The keystone.policy.backends.rules Module

Policy engine for keystone

class keystone.policy.backends.rules.Policy

Bases: keystone.policy.core.Driver

enforce(credentials, action, target)
keystone.policy.backends.rules.enforce(credentials, action, target, do_raise=True)

Verifies that the action is valid on the target in this context.

Parameters:
  • credentials – user credentials
  • action – string representing the action to be checked, which should be colon separated for clarity.
  • target – dictionary representing the object of the action for object creation this should be a dictionary representing the location of the object e.g. {‘project_id’: object.project_id}
Raises :

exception.Forbidden if verification fails.

Actions should be colon separated for clarity. For example:

  • identity:list_users
keystone.policy.backends.rules.init()
keystone.policy.backends.rules.reset()

Previous topic

The keystone.openstack.common.version Module

Next topic

The keystone.policy.backends.sql Module

This Page