golden hour

/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules

File/Folder	Size	Actions
__init__.py	35 B
__pycache__	-
acme.py	12.74 KB
aix_group.py	4.12 KB
aix_shadow.py	1.93 KB
aixpkg.py	24.15 KB
aliases.py	5.07 KB
alternatives.py	5.71 KB
ansiblegate.py	19.51 KB
apache.py	12.47 KB
apcups.py	2.15 KB
apf.py	3.09 KB
apkpkg.py	16 KB
aptly.py	15.28 KB
aptpkg.py	116.64 KB
archive.py	48.63 KB
arista_pyeapi.py	22.06 KB
artifactory.py	24.78 KB
at.py	10.72 KB
at_solaris.py	8.51 KB
augeas_cfg.py	13.93 KB
aws_sqs.py	6.55 KB
azurearm_compute.py	20.8 KB
azurearm_dns.py	15.8 KB
azurearm_network.py	82.99 KB
azurearm_resource.py	35.75 KB
bamboohr.py	7.36 KB
baredoc.py	11.13 KB
bcache.py	28.97 KB
beacons.py	27.82 KB
bigip.py	69.11 KB
bluez_bluetooth.py	6.76 KB
boto3_elasticache.py	37.34 KB
boto3_elasticsearch.py	53.17 KB
boto3_route53.py	39.82 KB
boto3_sns.py	12.93 KB
boto_apigateway.py	61.86 KB
boto_asg.py	35.69 KB
boto_cfn.py	7.95 KB
boto_cloudfront.py	12.75 KB
boto_cloudtrail.py	14.45 KB
boto_cloudwatch.py	10.99 KB
boto_cloudwatch_event.py	9.48 KB
boto_cognitoidentity.py	14.63 KB
boto_datapipeline.py	6.94 KB
boto_dynamodb.py	14.98 KB
boto_ec2.py	79.27 KB
boto_efs.py	14.05 KB
boto_elasticache.py	23.69 KB
boto_elasticsearch_domain.py	15.85 KB
boto_elb.py	35.53 KB
boto_elbv2.py	10.78 KB
boto_iam.py	75.62 KB
boto_iot.py	26.2 KB
boto_kinesis.py	19.62 KB
boto_kms.py	17.29 KB
boto_lambda.py	35.05 KB
boto_rds.py	34.92 KB
boto_route53.py	32.55 KB
boto_s3.py	4.24 KB
boto_s3_bucket.py	31.8 KB
boto_secgroup.py	25.22 KB
boto_sns.py	7.22 KB
boto_sqs.py	6.43 KB
boto_ssm.py	3.63 KB
boto_vpc.py	113.08 KB
bower.py	5.85 KB
bridge.py	10.81 KB
bsd_shadow.py	6.25 KB
btrfs.py	33.66 KB
cabal.py	3.79 KB
capirca_acl.py	40.04 KB
cassandra_cql.py	54.16 KB
cassandra_mod.py	4.3 KB
celery.py	3.33 KB
ceph.py	15.82 KB
chassis.py	1.52 KB
chef.py	4.66 KB
chocolatey.py	41.55 KB
chronos.py	2.89 KB
chroot.py	11.73 KB
cimc.py	23.02 KB
ciscoconfparse_mod.py	14.79 KB
cisconso.py	3.83 KB
cloud.py	9.39 KB
cmdmod.py	163.73 KB
composer.py	10.31 KB
config.py	16.98 KB
consul.py	69.3 KB
container_resource.py	12.94 KB
cp.py	31.98 KB
cpan.py	5.54 KB
cron.py	28.09 KB
cryptdev.py	10.08 KB
csf.py	16.04 KB
cyg.py	8.32 KB
daemontools.py	5.41 KB
data.py	3.85 KB
datadog_api.py	7.76 KB
ddns.py	7.12 KB
deb_apache.py	7.41 KB
deb_postgres.py	4.18 KB
debconfmod.py	4.06 KB
debian_ip.py	64.91 KB
debian_service.py	6.55 KB
debuild_pkgbuild.py	34.68 KB
defaults.py	6.55 KB
devinfo.py	9.07 KB
devmap.py	627 B
dig.py	8.75 KB
disk.py	30.82 KB
djangomod.py	7.53 KB
dnsmasq.py	5.71 KB
dnsutil.py	11.51 KB
dockercompose.py	32.62 KB
dockermod.py	224.85 KB
dpkg_lowpkg.py	12.94 KB
drac.py	10.97 KB
dracr.py	38.53 KB
drbd.py	7.19 KB
dummyproxy_pkg.py	2.46 KB
dummyproxy_service.py	2.91 KB
ebuildpkg.py	38.74 KB
eix.py	1.58 KB
elasticsearch.py	51.44 KB
environ.py	8.96 KB
eselect.py	4.99 KB
esxcluster.py	1.66 KB
esxdatacenter.py	1.68 KB
esxi.py	2.79 KB
esxvm.py	1.63 KB
etcd_mod.py	8.56 KB
ethtool.py	11.12 KB
event.py	7.67 KB
extfs.py	8.78 KB
file.py	232.18 KB
firewalld.py	20.51 KB
freebsd_sysctl.py	4.99 KB
freebsd_update.py	6.19 KB
freebsdjail.py	7.16 KB
freebsdkmod.py	6.17 KB
freebsdpkg.py	17.04 KB
freebsdports.py	13.13 KB
freebsdservice.py	12.53 KB
freezer.py	10.2 KB
gcp_addon.py	4.07 KB
gem.py	10.6 KB
genesis.py	21.75 KB
gentoo_service.py	9.18 KB
gentoolkitmod.py	8.39 KB
git.py	172.01 KB
github.py	53.19 KB
glanceng.py	4.69 KB
glassfish.py	19.49 KB
glusterfs.py	19.55 KB
gnomedesktop.py	6.85 KB
google_chat.py	1.52 KB
gpg.py	39.09 KB
grafana4.py	30.27 KB
grains.py	21.81 KB
groupadd.py	11.87 KB
grub_legacy.py	3.08 KB
guestfs.py	2.37 KB
hadoop.py	3.76 KB
haproxyconn.py	10.17 KB
hashutil.py	6.77 KB
heat.py	25.25 KB
helm.py	39.27 KB
hg.py	7.16 KB
highstate_doc.py	22.76 KB
hosts.py	10.47 KB
http.py	3.76 KB
icinga2.py	4.46 KB
idem.py	1.75 KB
ifttt.py	2.28 KB
ilo.py	15.98 KB
incron.py	7.68 KB
influxdb08mod.py	15.07 KB
influxdbmod.py	16.13 KB
infoblox.py	17.53 KB
ini_manage.py	14.63 KB
inspectlib	-
inspector.py	8.19 KB
introspect.py	4.02 KB
iosconfig.py	14.78 KB
ipmi.py	25.47 KB
ipset.py	17.97 KB
iptables.py	57.44 KB
iwtools.py	3.99 KB
jboss7.py	20.51 KB
jboss7_cli.py	15.23 KB
jenkinsmod.py	11.9 KB
jinja.py	2.66 KB
jira_mod.py	7.07 KB
junos.py	73.96 KB
k8s.py	24.87 KB
kapacitor.py	5.37 KB
kerberos.py	5.42 KB
kernelpkg_linux_apt.py	6.71 KB
kernelpkg_linux_yum.py	7.26 KB
key.py	1007 B
keyboard.py	2.64 KB
keystone.py	43.14 KB
keystoneng.py	21.82 KB
keystore.py	7.18 KB
kmod.py	7.65 KB
kubeadm.py	34.64 KB
kubernetesmod.py	46.77 KB
launchctl_service.py	9.69 KB
layman.py	4.22 KB
ldap3.py	18.81 KB
ldapmod.py	5.9 KB
libcloud_compute.py	23.48 KB
libcloud_dns.py	9.73 KB
libcloud_loadbalancer.py	13.14 KB
libcloud_storage.py	12.16 KB
linux_acl.py	7.7 KB
linux_ip.py	5.55 KB
linux_lvm.py	17.86 KB
linux_service.py	4.64 KB
linux_shadow.py	12.96 KB
linux_sysctl.py	7.5 KB
localemod.py	11.84 KB
locate.py	2.58 KB
logadm.py	9.44 KB
logmod.py	1.25 KB
logrotate.py	7.72 KB
lvs.py	11.54 KB
lxc.py	147.27 KB
lxd.py	90.07 KB
mac_assistive.py	11.37 KB
mac_brew_pkg.py	19.91 KB
mac_desktop.py	2.77 KB
mac_group.py	6.62 KB
mac_keychain.py	6.39 KB
mac_pkgutil.py	2.84 KB
mac_portspkg.py	11.36 KB
mac_power.py	13.29 KB
mac_service.py	19.64 KB
mac_shadow.py	14.23 KB
mac_softwareupdate.py	14.52 KB
mac_sysctl.py	5.13 KB
mac_system.py	15.07 KB
mac_timezone.py	8.34 KB
mac_user.py	16.41 KB
mac_xattr.py	6.27 KB
macdefaults.py	2.33 KB
macpackage.py	6.66 KB
makeconf.py	17.31 KB
mandrill.py	6.31 KB
marathon.py	5.36 KB
match.py	13 KB
mattermost.py	3.4 KB
mdadm_raid.py	9.86 KB
mdata.py	3.38 KB
memcached.py	6.13 KB
mine.py	18.84 KB
minion.py	7.68 KB
mod_random.py	7.18 KB
modjk.py	12.48 KB
mongodb.py	29.75 KB
monit.py	5.51 KB
moosefs.py	3.87 KB
mount.py	58.44 KB
mssql.py	14.64 KB
msteams.py	2.11 KB
munin.py	2.4 KB
mysql.py	90.66 KB
nacl.py	9.72 KB
nagios.py	6.53 KB
nagios_rpc.py	5.09 KB
namecheap_domains.py	12.84 KB
namecheap_domains_dns.py	5.93 KB
namecheap_domains_ns.py	4.51 KB
namecheap_ssl.py	25.69 KB
namecheap_users.py	2.4 KB
napalm_bgp.py	9.72 KB
napalm_formula.py	11.33 KB
napalm_mod.py	61.37 KB
napalm_netacl.py	28.59 KB
napalm_network.py	93.22 KB
napalm_ntp.py	10.22 KB
napalm_probes.py	13.25 KB
napalm_route.py	5.09 KB
napalm_snmp.py	7.05 KB
napalm_users.py	6.49 KB
napalm_yang_mod.py	20.28 KB
netaddress.py	1.6 KB
netbox.py	32.22 KB
netbsd_sysctl.py	3.92 KB
netbsdservice.py	6.43 KB
netmiko_mod.py	19.61 KB
netscaler.py	27.02 KB
network.py	63.42 KB
neutron.py	44.92 KB
neutronng.py	15.02 KB
nexus.py	22.95 KB
nfs3.py	3.9 KB
nftables.py	33.58 KB
nginx.py	3.83 KB
nilrt_ip.py	36.18 KB
nix.py	8.03 KB
nova.py	19.6 KB
npm.py	10.4 KB
nspawn.py	41.35 KB
nxos.py	24.65 KB
nxos_api.py	14.72 KB
nxos_upgrade.py	14.74 KB
omapi.py	3.6 KB
openbsd_sysctl.py	3.74 KB
openbsdpkg.py	10.97 KB
openbsdrcctl_service.py	6.33 KB
openbsdservice.py	8.31 KB
openscap.py	2.81 KB
openstack_config.py	3.21 KB
openstack_mng.py	2.71 KB
openvswitch.py	17.19 KB
opkg.py	49.67 KB
opsgenie.py	3.29 KB
oracle.py	5.82 KB
osquery.py	24.93 KB
out.py	2.53 KB
pacmanpkg.py	31.92 KB
pagerduty.py	4.7 KB
pagerduty_util.py	13.48 KB
pam.py	2.01 KB
panos.py	61.05 KB
parallels.py	19.85 KB
parted_partition.py	21.53 KB
pcs.py	14.11 KB
pdbedit.py	10.79 KB
pecl.py	3.79 KB
peeringdb.py	8.39 KB
pf.py	9.51 KB
philips_hue.py	1.55 KB
pillar.py	21.37 KB
pip.py	53.42 KB
pkg_resource.py	12.3 KB
pkgin.py	17.29 KB
pkgng.py	61.07 KB
pkgutil.py	9.85 KB
portage_config.py	22.73 KB
postfix.py	16.24 KB
postgres.py	88.24 KB
poudriere.py	7.85 KB
powerpath.py	2.57 KB
proxy.py	11.49 KB
ps.py	20.89 KB
publish.py	10.25 KB
puppet.py	10.9 KB
purefa.py	33.59 KB
purefb.py	13.69 KB
pushbullet.py	1.88 KB
pushover_notify.py	3.48 KB
pw_group.py	4.62 KB
pw_user.py	12.47 KB
pyenv.py	6.93 KB
qemu_img.py	1.53 KB
qemu_nbd.py	3.28 KB
quota.py	6.43 KB
rabbitmq.py	38.4 KB
rallydev.py	6.09 KB
random_org.py	23.76 KB
rbac_solaris.py	16.05 KB
rbenv.py	10.75 KB
rdp.py	6.08 KB
rebootmgr.py	7.68 KB
redismod.py	16.36 KB
reg.py	16.36 KB
rest_pkg.py	2.26 KB
rest_sample_utils.py	558 B
rest_service.py	3.63 KB
restartcheck.py	24.1 KB
restconf.py	3.15 KB
ret.py	1.27 KB
rh_ip.py	38.55 KB
rh_service.py	16.61 KB
riak.py	5.19 KB
rpm_lowpkg.py	27.67 KB
rpmbuild_pkgbuild.py	24.53 KB
rsync.py	8.04 KB
runit.py	17.17 KB
rvm.py	11.1 KB
s3.py	9.93 KB
s6.py	3.62 KB
salt_proxy.py	4.48 KB
salt_version.py	4.58 KB
saltcheck.py	46.66 KB
saltcloudmod.py	954 B
saltutil.py	57.49 KB
schedule.py	50.81 KB
scp_mod.py	6.22 KB
scsi.py	2.66 KB
sdb.py	2.48 KB
seed.py	8.87 KB
selinux.py	24.2 KB
sensehat.py	7.79 KB
sensors.py	1.3 KB
serverdensity_device.py	8.1 KB
servicenow.py	4.36 KB
slack_notify.py	7.83 KB
slackware_service.py	6.84 KB
slsutil.py	19.04 KB
smartos_imgadm.py	12.04 KB
smartos_nictagadm.py	6.46 KB
smartos_virt.py	5.21 KB
smartos_vmadm.py	26.2 KB
smbios.py	10.05 KB
smf_service.py	8.52 KB
smtp.py	5.41 KB
snapper.py	27.14 KB
solaris_fmadm.py	11.2 KB
solaris_group.py	2.8 KB
solaris_shadow.py	7.98 KB
solaris_system.py	3.72 KB
solaris_user.py	11.06 KB
solarisipspkg.py	18.68 KB
solarispkg.py	15.4 KB
solr.py	45.54 KB
solrcloud.py	14.63 KB
splunk.py	8.14 KB
splunk_search.py	8.76 KB
sqlite3.py	2.54 KB
ssh.py	43.89 KB
ssh_pkg.py	1.08 KB
ssh_service.py	3.39 KB
state.py	82.34 KB
status.py	57.79 KB
statuspage.py	14.67 KB
supervisord.py	11.15 KB
suse_apache.py	2.45 KB
suse_ip.py	35.72 KB
svn.py	10.75 KB
swarm.py	13.5 KB
swift.py	5.53 KB
sysbench.py	6.62 KB
sysfs.py	6.61 KB
syslog_ng.py	31.52 KB
sysmod.py	22.59 KB
sysrc.py	3.38 KB
system.py	19.28 KB
system_profiler.py	3.54 KB
systemd_service.py	46.29 KB
telegram.py	3.28 KB
telemetry.py	12.87 KB
temp.py	831 B
test.py	15.4 KB
test_virtual.py	237 B
testinframod.py	9.92 KB
textfsm_mod.py	16.22 KB
timezone.py	19.98 KB
tls.py	58.63 KB
tomcat.py	18.59 KB
trafficserver.py	10.44 KB
transactional_update.py	35.83 KB
travisci.py	2.05 KB
tuned.py	2.34 KB
twilio_notify.py	2.95 KB
udev.py	3.72 KB
upstart_service.py	16.92 KB
uptime.py	3.23 KB
useradd.py	22.63 KB
uwsgi.py	996 B
vagrant.py	20.4 KB
varnish.py	3.08 KB
vault.py	15.61 KB
vbox_guest.py	10.55 KB
vboxmanage.py	14.71 KB
vcenter.py	1.61 KB
victorops.py	6.54 KB
virt.py	287.71 KB
virtualenv_mod.py	15.09 KB
vmctl.py	9.56 KB
vsphere.py	380.41 KB
webutil.py	3.66 KB
win_auditpol.py	4.74 KB
win_autoruns.py	2.29 KB
win_certutil.py	4.55 KB
win_dacl.py	32.27 KB
win_disk.py	1.8 KB
win_dism.py	20.7 KB
win_dns_client.py	4.19 KB
win_dsc.py	27.54 KB
win_event.py	22.32 KB
win_file.py	64.39 KB
win_firewall.py	20.15 KB
win_groupadd.py	11.27 KB
win_iis.py	68.78 KB
win_ip.py	11.43 KB
win_lgpo.py	491.76 KB
win_lgpo_reg.py	17.9 KB
win_license.py	2.72 KB
win_network.py	13.9 KB
win_ntp.py	1.8 KB
win_path.py	11.12 KB
win_pkg.py	86.43 KB
win_pki.py	15.8 KB
win_powercfg.py	9.85 KB
win_psget.py	8.97 KB
win_servermanager.py	14.21 KB
win_service.py	32.96 KB
win_shadow.py	3.03 KB
win_shortcut.py	16.49 KB
win_smtp_server.py	17.67 KB
win_snmp.py	13.38 KB
win_status.py	16.94 KB
win_system.py	40.61 KB
win_task.py	79.17 KB
win_timezone.py	13.3 KB
win_useradd.py	27.39 KB
win_wua.py	38.29 KB
win_wusa.py	5.88 KB
winrepo.py	6.09 KB
wordpress.py	4.71 KB
x509.py	63.1 KB
x509_v2.py	74.15 KB
xapi_virt.py	24.07 KB
xbpspkg.py	15.84 KB
xfs.py	15.35 KB
xml.py	2.14 KB
xmpp.py	5.28 KB
yaml.py	1.94 KB
yumpkg.py	116.5 KB
zabbix.py	97.55 KB
zcbuildout.py	28.16 KB
zenoss.py	5.64 KB
zfs.py	34.44 KB
zk_concurrency.py	11.16 KB
znc.py	2.26 KB
zoneadm.py	15.05 KB
zonecfg.py	21.85 KB
zookeeper.py	14.72 KB
zpool.py	44.02 KB
zypperpkg.py	94.87 KB

Edit: keystone.py

"""
Module for handling openstack keystone calls.

:optdepends:    - keystoneclient Python adapter
:configuration: This module is not usable until the following are specified
    either in a pillar or in the minion's config file:

.. code-block:: yaml

keystone.user: admin
        keystone.password: verybadpass
        keystone.tenant: admin
        keystone.tenant_id: f80919baedab48ec8931f200c65a50df
        keystone.auth_url: 'http://127.0.0.1:5000/v2.0/'
        keystone.verify_ssl: True

OR (for token based authentication)

.. code-block:: yaml

keystone.token: 'ADMIN'
        keystone.endpoint: 'http://127.0.0.1:35357/v2.0'

If configuration for multiple openstack accounts is required, they can be
    set up as different configuration profiles. For example:

.. code-block:: yaml

openstack1:
          keystone.user: admin
          keystone.password: verybadpass
          keystone.tenant: admin
          keystone.tenant_id: f80919baedab48ec8931f200c65a50df
          keystone.auth_url: 'http://127.0.0.1:5000/v2.0/'
          keystone.verify_ssl: True

openstack2:
          keystone.user: admin
          keystone.password: verybadpass
          keystone.tenant: admin
          keystone.tenant_id: f80919baedab48ec8931f200c65a50df
          keystone.auth_url: 'http://127.0.0.2:5000/v2.0/'
          keystone.verify_ssl: True

With this configuration in place, any of the keystone functions can make use
    of a configuration profile by declaring it explicitly.
    For example:

.. code-block:: bash

salt '*' keystone.tenant_list profile=openstack1
"""

import logging

import salt.utils.http

HAS_KEYSTONE = False
try:
    # pylint: disable=import-error
    import keystoneclient.exceptions
    from keystoneclient.v2_0 import client

HAS_KEYSTONE = True
    from keystoneauth1 import session
    from keystoneauth1.identity import generic
    from keystoneclient import discover
    from keystoneclient.v3 import client as client3

# pylint: enable=import-error
except ImportError:
    pass

_OS_IDENTITY_API_VERSION = 2
_TENANTS = "tenants"

log = logging.getLogger(__name__)

def __virtual__():
    """
    Only load this module if keystone
    is installed on this minion.
    """
    if HAS_KEYSTONE:
        return "keystone"
    return (
        False,
        "keystone execution module cannot be loaded: keystoneclient python library not"
        " available.",
    )

def _get_kwargs(profile=None, **connection_args):
    """
    get connection args
    """
    if profile:
        prefix = profile + ":keystone."
    else:
        prefix = "keystone."

def get(key, default=None):
        """
        look in connection_args first, then default to config file
        """
        return connection_args.get(
            "connection_" + key, __salt__["config.get"](prefix + key, default)
        )

user = get("user", "admin")
    password = get("password", "ADMIN")
    tenant = get("tenant", "admin")
    tenant_id = get("tenant_id")
    auth_url = get("auth_url", "http://127.0.0.1:35357/v2.0/")
    insecure = get("insecure", False)
    token = get("token")
    endpoint = get("endpoint", "http://127.0.0.1:35357/v2.0")
    user_domain_name = get("user_domain_name", "Default")
    project_domain_name = get("project_domain_name", "Default")
    verify_ssl = get("verify_ssl", True)
    if token:
        kwargs = {"token": token, "endpoint": endpoint}
    else:
        kwargs = {
            "username": user,
            "password": password,
            "tenant_name": tenant,
            "tenant_id": tenant_id,
            "auth_url": auth_url,
            "user_domain_name": user_domain_name,
            "project_domain_name": project_domain_name,
        }
        # 'insecure' keyword not supported by all v2.0 keystone clients
        #   this ensures it's only passed in when defined
        if insecure:
            kwargs["insecure"] = True
    kwargs["verify_ssl"] = verify_ssl
    return kwargs

def api_version(profile=None, **connection_args):
    """
    Returns the API version derived from endpoint's response.

CLI Example:

.. code-block:: bash

salt '*' keystone.api_version
    """
    kwargs = _get_kwargs(profile=profile, **connection_args)
    auth_url = kwargs.get("auth_url", kwargs.get("endpoint", None))
    try:
        return salt.utils.http.query(
            auth_url, decode=True, decode_type="json", verify_ssl=kwargs["verify_ssl"]
        )["dict"]["version"]["id"]
    except KeyError:
        return None

def auth(profile=None, **connection_args):
    """
    Set up keystone credentials. Only intended to be used within Keystone-enabled modules.

CLI Example:

.. code-block:: bash

salt '*' keystone.auth
    """
    __utils__["versions.warn_until"](
        "Argon",
        "The keystone module has been deprecated and will be removed in {version}.  "
        "Please update to using the keystoneng module",
    )
    kwargs = _get_kwargs(profile=profile, **connection_args)

disc = discover.Discover(auth_url=kwargs["auth_url"])
    v2_auth_url = disc.url_for("v2.0")
    v3_auth_url = disc.url_for("v3.0")
    if v3_auth_url:
        global _OS_IDENTITY_API_VERSION
        global _TENANTS
        _OS_IDENTITY_API_VERSION = 3
        _TENANTS = "projects"
        kwargs["auth_url"] = v3_auth_url
    else:
        kwargs["auth_url"] = v2_auth_url
        kwargs.pop("user_domain_name")
        kwargs.pop("project_domain_name")
    auth = generic.Password(**kwargs)
    sess = session.Session(auth=auth)
    ks_cl = disc.create_client(session=sess)
    return ks_cl

def ec2_credentials_create(
    user_id=None,
    name=None,
    tenant_id=None,
    tenant=None,
    profile=None,
    **connection_args
):
    """
    Create EC2-compatible credentials for user per tenant

CLI Examples:

.. code-block:: bash

salt '*' keystone.ec2_credentials_create name=admin tenant=admin

salt '*' keystone.ec2_credentials_create \
        user_id=c965f79c4f864eaaa9c3b41904e67082 \
        tenant_id=722787eb540849158668370dc627ec5f
    """
    kstone = auth(profile, **connection_args)

if name:
        user_id = user_get(name=name, profile=profile, **connection_args)[name]["id"]
    if not user_id:
        return {"Error": "Could not resolve User ID"}

if tenant:
        tenant_id = tenant_get(name=tenant, profile=profile, **connection_args)[tenant][
            "id"
        ]
    if not tenant_id:
        return {"Error": "Could not resolve Tenant ID"}

newec2 = kstone.ec2.create(user_id, tenant_id)
    return {
        "access": newec2.access,
        "secret": newec2.secret,
        "tenant_id": newec2.tenant_id,
        "user_id": newec2.user_id,
    }

def ec2_credentials_delete(
    user_id=None, name=None, access_key=None, profile=None, **connection_args
):
    """
    Delete EC2-compatible credentials

CLI Examples:

.. code-block:: bash

salt '*' keystone.ec2_credentials_delete \
        860f8c2c38ca4fab989f9bc56a061a64 access_key=5f66d2f24f604b8bb9cd28886106f442

salt '*' keystone.ec2_credentials_delete name=admin \
        access_key=5f66d2f24f604b8bb9cd28886106f442
    """
    kstone = auth(profile, **connection_args)

if name:
        user_id = user_get(name=name, profile=None, **connection_args)[name]["id"]
    if not user_id:
        return {"Error": "Could not resolve User ID"}
    kstone.ec2.delete(user_id, access_key)
    return 'ec2 key "{}" deleted under user id "{}"'.format(access_key, user_id)

def ec2_credentials_get(
    user_id=None, name=None, access=None, profile=None, **connection_args
):
    """
    Return ec2_credentials for a user (keystone ec2-credentials-get)

CLI Examples:

.. code-block:: bash

salt '*' keystone.ec2_credentials_get c965f79c4f864eaaa9c3b41904e67082 access=722787eb540849158668370
        salt '*' keystone.ec2_credentials_get user_id=c965f79c4f864eaaa9c3b41904e67082 access=722787eb540849158668370
        salt '*' keystone.ec2_credentials_get name=nova access=722787eb540849158668370dc627ec5f
    """
    kstone = auth(profile, **connection_args)
    ret = {}
    if name:
        for user in kstone.users.list():
            if user.name == name:
                user_id = user.id
                break
    if not user_id:
        return {"Error": "Unable to resolve user id"}
    if not access:
        return {"Error": "Access key is required"}
    ec2_credentials = kstone.ec2.get(
        user_id=user_id, access=access, profile=profile, **connection_args
    )
    ret[ec2_credentials.user_id] = {
        "user_id": ec2_credentials.user_id,
        "tenant": ec2_credentials.tenant_id,
        "access": ec2_credentials.access,
        "secret": ec2_credentials.secret,
    }
    return ret

def ec2_credentials_list(user_id=None, name=None, profile=None, **connection_args):
    """
    Return a list of ec2_credentials for a specific user (keystone ec2-credentials-list)

CLI Examples:

.. code-block:: bash

salt '*' keystone.ec2_credentials_list 298ce377245c4ec9b70e1c639c89e654
        salt '*' keystone.ec2_credentials_list user_id=298ce377245c4ec9b70e1c639c89e654
        salt '*' keystone.ec2_credentials_list name=jack
    """
    kstone = auth(profile, **connection_args)
    ret = {}
    if name:
        for user in kstone.users.list():
            if user.name == name:
                user_id = user.id
                break
    if not user_id:
        return {"Error": "Unable to resolve user id"}
    for ec2_credential in kstone.ec2.list(user_id):
        ret[ec2_credential.user_id] = {
            "user_id": ec2_credential.user_id,
            "tenant_id": ec2_credential.tenant_id,
            "access": ec2_credential.access,
            "secret": ec2_credential.secret,
        }
    return ret

def endpoint_get(service, region=None, profile=None, interface=None, **connection_args):
    """
    Return a specific endpoint (keystone endpoint-get)

CLI Example:

.. code-block:: bash

salt 'v2' keystone.endpoint_get nova [region=RegionOne]

salt 'v3' keystone.endpoint_get nova interface=admin [region=RegionOne]
    """
    auth(profile, **connection_args)
    services = service_list(profile, **connection_args)
    if service not in services:
        return {"Error": "Could not find the specified service"}
    service_id = services[service]["id"]
    endpoints = endpoint_list(profile, **connection_args)

e = [
        _f
        for _f in [
            e
            if e["service_id"] == service_id
            and (e["region"] == region if region else True)
            and (e["interface"] == interface if interface else True)
            else None
            for e in endpoints.values()
        ]
        if _f
    ]
    if len(e) > 1:
        return {
            "Error": (
                "Multiple endpoints found ({}) for the {} service. Please specify"
                " region.".format(e, service)
            )
        }
    if len(e) == 1:
        return e[0]
    return {"Error": "Could not find endpoint for the specified service"}

def endpoint_list(profile=None, **connection_args):
    """
    Return a list of available endpoints (keystone endpoints-list)

CLI Example:

.. code-block:: bash

salt '*' keystone.endpoint_list
    """
    kstone = auth(profile, **connection_args)
    ret = {}

for endpoint in kstone.endpoints.list():
        ret[endpoint.id] = {
            value: getattr(endpoint, value)
            for value in dir(endpoint)
            if not value.startswith("_")
            and isinstance(getattr(endpoint, value), (str, dict, bool))
        }
    return ret

def endpoint_create(
    service,
    publicurl=None,
    internalurl=None,
    adminurl=None,
    region=None,
    profile=None,
    url=None,
    interface=None,
    **connection_args
):
    """
    Create an endpoint for an Openstack service

CLI Examples:

.. code-block:: bash

salt 'v2' keystone.endpoint_create nova 'http://public/url' 'http://internal/url' 'http://adminurl/url' region

salt 'v3' keystone.endpoint_create nova url='http://public/url' interface='public' region='RegionOne'
    """
    kstone = auth(profile, **connection_args)
    keystone_service = service_get(name=service, profile=profile, **connection_args)
    if not keystone_service or "Error" in keystone_service:
        return {"Error": "Could not find the specified service"}

if _OS_IDENTITY_API_VERSION > 2:
        kstone.endpoints.create(
            service=keystone_service[service]["id"],
            region_id=region,
            url=url,
            interface=interface,
        )
    else:
        kstone.endpoints.create(
            region=region,
            service_id=keystone_service[service]["id"],
            publicurl=publicurl,
            adminurl=adminurl,
            internalurl=internalurl,
        )
    return endpoint_get(service, region, profile, interface, **connection_args)

def endpoint_delete(
    service, region=None, profile=None, interface=None, **connection_args
):
    """
    Delete endpoints of an Openstack service

CLI Examples:

.. code-block:: bash

salt 'v2' keystone.endpoint_delete nova [region=RegionOne]

salt 'v3' keystone.endpoint_delete nova interface=admin [region=RegionOne]
    """
    kstone = auth(profile, **connection_args)
    endpoint = endpoint_get(service, region, profile, interface, **connection_args)
    if not endpoint or "Error" in endpoint:
        return {"Error": "Could not find any endpoints for the service"}
    kstone.endpoints.delete(endpoint["id"])
    endpoint = endpoint_get(service, region, profile, interface, **connection_args)
    if not endpoint or "Error" in endpoint:
        return True

def role_create(name, profile=None, **connection_args):
    """
    Create a named role.

CLI Example:

.. code-block:: bash

salt '*' keystone.role_create admin
    """

kstone = auth(profile, **connection_args)
    if "Error" not in role_get(name=name, profile=profile, **connection_args):
        return {"Error": 'Role "{}" already exists'.format(name)}
    kstone.roles.create(name)
    return role_get(name=name, profile=profile, **connection_args)

def role_delete(role_id=None, name=None, profile=None, **connection_args):
    """
    Delete a role (keystone role-delete)

CLI Examples:

.. code-block:: bash

salt '*' keystone.role_delete c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.role_delete role_id=c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.role_delete name=admin
    """
    kstone = auth(profile, **connection_args)

if name:
        for role in kstone.roles.list():
            if role.name == name:
                role_id = role.id
                break
    if not role_id:
        return {"Error": "Unable to resolve role id"}

role = kstone.roles.get(role_id)
    kstone.roles.delete(role)

ret = "Role ID {} deleted".format(role_id)
    if name:
        ret += " ({})".format(name)
    return ret

def role_get(role_id=None, name=None, profile=None, **connection_args):
    """
    Return a specific roles (keystone role-get)

CLI Examples:

.. code-block:: bash

salt '*' keystone.role_get c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.role_get role_id=c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.role_get name=nova
    """
    kstone = auth(profile, **connection_args)
    ret = {}
    if name:
        for role in kstone.roles.list():
            if role.name == name:
                role_id = role.id
                break
    if not role_id:
        return {"Error": "Unable to resolve role id"}
    role = kstone.roles.get(role_id)

ret[role.name] = {"id": role.id, "name": role.name}
    return ret

def role_list(profile=None, **connection_args):
    """
    Return a list of available roles (keystone role-list)

CLI Example:

.. code-block:: bash

salt '*' keystone.role_list
    """
    kstone = auth(profile, **connection_args)
    ret = {}
    for role in kstone.roles.list():
        ret[role.name] = {
            value: getattr(role, value)
            for value in dir(role)
            if not value.startswith("_")
            and isinstance(getattr(role, value), (str, dict, bool))
        }
    return ret

def service_create(
    name, service_type, description=None, profile=None, **connection_args
):
    """
    Add service to Keystone service catalog

CLI Examples:

.. code-block:: bash

salt '*' keystone.service_create nova compute \
'OpenStack Compute Service'
    """
    kstone = auth(profile, **connection_args)
    service = kstone.services.create(name, service_type, description=description)
    return service_get(service.id, profile=profile, **connection_args)

def service_delete(service_id=None, name=None, profile=None, **connection_args):
    """
    Delete a service from Keystone service catalog

CLI Examples:

.. code-block:: bash

salt '*' keystone.service_delete c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.service_delete name=nova
    """
    kstone = auth(profile, **connection_args)
    if name:
        service_id = service_get(name=name, profile=profile, **connection_args)[name][
            "id"
        ]
    kstone.services.delete(service_id)
    return 'Keystone service ID "{}" deleted'.format(service_id)

def service_get(service_id=None, name=None, profile=None, **connection_args):
    """
    Return a specific services (keystone service-get)

CLI Examples:

.. code-block:: bash

salt '*' keystone.service_get c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.service_get service_id=c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.service_get name=nova
    """
    kstone = auth(profile, **connection_args)
    ret = {}
    if name:
        for service in kstone.services.list():
            if service.name == name:
                service_id = service.id
                break
    if not service_id:
        return {"Error": "Unable to resolve service id"}
    service = kstone.services.get(service_id)
    ret[service.name] = {
        value: getattr(service, value)
        for value in dir(service)
        if not value.startswith("_")
        and isinstance(getattr(service, value), (str, dict, bool))
    }
    return ret

def service_list(profile=None, **connection_args):
    """
    Return a list of available services (keystone services-list)

CLI Example:

.. code-block:: bash

salt '*' keystone.service_list
    """
    kstone = auth(profile, **connection_args)
    ret = {}
    for service in kstone.services.list():
        ret[service.name] = {
            value: getattr(service, value)
            for value in dir(service)
            if not value.startswith("_")
            and isinstance(getattr(service, value), (str, dict, bool))
        }
    return ret

def tenant_create(
    name, description=None, enabled=True, profile=None, **connection_args
):
    """
    Create a keystone tenant

CLI Examples:

.. code-block:: bash

salt '*' keystone.tenant_create nova description='nova tenant'
        salt '*' keystone.tenant_create test enabled=False
    """
    kstone = auth(profile, **connection_args)
    new = getattr(kstone, _TENANTS, None).create(name, description, enabled)
    return tenant_get(new.id, profile=profile, **connection_args)

def project_create(
    name, domain, description=None, enabled=True, profile=None, **connection_args
):
    """
    Create a keystone project.
    Overrides keystone tenant_create form api V2. For keystone api V3.

.. versionadded:: 2016.11.0

name
        The project name, which must be unique within the owning domain.

domain
        The domain name.

description
        The project description.

enabled
        Enables or disables the project.

profile
        Configuration profile - if configuration for multiple openstack accounts required.

CLI Examples:

.. code-block:: bash

salt '*' keystone.project_create nova default description='Nova Compute Project'
        salt '*' keystone.project_create test default enabled=False
    """
    kstone = auth(profile, **connection_args)
    new = getattr(kstone, _TENANTS, None).create(
        name=name, domain=domain, description=description, enabled=enabled
    )
    return tenant_get(new.id, profile=profile, **connection_args)

def tenant_delete(tenant_id=None, name=None, profile=None, **connection_args):
    """
    Delete a tenant (keystone tenant-delete)

CLI Examples:

.. code-block:: bash

salt '*' keystone.tenant_delete c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.tenant_delete tenant_id=c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.tenant_delete name=demo
    """
    kstone = auth(profile, **connection_args)
    if name:
        for tenant in getattr(kstone, _TENANTS, None).list():
            if tenant.name == name:
                tenant_id = tenant.id
                break
    if not tenant_id:
        return {"Error": "Unable to resolve tenant id"}
    getattr(kstone, _TENANTS, None).delete(tenant_id)
    ret = "Tenant ID {} deleted".format(tenant_id)
    if name:

ret += " ({})".format(name)
    return ret

def project_delete(project_id=None, name=None, profile=None, **connection_args):
    """
    Delete a project (keystone project-delete).
    Overrides keystone tenant-delete form api V2. For keystone api V3 only.

.. versionadded:: 2016.11.0

project_id
        The project id.

name
        The project name.

profile
        Configuration profile - if configuration for multiple openstack accounts required.

CLI Examples:

.. code-block:: bash

salt '*' keystone.project_delete c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.project_delete project_id=c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.project_delete name=demo
    """
    auth(profile, **connection_args)

if _OS_IDENTITY_API_VERSION > 2:
        return tenant_delete(
            tenant_id=project_id, name=name, profile=None, **connection_args
        )
    else:
        return False

def tenant_get(tenant_id=None, name=None, profile=None, **connection_args):
    """
    Return a specific tenants (keystone tenant-get)

CLI Examples:

.. code-block:: bash

salt '*' keystone.tenant_get c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.tenant_get tenant_id=c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.tenant_get name=nova
    """
    kstone = auth(profile, **connection_args)
    ret = {}

if name:
        for tenant in getattr(kstone, _TENANTS, None).list():
            if tenant.name == name:
                tenant_id = tenant.id
                break
    if not tenant_id:
        return {"Error": "Unable to resolve tenant id"}
    tenant = getattr(kstone, _TENANTS, None).get(tenant_id)
    ret[tenant.name] = {
        value: getattr(tenant, value)
        for value in dir(tenant)
        if not value.startswith("_")
        and isinstance(getattr(tenant, value), (str, dict, bool))
    }
    return ret

def project_get(project_id=None, name=None, profile=None, **connection_args):
    """
    Return a specific projects (keystone project-get)
    Overrides keystone tenant-get form api V2.
    For keystone api V3 only.

.. versionadded:: 2016.11.0

project_id
        The project id.

name
        The project name.

profile
        Configuration profile - if configuration for multiple openstack accounts required.

CLI Examples:

.. code-block:: bash

salt '*' keystone.project_get c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.project_get project_id=c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.project_get name=nova
    """
    auth(profile, **connection_args)

if _OS_IDENTITY_API_VERSION > 2:
        return tenant_get(
            tenant_id=project_id, name=name, profile=None, **connection_args
        )
    else:
        return False

def tenant_list(profile=None, **connection_args):
    """
    Return a list of available tenants (keystone tenants-list)

CLI Example:

.. code-block:: bash

salt '*' keystone.tenant_list
    """
    kstone = auth(profile, **connection_args)
    ret = {}

for tenant in getattr(kstone, _TENANTS, None).list():
        ret[tenant.name] = {
            value: getattr(tenant, value)
            for value in dir(tenant)
            if not value.startswith("_")
            and isinstance(getattr(tenant, value), (str, dict, bool))
        }
    return ret

def project_list(profile=None, **connection_args):
    """
    Return a list of available projects (keystone projects-list).
    Overrides keystone tenants-list form api V2.
    For keystone api V3 only.

.. versionadded:: 2016.11.0

profile
        Configuration profile - if configuration for multiple openstack accounts required.

CLI Example:

.. code-block:: bash

salt '*' keystone.project_list
    """
    auth(profile, **connection_args)

if _OS_IDENTITY_API_VERSION > 2:
        return tenant_list(profile, **connection_args)
    else:
        return False

def tenant_update(
    tenant_id=None,
    name=None,
    description=None,
    enabled=None,
    profile=None,
    **connection_args
):
    """
    Update a tenant's information (keystone tenant-update)
    The following fields may be updated: name, description, enabled.
    Can only update name if targeting by ID

CLI Examples:

.. code-block:: bash

salt '*' keystone.tenant_update name=admin enabled=True
        salt '*' keystone.tenant_update c965f79c4f864eaaa9c3b41904e67082 name=admin email=admin@domain.com
    """
    kstone = auth(profile, **connection_args)

if not tenant_id:
        for tenant in getattr(kstone, _TENANTS, None).list():
            if tenant.name == name:
                tenant_id = tenant.id
                break
    if not tenant_id:
        return {"Error": "Unable to resolve tenant id"}

tenant = getattr(kstone, _TENANTS, None).get(tenant_id)
    if not name:
        name = tenant.name
    if not description:
        description = tenant.description
    if enabled is None:
        enabled = tenant.enabled
    updated = getattr(kstone, _TENANTS, None).update(
        tenant_id, name=name, description=description, enabled=enabled
    )

return {
        value: getattr(updated, value)
        for value in dir(updated)
        if not value.startswith("_")
        and isinstance(getattr(updated, value), (str, dict, bool))
    }

def project_update(
    project_id=None,
    name=None,
    description=None,
    enabled=None,
    profile=None,
    **connection_args
):
    """
    Update a tenant's information (keystone project-update)
    The following fields may be updated: name, description, enabled.
    Can only update name if targeting by ID

Overrides keystone tenant_update form api V2.
    For keystone api V3 only.

.. versionadded:: 2016.11.0

project_id
        The project id.

name
        The project name, which must be unique within the owning domain.

description
        The project description.

enabled
        Enables or disables the project.

profile
        Configuration profile - if configuration for multiple openstack accounts required.

CLI Examples:

.. code-block:: bash

salt '*' keystone.project_update name=admin enabled=True
        salt '*' keystone.project_update c965f79c4f864eaaa9c3b41904e67082 name=admin email=admin@domain.com
    """
    auth(profile, **connection_args)

if _OS_IDENTITY_API_VERSION > 2:
        return tenant_update(
            tenant_id=project_id,
            name=name,
            description=description,
            enabled=enabled,
            profile=profile,
            **connection_args
        )
    else:
        return False

def token_get(profile=None, **connection_args):
    """
    Return the configured tokens (keystone token-get)

CLI Example:

.. code-block:: bash

salt '*' keystone.token_get c965f79c4f864eaaa9c3b41904e67082
    """
    kstone = auth(profile, **connection_args)
    token = kstone.service_catalog.get_token()
    return {
        "id": token["id"],
        "expires": token["expires"],
        "user_id": token["user_id"],
        "tenant_id": token["tenant_id"],
    }

def user_list(profile=None, **connection_args):
    """
    Return a list of available users (keystone user-list)

CLI Example:

.. code-block:: bash

salt '*' keystone.user_list
    """
    kstone = auth(profile, **connection_args)
    ret = {}
    for user in kstone.users.list():
        ret[user.name] = {
            value: getattr(user, value, None)
            for value in dir(user)
            if not value.startswith("_")
            and isinstance(getattr(user, value, None), (str, dict, bool))
        }
        tenant_id = getattr(user, "tenantId", None)
        if tenant_id:
            ret[user.name]["tenant_id"] = tenant_id
    return ret

def user_get(user_id=None, name=None, profile=None, **connection_args):
    """
    Return a specific users (keystone user-get)

CLI Examples:

.. code-block:: bash

salt '*' keystone.user_get c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.user_get user_id=c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.user_get name=nova
    """
    kstone = auth(profile, **connection_args)
    ret = {}
    if name:
        for user in kstone.users.list():
            if user.name == name:
                user_id = user.id
                break
    if not user_id:
        return {"Error": "Unable to resolve user id"}
    try:
        user = kstone.users.get(user_id)
    except keystoneclient.exceptions.NotFound:
        msg = "Could not find user '{}'".format(user_id)
        log.error(msg)
        return {"Error": msg}

ret[user.name] = {
        value: getattr(user, value, None)
        for value in dir(user)
        if not value.startswith("_")
        and isinstance(getattr(user, value, None), (str, dict, bool))
    }

tenant_id = getattr(user, "tenantId", None)
    if tenant_id:
        ret[user.name]["tenant_id"] = tenant_id
    return ret

def user_create(
    name,
    password,
    email,
    tenant_id=None,
    enabled=True,
    profile=None,
    project_id=None,
    description=None,
    **connection_args
):
    """
    Create a user (keystone user-create)

CLI Examples:

.. code-block:: bash

salt '*' keystone.user_create name=jack password=zero email=jack@halloweentown.org \
        tenant_id=a28a7b5a999a455f84b1f5210264375e enabled=True
    """
    kstone = auth(profile, **connection_args)

if _OS_IDENTITY_API_VERSION > 2:
        if tenant_id and not project_id:
            project_id = tenant_id
        item = kstone.users.create(
            name=name,
            password=password,
            email=email,
            project_id=project_id,
            enabled=enabled,
            description=description,
        )
    else:
        item = kstone.users.create(
            name=name,
            password=password,
            email=email,
            tenant_id=tenant_id,
            enabled=enabled,
        )
    return user_get(item.id, profile=profile, **connection_args)

def user_delete(user_id=None, name=None, profile=None, **connection_args):
    """
    Delete a user (keystone user-delete)

CLI Examples:

.. code-block:: bash

salt '*' keystone.user_delete c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.user_delete user_id=c965f79c4f864eaaa9c3b41904e67082
        salt '*' keystone.user_delete name=nova
    """
    kstone = auth(profile, **connection_args)
    if name:
        for user in kstone.users.list():
            if user.name == name:
                user_id = user.id
                break
    if not user_id:
        return {"Error": "Unable to resolve user id"}
    kstone.users.delete(user_id)
    ret = "User ID {} deleted".format(user_id)
    if name:

ret += " ({})".format(name)
    return ret

def user_update(
    user_id=None,
    name=None,
    email=None,
    enabled=None,
    tenant=None,
    profile=None,
    project=None,
    description=None,
    **connection_args
):
    """
    Update a user's information (keystone user-update)
    The following fields may be updated: name, email, enabled, tenant.
    Because the name is one of the fields, a valid user id is required.

CLI Examples:

.. code-block:: bash

salt '*' keystone.user_update user_id=c965f79c4f864eaaa9c3b41904e67082 name=newname
        salt '*' keystone.user_update c965f79c4f864eaaa9c3b41904e67082 name=newname email=newemail@domain.com
    """
    kstone = auth(profile, **connection_args)
    if not user_id:
        for user in kstone.users.list():
            if user.name == name:
                user_id = user.id
                break
        if not user_id:
            return {"Error": "Unable to resolve user id"}
    user = kstone.users.get(user_id)
    # Keep previous settings if not updating them
    if not name:
        name = user.name
    if not email:
        email = user.email
    if enabled is None:
        enabled = user.enabled

if _OS_IDENTITY_API_VERSION > 2:
        if description is None:
            description = getattr(user, "description", None)
        else:
            description = str(description)

project_id = None
        if project:
            for proj in kstone.projects.list():
                if proj.name == project:
                    project_id = proj.id
                    break
        if not project_id:
            project_id = getattr(user, "project_id", None)

kstone.users.update(
            user=user_id,
            name=name,
            email=email,
            enabled=enabled,
            description=description,
            project_id=project_id,
        )
    else:
        kstone.users.update(user=user_id, name=name, email=email, enabled=enabled)

tenant_id = None
        if tenant:
            for tnt in kstone.tenants.list():
                if tnt.name == tenant:
                    tenant_id = tnt.id
                    break
            if tenant_id:
                kstone.users.update_tenant(user_id, tenant_id)

ret = "Info updated for user ID {}".format(user_id)
    return ret

def user_verify_password(
    user_id=None, name=None, password=None, profile=None, **connection_args
):
    """
    Verify a user's password

CLI Examples:

.. code-block:: bash

salt '*' keystone.user_verify_password name=test password=foobar
        salt '*' keystone.user_verify_password user_id=c965f79c4f864eaaa9c3b41904e67082 password=foobar
    """
    kstone = auth(profile, **connection_args)
    if "connection_endpoint" in connection_args:
        auth_url = connection_args.get("connection_endpoint")
    else:
        if _OS_IDENTITY_API_VERSION > 2:
            auth_url = __salt__["config.option"](
                "keystone.endpoint", "http://127.0.0.1:35357/v3"
            )
        else:
            auth_url = __salt__["config.option"](
                "keystone.endpoint", "http://127.0.0.1:35357/v2.0"
            )

if user_id:
        for user in kstone.users.list():
            if user.id == user_id:
                name = user.name
                break
    if not name:
        return {"Error": "Unable to resolve user name"}
    kwargs = {"username": name, "password": password, "auth_url": auth_url}
    try:
        if _OS_IDENTITY_API_VERSION > 2:
            client3.Client(**kwargs)
        else:
            client.Client(**kwargs)
    except (
        keystoneclient.exceptions.Unauthorized,
        keystoneclient.exceptions.AuthorizationFailure,
    ):
        return False
    return True

def user_password_update(
    user_id=None, name=None, password=None, profile=None, **connection_args
):
    """
    Update a user's password (keystone user-password-update)

CLI Examples:

.. code-block:: bash

salt '*' keystone.user_password_update c965f79c4f864eaaa9c3b41904e67082 password=12345
        salt '*' keystone.user_password_update user_id=c965f79c4f864eaaa9c3b41904e67082 password=12345
        salt '*' keystone.user_password_update name=nova password=12345
    """
    kstone = auth(profile, **connection_args)
    if name:
        for user in kstone.users.list():
            if user.name == name:
                user_id = user.id
                break
    if not user_id:
        return {"Error": "Unable to resolve user id"}

if _OS_IDENTITY_API_VERSION > 2:
        kstone.users.update(user=user_id, password=password)
    else:
        kstone.users.update_password(user=user_id, password=password)
    ret = "Password updated for user ID {}".format(user_id)
    if name:
        ret += " ({})".format(name)
    return ret

def user_role_add(
    user_id=None,
    user=None,
    tenant_id=None,
    tenant=None,
    role_id=None,
    role=None,
    profile=None,
    project_id=None,
    project_name=None,
    **connection_args
):
    """
    Add role for user in tenant (keystone user-role-add)

CLI Examples:

.. code-block:: bash

salt '*' keystone.user_role_add \
user_id=298ce377245c4ec9b70e1c639c89e654 \
tenant_id=7167a092ece84bae8cead4bf9d15bb3b \
role_id=ce377245c4ec9b70e1c639c89e8cead4
        salt '*' keystone.user_role_add user=admin tenant=admin role=admin
    """
    kstone = auth(profile, **connection_args)

if project_id and not tenant_id:
        tenant_id = project_id
    elif project_name and not tenant:
        tenant = project_name

if user:
        user_id = user_get(name=user, profile=profile, **connection_args)[user].get(
            "id"
        )
    else:
        user = next(iter(user_get(user_id, profile=profile, **connection_args).keys()))[
            "name"
        ]
    if not user_id:
        return {"Error": "Unable to resolve user id"}

if tenant:
        tenant_id = tenant_get(name=tenant, profile=profile, **connection_args)[
            tenant
        ].get("id")
    else:
        tenant = next(
            iter(tenant_get(tenant_id, profile=profile, **connection_args).keys())
        )["name"]
    if not tenant_id:
        return {"Error": "Unable to resolve tenant/project id"}

if role:
        role_id = role_get(name=role, profile=profile, **connection_args)[role]["id"]
    else:
        role = next(iter(role_get(role_id, profile=profile, **connection_args).keys()))[
            "name"
        ]
    if not role_id:
        return {"Error": "Unable to resolve role id"}

if _OS_IDENTITY_API_VERSION > 2:
        kstone.roles.grant(role_id, user=user_id, project=tenant_id)
    else:
        kstone.roles.add_user_role(user_id, role_id, tenant_id)
    ret_msg = '"{0}" role added for user "{1}" for "{2}" tenant/project'
    return ret_msg.format(role, user, tenant)

def user_role_remove(
    user_id=None,
    user=None,
    tenant_id=None,
    tenant=None,
    role_id=None,
    role=None,
    profile=None,
    project_id=None,
    project_name=None,
    **connection_args
):
    """
    Remove role for user in tenant (keystone user-role-remove)

CLI Examples:

.. code-block:: bash

salt '*' keystone.user_role_remove \
user_id=298ce377245c4ec9b70e1c639c89e654 \
tenant_id=7167a092ece84bae8cead4bf9d15bb3b \
role_id=ce377245c4ec9b70e1c639c89e8cead4
        salt '*' keystone.user_role_remove user=admin tenant=admin role=admin
    """
    kstone = auth(profile, **connection_args)

if project_id and not tenant_id:
        tenant_id = project_id
    elif project_name and not tenant:
        tenant = project_name

if role:
        role_id = role_get(name=role, profile=profile, **connection_args)[role]["id"]
    else:
        role = next(iter(role_get(role_id).keys()))["name"]
    if not role_id:
        return {"Error": "Unable to resolve role id"}

if _OS_IDENTITY_API_VERSION > 2:
        kstone.roles.revoke(role_id, user=user_id, project=tenant_id)
    else:
        kstone.roles.remove_user_role(user_id, role_id, tenant_id)
    ret_msg = '"{0}" role removed for user "{1}" under "{2}" tenant'
    return ret_msg.format(role, user, tenant)

def user_role_list(
    user_id=None,
    tenant_id=None,
    user_name=None,
    tenant_name=None,
    profile=None,
    project_id=None,
    project_name=None,
    **connection_args
):
    """
    Return a list of available user_roles (keystone user-roles-list)

CLI Examples:

.. code-block:: bash

salt '*' keystone.user_role_list \
user_id=298ce377245c4ec9b70e1c639c89e654 \
tenant_id=7167a092ece84bae8cead4bf9d15bb3b
        salt '*' keystone.user_role_list user_name=admin tenant_name=admin
    """
    kstone = auth(profile, **connection_args)
    ret = {}

if project_id and not tenant_id:
        tenant_id = project_id
    elif project_name and not tenant_name:
        tenant_name = project_name

if user_name:
        for user in kstone.users.list():
            if user.name == user_name:
                user_id = user.id
                break
    if tenant_name:
        for tenant in getattr(kstone, _TENANTS, None).list():
            if tenant.name == tenant_name:
                tenant_id = tenant.id
                break
    if not user_id or not tenant_id:
        return {"Error": "Unable to resolve user or tenant/project id"}

if _OS_IDENTITY_API_VERSION > 2:
        for role in kstone.roles.list(user=user_id, project=tenant_id):
            ret[role.name] = {
                value: getattr(role, value)
                for value in dir(role)
                if not value.startswith("_")
                and isinstance(getattr(role, value), (str, dict, bool))
            }
    else:
        for role in kstone.roles.roles_for_user(user=user_id, tenant=tenant_id):
            ret[role.name] = {
                "id": role.id,
                "name": role.name,
                "user_id": user_id,
                "tenant_id": tenant_id,
            }
    return ret

def _item_list(profile=None, **connection_args):
    """
    Template for writing list functions
    Return a list of available items (keystone items-list)

CLI Example:

.. code-block:: bash

salt '*' keystone.item_list
    """
    kstone = auth(profile, **connection_args)
    ret = []
    for item in kstone.items.list():
        ret.append(item.__dict__)
        # ret[item.name] = {
        #         'id': item.id,
        #         'name': item.name,
        #         }
    return ret

# The following is a list of functions that need to be incorporated in the
    # keystone module. This list should be updated as functions are added.
    #
    # endpoint-create     Create a new endpoint associated with a service
    # endpoint-delete     Delete a service endpoint
    # discover            Discover Keystone servers and show authentication
    #                     protocols and
    # bootstrap           Grants a new role to a new user on a new tenant, after
    #                     creating each.