pas.plugins.oidc 2.0.0b2__tar.gz → 2.0.0b3__tar.gz

{pas.plugins.oidc-2.0.0b2 → pas.plugins.oidc-2.0.0b3}/CHANGES.md

@@ -9,6 +9,19 @@
 
 <!-- towncrier release notes start -->
 
+## 2.0.0b3 (2025-02-03)
+
+
+### New features:
+
+- Register the adapter as needed by the @login endpoint present in plone.restapi @erral [#47](https://github.com/collective/pas.plugins.oidc/issues/47)
+
+
+### Internal:
+
+- Bump plone.restapi to 9.10.0 [@ericof]
+
+
 ## 2.0.0b2 (2024-12-09)
 
 

{pas.plugins.oidc-2.0.0b2 → pas.plugins.oidc-2.0.0b3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: pas.plugins.oidc
-Version: 2.0.0b2
+Version: 2.0.0b3
 Summary: OIDC support for Plone sites
 Home-page: https://github.com/collective/pas.plugins.oidc
 Author: mamico
@@ -34,8 +34,9 @@ Requires-Dist: plone.api
 Requires-Dist: plone.app.registry
 Requires-Dist: plone.base
 Requires-Dist: plone.protect
-Requires-Dist: plone.restapi>=8.34.0
+Requires-Dist: plone.restapi>=9.10.0
 Requires-Dist: oic
+Requires-Dist: requests
 Requires-Dist: z3c.form
 Provides-Extra: test
 Requires-Dist: zope.pytestlayer; extra == "test"
@@ -410,6 +411,19 @@ The project is licensed under the GPLv2.
 
 <!-- towncrier release notes start -->
 
+## 2.0.0b3 (2025-02-03)
+
+
+### New features:
+
+- Register the adapter as needed by the @login endpoint present in plone.restapi @erral [#47](https://github.com/collective/pas.plugins.oidc/issues/47)
+
+
+### Internal:
+
+- Bump plone.restapi to 9.10.0 [@ericof]
+
+
 ## 2.0.0b2 (2024-12-09)
 
 

{pas.plugins.oidc-2.0.0b2 → pas.plugins.oidc-2.0.0b3}/setup.py

@@ -14,7 +14,7 @@ long_description = f"""
 
 setup(
     name="pas.plugins.oidc",
-    version="2.0.0b2",
+    version="2.0.0b3",
     description="OIDC support for Plone sites",
     long_description=long_description,
     long_description_content_type="text/markdown",
@@ -59,8 +59,9 @@ setup(
         "plone.app.registry",
         "plone.base",
         "plone.protect",
-        "plone.restapi>=8.34.0",
+        "plone.restapi>=9.10.0",
         "oic",
+        "requests",
         "z3c.form",
     ],
     extras_require={

{pas.plugins.oidc-2.0.0b2 → pas.plugins.oidc-2.0.0b3}/src/pas/plugins/oidc/controlpanel/classic.py

@@ -138,6 +138,14 @@ class OIDCControlPanelAdapter:
     def user_property_as_userid(self, value):
         self.settings.user_property_as_userid = value
 
+    @property
+    def identity_domain_name(self):
+        return self.settings.identity_domain_name
+
+    @identity_domain_name.setter
+    def identity_domain_name(self, value):
+        self.settings.identity_domain_name = value
+
 
 class OIDCSettingsForm(controlpanel.RegistryEditForm):
     schema = IOIDCSettings

{pas.plugins.oidc-2.0.0b2 → pas.plugins.oidc-2.0.0b3}/src/pas/plugins/oidc/interfaces.py

@@ -119,6 +119,13 @@ class IOIDCSettings(Interface):
         default="sub",
     )
 
+    identity_domain_name = schema.TextLine(
+        title=_("Identity Domain Name"),
+        description=_("Required for Oracle Authentication Manager only"),
+        required=False,
+        default="",
+    )
+
 
 class IOIDCControlpanel(IControlpanel):
     """OIDC Control panel"""

{pas.plugins.oidc-2.0.0b2 → pas.plugins.oidc-2.0.0b3}/src/pas/plugins/oidc/plugins.py

@@ -27,6 +27,7 @@ from zope.interface import Interface
 
 import itertools
 import plone.api as api
+import requests
 import string
 
 
@@ -69,6 +70,29 @@ class IOIDCPlugin(Interface):
     """ """
 
 
+class OAMClient(Client):
+    """Override so we can adjust the jwks_uri to add domain needed for OAM"""
+
+    def __init__(self, *args, domain=None, **xargs):
+        super().__init__(self, *args, **xargs)
+        self.domain = domain
+        if domain:
+            session = requests.Session()
+            session.headers.update({"x-oauth-identity-domain-name": domain})
+            self.settings.requests_session = session
+
+    def handle_provider_config(self, pcr, issuer, keys=True, endpoints=True):
+        domain = self.domain
+        if domain:
+            # we need to modify jwks_uri in the provider_info to add the identityDomain for OAM
+            # gets used in https://github.com/CZ-NIC/pyoidc/blob/0bd1eadcefc5ccb7ef6c69d9b631537a7d3cfe30/src/oic/oauth2/__init__.py#L1132
+            url = pcr["jwks_uri"]
+            req = requests.PreparedRequest()
+            req.prepare_url(url, dict(identityDomainName=domain))
+            pcr["jwks_uri"] = req.url
+        return super().handle_provider_config(pcr, issuer, keys, endpoints)
+
+
 @implementer(IOIDCPlugin)
 class OIDCPlugin(BasePlugin):
     """PAS Plugin OpenID Connect."""
@@ -92,6 +116,7 @@ class OIDCPlugin(BasePlugin):
     use_deprecated_redirect_uri_for_logout = False
     use_modified_openid_schema = False
     user_property_as_userid = "sub"
+    identity_domain_name = ""
 
     _properties = (
         dict(id="title", type="string", mode="w", label="Title"),
@@ -160,6 +185,12 @@ class OIDCPlugin(BasePlugin):
             mode="w",
             label="User info property used as userid, default 'sub'",
         ),
+        dict(
+            id="identity_domain_name",
+            type="string",
+            mode="w",
+            label="Identity Domain Name (required for Oracle Authentication Manager only)",
+        ),
     )
 
     def __init__(self, id, title=None):
@@ -331,8 +362,19 @@ class OIDCPlugin(BasePlugin):
 
     # TODO: memoize (?)
     def get_oauth2_client(self):
+        domain = self.getProperty("identity_domain_name")
         try:
-            client = Client(client_authn_method=CLIENT_AUTHN_METHOD)
+            if domain:
+                client = OAMClient(
+                    client_authn_method=CLIENT_AUTHN_METHOD,
+                    domain=domain,
+                )
+            else:
+                client = Client(client_authn_method=CLIENT_AUTHN_METHOD)
+            client.allow["issuer_mismatch"] = (
+                True  # Some providers aren't configured with configured and issuer urls the same even though they should.
+            )
+
             # registration_response = client.register(provider_info["registration_endpoint"], redirect_uris=...)
             # ... oic.exception.RegistrationError: {'error': 'insufficient_scope',
             #     'error_description': "Policy 'Trusted Hosts' rejected request to client-registration service. Details: Host not trusted."}

pas.plugins.oidc-2.0.0b3/src/pas/plugins/oidc/services/login/configure.zcml

@@ -0,0 +1,11 @@
+<configure
+    xmlns="http://namespaces.zope.org/zope"
+    xmlns:plone="http://namespaces.plone.org/plone"
+    >
+
+  <!-- Login options -->
+  <adapter
+      factory=".get.OIDCLoginProviders"
+      name="pas-plugins-oidc-providers"
+      />
+</configure>

pas.plugins.oidc-2.0.0b3/src/pas/plugins/oidc/services/login/get.py

@@ -0,0 +1,29 @@
+from pas.plugins.oidc.plugins import OIDCPlugin
+from plone import api
+from plone.base.interfaces import IPloneSiteRoot
+from plone.restapi.interfaces import ILoginProviders
+from zope.component import adapter
+from zope.interface import implementer
+
+
+@adapter(IPloneSiteRoot)
+@implementer(ILoginProviders)
+class OIDCLoginProviders:
+    def __init__(self, context):
+        self.context = context
+
+    def get_providers(self):
+        options = []
+        acl_users = api.portal.get_tool("acl_users")
+        for plugin in acl_users.objectValues():
+            if isinstance(plugin, OIDCPlugin):
+                options.append(
+                    {
+                        "id": plugin.getId(),
+                        "plugin": "oidc",
+                        "title": plugin.title,
+                        "url": f"{self.context.absolute_url()}/@login-oidc/{plugin.getId()}",
+                    }
+                )
+
+        return options

{pas.plugins.oidc-2.0.0b2 → pas.plugins.oidc-2.0.0b3}/src/pas/plugins/oidc/utils.py

@@ -127,6 +127,8 @@ def authorization_flow_args(plugin: plugins.OIDCPlugin, session: Session) -> dic
         "nonce": session.get("nonce"),
         "redirect_uri": plugin.get_redirect_uris(),
     }
+    if plugin.getProperty("identity_domain_name"):
+        args["domain"] = plugin.getProperty("identity_domain_name", "")
     if plugin.getProperty("use_pkce"):
         # Build a random string of 43 to 128 characters
         # and send it in the request as a base64-encoded urlsafe string of the sha256 hash of that string

{pas.plugins.oidc-2.0.0b2 → pas.plugins.oidc-2.0.0b3}/src/pas.plugins.oidc.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: pas.plugins.oidc
-Version: 2.0.0b2
+Version: 2.0.0b3
 Summary: OIDC support for Plone sites
 Home-page: https://github.com/collective/pas.plugins.oidc
 Author: mamico
@@ -34,8 +34,9 @@ Requires-Dist: plone.api
 Requires-Dist: plone.app.registry
 Requires-Dist: plone.base
 Requires-Dist: plone.protect
-Requires-Dist: plone.restapi>=8.34.0
+Requires-Dist: plone.restapi>=9.10.0
 Requires-Dist: oic
+Requires-Dist: requests
 Requires-Dist: z3c.form
 Provides-Extra: test
 Requires-Dist: zope.pytestlayer; extra == "test"
@@ -410,6 +411,19 @@ The project is licensed under the GPLv2.
 
 <!-- towncrier release notes start -->
 
+## 2.0.0b3 (2025-02-03)
+
+
+### New features:
+
+- Register the adapter as needed by the @login endpoint present in plone.restapi @erral [#47](https://github.com/collective/pas.plugins.oidc/issues/47)
+
+
+### Internal:
+
+- Bump plone.restapi to 9.10.0 [@ericof]
+
+
 ## 2.0.0b2 (2024-12-09)
 
 

{pas.plugins.oidc-2.0.0b2 → pas.plugins.oidc-2.0.0b3}/src/pas.plugins.oidc.egg-info/requires.txt

@@ -6,8 +6,9 @@ plone.api
 plone.app.registry
 plone.base
 plone.protect
-plone.restapi>=8.34.0
+plone.restapi>=9.10.0
 oic
+requests
 z3c.form
 
 [test]

{pas.plugins.oidc-2.0.0b2 → pas.plugins.oidc-2.0.0b3}/tests/services/conftest.py

@@ -23,6 +23,7 @@ def keycloak(keycloak_service):
         "scope": ("openid", "profile", "email"),
         "redirect_uris": ("/login_oidc/oidc",),
         "create_restapi_ticket": True,
+        "identity_domain_name": "blah",  # ensure non OAM SP ignores extra params/header
     }
 
 

pas.plugins.oidc-2.0.0b2/src/pas/plugins/oidc/services/login/configure.zcml

@@ -1,15 +0,0 @@
-<configure
-    xmlns="http://namespaces.zope.org/zope"
-    xmlns:plone="http://namespaces.plone.org/plone"
-    >
-
-  <!-- Login options -->
-  <plone:service
-      method="GET"
-      factory=".get.Get"
-      for="Products.CMFPlone.interfaces.IPloneSiteRoot"
-      permission="zope.Public"
-      name="@login"
-      />
-
-</configure>

pas.plugins.oidc-2.0.0b2/src/pas/plugins/oidc/services/login/get.py

@@ -1,42 +0,0 @@
-from pas.plugins.oidc import utils
-from pas.plugins.oidc.plugins import OIDCPlugin
-from plone import api
-from plone.restapi.services import Service
-from typing import Dict
-from typing import List
-
-
-class Get(Service):
-    """List available login options for the site."""
-
-    def check_permission(self):
-        return True
-
-    @staticmethod
-    def list_login_providers() -> List[Dict]:
-        """List all configured login providers.
-
-        This should be moved to plone.restapi and be extendable.
-        :returns: List of login options.
-        """
-        portal_url = api.portal.get().absolute_url()
-        plugins = []
-        for plugin in utils.get_plugins():
-            if isinstance(plugin, OIDCPlugin):
-                plugins.append(
-                    {
-                        "id": plugin.getId(),
-                        "plugin": "oidc",
-                        "url": f"{portal_url}/@login-oidc/{plugin.getId()}",
-                        "title": plugin.title,
-                    }
-                )
-        return plugins
-
-    def reply(self) -> Dict[str, List[Dict]]:
-        """List login options available for the site.
-
-        :returns: Login options information.
-        """
-        providers = self.list_login_providers()
-        return {"options": providers}