simple_openid_connect 2.3.2__tar.gz → 2.4.0__tar.gz

{simple_openid_connect-2.3.2 → simple_openid_connect-2.4.0}/.envrc.dist

@@ -1,3 +1,5 @@
+watch_file requirements.dev.txt pyproject.toml
+
 if has nix; then
     use flake
 fi

{simple_openid_connect-2.3.2 → simple_openid_connect-2.4.0}/.github/workflows/checks.yml

@@ -27,18 +27,21 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        py_version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
-        drf_version: ["3.14", "3.15", "3.16"]
+        py_version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+        drf_version: ["3.15", "3.16", "3.17"]
         django_version:
           - "4.2" # LTS
-          - "5.1" # current
-          - "5.2" # current, LTS
+          - "5.2" # LTS
+          - "6" # current major version
         exclude:
-          # django 5.* requires python >3.9
-          - py_version: "3.9"
-            django_version: "5.1"
-          - py_version: "3.9"
-            django_version: "5.2"
+          # exclude new django versions with old python versions
+          - py_version: "3.10"
+            django_version: "6"
+          - py_version: "3.11"
+            django_version: "6"
+          # exclude old django versions with new python versions
+          - py_version: "3.14"
+            django_version: "4.2"
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3

{simple_openid_connect-2.3.2 → simple_openid_connect-2.4.0}/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## v2.4.0
+
+### Notable Features
+
+- JSON-Web-Keys of Identity-Providers are not cached indefinitely anymore.
+  In previous versions, when using the *client-style* API of this library, any instance of `OpenidClient` would fetch JSON-Web-Keys from the configured identity provider during initialization and then keep them forever. This has been changed so that JWKs are now only fetched on demand and cached based on the Identity-Providers HTTP `Cache-Control` header information. Because many Identity-Provider implementations don't send 'Cache-Control' headers, a default minimum cache of 10 minutes has also been implemented.
+
+### Minor Changes
+
+- The supported list of python and integration versions has been updated to match currently supported upstream ones.
+- The included django admin view now only displays raw tokens when djangos debug mode is enabled.
+
 ## v2.3.2
 
 ### Bug-Fixes

{simple_openid_connect-2.3.2 → simple_openid_connect-2.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: simple_openid_connect
-Version: 2.3.2
+Version: 2.4.0
 Summary: Simple and opinionated OpenID-Connect relying party and resource server implementation
 Author-email: lilly <li@lly.sh>
 Requires-Python: ~=3.9
@@ -66,14 +66,14 @@ Simple and opinionated OpenID-Connect relying party and resource server implemen
 
 ## Language & Framework Support
 
-We aim to follow pythons officially supported versions. This is currently python `v3.9`, `v3.10`, `v3.11`, `v3.12` and `v3.13`.
+We aim to follow pythons officially supported versions. This is currently python `v3.10`, `v3.11`, `v3.12`, `v3.13` and `v3.14`.
 
 In addition to being an OpenID library from which one can build their own authentication solutaion, we also offer explicit integrations into the following frameworks and projects:
 
 | Name                                                            | Package Feature       | Integration Docs                                                                                   | Supported Versions        |
 |-----------------------------------------------------------------|-----------------------|----------------------------------------------------------------------------------------------------|---------------------------|
-| [Django](https://www.djangoproject.com/)                        | `django`              | [Integration Docs](https://simple-openid-connect.readthedocs.io/en/stable/django-integration.html) | `v4.2`, `v5.1`, `v5.2`    |
-| [Django-Rest-Framework](https://www.django-rest-framework.org/) | `djangorestframework` | [Integration Docs](https://simple-openid-connect.readthedocs.io/en/stable/drf-integration.html)    | `v3.14`, `v3.15`, `v3.16` |
+| [Django](https://www.djangoproject.com/)                        | `django`              | [Integration Docs](https://simple-openid-connect.readthedocs.io/en/stable/django-integration.html) | `v4.2`, `v5.2`, `v6.0`    |
+| [Django-Rest-Framework](https://www.django-rest-framework.org/) | `djangorestframework` | [Integration Docs](https://simple-openid-connect.readthedocs.io/en/stable/drf-integration.html)    | `v3.15`, `v3.16`, `v3.17` |
 
 
 

{simple_openid_connect-2.3.2 → simple_openid_connect-2.4.0}/README.md

@@ -33,14 +33,14 @@ Simple and opinionated OpenID-Connect relying party and resource server implemen
 
 ## Language & Framework Support
 
-We aim to follow pythons officially supported versions. This is currently python `v3.9`, `v3.10`, `v3.11`, `v3.12` and `v3.13`.
+We aim to follow pythons officially supported versions. This is currently python `v3.10`, `v3.11`, `v3.12`, `v3.13` and `v3.14`.
 
 In addition to being an OpenID library from which one can build their own authentication solutaion, we also offer explicit integrations into the following frameworks and projects:
 
 | Name                                                            | Package Feature       | Integration Docs                                                                                   | Supported Versions        |
 |-----------------------------------------------------------------|-----------------------|----------------------------------------------------------------------------------------------------|---------------------------|
-| [Django](https://www.djangoproject.com/)                        | `django`              | [Integration Docs](https://simple-openid-connect.readthedocs.io/en/stable/django-integration.html) | `v4.2`, `v5.1`, `v5.2`    |
-| [Django-Rest-Framework](https://www.django-rest-framework.org/) | `djangorestframework` | [Integration Docs](https://simple-openid-connect.readthedocs.io/en/stable/drf-integration.html)    | `v3.14`, `v3.15`, `v3.16` |
+| [Django](https://www.djangoproject.com/)                        | `django`              | [Integration Docs](https://simple-openid-connect.readthedocs.io/en/stable/django-integration.html) | `v4.2`, `v5.2`, `v6.0`    |
+| [Django-Rest-Framework](https://www.django-rest-framework.org/) | `djangorestframework` | [Integration Docs](https://simple-openid-connect.readthedocs.io/en/stable/drf-integration.html)    | `v3.15`, `v3.16`, `v3.17` |
 
 
 

{simple_openid_connect-2.3.2 → simple_openid_connect-2.4.0}/requirements.dev.txt

@@ -10,6 +10,7 @@ mypy>=1.7.0
 pytest
 pytest-django
 pytest-explicit
+freezegun
 pyyaml
 responses
 ruff

{simple_openid_connect-2.3.2 → simple_openid_connect-2.4.0}/src/simple_openid_connect/__init__.py

@@ -2,4 +2,4 @@
 Simple and opinionated OpenID-Connect relying party (client) and resource server implementation.
 """
 
-__version__ = "2.3.2"
+__version__ = "2.4.0"

{simple_openid_connect-2.3.2 → simple_openid_connect-2.4.0}/src/simple_openid_connect/client.py

@@ -14,10 +14,11 @@ from typing import (
     TypeVar,
     Union,
 )
+from datetime import datetime, timedelta, timezone
+import warnings
 
 from cryptojwt import JWK
 from cryptojwt.jwk.jwk import key_from_jwk_dict
-
 from simple_openid_connect import (
     jwk,
     rp_initiated_logout,
@@ -62,8 +63,8 @@ class OpenidClient:
     """
 
     provider_config: ProviderMetadata
-    provider_keys: List[JWK]
     client_auth: ClientAuthenticationMethod
+    min_jwks_cache_duration: timedelta
     scope: str
 
     authorization_code_flow: AuthorizationCodeFlowClient
@@ -75,22 +76,48 @@ class OpenidClient:
     client_credentials_grant: ClientCredentialsGrantClient
     "*Client Credentials Grant* (or *Service Account Authentication*) functionality"
 
+    _jwks_max_age: Optional[datetime]
+    "Maximum time until the currently cached provider keys are valid"
+    _provider_keys: Optional[List[JWK]]
+    "Cached provider keys that can be used until they expire"
+
     def __init__(
         self,
         provider_config: ProviderMetadata,
-        provider_keys: List[JWK],
-        authentication_redirect_uri: Optional[str],
-        client_id: str,
+        provider_keys: Optional[List[JWK]] = None,
+        authentication_redirect_uri: Optional[str] = None,
+        client_id: str = "",
         client_secret: Optional[str] = None,
         scope: str = "openid",
+        min_jwks_cache_duration: timedelta = timedelta(minutes=10),
     ):
+        """
+        Construct a new client that is bound to an Identity-Provider.
+
+        See :func:`from_issuer_url` for a more convenient factory that constructs a client instance.
+
+        :param provider_config: Configuration of the identity provider, probably fetched via autodiscovery
+        :param authentication_redirect_uri: The URL that a User-Agent should be redirected to during the authentication process to reach this client
+        :param client_id: The client_id for this client. This is assigned to you by the Identity-Provider
+        :param client_secret: The client_secret for this client. This is assigned to you by the Identity-Provider and is recommended to set. If this client is not able to keep it's secret safe, it shoud however not be set.
+        :param scope: The authorization scope this client should request from the Identity-Provider
+        :param min_jwks_cache_duration: Minimum time this client will cache JWKs responses from the Identity-Provider. If set to 0, the Identity-Providers Cache-Control HTTP headers will be resepcted fully.
+        """
         self.provider_config = provider_config
-        self.provider_keys = provider_keys
+        self.scope = scope
+        self.authentication_redirect_uri = authentication_redirect_uri
+        self.min_jwks_cache_duration = min_jwks_cache_duration
         self.authorization_code_flow = AuthorizationCodeFlowClient(self)
         self.direct_access_grant = DirectAccessGrantClient(self)
         self.client_credentials_grant = ClientCredentialsGrantClient(self)
-        self.scope = scope
-        self.authentication_redirect_uri = authentication_redirect_uri
+        self._jwks_max_age = None
+        self._provider_keys = None
+
+        if provider_keys is not None:
+            warnings.warn(
+                "giving a provider_keys= parameter to the OpenidClient constructor and the parameter will be removed in a future release",
+                DeprecationWarning,
+            )
 
         if client_secret is None:
             self.client_auth = NoneAuth(client_id)
@@ -113,6 +140,7 @@ class OpenidClient:
         client_id: str,
         client_secret: Union[str, None] = None,
         scope: str = "openid",
+        min_jwks_cache_duration: timedelta = timedelta(minutes=10),
     ) -> Self:
         """
         Create a new client instance with an issuer url as base, automatically discovering information about the issuer in the process.
@@ -124,11 +152,17 @@ class OpenidClient:
         :param client_secret: Optionally a client secret which has been assigned to your client from the issuer.
             If not supplied, this client is assumed to be *public* which means it has not client secret because it cannot be kept safe (e.g. a web-app).
         :param scope: Which scopes to request from the OP
+        :param min_jwks_cache_duration: Minimum time this client will cache JWKs responses from the Identity-Provider. If set to 0, the Identity-Providers Cache-Control HTTP headers will be resepcted fully.
         """
 
         config = discover_configuration_from_issuer(url)
         return cls.from_issuer_config(
-            config, authentication_redirect_uri, client_id, client_secret, scope
+            config,
+            authentication_redirect_uri,
+            client_id,
+            client_secret,
+            scope,
+            min_jwks_cache_duration,
         )
 
     @classmethod
@@ -139,6 +173,7 @@ class OpenidClient:
         client_id: str,
         client_secret: Union[str, None] = None,
         scope: str = "openid",
+        min_jwks_cache_duration: timedelta = timedelta(minutes=10),
     ) -> Self:
         """
         Create a new client instance with a resolved issuer configuration as base.
@@ -152,12 +187,40 @@ class OpenidClient:
         :param client_secret: Optionally a client secret which has been assigned to your client from the issuer.
             If not supplied, this client is assumed to be *public* which means it has not client secret because it cannot be kept safe (e.g. a web-app).
         :param scope: Which scopes to request from the OP
+        :param min_jwks_cache_duration: Minimum time this client will cache JWKs responses from the Identity-Provider. If set to 0, the Identity-Providers Cache-Control HTTP headers will be resepcted fully.
         """
-        keys = jwk.fetch_jwks(config.jwks_uri)
         return cls(
-            config, keys, authentication_redirect_uri, client_id, client_secret, scope
+            config,
+            None,
+            authentication_redirect_uri,
+            client_id,
+            client_secret,
+            scope,
+            min_jwks_cache_duration,
         )
 
+    @property
+    def provider_keys(self) -> List[JWK]:
+        now = datetime.now(timezone.utc)
+
+        # return the cached data if it is still valid
+        if (
+            self._provider_keys is not None
+            and self._jwks_max_age is not None
+            and now <= self._jwks_max_age
+        ):
+            return self._provider_keys
+
+        # fetch new keys otherwise
+        jwks, idp_max_age = jwk.fetch_jwks_max_age(self.provider_config.jwks_uri)
+        self._provider_keys = jwks
+
+        # remember how long we can cache the retrieved keys
+        # if the idp did not return any max-age information, interpret as expiring immediately but also cache for the minimum configured time
+        self._jwks_max_age = max(idp_max_age or now, now + self.min_jwks_cache_duration)
+
+        return self._provider_keys
+
     @property
     def client_type(self) -> Literal["public", "confidential"]:
         """
@@ -309,11 +372,15 @@ class OpenidClient:
         # this implements support for pickling this class
         # it is basically the default pickle behavior but explicitly serializes keys because they are FFI backed and not normally picklable
         result = self.__dict__.copy()
-        result["provider_keys"] = [k.serialize() for k in self.provider_keys]
+        if self._provider_keys is not None:
+            result["_provider_keys"] = [k.serialize() for k in self._provider_keys]
         return result
 
     def __setstate__(self, state: Dict[str, Any]) -> None:
         # this implements support for unpickling this class
         # it is basically the default pickle behavior but explicitly deserializes keys
-        state["provider_keys"] = [key_from_jwk_dict(k) for k in state["provider_keys"]]
+        if state["_provider_keys"] is not None:
+            state["_provider_keys"] = [
+                key_from_jwk_dict(k) for k in state["_provider_keys"]
+            ]
         self.__dict__ = state

{simple_openid_connect-2.3.2 → simple_openid_connect-2.4.0}/src/simple_openid_connect/integrations/django/admin.py

@@ -1,8 +1,9 @@
-from typing import List
+from typing import List, Any, Dict, Optional
 
 from django.contrib import admin
 from django.http import HttpRequest
 from django.contrib.auth import get_user_model
+from django.conf import settings
 
 from . import models
 
@@ -34,3 +35,17 @@ class OpenidUserAdmin(admin.ModelAdmin):  # type: ignore[type-arg]
             result.append(f"user__{UserModel.EMAIL_FIELD}")
 
         return result
+
+    def change_view(
+        self,
+        request: Any,
+        object_id: Any,
+        form_url: Any = "",
+        extra_context: Optional[Dict[str, Any]] = None,
+    ) -> Any:
+        # add a settings.DEBUG context variable
+        extra_context = extra_context or dict()
+        extra_context.setdefault("settings", dict())
+        extra_context["settings"]["DEBUG"] = settings.DEBUG and True
+
+        return super().change_view(request, object_id, form_url, extra_context)

{simple_openid_connect-2.3.2 → simple_openid_connect-2.4.0}/src/simple_openid_connect/integrations/django/templates/simple_openid_connect/admin/openid_session_inline.html

@@ -1,7 +1,6 @@
 <fieldset class="module aligned" aria-labelledby="{{ inline_admin_formset.formset.prefix }}-heading">
   <h2 id="{{ inline_admin_formset.formset.prefix }}-heading" class="inline-heading">OpenID Sessions</h2>
 
-
   {% for inline_admin_form in inline_admin_formset %}
   {% with i_session=inline_admin_form.original %}
   {% if i_session %}
@@ -27,12 +26,14 @@
               <span style="color: green;">Valid until {{ i_session.access_token_expiry | default:"-empty-" }}</span>
             {% endif %}
           </div>
+          {% if settings.DEBUG %}
           <div style="margin-left: 2rem; min-width: 128px; padding: 6px 0;">
             <details>
               <summary>Token</summary>
               <code style="display: block; padding: 8px; line-break: anywhere;">{{ i_session.access_token }}</code>
-          </details>
+            </details>
           </div>
+          {% endif %}
         </div>
 
         <div class="flex-container">
@@ -44,12 +45,14 @@
               <span style="color: green;">Valid until {{ i_session.refresh_token_expiry | default:"-empty-" }}</span>
             {% endif %}
           </div>
+          {% if settings.DEBUG %}
           <div style="margin-left: 2rem; min-width: 128px; padding: 6px 0;">
             <details>
               <summary>Token</summary>
               <code style="display: block; padding: 8px; line-break: anywhere;">{{ i_session.refresh_token }}</code>
-          </details>
+            </details>
           </div>
+          {% endif %}
         </div>
 
         <div class="flex-container">

simple_openid_connect-2.4.0/src/simple_openid_connect/jwk.py

@@ -0,0 +1,59 @@
+"""
+JSON-Web-Key handling code
+"""
+
+from typing import List, cast, Tuple, Any, Optional
+from datetime import datetime, timedelta, timezone
+
+from cryptojwt import JWK, KeyBundle
+
+from simple_openid_connect.exceptions import OpenidProtocolError
+import requests
+
+requests.request
+
+
+class _Httpc:
+    """
+    A wrapper around ``requests.request`` which assigns a max_age parameter as instance variable for later retrieval
+    """
+
+    max_age: Optional[datetime] = None
+
+    def __call__(self, *args: Any, **kwargs: Any) -> requests.Response:
+        now = datetime.now(timezone.utc)
+        response = requests.request(*args, **kwargs)
+
+        # extract Cache-Control header and save its value for later
+        cache_control = response.headers.get("Cache-Control")
+        if cache_control and "max-age" in cache_control:
+            http_max_age = int(cache_control.split("max-age=")[1].split(",")[0])
+            self.max_age = now + timedelta(seconds=http_max_age)
+
+        return response
+
+
+def fetch_jwks_max_age(jwks_uri: str) -> Tuple[List[JWK], Optional[datetime]]:
+    """
+    Fetch JSON web keys from the given jwks_uri.
+    This uri is part of the provider configuration and used to validate responses and tokens sent by the provider.
+
+    :raises OpenidProtocolError: If fetching the keys fails
+    """
+    httpc = _Httpc()
+    bundle = KeyBundle(source=jwks_uri, httpc=httpc)
+    keys = cast(List[JWK], bundle.keys())
+    if not keys:
+        raise OpenidProtocolError("Failed to fetch keys")
+    return keys, httpc.max_age
+
+
+def fetch_jwks(jwks_uri: str) -> List[JWK]:
+    """
+    Fetch JSON web keys from the given jwks_uri.
+    This uri is part of the provider configuration and used to validate responses and tokens sent by the provider.
+
+    :raises OpenidProtocolError: If fetching the keys fails
+    """
+    keys, _ = fetch_jwks_max_age(jwks_uri)
+    return keys

{simple_openid_connect-2.3.2 → simple_openid_connect-2.4.0}/tests/conftest.py

@@ -65,7 +65,7 @@ def known_provider_configs(response_mock):
     """
     Mock requests to known OpenID provider config URLs to return static content
     """
-    # mafiasi identity
+    # mafiasi identity (keycloak)
     response_mock.get(
         url="https://identity.mafiasi.de/auth/realms/simple_openid_test/.well-known/openid-configuration",
         content_type="application/json",
@@ -77,6 +77,18 @@ def known_provider_configs(response_mock):
         body='{"keys":[{"kid":"JAehgk0O0uzTEht7KGCPVB_urwfsBGe22phHVDZezeo","kty":"RSA","alg":"RS256","use":"sig","n":"n1t4R6mVlBZggtmEM5HohZYg5QjLtjlRVyAMMM93H4WRPpP2Xqj3RrGwP-LZr6lQhk6w8nvPNGnFujWtXb_dBrhZDBh2z0mCNvfjJMp5Ki5sLT9nCbuZ4NkIhfx7qTzQ--GomQ6uKOSuoE12A_r9UopwuCf_1zrx0MIqN_kMeYU2px5yJW-5qbwPL9hcWcfY_Pdz5SFcQ3kDi6GlXA0PN74Ivhs9baVIv60cwB0TytQXGn__GYFZ-K5qAjIymyIy8cPRy9N27Gs29cWF-C56n1pAxwkcPY1SAQgcrspIhntQbZBeGboUx2pnQ_v8LEqVt9ahh52eAbV36YoQqu1DbQ","e":"AQAB","x5c":["MIICszCCAZsCBgGEZpqrijANBgkqhkiG9w0BAQsFADAdMRswGQYDVQQDDBJzaW1wbGVfb3BlbmlkX3Rlc3QwHhcNMjIxMTExMTIxMDIzWhcNMzIxMTExMTIxMjAzWjAdMRswGQYDVQQDDBJzaW1wbGVfb3BlbmlkX3Rlc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCfW3hHqZWUFmCC2YQzkeiFliDlCMu2OVFXIAwwz3cfhZE+k/ZeqPdGsbA/4tmvqVCGTrDye880acW6Na1dv90GuFkMGHbPSYI29+MkynkqLmwtP2cJu5ng2QiF/HupPND74aiZDq4o5K6gTXYD+v1SinC4J//XOvHQwio3+Qx5hTanHnIlb7mpvA8v2FxZx9j893PlIVxDeQOLoaVcDQ83vgi+Gz1tpUi/rRzAHRPK1Bcaf/8ZgVn4rmoCMjKbIjLxw9HL03bsazb1xYX4LnqfWkDHCRw9jVIBCByuykiGe1BtkF4ZuhTHamdD+/wsSpW31qGHnZ4BtXfpihCq7UNtAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAD3aKq2xiLNPlUcmxwtR1FihkEM+NM7VV+m+74Lf9m/lhNzuM00JZAW67gIz2kO5K4XaU84PCRzt3sELma/xVoBs3iW8AhtldTax17g0NZzpMEExzYi0vyihq8xihbx+8XrVwxQ3JBkb/y3b+otDX3xRxBKSCDuxuigL1bX7UzgJ3oe4wD6m8yN7nrMdqSMbspd8lkceKNPziclXnbKPIUwrnxdWMmB41zYcT3y+zHxqk6EDkf3NU+C3gCoRCQoBKcK4X2dwZdUbv0ginU9kROjNXc2+gP53CYDT4fqOEX/jBuljbYb9ziaQ9/5kJZ9SsazgWNjpf4VvhAsH64i7+dE="],"x5t":"PxLqu4M4uNWaUhbfkvI0tGrkhtQ","x5t#S256":"OWVSYSSNFaLyfxV0Lg6XyVDnB2t6sHwtNbzVB2fNCVc"}]}',
     )
 
+    # hanse.de (authentik)
+    response_mock.get(
+        url="https://auth.hanse.de/application/o/git/.well-known/openid-configuration",
+        content_type="application/json",
+        body='{"issuer":"https://auth.hanse.de/application/o/git/","authorization_endpoint":"https://auth.hanse.de/application/o/authorize/","token_endpoint":"https://auth.hanse.de/application/o/token/","userinfo_endpoint":"https://auth.hanse.de/application/o/userinfo/","end_session_endpoint":"https://auth.hanse.de/application/o/git/end-session/","introspection_endpoint":"https://auth.hanse.de/application/o/introspect/","revocation_endpoint":"https://auth.hanse.de/application/o/revoke/","device_authorization_endpoint":"https://auth.hanse.de/application/o/device/","backchannel_logout_supported":true,"backchannel_logout_session_supported":true,"response_types_supported":["code","id_token","id_token token","code token","code id_token","code id_token token"],"response_modes_supported":["query","fragment","form_post"],"jwks_uri":"https://auth.hanse.de/application/o/git/jwks/","grant_types_supported":["authorization_code","refresh_token","implicit","client_credentials","password","urn:ietf:params:oauth:grant-type:device_code"],"id_token_signing_alg_values_supported":["RS256"],"subject_types_supported":["public"],"token_endpoint_auth_methods_supported":["client_secret_post","client_secret_basic"],"acr_values_supported":["goauthentik.io/providers/oauth2/default"],"scopes_supported":["email","profile","offline_access","openid"],"request_parameter_supported":false,"claims_supported":["sub","iss","aud","exp","iat","auth_time","acr","amr","nonce","email","email_verified","name","given_name","preferred_username","nickname","groups"],"claims_parameter_supported":false,"code_challenge_methods_supported":["plain","S256"]}',
+    )
+    response_mock.get(
+        url="https://auth.hanse.de/application/o/git/jwks/",
+        content_type="application/json",
+        body='{"keys":[{"alg":"RS256","kid":"25bfaaaa8e5aed3a44d130d66ac81022","kty":"RSA","use":"sig","n":"tpOexiJZfPHxl3GOiQJCCmkM9GVkG7R-DUYwUYTuTDnGR0XClAD3HRWe7yW-Lzurk8kBH6OjfLU3aYhQAhjWBblvmTSXcIDRRkckHwYj-M4b59wxZW26rdSuI0FzUrJOEOMpNtm_HzxvdUyWYQQXYl7P9BNuJtTT0AG3Od-VC7hZMSLU_42cRxo3XTzbqpFfJlF1TRtjDh7_RB8oofohGF2LRKB-iP3wrRFO2_erLJI5rbxPUBiVhDisPau0R9kvIC-BbcL_RBHfZyZgl78PkWEDaRXCZ8JtweHnoMWZw4-6sIQHDcbigz6UFVlngcaV3aktPNobLZyJcAR4K_Xfz_FA135HOXpqzsS064TuksOj8TnklMHoz4k-Y7Q8FZFvFgJw_R4fxOG23IMfzWHmAEt8qhrcLfd_kZCP2dUbmH_z984NZ0Y34fZRSP7m5CMxGFzOFpueSjCBWRpgzifpEP4LBVZ1PyP5a06xHf_87imXdZ6oYgBcGBVmmsM9lSJhR4-XYuyz6sHvIXnMSRMw7LG6hqfh2fKUnRQIzcP_ldU6nQdTzA0cRcsYJ7HnoWCJj78uPo5vLVTjz3eoQuk8z5Beyce43SdkUH1kHbaobI8uxuwOcMnQVnRge3YFIpZR3SO5UPjSyjNhDFfuz2jt5idQT9cKX1vLFo6BtUf_1J8","e":"AQAB","x5c":["MIIFUzCCAzugAwIBAgIQX/aqWMV4Rf27MyUo/KcDYDANBgkqhkiG9w0BAQsFADAeMRwwGgYDVQQDDBNhdXRoZW50aWsgMjAyNS4xMC4wMB4XDTI1MTAyOTIzMjQ0M1oXDTI2MTAzMDIzMjQ0M1owVjEqMCgGA1UEAwwhYXV0aGVudGlrIFNlbGYtc2lnbmVkIENlcnRpZmljYXRlMRIwEAYDVQQKDAlhdXRoZW50aWsxFDASBgNVBAsMC1NlbGYtc2lnbmVkMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAtpOexiJZfPHxl3GOiQJCCmkM9GVkG7R+DUYwUYTuTDnGR0XClAD3HRWe7yW+Lzurk8kBH6OjfLU3aYhQAhjWBblvmTSXcIDRRkckHwYj+M4b59wxZW26rdSuI0FzUrJOEOMpNtm/HzxvdUyWYQQXYl7P9BNuJtTT0AG3Od+VC7hZMSLU/42cRxo3XTzbqpFfJlF1TRtjDh7/RB8oofohGF2LRKB+iP3wrRFO2/erLJI5rbxPUBiVhDisPau0R9kvIC+BbcL/RBHfZyZgl78PkWEDaRXCZ8JtweHnoMWZw4+6sIQHDcbigz6UFVlngcaV3aktPNobLZyJcAR4K/Xfz/FA135HOXpqzsS064TuksOj8TnklMHoz4k+Y7Q8FZFvFgJw/R4fxOG23IMfzWHmAEt8qhrcLfd/kZCP2dUbmH/z984NZ0Y34fZRSP7m5CMxGFzOFpueSjCBWRpgzifpEP4LBVZ1PyP5a06xHf/87imXdZ6oYgBcGBVmmsM9lSJhR4+XYuyz6sHvIXnMSRMw7LG6hqfh2fKUnRQIzcP/ldU6nQdTzA0cRcsYJ7HnoWCJj78uPo5vLVTjz3eoQuk8z5Beyce43SdkUH1kHbaobI8uxuwOcMnQVnRge3YFIpZR3SO5UPjSyjNhDFfuz2jt5idQT9cKX1vLFo6BtUf/1J8CAwEAAaNVMFMwUQYDVR0RAQH/BEcwRYJDUm5RNjFyUnZGUm1rU1d2b2tuVWFHMVlmWHIyQ0xzcEt6Mmw4UVdodC5zZWxmLXNpZ25lZC5nb2F1dGhlbnRpay5pbzANBgkqhkiG9w0BAQsFAAOCAgEAEa+ERlfh5DxgWtGa0U2WA7E+TcoF12ZsXfO0NOIMPZ/o9Pqou1Huc21Azzyh0dMAbJEuFVFmnqNLwqvjB6iK25Gk3pJakaN9iYvzhmAsb9eYLfGmOD6Bk9fHO6chEgVCxNtPja0ROV8SaEA/r8xT7pfpPJBnbjxgQjg1UDeszv8FXij0oct9tojkDPnMWJBv0m4SfZL33Vm093P9aEGLivfi/fAbjoA1nnOF+KOyoXGMN28qXUnYuc7ekjwaCAKIfkG/b06oaH6+0qV9Fl/58HMegoqPuJTEDrueM5hNKoLDhcb/unXyko1Cd/BRIID4uvmDhZl6P3HWo/lV9qW1lZwl2Dc63Hmq0XD1Vp6m8eBdT+yjXphwcsTadfVsKnVRbc+OZ27cMY2b/FHZ6kHE/qUUk+y11BrcVFx5uzF3gkCy5JmXnzB2249fJ/ixajRGyNZVt1rt8ItYwyRUpkzaSvhsl+1N+beRVm4rUFSNbOSCNq3/4NWmNhv+kvE9bS9w/vXZpkhlKRBUgCg8hZBdVSdloO4aJPCwKOgf/C2F7KtIqmj3vIxmQ9d6yD1OXGExtLHtBlE1g5n7N1At85YLFpeJAGqMwpZH430YKAoDuVf/+C5uSzLiAsubXW8d5gt7FTemJopu8/mmLswwC3eOuCRlIg49X76SOKOjRTJVRXA="],"x5t":"B6EFPg14J2vLHlggZg2c_4d5uxE","x5t#S256":"9FYLuDimrcpGF9RbZw7JNWZzoMElCaM7Yg8J7yf_FtI"}]}',
+    )
+
     # google
     response_mock.get(
         "https://accounts.google.com/.well-known/openid-configuration",
@@ -102,12 +114,23 @@ def dummy_provider_config(jwks, response_mock):
             id_token_signing_alg_values_supported=["RS256"],
         ).model_dump(exclude_defaults=True),
     )
+
     response_mock.get(
         url="https://provider.example.com/jwks",
         body=jwks.jwks(),
         content_type="application/json",
     )
 
+    response_mock.get(
+        url="https://provider.example.com/jwks-with-expiry",
+        body=jwks.jwks(),
+        content_type="application/json",
+        headers={
+            # 60 second expiry with some other directives around that need to be stripped out
+            "Cache-Control": "no-transform, max-age=60, public",
+        },
+    )
+
 
 @pytest.fixture
 def dummy_auth_response(response_mock):

{simple_openid_connect-2.3.2 → simple_openid_connect-2.4.0}/tests/test_client.py

@@ -102,9 +102,16 @@ def test_token_introspection(dummy_provider_config, dummy_token_introspection_re
 
 
 def test_pickling(dummy_provider_config):
-    # arrange
+    # arrange (make client and ensure provider JWKs is fetched)
     client = make_client()
+    _ = client.provider_keys
+    assert client._provider_keys is not None
 
     # act (assert not throwing)
     enc = pickle.dumps(client)
-    _ = pickle.loads(enc)
+    client2 = pickle.loads(enc)
+
+    # assert provider key equality
+    assert client._provider_keys is not None
+    assert client2._provider_keys is not None
+    assert client._provider_keys == client2._provider_keys

simple_openid_connect-2.4.0/tests/test_jwk.py

@@ -0,0 +1,47 @@
+from datetime import datetime, timezone
+
+from freezegun import freeze_time
+from cryptojwt import JWK
+
+from simple_openid_connect.jwk import fetch_jwks, fetch_jwks_max_age
+
+
+def test_load_mafiasi_jwks(known_provider_configs):
+    keys = fetch_jwks(
+        "https://identity.mafiasi.de/auth/realms/simple_openid_test/protocol/openid-connect/certs"
+    )
+    assert all(isinstance(k, JWK) for k in keys)
+    assert len(keys) == 1
+    assert keys[0].kid == "JAehgk0O0uzTEht7KGCPVB_urwfsBGe22phHVDZezeo"
+
+
+def test_load_hanse_jwks(known_provider_configs):
+    keys = fetch_jwks("https://auth.hanse.de/application/o/git/jwks/")
+    assert all(isinstance(k, JWK) for k in keys)
+    assert len(keys) == 1
+    assert keys[0].kid == "25bfaaaa8e5aed3a44d130d66ac81022"
+
+
+def test_load_dummy_jwks(dummy_provider_config):
+    keys = fetch_jwks("https://provider.example.com/jwks")
+    assert all(isinstance(k, JWK) for k in keys)
+    assert len(keys) == 1
+
+
+def test_load_dummy_jwks_max_age_without_cache_header(dummy_provider_config):
+    keys, max_age = fetch_jwks_max_age("https://provider.example.com/jwks")
+    assert all(isinstance(k, JWK) for k in keys)
+    assert len(keys) == 1
+    assert max_age is None
+
+
+@freeze_time("2026-01-01T00:00:00")
+def test_load_dummy_jwks_max_age_with_cache_header(dummy_provider_config):
+    keys, max_age = fetch_jwks_max_age(
+        "https://provider.example.com/jwks-with-expiry"
+    )  # returns a 60 second Cache-Control header
+    assert all(isinstance(k, JWK) for k in keys)
+    assert len(keys) == 1
+    assert max_age == datetime(
+        year=2026, month=1, day=1, hour=0, minute=1, second=0, tzinfo=timezone.utc
+    )

simple_openid_connect-2.3.2/src/simple_openid_connect/jwk.py

@@ -1,23 +0,0 @@
-"""
-JSON-Web-Key handling code
-"""
-
-from typing import List, cast
-
-from cryptojwt import JWK, KeyBundle
-
-from simple_openid_connect.exceptions import OpenidProtocolError
-
-
-def fetch_jwks(jwks_uri: str) -> List[JWK]:
-    """
-    Fetch JSON web keys from the given jwks_uri.
-    This uri is part of the provider configuration and used to validate responses and tokens sent by the provider.
-
-    :raises OpenidProtocolError: If fetching the keys fails
-    """
-    bundle = KeyBundle(source=jwks_uri)
-    keys = cast(List[JWK], bundle.keys())
-    if not keys:
-        raise OpenidProtocolError("Failed to fetch keys")
-    return keys

simple_openid_connect-2.3.2/tests/test_jwk.py

@@ -1,18 +0,0 @@
-from cryptojwt import JWK
-
-from simple_openid_connect.jwk import fetch_jwks
-
-
-def test_load_mafiasi_jwks(known_provider_configs):
-    keys = fetch_jwks(
-        "https://identity.mafiasi.de/auth/realms/simple_openid_test/protocol/openid-connect/certs"
-    )
-    assert all(isinstance(k, JWK) for k in keys)
-    assert len(keys) == 1
-    assert keys[0].kid == "JAehgk0O0uzTEht7KGCPVB_urwfsBGe22phHVDZezeo"
-
-
-def test_load_dummy_jwks(dummy_provider_config):
-    keys = fetch_jwks("https://provider.example.com/jwks")
-    assert all(isinstance(k, JWK) for k in keys)
-    assert len(keys) == 1