def handle_get_token(self, req):
<EOL>try:<EOL><INDENT>pathsegs = split_path(req.path_info, minsegs=<NUM_LIT:1>, maxsegs=<NUM_LIT:3>,<EOL>rest_with_last=True)<EOL><DEDENT>except ValueError:<EOL><INDENT>return HTTPNotFound(request=req)<EOL><DEDENT>if pathsegs[<NUM_LIT:0>] == '<STR_LIT>' and pathsegs[<NUM_LIT:2>] == '<STR_LIT>':<EOL><INDENT>account = pathsegs[<NUM_LIT:1>]<EOL>user = req.headers.get('<STR_LIT>')<EOL>if not user:<EOL><INDENT>user = unquote(req.headers.get('<STR_LIT>', '<STR_LIT>'))<EOL>if not user or '<STR_LIT::>' not in user:<EOL><INDENT>return HTTPUnauthorized(request=req)<EOL><DEDENT>account2, user = user.split('<STR_LIT::>', <NUM_LIT:1>)<EOL>if account != account2:<EOL><INDENT>return HTTPUnauthorized(request=req)<EOL><DEDENT><DEDENT>key = req.headers.get('<STR_LIT>')<EOL>if not key:<EOL><INDENT>key = unquote(req.headers.get('<STR_LIT>', '<STR_LIT>'))<EOL><DEDENT><DEDENT>elif pathsegs[<NUM_LIT:0>] in ('<STR_LIT>', '<STR_LIT>'):<EOL><INDENT>user = unquote(req.headers.get('<STR_LIT>', '<STR_LIT>'))<EOL>if not user:<EOL><INDENT>user = req.headers.get('<STR_LIT>')<EOL><DEDENT>if not user or '<STR_LIT::>' not in user:<EOL><INDENT>return HTTPUnauthorized(request=req)<EOL><DEDENT>account, user = user.split('<STR_LIT::>', <NUM_LIT:1>)<EOL>key = unquote(req.headers.get('<STR_LIT>', '<STR_LIT>'))<EOL>if not key:<EOL><INDENT>key = req.headers.get('<STR_LIT>')<EOL><DEDENT><DEDENT>else:<EOL><INDENT>return HTTPBadRequest(request=req)<EOL><DEDENT>if not all((account, user, key)):<EOL><INDENT>return HTTPUnauthorized(request=req)<EOL><DEDENT>if user == '<STR_LIT>' and self.super_admin_key andkey == self.super_admin_key:<EOL><INDENT>token = self.get_itoken(req.environ)<EOL>url = '<STR_LIT>' % (self.dsc_url, self.reseller_prefix)<EOL>return Response(<EOL>request=req,<EOL>content_type=CONTENT_TYPE_JSON,<EOL>body=json.dumps({'<STR_LIT>': {'<STR_LIT:default>': '<STR_LIT>',<EOL>'<STR_LIT>': url}}),<EOL>headers={'<STR_LIT>': token,<EOL>'<STR_LIT>': token,<EOL>'<STR_LIT>': url})<EOL><DEDENT>path = quote('<STR_LIT>' % (self.auth_account, account, user))<EOL>resp = self.make_pre_authed_request(<EOL>req.environ, '<STR_LIT:GET>', path).get_response(self.app)<EOL>if resp.status_int == <NUM_LIT>:<EOL><INDENT>return HTTPUnauthorized(request=req)<EOL><DEDENT>if resp.status_int // <NUM_LIT:100> != <NUM_LIT:2>:<EOL><INDENT>raise Exception('<STR_LIT>' %<EOL>(path, resp.status))<EOL><DEDENT>user_detail = json.loads(resp.body)<EOL>if not self.credentials_match(user_detail, key):<EOL><INDENT>return HTTPUnauthorized(request=req)<EOL><DEDENT>token = None<EOL>expires = None<EOL>candidate_token = resp.headers.get('<STR_LIT>')<EOL>if candidate_token:<EOL><INDENT>object_name = self._get_concealed_token(candidate_token)<EOL>path = quote('<STR_LIT>' %<EOL>(self.auth_account, object_name[-<NUM_LIT:1>], object_name))<EOL>delete_token = False<EOL>try:<EOL><INDENT>if req.headers.get('<STR_LIT>', '<STR_LIT:false>').lower() inTRUE_VALUES:<EOL><INDENT>delete_token = True<EOL><DEDENT>else:<EOL><INDENT>resp = self.make_pre_authed_request(<EOL>req.environ, '<STR_LIT:GET>', path).get_response(self.app)<EOL>if resp.status_int // <NUM_LIT:100> == <NUM_LIT:2>:<EOL><INDENT>token_detail = json.loads(resp.body)<EOL>if token_detail['<STR_LIT>'] > time():<EOL><INDENT>token = candidate_token<EOL>expires = token_detail['<STR_LIT>']<EOL><DEDENT>else:<EOL><INDENT>delete_token = True<EOL><DEDENT><DEDENT>elif resp.status_int != <NUM_LIT>:<EOL><INDENT>raise Exception(<EOL>'<STR_LIT>'<EOL>'<STR_LIT>' % (path, resp.status))<EOL><DEDENT><DEDENT><DEDENT>finally:<EOL><INDENT>if delete_token:<EOL><INDENT>self.make_pre_authed_request(<EOL>req.environ, '<STR_LIT>', path).get_response(self.app)<EOL>memcache_client = cache_from_env(req.environ)<EOL>if memcache_client:<EOL><INDENT>memcache_key = '<STR_LIT>' % (self.reseller_prefix,<EOL>candidate_token)<EOL>memcache_client.delete(memcache_key)<EOL><DEDENT><DEDENT><DEDENT><DEDENT>if not token:<EOL><INDENT>path = quote('<STR_LIT>' % (self.auth_account, account))<EOL>resp = self.make_pre_authed_request(<EOL>req.environ, '<STR_LIT>', path).get_response(self.app)<EOL>if resp.status_int // <NUM_LIT:100> != <NUM_LIT:2>:<EOL><INDENT>raise Exception('<STR_LIT>'<EOL>'<STR_LIT>' % (path, resp.status))<EOL><DEDENT>account_id =resp.headers['<STR_LIT>']<EOL>token = '<STR_LIT>' % (self.reseller_prefix, uuid4().hex)<EOL>object_name = self._get_concealed_token(token)<EOL>path = quote('<STR_LIT>' %<EOL>(self.auth_account, object_name[-<NUM_LIT:1>], object_name))<EOL>try:<EOL><INDENT>token_life = min(<EOL>int(req.headers.get('<STR_LIT>',<EOL>self.token_life)),<EOL>self.max_token_life)<EOL><DEDENT>except ValueError:<EOL><INDENT>token_life = self.token_life<EOL><DEDENT>expires = int(time() + token_life)<EOL>resp = self.make_pre_authed_request(<EOL>req.environ, '<STR_LIT>', path,<EOL>json.dumps({'<STR_LIT>': account, '<STR_LIT:user>': user,<EOL>'<STR_LIT>': account_id,<EOL>'<STR_LIT>': user_detail['<STR_LIT>'],<EOL>'<STR_LIT>': expires})).get_response(self.app)<EOL>if resp.status_int // <NUM_LIT:100> != <NUM_LIT:2>:<EOL><INDENT>raise Exception('<STR_LIT>' %<EOL>(path, resp.status))<EOL><DEDENT>path = quote('<STR_LIT>' % (self.auth_account, account, user))<EOL>resp = self.make_pre_authed_request(<EOL>req.environ, '<STR_LIT:POST>', path,<EOL>headers={'<STR_LIT>': token}<EOL>).get_response(self.app)<EOL>if resp.status_int // <NUM_LIT:100> != <NUM_LIT:2>:<EOL><INDENT>raise Exception('<STR_LIT>' %<EOL>(path, resp.status))<EOL><DEDENT><DEDENT>path = quote('<STR_LIT>' % (self.auth_account, account))<EOL>resp = self.make_pre_authed_request(<EOL>req.environ, '<STR_LIT:GET>', path).get_response(self.app)<EOL>if resp.status_int // <NUM_LIT:100> != <NUM_LIT:2>:<EOL><INDENT>raise Exception('<STR_LIT>' %<EOL>(path, resp.status))<EOL><DEDENT>detail = json.loads(resp.body)<EOL>url = detail['<STR_LIT>'][detail['<STR_LIT>']['<STR_LIT:default>']]<EOL>return Response(<EOL>request=req,<EOL>body=resp.body,<EOL>content_type=CONTENT_TYPE_JSON,<EOL>headers={'<STR_LIT>': token,<EOL>'<STR_LIT>': token,<EOL>'<STR_LIT>': str(int(expires - time())),<EOL>'<STR_LIT>': url})<EOL>
Handles the various `request for token and service end point(s)` calls.
        There are various formats to support the various auth servers in the
        past. Examples::

            GET <auth-prefix>/v1/<act>/auth
                X-Auth-User: <act>:<usr>  or  X-Storage-User: <usr>
                X-Auth-Key: <key>         or  X-Storage-Pass: <key>
            GET <auth-prefix>/auth
                X-Auth-User: <act>:<usr>  or  X-Storage-User: <act>:<usr>
                X-Auth-Key: <key>         or  X-Storage-Pass: <key>
            GET <auth-prefix>/v1.0
                X-Auth-User: <act>:<usr>  or  X-Storage-User: <act>:<usr>
                X-Auth-Key: <key>         or  X-Storage-Pass: <key>

        Values should be url encoded, "act%3Ausr" instead of "act:usr" for
        example; however, for backwards compatibility the colon may be included
        unencoded.

        On successful authentication, the response will have X-Auth-Token and
        X-Storage-Token set to the token to use with Swift and X-Storage-URL
        set to the URL to the default Swift cluster to use.

        The response body will be set to the account's services JSON object as
        described here::

            {"storage": {     # Represents the Swift storage service end points
                "default": "cluster1", # Indicates which cluster is the default
                "cluster1": "<URL to use with Swift>",
                    # A Swift cluster that can be used with this account,
                    # "cluster1" is the name of the cluster which is usually a
                    # location indicator (like "dfw" for a datacenter region).
                "cluster2": "<URL to use with Swift>"
                    # Another Swift cluster that can be used with this account,
                    # there will always be at least one Swift cluster to use or
                    # this whole "storage" dict won't be included at all.
             },
             "servers": {       # Represents the Nova server service end points
                # Expected to be similar to the "storage" dict, but not
                # implemented yet.
             },
             # Possibly other service dicts, not implemented yet.
            }

        One can also include an "X-Auth-New-Token: true" header to
        force issuing a new token and revoking any old token, even if
        it hasn't expired yet.

        :param req: The swob.Request to process.
        :returns: swob.Response, 2xx on success with data set as explained
                  above.