Skip to main content

{{ DESCRIPTION }}

Project description

Oauth2 Flask Service

Build Status

A generic OAuth2 authentication service and user permission manager.

Based off OpenSpending auth service.

Quick start

Clone the repo and install

make install

Run tests

make test

Run server

python server.py

Env Vars

  • PRIVATE_KEY & PUBLIC_KEY an RSA key-pair in PEM format. See tools/generate_key_pair.sh for more info.
  • GOOGLE_KEY & GOOGLE_SECRET: OAuth credentials for authenticating with Google
  • GITHUB_KEY & GITHUB_SECRET: OAuth credentials for authenticating with Github
  • DATABASE_URL: A SQLAlchemy compatible database connection string (where user data is stored)
  • EXTERNAL_ADDRESS: The hostname where this service is located on
  • ALLOWED_SERVICES: Which permissions providers are available. A ; delimited list of provider identifiers. Each provider identifier takes the form of [alias:]provider, where provider is the name of a Python module which exports a get_permissions(service, userid) function.
  • INSTALLED_EXTENSIONS: List of installed extensions. A ; delimited list of extension - the name of a Python modules which exports one or all of these functions
    • on_new_user(user_info)
    • on_user_login(user_info)
    • on_user_logout(user_info)

API

Check an authentication token's validity

/auth/check

Method: GET

Query Parameters:

  • jwt - authentication token
  • next - URL to redirect to when finished authentication

Returns:

If authenticated:

{
    "authenticated": true,
    "profile": {
        "id": "<user-id>",
        "name": "<user-name>",
        "email": "<user-email>",
        "avatar_url": "<url-for-user's-profile-photo>",
        "idhash": "<unique-id-of-the-user>",
        "username": "<user-selected-id>" # If user has a username
    }
}

If not:

{
    "authenticated": false,
    "providers": {
        "google": {
            "url": "<url-for-logging-in-with-the-Google-provider>"
        },
        "github": {
            "url": "<url-for-logging-in-with-the-Github-provider>"
        },
    }
}

When the authentication flow is finished, the caller will be redirected to the next URL with an extra query parameter jwt which contains the authentication token. The caller should cache this token for further interactions with the API.

Get permission for a service

/auth/authorize

Method: GET

Query Parameters:

  • jwt - user token (received from /user/check)
  • service - the relevant service (e.g. storage-service)

Returns:

{
    "token": "<token-for-the-relevant-service>"
    "userid": "<unique-id-of-the-user>",
    "permissions": {
        "permission-x": true,
        "permission-y": false
    },
    "service": "<relevant-service>"
}

Change the username

/auth/update

Method: POST

Query Parameters:

  • jwt - authentication token (received from /user/check)
  • username - A new username for the user profile (this action is only allowed once)

Returns:

{
    "success": true,
    "error": "<error-message-if-applicable>"
}

Note: trying to update other user profile fields like email will fail silently and return

{
    "success": true
}

Receive authorization public key

/auth/public-key

Method: GET

Returns:

The service's public key in PEM format.

Can be used by services to validate that the permission token is authentic.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

dgp-oauth2-0.2.0.tar.gz (27.7 kB view details)

Uploaded Source

Built Distribution

dgp_oauth2-0.2.0-py3-none-any.whl (11.6 kB view details)

Uploaded Python 3

File details

Details for the file dgp-oauth2-0.2.0.tar.gz.

File metadata

  • Download URL: dgp-oauth2-0.2.0.tar.gz
  • Upload date:
  • Size: 27.7 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/3.2.0 pkginfo/1.5.0.1 requests/2.24.0 setuptools/49.6.0 requests-toolbelt/0.9.1 tqdm/4.49.0 CPython/3.7.8

File hashes

Hashes for dgp-oauth2-0.2.0.tar.gz
Algorithm Hash digest
SHA256 23f041d1a0c5fa11c6752f217d84061d297299d9a6c288ddaa693eac35eb49d3
MD5 9f6d73eb2a29a8960e24148f1e5e88fe
BLAKE2b-256 6d866a767fefb3c9170a947421b3a64f131de818cb64ad60a756e3a0819c4b20

See more details on using hashes here.

Provenance

File details

Details for the file dgp_oauth2-0.2.0-py3-none-any.whl.

File metadata

  • Download URL: dgp_oauth2-0.2.0-py3-none-any.whl
  • Upload date:
  • Size: 11.6 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/3.2.0 pkginfo/1.5.0.1 requests/2.24.0 setuptools/49.6.0 requests-toolbelt/0.9.1 tqdm/4.49.0 CPython/3.7.8

File hashes

Hashes for dgp_oauth2-0.2.0-py3-none-any.whl
Algorithm Hash digest
SHA256 94ba3f5fb40cb0076055f0e685c6003f9f3a66ed52e5860490749f36913eaca7
MD5 2088573bed8f3319794d25b90b94af7e
BLAKE2b-256 6902376f67705aebfd531988808ca98337a30af43cf79552d076d69b2de2cfaa

See more details on using hashes here.

Provenance

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page