Merge lp:~salvatore-orlando/neutron/bug838006 into lp:neutron/diablo

[Salvatore Orlando]

************************************************************
NOTE: There merge proposal has a prerequisite branch:
~salvatore-orlando/quantum/quantum-api-auth
Please review it after the above branch has been merged
************************************************************

This branch simply allows the client library to add the Auth token for keystone in the request. The auth token is specified in the constructor, and it is optional.

The cli has also been update. The auth token can be specified as a command line parameter (-t or --token)

[Somik Behera (somikbehera)]

quantum.conf :

- We disable keystone integration by default, I think you missed this by mistake.

Otherwise, this change looks simple enough and adds optional auth component support to our client infrastructure.

I'll do another review and approve the merge-prop once we have merged the keystone integration branch.

[Brad Hall (bgh)]

Looks good to me

review: Approve

[Salvatore Orlando (salvatore-orlando)]

>
> quantum.conf :
>
> - We disable keystone integration by default, I think you missed this by
> mistake.
>
> Otherwise, this change looks simple enough and adds optional auth component
> support to our client infrastructure.
>
> I'll do another review and approve the merge-prop once we have merged the
> keystone integration branch.

Yeah, I forgot to revert it after testing. Will update soon.
Reverting to WIP for now.

[Salvatore Orlando (salvatore-orlando)]

The default pipeline in etc/quantum.conf has been restored

[dan wendlandt (danwent)]

This looks good, but to avoid confusion, I will wait to approve until the main keystone branch is merged.

[Salvatore Orlando (salvatore-orlando)]

> This looks good, but to avoid confusion, I will wait to approve until the main
> keystone branch is merged.

Definitely (the keystone branch is marked as prerequisite).
I've waited till now to merge the Keystone branch as I wasn't sure if you guys had more feedback. As your approvals are there anyway, I think it is now safe to merge.

[dan wendlandt (danwent)]

I'm curious why the diff shows etc/quantum.conf being added, but when I merge into trunk it does not. Merged branch looks simple enough and makes sense.

Basic testing to make sure cli file correctly parses and loads.

review: Approve

=== modified file 'bin/cli'
--- bin/cli	2011-08-26 08:41:19 +0000
+++ bin/cli	2011-09-02 07:12:21 +0000
@@ -126,6 +126,8 @@
       action="store_true", default=False, help="turn on verbose logging")
     parser.add_option("-f", "--logfile", dest="logfile",
       type="string", default="syslog", help="log file path")
+    parser.add_option("-t", "--token", dest="token",
+      type="string", default=None, help="authentication token")
     options, args = parser.parse_args()
 
     if options.verbose:
@@ -158,7 +160,8 @@
     LOG.info("Executing command \"%s\" with args: %s" % (cmd, args))
 
     client = Client(options.host, options.port, options.ssl,
-                    args[0], FORMAT)
+                    args[0], FORMAT,
+                    auth_token=options.token)
     commands[cmd]["func"](client, *args)
 
     LOG.info("Command execution completed")

=== added file 'etc/quantum.conf'
--- etc/quantum.conf	1970-01-01 00:00:00 +0000
+++ etc/quantum.conf	2011-09-02 07:12:21 +0000
@@ -0,0 +1,49 @@
+[DEFAULT]
+# Show more verbose log output (sets INFO log level output)
+verbose = True
+
+# Show debugging output in logs (sets DEBUG log level output)
+debug = True
+
+# Address to bind the API server
+bind_host = 0.0.0.0
+
+# Port the bind the API server to
+bind_port = 9696
+
+# Path to the extensions
+api_extensions_path = extensions
+
+[composite:quantum]
+use = egg:Paste#urlmap
+/: quantumversions
+/v1.0: quantumapi
+
+[pipeline:quantumapi]
+# To enable keystone integration uncomment the following line and
+# comment the next one
+#pipeline = authN authZ extensions quantumapiapp
+pipeline = extensions quantumapiapp
+
+
+[filter:authN]
+paste.filter_factory = quantum.common.authentication:filter_factory
+auth_host = 127.0.0.1
+auth_port = 5001
+auth_protocol = http
+auth_version = 2.0
+#auth_admin_token = 9a82c95a-99e9-4c3a-b5ee-199f6ba7ff04
+auth_admin_user = admin
+auth_admin_password = secrete
+
+[filter:authZ]
+paste.filter_factory = quantum.common.authorization:filter_factory
+
+[filter:extensions]
+paste.filter_factory = quantum.common.extensions:plugin_aware_extension_middleware_factory
+
+[app:quantumversions]
+paste.app_factory = quantum.api.versions:Versions.factory
+
+[app:quantumapiapp]
+paste.app_factory = quantum.api:APIRouterV1.factory

=== modified file 'quantum/client.py'
--- quantum/client.py	2011-08-30 01:59:14 +0000
+++ quantum/client.py	2011-09-02 07:12:21 +0000
@@ -34,6 +34,7 @@
     431: exceptions.StateInvalid,
     432: exceptions.PortInUseClient,
     440: exceptions.AlreadyAttachedClient}
+AUTH_TOKEN_HEADER = "X-Auth-Token"
 
 
 class ApiCall(object):
@@ -83,7 +84,8 @@
 
     def __init__(self, host="127.0.0.1", port=9696, use_ssl=False, tenant=None,
                 format="xml", testingStub=None, key_file=None, cert_file=None,
-                logger=None, action_prefix="/v1.0/tenants/{tenant_id}"):
+                auth_token=None, logger=None,
+                action_prefix="/v1.0/tenants/{tenant_id}"):
         """
         Creates a new client to some service.
 
@@ -95,6 +97,9 @@
         :param testingStub: A class that stubs basic server methods for tests
         :param key_file: The SSL key file to use if use_ssl is true
         :param cert_file: The SSL cert file to use if use_ssl is true
+        :param auth_token: authentication token to be passed to server
+        :param logger: Logger object for the client library
+        :param action_prefix: prefix for request URIs
         """
         self.host = host
         self.port = port
@@ -106,6 +111,7 @@
         self.key_file = key_file
         self.cert_file = cert_file
         self.logger = logger
+        self.auth_token = auth_token
         self.action_prefix = action_prefix
 
     def get_connection_type(self):
@@ -163,6 +169,9 @@
             connection_type = self.get_connection_type()
             headers = headers or {"Content-Type":
                                       "application/%s" % self.format}
+            # if available, add authentication token
+            if self.auth_token:
+                headers[AUTH_TOKEN_HEADER] = self.auth_token
             # Open connection and send request, handling SSL certs
             certs = {'key_file': self.key_file, 'cert_file': self.cert_file}
             certs = dict((x, certs[x]) for x in certs if certs[x] != None)