonemiddleware/latest/api/keystonemiddleware.external_oauth2_token.html

Methods for processing requests and responses within the ExternalAuth2Protocol.

```APIDOC
## ExternalAuth2Protocol Processing

### Description
Handles the processing of incoming requests and outgoing responses for the OAuth2 protocol flow.

### Methods
- ExternalAuth2Protocol.process_request()
- ExternalAuth2Protocol.process_response()
```

--------------------------------

### Configure Audit Notification Transport

Source: https://docs.openstack.org/keystonemiddleware/latest/audit.html

Define a custom transport URL for audit notifications when using messaging drivers.

```ini
[audit_middleware_notifications]
driver = messaging
transport_url = rabbit://user2:passwd@host:5672/another_virtual_host

```

--------------------------------

### External OAuth2 Token Introspection

Source: https://docs.openstack.org/keystonemiddleware/latest/api/keystonemiddleware.external_oauth2_token.html

Methods for introspecting OAuth2 tokens using various authentication client strategies.

```APIDOC
## Introspection Methods

### Description
These methods perform token introspection against an OAuth2 provider using specific authentication client implementations.

### Methods
- AbstractAuthClient.introspect()
- ClientSecretBasicAuthClient.introspect()
- ClientSecretJwtAuthClient.introspect()
- ClientSecretPostAuthClient.introspect()
- PrivateKeyJwtAuthClient.introspect()
- TlsClientAuthClient.introspect()
```
Tokens:
Raw