# Path: castellan/common/exception.py
# _FATAL_EXCEPTION_FORMAT_ERRORS = False
# class RedirectException(Exception):
# class CastellanException(Exception):
# class Forbidden(CastellanException):
# class KeyManagerError(CastellanException):
# class ManagedObjectNotFoundError(CastellanException):
# class InvalidManagedObjectDictError(CastellanException):
# class UnknownManagedObjectTypeError(CastellanException):
# class AuthTypeInvalidError(CastellanException):
# class InsufficientCredentialDataError(CastellanException):
#     def __init__(self, url):
#     def __init__(self, message_arg=None, *args, **kwargs):
# 
# Path: castellan/common/objects/key.py
# class Key(managed_object.ManagedObject):
#     def algorithm(self):
#     def bit_length(self):
#     def to_dict(self):
#     def from_dict(cls, dict_fields, id=None, metadata_only=False):
# 
# Path: castellan/common/objects/opaque_data.py
# class OpaqueData(managed_object.ManagedObject):
#     def __init__(self, data, name=None, created=None, id=None):
#     def managed_type(cls):
#     def format(self):
#     def get_encoded(self):
#     def __eq__(self, other):
#     def __ne__(self, other):
# 
# Path: castellan/i18n.py

# 
# Path: castellan/key_manager/key_manager.py
# class KeyManager(object, metaclass=abc.ABCMeta):
#     def __init__(self, configuration):
#     def create_key(self, context, algorithm, length,
#                    expiration=None, name=None):
#     def create_key_pair(self, context, algorithm, length,
#                         expiration=None, name=None):
#     def store(self, context, managed_object, expiration=None):
#     def get(self, context, managed_object_id, metadata_only=False):
#     def delete(self, context, managed_object_id):
#     def list(self, context, object_type=None, metadata_only=False):
#     def list_options_for_discovery(self):


import calendar
import time
import urllib
from cryptography.hazmat import backends
from cryptography.hazmat.primitives import serialization
from cryptography import x509 as cryptography_x509
from keystoneauth1 import identity
from keystoneauth1 import loading
from keystoneauth1 import service_token
from keystoneauth1 import session
from oslo_config import cfg
from oslo_log import log as logging
from oslo_utils import excutils
from castellan.common import exception
from castellan.common.objects import key as key_base_class
from castellan.common.objects import opaque_data as op_data
from castellan.i18n import _
from castellan.key_manager import key_manager
from barbicanclient import client as barbican_client_import
from barbicanclient import exceptions as barbican_exceptions
from oslo_utils import timeutils
    cfg.IntOpt('number_of_retries',
               default=60,
               help='Number of times to retry poll for key creation '
                    'completion'),
    cfg.BoolOpt('verify_ssl',
                default=True,
                help='Specifies if insecure TLS (https) requests. If False, '
                     'the server\'s certificate will not be validated, if '
                     'True, we can set the verify_ssl_path config meanwhile.'),
    cfg.StrOpt('verify_ssl_path',
               default=None,
               help='A path to a bundle or CA certs to check against, or '
                    'None for requests to attempt to locate and use '
                    'certificates which verify_ssh is True. If verify_ssl '
                    'is False, this is ignored.'),
    cfg.StrOpt('barbican_endpoint_type',
               default='public',
               choices=['public', 'internal', 'admin'],
               help='Specifies the type of endpoint.  Allowed values are: '
                    'public, private, and admin'),
    cfg.StrOpt('barbican_region_name',
               default=None,
               help='Specifies the region of the chosen endpoint.'),
    cfg.BoolOpt('send_service_user_token',
                default=False,
                help="""
When True, if sending a user token to a REST API, also send a service token.

Nova often reuses the user token provided to the nova-api to talk to other REST
APIs, such as Cinder, Glance and Neutron. It is possible that while the user

# Path: castellan/common/exception.py
# _FATAL_EXCEPTION_FORMAT_ERRORS = False
# class RedirectException(Exception):
# class CastellanException(Exception):
# class Forbidden(CastellanException):
# class KeyManagerError(CastellanException):
# class ManagedObjectNotFoundError(CastellanException):
# class InvalidManagedObjectDictError(CastellanException):
# class UnknownManagedObjectTypeError(CastellanException):
# class AuthTypeInvalidError(CastellanException):
# class InsufficientCredentialDataError(CastellanException):
#     def __init__(self, url):
#     def __init__(self, message_arg=None, *args, **kwargs):
# 
# Path: castellan/common/objects/key.py
# class Key(managed_object.ManagedObject):
#     def algorithm(self):
#     def bit_length(self):
#     def to_dict(self):
#     def from_dict(cls, dict_fields, id=None, metadata_only=False):
# 
# Path: castellan/common/objects/opaque_data.py
# class OpaqueData(managed_object.ManagedObject):
#     def __init__(self, data, name=None, created=None, id=None):
#     def managed_type(cls):
#     def format(self):
#     def get_encoded(self):
#     def __eq__(self, other):
#     def __ne__(self, other):
# 
# Path: castellan/i18n.py

# 
# Path: castellan/key_manager/key_manager.py
# class KeyManager(object, metaclass=abc.ABCMeta):
#     def __init__(self, configuration):
#     def create_key(self, context, algorithm, length,
#                    expiration=None, name=None):
#     def create_key_pair(self, context, algorithm, length,
#                         expiration=None, name=None):
#     def store(self, context, managed_object, expiration=None):
#     def get(self, context, managed_object_id, metadata_only=False):
#     def delete(self, context, managed_object_id):
#     def list(self, context, object_type=None, metadata_only=False):
#     def list_options_for_discovery(self):


# Path: castellan/key_manager/barbican_key_manager.py
import calendar
import time
import urllib
from cryptography.hazmat import backends
from cryptography.hazmat.primitives import serialization
from cryptography import x509 as cryptography_x509
from keystoneauth1 import identity
from keystoneauth1 import loading
from keystoneauth1 import service_token
from keystoneauth1 import session
from oslo_config import cfg
from oslo_log import log as logging
from oslo_utils import excutils
from castellan.common import exception
from castellan.common.objects import key as key_base_class
from castellan.common.objects import opaque_data as op_data
from castellan.i18n import _
from castellan.key_manager import key_manager
from barbicanclient import client as barbican_client_import
from barbicanclient import exceptions as barbican_exceptions
from oslo_utils import timeutils

    cfg.IntOpt('number_of_retries',
               default=60,
               help='Number of times to retry poll for key creation '
                    'completion'),
    cfg.BoolOpt('verify_ssl',
                default=True,
                help='Specifies if insecure TLS (https) requests. If False, '
                     'the server\'s certificate will not be validated, if '
                     'True, we can set the verify_ssl_path config meanwhile.'),
    cfg.StrOpt('verify_ssl_path',
               default=None,
               help='A path to a bundle or CA certs to check against, or '
                    'None for requests to attempt to locate and use '
                    'certificates which verify_ssh is True. If verify_ssl '
                    'is False, this is ignored.'),
    cfg.StrOpt('barbican_endpoint_type',
               default='public',
               choices=['public', 'internal', 'admin'],
               help='Specifies the type of endpoint.  Allowed values are: '
                    'public, private, and admin'),
    cfg.StrOpt('barbican_region_name',
               default=None,
               help='Specifies the region of the chosen endpoint.'),
    cfg.BoolOpt('send_service_user_token',
                default=False,
                help="""
When True, if sending a user token to a REST API, also send a service token.

Nova often reuses the user token provided to the nova-api to talk to other REST
APIs, such as Cinder, Glance and Neutron. It is possible that while the user

token was valid when the request was made to Nova, the token may expire before