3
,[aQ @ s d Z ddlmZmZ ddlZddlZddlmZ ddlm Z ddl
m Z m Z ddl
mZmZmZ ddlmZ d Zd
Zd Zd d
iZG dd deZdS )z
oauthlib.oauth2.rfc6749
~~~~~~~~~~~~~~~~~~~~~~~
This module is an implementation of various logic needed
for consuming OAuth 2.0 RFC6749.
)absolute_importunicode_literalsN)generate_token)tokens)InsecureTransportErrorTokenExpiredError)parse_token_responseprepare_token_request prepare_token_revocation_request)is_secure_transportZ auth_headerZquerybodyz Content-Typez!application/x-www-form-urlencodedc @ s e Zd ZdZedddddddddef ddZedd Zdd Z d
d Z
d d
Z d)ddZ d*ddZ
d+ddZd,ddZd-ddZd.dd Zd/d d Zd0d d Zdddedfd!d"Zd#d$ Zd%d& Zd'd( ZdS )1Clienta Base OAuth2 client responsible for access token management.
This class also acts as a generic interface providing methods common to all
client types such as ``prepare_authorization_request`` and
``prepare_token_revocation_request``. The ``prepare_x_request`` methods are
the recommended way of interacting with clients (as opposed to the abstract
prepare uri/body/etc methods). They are recommended over the older set
because they are easier to use (more consistent) and add a few additional
security checks, such as HTTPS and state checking.
Some of these methods require further implementation only provided by the
specific purpose clients such as
:py:class:`oauthlib.oauth2.MobileApplicationClient` and thus you should always
seek to use the client class matching the OAuth workflow you need. For
Python, this is usually :py:class:`oauthlib.oauth2.WebApplicationClient`.
BearerNc
K sn || _ || _|| _|| _|| _|| _|| _|p0i | _| | _| | _ |
| _
| | _ d| _ d| _
d| _| j| j dS )as Initialize a client with commonly used attributes.
:param client_id: Client identifier given by the OAuth provider upon
registration.
:param default_token_placement: Tokens can be supplied in the Authorization
header (default), the URL query component (``query``) or the request
body (``body``).
:param token_type: OAuth 2 token type. Defaults to Bearer. Change this
if you specify the ``access_token`` parameter and know it is of a
different token type, such as a MAC, JWT or SAML token. Can
also be supplied as ``token_type`` inside the ``token`` dict parameter.
:param access_token: An access token (string) used to authenticate
requests to protected resources. Can also be supplied inside the
``token`` dict parameter.
:param refresh_token: A refresh token (string) used to refresh expired
tokens. Can also be supplied inside the ``token`` dict parameter.
:param mac_key: Encryption key used with MAC tokens.
:param mac_algorithm: Hashing algorithm for MAC tokens.
:param token: A dict of token attributes such as ``access_token``,
``token_type`` and ``expires_at``.
:param scope: A list of default scopes to request authorization for.
:param state: A CSRF protection string used during authorization.
:param redirect_url: The redirection endpoint on the client side to which
the user returns after authorization.
:param state_generator: A no argument state generation callable. Defaults
to :py:meth:`oauthlib.common.generate_token`.
N) client_iddefault_token_placement
token_type access_token
refresh_tokenmac_key
mac_algorithmtokenscopestate_generatorstate redirect_urlcode
expires_in _expires_atpopulate_token_attributes)selfr r r r r r r r r r r r kwargs r! /usr/lib/python3.6/base.py__init__3 s 4
zClient.__init__c C s | j | jdS )aO Supported token types and their respective methods
Additional tokens can be supported by extending this dictionary.
The Bearer token spec is stable and safe to use.
The MAC token spec is not yet stable and support for MAC tokens
is experimental and currently matching version 00 of the spec.
)r ZMAC)_add_bearer_token_add_mac_token)r r! r! r" token_typesx s zClient.token_typesc O s t ddS )z,Abstract method used to create request URIs.z*Must be implemented by inheriting classes.N)NotImplementedError)r argsr r! r! r" prepare_request_uri s zClient.prepare_request_uric O s t ddS )z.Abstract method used to create request bodies.z*Must be implemented by inheriting classes.N)r' )r r( r r! r! r" prepare_request_body s zClient.prepare_request_bodyc O s dS )z4Abstract method used to parse redirection responses.Nr! )r r( r r! r! r" parse_request_uri_response s z!Client.parse_request_uri_responseGETc K s t |st |p| j}tdd | jj D }| jj |krLtd| j | j p\| j
j dsftd| j r| j t
j
k rt || jj |||||f|S )ac Add token to the request uri, body or authorization header.
The access token type provides the client with the information
required to successfully utilize the access token to make a protected
resource request (along with type-specific attributes). The client
MUST NOT use an access token if it does not understand the token
type.
For example, the "bearer" token type defined in
[`I-D.ietf-oauth-v2-bearer`_] is utilized by simply including the access
token string in the request:
.. code-block:: http
GET /resource/1 HTTP/1.1
Host: example.com
Authorization: Bearer mF_9.B5f-4.1JqM
while the "mac" token type defined in [`I-D.ietf-oauth-v2-http-mac`_] is
utilized by issuing a MAC key together with the access token which is
used to sign certain components of the HTTP requests:
.. code-block:: http
GET /resource/1 HTTP/1.1
Host: example.com
Authorization: MAC id="h480djs93hd8",
nonce="274312:dj83hs9s",
mac="kDZvddkndxvhGRXZhvuDjEWhGeE="
.. _`I-D.ietf-oauth-v2-bearer`: https://tools.ietf.org/html/rfc6749#section-12.2
.. _`I-D.ietf-oauth-v2-http-mac`: https://tools.ietf.org/html/rfc6749#section-12.2
c s s | ]\}}|j |fV qd S )N)lower).0kvr! r! r" s z#Client.add_token..zUnsupported token type: %sr zMissing access token.)r r r dictr& itemsr r-
ValueErrorr r getr timer )r uri http_methodr headerstoken_placementr Z case_insensitive_token_typesr! r! r" add_token s #
zClient.add_tokenc K s^ t |st |p| j | _|p$| j| _|p0| j| _| j|f| j| j| jd|}|tdfS )a[ Prepare the authorization request.
This is the first step in many OAuth flows in which the user is
redirected to a certain authorization URL. This method adds
required parameters to the authorization URL.
:param authorization_url: Provider authorization endpoint URL.
:param state: CSRF protection string. Will be automatically created if
not provided. The generated state is available via the ``state``
attribute. Clients should verify that the state is unchanged and
present in the authorization response. This verification is done
automatically if using the ``authorization_response`` parameter
with ``prepare_token_request``.
:param redirect_url: Redirect URL to which the user will be returned
after authorization. Must be provided unless previously setup with
the provider. If provided then it must also be provided in the
token request.
:param kwargs: Additional parameters to included in the request.
:returns: The prepared request tuple with (url, headers, body).
) redirect_urir r )r r r r r r r) FORM_ENC_HEADERS)r Zauthorization_urlr r r r Zauth_urlr! r! r" prepare_authorization_request s z$Client.prepare_authorization_requestr= c K sX t |st |p| j}|r*| j||d |p2| j| _| jf || jd|}|t|fS )al Prepare a token creation request.
Note that these requests usually require client authentication, either
by including client_id or a set of provider specific authentication
credentials.
:param token_url: Provider token creation endpoint URL.
:param authorization_response: The full redirection URL string, i.e.
the location to which the user was redirected after successfull
authorization. Used to mine credentials needed to obtain a token
in this step, such as authorization code.
:param redirect_url: The redirect_url supplied with the authorization
request (if there was one).
:param body: Request body (URL encoded string).
:param kwargs: Additional parameters to included in the request.
:returns: The prepared request tuple with (url, headers, body).
)r )r r< )r r r r+ r r* r> )r token_urlZauthorization_responser r r r r! r! r" r s
z Client.prepare_token_requestc K s> t |st |p| j| _| jf ||| jd|}|t|fS )a1 Prepare an access token refresh request.
Expired access tokens can be replaced by new access tokens without
going through the OAuth dance if the client obtained a refresh token.
This refresh token and authentication credentials can be used to
obtain a new access token, and possibly a new refresh token.
:param token_url: Provider token refresh endpoint URL.
:param refresh_token: Refresh token string.
:param body: Request body (URL encoded string).
:param scope: List of scopes to request. Must be equal to
or a subset of the scopes granted when obtaining the refresh
token.
:param kwargs: Additional parameters to included in the request.
:returns: The prepared request tuple with (url, headers, body).
)r r r )r r r prepare_refresh_bodyr> )r r@ r r r r r! r! r" prepare_refresh_token_request s z$Client.prepare_refresh_token_requestr c K s( t |st t||f|||d|S )a, Prepare a token revocation request.
:param revocation_url: Provider token revocation endpoint URL.
:param token: The access or refresh token to be revoked (string).
:param token_type_hint: ``"access_token"`` (default) or
``"refresh_token"``. This is optional and if you wish to not pass it you
must provide ``token_type_hint=None``.
:param callback: A jsonp callback such as ``package.callback`` to be invoked
upon receiving the response. Not that it should not include a () suffix.
:param kwargs: Additional parameters to included in the request.
:returns: The prepared request tuple with (url, headers, body).
Note that JSONP request may use GET requests as the parameters will
be added to the request URL query as opposed to the request body.
An example of a revocation request
.. code-block: http
POST /revoke HTTP/1.1
Host: server.example.com
Content-Type: application/x-www-form-urlencoded
Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
token=45ghiukldjahdnhzdauz&token_type_hint=refresh_token
An example of a jsonp revocation request
.. code-block: http
GET /revoke?token=agabcdefddddafdd&callback=package.myCallback HTTP/1.1
Host: server.example.com
Content-Type: application/x-www-form-urlencoded
Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
and an error response
.. code-block: http
package.myCallback({"error":"unsupported_token_type"});
Note that these requests usually require client credentials, client_id in
the case for public clients and provider specific authentication
credentials for confidential clients.
)token_type_hintr callback)r r r
)r Zrevocation_urlr rC r rD r r! r! r" r
2 s
4
z'Client.prepare_token_revocation_requestc K s t ||d| _| j| j | jS )a Parse the JSON response body.
If the access token request is valid and authorized, the
authorization server issues an access token as described in
`Section 5.1`_. A refresh token SHOULD NOT be included. If the request
failed client authentication or is invalid, the authorization server
returns an error response as described in `Section 5.2`_.
:param body: The response body from the token request.
:param scope: Scopes originally requested.
:return: Dictionary of token parameters.
:raises: Warning if scope has changed. OAuth2Error if response is invalid.
These response are json encoded and could easily be parsed without
the assistance of OAuthLib. However, there are a few subtle issues
to be aware of regarding the response which are helpfully addressed
through the raising of various errors.
A successful response should always contain
**access_token**
The access token issued by the authorization server. Often
a random string.
**token_type**
The type of the token issued as described in `Section 7.1`_.
Commonly ``Bearer``.
While it is not mandated it is recommended that the provider include
**expires_in**
The lifetime in seconds of the access token. For
example, the value "3600" denotes that the access token will
expire in one hour from the time the response was generated.
If omitted, the authorization server SHOULD provide the
expiration time via other means or document the default value.
**scope**
Providers may supply this in all responses but are required to only
if it has changed since the authorization request.
.. _`Section 5.1`: https://tools.ietf.org/html/rfc6749#section-5.1
.. _`Section 5.2`: https://tools.ietf.org/html/rfc6749#section-5.2
.. _`Section 7.1`: https://tools.ietf.org/html/rfc6749#section-7.1
)r )r r r )r r r r r! r! r" parse_request_body_responsem s . z"Client.parse_request_body_responsec K s |p| j }td|||d|S )aa Prepare an access token request, using a refresh token.
If the authorization server issued a refresh token to the client, the
client makes a refresh request to the token endpoint by adding the
following parameters using the "application/x-www-form-urlencoded"
format in the HTTP request entity-body:
grant_type
REQUIRED. Value MUST be set to "refresh_token".
refresh_token
REQUIRED. The refresh token issued to the client.
scope
OPTIONAL. The scope of the access request as described by
Section 3.3. The requested scope MUST NOT include any scope
not originally granted by the resource owner, and if omitted is
treated as equal to the scope originally granted by the
resource owner.
r )r r r )r )r r )r r r r r r! r! r" rA s
zClient.prepare_refresh_bodyc C sZ |t krtj| j|}n8|tkr0tj| j|}n |tkrHtj| j|}ntd|||fS )zDAdd a bearer token to the request uri, body or authorization header.zInvalid token placement.) AUTH_HEADERr Zprepare_bearer_headersr URI_QUERYZprepare_bearer_uriBODYZprepare_bearer_bodyr4 )r r7 r8 r r9 r: r! r! r" r$ s zClient._add_bearer_tokenc K s2 t j| j|| j|f|||| jd|}|||fS )zAdd a MAC token to the request authorization header.
Warning: MAC token support is experimental as the spec is not yet stable.
)r9 r extZhash_algorithm)r Zprepare_mac_headerr r r )r r7 r8 r r9 r: rI r r! r! r" r% s
zClient._add_mac_tokenc C s t jdt | j|S )Nz=Please switch to the public method populate_token_attributes.)warningswarnDeprecationWarningr )r responser! r! r" _populate_attributes s zClient._populate_attributesc C s d|kr|j d| _dS )z2Add attributes from an auth code response to self.r N)r5 r )r rM r! r! r" populate_code_attributes s z Client.populate_code_attributesc C s d|kr|j d| _d|kr(|j d| _d|kr<|j d| _d|krd|j d| _tj t| j | _d|kr|t|j d| _d|kr|j d| _d|kr|j d| _ dS ) z6Add attributes from a token exchange response to self.r r r r Z
expires_atr r N)
r5 r r r r r6 intr r r )r rM r! r! r" r s z Client.populate_token_attributes)r, NNN)NNN)NNNr= )Nr= N)r r= N)N)r= NN)r, NNN)__name__
__module__ __qualname____doc__rF r r# propertyr& r) r* r+ r; r? r rB r
rE rA r$ r% rN rO r r! r! r! r" r
sD :
5
$
$
:
2
r
)rT Z
__future__r r r6 rJ Zoauthlib.commonr Zoauthlib.oauth2.rfc6749r Z oauthlib.oauth2.rfc6749.errorsr r Z"oauthlib.oauth2.rfc6749.parametersr r r
Z oauthlib.oauth2.rfc6749.utilsr rF rG rH r> objectr
r! r! r! r" s