背景

         当前在华为云中，允许别的服务访问对象存储或者别的租户访问自己的桶内数据都可以通过委托的形式进行，那么在委托创建好之后，在程序中进行使用时候这部分操作还是有点麻烦，在这儿就系统性整理下，方便使用时候参考。

创建委托参考可以参考 https://bbs.huaweicloud.com/blogs/0a7a412ae32e11e8bd5a7ca23e93a891 中所描述

代码实现

为方便理解，将整个交互过程以简单流程图方式展示出来。

实际代码实现，不包含如何利用临时AK SK STS-Token和OBS交互部分（此部分在SDK中可以正常看到）

#!/usr/bin/python
# -*- coding:utf-8 -*-
import json
import requests
import pandas as pd
import moxing as mox
# 当需要获取子用户的token时填写子用户的用户名和密码，当获取委托的token时填写被委托租户的账户名和密码
userName = 'hw*****_devopsaccount'
userPasswd = ‘pass*****wd'
domainName = 'hw******_eimls'
agencyCreateUser = 'dea0f419e66d47bc9f023f6b21f39d93'
agencyName = 'yan'
iamEndPoint = 'https://iam.cn-north-1.myhuaweicloud.com'
obsEndPoint = 'https://obs.cn-north-1.myhuaweicloud.com'
durationseconds = 3600
region = 'cn-north-1'
temp_ak = ''
temp_sk = ''
sts_token = ''
# 通过子用户的用户名和密码，获取子用户的token
def getUserToken():
    userToken = ''
    url = iamEndPoint + '/v3/auth/tokens'
    headers = {'content-type': 'application/json'}
    playload = json.dumps({"auth": {"identity": {"methods": ["password"], "password": {
                    "user": {"name": userName, "password": userPasswd, "domain": {"name": domainName}}}},
                    "scope": {"domain": {"name": domainName}}}})
    resp = requests.request("POST", url, data=playload, headers=headers)
    if resp.status_code < 300:
        userToken = resp.headers['X-Subject-Token']
        # print userToken
    else:
        print resp.status_code
    return userToken
# 使用用户的token 和委托名 委托方账户ID 获取具有委托权限的token，
def getAgencyTempAuth():
    agencyToken = ''
    userToken = getUserToken()
    url = iamEndPoint + '/v3/auth/tokens'
    headers = {'content-type': 'application/json;charset=utf8', 'X-Auth-Token': userToken}
    playload = json.dumps({"auth": {"identity": {"methods": ["assume_role"], "assume_role": {"domain_id": agencyCreateUser,
                    "xrole_name": agencyName, "duration-seconds": durationseconds}}, "scope": {"project": {"name": region}}}})
    resp = requests.request("POST", url, data=playload, headers=headers)
    if resp.status_code < 300:
        agencyToken = resp.headers['X-Subject-Token']
    else:
        print resp.status_code
    return agencyToken
# 通过获取到的委托权限的token，获取能够访问委托方 OBS数据的 临时AK/SK+Ststoken
def getUserTempAuth():
    temp_auth = ''
    userToken = getAgencyTempAuth()
    url = iamEndPoint + '/v3.0/OS-CREDENTIAL/securitytokens'
    headers = {'content-type': 'application/json', 'X-Auth-Token': userToken}
    playload = json.dumps({"auth": {"identity": {"methods": ["token"], "token": {"id": "", "duration-seconds": durationseconds}}}})
    resp = requests.request("POST", url, data=playload, headers=headers)
    if resp.status_code < 300:
        temp_auth = json.loads(resp.content)
    else:
        print resp.status_code
    return temp_auth
if __name__ == '__main__':
    print 'this is a demo to get temp auth'
    resp = getUserTempAuth()
    
    temp_ak = resp['credential']['access']
    temp_sk = resp['credential']['secret']
    sts_token = resp['credential']['securitytoken']
    print 'temp_ak is : ', temp_ak
    print 'temp_sk is : ', temp_sk
    print 'sts_token is : ', sts_token
    from obs import ObsClient

    # 创建ObsClient实例
    obsClient = ObsClient(
        access_key_id= temp_ak,    
        secret_access_key= temp_sk,    
        server= obsEndPoint,
        security_token= sts_token
    )
    # 此处 桶和对象名称使用假名，正常使用时候更换为真实名称
    resp = obsClient.getObject('ob****n', 'Salary******KMS.csv', downloadPath='./Salary*****MS.csv')
    if resp.status < 300:
        print('requestId:', resp.requestId)
        print('url:', resp.body.url)
    else:
        print('errorCode:', resp.errorCode)
        print('errorMessage:', resp.errorMessage)