pyobs-auth 2.0.0.dev7__tar.gz → 2.0.0.dev9__tar.gz

{pyobs_auth-2.0.0.dev7 → pyobs_auth-2.0.0.dev9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pyobs-auth
-Version: 2.0.0.dev7
+Version: 2.0.0.dev9
 Summary: Shared Keycloak/OIDC authentication client for pyobs web services
 Author-email: Tim-Oliver Husser <thusser@uni-goettingen.de>
 License-Expression: MIT

{pyobs_auth-2.0.0.dev7 → pyobs_auth-2.0.0.dev9}/pyobs_auth/client.py

@@ -42,7 +42,9 @@ class KeycloakClient:
     def _discovery(self):
         return fetch_discovery_document(self._settings.discovery_url)
 
-    def start_authorization(self, *, redirect_uri: str | None = None) -> AuthorizationRequest:
+    def start_authorization(
+        self, *, idp_hint: str | None = None, redirect_uri: str | None = None
+    ) -> AuthorizationRequest:
         """Build the redirect URL for the authorization-code + PKCE login flow."""
         document = self._discovery()
         state = _b64url(secrets.token_bytes(24))
@@ -62,6 +64,10 @@ class KeycloakClient:
             "code_challenge": code_challenge,
             "code_challenge_method": "S256",
         }
+        if idp_hint:
+            # kc_idp_hint: Keycloak skips its login/IdP-selection page and redirects straight to
+            # that identity provider; unknown aliases fall back to the normal login page.
+            params["kc_idp_hint"] = idp_hint
         url = f"{document.authorization_endpoint}?{urlencode(params)}"
         return AuthorizationRequest(url=url, state=state, code_verifier=code_verifier)
 

{pyobs_auth-2.0.0.dev7 → pyobs_auth-2.0.0.dev9}/pyobs_auth/settings.py

@@ -33,6 +33,7 @@ class KeycloakSettings:
     post_logout_redirect_uri: str | None = None
     scopes: tuple[str, ...] = field(default_factory=lambda: ("openid", "profile", "email"))
     user_resolver: str | None = None
+    idp_hint: str | None = None
 
     @property
     def issuer(self) -> str:
@@ -85,4 +86,5 @@ def get_settings() -> KeycloakSettings:
         post_logout_redirect_uri=raw.get("POST_LOGOUT_REDIRECT_URI"),
         scopes=tuple(raw.get("SCOPES", ("openid", "profile", "email"))),
         user_resolver=raw.get("USER_RESOLVER"),
+        idp_hint=raw.get("IDP_HINT"),
     )

{pyobs_auth-2.0.0.dev7 → pyobs_auth-2.0.0.dev9}/pyobs_auth/views.py

@@ -37,7 +37,12 @@ class LoginView(View):
     def get(self, request: HttpRequest) -> HttpResponse:
         settings = get_settings()
         client = KeycloakClient(settings)
-        authorization = client.start_authorization()
+        # ?idp_hint= handling: absent -> the configured default hint (fast path); present but
+        # empty -> no hint (local Keycloak account); any value -> that specific hint.
+        idp_hint = request.GET.get("idp_hint")
+        if idp_hint is None:
+            idp_hint = settings.idp_hint
+        authorization = client.start_authorization(idp_hint=idp_hint or None)
 
         request.session[SESSION_STATE_KEY] = authorization.state
         request.session[SESSION_CODE_VERIFIER_KEY] = authorization.code_verifier

{pyobs_auth-2.0.0.dev7 → pyobs_auth-2.0.0.dev9}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pyobs-auth"
-version = "2.0.0.dev7"
+version = "2.0.0.dev9"
 description = "Shared Keycloak/OIDC authentication client for pyobs web services"
 authors = [{ name = "Tim-Oliver Husser", email = "thusser@uni-goettingen.de" }]
 requires-python = ">=3.11"