oidcauthlib 3.0.23__tar.gz → 3.0.25__tar.gz

{oidcauthlib-3.0.23/oidcauthlib.egg-info → oidcauthlib-3.0.25}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: oidcauthlib
-Version: 3.0.23
+Version: 3.0.25
 Summary: oidcauthlib
 Author-email: Imran Qureshi <imran.qureshi@bwell.com>
 License: Apache-2.0
@@ -58,8 +58,8 @@ scopes = await manager.get_scopes_from_user_info_async(access_token=token)
 - **Provider** is matched to the token's `iss`: an exact `issuer`, else a `well_known_uri` on the same scheme,
   host and port whose path segments start with the issuer's. Only a token with no `iss` at all is matched by
   its client id. A token matching no provider raises `ValueError`; it is never sent to another provider.
-- **Subject check:** the userinfo response's `sub` must equal the token's `sub` (OIDC Core 5.3.2); otherwise
-  the lookup raises `ValueError` and nothing is cached.
+- **Subject check:** for a token that has a `sub`, the userinfo response must carry the same `sub`
+  (OIDC Core 5.3.2); a missing or different one raises `ValueError` and nothing is cached.
 - **Cache** key is `oidc-userinfo-scopes:<issuer>:<client_id>:<sub>|v1` with each segment percent-encoded
   (so values containing `:` cannot collide, and two providers never share an entry); only the
   userinfo-derived scopes are stored, never the userinfo response. The token's own scopes are re-derived on every call. A token without

{oidcauthlib-3.0.23 → oidcauthlib-3.0.25}/README.md

@@ -30,8 +30,8 @@ scopes = await manager.get_scopes_from_user_info_async(access_token=token)
 - **Provider** is matched to the token's `iss`: an exact `issuer`, else a `well_known_uri` on the same scheme,
   host and port whose path segments start with the issuer's. Only a token with no `iss` at all is matched by
   its client id. A token matching no provider raises `ValueError`; it is never sent to another provider.
-- **Subject check:** the userinfo response's `sub` must equal the token's `sub` (OIDC Core 5.3.2); otherwise
-  the lookup raises `ValueError` and nothing is cached.
+- **Subject check:** for a token that has a `sub`, the userinfo response must carry the same `sub`
+  (OIDC Core 5.3.2); a missing or different one raises `ValueError` and nothing is cached.
 - **Cache** key is `oidc-userinfo-scopes:<issuer>:<client_id>:<sub>|v1` with each segment percent-encoded
   (so values containing `:` cannot collide, and two providers never share an entry); only the
   userinfo-derived scopes are stored, never the userinfo response. The token's own scopes are re-derived on every call. A token without

oidcauthlib-3.0.25/VERSION

@@ -0,0 +1 @@
+3.0.25

{oidcauthlib-3.0.23 → oidcauthlib-3.0.25}/oidcauthlib/auth/userinfo/oidc_userinfo_manager.py

@@ -23,6 +23,9 @@ logger.setLevel(SRC_LOG_LEVELS["AUTH"])
 
 _DEFAULT_PORTS = {"http": 80, "https": 443}
 
+# Okta org-server access tokens carry the login in ``sub`` and the stable user id in this claim.
+_OKTA_USER_ID_CLAIM = "uid"
+
 
 class OidcUserInfoCacheEntry(BaseModel):
     """Document stored for one cached scope list."""
@@ -43,8 +46,8 @@ class OidcUserInfoManager:
       same scheme, host and port whose path segments start with the issuer's). Only a token with no ``iss`` at
       all is matched by its client id. A token matching no provider is an error: the bearer token is never
       sent to an unrelated provider.
-    - The userinfo response's ``sub`` must equal the token's ``sub`` (OIDC Core 5.3.2), else the lookup fails
-      and nothing is cached.
+    - For a token that has a ``sub``, the userinfo response must carry the same ``sub`` (OIDC Core 5.3.2); a
+      missing or different one fails the lookup and nothing is cached.
     - The userinfo endpoint is discovered through ``WellKnownConfigurationManager``.
     - Scopes are derived the way fhir-server-ui's ``jwtParser`` does: the ``scope`` claim (plus ``scp``,
       which Okta uses), the claims named in ``scope_claims``, and each claim named in ``group_claims``
@@ -179,17 +182,45 @@ class OidcUserInfoManager:
         """Short digest of ``cache_key``: the key embeds the user's ``sub``, which must not reach logs."""
         return hashlib.sha256(cache_key.encode()).hexdigest()[:12]
 
+    @staticmethod
+    def _user_id(*, access_token: Token) -> str | None:
+        """The token's stable user id claim, when it has a ``sub`` to alias and the claim is a non-empty string."""
+        user_id = (access_token.claims or {}).get(_OKTA_USER_ID_CLAIM)
+        if access_token.subject and isinstance(user_id, str) and user_id:
+            return user_id
+        return None
+
+    @staticmethod
+    def _token_subjects(*, access_token: Token) -> set[str]:
+        """Identifiers a userinfo ``sub`` may legitimately equal for this token; empty for a token without ``sub``.
+
+        Okta org-server access tokens carry the login in ``sub`` and the user id in ``uid``, while the userinfo
+        response's ``sub`` is that user id; so the token's ``uid`` counts as the same subject as its ``sub``.
+        The alias is not issuer-specific and relies on the caller having verified the token (the userinfo
+        request is made with that same token, so the response is always for the token's own user).
+        """
+        subject = access_token.subject
+        if not subject:
+            return set()
+        if not isinstance(subject, str):
+            # A malformed ``sub`` can never be shown to equal the response's; fail closed like any mismatch.
+            raise ValueError("User info response subject is missing or differs from the token's subject")
+        user_id = OidcUserInfoManager._user_id(access_token=access_token)
+        return {subject} | ({user_id} if user_id else set())
+
     async def get_user_info_async(self, *, access_token: Token) -> dict[str, Any]:
         """Fetch the userinfo response for ``access_token``.
 
         ``access_token`` must already have been verified by the caller; its claims are trusted.
 
-        Per OIDC Core 5.3.2 the response's ``sub`` must equal the token's ``sub``; a response that carries a
-        different ``sub`` describes another user and is rejected.
+        Per OIDC Core 5.3.2 the response must carry a ``sub`` equal to the token's ``sub`` (or its ``uid``, see
+        ``_token_subjects``); a response without one, or with a different one, cannot be shown to describe the
+        token's user and is rejected. A token that has no ``sub`` has nothing to compare (its ``uid`` is not
+        consulted), so its response is accepted (and never cached).
 
         Raises:
-            ValueError: the token, auth config, discovery document or response is unusable, or the response
-                is for a different subject.
+            ValueError: the token, auth config, discovery document or response is unusable, or the response's
+                subject is missing or differs from the token's.
             httpx.HTTPError: the userinfo request failed.
         """
         if not access_token.token:
@@ -221,10 +252,11 @@ class OidcUserInfoManager:
                 user_info = response.json()
             if not isinstance(user_info, dict):
                 raise ValueError("User info response is not a valid JSON object")
-            response_subject = user_info.get("sub")
-            if response_subject is not None and access_token.subject and response_subject != access_token.subject:
-                # Neither subject is logged: they identify users.
-                raise ValueError("User info response is for a different subject than the token")
+            token_subjects = self._token_subjects(access_token=access_token)
+            if token_subjects and user_info.get("sub") not in token_subjects:
+                # Missing or different: ``sub`` is required in the response, and one that cannot be shown
+                # to be the token's subject must not be turned into scopes. Neither subject is logged.
+                raise ValueError("User info response subject is missing or differs from the token's subject")
             return user_info
 
     async def get_scopes_from_user_info_async(self, *, access_token: Token) -> list[str]:
@@ -242,7 +274,8 @@ class OidcUserInfoManager:
             cache_key = self.build_cache_key(
                 issuer=access_token.issuer or (access_token.claims or {}).get("iss"),
                 client_id=access_token.client_id,
-                subject=access_token.subject,
+                # The stable user id when the token has one: a login can be reassigned to another user.
+                subject=self._user_id(access_token=access_token) or access_token.subject,
             )
 
             user_info_scopes: list[str] | None = None

{oidcauthlib-3.0.23 → oidcauthlib-3.0.25/oidcauthlib.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: oidcauthlib
-Version: 3.0.23
+Version: 3.0.25
 Summary: oidcauthlib
 Author-email: Imran Qureshi <imran.qureshi@bwell.com>
 License: Apache-2.0
@@ -58,8 +58,8 @@ scopes = await manager.get_scopes_from_user_info_async(access_token=token)
 - **Provider** is matched to the token's `iss`: an exact `issuer`, else a `well_known_uri` on the same scheme,
   host and port whose path segments start with the issuer's. Only a token with no `iss` at all is matched by
   its client id. A token matching no provider raises `ValueError`; it is never sent to another provider.
-- **Subject check:** the userinfo response's `sub` must equal the token's `sub` (OIDC Core 5.3.2); otherwise
-  the lookup raises `ValueError` and nothing is cached.
+- **Subject check:** for a token that has a `sub`, the userinfo response must carry the same `sub`
+  (OIDC Core 5.3.2); a missing or different one raises `ValueError` and nothing is cached.
 - **Cache** key is `oidc-userinfo-scopes:<issuer>:<client_id>:<sub>|v1` with each segment percent-encoded
   (so values containing `:` cannot collide, and two providers never share an entry); only the
   userinfo-derived scopes are stored, never the userinfo response. The token's own scopes are re-derived on every call. A token without

oidcauthlib-3.0.23/VERSION

@@ -1 +0,0 @@
-3.0.23