keyston api与代码router映射

2   

1      简要说明

    OpenStackkeystone服务使用routes+paste+wsgi来实现urls映射到应用具体的action，并执行相关的请求动作。

其中：keystone的urls可以参考（本文主要说的是v3认证接口）：

https://developer.openstack.org/api-ref/identity/v3/

2      wsgi中paste入口

    python中的WSGI（Web Server Gateway Interface）是Python应用程序或框架与Web服务器之间的一种接口，定义了一套借口来实现服务器与应用端的通信规范。按照一套规范，应用端想要通信，很简单，只需要实现一个接受两个参数的，含有__call__方法并返回一个可遍历的含有零个或者多个string结果的python对象。

服务端，对于每个http请求，调用一次应用端“注册”的那个协议规定应用必须实现的对象，然后返回相应的响应消息。 WSGI Server唯一的任务就是接收来自client的请求，然后将请求传给application，最后将application的response传递给client。中间存在的一些东西，就需要中间件来处理。

1、通过简单的命令行操作

# openstack --deubg project list   GET call to identity for http://control_ip:35357/v3/projects +----------------------------------+------------+ | ID                               | Name       | +----------------------------------+------------+ | 6e87bb0c4bf6433bacbe4c08939059c0 | services   | | b05e46cdee7f4478b51bad71de703454 | admin      | +----------------------------------+------------+

2、我们可以看出，调用 openstack –deubgproject list 的时候，client端发送了一条获取项目列表的curl请求：http://control_ip:35357/v3/projects。

3、这条请求就是有paste模块进行解析。

我们可以在/etc/keystone/keystone-paste.ini中找到对应处理方式：

# vim /etc/keystone/keystone-paste.ini [composite:main] use = egg:Paste#urlmap /v2.0 = public_api /v3 = api_v3 / = public_version_api   [pipeline:api_v3] # The last item in this pipeline must be service_v3 or an equivalent # application. It cannot be a filter. pipeline = healthcheck cors sizelimit http_proxy_to_wsgi osprofiler url_normalize request_id admin_token_auth build_auth_context token_auth json_body ec2_extension_v3 s3_extension service_v3 [app:service_v3] use = egg:keystone#service_v3

4、paste模块会加载keystone-paste.ini文件中的[composite:main]这个wsgi应用。

根据paste处理机制，”/v3”请求过来的url会转发到”api_v3”(/v3 = api_v3)进行处理。

最终由[pipeline:api_v3]session中的 service_v3模块接受请求。

service_v3的代表的是egg:keystone#service_v3这个模块。

 5、service_v3这个对应的代码可以在entry_points.txt中查询到

cat  /xxx/site-packages/keystone-$version.egg-info/entry_points.txt |grep service_v3 service_v3 = keystone.version.service:v3_app_factory

3      v3_app_factory代码

1、在keystone.version.service中可以看到这样一份代码

from keystone.assignment import routers as assignment_routers from keystone.auth import routers as auth_routers from keystone.catalog import routers as catalog_routers from keystone.common import wsgi import keystone.conf from keystone.credential import routers as credential_routers from keystone.endpoint_policy import routers as endpoint_policy_routers from keystone.federation import routers as federation_routers from keystone.i18n import _LW from keystone.identity import routers as identity_routers from keystone.oauth1 import routers as oauth1_routers from keystone.policy import routers as policy_routers from keystone.resource import routers as resource_routers from keystone.revoke import routers as revoke_routers from keystone.token import _simple_cert as simple_cert_ext from keystone.token import routers as token_routers from keystone.trust import routers as trust_routers   @fail_gracefully @warn_local_conf def v3_app_factory(global_conf, **local_conf):     controllers.register_version('v3')     mapper = routes.Mapper()     sub_routers = []     _routers = []     # NOTE(dstanek): Routers should be ordered by their frequency of use in     # a live system. This is due to the routes implementation. The most     # frequently used routers should appear first.     all_api_routers = [auth_routers,                        assignment_routers,                        catalog_routers,                        credential_routers,                        identity_routers,                        policy_routers,                        resource_routers,                        revoke_routers,                        federation_routers,                        oauth1_routers,                        endpoint_policy_routers,                        simple_cert_ext]     if CONF.trust.enabled:         all_api_routers.append(trust_routers)     for api_routers in all_api_routers:         routers_instance = api_routers.Routers()         _routers.append(routers_instance)         routers_instance.append_v3_routers(mapper, sub_routers)     # Add in the v3 version api     sub_routers.append(routers.VersionV3('public', _routers))     return wsgi.ComposingRouter(mapper, sub_routers)

2、查看

resource_routers

from keystone.resource import controllers class Routers(wsgi.RoutersBase):     def append_v3_routers(self, mapper, routers):         routers.append(             router.Router(controllers.DomainV3(),                           'domains', 'domain',                           resource_descriptions=self.v3_resources))         config_controller = controllers.DomainConfigV3()         self._add_resource(             mapper, config_controller,             path='/domains/{domain_id}/config',             get_head_action='get_domain_config',             put_action='create_domain_config',             patch_action='update_domain_config_only',             delete_action='delete_domain_config',             rel=json_home.build_v3_resource_relation('domain_config'),             path_vars={                 'domain_id': json_home.Parameters.DOMAIN_ID             })         config_group_param = (             json_home.build_v3_parameter_relation('config_group'))         self._add_resource(             mapper, config_controller,             path='/domains/{domain_id}/config/{group}',             get_head_action='get_domain_config_wrapper',             patch_action='update_domain_config_group',             delete_action='delete_domain_config',             rel=json_home.build_v3_resource_relation('domain_config_group'),             path_vars={                 'domain_id': json_home.Parameters.DOMAIN_ID,                 'group': config_group_param             })         self._add_resource(             mapper, config_controller,             path='/domains/{domain_id}/config/{group}/{option}',             get_head_action='get_domain_config_wrapper',             patch_action='update_domain_config',             delete_action='delete_domain_config',             rel=json_home.build_v3_resource_relation('domain_config_option'),             path_vars={                 'domain_id': json_home.Parameters.DOMAIN_ID,                 'group': config_group_param,                 'option': json_home.build_v3_parameter_relation(                     'config_option')             })         self._add_resource(             mapper, config_controller,             path='/domains/config/default',             get_action='get_domain_config_default',             rel=json_home.build_v3_resource_relation('domain_config_default'))         self._add_resource(             mapper, config_controller,             path='/domains/config/{group}/default',             get_action='get_domain_config_default',             rel=json_home.build_v3_resource_relation(                 'domain_config_default_group'),             path_vars={                 'group': config_group_param             })         self._add_resource(             mapper, config_controller,             path='/domains/config/{group}/{option}/default',             get_action='get_domain_config_default',             rel=json_home.build_v3_resource_relation(                 'domain_config_default_option'),             path_vars={                 'group': config_group_param,                 'option': json_home.build_v3_parameter_relation(                     'config_option')             })         routers.append(             router.Router(controllers.ProjectV3(),  #项目的请求映射                           'projects', 'project',                           resource_descriptions=self.v3_resources))

可以看出projects最终的处理controller是keystone.resource.controllers.ProjectV3()这个类来处理的。

    查看ProjectV3这个类，即可看到所有curl对应的处理代码。

4      全部模块的映射关系

4.1    auth_routers（token操作）

代码路径 keystone.auth.routers

from keystone.auth import controllers class Routers(wsgi.RoutersBase):     def append_v3_routers(self, mapper, routers):         auth_controller = controllers.Auth()         self._add_resource(             mapper, auth_controller,             path='/auth/tokens',             get_action='validate_token',             head_action='check_token',             post_action='authenticate_for_token',             delete_action='revoke_token',             rel=json_home.build_v3_resource_relation('auth_tokens'))         self._add_resource(             mapper, auth_controller,             path='/auth/tokens/OS-PKI/revoked',             get_action='revocation_list',             rel=json_home.build_v3_extension_resource_relation(                 'OS-PKI', '1.0', 'revocations'))         self._add_resource(             mapper, auth_controller,             path='/auth/catalog',             get_action='get_auth_catalog',             rel=json_home.build_v3_resource_relation('auth_catalog'))         self._add_resource(             mapper, auth_controller,             path='/auth/projects',             get_action='get_auth_projects',             rel=json_home.build_v3_resource_relation('auth_projects'))         self._add_resource(             mapper, auth_controller,             path='/auth/domains',             get_action='get_auth_domains',             rel=json_home.build_v3_resource_relation('auth_domains'))

4.1    assignment_routers（权限操作）

代码路径keystone.assignment.routers

class Routers(wsgi.RoutersBase):     def append_v3_routers(self, mapper, routers):         project_controller = controllers.ProjectAssignmentV3()         self._add_resource(             mapper, project_controller,             path='/users/{user_id}/projects',             get_head_action='list_user_projects',             rel=json_home.build_v3_resource_relation('user_projects'),             path_vars={                 'user_id': json_home.Parameters.USER_ID,             })         routers.append(             router.Router(controllers.RoleV3(), 'roles', 'role',                           resource_descriptions=self.v3_resources,                           method_template='%s_wrapper'))         implied_roles_controller = controllers.ImpliedRolesV3()         self._add_resource(             mapper, implied_roles_controller,             path='/roles/{prior_role_id}/implies',             rel=json_home.build_v3_resource_relation('implied_roles'),             get_action='list_implied_roles',             status=json_home.Status.EXPERIMENTAL,             path_vars={                 'prior_role_id': json_home.Parameters.ROLE_ID,             }         )         self._add_resource(             mapper, implied_roles_controller,             path='/roles/{prior_role_id}/implies/{implied_role_id}',             put_action='create_implied_role',             delete_action='delete_implied_role',             head_action='check_implied_role',             get_action='get_implied_role',             rel=json_home.build_v3_resource_relation('implied_role'),             status=json_home.Status.EXPERIMENTAL,             path_vars={                 'prior_role_id': json_home.Parameters.ROLE_ID,                 'implied_role_id': json_home.Parameters.ROLE_ID             }         )         self._add_resource(             mapper, implied_roles_controller,             path='/role_inferences',             get_action='list_role_inference_rules',             rel=json_home.build_v3_resource_relation('role_inferences'),             status=json_home.Status.EXPERIMENTAL,             path_vars={}         )         grant_controller = controllers.GrantAssignmentV3()         self._add_resource(             mapper, grant_controller,             path='/projects/{project_id}/users/{user_id}/roles/{role_id}',             get_head_action='check_grant',             put_action='create_grant',             delete_action='revoke_grant',             rel=json_home.build_v3_resource_relation('project_user_role'),             path_vars={                 'project_id': json_home.Parameters.PROJECT_ID,                 'role_id': json_home.Parameters.ROLE_ID,                 'user_id': json_home.Parameters.USER_ID,             })         self._add_resource(             mapper, grant_controller,             path='/projects/{project_id}/groups/{group_id}/roles/{role_id}',             get_head_action='check_grant',             put_action='create_grant',             delete_action='revoke_grant',             rel=json_home.build_v3_resource_relation('project_group_role'),             path_vars={                 'group_id': json_home.Parameters.GROUP_ID,                 'project_id': json_home.Parameters.PROJECT_ID,                 'role_id': json_home.Parameters.ROLE_ID,             })         self._add_resource(             mapper, grant_controller,             path='/projects/{project_id}/users/{user_id}/roles',             get_head_action='list_grants',             rel=json_home.build_v3_resource_relation('project_user_roles'),             path_vars={                 'project_id': json_home.Parameters.PROJECT_ID,                 'user_id': json_home.Parameters.USER_ID,             })         self._add_resource(             mapper, grant_controller,             path='/projects/{project_id}/groups/{group_id}/roles',             get_head_action='list_grants',             rel=json_home.build_v3_resource_relation('project_group_roles'),             path_vars={                 'group_id': json_home.Parameters.GROUP_ID,                 'project_id': json_home.Parameters.PROJECT_ID,             })         self._add_resource(             mapper, grant_controller,             path='/domains/{domain_id}/users/{user_id}/roles/{role_id}',             get_head_action='check_grant',             put_action='create_grant',             delete_action='revoke_grant',             rel=json_home.build_v3_resource_relation('domain_user_role'),             path_vars={                 'domain_id': json_home.Parameters.DOMAIN_ID,                 'role_id': json_home.Parameters.ROLE_ID,                 'user_id': json_home.Parameters.USER_ID,             })         self._add_resource(             mapper, grant_controller,             path='/domains/{domain_id}/groups/{group_id}/roles/{role_id}',             get_head_action='check_grant',             put_action='create_grant',             delete_action='revoke_grant',             rel=json_home.build_v3_resource_relation('domain_group_role'),             path_vars={                 'domain_id': json_home.Parameters.DOMAIN_ID,                 'group_id': json_home.Parameters.GROUP_ID,                 'role_id': json_home.Parameters.ROLE_ID,             })         self._add_resource(             mapper, grant_controller,             path='/domains/{domain_id}/users/{user_id}/roles',             get_head_action='list_grants',             rel=json_home.build_v3_resource_relation('domain_user_roles'),             path_vars={                 'domain_id': json_home.Parameters.DOMAIN_ID,                 'user_id': json_home.Parameters.USER_ID,             })         self._add_resource(             mapper, grant_controller,             path='/domains/{domain_id}/groups/{group_id}/roles',             get_head_action='list_grants',             rel=json_home.build_v3_resource_relation('domain_group_roles'),             path_vars={                 'domain_id': json_home.Parameters.DOMAIN_ID,                 'group_id': json_home.Parameters.GROUP_ID,             })         self._add_resource(             mapper, controllers.RoleAssignmentV3(),             path='/role_assignments',             get_head_action='list_role_assignments_wrapper',             rel=json_home.build_v3_resource_relation('role_assignments'))         # Add by fukaixiang for user identity, begin         self._add_resource(             mapper, controllers.RoleAssignmentV3(),             path='/user_identity',             get_head_action='user_identity',             rel=json_home.build_v3_resource_relation('user_identity'))         # Add by fukaixiang for user identity, end         self._add_resource(             mapper, grant_controller,             path='/OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/'             '{role_id}/inherited_to_projects',             get_head_action='check_grant',             put_action='create_grant',             delete_action='revoke_grant',             rel=build_os_inherit_relation(                 resource_name='domain_user_role_inherited_to_projects'),             path_vars={                 'domain_id': json_home.Parameters.DOMAIN_ID,                 'role_id': json_home.Parameters.ROLE_ID,                 'user_id': json_home.Parameters.USER_ID,             })         self._add_resource(             mapper, grant_controller,             path='/OS-INHERIT/domains/{domain_id}/groups/{group_id}/roles/'             '{role_id}/inherited_to_projects',             get_head_action='check_grant',             put_action='create_grant',             delete_action='revoke_grant',             rel=build_os_inherit_relation(                 resource_name='domain_group_role_inherited_to_projects'),             path_vars={                 'domain_id': json_home.Parameters.DOMAIN_ID,                 'group_id': json_home.Parameters.GROUP_ID,                 'role_id': json_home.Parameters.ROLE_ID,             })         self._add_resource(             mapper, grant_controller,             path='/OS-INHERIT/domains/{domain_id}/groups/{group_id}/roles/'             'inherited_to_projects',             get_action='list_grants',             rel=build_os_inherit_relation(                 resource_name='domain_group_roles_inherited_to_projects'),             path_vars={                 'domain_id': json_home.Parameters.DOMAIN_ID,                 'group_id': json_home.Parameters.GROUP_ID,             })         self._add_resource(             mapper, grant_controller,             path='/OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/'             'inherited_to_projects',             get_action='list_grants',             rel=build_os_inherit_relation(                 resource_name='domain_user_roles_inherited_to_projects'),             path_vars={                 'domain_id': json_home.Parameters.DOMAIN_ID,                 'user_id': json_home.Parameters.USER_ID,             })         self._add_resource(             mapper, grant_controller,             path='/OS-INHERIT/projects/{project_id}/users/{user_id}/roles/'             '{role_id}/inherited_to_projects',             get_head_action='check_grant',             put_action='create_grant',             delete_action='revoke_grant',             rel=build_os_inherit_relation(                 resource_name='project_user_role_inherited_to_projects'),             path_vars={                 'project_id': json_home.Parameters.PROJECT_ID,                 'user_id': json_home.Parameters.USER_ID,                 'role_id': json_home.Parameters.ROLE_ID,             })         self._add_resource(             mapper, grant_controller,             path='/OS-INHERIT/projects/{project_id}/groups/{group_id}/'             'roles/{role_id}/inherited_to_projects',             get_head_action='check_grant',             put_action='create_grant',             delete_action='revoke_grant',             rel=build_os_inherit_relation(                 resource_name='project_group_role_inherited_to_projects'),             path_vars={                 'project_id': json_home.Parameters.PROJECT_ID,                 'group_id': json_home.Parameters.GROUP_ID,                 'role_id': json_home.Parameters.ROLE_ID,             })

4.1    catalog_routers

代码路径keystone. catalog.routers

class Routers(wsgi.RoutersBase):     """API for the keystone catalog.     The API Endpoint Filter looks like::         PUT /OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id}         GET /OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id}         HEAD /OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id}         DELETE /OS-EP-FILTER/projects/{project_id}/endpoints/{endpoint_id}         GET /OS-EP-FILTER/endpoints/{endpoint_id}/projects         GET /OS-EP-FILTER/projects/{project_id}/endpoints         GET /OS-EP-FILTER/projects/{project_id}/endpoint_groups         GET /OS-EP-FILTER/endpoint_groups         POST /OS-EP-FILTER/endpoint_groups         GET /OS-EP-FILTER/endpoint_groups/{endpoint_group_id}         HEAD /OS-EP-FILTER/endpoint_groups/{endpoint_group_id}         PATCH /OS-EP-FILTER/endpoint_groups/{endpoint_group_id}         DELETE /OS-EP-FILTER/endpoint_groups/{endpoint_group_id}         GET /OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/projects         GET /OS-EP-FILTER/endpoint_groups/{endpoint_group_id}/endpoints         PUT /OS-EP-FILTER/endpoint_groups/{endpoint_group}/projects/             {project_id}         GET /OS-EP-FILTER/endpoint_groups/{endpoint_group}/projects/             {project_id}         HEAD /OS-EP-FILTER/endpoint_groups/{endpoint_group}/projects/             {project_id}         DELETE /OS-EP-FILTER/endpoint_groups/{endpoint_group}/projects/             {project_id}     """     PATH_PREFIX = '/OS-EP-FILTER'     PATH_PROJECT_ENDPOINT = '/projects/{project_id}/endpoints/{endpoint_id}'     PATH_ENDPOINT_GROUPS = '/endpoint_groups/{endpoint_group_id}'     PATH_ENDPOINT_GROUP_PROJECTS = PATH_ENDPOINT_GROUPS + (         '/projects/{project_id}')     def append_v3_routers(self, mapper, routers):         regions_controller = controllers.RegionV3()         endpoint_filter_controller = controllers.EndpointFilterV3Controller()         endpoint_group_controller = controllers.EndpointGroupV3Controller()         project_endpoint_group_controller = (             controllers.ProjectEndpointGroupV3Controller())         routers.append(router.Router(regions_controller,                                      'regions', 'region',                                      resource_descriptions=self.v3_resources))         mapper.connect(             '/regions/{region_id}',             controller=regions_controller,             action='create_region_with_id',             conditions=dict(method=['PUT']))         routers.append(router.Router(controllers.ServiceV3(),                                      'services', 'service',                                      resource_descriptions=self.v3_resources))         routers.append(router.Router(controllers.EndpointV3(),                                      'endpoints', 'endpoint',                                      resource_descriptions=self.v3_resources))         self._add_resource(             mapper, endpoint_filter_controller,             path=self.PATH_PREFIX + '/endpoints/{endpoint_id}/projects',             get_action='list_projects_for_endpoint',             rel=build_resource_relation(resource_name='endpoint_projects'),             path_vars={                 'endpoint_id': json_home.Parameters.ENDPOINT_ID,             })         self._add_resource(             mapper, endpoint_filter_controller,             path=self.PATH_PREFIX + self.PATH_PROJECT_ENDPOINT,             get_head_action='check_endpoint_in_project',             put_action='add_endpoint_to_project',             delete_action='remove_endpoint_from_project',             rel=build_resource_relation(resource_name='project_endpoint'),             path_vars={                 'endpoint_id': json_home.Parameters.ENDPOINT_ID,                 'project_id': json_home.Parameters.PROJECT_ID,             })         self._add_resource(             mapper, endpoint_filter_controller,             path=self.PATH_PREFIX + '/projects/{project_id}/endpoints',             get_action='list_endpoints_for_project',             rel=build_resource_relation(resource_name='project_endpoints'),             path_vars={                 'project_id': json_home.Parameters.PROJECT_ID,             })         self._add_resource(             mapper, endpoint_group_controller,             path=self.PATH_PREFIX + '/projects/{project_id}/endpoint_groups',             get_action='list_endpoint_groups_for_project',             rel=build_resource_relation(                 resource_name='project_endpoint_groups'),             path_vars={                 'project_id': json_home.Parameters.PROJECT_ID,             })         self._add_resource(             mapper, endpoint_group_controller,             path=self.PATH_PREFIX + '/endpoint_groups',             get_action='list_endpoint_groups',             post_action='create_endpoint_group',             rel=build_resource_relation(resource_name='endpoint_groups'))         self._add_resource(             mapper, endpoint_group_controller,             path=self.PATH_PREFIX + self.PATH_ENDPOINT_GROUPS,             get_head_action='get_endpoint_group',             patch_action='update_endpoint_group',             delete_action='delete_endpoint_group',             rel=build_resource_relation(resource_name='endpoint_group'),             path_vars={                 'endpoint_group_id': ENDPOINT_GROUP_PARAMETER_RELATION             })         self._add_resource(             mapper, project_endpoint_group_controller,             path=self.PATH_PREFIX + self.PATH_ENDPOINT_GROUP_PROJECTS,             get_head_action='get_endpoint_group_in_project',             put_action='add_endpoint_group_to_project',             delete_action='remove_endpoint_group_from_project',             rel=build_resource_relation(                 resource_name='endpoint_group_to_project_association'),             path_vars={                 'project_id': json_home.Parameters.PROJECT_ID,                 'endpoint_group_id': ENDPOINT_GROUP_PARAMETER_RELATION             })         self._add_resource(             mapper, endpoint_group_controller,             path=self.PATH_PREFIX + self.PATH_ENDPOINT_GROUPS + (                 '/projects'),             get_action='list_projects_associated_with_endpoint_group',             rel=build_resource_relation(                 resource_name='projects_associated_with_endpoint_group'),             path_vars={                 'endpoint_group_id': ENDPOINT_GROUP_PARAMETER_RELATION             })         self._add_resource(             mapper, endpoint_group_controller,             path=self.PATH_PREFIX + self.PATH_ENDPOINT_GROUPS + (                 '/endpoints'),             get_action='list_endpoints_associated_with_endpoint_group',             rel=build_resource_relation(                 resource_name='endpoints_in_endpoint_group'),             path_vars={                 'endpoint_group_id': ENDPOINT_GROUP_PARAMETER_RELATION             })

4.1    credential_routers

代码路径keystone. credential.routers

class Routers(wsgi.RoutersBase):     def append_v3_routers(self, mapper, routers):         routers.append(             router.Router(controllers.CredentialV3(),                           'credentials', 'credential',                           resource_descriptions=self.v3_resources))

4.1    identity_routers

代码路径keystone. identity.routers

class Routers(wsgi.RoutersBase):     def append_v3_routers(self, mapper, routers):         user_controller = controllers.UserV3()         routers.append(             router.Router(user_controller,                           'users', 'user',                           resource_descriptions=self.v3_resources))         self._add_resource(             mapper, user_controller,             path='/users/{user_id}/password',             post_action='change_password',             rel=json_home.build_v3_resource_relation('user_change_password'),             path_vars={                 'user_id': json_home.Parameters.USER_ID,             })         self._add_resource(             mapper, user_controller,             path='/groups/{group_id}/users',             get_head_action='list_users_in_group',             rel=json_home.build_v3_resource_relation('group_users'),             path_vars={                 'group_id': json_home.Parameters.GROUP_ID,             })         self._add_resource(             mapper, user_controller,             path='/groups/{group_id}/users/{user_id}',             put_action='add_user_to_group',             get_head_action='check_user_in_group',             delete_action='remove_user_from_group',             rel=json_home.build_v3_resource_relation('group_user'),             path_vars={                 'group_id': json_home.Parameters.GROUP_ID,                 'user_id': json_home.Parameters.USER_ID,             })         group_controller = controllers.GroupV3()         routers.append(             router.Router(group_controller,                           'groups', 'group',                           resource_descriptions=self.v3_resources))         self._add_resource(             mapper, group_controller,             path='/users/{user_id}/groups',             get_head_action='list_groups_for_user',             rel=json_home.build_v3_resource_relation('user_groups'),             path_vars={                 'user_id': json_home.Parameters.USER_ID,             })

4.1    policy_routers

代码路径keystone. policy.routers

class Routers(wsgi.RoutersBase):     def append_v3_routers(self, mapper, routers):         policy_controller = controllers.PolicyV3()         routers.append(router.Router(policy_controller, 'policies', 'policy',                                      resource_descriptions=self.v3_resources))

4.1    resource_routers

代码路径keystone. resource.routers

class Routers(wsgi.RoutersBase):     def append_v3_routers(self, mapper, routers):         routers.append(             router.Router(controllers.DomainV3(),                           'domains', 'domain',                           resource_descriptions=self.v3_resources))         config_controller = controllers.DomainConfigV3()         self._add_resource(             mapper, config_controller,             path='/domains/{domain_id}/config',             get_head_action='get_domain_config',             put_action='create_domain_config',             patch_action='update_domain_config_only',             delete_action='delete_domain_config',             rel=json_home.build_v3_resource_relation('domain_config'),             path_vars={                 'domain_id': json_home.Parameters.DOMAIN_ID             })         config_group_param = (             json_home.build_v3_parameter_relation('config_group'))         self._add_resource(             mapper, config_controller,             path='/domains/{domain_id}/config/{group}',             get_head_action='get_domain_config_wrapper',             patch_action='update_domain_config_group',             delete_action='delete_domain_config',             rel=json_home.build_v3_resource_relation('domain_config_group'),             path_vars={                 'domain_id': json_home.Parameters.DOMAIN_ID,                 'group': config_group_param             })         self._add_resource(             mapper, config_controller,             path='/domains/{domain_id}/config/{group}/{option}',             get_head_action='get_domain_config_wrapper',             patch_action='update_domain_config',             delete_action='delete_domain_config',             rel=json_home.build_v3_resource_relation('domain_config_option'),             path_vars={                 'domain_id': json_home.Parameters.DOMAIN_ID,                 'group': config_group_param,                 'option': json_home.build_v3_parameter_relation(                     'config_option')             })         self._add_resource(             mapper, config_controller,             path='/domains/config/default',             get_action='get_domain_config_default',             rel=json_home.build_v3_resource_relation('domain_config_default'))         self._add_resource(             mapper, config_controller,             path='/domains/config/{group}/default',             get_action='get_domain_config_default',             rel=json_home.build_v3_resource_relation(                 'domain_config_default_group'),             path_vars={                 'group': config_group_param             })         self._add_resource(             mapper, config_controller,             path='/domains/config/{group}/{option}/default',             get_action='get_domain_config_default',             rel=json_home.build_v3_resource_relation(                 'domain_config_default_option'),             path_vars={                 'group': config_group_param,                 'option': json_home.build_v3_parameter_relation(                     'config_option')             })         routers.append(             router.Router(controllers.ProjectV3(),                           'projects', 'project',                           resource_descriptions=self.v3_resources))

4.1    revoke_routers

代码路径keystone. revoke.routers

class Routers(wsgi.RoutersBase):     PATH_PREFIX = '/OS-REVOKE'     def append_v3_routers(self, mapper, routers):         revoke_controller = controllers.RevokeController()         self._add_resource(             mapper, revoke_controller,             path=self.PATH_PREFIX + '/events',             get_action='list_revoke_events',             rel=json_home.build_v3_extension_resource_relation(                 'OS-REVOKE', '1.0', 'events'))

4.1    federation_routers

代码路径keystone. federation.routers

class Routers(wsgi.RoutersBase):     """API Endpoints for the Federation extension.     The API looks like::         PUT /OS-FEDERATION/identity_providers/{idp_id}         GET /OS-FEDERATION/identity_providers         GET /OS-FEDERATION/identity_providers/{idp_id}         DELETE /OS-FEDERATION/identity_providers/{idp_id}         PATCH /OS-FEDERATION/identity_providers/{idp_id}         PUT /OS-FEDERATION/identity_providers/             {idp_id}/protocols/{protocol_id}         GET /OS-FEDERATION/identity_providers/             {idp_id}/protocols         GET /OS-FEDERATION/identity_providers/             {idp_id}/protocols/{protocol_id}         PATCH /OS-FEDERATION/identity_providers/             {idp_id}/protocols/{protocol_id}         DELETE /OS-FEDERATION/identity_providers/             {idp_id}/protocols/{protocol_id}         PUT /OS-FEDERATION/mappings         GET /OS-FEDERATION/mappings         PATCH /OS-FEDERATION/mappings/{mapping_id}         GET /OS-FEDERATION/mappings/{mapping_id}         DELETE /OS-FEDERATION/mappings/{mapping_id}         GET /OS-FEDERATION/projects         GET /OS-FEDERATION/domains         PUT /OS-FEDERATION/service_providers/{sp_id}         GET /OS-FEDERATION/service_providers         GET /OS-FEDERATION/service_providers/{sp_id}         DELETE /OS-FEDERATION/service_providers/{sp_id}         PATCH /OS-FEDERATION/service_providers/{sp_id}         GET /OS-FEDERATION/identity_providers/{idp_id}/             protocols/{protocol_id}/auth         POST /OS-FEDERATION/identity_providers/{idp_id}/             protocols/{protocol_id}/auth         GET /auth/OS-FEDERATION/identity_providers/             {idp_id}/protocols/{protocol_id}/websso             ?origin=https%3A//horizon.example.com         POST /auth/OS-FEDERATION/identity_providers/             {idp_id}/protocols/{protocol_id}/websso             ?origin=https%3A//horizon.example.com         POST /auth/OS-FEDERATION/saml2         POST /auth/OS-FEDERATION/saml2/ecp         GET /OS-FEDERATION/saml2/metadata         GET /auth/OS-FEDERATION/websso/{protocol_id}             ?origin=https%3A//horizon.example.com         POST /auth/OS-FEDERATION/websso/{protocol_id}              ?origin=https%3A//horizon.example.com     """     def _construct_url(self, suffix):         return "/OS-FEDERATION/%s" % suffix     def append_v3_routers(self, mapper, routers):         auth_controller = controllers.Auth()         idp_controller = controllers.IdentityProvider()         protocol_controller = controllers.FederationProtocol()         mapping_controller = controllers.MappingController()         project_controller = controllers.ProjectAssignmentV3()         domain_controller = controllers.DomainV3()         saml_metadata_controller = controllers.SAMLMetadataV3()         sp_controller = controllers.ServiceProvider()         # Identity Provider CRUD operations         self._add_resource(             mapper, idp_controller,             path=self._construct_url('identity_providers/{idp_id}'),             get_action='get_identity_provider',             put_action='create_identity_provider',             patch_action='update_identity_provider',             delete_action='delete_identity_provider',             rel=build_resource_relation(resource_name='identity_provider'),             path_vars={                 'idp_id': IDP_ID_PARAMETER_RELATION,             })         self._add_resource(             mapper, idp_controller,             path=self._construct_url('identity_providers'),             get_action='list_identity_providers',             rel=build_resource_relation(resource_name='identity_providers'))         # Protocol CRUD operations         self._add_resource(             mapper, protocol_controller,             path=self._construct_url('identity_providers/{idp_id}/protocols/'                                      '{protocol_id}'),             get_action='get_protocol',             put_action='create_protocol',             patch_action='update_protocol',             delete_action='delete_protocol',             rel=build_resource_relation(                 resource_name='identity_provider_protocol'),             path_vars={                 'idp_id': IDP_ID_PARAMETER_RELATION,                 'protocol_id': PROTOCOL_ID_PARAMETER_RELATION,             })         self._add_resource(             mapper, protocol_controller,             path=self._construct_url('identity_providers/{idp_id}/protocols'),             get_action='list_protocols',             rel=build_resource_relation(                 resource_name='identity_provider_protocols'),             path_vars={                 'idp_id': IDP_ID_PARAMETER_RELATION,             })         # Mapping CRUD operations         self._add_resource(             mapper, mapping_controller,             path=self._construct_url('mappings/{mapping_id}'),             get_action='get_mapping',             put_action='create_mapping',             patch_action='update_mapping',             delete_action='delete_mapping',             rel=build_resource_relation(resource_name='mapping'),             path_vars={                 'mapping_id': build_parameter_relation(                     parameter_name='mapping_id'),             })         self._add_resource(             mapper, mapping_controller,             path=self._construct_url('mappings'),             get_action='list_mappings',             rel=build_resource_relation(resource_name='mappings'))         # Service Providers CRUD operations         self._add_resource(             mapper, sp_controller,             path=self._construct_url('service_providers/{sp_id}'),             get_action='get_service_provider',             put_action='create_service_provider',             patch_action='update_service_provider',             delete_action='delete_service_provider',             rel=build_resource_relation(resource_name='service_provider'),             path_vars={                 'sp_id': SP_ID_PARAMETER_RELATION,             })         self._add_resource(             mapper, sp_controller,             path=self._construct_url('service_providers'),             get_action='list_service_providers',             rel=build_resource_relation(resource_name='service_providers'))         self._add_resource(             mapper, domain_controller,             path=self._construct_url('domains'),             new_path='/auth/domains',             get_action='list_domains_for_user',             rel=build_resource_relation(resource_name='domains'))         self._add_resource(             mapper, project_controller,             path=self._construct_url('projects'),             new_path='/auth/projects',             get_action='list_projects_for_user',             rel=build_resource_relation(resource_name='projects'))         # Auth operations         self._add_resource(             mapper, auth_controller,             path=self._construct_url('identity_providers/{idp_id}/'                                      'protocols/{protocol_id}/auth'),             get_post_action='federated_authentication',             rel=build_resource_relation(                 resource_name='identity_provider_protocol_auth'),             path_vars={                 'idp_id': IDP_ID_PARAMETER_RELATION,                 'protocol_id': PROTOCOL_ID_PARAMETER_RELATION,             })         self._add_resource(             mapper, auth_controller,             path='/auth' + self._construct_url('saml2'),             post_action='create_saml_assertion',             rel=build_resource_relation(resource_name='saml2'))         self._add_resource(             mapper, auth_controller,             path='/auth' + self._construct_url('saml2/ecp'),             post_action='create_ecp_assertion',             rel=build_resource_relation(resource_name='ecp'))         self._add_resource(             mapper, auth_controller,             path='/auth' + self._construct_url('websso/{protocol_id}'),             get_post_action='federated_sso_auth',             rel=build_resource_relation(resource_name='websso'),             path_vars={                 'protocol_id': PROTOCOL_ID_PARAMETER_RELATION,             })         self._add_resource(             mapper, auth_controller,             path='/auth' + self._construct_url(                  'identity_providers/{idp_id}/protocols/{protocol_id}/websso'),             get_post_action='federated_idp_specific_sso_auth',             rel=build_resource_relation(resource_name='identity_providers'),             path_vars={                 'idp_id': IDP_ID_PARAMETER_RELATION,                 'protocol_id': PROTOCOL_ID_PARAMETER_RELATION,             })         # Keystone-Identity-Provider metadata endpoint         self._add_resource(             mapper, saml_metadata_controller,             path=self._construct_url('saml2/metadata'),             get_action='get_metadata',             rel=build_resource_relation(resource_name='metadata'))

4.1    oauth1_routers

代码路径keystone. oauth1.routers

class Routers(wsgi.RoutersBase):     """API Endpoints for the OAuth1 extension.     The goal of this extension is to allow third-party service providers     to acquire tokens with a limited subset of a user's roles for acting     on behalf of that user. This is done using an oauth-similar flow and     api.     The API looks like::       # Basic admin-only consumer crud       POST /OS-OAUTH1/consumers       GET /OS-OAUTH1/consumers       PATCH /OS-OAUTH1/consumers/{consumer_id}       GET /OS-OAUTH1/consumers/{consumer_id}       DELETE /OS-OAUTH1/consumers/{consumer_id}       # User access token crud       GET /users/{user_id}/OS-OAUTH1/access_tokens       GET /users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id}       GET /users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id}/roles       GET /users/{user_id}/OS-OAUTH1/access_tokens           /{access_token_id}/roles/{role_id}       DELETE /users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id}       # OAuth interfaces       POST /OS-OAUTH1/request_token  # create a request token       PUT /OS-OAUTH1/authorize  # authorize a request token       POST /OS-OAUTH1/access_token  # create an access token     """     def append_v3_routers(self, mapper, routers):         consumer_controller = controllers.ConsumerCrudV3()         access_token_controller = controllers.AccessTokenCrudV3()         access_token_roles_controller = controllers.AccessTokenRolesV3()         oauth_controller = controllers.OAuthControllerV3()         # basic admin-only consumer crud         self._add_resource(             mapper, consumer_controller,             path='/OS-OAUTH1/consumers',             get_action='list_consumers',             post_action='create_consumer',             rel=build_resource_relation(resource_name='consumers'))         self._add_resource(             mapper, consumer_controller,             path='/OS-OAUTH1/consumers/{consumer_id}',             get_action='get_consumer',             patch_action='update_consumer',             delete_action='delete_consumer',             rel=build_resource_relation(resource_name='consumer'),             path_vars={                 'consumer_id':                 build_parameter_relation(parameter_name='consumer_id'),             })         # user access token crud         self._add_resource(             mapper, access_token_controller,             path='/users/{user_id}/OS-OAUTH1/access_tokens',             get_action='list_access_tokens',             rel=build_resource_relation(resource_name='user_access_tokens'),             path_vars={                 'user_id': json_home.Parameters.USER_ID,             })         self._add_resource(             mapper, access_token_controller,             path='/users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id}',             get_action='get_access_token',             delete_action='delete_access_token',             rel=build_resource_relation(resource_name='user_access_token'),             path_vars={                 'access_token_id': ACCESS_TOKEN_ID_PARAMETER_RELATION,                 'user_id': json_home.Parameters.USER_ID,             })         self._add_resource(             mapper, access_token_roles_controller,             path='/users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id}/'             'roles',             get_action='list_access_token_roles',             rel=build_resource_relation(                 resource_name='user_access_token_roles'),             path_vars={                 'access_token_id': ACCESS_TOKEN_ID_PARAMETER_RELATION,                 'user_id': json_home.Parameters.USER_ID,             })         self._add_resource(             mapper, access_token_roles_controller,             path='/users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id}/'             'roles/{role_id}',             get_action='get_access_token_role',             rel=build_resource_relation(                 resource_name='user_access_token_role'),             path_vars={                 'access_token_id': ACCESS_TOKEN_ID_PARAMETER_RELATION,                 'role_id': json_home.Parameters.ROLE_ID,                 'user_id': json_home.Parameters.USER_ID,             })         # oauth flow calls         self._add_resource(             mapper, oauth_controller,             path='/OS-OAUTH1/request_token',             post_action='create_request_token',             rel=build_resource_relation(resource_name='request_tokens'))         self._add_resource(             mapper, oauth_controller,             path='/OS-OAUTH1/access_token',             post_action='create_access_token',             rel=build_resource_relation(resource_name='access_tokens'))         self._add_resource(             mapper, oauth_controller,             path='/OS-OAUTH1/authorize/{request_token_id}',             path_vars={                 'request_token_id':                 build_parameter_relation(parameter_name='request_token_id')             },             put_action='authorize_request_token',             rel=build_resource_relation(                 resource_name='authorize_request_token'))

4.1    endpoint_policy_routers

代码路径keystone. endpoint_policy.routers

class Routers(wsgi.RoutersBase):     PATH_PREFIX = '/OS-ENDPOINT-POLICY'     def append_v3_routers(self, mapper, routers):         endpoint_policy_controller = controllers.EndpointPolicyV3Controller()         self._add_resource(             mapper, endpoint_policy_controller,             path='/endpoints/{endpoint_id}' + self.PATH_PREFIX + '/policy',             get_head_action='get_policy_for_endpoint',             rel=build_resource_relation(resource_name='endpoint_policy'),             path_vars={'endpoint_id': json_home.Parameters.ENDPOINT_ID})         self._add_resource(             mapper, endpoint_policy_controller,             path='/policies/{policy_id}' + self.PATH_PREFIX + '/endpoints',             get_action='list_endpoints_for_policy',             rel=build_resource_relation(resource_name='policy_endpoints'),             path_vars={'policy_id': json_home.Parameters.POLICY_ID})         self._add_resource(             mapper, endpoint_policy_controller,             path=('/policies/{policy_id}' + self.PATH_PREFIX +                   '/endpoints/{endpoint_id}'),             get_head_action='check_policy_association_for_endpoint',             put_action='create_policy_association_for_endpoint',             delete_action='delete_policy_association_for_endpoint',             rel=build_resource_relation(                 resource_name='endpoint_policy_association'),             path_vars={                 'policy_id': json_home.Parameters.POLICY_ID,                 'endpoint_id': json_home.Parameters.ENDPOINT_ID,             })         self._add_resource(             mapper, endpoint_policy_controller,             path=('/policies/{policy_id}' + self.PATH_PREFIX +                   '/services/{service_id}'),             get_head_action='check_policy_association_for_service',             put_action='create_policy_association_for_service',             delete_action='delete_policy_association_for_service',             rel=build_resource_relation(                 resource_name='service_policy_association'),             path_vars={                 'policy_id': json_home.Parameters.POLICY_ID,                 'service_id': json_home.Parameters.SERVICE_ID,             })         self._add_resource(             mapper, endpoint_policy_controller,             path=('/policies/{policy_id}' + self.PATH_PREFIX +                   '/services/{service_id}/regions/{region_id}'),             get_head_action='check_policy_association_for_region_and_service',             put_action='create_policy_association_for_region_and_service',             delete_action='delete_policy_association_for_region_and_service',             rel=build_resource_relation(                 resource_name='region_and_service_policy_association'),             path_vars={                 'policy_id': json_home.Parameters.POLICY_ID,                 'service_id': json_home.Parameters.SERVICE_ID,                 'region_id': json_home.Parameters.REGION_ID,             })

4.1    simple_cert_ext

代码路径keystone. token. _simple_cert

class Routers(wsgi.RoutersBase):     def _construct_url(self, suffix):         return "/OS-SIMPLE-CERT/%s" % suffix     def append_v3_routers(self, mapper, routers):         controller = SimpleCert()         self._add_resource(             mapper, controller,             path=self._construct_url('ca'),             get_action='get_ca_certificate',             rel=build_resource_relation(resource_name='ca_certificate'))         self._add_resource(             mapper, controller,             path=self._construct_url('certificates'),             get_action='list_certificates',             rel=build_resource_relation(resource_name='certificates'))

5      参考

https://blog.csdn.net/tantexian/article/details/37740379