pypomes-iam 0.5.8__py3-none-any.whl → 0.6.9__py3-none-any.whl

pypomes_iam/__init__.py

@@ -6,7 +6,7 @@ from .iam_common import (
     IamServer, IamParam
 )
 from .iam_pomes import (
-    iam_setup, iam_get_token
+    iam_setup, iam_get_env_parameters, iam_get_token
 )
 from .iam_services import (
      jwt_required, logger_register
@@ -25,7 +25,7 @@ __all__ = [
     # iam_commons
     "IamServer", "IamParam",
     # iam_pomes
-    "iam_setup", "iam_get_token",
+    "iam_setup", "iam_get_env_parameters", "iam_get_token",
     # iam_services
     "jwt_required", "logger_register",
     # provider_pomes

pypomes_iam/iam_actions.py

@@ -10,8 +10,8 @@ from typing import Any
 
 from .iam_common import (
     IamServer, IamParam, UserParam, _iam_lock,
-    _get_iam_users, _get_iam_registry,  # _get_public_key,
-    _get_login_timeout, _get_user_data
+    _get_iam_users, _get_iam_registry, _get_public_key,
+    _get_login_timeout, _get_user_data, _iam_server_from_issuer
 )
 from .token_pomes import token_get_claims, token_validate
 
@@ -59,7 +59,7 @@ def action_login(iam_server: IamServer,
                                               errors=errors,
                                               logger=logger)
             if not errors:
-                user_data[UserParam.LOGIN_EXPIRATION] = int(datetime.now(tz=TZ_LOCAL).timestamp()) + timeout \
+                user_data[UserParam.LOGIN_EXPIRATION] = (int(datetime.now(tz=TZ_LOCAL).timestamp()) + timeout) \
                     if timeout else None
                 redirect_uri: str = args.get(UserParam.REDIRECT_URI)
                 user_data[UserParam.REDIRECT_URI] = redirect_uri
@@ -138,6 +138,7 @@ def action_token(iam_server: IamServer,
                                                        user_id=user_id,
                                                        errors=errors,
                                                        logger=logger)
+            # retrieve the stored access token
             token: str = user_data[UserParam.ACCESS_TOKEN] if user_data else None
             if token:
                 access_expiration: int = user_data.get(UserParam.ACCESS_EXPIRATION)
@@ -148,7 +149,7 @@ def action_token(iam_server: IamServer,
                     # access token has expired
                     refresh_token: str = user_data[UserParam.REFRESH_TOKEN]
                     if refresh_token:
-                        refresh_expiration = user_data[UserParam.REFRESH_EXPIRATION]
+                        refresh_expiration: int = user_data[UserParam.REFRESH_EXPIRATION]
                         if now < refresh_expiration:
                             header_data: dict[str, str] = {
                                 "Content-Type": "application/json"
@@ -242,7 +243,7 @@ def action_callback(iam_server: IamServer,
                 users.pop(oauth_state)
                 code: str = args.get("code")
                 header_data: dict[str, str] = {
-                    "Content-Type": "application/json"
+                    "Content-Type": "application/x-www-form-urlencoded"
                 }
                 body_data: dict[str, Any] = {
                     "grant_type": "authorization_code",
@@ -367,7 +368,7 @@ def __assert_link(iam_server: IamServer,
     """
     Make sure *iam_server* has a link associating *user_id* to an internal user identification.
     This is a requirement for exchanging a token issued by a federated *IAM* server for an equivalent
-    one from *iam_server.
+    one from *iam_server*.
 
     :param iam_server: the reference *IAM* server
     :param user_id: the reference user identification
@@ -375,6 +376,9 @@ def __assert_link(iam_server: IamServer,
     :param errors: incidental errors
     :param logger: optional logger
     """
+    if logger:
+        logger.debug(msg="Verifying associations for user "
+                         f"'{user_id}' in IAM server '{iam_server}'")
     # obtain a token with administrative rights
     admin_token: str = __get_administrative_token(iam_server=iam_server,
                                                   errors=errors,
@@ -383,7 +387,10 @@ def __assert_link(iam_server: IamServer,
         registry: dict[str, Any] = _get_iam_registry(iam_server=iam_server,
                                                      errors=errors,
                                                      logger=logger)
-        # obtain the internal user identification for 'from_id'
+        # obtain the internal user identification for 'user_id'
+        if logger:
+            logger.debug(msg="Obtaining internal identification "
+                             f"for user {user_id} in IAM server {iam_server}")
         url: str = f"{registry[IamParam.URL_BASE]}/admin/realms/{registry[IamParam.CLIENT_REALM]}/users"
         header_data: dict[str, str] = {
             "Authorization": f"Bearer {admin_token}",
@@ -393,15 +400,18 @@ def __assert_link(iam_server: IamServer,
             "username": user_id,
             "exact": "true"
         }
-        users: dict[str, Any] = __get_for_data(url=url,
-                                               header_data=header_data,
-                                               params=params,
-                                               errors=errors,
-                                               logger=logger)
+        users: list[dict[str, Any]] = __get_for_data(url=url,
+                                                     header_data=header_data,
+                                                     params=params,
+                                                     errors=errors,
+                                                     logger=logger)
         if users:
             # verify whether the 'oidc' protocol is referred to in an
-            # association between 'from_id' and the internal user identification
-            internal_id: str = users.get("id")
+            # association between 'user_id' and the internal user identification
+            internal_id: str = users[0].get("id")
+            if logger:
+                logger.debug(msg="Obtaining the providers federated with "
+                                 f"IAM server '{iam_server}' for internal identification '{internal_id}'")
             url = (f"{registry[IamParam.URL_BASE]}/admin/realms/"
                    f"{registry[IamParam.CLIENT_REALM]}/users/{internal_id}/federated-identity")
             providers: list[dict[str, Any]] = __get_for_data(url=url,
@@ -410,27 +420,38 @@ def __assert_link(iam_server: IamServer,
                                                              errors=errors,
                                                              logger=logger)
             no_link: bool = True
-            for provider in providers:
-                if provider.get("identityProvider") == "oidc":
-                    no_link = False
-                    break
-            if no_link:
-                # link the identities
-                claims: dict[str, dict[str, Any]] = token_get_claims(token=token,
-                                                                     errors=errors,
-                                                                     logger=logger)
-                if claims:
-                    token_sub: str = claims["paylod"]["sub"]
-                    url += "/oidc"
-                    body_data: dict[str, Any] = {
-                        "userId": token_sub,
-                        "userName": user_id
-                    }
-                    __post_data(url=url,
-                                header_data=header_data,
-                                body_data=body_data,
-                                errors=errors,
-                                logger=logger)
+            claims: dict[str, dict[str, Any]] = token_get_claims(token=token,
+                                                                 errors=errors,
+                                                                 logger=logger)
+            issuer: str = claims["payload"]["iss"] if claims else None
+            provider_name: str = _iam_server_from_issuer(issuer=issuer,
+                                                         errors=errors,
+                                                         logger=logger) if issuer else None
+            if provider_name:
+                for provider in providers:
+                    if provider.get("identityProvider") == provider_name:
+                        no_link = False
+                        break
+                if no_link:
+                    # link the identities
+                    claims: dict[str, dict[str, Any]] = token_get_claims(token=token,
+                                                                         errors=errors,
+                                                                         logger=logger)
+                    if claims:
+                        token_sub: str = claims["payload"]["sub"]
+                        if logger:
+                            logger.debug(msg="Creating an association between identifications "
+                                             f"'{user_id}' and '{token_sub}' in IAM server {iam_server}")
+                        url += f"/{provider_name}"
+                        body_data: dict[str, Any] = {
+                            "userId": token_sub,
+                            "userName": user_id
+                        }
+                        __post_data(url=url,
+                                    header_data=header_data,
+                                    body_data=body_data,
+                                    errors=errors,
+                                    logger=logger)
 
 
 def __get_administrative_token(iam_server: IamServer,
@@ -450,31 +471,47 @@ def __get_administrative_token(iam_server: IamServer,
     # initialize the return variable
     result: str | None = None
 
+    if logger:
+        logger.debug(msg="Requesting a token with "
+                         f"administrative rights to IAM Server '{iam_server}'")
+
     # obtain the IAM server's registry
     registry: dict[str, Any] = _get_iam_registry(iam_server=iam_server,
                                                  errors=errors,
                                                  logger=logger)
-    if registry and registry[IamParam.ADMIN_ID] and registry[IamParam.ADMIN_SECRET]:
-        header_data: dict[str, str] = {
-            "Content-Type": "application/json"
-        }
-        body_data: dict[str, str] = {
-            "grant-type": "password",
-            "username": registry[IamParam.ADMIN_ID],
-            "password": registry[IamParam.ADMIN_SECRET],
-            "client_id": registry[IamParam.CLIENT_ID]
-        }
-        token_data: dict[str, Any] = __post_for_token(iam_server=iam_server,
-                                                      header_data=header_data,
-                                                      body_data=body_data,
-                                                      errors=errors,
-                                                      logger=logger)
-        if token_data:
-            # obtain the token
-            result = token_data["access_token"]
-    else:
-        msg: str = (f"To obtain token with administrative rights from '{iam_server}', "
-                    f"the credentials for the realm administrator must be provided at setup time")
+    if registry:
+        if registry[IamParam.ADMIN_ID] and registry[IamParam.ADMIN_SECRET]:
+            header_data: dict[str, str] = {
+                "Content-Type": "application/x-www-form-urlencoded"
+            }
+            body_data: dict[str, str] = {
+                "grant_type": "password",
+                "username": registry[IamParam.ADMIN_ID],
+                "password": registry[IamParam.ADMIN_SECRET],
+                "client_id": "admin-cli"
+            }
+            token_data: dict[str, Any] = __post_for_token(iam_server=iam_server,
+                                                          header_data=header_data,
+                                                          body_data=body_data,
+                                                          errors=errors,
+                                                          logger=logger)
+            if token_data:
+                # obtain the token
+                result = token_data["access_token"]
+                if logger:
+                    logger.debug(msg="Administrative token obtained")
+
+        elif logger or isinstance(errors, list):
+            msg: str = ("Credentials for administrator of realm "
+                        f"'{registry[IamParam.CLIENT_REALM]}' "
+                        f"at IAM server '{iam_server}' not provided")
+            if logger:
+                logger.error(msg=msg)
+            if isinstance(errors, list):
+                errors.append(msg)
+
+    elif logger or isinstance(errors, list):
+        msg: str = f"Unknown IAM server {iam_server}"
         if logger:
             logger.error(msg=msg)
         if isinstance(errors, list):
@@ -510,14 +547,19 @@ def __get_client_secret(iam_server: IamServer,
                                                 errors=errors,
                                                 logger=logger)
         if token:
+            realm: str = registry[IamParam.CLIENT_REALM]
+            client_id: str = registry[IamParam.CLIENT_ID]
+            if logger:
+                logger.debug(msg=f"Obtaining the UUID for client '{client_id}', "
+                                 f"in realm '{realm}' at IAM server '{iam_server}'")
             # obtain the client UUID
-            url: str = f"{registry[IamParam.URL_BASE]}/realms/{registry[IamParam.CLIENT_REALM]}/clients"
+            url: str = f"{registry[IamParam.URL_BASE]}/realms/{realm}/clients"
             header_data: dict[str, str] = {
                 "Authorization": f"Bearer {token}",
                 "Content-Type": "application/json"
             }
             params: dict[str, str] = {
-                "clientId": registry[IamParam.CLIENT_ID]
+                "clientId": client_id
             }
             clients: list[dict[str, Any]] = __get_for_data(url=url,
                                                            header_data=header_data,
@@ -527,6 +569,9 @@ def __get_client_secret(iam_server: IamServer,
             if clients:
                 # obtain the client's secret password
                 client_uuid: str = clients[0]["id"]
+                if logger:
+                    logger.debug(msg=f"Obtaining the secret for client UUID '{client_uuid}', "
+                                     f"in realm '{realm}' at IAM server '{iam_server}'")
                 url += f"/{client_uuid}/client-secret"
                 reply: dict[str, Any] = __get_for_data(url=url,
                                                        header_data=header_data,
@@ -573,7 +618,7 @@ def __get_for_data(url: str,
                 logger.debug(msg=f"GET success, {json.dumps(obj=result,
                                                             ensure_ascii=False)}")
         else:
-            # request resulted in error
+            # request failed, report the problem
             msg: str = f"GET failure, status {response.status_code}, reason {response.reason}"
             if hasattr(response, "content") and response.content:
                 msg += f", content '{response.content}'"
@@ -615,7 +660,7 @@ def __post_data(url: str,
                                                    headers=header_data,
                                                    data=body_data)
         if response.status_code >= 400:
-            # request resulted in error
+            # request failed, report the problem
             msg = f"POST failure, status {response.status_code}, reason {response.reason}"
             if hasattr(response, "content") and response.content:
                 msg += f", content '{response.content}'"
@@ -665,9 +710,9 @@ def __post_for_token(iam_server: IamServer,
         - "username": <realm-administrator-identification>
         - "password": <realm-administrator-secret>
 
-    These attributes are then added to *body_data*:
+    These attributes are then added to *body_data*, except for acquiring administrative tokens:
         - "client_id": <client-id>
-        - "client_secret": <client-secret>  <- except for acquiring administrative tokens
+        - "client_secret": <client-secret>
 
     If the operation is successful, the token data is stored in the *IAM* server's registry, and returned.
     Otherwise, *errors* will contain the appropriate error message.
@@ -699,21 +744,25 @@ def __post_for_token(iam_server: IamServer,
                                                      logger=logger)
         if registry:
             # complete the data to send in body of request
-            body_data["client_id"] = registry[IamParam.CLIENT_ID]
+            if body_data["grant_type"] != "password":
+                body_data["client_id"] = registry[IamParam.CLIENT_ID]
 
             # build the URL
             base_url: str = f"{registry[IamParam.URL_BASE]}/realms/{registry[IamParam.CLIENT_REALM]}"
             url: str = f"{base_url}/protocol/openid-connect/token"
-
-            # log the POST ('client_secret' data must not be shown in log)
+            #  'client_secret' data must not be shown in log
+            msg: str = f"POST {url}, {json.dumps(obj=body_data,
+                                                 ensure_ascii=False)}"
+            if body_data["grant_type"] != "password":
+                # 'client_secret' not required for requesting tokens from staging environments
+                client_secret: str = __get_client_secret(iam_server=iam_server,
+                                                         errors=None,
+                                                         logger=logger)
+                if client_secret:
+                    body_data["client_secret"] = client_secret
+            # log the POST
             if logger:
-                logger.debug(msg=f"POST {url}, {json.dumps(obj=body_data,
-                                                           ensure_ascii=False)}")
-            client_secret: str = __get_client_secret(iam_server=iam_server,
-                                                     errors=errors,
-                                                     logger=logger)
-            if body_data["grant_type"] != "password" and client_secret:
-                body_data["client_secret"] = client_secret
+                logger.debug(msg=msg)
 
             # obtain the token
             try:
@@ -735,7 +784,7 @@ def __post_for_token(iam_server: IamServer,
                         logger.debug(msg=f"POST success, {json.dumps(obj=result,
                                                                      ensure_ascii=False)}")
                 else:
-                    # request resulted in error
+                    # request failed, report the problem
                     err_msg = f"POST failure, status {response.status_code}, reason {response.reason}"
                     if hasattr(response, "content") and response.content:
                         err_msg += f", content '{response.content}'"
@@ -796,9 +845,9 @@ def __validate_and_store(iam_server: IamServer,
             user_data["access-expiration"] = now + token_data.get("expires_in")
             refresh_exp: int = user_data.get("refresh_expires_in")
             user_data["refresh-expiration"] = (now + refresh_exp) if refresh_exp else sys.maxsize
-            # public_key: str = _get_public_key(iam_server=iam_server,
-            #                                   errors=errors,
-            #                                   logger=logger)
+            public_key: str = _get_public_key(iam_server=iam_server,
+                                              errors=errors,
+                                              logger=logger)
             recipient_attr = registry[IamParam.RECIPIENT_ATTR]
             login_id = user_data.pop("login-id", None)
             base_url: str = f"{registry[IamParam.URL_BASE]}/realms/{registry[IamParam.CLIENT_REALM]}"
@@ -806,7 +855,7 @@ def __validate_and_store(iam_server: IamServer,
                                                                issuer=base_url,
                                                                recipient_id=login_id,
                                                                recipient_attr=recipient_attr,
-                                                               # public_key=public_key,
+                                                               public_key=public_key,
                                                                errors=errors,
                                                                logger=logger)
             if claims:

pypomes_iam/iam_common.py

@@ -3,10 +3,7 @@ import sys
 from datetime import datetime
 from enum import StrEnum, auto
 from logging import Logger
-from pypomes_core import (
-    APP_PREFIX, TZ_LOCAL,
-    env_get_int, env_get_str, env_get_enum, env_get_enums, exc_format
-)
+from pypomes_core import TZ_LOCAL, exc_format
 from pypomes_crypto import crypto_jwk_convert
 from threading import RLock
 from typing import Any, Final
@@ -16,7 +13,7 @@ class IamServer(StrEnum):
     """
     Supported IAM servers.
     """
-    JUSRBR = auto()
+    JUSBR = auto()
     KEYCLOAK = auto()
 
 
@@ -57,85 +54,38 @@ class UserParam(StrEnum):
     REDIRECT_URI = "redirect-uri"
 
 
-def __get_iam_data() -> dict[IamServer, dict[IamParam, Any]]:
-    """
-    Establish the configuration data for select *IAM* servers, from environment variables.
-
-    The preferred way to specify configuration parameters is dynamically with *iam_setup()*;.
-    Specifying configuration parameters with environment variables can be done in two ways:
-
-    1. for a single *IAM* server, specify the data set
-          - *<APP_PREFIX>_IAM_SERVER*               (required, one of *jusbr*, *keycloak*)
-          - *<APP_PREFIX>_IAM_ADMIN_ID*             (optional, needed only if administrative duties are performed)
-          - *<APP_PREFIX>_IAM_ADMIN_PWD*            (optional, needed only if administrative duties are performed)
-          - *<APP_PREFIX>_IAM_CLIENT_ID*            (required)
-          - *<APP_PREFIX>_IAM_CLIENT_REALM*         (required)
-          - *<APP_PREFIX>_IAM_CLIENT_SECRET*        (required)
-          - *<APP_PREFIX>_IAM_ENDPOINT_CALLBACK*    (optional)
-          - *<APP_PREFIX>_IAM_ENDPOINT_LOGIN*       (optional)
-          - *<APP_PREFIX>_IAM_ENDPOINT_LOGOUT*      (optional)
-          - *<APP_PREFIX>_IAM_ENDPOINT_TOKEN*       (optional)
-          - *<APP_PREFIX>_IAM_ENDPOINT_EXCHANGE*    (optional)
-          - *<APP_PREFIX>_IAM_LOGIN_TIMEOUT*        (optional, defaults to no timeout)
-          - *<APP_PREFIX>_IAM_PK_LIFETIME*          (optional, defaults to non-terminating lifetime)
-          - *<APP_PREFIX>_IAM_RECIPIENT_ATTR*       (required)
-          - *<APP_PREFIX>_IAM_URL_BASE*             (required)
-
-    2. the parameters *PUBLIC_KEY*, *PK_EXPIRATION*, and *USERS* cannot be assigned values,
-       as they are reserved for internal use
-
-    3. for multiple *IAM* servers, specify a comma-separated list of servers in
-       *<APP_PREFIX>_IAM_SERVERS*, and for each server, specify the data set above,
-       respectively replacing *_IAM_* with *_JUSBR_* or *_KEYCLOAK_*, for the servers listed above
-
-    :return: the configuration data for the selected *IAM* servers
-    """
-    # initialize the return valiable
-    result: dict[IamServer, dict[IamParam, Any]] = {}
-
-    servers: list[IamServer] = []
-    single_server: IamServer = env_get_enum(key=f"{APP_PREFIX}_IAM_SERVER",
-                                            enum_class=IamServer)
-    if single_server:
-        default_setup: bool = True
-        servers.append(single_server)
-    else:
-        default_setup: bool = False
-        multi_servers: list[IamServer] = env_get_enums(key=f"{APP_PREFIX}_IAM_SERVERS",
-                                                       enum_class=IamServer)
-        if multi_servers:
-            servers.extend(multi_servers)
-
-    for server in servers:
-        if default_setup:
-            prefix: str = "IAM"
-            default_setup = False
-        else:
-            prefix: str = server
-        result[server] = {
-            IamParam.ADMIN_ID: env_get_str(key=f"{APP_PREFIX}_{prefix}_ADMIN_ID"),
-            IamParam.ADMIN_SECRET: env_get_str(key=f"{APP_PREFIX}_{prefix}_ADMIN_PWD"),
-            IamParam.CLIENT_ID: env_get_str(key=f"{APP_PREFIX}_{prefix}_CLIENT_ID"),
-            IamParam.CLIENT_REALM: env_get_str(key=f"{APP_PREFIX}_{prefix}_CLIENT_REALM"),
-            IamParam.CLIENT_SECRET: env_get_str(key=f"{APP_PREFIX}_{prefix}_CLIENT_SECRET"),
-            IamParam.LOGIN_TIMEOUT: env_get_int(key=f"{APP_PREFIX}_{prefix}_CLIENT_TIMEOUT"),
-            IamParam.ENDPOINT_CALLBACK: env_get_str(key=f"{APP_PREFIX}_{prefix}_ENDPOINT_CALLBACK"),
-            IamParam.ENDPOINT_LOGIN: env_get_str(key=f"{APP_PREFIX}_{prefix}_ENDPOINT_LOGIN"),
-            IamParam.ENDPOINT_LOGOUT: env_get_str(key=f"{APP_PREFIX}_{prefix}_ENDPOINT_LOGOUT"),
-            IamParam.ENDPOINT_TOKEN: env_get_str(key=f"{APP_PREFIX}_{prefix}_ENDPOINT_TOKEN"),
-            IamParam.ENDPOINT_EXCHANGE: env_get_str(key=f"{APP_PREFIX}_{prefix}_ENDPOINT_EXCHANGE"),
-            IamParam.PK_LIFETIME: env_get_str(key=f"{APP_PREFIX}_{prefix}_PK_LIFETIME"),
-            IamParam.RECIPIENT_ATTR: env_get_str(key=f"{APP_PREFIX}_{prefix}_RECIPIENT_ATTR"),
-            IamParam.URL_BASE: env_get_str(key=f"{APP_PREFIX}_{prefix}_URL_BASE")
-        }
-
-    return result
-
+# The configuration parameters for the IAM servers are specified dynamically dynamically with *iam_setup()*
+# Specifying configuration parameters with environment variables can be done in two ways:
+#
+# 1. for a single *IAM* server, specify the data set
+#       - *<APP_PREFIX>_IAM_ADMIN_ID*             (optional, needed if administrative duties are performed)
+#       - *<APP_PREFIX>_IAM_ADMIN_PWD*            (optional, needed if administrative duties are performed)
+#       - *<APP_PREFIX>_IAM_CLIENT_ID*            (required)
+#       - *<APP_PREFIX>_IAM_CLIENT_REALM*         (required)
+#       - *<APP_PREFIX>_IAM_CLIENT_SECRET*        (required)
+#       - *<APP_PREFIX>_IAM_ENDPOINT_CALLBACK*    (required)
+#       - *<APP_PREFIX>_IAM_ENDPOINT_EXCHANGE*    (required)
+#       - *<APP_PREFIX>_IAM_ENDPOINT_LOGIN*       (required)
+#       - *<APP_PREFIX>_IAM_ENDPOINT_LOGOUT*      (required)
+#       - *<APP_PREFIX>_IAM_ENDPOINT_PROVIDER*    (optional, needed if requesting tokens to providers)
+#       - *<APP_PREFIX>_IAM_ENDPOINT_TOKEN*       (required)
+#       - *<APP_PREFIX>_IAM_LOGIN_TIMEOUT*        (optional, defaults to no timeout)
+#       - *<APP_PREFIX>_IAM_PK_LIFETIME*          (optional, defaults to non-terminating lifetime)
+#       - *<APP_PREFIX>_IAM_RECIPIENT_ATTR*       (required)
+#       - *<APP_PREFIX>_IAM_URL_BASE*             (required)
+#
+# 2. for multiple *IAM* servers, specify the data set above for each server,
+#    respectively replacing *IAM* with a name in *IamServer* (currently, *JUSBR* and *KEYCLOAK* are supported).
+#
+# 3. the parameters *PUBLIC_KEY*, *PK_EXPIRATION*, and *USERS* cannot be assigned values,
+#    as they are reserved for internal use
 
 # registry structure:
 # { <IamServer>:
 #    {
 #       "base-url": <str>,
+#       "admin-id": <str>,
+#       "admin-secret": <str>,
 #       "client-id": <str>,
 #       "client-secret": <str>,
 #       "client-realm": <str,
@@ -162,7 +112,7 @@ def __get_iam_data() -> dict[IamServer, dict[IamParam, Any]]:
 #   },
 #   ...
 # }
-_IAM_SERVERS: Final[dict[IamServer, dict[IamParam, Any]]] = __get_iam_data()
+_IAM_SERVERS: Final[dict[IamServer, dict[IamParam, Any]]] = {}
 
 
 # the lock protecting the data in '_IAM_SERVERS'
@@ -186,7 +136,7 @@ def _iam_server_from_endpoint(endpoint: str,
 
     for iam_server in _IAM_SERVERS:
         if endpoint.startswith(iam_server):
-            result = IamServer.JUSRBR
+            result = iam_server
             break
 
     if not result:
@@ -408,21 +358,15 @@ def _get_iam_registry(iam_server: IamServer,
     :param logger: optional logger
     :return: the registry associated with *iam_server*, or *None* if the server is unknown
     """
-    # declare the return variable
-    result: dict[str, Any] | None
-
-    match iam_server:
-        case IamServer.JUSRBR:
-            result = _IAM_SERVERS[IamServer.JUSRBR]
-        case IamServer.KEYCLOAK:
-            result = _IAM_SERVERS[IamServer.KEYCLOAK]
-        case _:
-            result = None
-            msg = f"Unknown IAM server '{iam_server}'"
-            if logger:
-                logger.error(msg=msg)
-            if isinstance(errors, list):
-                errors.append(msg)
+    # assign the return variable
+    result: dict[str, Any] = _IAM_SERVERS.get(iam_server)
+
+    if not result:
+        msg = f"Unknown IAM server '{iam_server}'"
+        if logger:
+            logger.error(msg=msg)
+        if isinstance(errors, list):
+            errors.append(msg)
 
     return result
 

pypomes_iam/iam_pomes.py

@@ -1,5 +1,6 @@
 from flask import Flask
 from logging import Logger
+from pypomes_core import APP_PREFIX, env_get_int, env_get_str
 from typing import Any
 
 from .iam_common import (
@@ -16,17 +17,17 @@ def iam_setup(flask_app: Flask,
               base_url: str,
               client_id: str,
               client_realm: str,
+              client_secret: str | None,
               recipient_attribute: str,
-              client_secret: str = None,
-              login_timeout: int = None,
               admin_id: str = None,
               admin_secret: str = None,
+              login_timeout: int = None,
               public_key_lifetime: int = None,
               callback_endpoint: str = None,
+              exchange_endpoint: str = None,
               login_endpoint: str = None,
               logout_endpoint: str = None,
-              token_endpoint: str = None,
-              exchange_endpoint: str = None) -> None:
+              token_endpoint: str = None) -> None:
     """
     Establish the provided parameters for configuring the *IAM* server *iam_server*.
 
@@ -39,21 +40,21 @@ def iam_setup(flask_app: Flask,
     the first time it is needed.
 
     :param flask_app: the Flask application
-    :param iam_server: identifies the supported *IAM* server (*jusbr* or *keycloak*)
+    :param iam_server: identifies the supported *IAM* server (currently, *jusbr* or *keycloak*)
     :param base_url: base URL to request services
     :param client_id: the client's identification with the *IAM* server
     :param client_realm: the client realm
-    :param recipient_attribute: attribute in the token's payload holding the token's subject
     :param client_secret: the client's password with the *IAM* server
-    :param login_timeout: timeout for login authentication (in seconds,defaults to no timeout)
+    :param recipient_attribute: attribute in the token's payload holding the token's subject
     :param admin_id: identifies the realm administrator
     :param admin_secret: password for the realm administrator
+    :param login_timeout: timeout for login authentication (in seconds,defaults to no timeout)
     :param public_key_lifetime: how long to use *IAM* server's public key, before refreshing it (in seconds)
     :param callback_endpoint: endpoint for the callback from the front end
+    :param exchange_endpoint: endpoint for requesting token exchange
     :param login_endpoint: endpoint for redirecting user to the *IAM* server's login page
     :param logout_endpoint: endpoint for terminating user access
     :param token_endpoint: endpoint for retrieving authentication token
-    :param exchange_endpoint: endpoint for requesting token exchange
     """
 
     # configure the Keycloak registry
@@ -63,18 +64,15 @@ def iam_setup(flask_app: Flask,
             IamParam.CLIENT_ID: client_id,
             IamParam.CLIENT_REALM: client_realm,
             IamParam.CLIENT_SECRET: client_secret,
-            IamParam.LOGIN_TIMEOUT: login_timeout,
             IamParam.RECIPIENT_ATTR: recipient_attribute,
+            IamParam.ADMIN_ID: admin_id,
+            IamParam.ADMIN_SECRET: admin_secret,
+            IamParam.LOGIN_TIMEOUT: login_timeout,
+            IamParam.PK_LIFETIME: public_key_lifetime,
             IamParam.PK_EXPIRATION: 0,
             IamParam.PUBLIC_KEY: None,
             IamParam.USERS: {}
         }
-        if admin_id and admin_secret:
-            IamParam.ADMIN_ID = admin_id
-            IamParam.ADMIN_SECRET = admin_secret
-
-        if public_key_lifetime:
-            IamParam.PK_LIFETIME = public_key_lifetime
 
     # establish the endpoints
     if callback_endpoint:
@@ -104,6 +102,34 @@ def iam_setup(flask_app: Flask,
                                methods=["POST"])
 
 
+def iam_get_env_parameters(iam_prefix: str = None) -> dict[str, Any]:
+    """
+    Retrieve the set parameters for a *IAM* server from the environment.
+
+    the parameters are returned ready to be used as a '**kwargs' parameter set in a call to *iam_setup()*,
+    and sorted in the order appropriate to use them instead with a '*args' parameter set.
+
+    :param iam_prefix: the prefix classifying the parameters
+    :return: the sorted parameters classified by *prefix*
+    """
+    return {
+        "base_url": env_get_str(key=f"{APP_PREFIX}_{iam_prefix}_URL_AUTH_BASE"),
+        "client_id": env_get_str(key=f"{APP_PREFIX}_{iam_prefix}_CLIENT_ID"),
+        "client_realm": env_get_str(key=f"{APP_PREFIX}_{iam_prefix}_CLIENT_REALM"),
+        "client_secret": env_get_str(key=f"{APP_PREFIX}_{iam_prefix}_CLIENT_SECRET"),
+        "recipient_attribute": env_get_str(key=f"{APP_PREFIX}_{iam_prefix}_RECIPIENT_ATTR"),
+        "admin_id": env_get_str(key=f"{APP_PREFIX}_{iam_prefix}_ADMIN_ID"),
+        "admin_secret": env_get_str(key=f"{APP_PREFIX}_{iam_prefix}_ADMIN_SECRET"),
+        "login_timeout": env_get_str(key=f"{APP_PREFIX}_{iam_prefix}_LOGIN_TIMEOUT"),
+        "public_key_lifetime": env_get_int(key=f"{APP_PREFIX}_{iam_prefix}_PUBLIC_KEY_LIFETIME"),
+        "callback_endpoint": env_get_str(key=f"{APP_PREFIX}_{iam_prefix}_ENDPOINT_CALLBACK"),
+        "exchange_endpoint": env_get_str(key=f"{APP_PREFIX}_{iam_prefix}_ENDPOINT_EXCHANGE"),
+        "login_endpoint": env_get_str(key=f"{APP_PREFIX}_{iam_prefix}_ENDPOINT_LOGIN"),
+        "logout_endpoint": env_get_str(key=f"{APP_PREFIX}_{iam_prefix}_ENDPOINT_LOGOUT"),
+        "token_endpoint": env_get_str(key=f"{APP_PREFIX}_{iam_prefix}_ENDPOINT_TOKEN")
+    }
+
+
 def iam_get_token(iam_server: IamServer,
                   user_id: str,
                   errors: list[str] = None,

pypomes_iam/iam_services.py

@@ -168,7 +168,7 @@ def service_login() -> Response:
 #                  methods=["GET"])
 def service_logout() -> Response:
     """
-    Entry point for the JusBR logout service.
+    Entry point for the IAM server's logout service.
 
     The user is identified by the attribute *user-id* or "login", provided as a request parameter.
     If successful, remove all data relating to the user from the *IAM* server's registry.
@@ -214,7 +214,7 @@ def service_logout() -> Response:
 #                  methods=["POST"])
 def service_callback() -> Response:
     """
-    Entry point for the callback from JusBR on authentication operation.
+    Entry point for the callback from the IAM server on authentication operation.
 
     This callback is invoked from a front-end application after a successful login at the
     *IAM* server's login page, forwarding the data received. In a typical OAuth2 flow faction,

pypomes_iam/provider_pomes.py

@@ -106,76 +106,137 @@ def provider_get_token(provider_id: str,
     # initialize the return variable
     result: str | None = None
 
-    err_msg: str | None = None
     with _provider_lock:
         provider: dict[str, Any] = _provider_registry.get(provider_id)
         if provider:
-            now: float = datetime.now(tz=TZ_LOCAL).timestamp()
-            if now > provider.get(ProviderParam.ACCESS_EXPIRATION):
-                user: str = provider.get(ProviderParam.USER)
-                pwd: str = provider.get(ProviderParam.PWD)
-                headers_data: dict[str, str] = provider.get(ProviderParam.HEADER_DATA) or {}
-                body_data: dict[str, str] = provider.get(ProviderParam.BODY_DATA) or {}
-                custom_auth: tuple[str, str] = provider.get(ProviderParam.CUSTOM_AUTH)
-                if custom_auth:
-                    body_data[custom_auth[0]] = user
-                    body_data[custom_auth[1]] = pwd
-                else:
-                    enc_bytes: bytes = b64encode(f"{user}:{pwd}".encode())
-                    headers_data["Authorization"] = f"Basic {enc_bytes.decode()}"
+            now: int = int(datetime.now(tz=TZ_LOCAL).timestamp())
+            if now < provider.get(ProviderParam.ACCESS_EXPIRATION):
+                # retrieve the stored access token
+                result = provider.get(ProviderParam.ACCESS_TOKEN)
+            else:
+                # access token has expired
+                header_data: dict[str, str] | None = None
+                body_data: dict[str, str] | None = None
                 url: str = provider.get(ProviderParam.URL)
-                if logger:
-                    logger.debug(msg=f"POST {url}, {json.dumps(obj=body_data,
-                                                               ensure_ascii=False)}")
-                try:
-                    # typical return on a token request:
-                    # {
-                    #   "token_type": "Bearer",
-                    #   "access_token": <str>,
-                    #   "expires_in": <number-of-seconds>,
-                    #   optional data:
-                    #   "refresh_token": <str>,
-                    #   "refresh_expires_in": <number-of-seconds>
-                    # }
-                    response: requests.Response = requests.post(url=url,
-                                                                data=body_data,
-                                                                headers=headers_data,
-                                                                timeout=None)
-                    if response.status_code < 200 or response.status_code >= 300:
-                        # request resulted in error, report the problem
-                        err_msg = (f"POST failure, "
-                                   f"status {response.status_code}, reason {response.reason}")
+                refresh_token: str = provider.get(ProviderParam.REFRESH_TOKEN)
+                if refresh_token:
+                    # refresh token exists
+                    refresh_expiration: int = provider.get(ProviderParam.REFRESH_EXPIRATION)
+                    if now < refresh_expiration:
+                        # refresh token has not expired
+                        header_data: dict[str, str] = {
+                            "Content-Type": "application/json"
+                        }
+                        body_data: dict[str, str] = {
+                            "grant_type": "refresh_token",
+                            "refresh_token": refresh_token
+                        }
+                if not body_data:
+                    # refresh token does not exist or has expired
+                    user: str = provider.get(ProviderParam.USER)
+                    pwd: str = provider.get(ProviderParam.PWD)
+                    headers_data: dict[str, str] = provider.get(ProviderParam.HEADER_DATA) or {}
+                    body_data: dict[str, str] = provider.get(ProviderParam.BODY_DATA) or {}
+                    custom_auth: tuple[str, str] = provider.get(ProviderParam.CUSTOM_AUTH)
+                    if custom_auth:
+                        body_data[custom_auth[0]] = user
+                        body_data[custom_auth[1]] = pwd
                     else:
-                        # request succeeded
-                        if logger:
-                            logger.debug(msg=f"POST success, status {response.status_code}")
-                        reply: dict[str, Any] = response.json()
-                        provider[ProviderParam.ACCESS_TOKEN] = reply.get("access_token")
-                        provider[ProviderParam.ACCESS_EXPIRATION] = now + int(reply.get("expires_in"))
-                        if reply.get(ProviderParam.REFRESH_TOKEN):
-                            provider[ProviderParam.REFRESH_TOKEN] = reply["refresh_token"]
-                            if reply.get("refresh_expires_in"):
-                                provider[ProviderParam.REFRESH_EXPIRATION] = now + int(reply.get("refresh_expires_in"))
-                            else:
-                                provider[ProviderParam.REFRESH_EXPIRATION] = sys.maxsize
-                        if logger:
-                            logger.debug(msg=f"POST {url}: status {response.status_code}")
-                except Exception as e:
-                    # the operation raised an exception
-                    err_msg = exc_format(exc=e,
-                                         exc_info=sys.exc_info())
-                    err_msg = f"POST error, '{err_msg}'"
-        else:
-            err_msg: str = f"Provider '{provider_id}' not registered"
-
-    if err_msg:
-        if isinstance(errors, list):
-            errors.append(err_msg)
-        if logger:
-            logger.error(msg=err_msg)
-    else:
-        result = provider.get(ProviderParam.ACCESS_TOKEN)
+                        enc_bytes: bytes = b64encode(f"{user}:{pwd}".encode())
+                        headers_data["Authorization"] = f"Basic {enc_bytes.decode()}"
+
+                # obtain the token
+                token_data: dict[str, Any] = __post_for_token(url=url,
+                                                              header_data=header_data,
+                                                              body_data=body_data,
+                                                              errors=errors,
+                                                              logger=logger)
+                if token_data:
+                    result = token_data.get("access_token")
+                    provider[ProviderParam.ACCESS_TOKEN] = result
+                    provider[ProviderParam.ACCESS_EXPIRATION] = now + token_data.get("expires_in")
+                    refresh_token = token_data.get("refresh_token")
+                    if refresh_token:
+                        provider[ProviderParam.REFRESH_TOKEN] = refresh_token
+                        refresh_exp: int = token_data.get("refresh_expires_in")
+                        provider[ProviderParam.REFRESH_EXPIRATION] = (now + refresh_exp) \
+                            if refresh_exp else sys.maxsize
+
+        elif logger or isinstance(errors, list):
+            msg: str = f"Unknown provider '{provider_id}'"
+            if logger:
+                logger.error(msg=msg)
+            if isinstance(errors, list):
+                errors.append(msg)
 
     return result
 
 
+def __post_for_token(url: str,
+                     header_data: dict[str, str],
+                     body_data: dict[str, Any],
+                     errors: list[str] | None,
+                     logger: Logger | None) -> dict[str, Any] | None:
+    """
+    Send a *POST* request to *url* and return the token data obtained.
+
+    Token acquisition and token refresh are the two types of requests contemplated herein.
+    For the former, *header_data* and *body_data* will have contents customized to the specific provider,
+    whereas the latter's *body_data* will contain these two attributes:
+        - "grant_type": "refresh_token"
+        - "refresh_token": <current-refresh-token>
+
+    The typical data set returned contains the following attributes:
+        {
+            "token_type": "Bearer",
+            "access_token": <str>,
+            "expires_in": <number-of-seconds>,
+            "refresh_token": <str>,
+            "refesh_expires_in": <number-of-seconds>
+        }
+
+    :param url: the target URL
+    :param header_data: the data to send in the header of the request
+    :param body_data: the data to send in the body of the request
+    :param errors: incidental errors
+    :param logger: optional logger
+    :return: the token data, or *None* if error
+    """
+    # initialize the return variable
+    result: dict[str, Any] | None = None
+
+    # log the POST
+    if logger:
+        logger.debug(msg=f"POST {url}, {json.dumps(obj=body_data,
+                                                   ensure_ascii=False)}")
+    try:
+        response: requests.Response = requests.post(url=url,
+                                                    data=body_data,
+                                                    headers=header_data,
+                                                    timeout=None)
+        if response.status_code == 200:
+            # request succeeded
+            result = response.json()
+            if logger:
+                logger.debug(msg=f"POST success, status {response.status_code}")
+        else:
+            # request failed, report the problem
+            msg: str = (f"POST failure, "
+                        f"status {response.status_code}, reason {response.reason}")
+            if hasattr(response, "content") and response.content:
+                msg += f", content '{response.content}'"
+            if logger:
+                logger.error(msg=msg)
+            if isinstance(errors, list):
+                errors.append(msg)
+    except Exception as e:
+        # the operation raised an exception
+        err_msg = exc_format(exc=e,
+                             exc_info=sys.exc_info())
+        msg: str = f"POST error, {err_msg}"
+        if logger:
+            logger.debug(msg=msg)
+        if isinstance(errors, list):
+            errors.append(msg)
+
+    return result

{pypomes_iam-0.5.8.dist-info → pypomes_iam-0.6.9.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pypomes_iam
-Version: 0.5.8
+Version: 0.6.9
 Summary: A collection of Python pomes, penyeach (IAM modules)
 Project-URL: Homepage, https://github.com/TheWiseCoder/PyPomes-IAM
 Project-URL: Bug Tracker, https://github.com/TheWiseCoder/PyPomes-IAM/issues
@@ -10,7 +10,6 @@ Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
 Requires-Python: >=3.12
-Requires-Dist: cachetools>=6.2.1
 Requires-Dist: flask>=3.1.2
 Requires-Dist: pyjwt>=2.10.1
 Requires-Dist: pypomes-core>=2.8.1

pypomes_iam-0.6.9.dist-info/RECORD

@@ -0,0 +1,11 @@
+pypomes_iam/__init__.py,sha256=_6tSFfjuU-5p6TAMqNLHSL6IQmaJMSYuEW-TG3ybhTI,1044
+pypomes_iam/iam_actions.py,sha256=0PC7Z7xsepxynmgjMvKZLjLdvC3s5kGk_dqCFrG4Qs8,42083
+pypomes_iam/iam_common.py,sha256=ki_-m6fqJqUbGjgTD41r9zaE-FOXgA_c_tLisIYYTfU,15457
+pypomes_iam/iam_pomes.py,sha256=_kLnrZG25XhJsIv3wqDl_2sIJ2ho_2TIMKrPCyPmA7Q,7362
+pypomes_iam/iam_services.py,sha256=uUD333SaTbo8MGRyIp5GGil7HAupK73ym4_bKtGkPFg,15878
+pypomes_iam/provider_pomes.py,sha256=3mMj5LQs53YEINUEOfFBAxOwOP3aOR_szlE4daEBLK0,10523
+pypomes_iam/token_pomes.py,sha256=K4nSAotKUoHIE2s3ltc_nVimlNeKS9tnD-IlslkAvkk,6626
+pypomes_iam-0.6.9.dist-info/METADATA,sha256=tPsAu2TWT9hb3vu-KHnYT77TYZytoCQfs78uxWLlLH8,661
+pypomes_iam-0.6.9.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
+pypomes_iam-0.6.9.dist-info/licenses/LICENSE,sha256=YvUELgV8qvXlaYsy9hXG5EW3Bmsrkw-OJmmILZnonAc,1086
+pypomes_iam-0.6.9.dist-info/RECORD,,

pypomes_iam-0.5.8.dist-info/RECORD

@@ -1,11 +0,0 @@
-pypomes_iam/__init__.py,sha256=f-2W_zrCmXExubJPExQrhAwGpiQCmybEC_wguRYFHsw,994
-pypomes_iam/iam_actions.py,sha256=Bmd8rBg3948Afsg10B6B1ZrFY4wYtbxi55rX4Rlqiyk,39167
-pypomes_iam/iam_common.py,sha256=I-HtwpvrhByTbOoSQrMktjpbYgeIPlYM1YC6wkFUhI4,18251
-pypomes_iam/iam_pomes.py,sha256=BetEVGv41wkcP9E1wRvYiQgmJElDXH4Iz8qgf7iH6X0,5617
-pypomes_iam/iam_services.py,sha256=IkCjrKDX1Ix7BiHh-BL3VKz5xogcNC8prXkHyJzQoZ8,15862
-pypomes_iam/provider_pomes.py,sha256=N0nL9_hgHmAjG9JKFoXC33zk8b1ckPG1veu1jTp-2JE,8045
-pypomes_iam/token_pomes.py,sha256=K4nSAotKUoHIE2s3ltc_nVimlNeKS9tnD-IlslkAvkk,6626
-pypomes_iam-0.5.8.dist-info/METADATA,sha256=Q60cQU69Gbay_IjFewESe9P4O4Z6mQ5tz_tYvw7yIMM,694
-pypomes_iam-0.5.8.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
-pypomes_iam-0.5.8.dist-info/licenses/LICENSE,sha256=YvUELgV8qvXlaYsy9hXG5EW3Bmsrkw-OJmmILZnonAc,1086
-pypomes_iam-0.5.8.dist-info/RECORD,,