OAuth2IdProvider

IdProvider based on OAuth2 protocol

class DIRAC.Resources.IdProvider.OAuth2IdProvider.OAuth2IdProvider(**kwargs)

Bases: OAuth2Session

Base class to describe the configuration of the OAuth2 client of the corresponding provider.

DEFAULT_METADATA = {}
JWKS_REFRESH_RATE = 86400
METADATA_REFRESH_RATE = 86400
__init__(**kwargs)

Initialization

deviceAuthorization(group=None)

Authorization through DeviceCode flow

exchangeToken(accessToken, group=None, scope=None)

Get new tokens for group scope

Parameters:

  • accessToken (str) – access token

  • group (str) – requested group

  • scope (list) – requested scope

Returns:

dict – token

fetchJWKs(**kwargs)

Fetch JWKs

fetchToken(**kwargs)

Fetch token

Returns:

dict

fetch_metadata(**kwargs)

Fetch metadata

getGroupScopes(group: str) → list[str]

Get group scopes

Parameters:

group – DIRAC group

getJWKs()

Get JWKs

getScopeGroups(scope: str) → list[str]

Get DIRAC groups related to scope

getUserGroups(accessToken)

Get user groups

Parameters:

  • payload (str) – token payload

  • token (str) – access token

Returns:

S_OK(dict)/S_ERROR()

getUserProfile(accessToken)

Get user profile

Parameters:

accessToken (str)

Returns:

S_OK()/S_ERROR()

get_metadata(option=None)

Get metadata

Parameters:

option (str) – option

Returns:

option value

parseAuthResponse(response, session=None)

Make user info dict:

Parameters:

  • response (dict) – response on request to get user profile

  • session (object) – session

Returns:

S_OK((dict, dict))/S_ERROR()

refreshToken(**kwargs)

Refresh token

Parameters:

  • token (str) – refresh_token

  • group (str) – DIRAC group

Returns:

dict

researchGroup(payload=None, token=None)

Deprecated: Use getUserProfile instead

revokeToken(token=None, tokenTypeHint='refresh_token')

Revoke token

Parameters:

  • token (str) – access or refresh token

  • tokenTypeHint (str) – token type

Returns:

S_OK()/S_ERROR()

setParameters(parameters: dict)

Set parameters

Parameters:

parameters (dict) – parameters of the identity Provider

submitDeviceCodeAuthorizationFlow(group=None)

Submit authorization flow

Returns:

S_OK(dict)/S_ERROR() – dictionary with device code flow response

submitNewSession(pkce=True)

Submit new authorization session

Parameters:

pkce (bool) – use PKCE

Returns:

S_OK(str)/S_ERROR()

verifyToken(accessToken)

Verify access token

Parameters:

  • accessToken (str) – access token

  • jwks (dict) – JWKs

Returns:

dict

waitFinalStatusOfDeviceCodeAuthorizationFlow(deviceCode, interval=5, timeout=300)

Submit waiting loop process, that will monitor current authorization session status

Parameters:

  • deviceCode (str) – received device code

  • interval (int) – waiting interval

  • timeout (int) – max time of waiting

Returns:

S_OK(dict)/S_ERROR() - dictionary contain access/refresh token and some metadata

class DIRAC.Resources.IdProvider.OAuth2IdProvider.OAuth2Session(client_id=None, client_secret=None, token_endpoint_auth_method=None, revocation_endpoint_auth_method=None, scope=None, state=None, redirect_uri=None, token=None, token_placement='header', update_token=None, leeway=60, default_timeout=None, **kwargs)

Bases: OAuth2Session

Authlib does not yet know about the token exchange flow: https://github.com/lepture/authlib/tree/master/authlib/oauth2/rfc8693

so we will add auxiliary methods to implement this flow.

exchange_token(url, subject_token=None, subject_token_type=None, body='', auth=None, headers=None, **kwargs)

Exchange a new access token

Parameters:

  • url – Exchange Token endpoint, must be HTTPS.

  • subject_token (str) – subject_token

  • subject_token_type (str) – token type https://tools.ietf.org/html/rfc8693#section-3

  • body – Optional application/x-www-form-urlencoded body to add the include in the token request. Prefer kwargs over body.

  • refresh_token (str) – refresh token

  • access_token (str) – access token

  • auth – An auth tuple or method as accepted by requests.

  • headers – Dict to default request headers with.

Returns:

A OAuth2Token object (a dict too).

DIRAC.Resources.IdProvider.OAuth2IdProvider.claimParser(claimDict, attributes)

Parse claims to dictionary with certain keys

Parameters:

  • claimDict (dict) – claims

  • attributes (dict) – contain claim and regex to parse it

Returns:

dict