Barbican client used to interact with barbican service.
session – An instance of keystoneauth1.session.Session that can be either authenticated, or not authenticated. When using a non-authenticated Session, you must provide some additional parameters. When no session is provided it will default to a non-authenticated Session. (optional)
endpoint – Barbican endpoint url override. Required when a session is not given, or when using a non-authenticated session. When using an authenticated session, the client will attempt to get the endpoint from the Keystone service catalog. (optional)
project_id – The project ID used for context in Barbican. Required when a session is not given, or when using a non-authenticated session. When using an authenticated session, the project ID will be provided by the authentication mechanism and this parameter will be ignored. (optional)
verify – When a session is not given, the client will create a non-authenticated session. This parameter is passed to the session that is created. If set to False, it allows barbicanclient to perform “insecure” TLS (https) requests. The server’s certificate will not be verified against any certificate authorities. (optional) WARNING: This option should be used with caution.
version – Used as an endpoint filter when using an authenticated keystone session. When using a non-authenticated keystone session, this value is appended to the required endpoint url override. Defaults to ‘v1’.
service_type – Used as an endpoint filter when using an authenticated keystone session. Defaults to ‘key-manager’.
service_name – Used as an endpoint filter when using an authenticated keystone session.
interface – Used as an endpoint filter when using an authenticated keystone session. Defaults to ‘public’.
region_name – Used as an endpoint filter when using an authenticated keystone session.
microversion – Specifiy an API Microversion to be used. Defaults to ‘1.1’.
Entity Manager for Secret entities
Factory method for creating new Secret objects
Secrets returned by this method have not yet been stored in the Barbican service.
name – A friendly name for the Secret
payload – The unencrypted secret data
payload_content_type – DEPRECATED: The format/type of the secret data. Setting this can lead to unexpected results. See Launchpad Bug #1419166.
payload_content_encoding – DEPRECATED: The encoding of the secret data. Setting this can lead to unexpected results. See Launchpad Bug #1419166.
algorithm – The algorithm associated with this secret key
bit_length – The bit length of this secret key
mode – The algorithm mode used with this secret key
secret_type – The secret type for this secret key
expiration – The expiration time of the secret in ISO 8601 format
A new Secret object
barbicanclient.exceptions.HTTPAuthError – 401 Responses
barbicanclient.exceptions.HTTPClientError – 4xx Responses
barbicanclient.exceptions.HTTPServerError – 5xx Responses
Delete a Secret from Barbican
secret_ref – Full HATEOAS reference to a Secret, or a UUID
force – When true, forces the deletion of secrets with consumers
barbicanclient.exceptions.HTTPAuthError – 401 Responses
barbicanclient.exceptions.HTTPClientError – 4xx Responses
barbicanclient.exceptions.HTTPServerError – 5xx Responses
Retrieve an existing Secret from Barbican
secret_ref (str) – Full HATEOAS reference to a Secret, or a UUID
payload_content_type (str) – DEPRECATED: Content type to use for payload decryption. Setting this can lead to unexpected results. See Launchpad Bug #1419166.
Secret object retrieved from Barbican
barbicanclient.exceptions.HTTPAuthError – 401 Responses
barbicanclient.exceptions.HTTPClientError – 4xx Responses
barbicanclient.exceptions.HTTPServerError – 5xx Responses
List Secrets for the project
This method uses the limit and offset parameters for paging, and also supports filtering.
The time filters (created, updated, and expiration) are expected to be an ISO 8601 formatted string, which can be prefixed with comparison operators: ‘gt:’ (greater-than), ‘gte:’ (greater-than-or-equal), ‘lt:’ (less-than), or ‘lte’: (less-than-or-equal).
limit – Max number of secrets returned
offset – Offset secrets to begin list
name – Name filter for the list
algorithm – Algorithm filter for the list
mode – Mode filter for the list
bits – Bits filter for the list
secret_type – Secret type filter for the list
created – Created time filter for the list, an ISO 8601 format string, optionally prefixed with ‘gt:’, ‘gte:’, ‘lt:’, or ‘lte:’
updated – Updated time filter for the list, an ISO 8601 format string, optionally prefixed with ‘gt:’, ‘gte:’, ‘lt:’, or ‘lte:’
expiration – Expiration time filter for the list, an ISO 8601 format string, optionally prefixed with ‘gt:’, ‘gte:’, ‘lt:’, or ‘lte:’
sort – Determines the sorted order of the returned list, a string of comma-separated sort keys (‘created’, ‘expiration’, ‘mode’, ‘name’, ‘secret_type’, ‘status’, or ‘updated’) with a direction appended (‘:asc’ or ‘:desc’) to each key
list of Secret objects that satisfy the provided filter criteria.
list
barbicanclient.exceptions.HTTPAuthError – 401 Responses
barbicanclient.exceptions.HTTPClientError – 4xx Responses
barbicanclient.exceptions.HTTPServerError – 5xx Responses
List consumers of the secret
secret_ref – Full HATEOAS reference to a secret, or a UUID
limit – Max number of consumers returned
offset – Offset secrets to begin list
barbicanclient.exceptions.HTTPAuthError – 401 Responses
barbicanclient.exceptions.HTTPClientError – 4xx Responses
barbicanclient.exceptions.HTTPServerError – 5xx Responses
Add a consumer to the secret
secret_ref – Full HATEOAS reference to a secret, or a UUID
service – Name of the consuming service
resource_type – Type of the consuming resource
resource_id – ID of the consuming resource
A secret object per the get() method
barbicanclient.exceptions.HTTPAuthError – 401 Responses
barbicanclient.exceptions.HTTPClientError – 4xx Responses
barbicanclient.exceptions.HTTPServerError – 5xx Responses
NotImplementedError – When using microversion 1.0
Remove a consumer from the secret
secret_ref – Full HATEOAS reference to a secret, or a UUID
service – Name of the previously consuming service
resource_type – type of the previously consuming resource
resource_id – ID of the previously consuming resource
barbicanclient.exceptions.HTTPAuthError – 401 Responses
barbicanclient.exceptions.HTTPClientError – 4xx Responses
barbicanclient.exceptions.HTTPServerError – 5xx Responses
Update an existing Secret in Barbican
secret_ref (str) – Full HATEOAS reference to a Secret, or a UUID
payload (str) – New payload to add to secret
barbicanclient.exceptions.HTTPAuthError – 401 Responses
barbicanclient.exceptions.HTTPClientError – 4xx Responses
barbicanclient.exceptions.HTTPServerError – 5xx Responses
Secrets managed by Barbican
Secrets represent keys, credentials, and other sensitive data that is stored by the Barbican service.
Secret objects should not be instantiated directly.
You should use the create or get methods of the
barbicanclient.secrets.SecretManager
instead.
Get ACL settings for this secret.
Deletes the Secret from Barbican
Lazy-loaded property that holds the unencrypted data
Stores the Secret in Barbican.
New Secret objects are not persisted in Barbican until this method is called.
PayloadException
Updates the secret in Barbican.
Entity Manager for Order entitites
Factory method for AsymmetricOrder objects
AsymmetricOrder objects returned by this method have not yet been submitted to the Barbican service.
name – A friendly name for the container to be created
algorithm – The algorithm associated with this secret key
bit_length – The bit length of this secret key
pass_phrase – Optional passphrase
payload_content_type – The format/type of the secret data
expiration – The expiration time of the secret in ISO 8601 format
AsymmetricOrder
barbicanclient.exceptions.HTTPAuthError – 401 Responses
barbicanclient.exceptions.HTTPClientError – 4xx Responses
barbicanclient.exceptions.HTTPServerError – 5xx Responses
Factory method for CertificateOrder objects
CertificateOrder objects returned by this method have not yet been submitted to the Barbican service.
name – A friendly name for the container to be created
request_type – The type of the certificate request
subject_dn – A subject for the certificate
source_container_ref – A container with a public/private key pair to use as source for stored-key requests
ca_id – The identifier of the CA to use
profile – The profile of certificate to use
request_data – The CSR content
CertificateOrder
barbicanclient.v1.orders.CertificateOrder
Factory method for KeyOrder objects
KeyOrder objects returned by this method have not yet been submitted to the Barbican service.
name – A friendly name for the secret to be created
algorithm – The algorithm associated with this secret key
bit_length – The bit length of this secret key
mode – The algorithm mode used with this secret key
payload_content_type – The format/type of the secret data
expiration – The expiration time of the secret in ISO 8601 format
KeyOrder
barbicanclient.exceptions.HTTPAuthError – 401 Responses
barbicanclient.exceptions.HTTPClientError – 4xx Responses
barbicanclient.exceptions.HTTPServerError – 5xx Responses
Delete an Order from Barbican
order_ref – Full HATEOAS reference to an Order, or a UUID
Retrieve an existing Order from Barbican
order_ref – Full HATEOAS reference to an Order, or a UUID
An instance of the appropriate subtype of Order
barbicanclient.exceptions.HTTPAuthError – 401 Responses
barbicanclient.exceptions.HTTPClientError – 4xx Responses
barbicanclient.exceptions.HTTPServerError – 5xx Responses
List Orders for the project
This method uses the limit and offset parameters for paging.
limit – Max number of orders returned
offset – Offset orders to begin list
list of Order objects
barbicanclient.exceptions.HTTPAuthError – 401 Responses
barbicanclient.exceptions.HTTPClientError – 4xx Responses
barbicanclient.exceptions.HTTPServerError – 5xx Responses
Base order object to hold common functionality
This should be considered an abstract class that should not be instantiated directly.
Deletes the Order from Barbican
Submit the Order to Barbican.
New Order objects are not persisted in Barbican until this method is called.
KeyOrders can be used to request random key material from Barbican
Encryption mode being used with this key
The mode could be set to “CBC” for example, when requesting a key that will be used for AES encryption in CBC mode.
Passphrase to be used for passphrase protected asymmetric keys
EntityManager for Container entities
You should use the ContainerManager exposed by the Client and should not need to instantiate your own.
Factory method for Container objects
Container objects returned by this method have not yet been stored in Barbican.
name – A friendly name for the Container
secrets – Secrets to populate when creating a Container
Container
barbicanclient.exceptions.HTTPAuthError – 401 Responses
barbicanclient.exceptions.HTTPClientError – 4xx Responses
barbicanclient.exceptions.HTTPServerError – 5xx Responses
Factory method for CertificateContainer objects
CertificateContainer objects returned by this method have not yet been stored in Barbican.
name – A friendly name for the CertificateContainer
certificate – Secret object containing a Certificate
intermediates – Secret object containing Intermediate Certs
private_key – Secret object containing a Private Key
private_key_passphrase – Secret object containing a passphrase
CertificateContainer
barbicanclient.exceptions.HTTPAuthError – 401 Responses
barbicanclient.exceptions.HTTPClientError – 4xx Responses
barbicanclient.exceptions.HTTPServerError – 5xx Responses
Factory method for RSAContainer objects
RSAContainer objects returned by this method have not yet been stored in Barbican.
name – A friendly name for the RSAContainer
public_key – Secret object containing a Public Key
private_key – Secret object containing a Private Key
private_key_passphrase – Secret object containing a passphrase
RSAContainer
barbicanclient.exceptions.HTTPAuthError – 401 Responses
barbicanclient.exceptions.HTTPClientError – 4xx Responses
barbicanclient.exceptions.HTTPServerError – 5xx Responses
Delete a Container from Barbican
container_ref – Full HATEOAS reference to a Container, or a UUID
barbicanclient.exceptions.HTTPAuthError – 401 Responses
barbicanclient.exceptions.HTTPClientError – 4xx Responses
barbicanclient.exceptions.HTTPServerError – 5xx Responses
Retrieve an existing Container from Barbican
container_ref – Full HATEOAS reference to a Container, or a UUID
Container object or a subclass of the appropriate type
List containers for the project.
This method uses the limit and offset parameters for paging.
limit – Max number of containers returned
offset – Offset containers to begin list
name – Name filter for the list
type – Type filter for the list
list of Container metadata objects
barbicanclient.exceptions.HTTPAuthError – 401 Responses
barbicanclient.exceptions.HTTPClientError – 4xx Responses
barbicanclient.exceptions.HTTPServerError – 5xx Responses
Add a consumer to the container
container_ref – Full HATEOAS reference to a Container, or a UUID
name – Name of the consuming service
url – URL of the consuming resource
A container object per the get() method
barbicanclient.exceptions.HTTPAuthError – 401 Responses
barbicanclient.exceptions.HTTPClientError – 4xx Responses
barbicanclient.exceptions.HTTPServerError – 5xx Responses
Remove a consumer from the container
container_ref – Full HATEOAS reference to a Container, or a UUID
name – Name of the previously consuming service
url – URL of the previously consuming resource
barbicanclient.exceptions.HTTPAuthError – 401 Responses
barbicanclient.exceptions.HTTPClientError – 4xx Responses
barbicanclient.exceptions.HTTPServerError – 5xx Responses
Container is a generic grouping of Secrets
Get ACL settings for this container.
Delete container from Barbican
List of Secrets in Containers
Store Container in Barbican
Secret containing the Private Key
Secret containing the Passphrase
Secret containing the Public Key
Secret containing the certificate
Secret containing intermediate certificates
Secret containing the private key
Secret containing the passphrase
Entity Manager for Secret or Container ACL entities
Factory method for creating ACL entity.
ACL object returned by this method have not yet been stored in Barbican.
Input entity_ref is used to determine whether
ACL object type needs to be barbicanclient.acls.SecretACL
or barbicanclient.acls.ContainerACL
.
entity_ref (str) – Full HATEOAS reference to a secret or container
users (List or None) – List of Keystone userid(s) to be used in ACL.
project_access (bool) – Flag indicating project access behavior
operation_type (str) – Type indicating which class of Barbican operations this ACL is defined for e.g. ‘read’ operations
ACL object instance
barbicanclient.v1.acls.SecretACL
or
barbicanclient.v1.acls.ContainerACL
Retrieve existing ACLs for a secret or container found in Barbican
entity_ref (str) – Full HATEOAS reference to a secret or container.
ACL entity object instance
barbicanclient.v1.acls.SecretACL
or
barbicanclient.v1.acls.ContainerACL
barbicanclient.exceptions.HTTPAuthError – 401 Responses
barbicanclient.exceptions.HTTPClientError – 4xx Responses
ACL entity for a secret
Base ACL entity instance for secret or container.
Provide ACL data arguments to set ACL setting for given operation_type.
To add ACL setting for other operation types, use add_operation_acl method.
api – client instance reference
entity_ref (str) – Full HATEOAS reference to a secret or container
users (str List or None) – List of Keystone userid(s) to be used for ACL.
project_access (bool) – Flag indicating project access behavior
operation_type (str) – Type indicating which class of Barbican operations this ACL is defined for e.g. ‘read’ operations
created (str) – Time string indicating ACL create timestamp. This is populated only when populating data from api response. Not needed in client input.
updated (str) – Time string indicating ACL last update timestamp. This is populated only when populating data from api response. Not needed in client input.
Add ACL settings to entity for specific operation type.
If matching operation_type ACL already exists, then it replaces it with new PerOperationACL object using provided inputs. Otherwise it appends new PerOperationACL object to existing per operation ACL list.
This just adds to local entity and have not yet applied these changes to server.
users (List or None) – List of Keystone userid(s) to be used in ACL.
project_access (bool) – Flag indicating project access behavior
operation_type (str) – Type indicating which class of Barbican operations this ACL is defined for e.g. ‘read’ operations
created (str) – Time string indicating ACL create timestamp. This is populated only when populating data from api response. Not needed in client input.
updated (str) – Time string indicating ACL last update timestamp. This is populated only when populating data from api response. Not needed in client input.
Entity URI reference.
Entity UUID
Get operation specific ACL instance.
operation_type (str) – Type indicating which operation’s ACL setting is needed.
Loads ACL entity from Barbican server using its acl_ref
Clears the existing list of per operation ACL settings if there. Populates current ACL entity with ACL settings received from Barbican server.
barbicanclient.exceptions.HTTPAuthError – 401 Responses
barbicanclient.exceptions.HTTPClientError – 4xx Responses
barbicanclient.exceptions.HTTPServerError – 5xx Responses
List of operation specific ACL settings.
Remove Barbican ACLs setting defined for a secret or container
barbicanclient.exceptions.HTTPAuthError – 401 Responses
barbicanclient.exceptions.HTTPClientError – 4xx Responses
Submits ACLs for a secret or a container defined in server
In existing ACL case, this overwrites the existing ACL setting with provided inputs. If input users are None or empty list, this will remove existing ACL users if there. If input project_access flag is None, then default project access behavior is enabled.
str acl_ref: Full HATEOAS reference to a secret or container ACL.
barbicanclient.exceptions.HTTPAuthError – 401 Responses
barbicanclient.exceptions.HTTPClientError – 4xx Responses
barbicanclient.exceptions.HTTPServerError – 5xx Responses
ACL entity for a container
Base ACL entity instance for secret or container.
Provide ACL data arguments to set ACL setting for given operation_type.
To add ACL setting for other operation types, use add_operation_acl method.
api – client instance reference
entity_ref (str) – Full HATEOAS reference to a secret or container
users (str List or None) – List of Keystone userid(s) to be used for ACL.
project_access (bool) – Flag indicating project access behavior
operation_type (str) – Type indicating which class of Barbican operations this ACL is defined for e.g. ‘read’ operations
created (str) – Time string indicating ACL create timestamp. This is populated only when populating data from api response. Not needed in client input.
updated (str) – Time string indicating ACL last update timestamp. This is populated only when populating data from api response. Not needed in client input.
Add ACL settings to entity for specific operation type.
If matching operation_type ACL already exists, then it replaces it with new PerOperationACL object using provided inputs. Otherwise it appends new PerOperationACL object to existing per operation ACL list.
This just adds to local entity and have not yet applied these changes to server.
users (List or None) – List of Keystone userid(s) to be used in ACL.
project_access (bool) – Flag indicating project access behavior
operation_type (str) – Type indicating which class of Barbican operations this ACL is defined for e.g. ‘read’ operations
created (str) – Time string indicating ACL create timestamp. This is populated only when populating data from api response. Not needed in client input.
updated (str) – Time string indicating ACL last update timestamp. This is populated only when populating data from api response. Not needed in client input.
Entity URI reference.
Entity UUID
Get operation specific ACL instance.
operation_type (str) – Type indicating which operation’s ACL setting is needed.
Loads ACL entity from Barbican server using its acl_ref
Clears the existing list of per operation ACL settings if there. Populates current ACL entity with ACL settings received from Barbican server.
barbicanclient.exceptions.HTTPAuthError – 401 Responses
barbicanclient.exceptions.HTTPClientError – 4xx Responses
barbicanclient.exceptions.HTTPServerError – 5xx Responses
List of operation specific ACL settings.
Remove Barbican ACLs setting defined for a secret or container
barbicanclient.exceptions.HTTPAuthError – 401 Responses
barbicanclient.exceptions.HTTPClientError – 4xx Responses
Submits ACLs for a secret or a container defined in server
In existing ACL case, this overwrites the existing ACL setting with provided inputs. If input users are None or empty list, this will remove existing ACL users if there. If input project_access flag is None, then default project access behavior is enabled.
str acl_ref: Full HATEOAS reference to a secret or container ACL.
barbicanclient.exceptions.HTTPAuthError – 401 Responses
barbicanclient.exceptions.HTTPClientError – 4xx Responses
barbicanclient.exceptions.HTTPServerError – 5xx Responses
Raised for 401 Unauthorized responses from the server.
Raised for 4xx responses from the server.
Base exception for HTTP errors.
Raised for 5xx responses from the server.
User is trying to use an unsupported version of the API.
Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.