blob: 919eab9e66cf90834bbeb5852f910f4bf439d2f6 [file] [log] [blame]
ZhiQiang Fan39f97222013-09-20 04:49:44 +08001# Copyright 2012 OpenStack Foundation
nayna-patelb35f7232013-06-28 07:08:44 +00002# All Rights Reserved.
3#
4# Licensed under the Apache License, Version 2.0 (the "License"); you may
5# not use this file except in compliance with the License. You may obtain
6# a copy of the License at
7#
8# http://www.apache.org/licenses/LICENSE-2.0
9#
10# Unless required by applicable law or agreed to in writing, software
11# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13# License for the specific language governing permissions and limitations
14# under the License.
15
Masayuki Igawabfa07602015-01-20 18:47:17 +090016from tempest_lib import exceptions as lib_exc
17
nayna-patelb35f7232013-06-28 07:08:44 +000018from tempest.api.identity import base
Masayuki Igawa259c1132013-10-31 17:48:44 +090019from tempest.common.utils import data_utils
Matthew Treinish5c660ab2014-05-18 21:14:36 -040020from tempest import test
nayna-patelb35f7232013-06-28 07:08:44 +000021
22
Masayuki Igawabe64ed32014-02-19 14:32:03 +090023class TokensV3TestJSON(base.BaseIdentityV3AdminTest):
nayna-patelb35f7232013-06-28 07:08:44 +000024
Matthew Treinish5c660ab2014-05-18 21:14:36 -040025 @test.attr(type='smoke')
nayna-patelb35f7232013-06-28 07:08:44 +000026 def test_tokens(self):
27 # Valid user's token is authenticated
28 # Create a User
Masayuki Igawa259c1132013-10-31 17:48:44 +090029 u_name = data_utils.rand_name('user-')
nayna-patelb35f7232013-06-28 07:08:44 +000030 u_desc = '%s-description' % u_name
31 u_email = '%s@testmail.tm' % u_name
Masayuki Igawa259c1132013-10-31 17:48:44 +090032 u_password = data_utils.rand_name('pass-')
David Kranzd8ccb792014-12-29 11:32:05 -050033 user = self.client.create_user(
nayna-patelb35f7232013-06-28 07:08:44 +000034 u_name, description=u_desc, password=u_password,
35 email=u_email)
Matthew Treinishdb2c5972014-01-31 22:18:59 +000036 self.addCleanup(self.client.delete_user, user['id'])
nayna-patelb35f7232013-06-28 07:08:44 +000037 # Perform Authentication
David Kranzd8ccb792014-12-29 11:32:05 -050038 resp = self.token.auth(user['id'], u_password).response
nayna-patelb35f7232013-06-28 07:08:44 +000039 subject_token = resp['x-subject-token']
40 # Perform GET Token
David Kranzd8ccb792014-12-29 11:32:05 -050041 token_details = self.client.get_token(subject_token)
nayna-patelb35f7232013-06-28 07:08:44 +000042 self.assertEqual(resp['x-subject-token'], subject_token)
43 self.assertEqual(token_details['user']['id'], user['id'])
44 self.assertEqual(token_details['user']['name'], u_name)
45 # Perform Delete Token
David Kranze9d2f422014-07-02 13:57:41 -040046 self.client.delete_token(subject_token)
Masayuki Igawabfa07602015-01-20 18:47:17 +090047 self.assertRaises(lib_exc.NotFound, self.client.get_token,
nayna-patelb35f7232013-06-28 07:08:44 +000048 subject_token)
49
Matthew Treinish5c660ab2014-05-18 21:14:36 -040050 @test.attr(type='gate')
Brant Knudsonc5553292014-03-15 11:06:05 -050051 def test_rescope_token(self):
Brant Knudson5ee44a42014-03-16 10:55:21 -050052 """Rescope a token.
53
54 An unscoped token can be requested, that token can be used to request a
55 scoped token. The scoped token can be revoked, and the original token
56 used to get a token in a different project.
57
Brant Knudsonc5553292014-03-15 11:06:05 -050058 """
59
60 # Create a user.
61 user_name = data_utils.rand_name(name='user-')
62 user_password = data_utils.rand_name(name='pass-')
David Kranzd8ccb792014-12-29 11:32:05 -050063 user = self.client.create_user(user_name, password=user_password)
Brant Knudsonc5553292014-03-15 11:06:05 -050064 self.addCleanup(self.client.delete_user, user['id'])
65
Brant Knudson5ee44a42014-03-16 10:55:21 -050066 # Create a couple projects
67 project1_name = data_utils.rand_name(name='project-')
David Kranzd8ccb792014-12-29 11:32:05 -050068 project1 = self.client.create_project(project1_name)
Brant Knudson5ee44a42014-03-16 10:55:21 -050069 self.addCleanup(self.client.delete_project, project1['id'])
70
71 project2_name = data_utils.rand_name(name='project-')
David Kranzd8ccb792014-12-29 11:32:05 -050072 project2 = self.client.create_project(project2_name)
Brant Knudson5ee44a42014-03-16 10:55:21 -050073 self.addCleanup(self.client.delete_project, project2['id'])
Brant Knudsonc5553292014-03-15 11:06:05 -050074
75 # Create a role
76 role_name = data_utils.rand_name(name='role-')
David Kranzd8ccb792014-12-29 11:32:05 -050077 role = self.client.create_role(role_name)
Brant Knudsonc5553292014-03-15 11:06:05 -050078 self.addCleanup(self.client.delete_role, role['id'])
79
Brant Knudson5ee44a42014-03-16 10:55:21 -050080 # Grant the user the role on both projects.
David Kranze9d2f422014-07-02 13:57:41 -040081 self.client.assign_user_role(project1['id'], user['id'],
82 role['id'])
Brant Knudson5ee44a42014-03-16 10:55:21 -050083
David Kranze9d2f422014-07-02 13:57:41 -040084 self.client.assign_user_role(project2['id'], user['id'],
85 role['id'])
Brant Knudsonc5553292014-03-15 11:06:05 -050086
87 # Get an unscoped token.
David Kranzd8ccb792014-12-29 11:32:05 -050088 token_auth = self.token.auth(user=user['id'],
89 password=user_password)
Brant Knudsonc5553292014-03-15 11:06:05 -050090
David Kranzd8ccb792014-12-29 11:32:05 -050091 token_id = token_auth.response['x-subject-token']
Brant Knudsonc5553292014-03-15 11:06:05 -050092 orig_expires_at = token_auth['token']['expires_at']
93 orig_issued_at = token_auth['token']['issued_at']
94 orig_user = token_auth['token']['user']
95
96 self.assertIsInstance(token_auth['token']['expires_at'], unicode)
97 self.assertIsInstance(token_auth['token']['issued_at'], unicode)
98 self.assertEqual(['password'], token_auth['token']['methods'])
99 self.assertEqual(user['id'], token_auth['token']['user']['id'])
100 self.assertEqual(user['name'], token_auth['token']['user']['name'])
101 self.assertEqual('default',
102 token_auth['token']['user']['domain']['id'])
103 self.assertEqual('Default',
104 token_auth['token']['user']['domain']['name'])
105 self.assertNotIn('catalog', token_auth['token'])
106 self.assertNotIn('project', token_auth['token'])
107 self.assertNotIn('roles', token_auth['token'])
108
109 # Use the unscoped token to get a scoped token.
David Kranzd8ccb792014-12-29 11:32:05 -0500110 token_auth = self.token.auth(token=token_id,
Jamie Lennoxe5a95d42015-02-11 07:19:57 +0000111 project=project1_name,
112 project_domain='Default')
David Kranzd8ccb792014-12-29 11:32:05 -0500113 token1_id = token_auth.response['x-subject-token']
Brant Knudsonc5553292014-03-15 11:06:05 -0500114
115 self.assertEqual(orig_expires_at, token_auth['token']['expires_at'],
116 'Expiration time should match original token')
117 self.assertIsInstance(token_auth['token']['issued_at'], unicode)
118 self.assertNotEqual(orig_issued_at, token_auth['token']['issued_at'])
119 self.assertEqual(set(['password', 'token']),
120 set(token_auth['token']['methods']))
121 self.assertEqual(orig_user, token_auth['token']['user'],
122 'User should match original token')
123 self.assertIsInstance(token_auth['token']['catalog'], list)
Brant Knudson5ee44a42014-03-16 10:55:21 -0500124 self.assertEqual(project1['id'],
Brant Knudsonc5553292014-03-15 11:06:05 -0500125 token_auth['token']['project']['id'])
Brant Knudson5ee44a42014-03-16 10:55:21 -0500126 self.assertEqual(project1['name'],
Brant Knudsonc5553292014-03-15 11:06:05 -0500127 token_auth['token']['project']['name'])
128 self.assertEqual('default',
129 token_auth['token']['project']['domain']['id'])
130 self.assertEqual('Default',
131 token_auth['token']['project']['domain']['name'])
132 self.assertEqual(1, len(token_auth['token']['roles']))
133 self.assertEqual(role['id'], token_auth['token']['roles'][0]['id'])
134 self.assertEqual(role['name'], token_auth['token']['roles'][0]['name'])
135
Brant Knudson5ee44a42014-03-16 10:55:21 -0500136 # Revoke the unscoped token.
David Kranze9d2f422014-07-02 13:57:41 -0400137 self.client.delete_token(token1_id)
Brant Knudson5ee44a42014-03-16 10:55:21 -0500138
139 # Now get another scoped token using the unscoped token.
David Kranzd8ccb792014-12-29 11:32:05 -0500140 token_auth = self.token.auth(token=token_id,
Jamie Lennoxe5a95d42015-02-11 07:19:57 +0000141 project=project2_name,
142 project_domain='Default')
Brant Knudson5ee44a42014-03-16 10:55:21 -0500143
144 self.assertEqual(project2['id'],
145 token_auth['token']['project']['id'])
146 self.assertEqual(project2['name'],
147 token_auth['token']['project']['name'])