mitid-connect 0.0.1__py3-none-any.whl

mitid_connect/__init__.py

@@ -0,0 +1,29 @@
+"""Log in through MitID from Python: an unofficial implementation of MitID's browser client.
+
+It authenticates with the MitID app (QR code or one-time code) or a code token, and gives back
+the authorization code the service being logged in to exchanges for its own tokens.
+"""
+
+from importlib.metadata import PackageNotFoundError, version
+
+from .browser_client import BrowserClient
+from .helpers import (
+    choose_between_multiple_identitites,
+    generate_nem_login_parameters,
+    get_authentication_code,
+)
+from .srp import CustomSRP
+
+try:
+    __version__ = version("mitid_connect")
+except PackageNotFoundError:  # pragma: no cover - only in a checkout that is not installed
+    __version__ = "0.0.0"
+
+__all__ = [
+    "BrowserClient",
+    "CustomSRP",
+    "__version__",
+    "choose_between_multiple_identitites",
+    "generate_nem_login_parameters",
+    "get_authentication_code",
+]

mitid_connect/browser_client.py

@@ -0,0 +1,813 @@
+import requests, time, hashlib, base64, hmac, qrcode, threading, json, logging
+from .srp import CustomSRP, hex_to_bytes, bytes_to_hex, pad
+
+_LOGGER = logging.getLogger(__name__)
+
+
+DEFAULT_TIMEOUT = 30
+
+
+class BrowserClient:
+    def __init__(
+        self,
+        client_hash: str,
+        authentication_session_id: str,
+        requests_session=None,
+        timeout: int = DEFAULT_TIMEOUT,
+    ):
+        self.qr_display_thread_lock = threading.Lock()
+        self.session = requests_session if requests_session is not None else requests.Session()
+        self.timeout = timeout
+
+        self.client_hash = client_hash
+        self.authentication_session_id = authentication_session_id
+
+        r = self.session.get(
+            f"https://www.mitid.dk/mitid-core-client-backend/v1/authentication-sessions/{authentication_session_id}",
+            timeout=self.timeout,
+        )
+        if r.status_code != 200:
+            _LOGGER.error(
+                f"Failed to get authentication session ({authentication_session_id}), status code {r.status_code}"
+            )
+            raise Exception(r.content)
+
+        r = r.json()
+        # This is all needed for flowValueProofs later on
+        self.broker_security_context = r["brokerSecurityContext"]
+        self.service_provider_name = r["serviceProviderName"]
+        self.reference_text_header = r["referenceTextHeader"]
+        self.reference_text_body = r["referenceTextBody"]
+        self.status_message = (
+            f"Beginning login session for {self.service_provider_name}"
+        )
+        _LOGGER.info(f"Beginning login session for {self.service_provider_name}")
+        _LOGGER.debug(f"{self.reference_text_header}")
+        _LOGGER.debug(f"{self.reference_text_body}")
+
+    def __display_qr_ascii(self, stop_event):
+
+        frame = True
+        while not stop_event.is_set():
+            # os.system("cls" if os.name == "nt" else "clear")
+            # print("Scan this QR Code in the app:")
+            qr1, qr2 = self.__get_qr_codes()
+            # print(render_qr(qr1) if frame else render_qr(qr2))
+            frame = not frame
+            stop_event.wait(1)
+
+    def __set_qr_codes(self, qr1, qr2):
+        with self.qr_display_thread_lock:
+            self.qr1 = qr1
+            self.qr2 = qr2
+
+    def __get_qr_codes(self):
+        with self.qr_display_thread_lock:
+            return self.qr1, self.qr2
+
+    def get_current_qr_codes(self):
+        """Get current QR codes for external display (e.g., Home Assistant GUI)."""
+        try:
+            return self.__get_qr_codes()
+        except AttributeError:
+            return None
+
+    def start_app_authentication(self):
+        """Start APP authentication and return poll information."""
+        self.__select_authenticator("APP")
+
+        r = self.session.post(
+            f"https://www.mitid.dk/mitid-code-app-auth/v1/authenticator-sessions/web/{self.current_authenticator_session_id}/init-auth",
+            json={},
+            timeout=self.timeout,
+        )
+        if r.status_code != 200:
+            raise Exception(f"Failed to request app login, status code {r.status_code}")
+
+        r = r.json()
+        if (
+            "errorCode" in r
+            and r["errorCode"]
+            == "auth.codeapp.authentication.parallel_sessions_detected"
+        ):
+            raise Exception("Parallel app sessions detected")
+
+        self.poll_url = r["pollUrl"]
+        self.ticket = r["ticket"]
+        self.auth_status = "waiting"
+        self.status_message = "Waiting for MitID app"
+        self.otp_code = None
+        return {"poll_url": self.poll_url, "ticket": self.ticket}
+
+    def poll_app_authentication_status(self):
+        """Poll once for APP authentication status. Returns status dict."""
+        if not hasattr(self, "poll_url"):
+            raise Exception(
+                "Authentication not started - call start_app_authentication() first"
+            )
+
+        r = self.session.post(self.poll_url, json={"ticket": self.ticket}, timeout=self.timeout)
+
+        if r.status_code != 200:
+            return {"status": "error", "message": "Poll request failed"}
+
+        data = r.json()
+        status = data.get("status")
+
+        if status == "timeout":
+            return {"status": "waiting", "message": "Waiting for response..."}
+
+        elif status == "channel_validation_otp":
+            self.otp_code = data["channelBindingValue"]
+            self.status_message = f"Use OTP code: {self.otp_code}"
+            return {
+                "status": "otp_ready",
+                "message": self.status_message,
+                "otp_code": self.otp_code,
+            }
+
+        elif status == "channel_validation_tqr":
+            # Generate QR codes
+            channel_binding = data["channelBindingValue"]
+            half = int(len(channel_binding) / 2)
+
+            qr_data_1 = {
+                "v": 1,
+                "p": 1,
+                "t": 2,
+                "h": channel_binding[:half],
+                "uc": data["updateCount"],
+            }
+            qr1 = qrcode.QRCode(border=1)
+            qr1.add_data(json.dumps(qr_data_1, separators=(",", ":")))
+            qr1.make()
+
+            qr_data_2 = {
+                "v": 1,
+                "p": 2,
+                "t": 2,
+                "h": channel_binding[half:],
+                "uc": data["updateCount"],
+            }
+            qr2 = qrcode.QRCode(border=1)
+            qr2.add_data(json.dumps(qr_data_2, separators=(",", ":")))
+            qr2.make()
+
+            self.__set_qr_codes(qr1, qr2)
+            self.status_message = "Scan QR code with MitID app"
+            return {"status": "qr_ready", "message": self.status_message}
+
+        elif status == "channel_verified":
+            self.status_message = "QR verified, waiting for approval"
+            return {"status": "verified", "message": self.status_message}
+
+        elif status == "OK" and data.get("confirmation") == True:
+            # Authentication completed
+            self.auth_response = data["payload"]["response"]
+            self.auth_response_signature = data["payload"]["responseSignature"]
+            return {"status": "completed", "message": "Authentication successful"}
+
+        else:
+            return {"status": "error", "message": "Authentication was not accepted"}
+
+    def complete_app_authentication(self):
+        """Complete APP authentication after polling succeeds. Returns finalization session ID."""
+        if not hasattr(self, "auth_response"):
+            raise Exception(
+                "Authentication not completed - poll until status is 'completed'"
+            )
+
+        # SRP protocol stages
+        timer_1 = time.time()
+        SRP = CustomSRP()
+        A = SRP.SRPStage1()
+
+        r = self.session.post(
+            f"https://www.mitid.dk/mitid-code-app-auth/v1/authenticator-sessions/web/{self.current_authenticator_session_id}/init",
+            json={"randomA": {"value": A}},
+            timeout=self.timeout,
+        )
+        if r.status_code != 200:
+            raise Exception(f"Failed to init app protocol, status code {r.status_code}")
+
+        srpSalt = r.json()["srpSalt"]["value"]
+        randomB = r.json()["randomB"]["value"]
+
+        m = hashlib.sha256()
+        m.update(
+            base64.b64decode(self.auth_response)
+            + self.current_authenticator_session_flow_key.encode("utf8")
+        )
+        password = m.hexdigest()
+
+        m1 = SRP.SRPStage3(
+            srpSalt, randomB, password, self.current_authenticator_session_id
+        )
+
+        unhashed_flow_value_proof = self.__create_flow_value_proof()
+        m = hashlib.sha256()
+        unhashed_flow_value_proof_key = "flowValues" + bytes_to_hex(SRP.K_bits)
+        m.update(unhashed_flow_value_proof_key.encode("utf8"))
+        hashed_flow_value_proof_key = m.hexdigest()
+        hmac_flow_value_proof = hmac.new(
+            hex_to_bytes(hashed_flow_value_proof_key),
+            unhashed_flow_value_proof,
+            hashlib.sha256,
+        ).digest()
+        flow_value_proof = base64.b64encode(hmac_flow_value_proof).decode("ascii")
+
+        # Complete authentication
+        r = self.session.post(
+            f"https://www.mitid.dk/mitid-code-app-auth/v1/authenticator-sessions/web/{self.current_authenticator_session_id}/complete",
+            json={"M1": {"value": m1}, "flowValueProof": {"value": flow_value_proof}},
+            timeout=self.timeout,
+        )
+        if r.status_code != 200:
+            raise Exception(
+                f"Failed to complete app authentication, status code {r.status_code}"
+            )
+
+        self.status_message = "App login was accepted, finalizing authentication"
+        _LOGGER.info(
+            "App login was accepted, you can now finalize authentication and receive your authorization code"
+        )
+        self.finalization_authentication_session_id = r.json()[
+            "authenticationSessionId"
+        ]
+        return self.finalization_authentication_session_id
+
+    def __convert_human_authenticator_name_to_combination_id(self, authenticator_name):
+        match authenticator_name:
+            case "APP":
+                return "S3"
+            case "TOKEN":
+                return "S1"
+            case _:
+                raise Exception(f"No such authenticator name ({authenticator_name})")
+
+    def __convert_combination_id_to_human_authenticator_name(self, combination_id):
+        match combination_id:
+            case "S4":  # App + MitID chip
+                return "APP"
+            case "S3":
+                return "APP"
+            case "L2":
+                return "APP"
+            case "S1":
+                return "TOKEN"
+            case _:
+                raise Exception(f"No such combination ID ({combination_id})")
+
+    def identify_as_user_and_get_available_authenticators(self, user_id):
+        self.user_id = user_id
+        r = self.session.put(
+            f"https://www.mitid.dk/mitid-core-client-backend/v1/authentication-sessions/{self.authentication_session_id}",
+            json={"identityClaim": user_id},
+            timeout=self.timeout,
+        )
+
+        if r.status_code != 200:
+            _LOGGER.error(
+                f"Received status code ({r.status_code}) while attempting to identify as user ({user_id})"
+            )
+            if (
+                r.status_code == 400
+                and r.json()["errorCode"] == "control.identity_not_found"
+            ):
+                _LOGGER.error(f"User '{user_id}' does not exist.")
+                raise Exception(r.content)
+
+            if (
+                r.status_code == 400
+                and r.json()["errorCode"] == "control.authentication_session_not_found"
+            ):
+                _LOGGER.error("Authentication session not found")
+                raise Exception(r.content)
+
+            raise Exception(r.content)
+
+        r = self.session.post(
+            f"https://www.mitid.dk/mitid-core-client-backend/v2/authentication-sessions/{self.authentication_session_id}/next",
+            json={"combinationId": ""},
+            timeout=self.timeout,
+        )
+
+        if r.status_code != 200:
+            _LOGGER.error(
+                f"Received status code ({r.status_code}) while attempting to get authenticators for user ({user_id})"
+            )
+            raise Exception(r.content)
+
+        r = r.json()
+        if (
+            r["errors"]
+            and len(r["errors"]) > 0
+            and r["errors"][0]["errorCode"] == "control.authenticator_cannot_be_started"
+        ):
+            error_text = r["errors"][0]["userMessage"]["text"]["text"]
+            _LOGGER.error(
+                f"Could not get authenticators, got the following error text: {error_text}"
+            )
+            raise Exception(error_text)
+
+        self.current_authenticator_type = r["nextAuthenticator"]["authenticatorType"]
+        self.current_authenticator_session_flow_key = r["nextAuthenticator"][
+            "authenticatorSessionFlowKey"
+        ]
+        self.current_authenticator_eafe_hash = r["nextAuthenticator"]["eafeHash"]
+        self.current_authenticator_session_id = r["nextAuthenticator"][
+            "authenticatorSessionId"
+        ]
+
+        available_combinations = r["combinations"]
+        available_authenticators = {}
+        for available_combination in available_combinations:
+            available_authenticators[
+                self.__convert_combination_id_to_human_authenticator_name(
+                    available_combination["id"]
+                )
+            ] = available_combination["combinationItems"][0]["name"]
+
+        return available_authenticators
+
+    def __create_flow_value_proof(self):
+        hashed_broker_security_context = hashlib.sha256(
+            self.broker_security_context.encode("utf8")
+        ).hexdigest()
+        base64_reference_text_header = base64.b64encode(
+            (self.reference_text_header.encode("utf8"))
+        ).decode("ascii")
+        base64_reference_text_body = base64.b64encode(
+            (self.reference_text_body.encode("utf8"))
+        ).decode("ascii")
+        base64_service_provider_name = base64.b64encode(
+            (self.service_provider_name.encode("utf8"))
+        ).decode("ascii")
+        return f"{self.current_authenticator_session_id},{self.current_authenticator_session_flow_key},{self.client_hash},{self.current_authenticator_eafe_hash},{hashed_broker_security_context},{base64_reference_text_header},{base64_reference_text_body},{base64_service_provider_name}".encode(
+            "utf-8"
+        )
+
+    def __select_authenticator(self, authenticator_type: str):
+        if authenticator_type == self.current_authenticator_type:
+            return
+
+        combination_id = self.__convert_human_authenticator_name_to_combination_id(
+            authenticator_type
+        )
+
+        r = self.session.post(
+            f"https://www.mitid.dk/mitid-core-client-backend/v2/authentication-sessions/{self.authentication_session_id}/next",
+            json={"combinationId": combination_id},
+            timeout=self.timeout,
+        )
+
+        if r.status_code != 200:
+            _LOGGER.error(
+                f"Received status code ({r.status_code}) while attempting to get authenticators for user ({self.user_id})"
+            )
+            raise Exception(r.content)
+
+        r = r.json()
+        if (
+            r["errors"]
+            and len(r["errors"]) > 0
+            and r["errors"][0]["errorCode"] == "control.authenticator_cannot_be_started"
+        ):
+            error_text = r["errors"][0]["userMessage"]["text"]["text"]
+            _LOGGER.error(
+                f"Could not get authenticators, got the following error text: {error_text}"
+            )
+            raise Exception(error_text)
+
+        self.current_authenticator_type = r["nextAuthenticator"]["authenticatorType"]
+        self.current_authenticator_session_flow_key = r["nextAuthenticator"][
+            "authenticatorSessionFlowKey"
+        ]
+        self.current_authenticator_eafe_hash = r["nextAuthenticator"]["eafeHash"]
+        self.current_authenticator_session_id = r["nextAuthenticator"][
+            "authenticatorSessionId"
+        ]
+
+        if self.current_authenticator_type != authenticator_type:
+            raise Exception(
+                f"Was not able to choose the desired authenticator ({authenticator_type}), instead we received ({self.current_authenticator_type})"
+            )
+
+    def authenticate_with_token(self, token_digits: str):
+        self.__select_authenticator("TOKEN")
+
+        timer_1 = time.time()
+        SRP = CustomSRP()
+        A = SRP.SRPStage1()
+        timer_1 = time.time() - timer_1
+
+        r = self.session.post(
+            f"https://www.mitid.dk/mitid-code-token-auth/v1/authenticator-sessions/{self.current_authenticator_session_id}/codetoken-init",
+            json={"randomA": {"value": A}},
+            timeout=self.timeout,
+        )
+        if r.status_code != 200:
+            _LOGGER.error(
+                f"Failed to init TOTP code protocol, status code {r.status_code}"
+            )
+            raise Exception(r.content)
+
+        timer_2 = time.time()
+        r = r.json()
+        # pbkdfSalt is not actually used even though we receive it, what the hell are they doing here?
+        # This seems like schlock
+        # pbkdfSalt = r["pbkdf2Salt"]["value"]
+        srpSalt = r["srpSalt"]["value"]
+        randomB = r["randomB"]["value"]
+
+        m1 = SRP.SRPStage3(
+            srpSalt,
+            randomB,
+            bytes_to_hex(self.current_authenticator_session_flow_key.encode("utf-8")),
+            self.current_authenticator_session_id,
+        )
+
+        unhashed_flow_value_proof = self.__create_flow_value_proof()
+        m = hashlib.sha256()
+        unhashed_flow_value_proof_key = "OTP" + token_digits + bytes_to_hex(SRP.K_bits)
+        m.update(unhashed_flow_value_proof_key.encode("utf8"))
+        flow_value_proof_key = m.digest()
+
+        flow_value_proof = hmac.new(
+            flow_value_proof_key, unhashed_flow_value_proof, hashlib.sha256
+        ).hexdigest()
+
+        timer_2 = time.time() - timer_2
+        front_end_processing_time = int((timer_1 + timer_2) * 1000)
+
+        r = self.session.post(
+            f"https://www.mitid.dk/mitid-code-token-auth/v1/authenticator-sessions/{self.current_authenticator_session_id}/codetoken-prove",
+            json={
+                "m1": {"value": m1},
+                "flowValueProof": {"value": flow_value_proof},
+                "frontEndProcessingTime": front_end_processing_time,
+            },
+            timeout=self.timeout,
+        )
+        if r.status_code != 204:
+            _LOGGER.error(f"Failed to submit TOTP code, status code {r.status_code}")
+            raise Exception(r.content)
+
+        r = self.session.post(
+            f"https://www.mitid.dk/mitid-core-client-backend/v2/authentication-sessions/{self.authentication_session_id}/next",
+            json={"combinationId": ""},
+            timeout=self.timeout,
+        )
+        if r.status_code != 200:
+            _LOGGER.error(f"Failed to prove TOTP code, status code {r.status_code}")
+            raise Exception(r.content)
+
+        if (
+            r.json()["errors"]
+            and len(r.json()["errors"]) > 0
+            and r.json()["errors"][0]["errorCode"] == "TOTP_INVALID"
+        ):
+            error_text = r.json()["errors"][0]["message"]
+            _LOGGER.error(
+                f"Could not log in with the provided TOTP code, got the following message: {error_text}"
+            )
+            raise Exception(r.content)
+
+        r = r.json()
+        if (
+            "nextAuthenticator" not in r
+            or "authenticatorType" not in r["nextAuthenticator"]
+            or r["nextAuthenticator"]["authenticatorType"] != "PASSWORD"
+        ):
+            _LOGGER.error(
+                f"Ran into an unexpected situation, was expecting to be asked for password after TOTP but got the following response"
+            )
+            raise Exception(r.content)
+
+        self.current_authenticator_type = r["nextAuthenticator"]["authenticatorType"]
+        self.current_authenticator_session_flow_key = r["nextAuthenticator"][
+            "authenticatorSessionFlowKey"
+        ]
+        self.current_authenticator_eafe_hash = r["nextAuthenticator"]["eafeHash"]
+        self.current_authenticator_session_id = r["nextAuthenticator"][
+            "authenticatorSessionId"
+        ]
+        _LOGGER.info("Token code accepted, you now need to validate your password")
+
+    def authenticate_with_password(self, password: str):
+        if self.current_authenticator_type != "PASSWORD":
+            raise Exception(
+                f"You cannot authenticate with password before completing authentication with token code, the current authenticator type was ({self.current_authenticator_type})"
+            )
+
+        timer_1 = time.time()
+        SRP = CustomSRP()
+        A = SRP.SRPStage1()
+        timer_1 = time.time() - timer_1
+
+        r = self.session.post(
+            f"https://www.mitid.dk/mitid-password-auth/v1/authenticator-sessions/{self.current_authenticator_session_id}/init",
+            json={"randomA": {"value": A}},
+            timeout=self.timeout,
+        )
+        if r.status_code != 200:
+            _LOGGER.error(
+                f"Failed to init password protocol, status code {r.status_code}"
+            )
+            raise Exception(r.content)
+
+        timer_2 = time.time()
+        r = r.json()
+        pbkdfSalt = r["pbkdf2Salt"]["value"]
+        srpSalt = r["srpSalt"]["value"]
+        randomB = r["randomB"]["value"]
+
+        password = hashlib.pbkdf2_hmac(
+            "sha256", password.encode("utf-8"), hex_to_bytes(pbkdfSalt), 20000, 32
+        ).hex()
+
+        m1 = SRP.SRPStage3(
+            srpSalt, randomB, password, self.current_authenticator_session_id
+        )
+
+        unhashed_flow_value_proof = self.__create_flow_value_proof()
+        m = hashlib.sha256()
+        unhashed_flow_value_proof_key = "flowValues" + bytes_to_hex(SRP.K_bits)
+        m.update(unhashed_flow_value_proof_key.encode("utf8"))
+        flow_value_proof_key = m.digest()
+
+        flow_value_proof = hmac.new(
+            flow_value_proof_key, unhashed_flow_value_proof, hashlib.sha256
+        ).hexdigest()
+
+        timer_2 = time.time() - timer_2
+        front_end_processing_time = int((timer_1 + timer_2) * 1000)
+
+        r = self.session.post(
+            f"https://www.mitid.dk/mitid-password-auth/v1/authenticator-sessions/{self.current_authenticator_session_id}/password-prove",
+            json={
+                "m1": {"value": m1},
+                "flowValueProof": {"value": flow_value_proof},
+                "frontEndProcessingTime": front_end_processing_time,
+            },
+            timeout=self.timeout,
+        )
+        if r.status_code != 204:
+            _LOGGER.error(f"Failed to submit password, status code {r.status_code}")
+            raise Exception(r.content)
+
+        r = self.session.post(
+            f"https://www.mitid.dk/mitid-core-client-backend/v2/authentication-sessions/{self.authentication_session_id}/next",
+            json={"combinationId": ""},
+            timeout=self.timeout,
+        )
+        if r.status_code != 200:
+            _LOGGER.error(f"Failed to prove password, status code {r.status_code}")
+            raise Exception(r.content)
+
+        r = r.json()
+        if r["errors"] and len(r["errors"]) > 0:
+            if r["errors"][0]["errorCode"] == "PASSWORD_INVALID":
+                error_text = r["errors"][0]["message"]
+                _LOGGER.error(
+                    f"Could not log in with the provided password, got the following message: {error_text}"
+                )
+                raise Exception(error_text)
+            elif r["errors"][0]["errorCode"] == "core.psd2.error":
+                error_text = r["errors"][0]["message"]
+                _LOGGER.error(
+                    f"Could not log in due to an error, probably due to a wrong password provided. Got the following message: {error_text}"
+                )
+                raise Exception(error_text)
+            else:
+                error_text = r["errors"][0]["message"]
+                _LOGGER.error(
+                    f"Could not log in due to an unknown error, got the following message: {error_text}"
+                )
+                raise Exception(error_text)
+
+        self.finalization_authentication_session_id = r["nextSessionId"]
+        self.status_message = "Password accepted, finalizing authentication"
+        _LOGGER.info(
+            "Password was accepted, you can now finalize authentication and receive your authorization code"
+        )
+
+    def authenticate_with_app(self):
+        self.__select_authenticator("APP")
+
+        r = self.session.post(
+            f"https://www.mitid.dk/mitid-code-app-auth/v1/authenticator-sessions/web/{self.current_authenticator_session_id}/init-auth",
+            json={},
+            timeout=self.timeout,
+        )
+        if r.status_code != 200:
+            _LOGGER.error(f"Failed to request app login, status code {r.status_code}")
+            raise Exception(r.content)
+
+        r = r.json()
+        if (
+            "errorCode" in r
+            and r["errorCode"]
+            == "auth.codeapp.authentication.parallel_sessions_detected"
+        ):
+            _LOGGER.error(
+                "Parallel app sessions detected, only a single app login session can be happening at any one time"
+            )
+            raise Exception(
+                "Parallel app sessions detected. Please wait a few minutes before trying again."
+            )
+
+        poll_url = r["pollUrl"]
+        ticket = r["ticket"]
+        self.status_message = "Login request has been made, open your MitID app now"
+        _LOGGER.info("Login request has been made, open your MitID app now")
+        qr_stop_event = None
+        qr_display_thread = None
+        while True:
+            r = self.session.post(poll_url, json={"ticket": ticket}, timeout=self.timeout)
+
+            if r.status_code == 200 and r.json()["status"] == "timeout":
+                continue
+
+            if r.status_code == 200 and r.json()["status"] == "channel_validation_otp":
+                self.status_message = f"Please use the following OTP code in the app: {r.json()['channelBindingValue']}"
+                _LOGGER.info(
+                    f"Please use the following OTP code in the app: {r.json()['channelBindingValue']}"
+                )
+                continue
+
+            if r.status_code == 200 and r.json()["status"] == "channel_validation_tqr":
+                qr_data = {
+                    "v": 1,
+                    "p": 1,
+                    "t": 2,
+                    "h": r.json()["channelBindingValue"][
+                        : int(len(r.json()["channelBindingValue"]) / 2)
+                    ],
+                    "uc": r.json()["updateCount"],
+                }
+                qr1 = qrcode.QRCode(border=1)
+                qr1.add_data(json.dumps(qr_data, separators=(",", ":")))
+                qr1.make()
+
+                qr_data["p"] = 2
+                qr_data["h"] = r.json()["channelBindingValue"][
+                    int(len(r.json()["channelBindingValue"]) / 2) :
+                ]
+
+                qr2 = qrcode.QRCode(border=1)
+                qr2.add_data(json.dumps(qr_data, separators=(",", ":")))
+                qr2.make()
+
+                self.__set_qr_codes(qr1, qr2)
+
+                if qr_stop_event is None:
+                    qr_stop_event = threading.Event()
+                    qr_display_thread = threading.Thread(
+                        target=self.__display_qr_ascii, args=[qr_stop_event]
+                    )
+                    qr_display_thread.start()
+
+                continue
+
+            if r.status_code == 200 and r.json()["status"] == "channel_verified":
+                if qr_display_thread and qr_display_thread.is_alive():
+                    qr_stop_event.set()
+                    qr_display_thread.join()
+                self.status_message = "The OTP/QR code has been verified, now waiting user to approve login"
+                _LOGGER.info(
+                    "The OTP/QR code has been verified, now waiting user to approve login"
+                )
+                continue
+
+            if not (
+                r.status_code == 200
+                and r.json()["status"] == "OK"
+                and r.json()["confirmation"] == True
+            ):
+                if qr_display_thread and qr_display_thread.is_alive():
+                    qr_stop_event.set()
+                    qr_display_thread.join()
+                _LOGGER.error("Login request was not accepted")
+                raise Exception(r.content)
+
+            break
+
+        r = r.json()
+        response = r["payload"]["response"]
+        response_signature = r["payload"]["responseSignature"]
+
+        timer_1 = time.time()
+        SRP = CustomSRP()
+        A = SRP.SRPStage1()
+        timer_1 = time.time() - timer_1
+
+        r = self.session.post(
+            f"https://www.mitid.dk/mitid-code-app-auth/v1/authenticator-sessions/web/{self.current_authenticator_session_id}/init",
+            json={"randomA": {"value": A}},
+            timeout=self.timeout,
+        )
+        if r.status_code != 200:
+            _LOGGER.error(f"Failed to init app protocol, status code {r.status_code}")
+            raise Exception(r.content)
+
+        timer_2 = time.time()
+        srpSalt = r.json()["srpSalt"]["value"]
+        randomB = r.json()["randomB"]["value"]
+
+        m = hashlib.sha256()
+        m.update(
+            base64.b64decode(response)
+            + self.current_authenticator_session_flow_key.encode("utf8")
+        )
+        password = m.hexdigest()
+
+        m1 = SRP.SRPStage3(
+            srpSalt, randomB, password, self.current_authenticator_session_id
+        )
+
+        unhashed_flow_value_proof = self.__create_flow_value_proof()
+        m = hashlib.sha256()
+        unhashed_flow_value_proof_key = "flowValues" + bytes_to_hex(SRP.K_bits)
+        m.update(unhashed_flow_value_proof_key.encode("utf8"))
+        flow_value_proof_key = m.digest()
+
+        flow_value_proof = hmac.new(
+            flow_value_proof_key, unhashed_flow_value_proof, hashlib.sha256
+        ).hexdigest()
+
+        timer_2 = time.time() - timer_2
+
+        r = self.session.post(
+            f"https://www.mitid.dk/mitid-code-app-auth/v1/authenticator-sessions/web/{self.current_authenticator_session_id}/prove",
+            json={"m1": {"value": m1}, "flowValueProof": {"value": flow_value_proof}},
+            timeout=self.timeout,
+        )
+        if r.status_code != 200:
+            _LOGGER.error(
+                f"Failed to submit app response proof, status code {r.status_code}"
+            )
+            raise Exception(r.content)
+
+        timer_3 = time.time()
+        m2 = r.json()["m2"]["value"]
+        if not SRP.SRPStage5(m2):
+            raise Exception("m2 could not be validated during proving of app response")
+        auth_enc = base64.b64encode(
+            SRP.AuthEnc(base64.b64decode(pad(response_signature)))
+        ).decode("ascii")
+        timer_3 = time.time() - timer_3
+
+        front_end_processing_time = int((timer_1 + timer_2 + timer_3) * 1000)
+
+        r = self.session.post(
+            f"https://www.mitid.dk/mitid-code-app-auth/v1/authenticator-sessions/web/{self.current_authenticator_session_id}/verify",
+            json={
+                "encAuth": auth_enc,
+                "frontEndProcessingTime": front_end_processing_time,
+            },
+            timeout=self.timeout,
+        )
+        if r.status_code != 204:
+            _LOGGER.error(
+                f"Failed to verify app response signature, status code {r.status_code}"
+            )
+            raise Exception(r.content)
+
+        r = self.session.post(
+            f"https://www.mitid.dk/mitid-core-client-backend/v2/authentication-sessions/{self.authentication_session_id}/next",
+            json={"combinationId": ""},
+            timeout=self.timeout,
+        )
+        if r.status_code != 200:
+            _LOGGER.error(f"Failed to prove app login, status code {r.status_code}")
+            raise Exception(r.content)
+
+        r = r.json()
+        if r["errors"] and len(r["errors"]) > 0:
+            _LOGGER.error(f"Could not prove the app login")
+            raise Exception("Could not prove the app login. Please try again.")
+
+        self.finalization_authentication_session_id = r["nextSessionId"]
+        self.status_message = "App login was accepted, finalizing authentication"
+        _LOGGER.info(
+            "App login was accepted, you can now finalize authentication and receive your authorization code"
+        )
+
+    def finalize_authentication_and_get_authorization_code(self):
+        if not self.finalization_authentication_session_id:
+            raise Exception(
+                "No finalization session ID set, make sure you have completed an authentication flow."
+            )
+
+        r = self.session.put(
+            f"https://www.mitid.dk/mitid-core-client-backend/v1/authentication-sessions/{self.finalization_authentication_session_id}/finalization",
+            timeout=self.timeout,
+        )
+        if r.status_code != 200:
+            _LOGGER.error(
+                f"Failed to retrieve authorization code, status code {r.status_code}"
+            )
+            raise Exception(r.content)
+
+        return r.json()["authorizationCode"]

mitid_connect/helpers.py

@@ -0,0 +1,98 @@
+"""Ready-made steps of a NemLog-in login flow around the MitID browser client."""
+
+import binascii, base64, hashlib, logging
+from typing import Any
+
+from Cryptodome import Random
+from requests import Response, Session
+from .browser_client import BrowserClient
+from bs4 import BeautifulSoup
+
+_LOGGER = logging.getLogger(__name__)
+
+def get_authentication_code(
+    session: Session, aux: dict[str, Any], method: str, user_id: str, password: str | None
+) -> str:
+    """Log `user_id` in with the MitID app, from NemLog-in's parameters `aux`, and give the code.
+
+    Raises:
+        NotImplementedError: `method` is "TOKEN", which needs the token's digits.
+        Exception: the method is unknown, or not one the user has.
+    """
+    client_hash = binascii.hexlify(base64.b64decode(aux["coreClient"]["checksum"])).decode('ascii')
+    authentication_session_id = aux["parameters"]["authenticationSessionId"]
+
+    MitIDClient = BrowserClient(client_hash, authentication_session_id, session)
+    available_authenticators = MitIDClient.identify_as_user_and_get_available_authenticators(user_id)
+
+    _LOGGER.debug(f"Available authenticator: {available_authenticators}")
+
+    if method == "TOKEN" and "TOKEN" in available_authenticators:
+        if not password:
+            raise ValueError("Password is required for TOKEN authentication")
+        # Token digits must be provided via the caller, not via interactive input
+        raise NotImplementedError(
+            "TOKEN authentication requires token_digits parameter - interactive input not supported"
+        )
+    elif method == "APP" and "APP" in available_authenticators:
+        MitIDClient.authenticate_with_app()
+    elif method == "TOKEN" and "TOKEN" not in available_authenticators:
+        raise Exception(f"Token authentication method chosen but not available for MitID user")
+    elif method == "APP" and "APP" not in available_authenticators:    
+        raise Exception(f"App authentication method chosen but not available for MitID user")
+    else:
+        raise Exception(f"Unknown authenticator method: {method}")
+
+    authorization_code = MitIDClient.finalize_authentication_and_get_authorization_code()
+    return authorization_code
+
+def choose_between_multiple_identitites(
+    session: Session, request: Response, soup: BeautifulSoup, identity_index: int = 0
+) -> tuple[Response, BeautifulSoup]:
+    """Choose between multiple identities.
+
+    Args:
+        session: requests session
+        request: current request object
+        soup: BeautifulSoup parsed response
+        identity_index: zero-based index of the identity to select (default: 0, first identity)
+
+    Returns:
+        Tuple of (request, soup) after identity selection
+    """
+    data = {}
+    for soup_input in soup.form.select("input"):
+        try:
+            data[soup_input["name"]] = soup_input["value"]
+        except KeyError:
+            data[soup_input.get("name", "")] = ""
+    login_options = soup.select("div.list-link-box")
+    _LOGGER.info('Multiple identities available:')
+    for i, login_option in enumerate(login_options):
+        _LOGGER.info(f'{i+1}: {login_option.select_one("div.list-link-text").string}')
+
+    if identity_index < 0 or identity_index >= len(login_options):
+        raise ValueError(f"Identity index {identity_index} out of range (0-{len(login_options)-1})")
+
+    selected_option = login_options[identity_index].a["data-loginoptions"]
+    data["ChosenOptionJson"] = selected_option
+    _LOGGER.info(f'Selected identity {identity_index + 1}')
+
+    request = session.post(request.url, data=data)
+    soup = BeautifulSoup(request.text, "xml")
+    return request, soup
+
+def __generate_random_string():
+    return binascii.hexlify(Random.new().read(28)).decode("utf-8")
+
+def __generate_challenge(verifier):
+    return base64.urlsafe_b64encode(hashlib.sha256(verifier.encode("utf-8")).digest()).decode("utf-8").rstrip("=")
+
+def generate_nem_login_parameters() -> tuple[str, str, str, str]:
+    """A fresh state, nonce, PKCE code verifier and its S256 code challenge for NemLog-in."""
+    nem_login_state = __generate_random_string()
+    nem_login_nonce = __generate_random_string()
+    nem_login_code_verifier = __generate_random_string()
+    nem_login_code_challenge = __generate_challenge(nem_login_code_verifier)
+
+    return nem_login_state, nem_login_nonce, nem_login_code_verifier, nem_login_code_challenge

mitid_connect/srp.py

@@ -0,0 +1,216 @@
+"""The SRP-6a exchange and AES-GCM encryption MitID's browser client speaks."""
+
+import base64
+import secrets
+import binascii
+import hashlib
+from collections.abc import Callable
+from typing import Protocol, cast
+
+from Cryptodome.Cipher import AES
+from Cryptodome import Random
+
+BLOCK_SIZE = 16
+
+
+class _Gcm(Protocol):
+    def encrypt_and_digest(self, plaintext: bytes) -> tuple[bytes, bytes]: ...
+    def decrypt_and_verify(self, ciphertext: bytes, received_mac_tag: bytes) -> bytes: ...
+
+
+# pycryptodomex annotates AES.new with a bare Dict among its overloads, which a strict check reads
+# as unknown; it is taken by name, with the type it has in GCM mode.
+_new_gcm = cast(Callable[[bytes, int, bytes], _Gcm], getattr(AES, "new"))
+
+
+def pad(s: str) -> str:
+    """`s` padded to a whole number of blocks, PKCS#7 style."""
+    return s + (BLOCK_SIZE - len(s) % BLOCK_SIZE) * chr(BLOCK_SIZE - len(s) % BLOCK_SIZE)
+
+
+def unpad(s: str) -> str:
+    """`s` with its PKCS#7 padding taken off."""
+    return s[:-ord(s[len(s) - 1:])]
+
+
+def int_to_hex(x: int) -> str:
+    """`x` in lower-case hex, without a prefix."""
+    return format(x, 'x')
+
+
+def int_to_bytes(x: int) -> bytes:
+    """`x` as big-endian bytes, as few as hold it."""
+    return x.to_bytes((x.bit_length() + 7) // 8, 'big')
+
+
+def bytes_to_int(x: bytes) -> int:
+    """The big-endian number `x` holds."""
+    return int.from_bytes(x, 'big')
+
+
+def bytes_to_hex(x: bytes) -> str:
+    """`x` in lower-case hex."""
+    return binascii.hexlify(x).decode('utf-8')
+
+
+def hex_to_bytes(x: str) -> bytes:
+    """The bytes the hex `x` spells."""
+    return binascii.unhexlify(x)
+
+
+def hex_to_int(x: str) -> int:
+    """The number the hex `x` spells."""
+    return int(x, 16)
+
+
+def AesDecryptWithKey(encMessage: str | bytes, key: bytes) -> bytes:
+    """The plain text of the base64 AES-GCM message `encMessage`: IV, cipher text, then tag."""
+    encMessage = base64.b64decode(encMessage)
+
+    iv = encMessage[:BLOCK_SIZE]
+    cipherText = encMessage[BLOCK_SIZE:len(encMessage)-BLOCK_SIZE]
+    macTag = encMessage[len(encMessage)-BLOCK_SIZE:]
+
+    cipher = _new_gcm(key, AES.MODE_GCM, iv)
+    decrypted = cipher.decrypt_and_verify(cipherText, macTag)
+    return decrypted
+
+class CustomSRP():
+    """One SRP-6a exchange with MitID, and the session key it agrees."""
+
+    n: int
+    g: int
+    a: int
+    big_a: int
+    big_b: int
+    hashed_password: int
+    K_bits: bytes
+    M1_hex: str
+
+    def SRPStage1(self) -> str:
+        """Pick a secret, and give the public value A, in hex, to send."""
+        self.n = 4983313092069490398852700692508795473567251422586244806694940877242664573189903192937797446992068818099986958054998012331720869136296780936009508700487789962429161515853541556719593346959929531150706457338429058926505817847524855862259333438239756474464759974189984231409170758360686392625635632084395639143229889862041528635906990913087245817959460948345336333086784608823084788906689865566621015175424691535711520273786261989851360868669067101108956159530739641990220546209432953829448997561743719584980402874346226230488627145977608389858706391858138200618631385210304429902847702141587470513336905449351327122086464725143970313054358650488241167131544692349123381333204515637608656643608393788598011108539679620836313915590459891513992208387515629240292926570894321165482608544030173975452781623791805196546326996790536207359143527182077625412731080411108775183565594553871817639221414953634530830290393130518228654795859
+        self.g = 2
+        a = secrets.randbits(256)
+        if a < 0:
+            a += self.n
+        self.a = a
+
+        self.big_a = pow(self.g, self.a, self.n)
+        return int_to_hex(self.big_a)
+    
+    def computeLittleS(self) -> int:
+        """The multiplier k of SRP-6a, as MitID works it out."""
+        N_bytes = int_to_bytes(self.n)
+        g_bytes = int_to_bytes(self.g)
+        
+        # Prepend g_bytes with |N_bytes|-|g_bytes| of 0
+        g_bytes = (b"\0" * (len(N_bytes) - len(g_bytes))) + g_bytes
+
+        m = hashlib.sha256()
+        m.update(str(self.n).encode('utf-8') + g_bytes)
+        digest = m.hexdigest()
+
+        return hex_to_int(digest)
+
+    def computeU(self) -> int:
+        """The scrambler u, from A and B."""
+        N_length = len(int_to_bytes(self.n))
+        A_bytes = int_to_bytes(self.big_a)
+        B_bytes = int_to_bytes(self.big_b)
+
+        # Prepend A_bytes with |N_bytes|-|A_bytes| of 0
+        A_bytes = (b"\0"*(N_length-len(A_bytes)))+A_bytes
+
+        # Prepend r_bytes with |N_bytes|-|r_bytes| of 0
+        B_bytes = (b"\0"*(N_length-len(B_bytes)))+B_bytes
+        
+        m = hashlib.sha256()
+        m.update(A_bytes + B_bytes)
+        hashed = m.hexdigest()
+        u = hex_to_int(hashed) % self.n
+        return u
+
+    def computeSessionKey(self) -> int:
+        """The premaster secret S. MitID's own app does not refuse u == 0, so this does not."""
+        u = self.computeU()
+
+        s = self.computeLittleS()
+        
+        a = u * self.hashed_password + self.a
+        c = pow((self.big_b - (pow(self.g, self.hashed_password, self.n) * s)), a, self.n)
+        if a < 0:
+            a += self.n
+
+        return c
+
+    def computeM1(self, r: str, srpSalt: str) -> str:
+        """The client's proof M1, in hex."""
+        m = hashlib.sha256()
+        m.update(str(self.n).encode("utf-8"))
+        N = hex_to_int(m.hexdigest())
+
+        m = hashlib.sha256()
+        m.update(str(self.g).encode("utf-8"))
+        g = hex_to_int(m.hexdigest())
+        a = N ^ g
+
+        m = hashlib.sha256()
+        m.update((str(a) + r + srpSalt + str(self.big_a) + str(self.big_b) + bytes_to_hex(self.K_bits)).encode("ascii"))
+        return m.hexdigest()
+
+    def SRPStage3(self, srpSalt: str, randomB: str, password: str, auth_session_id: str) -> str:
+        """Take the server's B, agree the session key, and give the proof M1 to send.
+
+        Raises:
+            Exception: B fails SRP's safety check.
+        """
+        self.big_b = hex_to_int(randomB)
+
+        if(self.big_b == 0 or self.big_b % self.n == 0):
+            raise Exception("randomB did not pass safety check")
+
+        m = hashlib.sha256()
+        m.update((srpSalt + password).encode("ascii"))
+        self.hashed_password = hex_to_int(m.hexdigest())
+
+        a = self.computeSessionKey()
+
+        m = hashlib.sha256()
+        m.update(str(a).encode("utf-8"))
+        self.K_bits = m.digest()
+
+        m = hashlib.sha256()
+        m.update(auth_session_id.encode("utf-8"))
+        I_hex = m.hexdigest()
+
+        self.M1_hex = self.computeM1(I_hex, srpSalt)
+
+        return self.M1_hex
+    
+    # Should satisfy if the server is correct
+    # Interestingly enough, this cannot be checked for the pin-binding proof
+    def SRPStage5(self, M2_hex: str) -> bool:
+        """Whether the server's proof M2 matches the session key agreed."""
+        M1_bigInt = int(self.M1_hex, 16)
+
+        m = hashlib.sha256()
+        m.update((str(self.big_a) + str(M1_bigInt) + bytes_to_hex(self.K_bits)).encode('utf-8'))
+        M2_hex_verify = m.hexdigest()
+        return M2_hex_verify == M2_hex
+
+    def AuthEnc(self, plainText: bytes) -> bytes:
+        """`plainText` encrypted with the session key: IV, cipher text, then tag."""
+        iv = Random.new().read(BLOCK_SIZE)
+        cipher = _new_gcm(self.K_bits, AES.MODE_GCM, iv)
+        ciphertext, tag = cipher.encrypt_and_digest(plainText)
+        return (iv + ciphertext + tag)
+
+    def AuthDec(self, encMessage: str | bytes) -> bytes:
+        """The plain text of a message encrypted with the session key."""
+        return AesDecryptWithKey(encMessage, self.K_bits)
+    
+    def AuthDecPin(self, encMessage: str | bytes) -> bytes:
+        """The plain text of a message encrypted with the PIN key derived from the session key."""
+        pin_key = hashlib.sha256(binascii.hexlify(self.K_bits) + b"PIN").digest()
+        return AesDecryptWithKey(encMessage, pin_key)

mitid_connect-0.0.1.dist-info/METADATA

@@ -0,0 +1,55 @@
+Metadata-Version: 2.4
+Name: mitid_connect
+Version: 0.0.1
+Summary: Log in through MitID from Python: an unofficial implementation of MitID's browser client, with the MitID app or a code token.
+Author: HairingX
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/HairingX/mitid_connect
+Project-URL: Source, https://github.com/HairingX/mitid_connect
+Project-URL: Issues, https://github.com/HairingX/mitid_connect/issues
+Project-URL: Releases, https://github.com/HairingX/mitid_connect/releases
+Keywords: mitid,nemlog-in,login,denmark
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Software Development :: Libraries
+Classifier: Typing :: Typed
+Requires-Python: >=3.12
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: beautifulsoup4>=4.12.0
+Requires-Dist: lxml>=5.0.0
+Requires-Dist: pycryptodomex>=3.24.1
+Requires-Dist: qrcode>=8.2
+Requires-Dist: requests>=2.31.0
+Dynamic: license-file
+
+# mitid_connect
+
+Log in through [MitID](https://www.mitid.dk) from Python: an unofficial implementation of MitID's
+browser client. It authenticates with the MitID app - by QR code or one-time code - or with a
+code token, and gives back the authorization code that the service being logged in to exchanges
+for its own tokens.
+
+```python
+from mitid_connect import BrowserClient
+
+client = BrowserClient(client_hash, authentication_session_id)
+authenticators = client.identify_as_user_and_get_available_authenticators("username")
+client.authenticate_with_app()            # approve in the MitID app
+code = client.finalize_authentication_and_get_authorization_code()
+```
+
+`client_hash` and `authentication_session_id` come from the service's NemLog-in page;
+`get_authentication_code` does all of the above from that page's parameters.
+
+It is used by [aula_connect](https://github.com/HairingX/aula_connect) to log in to Aula.
+
+## Origin and licence
+
+It carries on MitID-BrowserClient by Hundter, under the MIT licence (`LICENSE`).

mitid_connect-0.0.1.dist-info/RECORD

@@ -0,0 +1,10 @@
+mitid_connect/__init__.py,sha256=6lPc4-HF1grYMWhwV_C96vweANum8EY2M7PnjWUsgrc,889
+mitid_connect/browser_client.py,sha256=EAd4NqMaJtepm5qx1N5v0n4DKhdtrDwDIoXjX1BGOug,32429
+mitid_connect/helpers.py,sha256=P6SI3Wt-mPnFQkNOXDq4-lbj9YHihZTFWcwJpFdUzb8,4385
+mitid_connect/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+mitid_connect/srp.py,sha256=TeVUZcbJb3qrCV4KMmpUbWwTMoteCY6lOyACqkeRP6E,7914
+mitid_connect-0.0.1.dist-info/licenses/LICENSE,sha256=v-WwuWyqFMKfwXLWDSB_LS99yZNu4Ibd1HnMiF8ddyY,1153
+mitid_connect-0.0.1.dist-info/METADATA,sha256=MkzDd-xJZLeEHbpYnMQ05U2hYLalQXpFB4f1nOO4A4g,2316
+mitid_connect-0.0.1.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
+mitid_connect-0.0.1.dist-info/top_level.txt,sha256=6OqNVy-tgVlykookob7hBs2KZkcN7VcAvuU66XJ2aBg,14
+mitid_connect-0.0.1.dist-info/RECORD,,

mitid_connect-0.0.1.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.2.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

mitid_connect-0.0.1.dist-info/licenses/LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) Hundter, the author of MitID-BrowserClient, which this library carries on
+Copyright (c) 2026 HairingX
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

mitid_connect-0.0.1.dist-info/top_level.txt

@@ -0,0 +1 @@
+mitid_connect