3 ,î[`ã@s:dZddlmZmZddlZejeƒZGdd„deƒZ dS)zJ oauthlib.oauth2.rfc6749.grant_types ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ é)Úabsolute_importÚunicode_literalsNc@säeZdZdd„Zdd„Zdd„Zdd„Zd d „Zdd„Zd d„Z dd„Z dd„Zdd„Zdd„Z dd„Zdd„Zdd„Zdd„Zdd „Zd!d"„Zd#d$„Zd%d&„Zd'd(„Zd)d*„Zd+d,„Zd-d.„Zd/d0„Zd1d2„Zd3d4„Zd5d6„Zd7S)8ÚRequestValidatorcOsdS)aDetermine if client authentication is required for current request. According to the rfc6749, client authentication is required in the following cases: - Resource Owner Password Credentials Grant, when Client type is Confidential or when Client was issued client credentials or whenever Client provided client authentication, see `Section 4.3.2`_. - Authorization Code Grant, when Client type is Confidential or when Client was issued client credentials or whenever Client provided client authentication, see `Section 4.1.3`_. - Refresh Token Grant, when Client type is Confidential or when Client was issued client credentials or whenever Client provided client authentication, see `Section 6`_ :param request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant - Resource Owner Password Credentials Grant - Refresh Token Grant .. _`Section 4.3.2`: https://tools.ietf.org/html/rfc6749#section-4.3.2 .. _`Section 4.1.3`: https://tools.ietf.org/html/rfc6749#section-4.1.3 .. _`Section 6`: https://tools.ietf.org/html/rfc6749#section-6 T©)ÚselfÚrequestÚargsÚkwargsrrú'/usr/lib/python3.6/request_validator.pyÚclient_authentication_requiredsz/RequestValidator.client_authentication_requiredcOstdƒ‚dS)aQAuthenticate client through means outside the OAuth 2 spec. Means of authentication is negotiated beforehand and may for example be `HTTP Basic Authentication Scheme`_ which utilizes the Authorization header. Headers may be accesses through request.headers and parameters found in both body and query can be obtained by direct attribute access, i.e. request.client_id for client_id in the URL query. :param request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant - Resource Owner Password Credentials Grant (may be disabled) - Client Credentials Grant - Refresh Token Grant .. _`HTTP Basic Authentication Scheme`: https://tools.ietf.org/html/rfc1945#section-11.1 z&Subclasses must implement this method.N)ÚNotImplementedError)rrrr rrr Úauthenticate_client+sz$RequestValidator.authenticate_clientcOstdƒ‚dS)aEnsure client_id belong to a non-confidential client. A non-confidential client is one that is not required to authenticate through other means, such as using HTTP Basic. Note, while not strictly necessary it can often be very convenient to set request.client to the client object associated with the given client_id. :param request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant z&Subclasses must implement this method.N)r)rÚ client_idrrr rrr Úauthenticate_client_idCsz'RequestValidator.authenticate_client_idcOstdƒ‚dS)aeEnsure that the authorization process represented by this authorization code began with this 'redirect_uri'. If the client specifies a redirect_uri when obtaining code then that redirect URI must be bound to the code and verified equal in this method, according to RFC 6749 section 4.1.3. Do not compare against the client's allowed redirect URIs, but against the URI used when the code was saved. :param client_id: Unicode client identifier :param code: Unicode authorization_code. :param redirect_uri: Unicode absolute URI :param client: Client object set by you, see authenticate_client. :param request: The HTTP Request (oauthlib.common.Request) :rtype: True or False Method is used by: - Authorization Code Grant (during token request) z&Subclasses must implement this method.N)r)rrÚcodeÚredirect_uriÚclientrrr rrr Úconfirm_redirect_uriUsz%RequestValidator.confirm_redirect_uricOstdƒ‚dS)aEGet the default redirect URI for the client. :param client_id: Unicode client identifier :param request: The HTTP Request (oauthlib.common.Request) :rtype: The default redirect URI for the client Method is used by: - Authorization Code Grant - Implicit Grant z&Subclasses must implement this method.N)r)rrrrr rrr Úget_default_redirect_urilsz)RequestValidator.get_default_redirect_uricOstdƒ‚dS)a¢Get the default scopes for the client. :param client_id: Unicode client identifier :param request: The HTTP Request (oauthlib.common.Request) :rtype: List of default scopes Method is used by all core grant types: - Authorization Code Grant - Implicit Grant - Resource Owner Password Credentials Grant - Client Credentials grant z&Subclasses must implement this method.N)r)rrrrr rrr Úget_default_scopesys z#RequestValidator.get_default_scopescOstdƒ‚dS)aGet the list of scopes associated with the refresh token. :param refresh_token: Unicode refresh token :param request: The HTTP Request (oauthlib.common.Request) :rtype: List of scopes. Method is used by: - Refresh token grant z&Subclasses must implement this method.N)r)rÚ refresh_tokenrrr rrr Úget_original_scopesˆs z$RequestValidator.get_original_scopescOsdS)a7Check if requested scopes are within a scope of the refresh token. When access tokens are refreshed the scope of the new token needs to be within the scope of the original token. This is ensured by checking that all requested scopes strings are on the list returned by the get_original_scopes. If this check fails, is_within_original_scope is called. The method can be used in situations where returning all valid scopes from the get_original_scopes is not practical. :param request_scopes: A list of scopes that were requested by client :param refresh_token: Unicode refresh_token :param request: The HTTP Request (oauthlib.common.Request) :rtype: True or False Method is used by: - Refresh token grant Fr)rZrequest_scopesrrrr rrr Úis_within_original_scope”sz)RequestValidator.is_within_original_scopecOstdƒ‚dS)a1Invalidate an authorization code after use. :param client_id: Unicode client identifier :param code: The authorization code grant (request.code). :param request: The HTTP Request (oauthlib.common.Request) Method is used by: - Authorization Code Grant z&Subclasses must implement this method.N)r)rrrrrr rrr Úinvalidate_authorization_code©s z.RequestValidator.invalidate_authorization_codecOstdƒ‚dS)aRevoke an access or refresh token. :param token: The token string. :param token_type_hint: access_token or refresh_token. :param request: The HTTP Request (oauthlib.common.Request) Method is used by: - Revocation Endpoint z&Subclasses must implement this method.N)r)rÚtokenZtoken_type_hintrrr rrr Úrevoke_tokenµs zRequestValidator.revoke_tokencCsdS)aŽDetermine whether to rotate the refresh token. Default, yes. When access tokens are refreshed the old refresh token can be kept or replaced with a new one (rotated). Return True to rotate and and False for keeping original. :param request: oauthlib.common.Request :rtype: True or False Method is used by: - Refresh Token Grant Tr)rrrrr Úrotate_refresh_tokenÁs z%RequestValidator.rotate_refresh_tokencOstdƒ‚dS)aóPersist the authorization_code. The code should at minimum be stored with: - the client_id (client_id) - the redirect URI used (request.redirect_uri) - a resource owner / user (request.user) - the authorized scopes (request.scopes) - the client state, if given (code.get('state')) The 'code' argument is actually a dictionary, containing at least a 'code' key with the actual authorization code: {'code': 'sdf345jsdf0934f'} It may also have a 'state' key containing a nonce for the client, if it chose to send one. That value should be saved and used in 'validate_code'. It may also have a 'claims' parameter which, when present, will be a dict deserialized from JSON as described at http://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter This value should be saved in this method and used again in 'validate_code'. :param client_id: Unicode client identifier :param code: A dict of the authorization code grant and, optionally, state. :param request: The HTTP Request (oauthlib.common.Request) Method is used by: - Authorization Code Grant z&Subclasses must implement this method.N)r)rrrrrr rrr Úsave_authorization_codeÐsz(RequestValidator.save_authorization_codecOs|j||f|ž|ŽS)zvPersist the token with a token type specific method. Currently, only save_bearer_token is supported. )Úsave_bearer_token)rrrrr rrr Ú save_tokenñszRequestValidator.save_tokencOstdƒ‚dS)aÎPersist the Bearer token. The Bearer token should at minimum be associated with: - a client and it's client_id, if available - a resource owner / user (request.user) - authorized scopes (request.scopes) - an expiration time - a refresh token, if issued - a claims document, if present in request.claims The Bearer token dict may hold a number of items:: { 'token_type': 'Bearer', 'access_token': 'askfjh234as9sd8', 'expires_in': 3600, 'scope': 'string of space separated authorized scopes', 'refresh_token': '23sdf876234', # if issued 'state': 'given_by_client', # if supplied by client } Note that while "scope" is a string-separated list of authorized scopes, the original list is still available in request.scopes Also note that if an Authorization Code grant request included a valid claims parameter (for OpenID Connect) then the request.claims property will contain the claims dict, which should be saved for later use when generating the id_token and/or UserInfo response content. :param client_id: Unicode client identifier :param token: A Bearer token dict :param request: The HTTP Request (oauthlib.common.Request) :rtype: The default redirect URI for the client Method is used by all core grant types issuing Bearer tokens: - Authorization Code Grant - Implicit Grant - Resource Owner Password Credentials Grant (might not associate a client) - Client Credentials grant z&Subclasses must implement this method.N)r)rrrrr rrr røs)z"RequestValidator.save_bearer_tokencCstdƒ‚dS)aä In the OpenID Connect workflows when an ID Token is requested this method is called. Subclasses should implement the construction, signing and optional encryption of the ID Token as described in the OpenID Connect spec. In addition to the standard OAuth2 request properties, the request may also contain these OIDC specific properties which are useful to this method: - nonce, if workflow is implicit or hybrid and it was provided - claims, if provided to the original Authorization Code request The token parameter is a dict which may contain an ``access_token`` entry, in which case the resulting ID Token *should* include a calculated ``at_hash`` claim. Similarly, when the request parameter has a ``code`` property defined, the ID Token *should* include a calculated ``c_hash`` claim. http://openid.net/specs/openid-connect-core-1_0.html (sections `3.1.3.6`_, `3.2.2.10`_, `3.3.2.11`_) .. _`3.1.3.6`: http://openid.net/specs/openid-connect-core-1_0.html#CodeIDToken .. _`3.2.2.10`: http://openid.net/specs/openid-connect-core-1_0.html#ImplicitIDToken .. _`3.3.2.11`: http://openid.net/specs/openid-connect-core-1_0.html#HybridIDToken :param token: A Bearer token dict :param token_handler: the token handler (BearerToken class) :param request: the HTTP Request (oauthlib.common.Request) :return: The ID Token (a JWS signed JWT) z&Subclasses must implement this method.N)r)rrZ token_handlerrrrr Úget_id_token#szRequestValidator.get_id_tokencCstdƒ‚dS)aA Ensure the Bearer token is valid and authorized access to scopes. :param token: A string of random characters. :param scopes: A list of scopes associated with the protected resource. :param request: The HTTP Request (oauthlib.common.Request) A key to OAuth 2 security and restricting impact of leaked tokens is the short expiration time of tokens, *always ensure the token has not expired!*. Two different approaches to scope validation: 1) all(scopes). The token must be authorized access to all scopes associated with the resource. For example, the token has access to ``read-only`` and ``images``, thus the client can view images but not upload new. Allows for fine grained access control through combining various scopes. 2) any(scopes). The token must be authorized access to one of the scopes associated with the resource. For example, token has access to ``read-only-images``. Allows for fine grained, although arguably less convenient, access control. A powerful way to use scopes would mimic UNIX ACLs and see a scope as a group with certain privileges. For a restful API these might map to HTTP verbs instead of read, write and execute. Note, the request.user attribute can be set to the resource owner associated with this token. Similarly the request.client and request.scopes attribute can be set to associated client object and authorized scopes. If you then use a decorator such as the one provided for django these attributes will be made available in all protected views as keyword arguments. :param token: Unicode Bearer token :param scopes: List of scopes (defined by you) :param request: The HTTP Request (oauthlib.common.Request) :rtype: True or False Method is indirectly used by all core Bearer token issuing grant types: - Authorization Code Grant - Implicit Grant - Resource Owner Password Credentials Grant - Client Credentials Grant z&Subclasses must implement this method.N)r)rrÚscopesrrrr Úvalidate_bearer_tokenCs0z&RequestValidator.validate_bearer_tokencOstdƒ‚dS)a™Ensure client_id belong to a valid and active client. Note, while not strictly necessary it can often be very convenient to set request.client to the client object associated with the given client_id. :param request: oauthlib.common.Request :rtype: True or False Method is used by: - Authorization Code Grant - Implicit Grant z&Subclasses must implement this method.N)r)rrrrr rrr Úvalidate_client_idusz#RequestValidator.validate_client_idcOstdƒ‚dS)a¾Verify that the authorization_code is valid and assigned to the given client. Before returning true, set the following based on the information stored with the code in 'save_authorization_code': - request.user - request.state (if given) - request.scopes - request.claims (if given) OBS! The request.user attribute should be set to the resource owner associated with this authorization code. Similarly request.scopes must also be set. The request.claims property, if it was given, should assigned a dict. :param client_id: Unicode client identifier :param code: Unicode authorization code :param client: Client object set by you, see authenticate_client. :param request: The HTTP Request (oauthlib.common.Request) :rtype: True or False Method is used by: - Authorization Code Grant z&Subclasses must implement this method.N)r)rrrrrrr rrr Ú validate_code…szRequestValidator.validate_codecOstdƒ‚dS)a;Ensure client is authorized to use the grant_type requested. :param client_id: Unicode client identifier :param grant_type: Unicode grant type, i.e. authorization_code, password. :param client: Client object set by you, see authenticate_client. :param request: The HTTP Request (oauthlib.common.Request) :rtype: True or False Method is used by: - Authorization Code Grant - Resource Owner Password Credentials Grant - Client Credentials Grant - Refresh Token Grant z&Subclasses must implement this method.N)r)rrZ grant_typerrrr rrr Úvalidate_grant_type¡sz$RequestValidator.validate_grant_typecOstdƒ‚dS)aEnsure client is authorized to redirect to the redirect_uri requested. All clients should register the absolute URIs of all URIs they intend to redirect to. The registration is outside of the scope of oauthlib. :param client_id: Unicode client identifier :param redirect_uri: Unicode absolute URI :param request: The HTTP Request (oauthlib.common.Request) :rtype: True or False Method is used by: - Authorization Code Grant - Implicit Grant z&Subclasses must implement this method.N)r)rrrrrr rrr Úvalidate_redirect_uri²sz&RequestValidator.validate_redirect_uricOstdƒ‚dS)ayEnsure the Bearer token is valid and authorized access to scopes. OBS! The request.user attribute should be set to the resource owner associated with this refresh token. :param refresh_token: Unicode refresh token :param client: Client object set by you, see authenticate_client. :param request: The HTTP Request (oauthlib.common.Request) :rtype: True or False Method is used by: - Authorization Code Grant (indirectly by issuing refresh tokens) - Resource Owner Password Credentials Grant (also indirectly) - Refresh Token Grant z&Subclasses must implement this method.N)r)rrrrrr rrr Úvalidate_refresh_tokenÃsz'RequestValidator.validate_refresh_tokencOstdƒ‚dS)aÏEnsure client is authorized to use the response_type requested. :param client_id: Unicode client identifier :param response_type: Unicode response type, i.e. code, token. :param client: Client object set by you, see authenticate_client. :param request: The HTTP Request (oauthlib.common.Request) :rtype: True or False Method is used by: - Authorization Code Grant - Implicit Grant z&Subclasses must implement this method.N)r)rrZ response_typerrrr rrr Úvalidate_response_typeÕs z'RequestValidator.validate_response_typecOstdƒ‚dS)a/Ensure the client is authorized access to requested scopes. :param client_id: Unicode client identifier :param scopes: List of scopes (defined by you) :param client: Client object set by you, see authenticate_client. :param request: The HTTP Request (oauthlib.common.Request) :rtype: True or False Method is used by all core grant types: - Authorization Code Grant - Implicit Grant - Resource Owner Password Credentials Grant - Client Credentials Grant z&Subclasses must implement this method.N)r)rrr!rrrr rrr Úvalidate_scopesäsz RequestValidator.validate_scopescCstdƒ‚dS)aÇEnsure the logged in user has authorized silent OpenID authorization. Silent OpenID authorization allows access tokens and id tokens to be granted to clients without any user prompt or interaction. :param request: The HTTP Request (oauthlib.common.Request) :rtype: True or False Method is used by: - OpenIDConnectAuthCode - OpenIDConnectImplicit - OpenIDConnectHybrid z&Subclasses must implement this method.N)r)rrrrr Úvalidate_silent_authorizationõsz.RequestValidator.validate_silent_authorizationcCstdƒ‚dS)aoEnsure session user has authorized silent OpenID login. If no user is logged in or has not authorized silent login, this method should return False. If the user is logged in but associated with multiple accounts and not selected which one to link to the token then this method should raise an oauthlib.oauth2.AccountSelectionRequired error. :param request: The HTTP Request (oauthlib.common.Request) :rtype: True or False Method is used by: - OpenIDConnectAuthCode - OpenIDConnectImplicit - OpenIDConnectHybrid z&Subclasses must implement this method.N)r)rrrrr Úvalidate_silent_loginsz&RequestValidator.validate_silent_logincOstdƒ‚dS)a¯Ensure the username and password is valid. OBS! The validation should also set the user attribute of the request to a valid resource owner, i.e. request.user = username or similar. If not set you will be unable to associate a token with a user in the persistance method used (commonly, save_bearer_token). :param username: Unicode username :param password: Unicode password :param client: Client object set by you, see authenticate_client. :param request: The HTTP Request (oauthlib.common.Request) :rtype: True or False Method is used by: - Resource Owner Password Credentials Grant z&Subclasses must implement this method.N)r)rZusernameZpasswordrrrr rrr Ú validate_userszRequestValidator.validate_usercCstdƒ‚dS)aLEnsure client supplied user id hint matches session user. If the sub claim or id_token_hint is supplied then the session user must match the given ID. :param id_token_hint: User identifier string. :param scopes: List of OAuth 2 scopes and OpenID claims (strings). :param claims: OpenID Connect claims dict. :param request: The HTTP Request (oauthlib.common.Request) :rtype: True or False Method is used by: - OpenIDConnectAuthCode - OpenIDConnectImplicit - OpenIDConnectHybrid z&Subclasses must implement this method.N)r)rZ id_token_hintr!Zclaimsrrrr Úvalidate_user_match,sz$RequestValidator.validate_user_matchN)Ú__name__Ú __module__Ú__qualname__rr rrrrrrrrrrrrr r"r#r$r%r&r'r(r)r*r+r,r-rrrr r s6 !+ 2r) Ú__doc__Z __future__rrZloggingZ getLoggerr.ÚlogÚobjectrrrrr Ús