cmdbox 0.5.3.1__tar.gz → 0.6.0__tar.gz

{cmdbox-0.5.3.1/cmdbox.egg-info → cmdbox-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: cmdbox
-Version: 0.5.3.1
+Version: 0.6.0
 Summary: cmdbox: It is a command line application with a plugin mechanism.
 Home-page: https://github.com/hamacom2004jp/cmdbox
 Download-URL: https://github.com/hamacom2004jp/cmdbox
@@ -35,18 +35,48 @@ License-File: LICENSE
 # Install
 
 - Install cmdbox with the following command.
+- Also install the docker version of the redis server.
 
 ```bash
+docker run -p 6379:6379 --name redis -e REDIS_PASSWORD=password -it ubuntu/redis:latest
 pip install cmdbox
 cmdbox -v
 ```
 
-- Also install the docker version of the redis server.
+- When using SAML in web mode, install the modules with dependencies.
+```bash
+pip install xmlsec==1.3.13 python3-saml
+apt-get install -y pkg-config libxml2-dev libxmlsec1-dev libxmlsec1-openssl build-essential libopencv-dev
+```
+
+- When using `--agent use` in web mode, install the modules with dependencies.
+```bash
+pip install google-adk litellm
+```
+
+# Run
+
+- Run the cmdbox server.
+
+```bash
+cmdbox -m server -c start &
+```
+
+- Run the cmdbox web.
+
+```bash
+cmdbox -m web -c start --signin_file .cmdbox/user_list.yml &
+```
+
+- Run the cmdbox web with agent.
+- Below is an example of using Google vertexai.
+- Other available options include Azure OpenAI and Ollama.
 
 ```bash
-docker run -p 6379:6379 --name redis -it ubuntu/redis:latest
+cmdbox -m web -c start --signin_file .cmdbox/user_list.yml --agent use --llmprov vertexai --llmmodel gemini-2.0-flash --llmlocation us-central1 --llmsvaccountfile <account json file>
 ```
 
+
 # Tutorial
 
 - Open the ```.sample/sample_project``` folder in the current directory with VSCode.
@@ -267,29 +297,47 @@ aliases:                                # Specify the alias for the specified co
                                         #   e.g. /{1}_exec
         move:                           # Specify whether to move the regular expression group of the source to the target.
                                         #   e.g. true
-  audit:
-    enabled: true                       # Specify whether to enable the audit function.
-    write:
-      mode: audit                       # Specify the mode of the feature to be writed.
-      cmd: write                        # Specify the command to be writed.
-    search:
-      mode: audit                       # Specify the mode of the feature to be searched.
-      cmd: search                       # Specify the command to be searched.
-    options:                            # Specify the options for the audit function.
-      host: localhost                   # Specify the service host of the audit Redis server.However, if it is specified as a command line argument, it is ignored.
-      port: 6379                        # Specify the service port of the audit Redis server.However, if it is specified as a command line argument, it is ignored.
-      password: password                # Specify the access password of the audit Redis server.However, if it is specified as a command line argument, it is ignored.
-      svname: server                    # Specify the audit service name of the inference server.However, if it is specified as a command line argument, it is ignored.
-      retry_count: 3                    # Specifies the number of reconnections to the audit Redis server.If less than 0 is specified, reconnection is forever.
-      retry_interval: 1                 # Specifies the number of seconds before reconnecting to the audit Redis server.
-      timeout: 15                       # Specify the maximum waiting time until the server responds.
-      pg_enabled: False                 # Specify True if using the postgresql database server.
-      pg_host: localhost                # Specify the postgresql host.
-      pg_port: 5432                     # Specify the postgresql port.
-      pg_user: postgres                 # Specify the postgresql user name.
-      pg_password: password             # Specify the postgresql password.
-      pg_dbname: audit                  # Specify the postgresql database name.
-      retention_period_days: 365        # Specify the number of days to retain audit logs.
+agentrule:                              # Specifies a list of rules that determine which commands the agent can execute.
+  policy: deny                          # Specify the default policy for the rule. The value can be allow or deny.
+  rules:                                # Specify the rules for the commands that the agent can execute according to the group to which the user belongs.
+  - mode: audit                         # Specify the "mode" as the condition for applying the rule.
+    cmds: [search, write]               # Specify the "cmd" to which the rule applies. Multiple items can be specified in a list.
+    rule: allow                         # Specifies whether the specified command is allowed or not. Values are allow or deny.
+  - mode: client
+    cmds: [file_copy, file_download, file_list, file_mkdir, file_move, file_remove, file_rmdir, file_upload, server_info]
+    rule: allow
+  - mode: cmd
+    cmds: [list, load]
+    rule: allow
+  - mode: server
+    cmds: [list]
+    rule: allow
+  - mode: web
+    cmds: [gencert, genpass, group_list, user_list]
+    rule: allow
+audit:
+  enabled: true                         # Specify whether to enable the audit function.
+  write:
+    mode: audit                         # Specify the mode of the feature to be writed.
+    cmd: write                          # Specify the command to be writed.
+  search:
+    mode: audit                         # Specify the mode of the feature to be searched.
+    cmd: search                         # Specify the command to be searched.
+  options:                              # Specify the options for the audit function.
+    host: localhost                     # Specify the service host of the audit Redis server.However, if it is specified as a command line argument, it is ignored.
+    port: 6379                          # Specify the service port of the audit Redis server.However, if it is specified as a command line argument, it is ignored.
+    password: password                  # Specify the access password of the audit Redis server.However, if it is specified as a command line argument, it is ignored.
+    svname: cmdbox                      # Specify the audit service name of the inference server.However, if it is specified as a command line argument, it is ignored.
+    retry_count: 3                      # Specifies the number of reconnections to the audit Redis server.If less than 0 is specified, reconnection is forever.
+    retry_interval: 1                   # Specifies the number of seconds before reconnecting to the audit Redis server.
+    timeout: 15                         # Specify the maximum waiting time until the server responds.
+    pg_enabled: False                   # Specify True if using the postgresql database server.
+    pg_host: localhost                  # Specify the postgresql host.
+    pg_port: 5432                       # Specify the postgresql port.
+    pg_user: postgres                   # Specify the postgresql user name.
+    pg_password: password               # Specify the postgresql password.
+    pg_dbname: audit                    # Specify the postgresql database name.
+    retention_period_days: 365          # Specify the number of days to retain audit logs.
 
 ```
 
@@ -303,25 +351,25 @@ aliases:                                # Specify the alias for the specified co
 users:                         # A list of users, each of which is a map that contains the following fields.
 - uid: 1                       # An ID that identifies a user. No two users can have the same ID.
   name: admin                  # A name that identifies the user. No two users can have the same name.
-  password: XXXXXXXXXXX        # The user's password. The value is hashed with the hash function specified in the next hash field.
-  hash: plain                  # The hash function used to hash the password, which can be plain, md5, sha1, or sha256, or oauth2.
+  password: XXXXXXXXXXXXXXXX   # The user's password. The value is hashed with the hash function specified in the next hash field.
+  hash: plain                  # The hash function used to hash the password, which can be plain, md5, sha1, or sha256, or oauth2, or saml.
   groups: [admin]              # A list of groups to which the user belongs, as specified in the groups field.
-  email: admin@aaa.bbb.jp      # The email address of the user, used when authenticating using the provider specified in the oauth2 field.
+  email: admin@aaa.bbb.jp      # The email address of the user, used when authenticating using the provider specified in the oauth2 or saml field.
 - uid: 101
   name: user01
-  password: XXXXXXXXXXX
+  password: XXXXXXXXXXXXXXXX
   hash: md5
   groups: [user]
   email: user01@aaa.bbb.jp
 - uid: 102
   name: user02
-  password: XXXXXXXXXXX
+  password: XXXXXXXXXXXXXXXX
   hash: sha1
   groups: [readonly]
   email: user02@aaa.bbb.jp
 - uid: 103
   name: user03
-  password: XXXXXXXXXXX
+  password: XXXXXXXXXXXXXXXX
   hash: sha256
   groups: [editor]
   email: user03@aaa.bbb.jp
@@ -351,6 +399,10 @@ cmdrule:                       # A list of command rules, Specify a rule that de
     mode: server
     cmds: [list]
     rule: allow
+  - groups: [user, guest]
+    mode: audit
+    cmds: [write]
+    rule: allow
   - groups: [user, guest]
     mode: web
     cmds: [genpass]
@@ -371,7 +423,8 @@ pathrule:                      # List of RESTAPI rules, rules that determine whe
     rule: allow
   - groups: [user]
     paths: [/signin, /assets, /bbforce_cmd, /copyright, /dosignin, /dosignout, /password/change,
-            /exec_cmd, /exec_pipe, /filer, /gui, /get_server_opt, /usesignout, /versions_cmdbox, /versions_used]
+            /gui/user_data/load, /gui/user_data/save, /gui/user_data/delete,
+            /exec_cmd, /exec_pipe, /filer, /result, /gui, /get_server_opt, /usesignout, /versions_cmdbox, /versions_used]
     rule: allow
   - groups: [readonly]
     paths: [/gui/del_cmd, /gui/del_pipe, /gui/save_cmd, /gui/save_pipe]
@@ -406,7 +459,8 @@ oauth2:                             # OAuth2 settings.
       client_secret: XXXXXXXXXXX    # Specify Google's OAuth2 client secret.
       redirect_uri: https://localhost:8443/oauth2/google/callback # Specify Google's OAuth2 redirect URI.
       scope: ['email']              # Specify the scope you want to retrieve with Google's OAuth2. Usually, just reading the email is sufficient.
-      signin_module:                # Specify the module name that implements the sign-in. see, cmdbox.app.signin.SignIn
+      signin_module:                # Specify the module name that implements the sign-in.
+        cmdbox.app.auth.google_signin
       note:                         # Specify a description such as Google's OAuth2 reference site.
       - https://developers.google.com/identity/protocols/oauth2/web-server?hl=ja#httprest
     github:                         # OAuth2 settings for GitHub.
@@ -415,9 +469,50 @@ oauth2:                             # OAuth2 settings.
       client_secret: XXXXXXXXXXX    # Specify the GitHub OAuth2 client secret.
       redirect_uri: https://localhost:8443/oauth2/github/callback # Specify the OAuth2 redirect URI for GitHub.
       scope: ['user:email']         # Specify the scope you want to get from GitHub's OAuth2. Usually, just reading the email is sufficient.
-      signin_module:                # Specify the module name that implements the sign-in. see, cmdbox.app.signin.SignIn
+      signin_module:                # Specify the module name that implements the sign-in.
+        cmdbox.app.auth.github_signin
       note:                         # Specify a description, such as a reference site for OAuth2 on GitHub.
       - https://docs.github.com/ja/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps#scopes
+    azure:                          # OAuth2 settings for Azure AD.
+      enabled: false                # Specify whether to enable OAuth2 for Azure AD.
+      tenant_id: XXXXXXXXXXX        # Specify the tenant ID for Azure AD.
+      client_id: XXXXXXXXXXX        # Specify the OAuth2 client ID for Azure AD.
+      client_secret: XXXXXXXXXXX    # Specify the Azure AD OAuth2 client secret.
+      redirect_uri: https://localhost:8443/oauth2/azure/callback # Specify the OAuth2 redirect URI for Azure AD.
+      scope: ['openid', 'profile', 'email', 'https://graph.microsoft.com/mail.read']
+      signin_module:                # Specify the module name that implements the sign-in.
+        cmdbox.app.auth.azure_signin
+      note:                         # Specify a description, such as a reference site for Azure AD's OAuth2.
+      - https://learn.microsoft.com/ja-jp/entra/identity-platform/v2-oauth2-auth-code-flow
+saml:                               # SAML settings.
+  providers:                        # This is a per-provider setting for OAuth2.
+    azure:                          # SAML settings for Azure AD.
+      enabled: false                # Specify whether to enable SAML authentication for Azure AD.
+      signin_module:                # Specify the module name that implements the sign-in.
+        cmdbox.app.auth.azure_signin_saml # Specify the python3-saml configuration.
+                                    # see) https://github.com/SAML-Toolkits/python3-saml
+      sp:
+        entityId: https://localhost:8443/
+        assertionConsumerService:
+          url: https://localhost:8443/saml/azure/callback
+          binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
+        attributeConsumingService: {}
+        singleLogoutService:
+          binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
+        NameIDFormat: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
+        x509cert: ''
+        privateKey: ''
+      idp:
+        entityId: https://sts.windows.net/{tenant-id}/
+        singleSignOnService:
+          url: https://login.microsoftonline.com/{tenant-id}/saml2
+          binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
+        x509cert: XXXXXXXXXXX
+        singleLogoutService: {}
+        certFingerprint: ''
+        certFingerprintAlgorithm: sha1
+
+
 ```
 
 - See the documentation for references to each file.

{cmdbox-0.5.3.1 → cmdbox-0.6.0}/README.md

@@ -11,18 +11,48 @@
 # Install
 
 - Install cmdbox with the following command.
+- Also install the docker version of the redis server.
 
 ```bash
+docker run -p 6379:6379 --name redis -e REDIS_PASSWORD=password -it ubuntu/redis:latest
 pip install cmdbox
 cmdbox -v
 ```
 
-- Also install the docker version of the redis server.
+- When using SAML in web mode, install the modules with dependencies.
+```bash
+pip install xmlsec==1.3.13 python3-saml
+apt-get install -y pkg-config libxml2-dev libxmlsec1-dev libxmlsec1-openssl build-essential libopencv-dev
+```
+
+- When using `--agent use` in web mode, install the modules with dependencies.
+```bash
+pip install google-adk litellm
+```
+
+# Run
+
+- Run the cmdbox server.
+
+```bash
+cmdbox -m server -c start &
+```
+
+- Run the cmdbox web.
+
+```bash
+cmdbox -m web -c start --signin_file .cmdbox/user_list.yml &
+```
+
+- Run the cmdbox web with agent.
+- Below is an example of using Google vertexai.
+- Other available options include Azure OpenAI and Ollama.
 
 ```bash
-docker run -p 6379:6379 --name redis -it ubuntu/redis:latest
+cmdbox -m web -c start --signin_file .cmdbox/user_list.yml --agent use --llmprov vertexai --llmmodel gemini-2.0-flash --llmlocation us-central1 --llmsvaccountfile <account json file>
 ```
 
+
 # Tutorial
 
 - Open the ```.sample/sample_project``` folder in the current directory with VSCode.
@@ -243,29 +273,47 @@ aliases:                                # Specify the alias for the specified co
                                         #   e.g. /{1}_exec
         move:                           # Specify whether to move the regular expression group of the source to the target.
                                         #   e.g. true
-  audit:
-    enabled: true                       # Specify whether to enable the audit function.
-    write:
-      mode: audit                       # Specify the mode of the feature to be writed.
-      cmd: write                        # Specify the command to be writed.
-    search:
-      mode: audit                       # Specify the mode of the feature to be searched.
-      cmd: search                       # Specify the command to be searched.
-    options:                            # Specify the options for the audit function.
-      host: localhost                   # Specify the service host of the audit Redis server.However, if it is specified as a command line argument, it is ignored.
-      port: 6379                        # Specify the service port of the audit Redis server.However, if it is specified as a command line argument, it is ignored.
-      password: password                # Specify the access password of the audit Redis server.However, if it is specified as a command line argument, it is ignored.
-      svname: server                    # Specify the audit service name of the inference server.However, if it is specified as a command line argument, it is ignored.
-      retry_count: 3                    # Specifies the number of reconnections to the audit Redis server.If less than 0 is specified, reconnection is forever.
-      retry_interval: 1                 # Specifies the number of seconds before reconnecting to the audit Redis server.
-      timeout: 15                       # Specify the maximum waiting time until the server responds.
-      pg_enabled: False                 # Specify True if using the postgresql database server.
-      pg_host: localhost                # Specify the postgresql host.
-      pg_port: 5432                     # Specify the postgresql port.
-      pg_user: postgres                 # Specify the postgresql user name.
-      pg_password: password             # Specify the postgresql password.
-      pg_dbname: audit                  # Specify the postgresql database name.
-      retention_period_days: 365        # Specify the number of days to retain audit logs.
+agentrule:                              # Specifies a list of rules that determine which commands the agent can execute.
+  policy: deny                          # Specify the default policy for the rule. The value can be allow or deny.
+  rules:                                # Specify the rules for the commands that the agent can execute according to the group to which the user belongs.
+  - mode: audit                         # Specify the "mode" as the condition for applying the rule.
+    cmds: [search, write]               # Specify the "cmd" to which the rule applies. Multiple items can be specified in a list.
+    rule: allow                         # Specifies whether the specified command is allowed or not. Values are allow or deny.
+  - mode: client
+    cmds: [file_copy, file_download, file_list, file_mkdir, file_move, file_remove, file_rmdir, file_upload, server_info]
+    rule: allow
+  - mode: cmd
+    cmds: [list, load]
+    rule: allow
+  - mode: server
+    cmds: [list]
+    rule: allow
+  - mode: web
+    cmds: [gencert, genpass, group_list, user_list]
+    rule: allow
+audit:
+  enabled: true                         # Specify whether to enable the audit function.
+  write:
+    mode: audit                         # Specify the mode of the feature to be writed.
+    cmd: write                          # Specify the command to be writed.
+  search:
+    mode: audit                         # Specify the mode of the feature to be searched.
+    cmd: search                         # Specify the command to be searched.
+  options:                              # Specify the options for the audit function.
+    host: localhost                     # Specify the service host of the audit Redis server.However, if it is specified as a command line argument, it is ignored.
+    port: 6379                          # Specify the service port of the audit Redis server.However, if it is specified as a command line argument, it is ignored.
+    password: password                  # Specify the access password of the audit Redis server.However, if it is specified as a command line argument, it is ignored.
+    svname: cmdbox                      # Specify the audit service name of the inference server.However, if it is specified as a command line argument, it is ignored.
+    retry_count: 3                      # Specifies the number of reconnections to the audit Redis server.If less than 0 is specified, reconnection is forever.
+    retry_interval: 1                   # Specifies the number of seconds before reconnecting to the audit Redis server.
+    timeout: 15                         # Specify the maximum waiting time until the server responds.
+    pg_enabled: False                   # Specify True if using the postgresql database server.
+    pg_host: localhost                  # Specify the postgresql host.
+    pg_port: 5432                       # Specify the postgresql port.
+    pg_user: postgres                   # Specify the postgresql user name.
+    pg_password: password               # Specify the postgresql password.
+    pg_dbname: audit                    # Specify the postgresql database name.
+    retention_period_days: 365          # Specify the number of days to retain audit logs.
 
 ```
 
@@ -279,25 +327,25 @@ aliases:                                # Specify the alias for the specified co
 users:                         # A list of users, each of which is a map that contains the following fields.
 - uid: 1                       # An ID that identifies a user. No two users can have the same ID.
   name: admin                  # A name that identifies the user. No two users can have the same name.
-  password: XXXXXXXXXXX        # The user's password. The value is hashed with the hash function specified in the next hash field.
-  hash: plain                  # The hash function used to hash the password, which can be plain, md5, sha1, or sha256, or oauth2.
+  password: XXXXXXXXXXXXXXXX   # The user's password. The value is hashed with the hash function specified in the next hash field.
+  hash: plain                  # The hash function used to hash the password, which can be plain, md5, sha1, or sha256, or oauth2, or saml.
   groups: [admin]              # A list of groups to which the user belongs, as specified in the groups field.
-  email: admin@aaa.bbb.jp      # The email address of the user, used when authenticating using the provider specified in the oauth2 field.
+  email: admin@aaa.bbb.jp      # The email address of the user, used when authenticating using the provider specified in the oauth2 or saml field.
 - uid: 101
   name: user01
-  password: XXXXXXXXXXX
+  password: XXXXXXXXXXXXXXXX
   hash: md5
   groups: [user]
   email: user01@aaa.bbb.jp
 - uid: 102
   name: user02
-  password: XXXXXXXXXXX
+  password: XXXXXXXXXXXXXXXX
   hash: sha1
   groups: [readonly]
   email: user02@aaa.bbb.jp
 - uid: 103
   name: user03
-  password: XXXXXXXXXXX
+  password: XXXXXXXXXXXXXXXX
   hash: sha256
   groups: [editor]
   email: user03@aaa.bbb.jp
@@ -327,6 +375,10 @@ cmdrule:                       # A list of command rules, Specify a rule that de
     mode: server
     cmds: [list]
     rule: allow
+  - groups: [user, guest]
+    mode: audit
+    cmds: [write]
+    rule: allow
   - groups: [user, guest]
     mode: web
     cmds: [genpass]
@@ -347,7 +399,8 @@ pathrule:                      # List of RESTAPI rules, rules that determine whe
     rule: allow
   - groups: [user]
     paths: [/signin, /assets, /bbforce_cmd, /copyright, /dosignin, /dosignout, /password/change,
-            /exec_cmd, /exec_pipe, /filer, /gui, /get_server_opt, /usesignout, /versions_cmdbox, /versions_used]
+            /gui/user_data/load, /gui/user_data/save, /gui/user_data/delete,
+            /exec_cmd, /exec_pipe, /filer, /result, /gui, /get_server_opt, /usesignout, /versions_cmdbox, /versions_used]
     rule: allow
   - groups: [readonly]
     paths: [/gui/del_cmd, /gui/del_pipe, /gui/save_cmd, /gui/save_pipe]
@@ -382,7 +435,8 @@ oauth2:                             # OAuth2 settings.
       client_secret: XXXXXXXXXXX    # Specify Google's OAuth2 client secret.
       redirect_uri: https://localhost:8443/oauth2/google/callback # Specify Google's OAuth2 redirect URI.
       scope: ['email']              # Specify the scope you want to retrieve with Google's OAuth2. Usually, just reading the email is sufficient.
-      signin_module:                # Specify the module name that implements the sign-in. see, cmdbox.app.signin.SignIn
+      signin_module:                # Specify the module name that implements the sign-in.
+        cmdbox.app.auth.google_signin
       note:                         # Specify a description such as Google's OAuth2 reference site.
       - https://developers.google.com/identity/protocols/oauth2/web-server?hl=ja#httprest
     github:                         # OAuth2 settings for GitHub.
@@ -391,9 +445,50 @@ oauth2:                             # OAuth2 settings.
       client_secret: XXXXXXXXXXX    # Specify the GitHub OAuth2 client secret.
       redirect_uri: https://localhost:8443/oauth2/github/callback # Specify the OAuth2 redirect URI for GitHub.
       scope: ['user:email']         # Specify the scope you want to get from GitHub's OAuth2. Usually, just reading the email is sufficient.
-      signin_module:                # Specify the module name that implements the sign-in. see, cmdbox.app.signin.SignIn
+      signin_module:                # Specify the module name that implements the sign-in.
+        cmdbox.app.auth.github_signin
       note:                         # Specify a description, such as a reference site for OAuth2 on GitHub.
       - https://docs.github.com/ja/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps#scopes
+    azure:                          # OAuth2 settings for Azure AD.
+      enabled: false                # Specify whether to enable OAuth2 for Azure AD.
+      tenant_id: XXXXXXXXXXX        # Specify the tenant ID for Azure AD.
+      client_id: XXXXXXXXXXX        # Specify the OAuth2 client ID for Azure AD.
+      client_secret: XXXXXXXXXXX    # Specify the Azure AD OAuth2 client secret.
+      redirect_uri: https://localhost:8443/oauth2/azure/callback # Specify the OAuth2 redirect URI for Azure AD.
+      scope: ['openid', 'profile', 'email', 'https://graph.microsoft.com/mail.read']
+      signin_module:                # Specify the module name that implements the sign-in.
+        cmdbox.app.auth.azure_signin
+      note:                         # Specify a description, such as a reference site for Azure AD's OAuth2.
+      - https://learn.microsoft.com/ja-jp/entra/identity-platform/v2-oauth2-auth-code-flow
+saml:                               # SAML settings.
+  providers:                        # This is a per-provider setting for OAuth2.
+    azure:                          # SAML settings for Azure AD.
+      enabled: false                # Specify whether to enable SAML authentication for Azure AD.
+      signin_module:                # Specify the module name that implements the sign-in.
+        cmdbox.app.auth.azure_signin_saml # Specify the python3-saml configuration.
+                                    # see) https://github.com/SAML-Toolkits/python3-saml
+      sp:
+        entityId: https://localhost:8443/
+        assertionConsumerService:
+          url: https://localhost:8443/saml/azure/callback
+          binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
+        attributeConsumingService: {}
+        singleLogoutService:
+          binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
+        NameIDFormat: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
+        x509cert: ''
+        privateKey: ''
+      idp:
+        entityId: https://sts.windows.net/{tenant-id}/
+        singleSignOnService:
+          url: https://login.microsoftonline.com/{tenant-id}/saml2
+          binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
+        x509cert: XXXXXXXXXXX
+        singleLogoutService: {}
+        certFingerprint: ''
+        certFingerprintAlgorithm: sha1
+
+
 ```
 
 - See the documentation for references to each file.

cmdbox-0.6.0/cmdbox/app/auth/azure_signin.py

@@ -0,0 +1,38 @@
+from cmdbox.app.auth.signin import Signin
+from fastapi import Request, Response
+from typing import Any, Dict
+import requests
+import urllib
+
+
+class AzureSignin(Signin):
+    @classmethod
+    def get_email(cls, data:Any) -> str:
+        user_info_resp = requests.get(
+            url='https://graph.microsoft.com/v1.0/me',
+            #url='https://graph.microsoft.com/v1.0/me/transitiveMemberOf?$Top=999',
+            headers={'Authorization': f'Bearer {data}'}
+        )
+        user_info_resp.raise_for_status()
+        user_info_json = user_info_resp.json()
+        if isinstance(user_info_json, dict):
+            email = user_info_json.get('mail', 'notfound')
+            return email
+        return 'notfound'
+    
+    def request_access_token(self, conf:Dict, req:Request, res:Response) -> str:
+        headers = {'Content-Type': 'application/x-www-form-urlencoded',
+                    'Accept': 'application/json'}
+        data = {'tenant': conf['tenant_id'],
+                'code': req.query_params['code'],
+                'scope': " ".join(conf['scope']),
+                'client_id': conf['client_id'],
+                #'client_secret': conf['client_secret'],
+                'redirect_uri': conf['redirect_uri'],
+                'grant_type': 'authorization_code'}
+        query = '&'.join([f'{k}={urllib.parse.quote(v)}' for k, v in data.items()])
+        # アクセストークン取得
+        token_resp = requests.post(url=f'https://login.microsoftonline.com/{conf["tenant_id"]}/oauth2/v2.0/token', headers=headers, data=query)
+        token_resp.raise_for_status()
+        token_json = token_resp.json()
+        return token_json['access_token']

cmdbox-0.6.0/cmdbox/app/auth/azure_signin_saml.py

@@ -0,0 +1,12 @@
+from cmdbox.app.auth.signin_saml import SigninSAML
+from typing import Any
+
+
+class AzyreSigninSAML(SigninSAML):
+    @classmethod
+    def get_email(cls, data:Any) -> str:
+        user_info_json = data.get_attributes()
+        if isinstance(user_info_json, dict):
+            email = user_info_json.get('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress', ['notfound'])
+            return email[0] if len(email) > 0 else 'notfound'
+        return 'notfound'

cmdbox-0.6.0/cmdbox/app/auth/github_signin.py

@@ -0,0 +1,38 @@
+from cmdbox.app.auth.signin import Signin
+from fastapi import Request, Response
+from typing import Any, Dict
+import requests
+import urllib.parse
+
+
+class GithubSignin(Signin):
+    @classmethod
+    def get_email(cls, data:Any) -> str:
+        user_info_resp = requests.get(
+            url='https://api.github.com/user/emails',
+            headers={'Authorization': f'Bearer {data}'}
+        )
+        user_info_resp.raise_for_status()
+        user_info_json = user_info_resp.json()
+        if type(user_info_json) == list:
+            email = 'notfound'
+            for u in user_info_json:
+                if u['primary']:
+                    email = u['email']
+                    break
+            return email
+        return 'notfound'
+
+    def request_access_token(self, conf:Dict, req:Request, res:Response) -> str:
+        headers = {'Content-Type': 'application/x-www-form-urlencoded',
+                    'Accept': 'application/json'}
+        data = {'code': req.query_params['code'],
+                'client_id': conf['client_id'],
+                'client_secret': conf['client_secret'],
+                'redirect_uri': conf['redirect_uri']}
+        query = '&'.join([f'{k}={urllib.parse.quote(v)}' for k, v in data.items()])
+        # アクセストークン取得
+        token_resp = requests.post(url='https://github.com/login/oauth/access_token', headers=headers, data=query)
+        token_resp.raise_for_status()
+        token_json = token_resp.json()
+        return token_json['access_token']

cmdbox-0.6.0/cmdbox/app/auth/google_signin.py

@@ -0,0 +1,32 @@
+from cmdbox.app.auth.signin import Signin
+from fastapi import Request, Response
+from typing import Any, Dict
+import requests
+import urllib.parse
+
+
+class GoogleSignin(Signin):
+    @classmethod
+    def get_email(cls, data:Any) -> str:
+        user_info_resp = requests.get(
+            url='https://www.googleapis.com/oauth2/v1/userinfo',
+            headers={'Authorization': f'Bearer {data}'}
+        )
+        user_info_resp.raise_for_status()
+        user_info_json = user_info_resp.json()
+        return user_info_json['email'] if 'email' in user_info_json else 'notfound'
+
+    def request_access_token(self, conf:Dict, req:Request, res:Response) -> str:
+        headers = {'Content-Type': 'application/x-www-form-urlencoded'}
+        next = req.query_params['state']
+        data = {'code': req.query_params['code'],
+                'client_id': conf['client_id'],
+                'client_secret': conf['client_secret'],
+                'redirect_uri': conf['redirect_uri'],
+                'grant_type': 'authorization_code'}
+        query = '&'.join([f'{k}={urllib.parse.quote(v)}' for k, v in data.items()])
+        # アクセストークン取得
+        token_resp = requests.post(url='https://oauth2.googleapis.com/token', headers=headers, data=query)
+        token_resp.raise_for_status()
+        token_json = token_resp.json()
+        return token_json['access_token']