oidc-discovery 0.1.0__py3-none-any.whl

oidc_discovery/clients.py

@@ -0,0 +1,69 @@
+from abc import ABCMeta, abstractmethod
+from typing import Literal
+
+from httpx import AsyncClient, Client, HTTPStatusError, RequestError
+from pydantic import ValidationError
+
+from oidc_discovery.models import OIDCProviderMetadata
+
+SUFFIX: Literal["/.well-known/openid-configuration"] = \
+        "/.well-known/openid-configuration"
+
+
+class OIDCDiscoveryError(Exception): ...
+
+
+class OIDCDiscovererInterface(metaclass=ABCMeta):
+    @abstractmethod
+    def __call__(self) -> OIDCProviderMetadata: ...
+
+
+class OIDCDiscoverer(OIDCDiscovererInterface):
+    _client: Client
+    _issuer: str
+
+    def __init__(self, client: Client, issuer: str) -> None:
+        self._client = client
+        self._issuer = issuer
+
+    def __call__(self) -> OIDCProviderMetadata:
+        url = self._issuer + SUFFIX
+
+        try:
+            response = self._client.get(url)
+            response.raise_for_status()
+            return OIDCProviderMetadata.model_validate_json(response.text)
+        except (RequestError, HTTPStatusError) as e:
+            raise OIDCDiscoveryError from e
+        except ValidationError as e:
+            raise OIDCDiscoveryError(str(e)) from e
+        finally:
+            self._client.close()
+
+
+class AsyncOIDCDiscovererInterface(metaclass=ABCMeta):
+    @abstractmethod
+    async def __call__(self) -> OIDCProviderMetadata: ...
+
+
+class AsyncOIDCDiscoverer(AsyncOIDCDiscovererInterface):
+    _client: AsyncClient
+    _issuer: str
+
+    def __init__(self, client: AsyncClient, issuer: str) -> None:
+        self._client = client
+        self._issuer = issuer
+
+    async def __call__(self) -> OIDCProviderMetadata:
+        url = self._issuer + SUFFIX
+
+        try:
+            response = await self._client.get(url)
+            response.raise_for_status()
+            return OIDCProviderMetadata.model_validate_json(response.text)
+        except (RequestError, HTTPStatusError) as e:
+            raise OIDCDiscoveryError from e
+        except ValidationError as e:
+            raise OIDCDiscoveryError(str(e)) from e
+        finally:
+            await self._client.aclose()

oidc_discovery/models.py

@@ -0,0 +1,222 @@
+from typing import Optional
+
+from pydantic import AnyHttpUrl, BaseModel, StrictBool, StrictStr
+
+
+class OIDCProviderMetadata(BaseModel):
+    """OpenID Providers have metadata describing their configuration. These OpenID
+    Provider Metadata values are used by OpenID Connect
+    Additional OpenID Provider Metadata parameters MAY also be used. Some are defined
+    by other specifications, such as OpenID Connect Session Management 1.0.
+
+    See: https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
+    """
+    model_config = {"extra": "allow"}
+
+    issuer: AnyHttpUrl
+    """REQUIRED. URL using the https scheme with no query or fragment components that
+    the OP asserts as its Issuer Identifier. If Issuer discovery is supported (see
+    Section 2), this value MUST be identical to the issuer value returned by WebFinger.
+    This also MUST be identical to the iss Claim value in ID Tokens issued from this
+    Issuer."""
+
+    authorization_endpoint: AnyHttpUrl
+    """REQUIRED. URL of the OP's OAuth 2.0 Authorization Endpoint [OpenID.Core].
+    This URL MUST use the https scheme and MAY contain port, path, and query parameter
+    components."""
+
+    token_endpoint: Optional[AnyHttpUrl] = None
+    """URL of the OP's OAuth 2.0 Token Endpoint [OpenID.Core]. This is REQUIRED unless
+    only the Implicit Flow is used. This URL MUST use the https scheme and MAY contain
+    port, path, and query parameter components. """
+
+    userinfo_endpoint: Optional[AnyHttpUrl] = None
+    """RECOMMENDED. URL of the OP's UserInfo Endpoint [OpenID.Core]. This URL MUST use
+    the https scheme and MAY contain port, path, and query parameter components. """
+
+    jwks_uri: AnyHttpUrl
+    """REQUIRED. URL of the OP's JWK Set [JWK] document, which MUST use the https
+    scheme. This contains the signing key(s) the RP uses to validate signatures from
+    the OP. The JWK Set MAY also contain the Server's encryption key(s), which are used
+    by RPs to encrypt requests to the Server. When both signing and encryption keys are
+    made available, a use (public key use) parameter value is REQUIRED for all keys in
+    the referenced JWK Set to indicate each key's intended usage. Although some
+    algorithms allow the same key to be used for both signatures and encryption, doing
+    so is NOT RECOMMENDED, as it is less secure. The JWK x5c parameter MAY be used to
+    provide X.509 representations of keys provided. When used, the bare key values MUST
+    still be present and MUST match those in the certificate. The JWK Set MUST NOT
+    contain private or symmetric key values."""
+
+    registration_endpoint: Optional[AnyHttpUrl] = None
+    """RECOMMENDED. URL of the OP's Dynamic Client Registration Endpoint
+    [OpenID.Registration], which MUST use the https scheme."""
+
+    scopes_supported: Optional[list[StrictStr]] = None
+    """RECOMMENDED. JSON array containing a list of the OAuth 2.0 [RFC6749] scope
+    values that this server supports. The server MUST support the openid scope value.
+    Servers MAY choose not to advertise some supported scope values even when this
+    parameter is used, although those defined in [OpenID.Core] SHOULD be listed, if
+    supported."""
+
+    response_types_supported: list[StrictStr]
+    """REQUIRED. JSON array containing a list of the OAuth 2.0 response_type values
+    that this OP supports. Dynamic OpenID Providers MUST support the code, id_token,
+    and the id_token token Response Type values."""
+
+    response_modes_supported: Optional[list[StrictStr]] = None
+    """OPTIONAL. JSON array containing a list of the OAuth 2.0 response_mode values
+    that this OP supports, as specified in OAuth 2.0 Multiple Response Type Encoding
+    Practices [OAuth.Responses]. If omitted, the default for Dynamic OpenID Providers
+    is ["query", "fragment"]."""
+
+    grant_types_supported: Optional[list[StrictStr]] = None
+    """OPTIONAL. JSON array containing a list of the OAuth 2.0 Grant Type values that
+    this OP supports. Dynamic OpenID Providers MUST support the authorization_code and
+    implicit Grant Type values and MAY support other Grant Types. If omitted, the
+    default value is ["authorization_code", "implicit"]."""
+
+    acr_values_supported: Optional[list[StrictStr]] = None
+    """OPTIONAL. JSON array containing a list of the Authentication Context Class
+    References that this OP supports."""
+
+    subject_types_supported: list[StrictStr]
+    """REQUIRED. JSON array containing a list of the Subject Identifier types that this
+    OP supports. Valid types include pairwise and public."""
+
+    id_token_signing_alg_values_supported: list[StrictStr]
+    """REQUIRED. JSON array containing a list of the JWS signing algorithms
+    (alg values) supported by the OP for the ID Token to encode the Claims in a JWT
+    [JWT]. The algorithm RS256 MUST be included. The value none MAY be supported but
+    MUST NOT be used unless the Response Type used returns no ID Token from the
+    Authorization Endpoint (such as when using the Authorization Code Flow)."""
+
+    id_token_encryption_alg_values_supported: Optional[list[StrictStr]] = None
+    """OPTIONAL. JSON array containing a list of the JWE encryption algorithms
+    (alg values) supported by the OP for the ID Token to encode the Claims in a JWT
+    [JWT]."""
+
+    id_token_encryption_enc_values_supported: Optional[list[StrictStr]] = None
+    """OPTIONAL. JSON array containing a list of the JWE encryption algorithms
+    (enc values) supported by the OP for the ID Token to encode the Claims in a JWT
+    [JWT]."""
+
+    userinfo_signing_alg_values_supported: Optional[list[StrictStr]] = None
+    """OPTIONAL. JSON array containing a list of the JWS [JWS] signing algorithms
+    (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT
+    [JWT]. The value none MAY be included."""
+
+    userinfo_encryption_alg_values_supported: Optional[list[StrictStr]] = None
+    """OPTIONAL. JSON array containing a list of the JWE [JWE] encryption algorithms
+    (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT
+    [JWT]."""
+
+    userinfo_encryption_enc_values_supported: Optional[list[StrictStr]] = None
+    """OPTIONAL. JSON array containing a list of the JWE encryption algorithms
+    (enc values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT
+    [JWT]. """
+
+    request_object_signing_alg_values_supported: Optional[list[StrictStr]] = None
+    """OPTIONAL. JSON array containing a list of the JWS signing algorithms (alg values)
+    supported by the OP for Request Objects, which are described in Section 6.1 of
+    OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the
+    Request Object is passed by value (using the request parameter) and when it is
+    passed by reference (using the request_uri parameter). Servers SHOULD support none
+    and RS256."""
+
+    request_object_encryption_alg_values_supported: Optional[list[StrictStr]] = None
+    """OPTIONAL. JSON array containing a list of the JWE encryption algorithms
+    (alg values) supported by the OP for Request Objects. These algorithms are used
+    both when the Request Object is passed by value and when it is passed by
+    reference."""
+
+    request_object_encryption_enc_values_supported: Optional[list[StrictStr]] = None
+    """OPTIONAL. JSON array containing a list of the JWE encryption algorithms
+    (enc values) supported by the OP for Request Objects. These algorithms are used
+    both when the Request Object is passed by value and when it is passed by
+    reference."""
+
+    token_endpoint_auth_methods_supported: Optional[list[StrictStr]] = None
+    """OPTIONAL. JSON array containing a list of Client Authentication methods
+    supported by this Token Endpoint. The options are client_secret_post,
+    client_secret_basic, client_secret_jwt, and private_key_jwt, as described in
+    Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods
+    MAY be defined by extensions. If omitted, the default is client_secret_basic -- the
+    HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0
+    [RFC6749]."""
+
+    token_endpoint_auth_signing_alg_values_supported: Optional[list[StrictStr]] = None
+    """OPTIONAL. JSON array containing a list of the JWS signing algorithms
+    (alg values) supported by the Token Endpoint for the signature on the JWT [JWT]
+    used to authenticate the Client at the Token Endpoint for the private_key_jwt and
+    client_secret_jwt authentication methods. Servers SHOULD support RS256. The value
+    none MUST NOT be used."""
+
+    display_values_supported: Optional[list[StrictStr]] = None
+    """OPTIONAL. JSON array containing a list of the display parameter values that the
+    OpenID Provider supports. These values are described in Section 3.1.2.1 of OpenID
+    Connect Core 1.0 [OpenID.Core]."""
+
+    claim_types_supported: Optional[list[StrictStr]] = None
+    """OPTIONAL. JSON array containing a list of the Claim Types that the OpenID
+    Provider supports. These Claim Types are described in Section 5.6 of OpenID Connect
+    Core 1.0 [OpenID.Core]. Values defined by this specification are normal,
+    aggregated, and distributed. If omitted, the implementation supports only normal
+    Claims."""
+
+    claims_supported: Optional[list[StrictStr]] = None
+    """RECOMMENDED. JSON array containing a list of the Claim Names of the Claims that
+    the OpenID Provider MAY be able to supply values for. Note that for privacy or
+    other reasons, this might not be an exhaustive list."""
+
+    service_documentation: Optional[AnyHttpUrl] = None
+    """OPTIONAL. URL of a page containing human-readable information that developers
+    might want or need to know when using the OpenID Provider. In particular, if the
+    OpenID Provider does not support Dynamic Client Registration, then information on
+    how to register Clients needs to be provided in this documentation."""
+
+    claims_locales_supported: Optional[list[StrictStr]] = None
+    """OPTIONAL. Languages and scripts supported for values in Claims being returned,
+    represented as a JSON array of BCP47 [RFC5646] language tag values. Not all
+    languages and scripts are necessarily supported for all Claim values."""
+
+    ui_locales_supported: Optional[list[StrictStr]] = None
+    """OPTIONAL. Languages and scripts supported for the user interface, represented as
+    a JSON array of BCP47 [RFC5646] language tag values."""
+
+    claims_parameter_supported: Optional[StrictBool] = None
+    """OPTIONAL. Boolean value specifying whether the OP supports use of the claims
+    parameter, with true indicating support. If omitted, the default value is false."""
+
+    request_parameter_supported: Optional[StrictBool] = None
+    """OPTIONAL. Boolean value specifying whether the OP supports use of the request
+    parameter, with true indicating support. If omitted, the default value is false."""
+
+    request_uri_parameter_supported: Optional[StrictBool] = None
+    """OPTIONAL. Boolean value specifying whether the OP supports use of the
+    request_uri parameter, with true indicating support. If omitted, the default value
+    is true."""
+
+    require_request_uri_registration: Optional[StrictBool] = None
+    """OPTIONAL. Boolean value specifying whether the OP requires any request_uri
+    values used to be pre-registered using the request_uris registration parameter.
+    Pre-registration is REQUIRED when the value is true. If omitted, the default value
+    is false."""
+
+    op_policy_uri: Optional[AnyHttpUrl] = None
+    """OPTIONAL. URL that the OpenID Provider provides to the person registering the
+    Client to read about the OP's requirements on how the Relying Party can use the
+    data provided by the OP. The registration process SHOULD display this URL to the
+    person registering the Client if it is given."""
+
+    op_tos_uri: Optional[AnyHttpUrl] = None
+    """OPTIONAL. URL that the OpenID Provider provides to the person registering the
+    Client to read about the OpenID Provider's terms of service. The registration
+    process SHOULD display this URL to the person registering the Client if it is
+    given."""
+
+    end_session_endpoint: Optional[AnyHttpUrl] = None
+    """https://openid.net/specs/openid-connect-rpinitiated-1_0.html#OPMetadata
+    REQUIRED. URL at the OP to which an RP can perform a redirect to request that the
+    End-User be logged out at the OP. This URL MUST use the https scheme and MAY
+    contain port, path, and query parameter components.
+    It is optional here, because OPs may or not may not support this specification."""

oidc_discovery-0.1.0.dist-info/METADATA

@@ -0,0 +1,17 @@
+Metadata-Version: 2.3
+Name: oidc-discovery
+Version: 0.1.0
+Summary: Add your description here
+Author: Youri Westerman
+Author-email: Youri Westerman <y.westerman@amsterdam.nl>
+Requires-Dist: httpx[http2]>=0.28.1
+Requires-Dist: pydantic>=2.13.4
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+
+# OpenID Connect Discovery
+Implementation of a client for
+[OpenID Connect Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html)
+
+Allowing one to retrieve the information required to communicate with OpenID connect core providers.
+This does not support issuer discovery at this time.

oidc_discovery-0.1.0.dist-info/RECORD

@@ -0,0 +1,7 @@
+oidc_discovery/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+oidc_discovery/clients.py,sha256=_K8sAuQrWmebvXvcUXmUBSfXTI34KqExYq7xSYkN1P0,2079
+oidc_discovery/models.py,sha256=b9r2eFf0pVXIf81FaErdpil9feK3ylMqEBLZiNy6jaA,12652
+oidc_discovery/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+oidc_discovery-0.1.0.dist-info/WHEEL,sha256=jK0lbM7sVtq70msNoYotEXYS3OJMDdns2CRgyjhimnE,81
+oidc_discovery-0.1.0.dist-info/METADATA,sha256=o9RODWPb9j-2FFsdhqnFzkmXGSTcIReY1OMOWXLv5K0,606
+oidc_discovery-0.1.0.dist-info/RECORD,,

oidc_discovery-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: uv 0.11.25
+Root-Is-Purelib: true
+Tag: py3-none-any