{"id":4727,"library":"python-keystoneclient","title":"OpenStack Keystone Client Library","description":"python-keystoneclient is the official Python binding to the OpenStack Identity API (Keystone). It provides a Python API for interacting with the Keystone service to manage authentication, authorization, and service catalog discovery within an OpenStack environment. The current version is 5.8.0, and its release cadence is tied to the broader OpenStack development cycle.","status":"active","version":"5.8.0","language":"en","source_language":"en","source_url":"https://github.com/openstack/python-keystoneclient","tags":["openstack","keystone","identity","authentication","authorization","cloud"],"install":[{"cmd":"pip install python-keystoneclient","lang":"bash","label":"Install latest version"}],"dependencies":[{"reason":"Provides authentication plugins and session management, which python-keystoneclient leverages.","package":"keystoneauth1"}],"imports":[{"symbol":"v3.Password","correct":"from keystoneauth1.identity import v3"},{"symbol":"session.Session","correct":"from keystoneauth1 import session"},{"symbol":"client.Client","correct":"from keystoneclient.v3 import client"},{"note":"The keystoneclient.apiclient.exceptions module was removed in version 2.1.0; exceptions are now mapped to keystoneauth1.exceptions.","wrong":"from keystoneclient.apiclient import exceptions","symbol":"keystoneclient.exceptions.ClientException","correct":"from keystoneclient import exceptions"}],"quickstart":{"code":"import os\nfrom keystoneauth1.identity import v3\nfrom keystoneauth1 import session\nfrom keystoneclient.v3 import client\n\n# Environment variables for authentication (recommended practice)\nAUTH_URL = os.environ.get('OS_AUTH_URL', 'http://localhost:5000/v3')\nUSERNAME = os.environ.get('OS_USERNAME', 'admin')\nPASSWORD = os.environ.get('OS_PASSWORD', 'password')\nPROJECT_NAME = os.environ.get('OS_PROJECT_NAME', 'admin')\nUSER_DOMAIN_ID = os.environ.get('OS_USER_DOMAIN_ID', 'default')\nPROJECT_DOMAIN_ID = os.environ.get('OS_PROJECT_DOMAIN_ID', 'default')\n\n# 1. Authenticate using a session (V3 API example)\nauth = v3.Password(\n    auth_url=AUTH_URL,\n    username=USERNAME,\n    password=PASSWORD,\n    project_name=PROJECT_NAME,\n    user_domain_id=USER_DOMAIN_ID,\n    project_domain_id=PROJECT_DOMAIN_ID\n)\nsess = session.Session(auth=auth)\n\n# 2. Initialize the Keystone client\nkeystone = client.Client(session=sess)\n\n# 3. Perform an operation (e.g., list projects)\ntry:\n    projects = keystone.projects.list()\n    print(f\"Successfully connected to Keystone. Found {len(projects)} projects.\")\n    for project in projects:\n        print(f\"  - {project.name} (ID: {project.id})\")\nexcept exceptions.ClientException as e:\n    print(f\"Error connecting to Keystone: {e}\")\nexcept Exception as e:\n    print(f\"An unexpected error occurred: {e}\")","lang":"python","description":"This quickstart demonstrates how to authenticate with OpenStack Keystone using the V3 API and session-based authentication, then lists available projects. It leverages environment variables for credentials, which is a common and secure practice in OpenStack environments."},"warnings":[{"fix":"Migrate CLI operations to `python-openstackclient`. Install it via `pip install python-openstackclient` and use `openstack <service> <command>` instead (e.g., `openstack user list`).","message":"The `keystone` command-line interface (CLI) is deprecated in favor of the `openstack` CLI provided by `python-openstackclient`.","severity":"deprecated","affected_versions":"All versions since OpenStack Kilo (approx. 2015) onwards."},{"fix":"Always use `keystoneauth1.session.Session` with an authentication plugin (e.g., `keystoneauth1.identity.v3.Password`) and pass the session to the `keystoneclient.Client` constructor. This provides more robust and flexible authentication.","message":"Non-session based authentication (passing username, password directly to `keystoneclient.Client` without a `keystoneauth1.session.Session` object) is deprecated.","severity":"deprecated","affected_versions":"All versions since at least 5.x. Earlier versions also recommended session-based auth."},{"fix":"Ensure you are using authentication plugins directly from the `keystoneauth1.identity` module, not `keystoneclient.auth.identity`.","message":"`keystoneclient` authentication plugins are deprecated in favor of `keystoneauth1` plugins.","severity":"deprecated","affected_versions":"Since version 2.1.0."},{"fix":"Update import statements to use `from keystoneclient import exceptions` and refer to the appropriate exception classes (which are aliases to `keystoneauth1` exceptions).","message":"The exception classes previously found under `keystoneclient.apiclient.exceptions` were removed and mapped to `keystoneauth1.exceptions`. Direct imports from `keystoneclient.apiclient.exceptions` will fail.","severity":"breaking","affected_versions":"2.1.0 and later."},{"fix":"Provide explicit hidden imports and copy metadata for `keystoneclient`, `keystoneauth1`, and `os_service_types` in your PyInstaller `.spec` file. Example additions to `hiddenimports` and `added_files` can be found in Stack Overflow solutions.","message":"When bundling applications with PyInstaller, `python-keystoneclient` (and its dependency `keystoneauth1`) may encounter `PackageNotFoundError` or issues related to `pbr` versioning.","severity":"gotcha","affected_versions":"All versions."}],"env_vars":null,"last_verified":"2026-04-12T00:00:00.000Z","next_check":"2026-07-11T00:00:00.000Z"}