Name	Size	Mode	Actions
hooks/	-	0755	rm
__pycache__/	-	0755	rm
test_aggregate.py	2091	0644	editdlrm
test_clustering.py	49762	0644	editdlrm
test_cluster_templates.py	4186	0644	editdlrm
test_coe_clusters.py	1013	0644	editdlrm
test_compute.py	22058	0644	editdlrm
test_devstack.py	1892	0644	editdlrm
test_domain.py	5101	0644	editdlrm
test_endpoints.py	7841	0644	editdlrm
test_flavor.py	6683	0644	editdlrm
test_floating_ip.py	11651	0644	editdlrm
test_floating_ip_pool.py	1792	0644	editdlrm
test_groups.py	4017	0644	editdlrm
test_identity.py	10600	0644	editdlrm
test_image.py	6827	0644	editdlrm
test_inventory.py	3783	0644	editdlrm
test_keypairs.py	2424	0644	editdlrm
test_limits.py	1840	0644	editdlrm
test_magnum_services.py	1451	0644	editdlrm
test_network.py	5327	0644	editdlrm
test_object.py	7450	0644	editdlrm
test_port.py	5865	0644	editdlrm
test_project.py	4796	0644	editdlrm
test_project_cleanup.py	3991	0644	editdlrm
test_qos_bandwidth_limit_rule.py	4110	0644	editdlrm
test_qos_dscp_marking_rule.py	2775	0644	editdlrm
test_qos_minimum_bandwidth_rule.py	2808	0644	editdlrm
test_qos_policy.py	3997	0644	editdlrm
test_quotas.py	3242	0644	editdlrm
test_range_search.py	6120	0644	editdlrm
test_recordset.py	6629	0644	editdlrm
test_router.py	13924	0644	editdlrm
test_security_groups.py	2536	0644	editdlrm
test_server_group.py	1449	0644	editdlrm
test_services.py	5332	0644	editdlrm
test_stack.py	5737	0644	editdlrm
test_users.py	6634	0644	editdlrm
test_volume.py	6805	0644	editdlrm
test_volume_backup.py	5081	0644	editdlrm
test_volume_type.py	4567	0644	editdlrm
test_zone.py	3079	0644	editdlrm
util.py	1358	0644	editdlrm
__init__.py	0	0644	editdlrm

# Licensed under the Apache License, Version 2.0 (the "License"); you may # not use this file except in compliance with the License. You may obtain # a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the # License for the specific language governing permissions and limitations # under the License. """ test_identity ---------------------------------- Functional tests for `shade` identity methods. """ import random import string from openstack.cloud.exc import OpenStackCloudException from openstack.tests.functional import base class TestIdentity(base.KeystoneBaseFunctionalTest): def setUp(self): super(TestIdentity, self).setUp() self.role_prefix = 'test_role' + ''.join( random.choice(string.ascii_lowercase) for _ in range(5)) self.user_prefix = self.getUniqueString('user') self.group_prefix = self.getUniqueString('group') self.addCleanup(self._cleanup_users) if self.identity_version not in ('2', '2.0'): self.addCleanup(self._cleanup_groups) self.addCleanup(self._cleanup_roles) def _cleanup_groups(self): exception_list = list() for group in self.operator_cloud.list_groups(): if group['name'].startswith(self.group_prefix): try: self.operator_cloud.delete_group(group['id']) except Exception as e: exception_list.append(str(e)) continue if exception_list: # Raise an error: we must make users aware that something went # wrong raise OpenStackCloudException('\n'.join(exception_list)) def _cleanup_users(self): exception_list = list() for user in self.operator_cloud.list_users(): if user['name'].startswith(self.user_prefix): try: self.operator_cloud.delete_user(user['id']) except Exception as e: exception_list.append(str(e)) continue if exception_list: raise OpenStackCloudException('\n'.join(exception_list)) def _cleanup_roles(self): exception_list = list() for role in self.operator_cloud.list_roles(): if role['name'].startswith(self.role_prefix): try: self.operator_cloud.delete_role(role['name']) except Exception as e: exception_list.append(str(e)) continue if exception_list: raise OpenStackCloudException('\n'.join(exception_list)) def _create_user(self, **kwargs): domain_id = None if self.identity_version not in ('2', '2.0'): domain = self.operator_cloud.get_domain('default') domain_id = domain['id'] return self.operator_cloud.create_user(domain_id=domain_id, **kwargs) def test_list_roles(self): roles = self.operator_cloud.list_roles() self.assertIsNotNone(roles) self.assertNotEqual([], roles) def test_get_role(self): role = self.operator_cloud.get_role('admin') self.assertIsNotNone(role) self.assertIn('id', role) self.assertIn('name', role) self.assertEqual('admin', role['name']) def test_search_roles(self): roles = self.operator_cloud.search_roles(filters={'name': 'admin'}) self.assertIsNotNone(roles) self.assertEqual(1, len(roles)) self.assertEqual('admin', roles[0]['name']) def test_create_role(self): role_name = self.role_prefix + '_create_role' role = self.operator_cloud.create_role(role_name) self.assertIsNotNone(role) self.assertIn('id', role) self.assertIn('name', role) self.assertEqual(role_name, role['name']) def test_delete_role(self): role_name = self.role_prefix + '_delete_role' role = self.operator_cloud.create_role(role_name) self.assertIsNotNone(role) self.assertTrue(self.operator_cloud.delete_role(role_name)) # TODO(Shrews): Once we can support assigning roles within shade, we # need to make this test a little more specific, and add more for testing # filtering functionality. def test_list_role_assignments(self): if self.identity_version in ('2', '2.0'): self.skipTest("Identity service does not support role assignments") assignments = self.operator_cloud.list_role_assignments() self.assertIsInstance(assignments, list) self.assertGreater(len(assignments), 0) def test_list_role_assignments_v2(self): user = self.operator_cloud.get_user('demo') project = self.operator_cloud.get_project('demo') assignments = self.operator_cloud.list_role_assignments( filters={'user': user['id'], 'project': project['id']}) self.assertIsInstance(assignments, list) self.assertGreater(len(assignments), 0) def test_grant_revoke_role_user_project(self): user_name = self.user_prefix + '_user_project' user_email = 'nobody@nowhere.com' role_name = self.role_prefix + '_grant_user_project' role = self.operator_cloud.create_role(role_name) user = self._create_user(name=user_name, email=user_email, default_project='demo') self.assertTrue(self.operator_cloud.grant_role( role_name, user=user['id'], project='demo', wait=True)) assignments = self.operator_cloud.list_role_assignments({ 'role': role['id'], 'user': user['id'], 'project': self.operator_cloud.get_project('demo')['id'] }) self.assertIsInstance(assignments, list) self.assertEqual(1, len(assignments)) self.assertTrue(self.operator_cloud.revoke_role( role_name, user=user['id'], project='demo', wait=True)) assignments = self.operator_cloud.list_role_assignments({ 'role': role['id'], 'user': user['id'], 'project': self.operator_cloud.get_project('demo')['id'] }) self.assertIsInstance(assignments, list) self.assertEqual(0, len(assignments)) def test_grant_revoke_role_group_project(self): if self.identity_version in ('2', '2.0'): self.skipTest("Identity service does not support group") role_name = self.role_prefix + '_grant_group_project' role = self.operator_cloud.create_role(role_name) group_name = self.group_prefix + '_group_project' group = self.operator_cloud.create_group( name=group_name, description='test group', domain='default') self.assertTrue(self.operator_cloud.grant_role( role_name, group=group['id'], project='demo')) assignments = self.operator_cloud.list_role_assignments({ 'role': role['id'], 'group': group['id'], 'project': self.operator_cloud.get_project('demo')['id'] }) self.assertIsInstance(assignments, list) self.assertEqual(1, len(assignments)) self.assertTrue(self.operator_cloud.revoke_role( role_name, group=group['id'], project='demo')) assignments = self.operator_cloud.list_role_assignments({ 'role': role['id'], 'group': group['id'], 'project': self.operator_cloud.get_project('demo')['id'] }) self.assertIsInstance(assignments, list) self.assertEqual(0, len(assignments)) def test_grant_revoke_role_user_domain(self): if self.identity_version in ('2', '2.0'): self.skipTest("Identity service does not support domain") role_name = self.role_prefix + '_grant_user_domain' role = self.operator_cloud.create_role(role_name) user_name = self.user_prefix + '_user_domain' user_email = 'nobody@nowhere.com' user = self._create_user(name=user_name, email=user_email, default_project='demo') self.assertTrue(self.operator_cloud.grant_role( role_name, user=user['id'], domain='default')) assignments = self.operator_cloud.list_role_assignments({ 'role': role['id'], 'user': user['id'], 'domain': self.operator_cloud.get_domain('default')['id'] }) self.assertIsInstance(assignments, list) self.assertEqual(1, len(assignments)) self.assertTrue(self.operator_cloud.revoke_role( role_name, user=user['id'], domain='default')) assignments = self.operator_cloud.list_role_assignments({ 'role': role['id'], 'user': user['id'], 'domain': self.operator_cloud.get_domain('default')['id'] }) self.assertIsInstance(assignments, list) self.assertEqual(0, len(assignments)) def test_grant_revoke_role_group_domain(self): if self.identity_version in ('2', '2.0'): self.skipTest("Identity service does not support domain or group") role_name = self.role_prefix + '_grant_group_domain' role = self.operator_cloud.create_role(role_name) group_name = self.group_prefix + '_group_domain' group = self.operator_cloud.create_group( name=group_name, description='test group', domain='default') self.assertTrue(self.operator_cloud.grant_role( role_name, group=group['id'], domain='default')) assignments = self.operator_cloud.list_role_assignments({ 'role': role['id'], 'group': group['id'], 'domain': self.operator_cloud.get_domain('default')['id'] }) self.assertIsInstance(assignments, list) self.assertEqual(1, len(assignments)) self.assertTrue(self.operator_cloud.revoke_role( role_name, group=group['id'], domain='default')) assignments = self.operator_cloud.list_role_assignments({ 'role': role['id'], 'group': group['id'], 'domain': self.operator_cloud.get_domain('default')['id'] }) self.assertIsInstance(assignments, list) self.assertEqual(0, len(assignments))