pyobs-auth 2.0.0.dev2__tar.gz → 2.0.0.dev4__tar.gz

{pyobs_auth-2.0.0.dev2 → pyobs_auth-2.0.0.dev4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pyobs-auth
-Version: 2.0.0.dev2
+Version: 2.0.0.dev4
 Summary: Shared Keycloak/OIDC authentication client for pyobs web services
 Author-email: Tim-Oliver Husser <thusser@uni-goettingen.de>
 License-Expression: MIT

{pyobs_auth-2.0.0.dev2 → pyobs_auth-2.0.0.dev4}/pyobs_auth/client.py

@@ -112,6 +112,24 @@ class KeycloakClient:
 
         return self._post_token(document.token_endpoint, data)
 
+    def end_session_url(self, *, id_token_hint: str, post_logout_redirect_uri: str | None = None) -> str:
+        """RP-Initiated Logout: URL to send the browser to end the user's Keycloak SSO session.
+
+        `id_token_hint` lets Keycloak log the user out with a single redirect instead of showing
+        a confirmation page - so an id_token needs to have been kept around from login for this
+        to give a clean one-click logout.
+        """
+        document = self._discovery()
+        if not document.end_session_endpoint:
+            raise ValueError("this Keycloak realm did not advertise an end_session_endpoint")
+
+        effective_redirect_uri = post_logout_redirect_uri or self._settings.post_logout_redirect_uri
+        params = {"id_token_hint": id_token_hint, "client_id": self._settings.client_id}
+        if effective_redirect_uri:
+            params["post_logout_redirect_uri"] = effective_redirect_uri
+
+        return f"{document.end_session_endpoint}?{urlencode(params)}"
+
     def _post_token(self, token_endpoint: str, data: dict[str, str]) -> dict[str, Any]:
         response = self._session.post(token_endpoint, data=data, timeout=10.0)
         if response.status_code != 200:

{pyobs_auth-2.0.0.dev2 → pyobs_auth-2.0.0.dev4}/pyobs_auth/settings.py

@@ -8,6 +8,7 @@ Read from the Django ``PYOBS_AUTH`` setting, e.g.::
         "CLIENT_ID": "archive",
         "CLIENT_SECRET": os.getenv("KEYCLOAK_CLIENT_SECRET"),
         "REDIRECT_URI": "https://archive.example.org/accounts/keycloak/callback/",
+        "POST_LOGOUT_REDIRECT_URI": "https://archive.example.org/",
         # dotted path to a callable(claims: dict) -> django.contrib.auth.models.User
         "USER_RESOLVER": "pyobs_archive.authentication.keycloak.resolve_user",
     }
@@ -29,6 +30,7 @@ class KeycloakSettings:
     client_secret: str | None = None
     audience: str | None = None
     redirect_uri: str | None = None
+    post_logout_redirect_uri: str | None = None
     scopes: tuple[str, ...] = field(default_factory=lambda: ("openid", "profile", "email"))
     user_resolver: str | None = None
 
@@ -80,6 +82,7 @@ def get_settings() -> KeycloakSettings:
         client_secret=raw.get("CLIENT_SECRET"),
         audience=raw.get("AUDIENCE"),
         redirect_uri=raw.get("REDIRECT_URI"),
+        post_logout_redirect_uri=raw.get("POST_LOGOUT_REDIRECT_URI"),
         scopes=tuple(raw.get("SCOPES", ("openid", "profile", "email"))),
         user_resolver=raw.get("USER_RESOLVER"),
     )

{pyobs_auth-2.0.0.dev2 → pyobs_auth-2.0.0.dev4}/pyobs_auth/urls.py

@@ -1,10 +1,11 @@
 from django.urls import path
 
-from .views import CallbackView, LoginView
+from .views import CallbackView, LoginView, LogoutView
 
 app_name = "pyobs_auth"
 
 urlpatterns = [
     path("login/", LoginView.as_view(), name="login"),
     path("callback/", CallbackView.as_view(), name="callback"),
+    path("logout/", LogoutView.as_view(), name="logout"),
 ]

{pyobs_auth-2.0.0.dev2 → pyobs_auth-2.0.0.dev4}/pyobs_auth/views.py

@@ -8,7 +8,7 @@ plain Django views instead; wire them in via pyobs_auth.urls.
 from __future__ import annotations
 
 from django.conf import settings as django_settings
-from django.contrib.auth import login
+from django.contrib.auth import login, logout
 from django.http import HttpRequest, HttpResponse, HttpResponseBadRequest, HttpResponseRedirect
 from django.views import View
 
@@ -19,6 +19,9 @@ from .validation import TokenValidationError, TokenValidator
 SESSION_STATE_KEY = "pyobs_auth_state"
 SESSION_CODE_VERIFIER_KEY = "pyobs_auth_code_verifier"
 SESSION_NEXT_KEY = "pyobs_auth_next"
+# Presence of this key is also how LogoutView tells "this session came from Keycloak" apart from
+# a plain local-password session, so it knows whether to also end the Keycloak SSO session.
+SESSION_ID_TOKEN_KEY = "pyobs_auth_id_token"
 
 
 class LoginView(View):
@@ -29,7 +32,9 @@ class LoginView(View):
 
         request.session[SESSION_STATE_KEY] = authorization.state
         request.session[SESSION_CODE_VERIFIER_KEY] = authorization.code_verifier
-        request.session[SESSION_NEXT_KEY] = request.GET.get("next", "/")
+        # `or "/"` (not just a dict default) because `?next=` with an empty value is a present-but-
+        # falsy key - `.get("next", "/")` alone would return "" instead of falling back to "/".
+        request.session[SESSION_NEXT_KEY] = request.GET.get("next") or "/"
 
         return HttpResponseRedirect(authorization.url)
 
@@ -44,7 +49,7 @@ class CallbackView(View):
         state = request.GET.get("state")
         expected_state = request.session.pop(SESSION_STATE_KEY, None)
         code_verifier = request.session.pop(SESSION_CODE_VERIFIER_KEY, None)
-        next_url = request.session.pop(SESSION_NEXT_KEY, "/")
+        next_url = request.session.pop(SESSION_NEXT_KEY, "/") or "/"
 
         if not code or not state or not code_verifier or state != expected_state:
             return HttpResponseBadRequest("Invalid or expired login state")
@@ -74,5 +79,34 @@ class CallbackView(View):
 
         backend = getattr(django_settings, "PYOBS_AUTH_LOGIN_BACKEND", "django.contrib.auth.backends.ModelBackend")
         login(request, user, backend=backend)
+        # Set after login(), which rotates the session key - setting it before would risk the
+        # value getting lost if that rotation ever stopped preserving existing session data.
+        id_token = tokens.get("id_token")
+        if id_token:
+            request.session[SESSION_ID_TOKEN_KEY] = id_token
 
         return HttpResponseRedirect(next_url)
+
+
+class LogoutView(View):
+    """Ends the local Django session and, only if this session was established via Keycloak
+    (an id_token was stored at login), also ends the Keycloak SSO session via RP-Initiated
+    Logout - so a plain local-password session just gets an ordinary local logout, unaffected."""
+
+    http_method_names = ["post"]
+
+    def post(self, request: HttpRequest) -> HttpResponse:
+        id_token = request.session.pop(SESSION_ID_TOKEN_KEY, None)
+        logout(request)
+
+        if id_token is None:
+            next_url = request.POST.get("next") or request.GET.get("next") or "/"
+            return HttpResponseRedirect(next_url)
+
+        # post_logout_redirect_uri here deliberately comes only from PYOBS_AUTH (a fixed,
+        # pre-registered absolute URL, like REDIRECT_URI for login) rather than from a per-request
+        # `next` - Keycloak validates it against "Valid post logout redirect URIs" for the client,
+        # so an arbitrary relative path wouldn't match and the redirect would fail.
+        settings = get_settings()
+        client = KeycloakClient(settings)
+        return HttpResponseRedirect(client.end_session_url(id_token_hint=id_token))

{pyobs_auth-2.0.0.dev2 → pyobs_auth-2.0.0.dev4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pyobs-auth"
-version = "2.0.0.dev2"
+version = "2.0.0.dev4"
 description = "Shared Keycloak/OIDC authentication client for pyobs web services"
 authors = [{ name = "Tim-Oliver Husser", email = "thusser@uni-goettingen.de" }]
 requires-python = ">=3.11"