cco/py-scopes
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

oidc auth: login and retrieval of user data basically working

Browse source
This commit is contained in:
Helmut Merz 2025-03-26 18:15:38 +01:00
parent c1f07effee
commit 950fcb4174
2 changed files with 24 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
demo/config.py
View file

@ -24,10 +24,12 @@ oidc_provider = 'https://a1.cy7.de'
oidc_client_id = getenv('OIDC_CLIENT_ID', '311613119816392525') oidc_client_id = getenv('OIDC_CLIENT_ID', '311613119816392525')
oidc_params = dict( oidc_params = dict(
auth_url=getenv('OIDC_PROVIDER_URL', oidc_provider + '/oauth/v2/authorize'), auth_url=getenv('OIDC_PROVIDER_URL', oidc_provider + '/oauth/v2/authorize'),
token_url=getenv('OIDC_TOKEN_URL', oidc_provider + '/oauth/v2/token'),
userinfo_url=getenv('OIDC_USERINFO_URL', oidc_provider + '/oidc/v1/userinfo'),
callback_url=getenv('OIDC_CALLBACK_URL', base_url + '/auth/callback'), callback_url=getenv('OIDC_CALLBACK_URL', base_url + '/auth/callback'),
client_id = oidc_client_id, client_id = oidc_client_id,
cookie_name=getenv('OIDC_COOKIE_NAME', 'oidc_' + oidc_client_id), cookie_name=getenv('OIDC_COOKIE_NAME', 'oidc_' + oidc_client_id),
cookie_domain=getenv('OIDC_COOKIE_DOMAIN', 'cy7.de'), cookie_domain=getenv('OIDC_COOKIE_DOMAIN', None),
cookie_lifetime=getenv('OIDC_COOKIE_LIFETIME', '86400'), cookie_lifetime=getenv('OIDC_COOKIE_LIFETIME', '86400'),
) )

26
scopes/server/auth.py
View file

@ -4,6 +4,7 @@ from email.utils import formatdate
import json import json
from oic import oic, rndstr, unreserved from oic import oic, rndstr, unreserved
from oic.oic.message import AuthorizationResponse from oic.oic.message import AuthorizationResponse
import requests
from time import time from time import time
from zope.authentication.interfaces import IAuthentication from zope.authentication.interfaces import IAuthentication
from zope.interface import implementer from zope.interface import implementer
@ -67,7 +68,7 @@ class Authenticator(DummyFolder):
print('*** login', self, req.getTraversalStack(), req['PATH_INFO']) print('*** login', self, req.getTraversalStack(), req['PATH_INFO'])
#print('***', dir(req)) #print('***', dir(req))
client = oic.Client() client = oic.Client()
#providerInfo = client.provider_config(params['provider_url']) #providerInfo = client.provider_config(config.oidc_provider)
#print('***', providerInfo) #print('***', providerInfo)
state = rndstr() state = rndstr()
nonce = rndstr() nonce = rndstr()
@ -78,9 +79,10 @@ class Authenticator(DummyFolder):
scope=['openid', 'profile'], scope=['openid', 'profile'],
redirect_uri=self.params['callback_url'], redirect_uri=self.params['callback_url'],
) )
addArgs, codeVerifyer = client.add_code_challenge() addArgs, codeVerifier = client.add_code_challenge()
print('***', addArgs, codeVerifier)
args.update(addArgs) args.update(addArgs)
self.storeSession(dict(state=state, nonce=nonce, codeVerifyer=codeVerifyer)) self.storeSession(dict(state=state, nonce=nonce, code_verifier=codeVerifier))
authReq = client.construct_AuthorizationRequest(request_args=args) authReq = client.construct_AuthorizationRequest(request_args=args)
loginUrl = authReq.request(self.params['auth_url']) loginUrl = authReq.request(self.params['auth_url'])
print('***', loginUrl) print('***', loginUrl)
@ -91,8 +93,22 @@ class Authenticator(DummyFolder):
print('*** callback', self, req.form) print('*** callback', self, req.form)
data = self.loadSession() data = self.loadSession()
code = req.form['code'] code = req.form['code']
client = oic.Client() print('***', data, code)
print('***', data, code, client) # !check state: req.form['state'] == data['state']
args = dict(
grant_type='authorization_code',
code=code,
redirect_uri=self.params['callback_url'],
client_id=self.params['client_id'],
code_verifier=data['code_verifier']
)
# !set header: 'Content-Type: application/x-www-form-urlencoded'
tokenResponse = requests.post(self.params['token_url'], data=args)
tdata = tokenResponse.json()
print('***', tdata)
headers = dict(Authorization='Bearer ' + tdata['access_token'])
userInfo = requests.get(self.params['userinfo_url'], headers=headers)
print('***', userInfo.json())
def storeSession(self, data): def storeSession(self, data):
options = {} options = {}