pyobs-auth 2.0.0.dev0__py3-none-any.whl → 2.0.0.dev2__py3-none-any.whl

pyobs_auth/authentication.py

@@ -5,6 +5,9 @@ support here. See pyobs-core's shared-auth design doc for why: any upstream iden
 (including a self-hosted observation-portal) is meant to be brokered *behind* Keycloak, not
 validated directly by this class, so archive/robotic-backend/etc. only ever need to trust one
 issuer.
+
+This class is written to be safe to stack alongside another Bearer-scheme authenticator that
+can't be modified (e.g. an existing legacy OAuth2 BearerAuthentication) - see below.
 """
 
 from __future__ import annotations
@@ -29,6 +32,15 @@ class KeycloakAuthentication(authentication.BaseAuthentication):
         settings = get_settings()
         validator = TokenValidator(settings)
 
+        # DRF stops the whole authenticator chain on a raise, unlike a `None` return, which just
+        # falls through to the next class. If another Bearer-scheme authenticator is also
+        # registered (e.g. a legacy OAuth2 BearerAuthentication that can't be modified to do the
+        # same check), a token that was never meant for us must not block it from getting a turn -
+        # so defer (return None) for anything that doesn't even claim to be from our issuer, and
+        # only raise once we know the token was meant for us but is actually invalid.
+        if validator.unverified_issuer(token) != settings.issuer:
+            return None
+
         try:
             claims = validator.validate(token)
         except TokenValidationError as exc:

{pyobs_auth-2.0.0.dev0.dist-info → pyobs_auth-2.0.0.dev2.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pyobs-auth
-Version: 2.0.0.dev0
+Version: 2.0.0.dev2
 Summary: Shared Keycloak/OIDC authentication client for pyobs web services
 Author-email: Tim-Oliver Husser <thusser@uni-goettingen.de>
 License-Expression: MIT

{pyobs_auth-2.0.0.dev0.dist-info → pyobs_auth-2.0.0.dev2.dist-info}/RECORD

@@ -1,6 +1,6 @@
 pyobs_auth/__init__.py,sha256=vCI7zULdAAll7fiHPhxlra7xfwbPvPAZwtITHExPYn8,280
 pyobs_auth/apps.py,sha256=gWeEqL9TK3x6owVKHbnUujttu3Nt-qGcquQC7wLb4nY,151
-pyobs_auth/authentication.py,sha256=ejjWWvg39COSUVRxyTX0pOpOYjZSyNNzJ3_0Npk03nY,1708
+pyobs_auth/authentication.py,sha256=H1CCorVntY4yxwjBuUIkm6UuoFbVWjqSGI1P2rp9YGo,2544
 pyobs_auth/client.py,sha256=6WltZrcnJNahwpProomt-q4cDeaq5VRhnerEiTGg61Q,4648
 pyobs_auth/discovery.py,sha256=a7d6uqA8ebMHrRrfy-pHNvyP_RRAO87UOuAryiKiico,1360
 pyobs_auth/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -8,7 +8,7 @@ pyobs_auth/settings.py,sha256=MhHnhsdrlhpLzC7GhVjQEaMhxKz6aDeUFju1J5ieJjM,3051
 pyobs_auth/urls.py,sha256=6fMyNdX7jDyl-wVUXAyUG4HjJngrfR_rk9i2PKt0lGA,236
 pyobs_auth/validation.py,sha256=cOuG6kl4_O03BWACJZfhsPLuEYQvj36FxBYk-adneyI,2673
 pyobs_auth/views.py,sha256=euZ433EcO0mrBoTCmCbRHCrKmbyR0bV1HvIVa6V8lxA,3123
-pyobs_auth-2.0.0.dev0.dist-info/METADATA,sha256=a13okJuEHBtqPzenRZz7ZPFDDAvEP2FNjgN7r0D7xAg,410
-pyobs_auth-2.0.0.dev0.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
-pyobs_auth-2.0.0.dev0.dist-info/licenses/LICENSE,sha256=Gi2yBbEZraESTIWbTnc4elzshQaXpW4QBs9FBotLG7A,1099
-pyobs_auth-2.0.0.dev0.dist-info/RECORD,,
+pyobs_auth-2.0.0.dev2.dist-info/METADATA,sha256=yyxN-cJzX7ZddMMHgL5TKp2phwQtWgPupNpIzUAWhSw,410
+pyobs_auth-2.0.0.dev2.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
+pyobs_auth-2.0.0.dev2.dist-info/licenses/LICENSE,sha256=Gi2yBbEZraESTIWbTnc4elzshQaXpW4QBs9FBotLG7A,1099
+pyobs_auth-2.0.0.dev2.dist-info/RECORD,,