Skip to content

Commit 9754a67

Browse files
Zuulopenstack-gerrit
Zuul
authored and
openstack-gerrit
committed
Merge "Adding options to user cli"
2 parents 8efb319 + 05da145 commit 9754a67

5 files changed

Lines changed: 1356 additions & 238 deletions

File tree

‎doc/source/cli/command-objects/user.rst‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,12 @@ Create new user
1919
[--password-prompt]
2020
[--email <email-address>]
2121
[--description <description>]
22+
[--multi-factor-auth-rule <rule>]
23+
[--ignore-lockout-failure-attempts| --no-ignore-lockout-failure-attempts]
24+
[--ignore-password-expiry| --no-ignore-password-expiry]
25+
[--ignore-change-password-upon-first-use| --no-ignore-change-password-upon-first-use]
26+
[--enable-lock-password| --disable-lock-password]
27+
[--enable-multi-factor-auth| --disable-multi-factor-auth]
2228
[--enable | --disable]
2329
[--or-show]
2430
<user-name>
@@ -56,6 +62,63 @@ Create new user
5662
5763
.. versionadded:: 3
5864
65+
.. option:: --ignore-lockout-failure-attempts
66+
67+
Opt into ignoring the number of times a user has authenticated and
68+
locking out the user as a result
69+
70+
.. option:: --no-ignore-lockout-failure-attempts
71+
72+
Opt out of ignoring the number of times a user has authenticated
73+
and locking out the user as a result
74+
75+
.. option:: --ignore-change-password-upon-first-use
76+
77+
Control if a user should be forced to change their password immediately
78+
after they log into keystone for the first time. Opt into ignoring
79+
the user to change their password during first time login in keystone.
80+
81+
.. option:: --no-ignore-change-password-upon-first-use
82+
83+
Control if a user should be forced to change their password immediately
84+
after they log into keystone for the first time. Opt out of ignoring
85+
the user to change their password during first time login in keystone.
86+
87+
.. option:: --ignore-password-expiry
88+
89+
Opt into allowing user to continue using passwords that may be
90+
expired
91+
92+
.. option:: --no-ignore-password-expiry
93+
94+
Opt out of allowing user to continue using passwords that may be
95+
expired
96+
97+
.. option:: --enable-lock-password
98+
99+
Disables the ability for a user to change its password through
100+
self-service APIs
101+
102+
.. option:: --disable-lock-password
103+
104+
Enables the ability for a user to change its password through
105+
self-service APIs
106+
107+
.. option:: --enable-multi-factor-auth
108+
109+
Enables the MFA (Multi Factor Auth)
110+
111+
.. option:: --disable-multi-factor-auth
112+
113+
Disables the MFA (Multi Factor Auth)
114+
115+
.. option:: --multi-factor-auth-rule <rule>
116+
117+
Set multi-factor auth rules. For example, to set a rule requiring the
118+
"password" and "totp" auth methods to be provided,
119+
use: "--multi-factor-auth-rule password,totp".
120+
May be provided multiple times to set different rule combinations.
121+
59122
.. option:: --enable
60123
61124
Enable user (default)
@@ -146,6 +209,12 @@ Set user properties
146209
[--password-prompt]
147210
[--email <email-address>]
148211
[--description <description>]
212+
[--multi-factor-auth-rule <rule>]
213+
[--ignore-lockout-failure-attempts| --no-ignore-lockout-failure-attempts]
214+
[--ignore-password-expiry| --no-ignore-password-expiry]
215+
[--ignore-change-password-upon-first-use| --no-ignore-change-password-upon-first-use]
216+
[--enable-lock-password| --disable-lock-password]
217+
[--enable-multi-factor-auth| --disable-multi-factor-auth]
149218
[--enable|--disable]
150219
<user>
151220
@@ -187,6 +256,63 @@ Set user properties
187256
188257
.. versionadded:: 3
189258
259+
.. option:: --ignore-lockout-failure-attempts
260+
261+
Opt into ignoring the number of times a user has authenticated and
262+
locking out the user as a result
263+
264+
.. option:: --no-ignore-lockout-failure-attempts
265+
266+
Opt out of ignoring the number of times a user has authenticated
267+
and locking out the user as a result
268+
269+
.. option:: --ignore-change-password-upon-first-use
270+
271+
Control if a user should be forced to change their password immediately
272+
after they log into keystone for the first time. Opt into ignoring
273+
the user to change their password during first time login in keystone.
274+
275+
.. option:: --no-ignore-change-password-upon-first-use
276+
277+
Control if a user should be forced to change their password immediately
278+
after they log into keystone for the first time. Opt out of ignoring
279+
the user to change their password during first time login in keystone.
280+
281+
.. option:: --ignore-password-expiry
282+
283+
Opt into allowing user to continue using passwords that may be
284+
expired
285+
286+
.. option:: --no-ignore-password-expiry
287+
288+
Opt out of allowing user to continue using passwords that may be
289+
expired
290+
291+
.. option:: --enable-lock-password
292+
293+
Disables the ability for a user to change its password through
294+
self-service APIs
295+
296+
.. option:: --disable-lock-password
297+
298+
Enables the ability for a user to change its password through
299+
self-service APIs
300+
301+
.. option:: --enable-multi-factor-auth
302+
303+
Enables the MFA (Multi Factor Auth)
304+
305+
.. option:: --disable-multi-factor-auth
306+
307+
Disables the MFA (Multi Factor Auth)
308+
309+
.. option:: --multi-factor-auth-rule <rule>
310+
311+
Set multi-factor auth rules. For example, to set a rule requiring the
312+
"password" and "totp" auth methods to be provided,
313+
use: "--multi-factor-auth-rule password,totp".
314+
May be provided multiple times to set different rule combinations.
315+
190316
.. option:: --enable
191317
192318
Enable user (default)

‎openstackclient/identity/v3/user.py‎

Lines changed: 119 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,114 @@
3030
LOG = logging.getLogger(__name__)
3131

3232

33+
def _get_options_for_user(identity_client, parsed_args):
34+
options = {}
35+
if parsed_args.ignore_lockout_failure_attempts:
36+
options['ignore_lockout_failure_attempts'] = True
37+
if parsed_args.no_ignore_lockout_failure_attempts:
38+
options['ignore_lockout_failure_attempts'] = False
39+
if parsed_args.ignore_password_expiry:
40+
options['ignore_password_expiry'] = True
41+
if parsed_args.no_ignore_password_expiry:
42+
options['ignore_password_expiry'] = False
43+
if parsed_args.ignore_change_password_upon_first_use:
44+
options['ignore_change_password_upon_first_use'] = True
45+
if parsed_args.no_ignore_change_password_upon_first_use:
46+
options['ignore_change_password_upon_first_use'] = False
47+
if parsed_args.enable_lock_password:
48+
options['lock_password'] = True
49+
if parsed_args.disable_lock_password:
50+
options['lock_password'] = False
51+
if parsed_args.enable_multi_factor_auth:
52+
options['multi_factor_auth_enabled'] = True
53+
if parsed_args.disable_multi_factor_auth:
54+
options['multi_factor_auth_enabled'] = False
55+
if parsed_args.multi_factor_auth_rule:
56+
auth_rules = [rule.split(",") for rule in
57+
parsed_args.multi_factor_auth_rule]
58+
if auth_rules:
59+
options['multi_factor_auth_rules'] = auth_rules
60+
return options
61+
62+
63+
def _add_user_options(parser):
64+
# Add additional user options
65+
66+
parser.add_argument(
67+
'--ignore-lockout-failure-attempts',
68+
action="store_true",
69+
help=_('Opt into ignoring the number of times a user has '
70+
'authenticated and locking out the user as a result'),
71+
)
72+
parser.add_argument(
73+
'--no-ignore-lockout-failure-attempts',
74+
action="store_true",
75+
help=_('Opt out of ignoring the number of times a user has '
76+
'authenticated and locking out the user as a result'),
77+
)
78+
parser.add_argument(
79+
'--ignore-password-expiry',
80+
action="store_true",
81+
help=_('Opt into allowing user to continue using passwords that '
82+
'may be expired'),
83+
)
84+
parser.add_argument(
85+
'--no-ignore-password-expiry',
86+
action="store_true",
87+
help=_('Opt out of allowing user to continue using passwords '
88+
'that may be expired'),
89+
)
90+
parser.add_argument(
91+
'--ignore-change-password-upon-first-use',
92+
action="store_true",
93+
help=_('Control if a user should be forced to change their password '
94+
'immediately after they log into keystone for the first time. '
95+
'Opt into ignoring the user to change their password during '
96+
'first time login in keystone'),
97+
)
98+
parser.add_argument(
99+
'--no-ignore-change-password-upon-first-use',
100+
action="store_true",
101+
help=_('Control if a user should be forced to change their password '
102+
'immediately after they log into keystone for the first time. '
103+
'Opt out of ignoring the user to change their password during '
104+
'first time login in keystone'),
105+
)
106+
parser.add_argument(
107+
'--enable-lock-password',
108+
action="store_true",
109+
help=_('Disables the ability for a user to change its password '
110+
'through self-service APIs'),
111+
)
112+
parser.add_argument(
113+
'--disable-lock-password',
114+
action="store_true",
115+
help=_('Enables the ability for a user to change its password '
116+
'through self-service APIs'),
117+
)
118+
parser.add_argument(
119+
'--enable-multi-factor-auth',
120+
action="store_true",
121+
help=_('Enables the MFA (Multi Factor Auth)'),
122+
)
123+
parser.add_argument(
124+
'--disable-multi-factor-auth',
125+
action="store_true",
126+
help=_('Disables the MFA (Multi Factor Auth)'),
127+
)
128+
parser.add_argument(
129+
'--multi-factor-auth-rule',
130+
metavar='<rule>',
131+
action="append",
132+
default=[],
133+
help=_('Set multi-factor auth rules. For example, to set a rule '
134+
'requiring the "password" and "totp" auth methods to be '
135+
'provided, use: "--multi-factor-auth-rule password,totp". '
136+
'May be provided multiple times to set different rule '
137+
'combinations.')
138+
)
139+
140+
33141
class CreateUser(command.ShowOne):
34142
_description = _("Create new user")
35143

@@ -72,6 +180,8 @@ def get_parser(self, prog_name):
72180
metavar='<description>',
73181
help=_('User description'),
74182
)
183+
_add_user_options(parser)
184+
75185
enable_group = parser.add_mutually_exclusive_group()
76186
enable_group.add_argument(
77187
'--enable',
@@ -113,6 +223,7 @@ def take_action(self, parsed_args):
113223
if not parsed_args.password:
114224
LOG.warning(_("No password was supplied, authentication will fail "
115225
"when a user does not have a password."))
226+
options = _get_options_for_user(identity_client, parsed_args)
116227

117228
try:
118229
user = identity_client.users.create(
@@ -122,7 +233,8 @@ def take_action(self, parsed_args):
122233
password=parsed_args.password,
123234
email=parsed_args.email,
124235
description=parsed_args.description,
125-
enabled=enabled
236+
enabled=enabled,
237+
options=options,
126238
)
127239
except ks_exc.Conflict:
128240
if parsed_args.or_show:
@@ -333,6 +445,8 @@ def get_parser(self, prog_name):
333445
metavar='<description>',
334446
help=_('Set user description'),
335447
)
448+
_add_user_options(parser)
449+
336450
enable_group = parser.add_mutually_exclusive_group()
337451
enable_group.add_argument(
338452
'--enable',
@@ -390,6 +504,10 @@ def take_action(self, parsed_args):
390504
if parsed_args.disable:
391505
kwargs['enabled'] = False
392506

507+
options = _get_options_for_user(identity_client, parsed_args)
508+
if options:
509+
kwargs['options'] = options
510+
393511
identity_client.users.update(user.id, **kwargs)
394512

395513

‎openstackclient/tests/unit/identity/v3/fakes.py‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -108,6 +108,9 @@
108108
"rules": MAPPING_RULES_2
109109
}
110110

111+
mfa_opt1 = 'password,totp'
112+
mfa_opt2 = 'password'
113+
111114
project_id = '8-9-64'
112115
project_name = 'beatles'
113116
project_description = 'Fab Four'

0 commit comments

Comments
 (0)