Authentication

Signing in, for the web console and for portals that embed it. A user name and password, or a token the caller already holds, is exchanged for a Keystone token scoped to one project or to the whole cloud. A portal that already holds a user's token can instead mint a one-time code that a browser redeems to be signed in without a password. Every other group takes the token these operations return, in X-Auth-Token.

📄️ Create a one-time sign-in code

For a portal that holds the user's token. The code carries the caller's own session and nothing more. A browser redeems it once to be signed in without a password. It expires after a minute.

📄️ Redeem a one-time sign-in code

Answers the session the code carries. A code works once. A used or expired code is refused the same way. Attempts are rate limited.

📄️ List the projects a token can be scoped to

Answers `projects`, each with its id, name, domain and whether it is enabled. An unscoped token works.

📄️ Show the caller's session

Who the token belongs to, its project, roles and expiry, and whether it may use the operator calls.

📄️ Sign in

Exchanges a user name and password for a token. Naming no project gives an unscoped token, answered with the projects it can be scoped to and whether it can be scoped to the whole cloud. Attempts are rate limited.

📄️ Scope a session

Exchanges the caller's token, scoped or not, for one scoped to `project_id`. With `system`, the new token is scoped to the whole cloud instead, which operator calls need. Attempts are rate limited.