canaille 0.0.1__py3-none-any.whl

Canaille-0.0.1.dist-info/LICENSE.md

@@ -0,0 +1,19 @@
+Copyright (c) 2020 by Yaal
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

Canaille-0.0.1.dist-info/METADATA

@@ -0,0 +1,92 @@
+Metadata-Version: 2.1
+Name: Canaille
+Version: 0.0.1
+Summary: Simple OAuth2/OpenID Connect server based upon LDAP
+Home-page: https://gitlab.com/yaal/canaille
+Maintainer: Yaal
+Maintainer-email: contact@yaal.fr
+License: MIT
+Project-URL: Code, https://gitlab.com/yaal/canaille
+Project-URL: Issue Tracker, https://gitlab.com/yaal/canaille/-/issues
+Platform: UNKNOWN
+Classifier: Environment :: Web Environment
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python
+Classifier: Topic :: System :: Systems Administration :: Authentication/Directory
+Classifier: Topic :: System :: Systems Administration :: Authentication/Directory :: LDAP
+Requires-Python: >=3.6
+Description-Content-Type: text/markdown
+Requires-Dist: authlib
+Requires-Dist: email-validator
+Requires-Dist: flask
+Requires-Dist: flask-babel
+Requires-Dist: flask-wtf
+Requires-Dist: python-ldap
+Requires-Dist: sentry-sdk[flask]
+Requires-Dist: toml
+
+⚠ Canaille is under development. Do not use in production yet. ⚠
+
+# Canaille
+
+Canaille is a French word meaning *rascal*, and is pronounced approximatively **Can I?**,
+as in *Can I access this data please?*. It is a simple OpenID Connect provider based upon OpenLDAP.
+
+It aims to be very light, simple to install and simple to maintain. Its main features are :
+- OAuth/OpenID Connect support;
+- Authentication against a LDAP directory;
+- No additional database required. Everything is stored in your OpenLDAP server;
+- The code is easy to read and easy to edit in case you want to write a patch.
+
+## Install
+
+First you need to install the schemas into your LDAP server. There are several ways to achieve this:
+
+### LDAP schemas
+
+#### Option 1: Add the schema into your filesystem
+
+```bash
+test -d /etc/openldap/schema && sudo cp schema/* /etc/openldap/schema
+test -d /etc/ldap/schema && sudo cp schema/* /etc/ldap/schema
+sudo service slapd restart
+```
+
+#### Option 2: Use slapadd
+
+```bash
+sudo slapadd -n0 -l schema/*.ldif
+```
+
+### Web interface
+
+Then you can deploy the code either by copying the git repository or installing the pip package:
+
+```bash
+pip install canaille
+```
+
+Finally you have to run the website in a WSGI server:
+
+```bash
+pip install gunicorn
+gunicorn "canaille:create_app()"
+```
+
+## Contribute
+
+Contributions are welcome!
+To run the tests, you just need to run `tox`.
+
+To try a development environment, you can run the docker image and then open https://127.0.0.1:5000
+You can then connect with user *admin* and password *admin* to access an admin account, or user *user* and password *user* for a regular one.
+
+```bash
+cp canaille/conf/config.sample.toml canaille/conf/config.toml
+cp canaille/conf/oauth-authorization-server.sample.json canaille/conf/oauth-authorization-server.json
+cp canaille/conf/openid-configuration.sample.json canaille/conf/openid-configuration.json
+docker-compose up
+```
+
+

Canaille-0.0.1.dist-info/RECORD

@@ -0,0 +1,70 @@
+canaille/__init__.py,sha256=nH_5AxaaNvDnfNlUJyN8F5FJOoolQ5mSTfrxwKKcP8k,6108
+canaille/account.py,sha256=yixiHTw_glJDOwAsMYjtAgFtOrAJ10DkgP_c0vIqfJU,2151
+canaille/consents.py,sha256=u2ai6afpQylqFS4-ylQGZEj3VIsUhydSXdca9NVtU28,1035
+canaille/flaskutils.py,sha256=9oumsgo6u1VUXxHLkum-WXt05c3cdXwIOZofIzMnZc4,927
+canaille/forms.py,sha256=FqR4FbTCmfd9ylwqWW8K3vFtYVlPVr6SV4r3T8_AAJw,2455
+canaille/ldaputils.py,sha256=NtmEUwwQ8cvVXyUTJbx6OhWMPPXGU2JpqwosCzq4orI,7992
+canaille/models.py,sha256=jkVNmR59uY9mws-a1kQmeQo5tlQ1YWnVgGe37MSyTvA,7548
+canaille/oauth.py,sha256=xiQRG0-QJko3dPEbiRcb0uKies-Fz2JicPEfm2kGDCc,4056
+canaille/oauth2utils.py,sha256=Vuk1D3i8CMpogP60iaMCi97V4PNeB-zcMOFjDCKqItg,9483
+canaille/tokens.py,sha256=88gZ165HxG4bwnU5hn37C-K1sSTtnf2p318aAp8UyUQ,1093
+canaille/well_known.py,sha256=_gctoGC4f2w8RDNboZ65bSi-zUCczJzKmhUzgc6_oDc,443
+canaille/admin/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+canaille/admin/authorizations.py,sha256=Bxtgx5CbAsYBnxC13d2mCVUuJ_7CfP2xmATSfCa6tGE,665
+canaille/admin/clients.py,sha256=cL2kpZB1H0CPm4EQB6NJ_jX4sAsK6XkbQQduYiK-4WU,7645
+canaille/admin/tokens.py,sha256=f0konokNeoKi1eR2mo7j6jpxZZdYGrv10lVEkuaMXEQ,523
+canaille/conf/config.sample.toml,sha256=3PtQEEsv-Sz2OqCJmt9S1QNEkYuonKQ_h9oDhHch_qY,1898
+canaille/conf/oauth-authorization-server.sample.json,sha256=J-fGflF0fbwthbsiCruIB-XYS0DcNSQOg7nFmIM8LJI,926
+canaille/conf/openid-configuration.sample.json,sha256=R-phkWPN___hxSbNxQX8RgUa3NH0b-xAgZM2550RJ64,2174
+canaille/static/css/base.css,sha256=daN_6MGXJ__1IdY62e6fenxbtqrnkvm1NXVxM26ahxo,471
+canaille/static/datatables/French.json,sha256=Rt3I8_rVRREOOIgr3jZIoelsBFlQE5Fe_wOEZiwdV2c,1049
+canaille/static/datatables/dataTables.semanticui.min.css,sha256=SJpV2BABjesndlj0vdtRpj4LE4eigoPZVjTNQ6cMsy8,2625
+canaille/static/datatables/dataTables.semanticui.min.js,sha256=L9t1ZuJNPnJ2fHvdL9PFpdW3IC3jQFx-0oXN520PVFM,3629
+canaille/static/datatables/jquery.dataTables.min.css,sha256=NsjPUPa1DUo51N8aw3uVf4ygtyEBB8DzDAfH2eRJTUs,13892
+canaille/static/datatables/jquery.dataTables.min.js,sha256=_7zo27Ll_hVKhCsE-y8m2SS5bhFPEQFheTCL87HuumA,84647
+canaille/static/fomanticui/semantic.min.css,sha256=2-dssJtgusl_DZZZ8gF9ayAgRzcewXQsaP86E4Ul-ss,1362383
+canaille/static/fomanticui/semantic.min.js,sha256=yibQd6vg4YwSTFUcgd-MwPALTUAVCKTjh4jMON4j-Gk,360427
+canaille/static/fomanticui/themes/default/assets/fonts/brand-icons.eot,sha256=gR4VdxhAZhCM7KhtWmJKkBIwPfUgbFywsn1eP-3LpaM,133034
+canaille/static/fomanticui/themes/default/assets/fonts/brand-icons.svg,sha256=AjQLoXidCbzFB1Y8icSoR7pTe7gTIIJ3elBRnPdLy1s,715890
+canaille/static/fomanticui/themes/default/assets/fonts/brand-icons.ttf,sha256=oMFFOCrP5Zdn0Uh9ZQXzSWZbaFwohc2RtiHRQaKSsPg,132728
+canaille/static/fomanticui/themes/default/assets/fonts/brand-icons.woff,sha256=6DbF1d_BPhgXDFvd77T9rHxlrArUOktDGs3EqYhlomA,89824
+canaille/static/fomanticui/themes/default/assets/fonts/brand-icons.woff2,sha256=XZGQKSrN1Iug_DUID350SPPN8NeRmaTSPw9JtTQf3yk,76612
+canaille/static/fomanticui/themes/default/assets/fonts/icons.eot,sha256=MlAXJ7sj_HdhWx7Ha18pjsIhmMDz1qPn1v5Kw88xXbk,202902
+canaille/static/fomanticui/themes/default/assets/fonts/icons.otf,sha256=vcXQufOXvoPohsdLAUHRlUqkOEs1nc5JgpmUxKLh978,93888
+canaille/static/fomanticui/themes/default/assets/fonts/icons.svg,sha256=52hTmAh1f37sIPCcnumzaw5sVjbpDJ7ml5lcu8buBVU,897426
+canaille/static/fomanticui/themes/default/assets/fonts/icons.ttf,sha256=Ix1ozvvGhG-3jK_KhGdAGk83HiJkGGYuiQDj1SrcAKs,202616
+canaille/static/fomanticui/themes/default/assets/fonts/icons.woff,sha256=NS-OrSgEGd2VPSvHhDOGu5Qw6BUsLb0sLSSU9rlWfuc,103300
+canaille/static/fomanticui/themes/default/assets/fonts/icons.woff2,sha256=f00_0KcF2_hAMpiq2R1d5pcua11TYGjrqLJJVKWgqMc,79444
+canaille/static/fomanticui/themes/default/assets/fonts/outline-icons.eot,sha256=AfRBb121ni3WtvvZ3DIzbZnbGPfrYjpJ9YTQSv0nlHM,34390
+canaille/static/fomanticui/themes/default/assets/fonts/outline-icons.svg,sha256=hl_SPeE7GSAoDhgjWVeeCe_3oJ6yRnbs7sdVKDhVn1U,144322
+canaille/static/fomanticui/themes/default/assets/fonts/outline-icons.ttf,sha256=8yuUopBg3-wMeXod_hETV-sdaC8aykrEuVzw9MPiv6k,34092
+canaille/static/fomanticui/themes/default/assets/fonts/outline-icons.woff,sha256=ji2WGYcRtjdS5fL1mHuP_FNt9hVqBlvb4oy3IxyteT0,16800
+canaille/static/fomanticui/themes/default/assets/fonts/outline-icons.woff2,sha256=aoyOnh5_aSwhrxlW3hY_PQJneOZEn-k6CaZxhHyhrmU,13584
+canaille/static/fomanticui/themes/default/assets/images/flags.png,sha256=lNXH8WYTAcSm3Ekdct1VmgYgzZF6gm8N8bAju5bqnd0,28123
+canaille/static/jquery/jquery.min.js,sha256=FgpCb_KJQlLNfOu91ta32o_NMZxltwRo8QtmkMRdAu8,86927
+canaille/static/js/base.js,sha256=FRF2aY3_vnTx3Fj5GcPnLAXgum4JvX2-ck3tgd_ULG8,93
+canaille/static/js/users.js,sha256=auJrLvGRLS4P451DXKfbn2Fg28YXShtHf2q9Stg5yno,432
+canaille/templates/authorize.html,sha256=nlfj5z8bJhaqP8xCDNdFYDrjivKLenzSEPh3hce00us,1295
+canaille/templates/base.html,sha256=qBRPAix1PKelSpXXZyAOYWH-FEVpjiDNdsWhZA4QTJI,3704
+canaille/templates/consent_list.html,sha256=2BOKqbIZMGFWPNJ3eufOSFlWAWvdXpKGYqVHi9Bb0Rg,2839
+canaille/templates/error.html,sha256=QfF7keTyDBEZZ0DqcRm7yVeJ-Kk-nbVk9020uF2JSwM,264
+canaille/templates/fomanticui.j2,sha256=xrFXIUUE_gYOjWMqCEog1Ktb6ywK7qHB4aUMMDgsUgE,1565
+canaille/templates/home.html,sha256=L70TrEUWEVwsFMFXI9EbHXSNYy8QgvHtHM3nOMgvL4M,106
+canaille/templates/login.html,sha256=5KPTIU2T3CJs2EojVg4bv-wBPBWo9x4gMmcnk0esc7U,1282
+canaille/templates/profile.html,sha256=VgGOhjZcQp7Kdl4CXJT1KZcHnUdyGJGthCeaCN2SWmc,686
+canaille/templates/token_list.html,sha256=EgNEEG1iqvSBmBH3SHItX_aaFKFbLrK97C7hciqBheQ,2858
+canaille/templates/admin/authorization_list.html,sha256=wROv_vEIBOhvmLI80E9vxnOZoJn7vYnzULaIn9PuC4w,1233
+canaille/templates/admin/authorization_view.html,sha256=9kIUGRWsv6sYq1fLDYYFkk5MsKljJ6NRPdOFHyXZ3l0,801
+canaille/templates/admin/client_add.html,sha256=h6IhZbla9gE1Vp7nk4piBSro_BDq7b-IIqvC7ev0rWM,567
+canaille/templates/admin/client_edit.html,sha256=K7ui58kad1FB8foi2qH143qeUrDRN71benbtkVhkqZo,1365
+canaille/templates/admin/client_list.html,sha256=Wgd_4f6jD_dslUGeFc31FXjq-7cynkOWomhD1SODGyM,1185
+canaille/templates/admin/token_list.html,sha256=rMztwC3Pr0BNIqyRdbspeod9hzTvbV9vpxzUUcbAtBo,1167
+canaille/templates/admin/token_view.html,sha256=4T-r2zCGl0FKTxhR4cYFbFZdQxPH9DT3Ady3G0TaDt8,761
+canaille/translations/messages.pot,sha256=TKotVvILXaVOOhj_3AMb7ImqoQbac5E-wbOg4CO6rNo,6562
+canaille/translations/fr/LC_MESSAGES/messages.mo,sha256=KOGDaGfce5HdvoUSlVOarvrLepaFwRuqMbZ_I9N-WSk,4232
+canaille/translations/fr/LC_MESSAGES/messages.po,sha256=NZgbkOvEd1PuI-GjahgdM5O4cLzDZMWblzQdgo-59H4,8226
+Canaille-0.0.1.dist-info/LICENSE.md,sha256=UR_cMK98RpwF1LowncFEah4jft4uJsIMr1EvkpXmFO4,1051
+Canaille-0.0.1.dist-info/METADATA,sha256=BMkaYacy-_q9XmFFU6p4J42KwivFggpKApoi5kmiKdI,2911
+Canaille-0.0.1.dist-info/WHEEL,sha256=EVRjI69F5qVjm_YgqcTXPnTAv3BfSUr0WVAHuSP3Xoo,92
+Canaille-0.0.1.dist-info/top_level.txt,sha256=YrVDHbkt3FE8oH1GwYrrT6sFbGorxLmzod00bnQmofM,9
+Canaille-0.0.1.dist-info/RECORD,,

Canaille-0.0.1.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: bdist_wheel (0.35.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

Canaille-0.0.1.dist-info/top_level.txt

@@ -0,0 +1 @@
+canaille

canaille/__init__.py

@@ -0,0 +1,197 @@
+import ldap
+import os
+import toml
+
+import canaille.admin
+import canaille.admin.tokens
+import canaille.admin.authorizations
+import canaille.admin.clients
+import canaille.consents
+import canaille.oauth
+import canaille.account
+import canaille.tokens
+import canaille.well_known
+
+from cryptography.hazmat.primitives import serialization as crypto_serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
+from cryptography.hazmat.backends import default_backend as crypto_default_backend
+
+from flask import Flask, g, request, render_template
+from flask_babel import Babel
+
+from .flaskutils import current_user
+from .ldaputils import LDAPObject
+from .oauth2utils import config_oauth
+from .models import User, Token, AuthorizationCode, Client, Consent
+
+try:  # pragma: no cover
+    import sentry_sdk
+    from sentry_sdk.integrations.flask import FlaskIntegration
+
+    SENTRY = True
+except Exception:
+    SENTRY = False
+
+
+def create_app(config=None):
+    app = Flask(__name__)
+    dir_path = os.path.dirname(os.path.realpath(__file__))
+
+    app.config.from_mapping(
+        {
+            "SESSION_COOKIE_NAME": "canaille",
+            "OAUTH2_REFRESH_TOKEN_GENERATOR": True,
+        }
+    )
+    if config:
+        app.config.from_mapping(config)
+    elif "CONFIG" in os.environ:
+        app.config.from_mapping(toml.load(os.environ.get("CONFIG")))
+    elif os.path.exists(os.path.join(dir_path, "conf", "config.toml")):
+        app.config.from_mapping(
+            toml.load(os.path.join(dir_path, "conf", "config.toml"))
+        )
+    else:
+        raise Exception(
+            "No configuration file found. "
+            "Either create conf/config.toml or set the 'CONFIG' variable environment."
+        )
+
+    setup_dev_keypair(app)
+
+    if not os.path.exists(app.config["JWT"]["PUBLIC_KEY"]) or not os.path.exists(
+        app.config["JWT"]["PRIVATE_KEY"]
+    ):
+        raise Exception("Invalid keypair")
+    setup_app(app)
+
+    return app
+
+
+def setup_dev_keypair(app):
+    if not os.environ.get("FLASK_ENV") == "development":
+        return
+
+    if os.path.exists(app.config["JWT"]["PUBLIC_KEY"]) or os.path.exists(
+        app.config["JWT"]["PRIVATE_KEY"]
+    ):
+        return
+
+    key = rsa.generate_private_key(
+        backend=crypto_default_backend(), public_exponent=65537, key_size=2048
+    )
+    private_key = key.private_bytes(
+        crypto_serialization.Encoding.PEM,
+        crypto_serialization.PrivateFormat.PKCS8,
+        crypto_serialization.NoEncryption(),
+    )
+    public_key = key.public_key().public_bytes(
+        crypto_serialization.Encoding.OpenSSH, crypto_serialization.PublicFormat.OpenSSH
+    )
+
+    with open(app.config["JWT"]["PUBLIC_KEY"], "wb") as fd:
+        fd.write(public_key)
+
+    with open(app.config["JWT"]["PRIVATE_KEY"], "wb") as fd:
+        fd.write(private_key)
+
+
+def setup_ldap_tree(app):
+    conn = ldap.initialize(app.config["LDAP"]["URI"])
+    conn.simple_bind_s(app.config["LDAP"]["BIND_DN"], app.config["LDAP"]["BIND_PW"])
+    Token.initialize(conn)
+    AuthorizationCode.initialize(conn)
+    Client.initialize(conn)
+    Consent.initialize(conn)
+    conn.unbind_s()
+
+
+def setup_app(app):
+    if SENTRY and app.config.get("SENTRY_DSN"):
+        sentry_sdk.init(dsn=app.config["SENTRY_DSN"], integrations=[FlaskIntegration()])
+
+    try:
+        LDAPObject.root_dn = app.config["LDAP"]["ROOT_DN"]
+        base = app.config["LDAP"]["USER_BASE"]
+        if base.endswith(app.config["LDAP"]["ROOT_DN"]):
+            base = base[: -len(app.config["LDAP"]["ROOT_DN"]) - 1]
+        User.base = base
+
+        app.url_map.strict_slashes = False
+
+        config_oauth(app)
+        setup_ldap_tree(app)
+        app.register_blueprint(canaille.account.bp)
+        app.register_blueprint(canaille.oauth.bp, url_prefix="/oauth")
+        app.register_blueprint(canaille.consents.bp, url_prefix="/consent")
+        app.register_blueprint(canaille.tokens.bp, url_prefix="/token")
+        app.register_blueprint(
+            canaille.well_known.bp, url_prefix="/.well-known"
+        )
+        app.register_blueprint(
+            canaille.admin.tokens.bp, url_prefix="/admin/token"
+        )
+        app.register_blueprint(
+            canaille.admin.authorizations.bp, url_prefix="/admin/authorization"
+        )
+        app.register_blueprint(
+            canaille.admin.clients.bp, url_prefix="/admin/client"
+        )
+
+        babel = Babel(app)
+
+        @babel.localeselector
+        def get_locale():
+            user = getattr(g, "user", None)
+            if user is not None:
+                return user.locale
+
+            if app.config.get("LANGUAGE"):
+                return app.config.get("LANGUAGE")
+
+            return request.accept_languages.best_match(["fr_FR", "en_US"])
+
+        @babel.timezoneselector
+        def get_timezone():
+            user = getattr(g, "user", None)
+            if user is not None:
+                return user.timezone
+
+        @app.before_request
+        def before_request():
+            g.ldap = ldap.initialize(app.config["LDAP"]["URI"])
+            g.ldap.simple_bind_s(
+                app.config["LDAP"]["BIND_DN"], app.config["LDAP"]["BIND_PW"]
+            )
+
+        @app.after_request
+        def after_request(response):
+            if "ldap" in g:
+                g.ldap.unbind_s()
+            return response
+
+        @app.context_processor
+        def global_processor():
+            return {
+                "logo_url": app.config.get("LOGO"),
+                "website_name": app.config.get("NAME"),
+                "user": current_user(),
+                "menu": True,
+            }
+
+        @app.errorhandler(403)
+        def unauthorized(e):
+            return render_template("error.html", error=403), 403
+
+        @app.errorhandler(404)
+        def page_not_found(e):
+            return render_template("error.html", error=404), 404
+
+        @app.errorhandler(500)
+        def server_error(e):
+            return render_template("error.html", error=500), 500
+
+    except Exception as exc:
+        if SENTRY and app.config.get("SENTRY_DSN"):
+            sentry_sdk.capture_exception(exc)
+        raise

canaille/account.py

@@ -0,0 +1,72 @@
+from flask import Blueprint, request, flash, url_for, current_app
+from flask import render_template, redirect
+from flask_babel import gettext
+
+from .forms import LoginForm, ProfileForm
+from .flaskutils import current_user, user_needed
+from .models import User
+
+
+bp = Blueprint(__name__, "home")
+
+
+@bp.route("/")
+def index():
+    if not current_user():
+        return redirect(url_for("canaille.account.login"))
+    return redirect(url_for("canaille.account.profile"))
+
+
+@bp.route("/login", methods=("GET", "POST"))
+def login():
+    form = LoginForm(request.form or None)
+
+    if request.form:
+        if not form.validate() or not User.authenticate(
+            form.login.data, form.password.data, True
+        ):
+            flash(gettext("Login failed, please check your information"), "error")
+            return render_template("login.html", form=form)
+
+        return redirect(url_for("canaille.account.index"))
+
+    return render_template("login.html", form=form)
+
+
+@bp.route("/logout")
+def logout():
+    if current_user():
+        current_user().logout()
+    return redirect("/")
+
+
+@bp.route("/profile", methods=("GET", "POST"))
+@user_needed()
+def profile(user):
+    claims = current_app.config["JWT"]["MAPPING"]
+    data = {
+        k.lower(): getattr(user, v)[0]
+        if getattr(user, v) and isinstance(getattr(user, v), list)
+        else getattr(user, v) or ""
+        for k, v in claims.items()
+    }
+    form = ProfileForm(request.form or None, data=data)
+
+    if request.form:
+        if not form.validate():
+            flash(gettext("Profile edition failed."), "error")
+
+        else:
+            for attribute in form:
+                model_attribute_name = claims.get(attribute.name.upper())
+                if not model_attribute_name or not hasattr(user, model_attribute_name):
+                    continue
+
+                user[model_attribute_name] = [attribute.data]
+
+            if not form.password1.data or user.set_password(form.password1.data):
+                flash(gettext("Profile updated successfuly."), "success")
+
+            user.save()
+
+    return render_template("profile.html", form=form, menuitem="profile")

canaille/admin/authorizations.py

@@ -0,0 +1,24 @@
+from flask import Blueprint, render_template
+from canaille.models import AuthorizationCode
+from canaille.flaskutils import admin_needed
+
+
+bp = Blueprint(__name__, "authorizations")
+
+
+@bp.route("/")
+@admin_needed()
+def index():
+    authorizations = AuthorizationCode.filter()
+    return render_template(
+        "admin/authorization_list.html", authorizations=authorizations
+    )
+
+
+@bp.route("/<authorization_id>", methods=["GET", "POST"])
+@admin_needed()
+def view(authorization_id):
+    authorization = AuthorizationCode.get(authorization_id)
+    return render_template(
+        "admin/authorization_view.html", authorization=authorization, menuitem="admin"
+    )