Skip to content
This repository was archived by the owner on Jun 1, 2023. It is now read-only.

Commit dee6dcb

Browse files
roherohe
committed
Updated README.md
1 parent e2847a4 commit dee6dcb

3 files changed

Lines changed: 216 additions & 1 deletion

File tree

‎.pytest_cache/v/cache/lastfailed‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
{
2+
"tests/test_20_rp_handler.py::TestRPHandler::()::test_get_accesstoken": true,
3+
"tests/test_20_rp_handler.py::TestRPHandler::()::test_get_userinfo": true
4+
}

‎README.md‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,6 @@
11
# oicrp
2-
Highlevel interface to the OIDC RP library
2+
High level interface to the OIDC RP library
3+
4+
oidcrp represents the 4th layer in the
5+
JWTConnect stack (cryptojwt, oidcmsg, oidcservice, oidcrp)
6+

‎chrp/config.py‎

Lines changed: 207 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,207 @@
1+
# BASE = "https://lingon.ladok.umu.se"
2+
3+
PORT = 8089
4+
5+
# If PORT and not default port
6+
BASEURL = "https://localhost:{}".format(PORT)
7+
# else
8+
# BASEURL = "https://localhost"
9+
10+
# If BASE is https these has to be specified
11+
SERVER_CERT = "certs/cert.pem"
12+
SERVER_KEY = "certs/key.pem"
13+
CA_BUNDLE = None
14+
15+
VERIFY_SSL = False
16+
17+
KEYDEFS = [
18+
{"type": "RSA", "key": '', "use": ["sig"]},
19+
{"type": "EC", "crv": "P-256", "use": ["sig"]}
20+
]
21+
22+
PRIVATE_JWKS_PATH = "jwks_dir/jwks.json"
23+
PUBLIC_JWKS_PATH = 'static/jwks.json'
24+
# information used when registering the client, this may be the same for all OPs
25+
26+
SERVICES = ['ProviderInfoDiscovery', 'Registration', 'Authorization',
27+
'AccessToken', 'RefreshAccessToken', 'UserInfo']
28+
29+
CLIENT_PREFS = {
30+
"application_type": "web",
31+
"application_name": "rphandler",
32+
"contacts": ["ops@example.com"],
33+
"response_types": ["code", "id_token", "id_token token", "code id_token",
34+
"code id_token token", "code token"],
35+
"scope": ["openid", "profile", "email", "address", "phone"],
36+
"token_endpoint_auth_method": ["client_secret_basic", 'client_secret_post'],
37+
'services': SERVICES
38+
}
39+
40+
# The keys in this dictionary are the OPs short user friendly name
41+
# not the issuer (iss) name.
42+
43+
CLIENTS = {
44+
# The ones that support webfinger, OP discovery and client registration
45+
# This is the default, any client that is not listed here is expected to
46+
# support dynamic discovery and registration.
47+
"": {
48+
"client_preferences": CLIENT_PREFS,
49+
"redirect_uris": None,
50+
"services": {
51+
'WebFinger': {},
52+
'ProviderInfoDiscovery': {},
53+
'Registration': {},
54+
'Authorization': {},
55+
'AccessToken': {},
56+
'RefreshAccessToken': {},
57+
'UserInfo': {}
58+
}
59+
},
60+
# Supports OP information lookup but not client registration
61+
"google": {
62+
"issuer": "https://accounts.google.com/",
63+
"client_id": "xxxxxxxxx.apps.googleusercontent.com",
64+
"client_secret": "2222222222",
65+
"redirect_uris": ["{}/authz_cb/google".format(BASEURL)],
66+
"client_prefs": {
67+
"response_types": ["code"],
68+
"scope": ["openid", "profile", "email"],
69+
"token_endpoint_auth_method": ["client_secret_basic",
70+
'client_secret_post']
71+
},
72+
"allow": {
73+
"issuer_mismatch": True
74+
},
75+
# "userinfo_request_method": "GET",
76+
"services": {
77+
'ProviderInfoDiscovery': {},
78+
'Authorization': {},
79+
'AccessToken': {},
80+
'RefreshAccessToken': {},
81+
'UserInfo': {}
82+
}
83+
},
84+
"linkedin": {
85+
"issuer": "https://www.linkedin.com/oauth/v2/",
86+
"client_id": "xxxxxxx",
87+
"client_secret": "yyyyyyy",
88+
"redirect_uris": ["{}/authz_cb/linkedin".format(BASEURL)],
89+
"behaviour": {
90+
"response_types": ["code"],
91+
"scope": ["r_basicprofile", "r_emailaddress"],
92+
"token_endpoint_auth_method": ['client_secret_post']
93+
},
94+
"provider_info": {
95+
"authorization_endpoint":
96+
"https://www.linkedin.com/oauth/v2/authorization",
97+
"token_endpoint": "https://www.linkedin.com/oauth/v2/accessToken",
98+
"userinfo_endpoint":
99+
"https://api.linkedin.com/v1/people/~?format=json"
100+
},
101+
'services': {
102+
'Authorization': {},
103+
'linkedin.AccessToken': {},
104+
'linkedin.UserInfo': {}
105+
}
106+
},
107+
"facebook": {
108+
"issuer": "https://www.facebook.com/v2.11/dialog/oauth",
109+
"behaviour": {
110+
"response_types": ["code"],
111+
"scope": ["email", "public_profile"],
112+
"token_endpoint_auth_method": ['']
113+
},
114+
"redirect_uris": ["{}/authz_cb/facebook".format(BASEURL)],
115+
"provider_info": {
116+
"authorization_endpoint":
117+
"https://www.facebook.com/v2.11/dialog/oauth",
118+
"token_endpoint":
119+
"https://graph.facebook.com/v2.11/oauth/access_token",
120+
"userinfo_endpoint":
121+
"https://graph.facebook.com/me"
122+
},
123+
'services': {
124+
'Authorization': {},
125+
'AccessToken': {'default_authn_method': ''},
126+
'UserInfo': {'default_authn_method':''}
127+
}
128+
},
129+
'github': {
130+
"issuer": "https://github.com/login/oauth/authorize",
131+
'client_id': 'eeeeeeeee',
132+
'client_secret': 'aaaaaaaaaaaaa',
133+
"redirect_uris": ["{}/authz_cb/github".format(BASEURL)],
134+
"behaviour": {
135+
"response_types": ["code"],
136+
"scope": ["user", "public_repo"],
137+
"token_endpoint_auth_method": ['']
138+
},
139+
"provider_info": {
140+
"authorization_endpoint":
141+
"https://github.com/login/oauth/authorize",
142+
"token_endpoint":
143+
"https://github.com/login/oauth/access_token",
144+
"userinfo_endpoint":
145+
"https://api.github.com/user"
146+
},
147+
'services': {
148+
'Authorization': {},
149+
'AccessToken': {},
150+
'UserInfo': {'default_authn_method': ''}
151+
}
152+
},
153+
"salesforce": {
154+
"issuer": "https://login.salesforce.com",
155+
"client_id": "xxxxxxxxx.yyy",
156+
"client_secret": "2222222222",
157+
"redirect_uris": ["{}/authz_cb/salesforce".format(BASEURL)],
158+
"client_prefs": {
159+
"response_types": ["code"],
160+
"scope": ["openid", "profile", "email"],
161+
"token_endpoint_auth_method": ["client_secret_basic",
162+
'client_secret_post']
163+
},
164+
# "allow": {
165+
# "issuer_mismatch": True
166+
# },
167+
# "userinfo_request_method": "GET",
168+
"services": {
169+
'ProviderInfoDiscovery': {},
170+
'Authorization': {},
171+
'AccessToken': {},
172+
'RefreshAccessToken': {},
173+
'UserInfo': {}
174+
},
175+
"keys": {'file': {"https://login.salesforce.com": 'salesforce.jwks'}}
176+
},
177+
"okta": {
178+
"issuer": "https://dev-968755.oktapreview.com/",
179+
"client_id": "123456789",
180+
"client_secret": "abcdefgh",
181+
"redirect_uris": ["{}/authz_cb/okta".format(BASEURL)],
182+
"client_prefs": {
183+
"response_types": ["code"],
184+
"scope": ["openid", "profile", "email"],
185+
"token_endpoint_auth_method": ["client_secret_basic",
186+
'client_secret_post']
187+
},
188+
"provider_info": {
189+
"authorization_endpoint":
190+
"https://dev-968755.oktapreview.com/oauth2/default/v1"
191+
"/authorize",
192+
"token_endpoint":
193+
"https://dev-968755.oktapreview.com/oauth2/default/v1/token",
194+
"userinfo_endpoint":
195+
"https://dev-968755.oktapreview.com/oauth2/v1/userinfo"
196+
},
197+
# "userinfo_request_method": "GET",
198+
"services": {
199+
'Authorization': {},
200+
'AccessToken': {},
201+
'UserInfo': {}
202+
}
203+
}
204+
}
205+
206+
# Whether an attempt to fetch the userinfo should be made
207+
USERINFO = True

0 commit comments

Comments
 (0)