pypomes-iam 0.6.9__tar.gz → 0.7.6__tar.gz

{pypomes_iam-0.6.9 → pypomes_iam-0.7.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pypomes_iam
-Version: 0.6.9
+Version: 0.7.6
 Summary: A collection of Python pomes, penyeach (IAM modules)
 Project-URL: Homepage, https://github.com/TheWiseCoder/PyPomes-IAM
 Project-URL: Bug Tracker, https://github.com/TheWiseCoder/PyPomes-IAM/issues

{pypomes_iam-0.6.9 → pypomes_iam-0.7.6}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "pypomes_iam"
-version = "0.6.9"
+version = "0.7.6"
 authors = [
   { name="GT Nunes", email="wisecoder01@gmail.com" }
 ]

{pypomes_iam-0.6.9 → pypomes_iam-0.7.6}/src/pypomes_iam/iam_actions.py

@@ -26,6 +26,7 @@ def action_login(iam_server: IamServer,
     These are the expected attributes in *args*:
         - user-id: optional, identifies the reference user (alias: 'login')
         - redirect-uri: a parameter to be added to the query part of the returned URL
+        -target-idp: optionally, identify a target identity provider for the login operation
 
     If provided, the user identification will be validated against the authorization data
     returned by *iam_server* upon login. On success, the appropriate URL for invoking
@@ -43,9 +44,14 @@ def action_login(iam_server: IamServer,
     # obtain the optional user's identification
     user_id: str = args.get("user-id") or args.get("login")
 
+    # obtain the optional target identity provider
+    target_idp: str = args.get("target-idp")
+
     # build the user data
     # ('oauth_state' is a randomly-generated string, thus 'user_data' is always a new entry)
     oauth_state: str = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(16))
+    if target_idp:
+        oauth_state += f"idp={target_idp}"
 
     with _iam_lock:
         # retrieve the user data from the IAM server's registry
@@ -75,6 +81,10 @@ def action_login(iam_server: IamServer,
                               f"&client_id={registry[IamParam.CLIENT_ID]}"
                               f"&redirect_uri={redirect_uri}"
                               f"&state={oauth_state}")
+                    if target_idp:
+                        # HAZARD: the name 'kc_idp_hint' is Keycloak-specific
+                        result += f"&kc_idp_hint={target_idp}"
+
     return result
 
 
@@ -240,6 +250,10 @@ def action_callback(iam_server: IamServer,
             if int(datetime.now(tz=TZ_LOCAL).timestamp()) > expiration:
                 errors.append("Operation timeout")
             else:
+                pos: int = oauth_state.rfind("idp=")
+                target_idp: str = oauth_state[pos+4:] if pos > 0 else None
+                target_iam = IamServer(target_idp) if target_idp in IamServer else None
+                target_data: dict[str, Any] = user_data.copy() if target_iam else None
                 users.pop(oauth_state)
                 code: str = args.get("code")
                 header_data: dict[str, str] = {
@@ -264,6 +278,33 @@ def action_callback(iam_server: IamServer,
                                                   now=now,
                                                   errors=errors,
                                                   logger=logger)
+                    if target_iam:
+                        if logger:
+                            logger.debug(msg=f"Requesting to IAM server '{iam_server}' "
+                                             f"the token issued by '{target_iam}' ")
+                        registry: dict[str, Any] = _get_iam_registry(iam_server,
+                                                                     errors=errors,
+                                                                     logger=logger)
+                        url: str = f"{registry[IamParam.URL_BASE]}/realms/{registry[IamParam.CLIENT_REALM]}"
+                        url += f"/broker/{target_idp}/token"
+                        header_data: dict[str, str] = {
+                            "Authorization": f"Bearer {result[1]}",
+                            "Content-Type": "application/json"
+                        }
+                        token_data = __get_for_data(url=url,
+                                                    header_data=header_data,
+                                                    params=None,
+                                                    errors=errors,
+                                                    logger=logger)
+                        if not errors:
+                            token_info: tuple[str, str] = __validate_and_store(iam_server=target_iam,
+                                                                               user_data=target_data,
+                                                                               token_data=token_data,
+                                                                               now=now,
+                                                                               errors=errors,
+                                                                               logger=logger)
+                            if token_info and logger:
+                                logger.debug(msg=f"Token obtained: {json.dumps(obj=token_info)}")
         else:
             msg: str = f"State '{oauth_state}' not found in {iam_server}'s registry"
             if logger:
@@ -277,7 +318,7 @@ def action_callback(iam_server: IamServer,
 def action_exchange(iam_server: IamServer,
                     args: dict[str, Any],
                     errors: list[str] = None,
-                    logger: Logger = None) -> dict[str, Any]:
+                    logger: Logger = None) -> tuple[str, str]:
     """
     Request *iam_server* to issue a token in exchange for the token obtained from another *IAM* server.
 
@@ -298,17 +339,23 @@ def action_exchange(iam_server: IamServer,
     :param args: the arguments passed when requesting the service
     :param errors: incidental errors
     :param logger: optional logger
-    :return: the data for the new token, or *None* if error
+    :return: a tuple containing the reference user identification and the token obtained, or *None* if error
     """
     # initialize the return variable
-    result: dict[str, Any] | None = None
+    result: tuple[str, str] | None = None
 
     # obtain the user's identification
     user_id: str = args.get("user-id") or args.get("login")
 
     # obtain the token to be exchanged
     token: str = args.get("access-token") if user_id else None
-    if token:
+    token_claims: dict[str, dict[str, Any]] = token_get_claims(token=token,
+                                                               errors=errors,
+                                                               logger=logger) if token else None
+    token_issuer: str = _iam_server_from_issuer(issuer=token_claims["payload"]["iss"],
+                                                errors=errors,
+                                                logger=logger) if token_claims else None
+    if not errors:
         # HAZARD: only 'IAM_KEYCLOAK' is currently supported
         with _iam_lock:
             # retrieve the IAM server's registry
@@ -324,6 +371,8 @@ def action_exchange(iam_server: IamServer,
                               logger=logger)
                 if not errors:
                     # exchange the token
+                    if logger:
+                        logger.debug(msg=f"Requesting the token exchange to IAM server '{iam_server}'")
                     header_data: dict[str, Any] = {
                         "Content-Type": "application/x-www-form-urlencoded"
                     }
@@ -333,7 +382,7 @@ def action_exchange(iam_server: IamServer,
                         "subject_token_type": "urn:ietf:params:oauth:token-type:access_token",
                         "requested_token_type": "urn:ietf:params:oauth:token-type:access_token",
                         "audience": registry[IamParam.CLIENT_ID],
-                        "subject_issuer": "oidc"
+                        "subject_issuer": token_issuer
                     }
                     now: int = int(datetime.now(tz=TZ_LOCAL).timestamp())
                     token_data: dict[str, Any] = __post_for_token(iam_server=iam_server,
@@ -443,13 +492,13 @@ def __assert_link(iam_server: IamServer,
                             logger.debug(msg="Creating an association between identifications "
                                              f"'{user_id}' and '{token_sub}' in IAM server {iam_server}")
                         url += f"/{provider_name}"
-                        body_data: dict[str, Any] = {
+                        json_data: dict[str, Any] = {
                             "userId": token_sub,
                             "userName": user_id
                         }
-                        __post_data(url=url,
+                        __post_json(url=url,
                                     header_data=header_data,
-                                    body_data=body_data,
+                                    json_data=json_data,
                                     errors=errors,
                                     logger=logger)
 
@@ -638,27 +687,27 @@ def __get_for_data(url: str,
     return result
 
 
-def __post_data(url: str,
+def __post_json(url: str,
                 header_data: dict[str, str],
-                body_data: dict[str, Any],
+                json_data: dict[str, Any],
                 errors: list[str] | None,
                 logger: Logger | None) -> None:
     """
     Submit a *POST* request to *url*.
 
     :param header_data: the data to send in the header of the request
-    :param body_data: the data to send in the body of the request
+    :param json_data: the JSON data to send in the request
     :param errors: incidental errors
     :param logger: optional logger
     """
     # log the POST
     if logger:
-        logger.debug(msg=f"POST {url}, {json.dumps(obj=body_data,
+        logger.debug(msg=f"POST {url}, {json.dumps(obj=json_data,
                                                    ensure_ascii=False)}")
     try:
-        response: requests.Response = requests.get(url=url,
-                                                   headers=header_data,
-                                                   data=body_data)
+        response: requests.Response = requests.post(url=url,
+                                                    headers=header_data,
+                                                    json=json_data)
         if response.status_code >= 400:
             # request failed, report the problem
             msg = f"POST failure, status {response.status_code}, reason {response.reason}"
@@ -831,6 +880,8 @@ def __validate_and_store(iam_server: IamServer,
     # initialize the return variable
     result: tuple[str, str] | None = None
 
+    if logger:
+        logger.debug(msg=f"Validating and storing the token")
     with _iam_lock:
         # retrieve the IAM server's registry
         registry: dict[str, Any] = _get_iam_registry(iam_server=iam_server,

{pypomes_iam-0.6.9 → pypomes_iam-0.7.6}/src/pypomes_iam/iam_services.py

@@ -120,6 +120,7 @@ def service_login() -> Response:
     These are the expected request parameters:
         - user-id: optional, identifies the reference user (alias: 'login')
         - redirect-uri: a parameter to be added to the query part of the returned URL
+        -target-idp: optionally, identify a target identity provider for the login operation
 
     If provided, the user identification will be validated against the authorization data
     returned by *iam_server* upon login. On success, the following JSON, containing the appropriate
@@ -338,13 +339,10 @@ def service_exchange() -> Response:
     If the exchange is successful, the token data is stored in the *IAM* server's registry, and returned.
     Otherwise, *errors* will contain the appropriate error message.
 
-    On success, the typical *Response* returned will contain the following attributes:
+    On success, the returned *Response* will contain the following JSON:
         {
-            "token_type": "Bearer",
-            "access_token": <str>,
-            "expires_in": <number-of-seconds>,
-            "refresh_token": <str>,
-            "refesh_expires_in": <number-of-seconds>
+            "user-id": <reference-user-identification>,
+            "access-token": <token>
         }
 
     :return: *Response* containing the token data, or *BAD REQUEST*
@@ -360,10 +358,10 @@ def service_exchange() -> Response:
                                                           errors=errors,
                                                           logger=__IAM_LOGGER)
         # exchange the token
-        token_data: dict[str, Any] | None = None
+        token_info: tuple[str, str] | None = None
         if iam_server:
             errors: list[str] = []
-            token_data = action_exchange(iam_server=iam_server,
+            token_info = action_exchange(iam_server=iam_server,
                                          args=request.args,
                                          errors=errors,
                                          logger=__IAM_LOGGER)
@@ -372,7 +370,8 @@ def service_exchange() -> Response:
         result = Response(response="; ".join(errors),
                           status=400)
     else:
-        result = jsonify(token_data)
+        result = jsonify({"user-id": token_info[0],
+                          "access-token": token_info[1]})
 
     # log the response
     if __IAM_LOGGER: