func newCredentials(ecfg *environConfig) (identity.Credentials, identity.AuthMode) {
cred := identity.Credentials{
User: ecfg.username(),
Secrets: ecfg.password(),
Region: ecfg.region(),
TenantName: ecfg.tenantName(),
URL: ecfg.authURL(),
DomainName: ecfg.domainName(),
}
// authModeCfg has already been validated so we know it's one of the values below.
var authMode identity.AuthMode
switch AuthMode(ecfg.authMode()) {
case AuthLegacy:
authMode = identity.AuthLegacy
case AuthUserPass:
authMode = identity.AuthUserPass
if cred.DomainName != "" {
authMode = identity.AuthUserPassV3
}
case AuthKeyPair:
authMode = identity.AuthKeyPair
cred.User = ecfg.accessKey()
cred.Secrets = ecfg.secretKey()
}
return cred, authMode
}
func newCredentials(spec environs.CloudSpec) (identity.Credentials, identity.AuthMode) {
credAttrs := spec.Credential.Attributes()
cred := identity.Credentials{
Region: spec.Region,
URL: spec.Endpoint,
TenantName: credAttrs[CredAttrTenantName],
}
// AuthType is validated when the environment is opened, so it's known
// to be one of these values.
var authMode identity.AuthMode
switch spec.Credential.AuthType() {
case cloud.UserPassAuthType:
// TODO(axw) we need a way of saying to use legacy auth.
cred.User = credAttrs[CredAttrUserName]
cred.Secrets = credAttrs[CredAttrPassword]
cred.DomainName = credAttrs[CredAttrDomainName]
authMode = identity.AuthUserPass
if cred.DomainName != "" {
authMode = identity.AuthUserPassV3
}
case cloud.AccessKeyAuthType:
cred.User = credAttrs[CredAttrAccessKey]
cred.Secrets = credAttrs[CredAttrSecretKey]
authMode = identity.AuthKeyPair
}
return cred, authMode
}
func determineBestClient(
options identity.AuthOptions,
client client.AuthenticatingClient,
cred identity.Credentials,
newClient func(*identity.Credentials, identity.AuthMode, *log.Logger) client.AuthenticatingClient,
) client.AuthenticatingClient {
for _, option := range options {
if option.Mode != identity.AuthUserPassV3 {
continue
}
cred.URL = option.Endpoint
v3client := newClient(&cred, identity.AuthUserPassV3, nil)
// V3 being advertised is not necessaritly a guarantee that it will
// work.
err := v3client.Authenticate()
if err == nil {
return v3client
}
}
return client
}