Skip to main content

{{ DESCRIPTION }}

Project description

Oauth2 Flask Service

Build Status

A generic OAuth2 authentication service and user permission manager.

Based off OpenSpending auth service.

Quick start

Clone the repo and install

make install

Run tests

make test

Run server

python server.py

Env Vars

  • PRIVATE_KEY & PUBLIC_KEY an RSA key-pair in PEM format. See tools/generate_key_pair.sh for more info.
  • GOOGLE_KEY & GOOGLE_SECRET: OAuth credentials for authenticating with Google
  • GITHUB_KEY & GITHUB_SECRET: OAuth credentials for authenticating with Github
  • DATABASE_URL: A SQLAlchemy compatible database connection string (where user data is stored)
  • EXTERNAL_ADDRESS: The hostname where this service is located on
  • ALLOWED_SERVICES: Which permissions providers are available. A ; delimited list of provider identifiers. Each provider identifier takes the form of [alias:]provider, where provider is the name of a Python module which exports a get_permissions(service, userid) function.
  • INSTALLED_EXTENSIONS: List of installed extensions. A ; delimited list of extension - the name of a Python modules which exports one or all of these functions
    • on_new_user(user_info)
    • on_user_login(user_info)
    • on_user_logout(user_info)

API

Check an authentication token's validity

/auth/check

Method: GET

Query Parameters:

  • jwt - authentication token
  • next - URL to redirect to when finished authentication

Returns:

If authenticated:

{
    "authenticated": true,
    "profile": {
        "id": "<user-id>",
        "name": "<user-name>",
        "email": "<user-email>",
        "avatar_url": "<url-for-user's-profile-photo>",
        "idhash": "<unique-id-of-the-user>",
        "username": "<user-selected-id>" # If user has a username
    }
}

If not:

{
    "authenticated": false,
    "providers": {
        "google": {
            "url": "<url-for-logging-in-with-the-Google-provider>"
        },
        "github": {
            "url": "<url-for-logging-in-with-the-Github-provider>"
        },
    }
}

When the authentication flow is finished, the caller will be redirected to the next URL with an extra query parameter jwt which contains the authentication token. The caller should cache this token for further interactions with the API.

Get permission for a service

/auth/authorize

Method: GET

Query Parameters:

  • jwt - user token (received from /user/check)
  • service - the relevant service (e.g. storage-service)

Returns:

{
    "token": "<token-for-the-relevant-service>"
    "userid": "<unique-id-of-the-user>",
    "permissions": {
        "permission-x": true,
        "permission-y": false
    },
    "service": "<relevant-service>"
}

Change the username

/auth/update

Method: POST

Query Parameters:

  • jwt - authentication token (received from /user/check)
  • username - A new username for the user profile (this action is only allowed once)

Returns:

{
    "success": true,
    "error": "<error-message-if-applicable>"
}

Note: trying to update other user profile fields like email will fail silently and return

{
    "success": true
}

Receive authorization public key

/auth/public-key

Method: GET

Returns:

The service's public key in PEM format.

Can be used by services to validate that the permission token is authentic.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

dgp-oauth2-1.2.0rc4.tar.gz (81.4 kB view details)

Uploaded Source

Built Distribution

dgp_oauth2-1.2.0rc4-py3-none-any.whl (12.9 kB view details)

Uploaded Python 3

File details

Details for the file dgp-oauth2-1.2.0rc4.tar.gz.

File metadata

  • Download URL: dgp-oauth2-1.2.0rc4.tar.gz
  • Upload date:
  • Size: 81.4 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/4.0.2 CPython/3.10.5

File hashes

Hashes for dgp-oauth2-1.2.0rc4.tar.gz
Algorithm Hash digest
SHA256 e9ce40fb8ef6ed054502d70d2c614a365ea0cbbb35a17430a559b5661b0ac3f1
MD5 a2a1936a1def0806b793e2016768ecb4
BLAKE2b-256 23e90c703b072dbf3581d6cf79daa9ce62ac047eabf474d6ffe599af59e41c84

See more details on using hashes here.

Provenance

File details

Details for the file dgp_oauth2-1.2.0rc4-py3-none-any.whl.

File metadata

File hashes

Hashes for dgp_oauth2-1.2.0rc4-py3-none-any.whl
Algorithm Hash digest
SHA256 7229f9ff8bcc83864813903f368de4075d6ce3f4182ab5cf1cdcd13af407c3b0
MD5 d21c24514ffb1be51d0bf041e51f38a0
BLAKE2b-256 ae3d5e43bd1464bbd33e7fb364024ad9f35a8df98b9010d4ccc7542d9cab67bf

See more details on using hashes here.

Provenance

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page