keycloakauthenticator 3.3.0__tar.gz → 4.0.1__tar.gz

{keycloakauthenticator-3.3.0 → keycloakauthenticator-4.0.1}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: keycloakauthenticator
-Version: 3.3.0
+Version: 4.0.1
 Summary: KeyCloakAuthenticator: Authenticate JupyterHub users with KeyCloak and OIDC
 Home-page: https://github.com/swan-cern/jupyterhub-extensions
 Author: SWAN Admins
@@ -15,6 +15,19 @@ Classifier: Intended Audience :: Science/Research
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 3
 Description-Content-Type: text/markdown
+Requires-Dist: jupyterhub
+Requires-Dist: oauthenticator==16.1.0
+Requires-Dist: PyJWT[crypto]>=2.0.0
+Dynamic: author
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: keywords
+Dynamic: license
+Dynamic: platform
+Dynamic: requires-dist
+Dynamic: summary
 
 # KeyCloakAuthenticator
 
@@ -47,7 +60,7 @@ In your JupyterHub config file, set the authenticator and configure it:
 ```python
 # Enable the authenticator
 c.JupyterHub.authenticator_class = 'keycloakauthenticator.KeyCloakAuthenticator'
-c.KeyCloakAuthenticator.username_key = 'preferred_username'
+c.KeyCloakAuthenticator.username_claim = 'preferred_username'
 
 # URL to redirect to after logout is complete with auth provider.
 c.KeyCloakAuthenticator.logout_redirect_url = 'https://cern.ch/swan'

{keycloakauthenticator-3.3.0 → keycloakauthenticator-4.0.1}/README.md

@@ -29,7 +29,7 @@ In your JupyterHub config file, set the authenticator and configure it:
 ```python
 # Enable the authenticator
 c.JupyterHub.authenticator_class = 'keycloakauthenticator.KeyCloakAuthenticator'
-c.KeyCloakAuthenticator.username_key = 'preferred_username'
+c.KeyCloakAuthenticator.username_claim = 'preferred_username'
 
 # URL to redirect to after logout is complete with auth provider.
 c.KeyCloakAuthenticator.logout_redirect_url = 'https://cern.ch/swan'

{keycloakauthenticator-3.3.0 → keycloakauthenticator-4.0.1}/keycloakauthenticator/_version.py

@@ -1,3 +1,3 @@
 # please don't modify this file,
 # this is automatically updated by bump2version
-__version__ = '3.3.0'
+__version__ = '4.0.1'

{keycloakauthenticator-3.3.0 → keycloakauthenticator-4.0.1}/keycloakauthenticator/auth.py

@@ -153,8 +153,7 @@ class KeyCloakAuthenticator(GenericOAuthenticator):
         # Try to load the configs until it succeeds
         while True:
             try:
-                req = HTTPRequest(f"{self.oidc_issuer}/.well-known/openid-configuration", headers=self._get_headers())
-                data = await self.fetch(req, "fetching oidc config")
+                data = await self.httpfetch(f"{self.oidc_issuer}/.well-known/openid-configuration", label="fetching oidc config")
 
                 if not set(['authorization_endpoint', 'token_endpoint', 'userinfo_endpoint']).issubset(data.keys()):
                     raise Exception('Unable to retrieve OIDC necessary values')
@@ -166,15 +165,15 @@ class KeyCloakAuthenticator(GenericOAuthenticator):
                 end_session_url = data.get('end_session_endpoint')
                 if self.enable_logout and end_session_url:
                     if self.logout_redirect_url:
-                        end_session_url += '?redirect_uri=%s' % self.logout_redirect_url
+                        end_session_url += '?post_logout_redirect_uri=%s' % self.logout_redirect_url
+                        end_session_url += '&client_id=%s' % self.client_id
                     # Update parent class OAuthenticator.logout_redirect_url
                     self.logout_redirect_url = end_session_url 
 
                 if self.config.check_signature :
                     jwks_uri = data['jwks_uri']
 
-                    req = HTTPRequest(jwks_uri, headers=self._get_headers())
-                    jwk_data = await self.fetch(req, "fetching jwks")
+                    jwk_data = await self.httpfetch(jwks_uri, label="fetching jwks")
                     self.public_key = RSAAlgorithm(RSAAlgorithm.SHA256).from_jwk(jwk_data['keys'][0])
                     self.log.info(f"aquired public key from {jwks_uri}")
                 else:
@@ -185,7 +184,7 @@ class KeyCloakAuthenticator(GenericOAuthenticator):
                 self.log.info('KeycloakAuthenticator fully configured')
                 break
             except:
-                self.log.error("Failure to retrieve the openid configuration, will try again in 1 min (auth calls will fail)")
+                self.log.error("Failure to retrieve the openid configuration, will try again in 1 min (auth calls will fail)", exc_info=True)
                 await asyncio.sleep(60)
 
     def _validate_roles(self, user_roles):
@@ -216,14 +215,14 @@ class KeyCloakAuthenticator(GenericOAuthenticator):
                 client_secret = self.client_secret,
                 subject_token = token,
                 audience = service_name,
-                requested_token_type = 'urn:ietf:params:oauth:token-type:access_token'
+                requested_token_type = 'urn:ietf:params:oauth:token-type:access_token',
+                subject_token_type = 'urn:ietf:params:oauth:token-type:access_token'
             )
             data = parse.urlencode(values)
 
             req = HTTPRequest(
                 self.token_url,
                 method="POST",
-                headers=self._get_headers(),
                 body=data,
             )
 
@@ -250,7 +249,7 @@ class KeyCloakAuthenticator(GenericOAuthenticator):
             access_tokens[service_name] = access_token
 
             # Produce logs and metrics for this token exchange
-            queue_t = response.time_info['queue']
+            queue_t = response.time_info['queue'] if 'queue' in response.time_info else -1
             request_t = response.request_time
             self.log.info('Exchanged {} token, queue time: {} s, request time: {} s'.format(service_name, queue_t, request_t))
             metric_exchange_tornado_queue_time.labels("exchange_token_{}".format(service_name.replace("-","_"))).observe(queue_t)            
@@ -269,16 +268,13 @@ class KeyCloakAuthenticator(GenericOAuthenticator):
                 refresh_token = refresh_token
             )
             data = parse.urlencode(values)
-
-            req = HTTPRequest(
-                self.token_url,
-                method="POST",
-                headers=self._get_headers(),
-                body=data,
-            )
             access_t = None
             refresh_t = None
-            response = await self.fetch(req, "refreshing token", parse_json=False)
+            response = await self.httpfetch(self.token_url,
+                                            label="refreshing token",
+                                            method="POST",
+                                            body=data,
+                                            parse_json=False)
             if response.body:
                 body = json.loads(response.body.decode('utf8', 'replace'))
                 access_t = body.get('access_token', None)
@@ -289,7 +285,8 @@ class KeyCloakAuthenticator(GenericOAuthenticator):
                self.log.error("Could not obtain refresh token for swan") 
             
             metric_refresh_tornado_request_time.labels("refresh_token",response.code).observe(response.request_time)
-            metric_refresh_tornado_queue_time.observe(response.time_info.get('queue'))
+            queue_t = response.time_info['queue'] if 'queue' in response.time_info else -1
+            metric_refresh_tornado_queue_time.observe(queue_t)
             self.log.info('Refresh token request completed in {} seconds'.format(time.time() - start))
             return access_t, refresh_t
     

{keycloakauthenticator-3.3.0 → keycloakauthenticator-4.0.1}/keycloakauthenticator/tests/test_auth.py

@@ -50,19 +50,20 @@ async def test_refresh_user(monkeypatch):
     monkeypatch.setattr(KeyCloakAuthenticator, "oidc_issuer", "dummy-oidc-url")
 
     # Mock the response from the server on refresh and exchange tokens
-    async def _mock_fetch(self, request, label, parse_json):
-        print("Mocking fetch for ", request, label)
+    async def _mock_fetch(self, req, label, **kargs):
+        print(f"Mocking fetch for {req} ({label})")
         mock_response_body = json.dumps({ 
             "access_token": _get_mock_token(private_key, "new_access_token"),
             "refresh_token": _get_mock_token(private_key, "new_refresh_token"),
             })
+
         class MockResponse:
             def __init__(self):
                 self.code = 200
                 self.body = mock_response_body.encode('utf-8')
                 self.request_time = 0
-                self.time_info ={
-                "queue": 0
+                self.time_info = {
+                    "queue": 0
                 }
         return MockResponse()
     monkeypatch.setattr(KeyCloakAuthenticator, "fetch", _mock_fetch)
@@ -120,22 +121,23 @@ async def test_refresh_user_with_expired_refresh_token(monkeypatch):
     # Mock the response from the server on refresh and exchange tokens
     monkeypatch.setattr(KeyCloakAuthenticator, "oidc_issuer", "dummy-oidc-url")
 
-    async def _mock_fetch(self, request, label, parse_json):
-        print("Mocking fetch for ", request, label)
+    async def _mock_httpfetch(self, url, label, **kargs):
+        print(f"Mocking httpfetch for {url} ({label})")
         mock_response_body = json.dumps({ 
             "access_token": _get_mock_token(private_key, "new_access_token"),
             "refresh_token": _get_mock_token(private_key, "new_refresh_token"),
             })
+
         class MockResponse:
             def __init__(self):
                 self.code = 200
                 self.body = mock_response_body.encode('utf-8')
                 self.request_time = 0
-                self.time_info ={
-                "queue": 0
+                self.time_info = {
+                    "queue": 0
                 }
         return MockResponse()
-    monkeypatch.setattr(KeyCloakAuthenticator, "fetch", _mock_fetch)
+    monkeypatch.setattr(KeyCloakAuthenticator, "httpfetch", _mock_httpfetch)
 
     class MockUser:
         """Fake user object, with dummy authentication state from DB"""

{keycloakauthenticator-3.3.0 → keycloakauthenticator-4.0.1}/keycloakauthenticator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: keycloakauthenticator
-Version: 3.3.0
+Version: 4.0.1
 Summary: KeyCloakAuthenticator: Authenticate JupyterHub users with KeyCloak and OIDC
 Home-page: https://github.com/swan-cern/jupyterhub-extensions
 Author: SWAN Admins
@@ -15,6 +15,19 @@ Classifier: Intended Audience :: Science/Research
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 3
 Description-Content-Type: text/markdown
+Requires-Dist: jupyterhub
+Requires-Dist: oauthenticator==16.1.0
+Requires-Dist: PyJWT[crypto]>=2.0.0
+Dynamic: author
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: keywords
+Dynamic: license
+Dynamic: platform
+Dynamic: requires-dist
+Dynamic: summary
 
 # KeyCloakAuthenticator
 
@@ -47,7 +60,7 @@ In your JupyterHub config file, set the authenticator and configure it:
 ```python
 # Enable the authenticator
 c.JupyterHub.authenticator_class = 'keycloakauthenticator.KeyCloakAuthenticator'
-c.KeyCloakAuthenticator.username_key = 'preferred_username'
+c.KeyCloakAuthenticator.username_claim = 'preferred_username'
 
 # URL to redirect to after logout is complete with auth provider.
 c.KeyCloakAuthenticator.logout_redirect_url = 'https://cern.ch/swan'

{keycloakauthenticator-3.3.0 → keycloakauthenticator-4.0.1}/keycloakauthenticator.egg-info/requires.txt

@@ -1,3 +1,3 @@
 jupyterhub
-oauthenticator==15.0.0
+oauthenticator==16.1.0
 PyJWT[crypto]>=2.0.0

{keycloakauthenticator-3.3.0 → keycloakauthenticator-4.0.1}/setup.py

@@ -23,7 +23,7 @@ setup_args = dict(
     packages=setuptools.find_packages(),
     install_requires=[
         'jupyterhub',
-        'oauthenticator==15.0.0',
+        'oauthenticator==16.1.0',
         'PyJWT[crypto]>=2.0.0'
     ],
     zip_safe=False,