pypomes-iam 0.7.2__py3-none-any.whl → 0.7.6__py3-none-any.whl

pypomes_iam/iam_actions.py

@@ -26,6 +26,7 @@ def action_login(iam_server: IamServer,
     These are the expected attributes in *args*:
         - user-id: optional, identifies the reference user (alias: 'login')
         - redirect-uri: a parameter to be added to the query part of the returned URL
+        -target-idp: optionally, identify a target identity provider for the login operation
 
     If provided, the user identification will be validated against the authorization data
     returned by *iam_server* upon login. On success, the appropriate URL for invoking
@@ -43,9 +44,14 @@ def action_login(iam_server: IamServer,
     # obtain the optional user's identification
     user_id: str = args.get("user-id") or args.get("login")
 
+    # obtain the optional target identity provider
+    target_idp: str = args.get("target-idp")
+
     # build the user data
     # ('oauth_state' is a randomly-generated string, thus 'user_data' is always a new entry)
     oauth_state: str = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(16))
+    if target_idp:
+        oauth_state += f"idp={target_idp}"
 
     with _iam_lock:
         # retrieve the user data from the IAM server's registry
@@ -75,6 +81,10 @@ def action_login(iam_server: IamServer,
                               f"&client_id={registry[IamParam.CLIENT_ID]}"
                               f"&redirect_uri={redirect_uri}"
                               f"&state={oauth_state}")
+                    if target_idp:
+                        # HAZARD: the name 'kc_idp_hint' is Keycloak-specific
+                        result += f"&kc_idp_hint={target_idp}"
+
     return result
 
 
@@ -240,6 +250,10 @@ def action_callback(iam_server: IamServer,
             if int(datetime.now(tz=TZ_LOCAL).timestamp()) > expiration:
                 errors.append("Operation timeout")
             else:
+                pos: int = oauth_state.rfind("idp=")
+                target_idp: str = oauth_state[pos+4:] if pos > 0 else None
+                target_iam = IamServer(target_idp) if target_idp in IamServer else None
+                target_data: dict[str, Any] = user_data.copy() if target_iam else None
                 users.pop(oauth_state)
                 code: str = args.get("code")
                 header_data: dict[str, str] = {
@@ -264,6 +278,33 @@ def action_callback(iam_server: IamServer,
                                                   now=now,
                                                   errors=errors,
                                                   logger=logger)
+                    if target_iam:
+                        if logger:
+                            logger.debug(msg=f"Requesting to IAM server '{iam_server}' "
+                                             f"the token issued by '{target_iam}' ")
+                        registry: dict[str, Any] = _get_iam_registry(iam_server,
+                                                                     errors=errors,
+                                                                     logger=logger)
+                        url: str = f"{registry[IamParam.URL_BASE]}/realms/{registry[IamParam.CLIENT_REALM]}"
+                        url += f"/broker/{target_idp}/token"
+                        header_data: dict[str, str] = {
+                            "Authorization": f"Bearer {result[1]}",
+                            "Content-Type": "application/json"
+                        }
+                        token_data = __get_for_data(url=url,
+                                                    header_data=header_data,
+                                                    params=None,
+                                                    errors=errors,
+                                                    logger=logger)
+                        if not errors:
+                            token_info: tuple[str, str] = __validate_and_store(iam_server=target_iam,
+                                                                               user_data=target_data,
+                                                                               token_data=token_data,
+                                                                               now=now,
+                                                                               errors=errors,
+                                                                               logger=logger)
+                            if token_info and logger:
+                                logger.debug(msg=f"Token obtained: {json.dumps(obj=token_info)}")
         else:
             msg: str = f"State '{oauth_state}' not found in {iam_server}'s registry"
             if logger:
@@ -451,13 +492,13 @@ def __assert_link(iam_server: IamServer,
                             logger.debug(msg="Creating an association between identifications "
                                              f"'{user_id}' and '{token_sub}' in IAM server {iam_server}")
                         url += f"/{provider_name}"
-                        body_data: dict[str, Any] = {
+                        json_data: dict[str, Any] = {
                             "userId": token_sub,
                             "userName": user_id
                         }
-                        __post_data(url=url,
+                        __post_json(url=url,
                                     header_data=header_data,
-                                    body_data=body_data,
+                                    json_data=json_data,
                                     errors=errors,
                                     logger=logger)
 
@@ -646,27 +687,27 @@ def __get_for_data(url: str,
     return result
 
 
-def __post_data(url: str,
+def __post_json(url: str,
                 header_data: dict[str, str],
-                body_data: dict[str, Any],
+                json_data: dict[str, Any],
                 errors: list[str] | None,
                 logger: Logger | None) -> None:
     """
     Submit a *POST* request to *url*.
 
     :param header_data: the data to send in the header of the request
-    :param body_data: the data to send in the body of the request
+    :param json_data: the JSON data to send in the request
     :param errors: incidental errors
     :param logger: optional logger
     """
     # log the POST
     if logger:
-        logger.debug(msg=f"POST {url}, {json.dumps(obj=body_data,
+        logger.debug(msg=f"POST {url}, {json.dumps(obj=json_data,
                                                    ensure_ascii=False)}")
     try:
         response: requests.Response = requests.post(url=url,
                                                     headers=header_data,
-                                                    data=body_data)
+                                                    json=json_data)
         if response.status_code >= 400:
             # request failed, report the problem
             msg = f"POST failure, status {response.status_code}, reason {response.reason}"
@@ -839,6 +880,8 @@ def __validate_and_store(iam_server: IamServer,
     # initialize the return variable
     result: tuple[str, str] | None = None
 
+    if logger:
+        logger.debug(msg=f"Validating and storing the token")
     with _iam_lock:
         # retrieve the IAM server's registry
         registry: dict[str, Any] = _get_iam_registry(iam_server=iam_server,

pypomes_iam/iam_services.py

@@ -120,6 +120,7 @@ def service_login() -> Response:
     These are the expected request parameters:
         - user-id: optional, identifies the reference user (alias: 'login')
         - redirect-uri: a parameter to be added to the query part of the returned URL
+        -target-idp: optionally, identify a target identity provider for the login operation
 
     If provided, the user identification will be validated against the authorization data
     returned by *iam_server* upon login. On success, the following JSON, containing the appropriate

{pypomes_iam-0.7.2.dist-info → pypomes_iam-0.7.6.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pypomes_iam
-Version: 0.7.2
+Version: 0.7.6
 Summary: A collection of Python pomes, penyeach (IAM modules)
 Project-URL: Homepage, https://github.com/TheWiseCoder/PyPomes-IAM
 Project-URL: Bug Tracker, https://github.com/TheWiseCoder/PyPomes-IAM/issues

{pypomes_iam-0.7.2.dist-info → pypomes_iam-0.7.6.dist-info}/RECORD

@@ -1,11 +1,11 @@
 pypomes_iam/__init__.py,sha256=_6tSFfjuU-5p6TAMqNLHSL6IQmaJMSYuEW-TG3ybhTI,1044
-pypomes_iam/iam_actions.py,sha256=qUX8DdTBOUVfJpWtE7qg4rSBh6ZQNG_4VnMA7uebnV4,42781
+pypomes_iam/iam_actions.py,sha256=zoxAzcw9fBTMEt-y5INaw7Wjfa1R5o-z_ORxvo4kqGU,45612
 pypomes_iam/iam_common.py,sha256=ki_-m6fqJqUbGjgTD41r9zaE-FOXgA_c_tLisIYYTfU,15457
 pypomes_iam/iam_pomes.py,sha256=_kLnrZG25XhJsIv3wqDl_2sIJ2ho_2TIMKrPCyPmA7Q,7362
-pypomes_iam/iam_services.py,sha256=AzrZux2Pt_FoCNcTcXfWphHb587vB3WIbKYG7RFf5zE,15821
+pypomes_iam/iam_services.py,sha256=HFK_ihY1n7I4JGptAwV44MxHMPsGLDU5ElsaFOqUDcc,15915
 pypomes_iam/provider_pomes.py,sha256=3mMj5LQs53YEINUEOfFBAxOwOP3aOR_szlE4daEBLK0,10523
 pypomes_iam/token_pomes.py,sha256=K4nSAotKUoHIE2s3ltc_nVimlNeKS9tnD-IlslkAvkk,6626
-pypomes_iam-0.7.2.dist-info/METADATA,sha256=7amJ095DkifMRQeC7uX5C6rsU7jzgCA7Bnn3uu6N6q4,661
-pypomes_iam-0.7.2.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
-pypomes_iam-0.7.2.dist-info/licenses/LICENSE,sha256=YvUELgV8qvXlaYsy9hXG5EW3Bmsrkw-OJmmILZnonAc,1086
-pypomes_iam-0.7.2.dist-info/RECORD,,
+pypomes_iam-0.7.6.dist-info/METADATA,sha256=b6eajrnQCM0TsdjAbz1H4xf9EgrGV0ii_phYm51nOQI,661
+pypomes_iam-0.7.6.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
+pypomes_iam-0.7.6.dist-info/licenses/LICENSE,sha256=YvUELgV8qvXlaYsy9hXG5EW3Bmsrkw-OJmmILZnonAc,1086
+pypomes_iam-0.7.6.dist-info/RECORD,,