pypomes-iam 0.6.2__py3-none-any.whl → 0.8.2__py3-none-any.whl

pypomes_iam/iam_actions.py

@@ -10,27 +10,33 @@ from typing import Any
 
 from .iam_common import (
     IamServer, IamParam, UserParam, _iam_lock,
-    _get_iam_users, _get_iam_registry,  # _get_public_key,
-    _get_login_timeout, _get_user_data
+    _get_iam_users, _get_iam_registry, _get_public_key,
+    _get_login_timeout, _get_user_data, _iam_server_from_issuer
 )
-from .token_pomes import token_get_claims, token_validate
+from .token_pomes import token_get_values, token_validate
 
 
-def action_login(iam_server: IamServer,
-                 args: dict[str, Any],
-                 errors: list[str] = None,
-                 logger: Logger = None) -> str:
+def iam_login(iam_server: IamServer,
+              args: dict[str, Any],
+              errors: list[str] = None,
+              logger: Logger = None) -> str:
     """
     Build the URL for redirecting the request to *iam_server*'s authentication page.
 
     These are the expected attributes in *args*:
         - user-id: optional, identifies the reference user (alias: 'login')
         - redirect-uri: a parameter to be added to the query part of the returned URL
+        -target-idp: optionally, identify a target identity provider for the login operation
 
     If provided, the user identification will be validated against the authorization data
     returned by *iam_server* upon login. On success, the appropriate URL for invoking
     the IAM server's authentication page is returned.
 
+    if 'target_idp' is provided as an attribute in *args*, the OAuth2 state variable included in the
+    returned URL will be postfixed with the string *#idp=<target-idp>*. At the callback endpoint,
+    this instructs *iam_server* to act as a broker, forwading the authentication process to the
+    *IAM* server *target-idp*.
+
     :param iam_server: the reference registered *IAM* server
     :param args: the arguments passed when requesting the service
     :param errors: incidental error messages
@@ -43,9 +49,14 @@ def action_login(iam_server: IamServer,
     # obtain the optional user's identification
     user_id: str = args.get("user-id") or args.get("login")
 
+    # obtain the optional target identity provider
+    target_idp: str = args.get("target-idp")
+
     # build the user data
     # ('oauth_state' is a randomly-generated string, thus 'user_data' is always a new entry)
     oauth_state: str = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(16))
+    if target_idp:
+        oauth_state += f"#idp={target_idp}"
 
     with _iam_lock:
         # retrieve the user data from the IAM server's registry
@@ -75,19 +86,23 @@ def action_login(iam_server: IamServer,
                               f"&client_id={registry[IamParam.CLIENT_ID]}"
                               f"&redirect_uri={redirect_uri}"
                               f"&state={oauth_state}")
+                    if target_idp:
+                        # HAZARD: the name 'kc_idp_hint' is Keycloak-specific
+                        result += f"&kc_idp_hint={target_idp}"
+
     return result
 
 
-def action_logout(iam_server: IamServer,
-                  args: dict[str, Any],
-                  errors: list[str] = None,
-                  logger: Logger = None) -> None:
+def iam_logout(iam_server: IamServer,
+               args: dict[str, Any],
+               errors: list[str] = None,
+               logger: Logger = None) -> None:
     """
     Logout the user, by removing all data associating it from *iam_server*'s registry.
 
-    The user is identified by the attribute *user-id* or "login", provided in *args*.
-    If successful, remove all data relating to the user from the *IAM* server's registry.
-    Otherwise, this operation fails silently, unless an error has ocurred.
+    The user is identified by the attribute *user-id* or *login*, provided in *args*.
+    A logout request is sent to *iam_server* and, if successful, remove all data relating to the user
+    from the *IAM* server's registry.
 
     :param iam_server: the reference registered *IAM* server
     :param args: the arguments passed when requesting the service
@@ -99,33 +114,90 @@ def action_logout(iam_server: IamServer,
 
     if user_id:
         with _iam_lock:
-            # retrieve the data for all users in the IAM server's registry
-            users: dict[str, dict[str, Any]] = _get_iam_users(iam_server=iam_server,
-                                                              errors=errors,
-                                                              logger=logger) or {}
-            if user_id in users:
-                users.pop(user_id)
-                if logger:
-                    logger.debug(msg=f"User '{user_id}' removed from {iam_server}'s registry")
+            # retrieve the IAM server's registry and the data for all users therein
+            registry: dict[str, Any] = _get_iam_registry(iam_server,
+                                                         errors=errors,
+                                                         logger=logger)
+            users: dict[str, dict[str, Any]] = registry[IamParam.USERS] if registry else {}
+            user_data: dict[str, Any] = users.get(user_id)
+            if user_data:
+                # request the IAM server to logout 'client_id'
+                client_secret: str = __get_client_secret(iam_server=iam_server,
+                                                         errors=errors,
+                                                         logger=logger)
+                if client_secret:
+                    url: str = (f"{registry[IamParam.URL_BASE]}/realms/{registry[IamParam.CLIENT_REALM]}"
+                                "/protocol/openid-connect/logout")
+                    header_data: dict[str, str] = {
+                        "Content-Type": "application/x-www-form-urlencoded"
+                    }
+                    body_data: dict[str, Any] = {
+                        "client_id": registry[IamParam.CLIENT_ID],
+                        "client_secret": client_secret,
+                        "refresh_token": user_data[UserParam.REFRESH_TOKEN]
+                    }
+                    #  log the POST
+                    if logger:
+                        logger.debug(msg=f"POST {url}")
+                    try:
+                        response: requests.Response = requests.post(url=url,
+                                                                    headers=header_data,
+                                                                    data=body_data)
+                        if response.status_code in [200, 204]:
+                            # request succeeded
+                            if logger:
+                                logger.debug(msg=f"POST success")
+                        else:
+                            # request failed, report the problem
+                            msg: str = f"POST failure, status {response.status_code}, reason {response.reason}"
+                            if logger:
+                                logger.error(msg=msg)
+                            if isinstance(errors, list):
+                                errors.append(msg)
+                    except Exception as e:
+                        # the operation raised an exception
+                        msg: str = exc_format(exc=e,
+                                              exc_info=sys.exc_info())
+                        if logger:
+                            logger.error(msg=msg)
+                        if isinstance(errors, list):
+                            errors.append(msg)
 
+                    if not errors and user_id in users:
+                        users.pop(user_id)
+                        if logger:
+                            logger.debug(msg=f"User '{user_id}' removed from {iam_server}'s registry")
+    else:
+        msg: str = "User identification not provided"
+        if logger:
+            logger.error(msg=msg)
+        if isinstance(errors, list):
+            errors.append(msg)
 
-def action_token(iam_server: IamServer,
-                 args: dict[str, Any],
-                 errors: list[str] = None,
-                 logger: Logger = None) -> str:
+
+def iam_get_token(iam_server: IamServer,
+                  args: dict[str, Any],
+                  errors: list[str] = None,
+                  logger: Logger = None) -> dict[str, str]:
     """
     Retrieve the authentication token for the user, from *iam_server*.
 
     The user is identified by the attribute *user-id* or *login*, provided in *args*.
 
+    On success, the returned *dict* will contain the following JSON:
+        {
+            "access-token": <token>,
+            "user-id": <user-identification
+        }
+
     :param iam_server: the reference registered *IAM* server
     :param args: the arguments passed when requesting the service
     :param errors: incidental error messages
     :param logger: optional logger
-    :return: the token for user indicated, or *None* if error
+    :return: the user identification and token issued, or *None* if error
     """
     # initialize the return variable
-    result: str | None = None
+    result: dict[str, str] | None = None
 
     # obtain the user's identification
     user_id: str = args.get("user-id") or args.get("login")
@@ -144,7 +216,10 @@ def action_token(iam_server: IamServer,
                 access_expiration: int = user_data.get(UserParam.ACCESS_EXPIRATION)
                 now: int = int(datetime.now(tz=TZ_LOCAL).timestamp())
                 if now < access_expiration:
-                    result = token
+                    result = {
+                        "access-token": token,
+                        "user-id": user_id
+                    }
                 else:
                     # access token has expired
                     refresh_token: str = user_data[UserParam.REFRESH_TOKEN]
@@ -152,7 +227,7 @@ def action_token(iam_server: IamServer,
                         refresh_expiration: int = user_data[UserParam.REFRESH_EXPIRATION]
                         if now < refresh_expiration:
                             header_data: dict[str, str] = {
-                                "Content-Type": "application/json"
+                                "Content-Type": "application/x-www-form-urlencoded"
                             }
                             body_data: dict[str, str] = {
                                 "grant_type": "refresh_token",
@@ -172,7 +247,10 @@ def action_token(iam_server: IamServer,
                                                                                    now=now,
                                                                                    errors=errors,
                                                                                    logger=logger)
-                                result = token_info[1]
+                                result = {
+                                    "access-token": token_info[1],
+                                    "user-id": user_id
+                                }
                             else:
                                 # refresh token is no longer valid
                                 user_data[UserParam.REFRESH_TOKEN] = None
@@ -200,10 +278,10 @@ def action_token(iam_server: IamServer,
     return result
 
 
-def action_callback(iam_server: IamServer,
-                    args: dict[str, Any],
-                    errors: list[str] = None,
-                    logger: Logger = None) -> tuple[str, str] | None:
+def iam_callback(iam_server: IamServer,
+                 args: dict[str, Any],
+                 errors: list[str] = None,
+                 logger: Logger = None) -> tuple[str, str] | None:
     """
     Entry point for the callback from *iam_server* via the front-end application, on authentication operations.
 
@@ -211,6 +289,10 @@ def action_callback(iam_server: IamServer,
         - *state*: used to enhance security during the authorization process, typically to provide *CSRF* protection
         - *code*: the temporary authorization code provided by *iam_server*, to be exchanged for the token
 
+    if *state* is postfixed with the string *#idp=<target-idp>*, this instructs *iam_server* to act as a broker,
+    forwarding the authentication process to the *IAM* server *target-idp*. This mechanism fully dispenses with
+    the flows 'callback-exchange', and 'callback' followed by 'exchange'.
+
     :param iam_server: the reference registered *IAM* server
     :param args: the arguments passed when requesting the service
     :param errors: incidental errors
@@ -240,6 +322,10 @@ def action_callback(iam_server: IamServer,
             if int(datetime.now(tz=TZ_LOCAL).timestamp()) > expiration:
                 errors.append("Operation timeout")
             else:
+                pos: int = oauth_state.rfind("#idp=")
+                target_idp: str = oauth_state[pos+4:] if pos > 0 else None
+                target_iam = IamServer(target_idp) if target_idp in IamServer else None
+                target_data: dict[str, Any] = user_data.copy() if target_iam else None
                 users.pop(oauth_state)
                 code: str = args.get("code")
                 header_data: dict[str, str] = {
@@ -264,6 +350,33 @@ def action_callback(iam_server: IamServer,
                                                   now=now,
                                                   errors=errors,
                                                   logger=logger)
+                    if target_iam:
+                        if logger:
+                            logger.debug(msg=f"Requesting to IAM server '{iam_server}' "
+                                             f"the token issued by '{target_iam}' ")
+                        registry: dict[str, Any] = _get_iam_registry(iam_server,
+                                                                     errors=errors,
+                                                                     logger=logger)
+                        url: str = (f"{registry[IamParam.URL_BASE]}/realms/"
+                                    f"{registry[IamParam.CLIENT_REALM]}/broker/{target_idp}/token")
+                        header_data: dict[str, str] = {
+                            "Authorization": f"Bearer {result[1]}",
+                            "Content-Type": "application/json"
+                        }
+                        token_data = __get_for_data(url=url,
+                                                    header_data=header_data,
+                                                    params=None,
+                                                    errors=errors,
+                                                    logger=logger)
+                        if not errors:
+                            token_info: tuple[str, str] = __validate_and_store(iam_server=target_iam,
+                                                                               user_data=target_data,
+                                                                               token_data=token_data,
+                                                                               now=now,
+                                                                               errors=errors,
+                                                                               logger=logger)
+                            if token_info and logger:
+                                logger.debug(msg=f"Token obtained: {json.dumps(obj=token_info)}")
         else:
             msg: str = f"State '{oauth_state}' not found in {iam_server}'s registry"
             if logger:
@@ -274,10 +387,10 @@ def action_callback(iam_server: IamServer,
     return result
 
 
-def action_exchange(iam_server: IamServer,
-                    args: dict[str, Any],
-                    errors: list[str] = None,
-                    logger: Logger = None) -> dict[str, Any]:
+def iam_exchange(iam_server: IamServer,
+                 args: dict[str, Any],
+                 errors: list[str] = None,
+                 logger: Logger = None) -> tuple[str, str]:
     """
     Request *iam_server* to issue a token in exchange for the token obtained from another *IAM* server.
 
@@ -298,17 +411,21 @@ def action_exchange(iam_server: IamServer,
     :param args: the arguments passed when requesting the service
     :param errors: incidental errors
     :param logger: optional logger
-    :return: the data for the new token, or *None* if error
+    :return: a tuple containing the reference user identification and the token obtained, or *None* if error
     """
     # initialize the return variable
-    result: dict[str, Any] | None = None
+    result: tuple[str, str] | None = None
 
     # obtain the user's identification
     user_id: str = args.get("user-id") or args.get("login")
 
     # obtain the token to be exchanged
     token: str = args.get("access-token") if user_id else None
-    if token:
+    token_issuer: tuple[str] = token_get_values(token=token,
+                                                keys=("iss",),
+                                                errors=errors,
+                                                logger=logger)
+    if not errors:
         # HAZARD: only 'IAM_KEYCLOAK' is currently supported
         with _iam_lock:
             # retrieve the IAM server's registry
@@ -320,10 +437,13 @@ def action_exchange(iam_server: IamServer,
                 __assert_link(iam_server=iam_server,
                               user_id=user_id,
                               token=token,
+                              token_issuer=token_issuer[0],
                               errors=errors,
                               logger=logger)
                 if not errors:
                     # exchange the token
+                    if logger:
+                        logger.debug(msg=f"Requesting the token exchange to IAM server '{iam_server}'")
                     header_data: dict[str, Any] = {
                         "Content-Type": "application/x-www-form-urlencoded"
                     }
@@ -333,7 +453,7 @@ def action_exchange(iam_server: IamServer,
                         "subject_token_type": "urn:ietf:params:oauth:token-type:access_token",
                         "requested_token_type": "urn:ietf:params:oauth:token-type:access_token",
                         "audience": registry[IamParam.CLIENT_ID],
-                        "subject_issuer": "oidc"
+                        "subject_issuer": token_issuer
                     }
                     now: int = int(datetime.now(tz=TZ_LOCAL).timestamp())
                     token_data: dict[str, Any] = __post_for_token(iam_server=iam_server,
@@ -360,15 +480,70 @@ def action_exchange(iam_server: IamServer,
     return result
 
 
+def iam_userinfo(iam_server: IamServer,
+                 args: dict[str, Any],
+                 errors: list[str] = None,
+                 logger: Logger = None) -> dict[str, Any] | None:
+    """
+    Obtain user data from *iam_server*.
+
+    The user is identified by the attribute *user-id* or *login*, provided in *args*.
+
+    :param iam_server: the reference registered *IAM* server
+    :param args: the arguments passed when requesting the service
+    :param errors: incidental error messages
+    :param logger: optional logger
+    :return: the user information requested, or *None* if error
+    """
+    # initialize the return variable
+    result: dict[str, Any] | None = None
+
+    # obtain the user's identification
+    user_id: str = args.get("user-id") or args.get("login")
+
+    err_msg: str | None = None
+    if user_id:
+        with _iam_lock:
+            # retrieve the IAM server's registry and the user data therein
+            registry: dict[str, Any] = _get_iam_registry(iam_server,
+                                                         errors=errors,
+                                                         logger=logger)
+            user_data: dict[str, Any] = registry[IamParam.USERS].get(user_id)
+            if user_data:
+                url: str = (f"{registry[IamParam.URL_BASE]}/realms/{registry[IamParam.CLIENT_REALM]}"
+                            "/protocol/openid-connect/userinfo")
+                header_data: dict[str, str] = {
+                    "Authorization": f"Bearer {args.get('access-token')}"
+                }
+                result = __get_for_data(url=url,
+                                        header_data=header_data,
+                                        params=None,
+                                        errors=errors,
+                                        logger=logger)
+            else:
+                err_msg = f"Unknown user '{user_id}'"
+    else:
+        err_msg: str = "User identification not provided"
+
+    if err_msg:
+        if logger:
+            logger.error(msg=err_msg)
+        if isinstance(errors, list):
+            errors.append(err_msg)
+
+    return result
+
+
 def __assert_link(iam_server: IamServer,
                   user_id: str,
                   token: str,
+                  token_issuer: str,
                   errors: list[str] | None,
                   logger: Logger | None) -> None:
     """
     Make sure *iam_server* has a link associating *user_id* to an internal user identification.
     This is a requirement for exchanging a token issued by a federated *IAM* server for an equivalent
-    one from *iam_server.
+    one from *iam_server*.
 
     :param iam_server: the reference *IAM* server
     :param user_id: the reference user identification
@@ -376,6 +551,9 @@ def __assert_link(iam_server: IamServer,
     :param errors: incidental errors
     :param logger: optional logger
     """
+    if logger:
+        logger.debug(msg="Verifying associations for user "
+                         f"'{user_id}' in IAM server '{iam_server}'")
     # obtain a token with administrative rights
     admin_token: str = __get_administrative_token(iam_server=iam_server,
                                                   errors=errors,
@@ -384,7 +562,10 @@ def __assert_link(iam_server: IamServer,
         registry: dict[str, Any] = _get_iam_registry(iam_server=iam_server,
                                                      errors=errors,
                                                      logger=logger)
-        # obtain the internal user identification for 'from_id'
+        # obtain the internal user identification for 'user_id'
+        if logger:
+            logger.debug(msg="Obtaining internal identification "
+                             f"for user '{user_id}' in IAM server '{iam_server}'")
         url: str = f"{registry[IamParam.URL_BASE]}/admin/realms/{registry[IamParam.CLIENT_REALM]}/users"
         header_data: dict[str, str] = {
             "Authorization": f"Bearer {admin_token}",
@@ -394,15 +575,18 @@ def __assert_link(iam_server: IamServer,
             "username": user_id,
             "exact": "true"
         }
-        users: dict[str, Any] = __get_for_data(url=url,
-                                               header_data=header_data,
-                                               params=params,
-                                               errors=errors,
-                                               logger=logger)
+        users: list[dict[str, Any]] = __get_for_data(url=url,
+                                                     header_data=header_data,
+                                                     params=params,
+                                                     errors=errors,
+                                                     logger=logger)
         if users:
-            # verify whether the 'oidc' protocol is referred to in an
-            # association between 'from_id' and the internal user identification
-            internal_id: str = users.get("id")
+            # verify whether the IAM server that issued the token is a federated identity provider
+            # in the associations between 'user_id' and the internal user identification
+            internal_id: str = users[0].get("id")
+            if logger:
+                logger.debug(msg="Obtaining the providers federated in IAM server "
+                                 f"'{iam_server}', for internal identification '{internal_id}'")
             url = (f"{registry[IamParam.URL_BASE]}/admin/realms/"
                    f"{registry[IamParam.CLIENT_REALM]}/users/{internal_id}/federated-identity")
             providers: list[dict[str, Any]] = __get_for_data(url=url,
@@ -411,27 +595,34 @@ def __assert_link(iam_server: IamServer,
                                                              errors=errors,
                                                              logger=logger)
             no_link: bool = True
-            for provider in providers:
-                if provider.get("identityProvider") == "oidc":
-                    no_link = False
-                    break
-            if no_link:
-                # link the identities
-                claims: dict[str, dict[str, Any]] = token_get_claims(token=token,
-                                                                     errors=errors,
-                                                                     logger=logger)
-                if claims:
-                    token_sub: str = claims["paylod"]["sub"]
-                    url += "/oidc"
-                    body_data: dict[str, Any] = {
-                        "userId": token_sub,
-                        "userName": user_id
-                    }
-                    __post_data(url=url,
-                                header_data=header_data,
-                                body_data=body_data,
-                                errors=errors,
-                                logger=logger)
+            provider_name: str = _iam_server_from_issuer(issuer=token_issuer,
+                                                         errors=errors,
+                                                         logger=logger)
+            if provider_name:
+                for provider in providers:
+                    if provider.get("identityProvider") == provider_name:
+                        no_link = False
+                        break
+                if no_link:
+                    # link the identities
+                    token_sub: tuple[str] = token_get_values(token=token,
+                                                             keys=("sub",),
+                                                             errors=errors,
+                                                             logger=logger)
+                    if token_sub:
+                        if logger:
+                            logger.debug(msg="Creating an association between identifications "
+                                             f"'{user_id}' and '{token_sub}' in IAM server '{iam_server}'")
+                        url += f"/{provider_name}"
+                        json_data: dict[str, Any] = {
+                            "userId": token_sub[0],
+                            "userName": user_id
+                        }
+                        __post_json(url=url,
+                                    header_data=header_data,
+                                    json_data=json_data,
+                                    errors=errors,
+                                    logger=logger)
 
 
 def __get_administrative_token(iam_server: IamServer,
@@ -451,31 +642,47 @@ def __get_administrative_token(iam_server: IamServer,
     # initialize the return variable
     result: str | None = None
 
+    if logger:
+        logger.debug(msg="Requesting a token with "
+                         f"administrative rights to IAM Server '{iam_server}'")
+
     # obtain the IAM server's registry
     registry: dict[str, Any] = _get_iam_registry(iam_server=iam_server,
                                                  errors=errors,
                                                  logger=logger)
-    if registry and registry[IamParam.ADMIN_ID] and registry[IamParam.ADMIN_SECRET]:
-        header_data: dict[str, str] = {
-            "Content-Type": "application/x-www-form-urlencoded"
-        }
-        body_data: dict[str, str] = {
-            "grant-type": "password",
-            "username": registry[IamParam.ADMIN_ID],
-            "password": registry[IamParam.ADMIN_SECRET],
-            "client_id": registry[IamParam.CLIENT_ID]
-        }
-        token_data: dict[str, Any] = __post_for_token(iam_server=iam_server,
-                                                      header_data=header_data,
-                                                      body_data=body_data,
-                                                      errors=errors,
-                                                      logger=logger)
-        if token_data:
-            # obtain the token
-            result = token_data["access_token"]
-    else:
-        msg: str = (f"To obtain token with administrative rights from '{iam_server}', "
-                    f"the credentials for the realm administrator must be provided at setup time")
+    if registry:
+        if registry[IamParam.ADMIN_ID] and registry[IamParam.ADMIN_SECRET]:
+            header_data: dict[str, str] = {
+                "Content-Type": "application/x-www-form-urlencoded"
+            }
+            body_data: dict[str, str] = {
+                "grant_type": "password",
+                "username": registry[IamParam.ADMIN_ID],
+                "password": registry[IamParam.ADMIN_SECRET],
+                "client_id": "admin-cli"
+            }
+            token_data: dict[str, Any] = __post_for_token(iam_server=iam_server,
+                                                          header_data=header_data,
+                                                          body_data=body_data,
+                                                          errors=errors,
+                                                          logger=logger)
+            if token_data:
+                # obtain the token
+                result = token_data["access_token"]
+                if logger:
+                    logger.debug(msg="Administrative token obtained")
+
+        elif logger or isinstance(errors, list):
+            msg: str = ("Credentials for administrator of realm "
+                        f"'{registry[IamParam.CLIENT_REALM]}' "
+                        f"at IAM server '{iam_server}' not provided")
+            if logger:
+                logger.error(msg=msg)
+            if isinstance(errors, list):
+                errors.append(msg)
+
+    elif logger or isinstance(errors, list):
+        msg: str = f"Unknown IAM server {iam_server}"
         if logger:
             logger.error(msg=msg)
         if isinstance(errors, list):
@@ -511,14 +718,19 @@ def __get_client_secret(iam_server: IamServer,
                                                 errors=errors,
                                                 logger=logger)
         if token:
+            realm: str = registry[IamParam.CLIENT_REALM]
+            client_id: str = registry[IamParam.CLIENT_ID]
+            if logger:
+                logger.debug(msg=f"Obtaining the UUID for client '{client_id}', "
+                                 f"in realm '{realm}' at IAM server '{iam_server}'")
             # obtain the client UUID
-            url: str = f"{registry[IamParam.URL_BASE]}/realms/{registry[IamParam.CLIENT_REALM]}/clients"
+            url: str = f"{registry[IamParam.URL_BASE]}/realms/{realm}/clients"
             header_data: dict[str, str] = {
                 "Authorization": f"Bearer {token}",
                 "Content-Type": "application/json"
             }
             params: dict[str, str] = {
-                "clientId": registry[IamParam.CLIENT_ID]
+                "clientId": client_id
             }
             clients: list[dict[str, Any]] = __get_for_data(url=url,
                                                            header_data=header_data,
@@ -528,6 +740,9 @@ def __get_client_secret(iam_server: IamServer,
             if clients:
                 # obtain the client's secret password
                 client_uuid: str = clients[0]["id"]
+                if logger:
+                    logger.debug(msg=f"Obtaining the secret for client UUID '{client_uuid}', "
+                                     f"in realm '{realm}' at IAM server '{iam_server}'")
                 url += f"/{client_uuid}/client-secret"
                 reply: dict[str, Any] = __get_for_data(url=url,
                                                        header_data=header_data,
@@ -594,27 +809,27 @@ def __get_for_data(url: str,
     return result
 
 
-def __post_data(url: str,
+def __post_json(url: str,
                 header_data: dict[str, str],
-                body_data: dict[str, Any],
+                json_data: dict[str, Any],
                 errors: list[str] | None,
                 logger: Logger | None) -> None:
     """
     Submit a *POST* request to *url*.
 
     :param header_data: the data to send in the header of the request
-    :param body_data: the data to send in the body of the request
+    :param json_data: the JSON data to send in the request
     :param errors: incidental errors
     :param logger: optional logger
     """
     # log the POST
     if logger:
-        logger.debug(msg=f"POST {url}, {json.dumps(obj=body_data,
+        logger.debug(msg=f"POST {url}, {json.dumps(obj=json_data,
                                                    ensure_ascii=False)}")
     try:
-        response: requests.Response = requests.get(url=url,
-                                                   headers=header_data,
-                                                   data=body_data)
+        response: requests.Response = requests.post(url=url,
+                                                    headers=header_data,
+                                                    json=json_data)
         if response.status_code >= 400:
             # request failed, report the problem
             msg = f"POST failure, status {response.status_code}, reason {response.reason}"
@@ -666,9 +881,9 @@ def __post_for_token(iam_server: IamServer,
         - "username": <realm-administrator-identification>
         - "password": <realm-administrator-secret>
 
-    These attributes are then added to *body_data*:
+    These attributes are then added to *body_data*, except for acquiring administrative tokens:
         - "client_id": <client-id>
-        - "client_secret": <client-secret>  <- except for acquiring administrative tokens
+        - "client_secret": <client-secret>
 
     If the operation is successful, the token data is stored in the *IAM* server's registry, and returned.
     Otherwise, *errors* will contain the appropriate error message.
@@ -700,21 +915,25 @@ def __post_for_token(iam_server: IamServer,
                                                      logger=logger)
         if registry:
             # complete the data to send in body of request
-            body_data["client_id"] = registry[IamParam.CLIENT_ID]
+            if body_data["grant_type"] != "password":
+                body_data["client_id"] = registry[IamParam.CLIENT_ID]
 
             # build the URL
-            base_url: str = f"{registry[IamParam.URL_BASE]}/realms/{registry[IamParam.CLIENT_REALM]}"
-            url: str = f"{base_url}/protocol/openid-connect/token"
-
-            # log the POST ('client_secret' data must not be shown in log)
+            url: str = (f"{registry[IamParam.URL_BASE]}/realms/"
+                        f"{registry[IamParam.CLIENT_REALM]}/protocol/openid-connect/token")
+            #  'client_secret' data must not be shown in log
+            msg: str = f"POST {url}, {json.dumps(obj=body_data,
+                                                 ensure_ascii=False)}"
+            if body_data["grant_type"] != "password":
+                # 'client_secret' not required for requesting tokens from staging environments
+                client_secret: str = __get_client_secret(iam_server=iam_server,
+                                                         errors=None,
+                                                         logger=logger)
+                if client_secret:
+                    body_data["client_secret"] = client_secret
+            # log the POST
             if logger:
-                logger.debug(msg=f"POST {url}, {json.dumps(obj=body_data,
-                                                           ensure_ascii=False)}")
-            client_secret: str = __get_client_secret(iam_server=iam_server,
-                                                     errors=errors,
-                                                     logger=logger)
-            if body_data["grant_type"] != "password" and client_secret:
-                body_data["client_secret"] = client_secret
+                logger.debug(msg=msg)
 
             # obtain the token
             try:
@@ -783,6 +1002,8 @@ def __validate_and_store(iam_server: IamServer,
     # initialize the return variable
     result: tuple[str, str] | None = None
 
+    if logger:
+        logger.debug(msg=f"Validating and storing the token")
     with _iam_lock:
         # retrieve the IAM server's registry
         registry: dict[str, Any] = _get_iam_registry(iam_server=iam_server,
@@ -797,9 +1018,9 @@ def __validate_and_store(iam_server: IamServer,
             user_data["access-expiration"] = now + token_data.get("expires_in")
             refresh_exp: int = user_data.get("refresh_expires_in")
             user_data["refresh-expiration"] = (now + refresh_exp) if refresh_exp else sys.maxsize
-            # public_key: str = _get_public_key(iam_server=iam_server,
-            #                                   errors=errors,
-            #                                   logger=logger)
+            public_key: str = _get_public_key(iam_server=iam_server,
+                                              errors=errors,
+                                              logger=logger)
             recipient_attr = registry[IamParam.RECIPIENT_ATTR]
             login_id = user_data.pop("login-id", None)
             base_url: str = f"{registry[IamParam.URL_BASE]}/realms/{registry[IamParam.CLIENT_REALM]}"
@@ -807,7 +1028,7 @@ def __validate_and_store(iam_server: IamServer,
                                                                issuer=base_url,
                                                                recipient_id=login_id,
                                                                recipient_attr=recipient_attr,
-                                                               # public_key=public_key,
+                                                               public_key=public_key,
                                                                errors=errors,
                                                                logger=logger)
             if claims: