Skip to content
This repository was archived by the owner on Jun 23, 2023. It is now read-only.

Commit 5538fe6

Browse files
roherohe
committed
Adjustments.
1 parent 039b2a6 commit 5538fe6

5 files changed

Lines changed: 339 additions & 39 deletions

File tree

‎flask_op/application.py‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -18,15 +18,18 @@ def init_oidc_op_endpoints(app):
1818
port=app.srv_config.port)
1919
_server_info_config['issuer'] = iss
2020

21-
_kj_args = {k:v for k,v in _server_info_config['jwks'].items() if k != 'uri_path'}
22-
_kj = init_key_jar(**_kj_args)
23-
# make sure I have a set of keys under my 'real' name
24-
_kj.import_jwks_as_json(_kj.export_jwks_as_json(True, ''), iss)
25-
26-
endpoint_context = EndpointContext(_server_info_config, keyjar=_kj, cwd=folder)
27-
28-
# sort of backward but work so...
29-
_kj.httpc_params = endpoint_context.httpc_params
21+
# _kj_args = {k:v for k,v in _server_info_config['jwks'].items() if k != 'uri_path'}
22+
#
23+
# db_conf = _server_info_config.get('db_conf')
24+
# if db_conf:
25+
# key_jar_conf = db_conf.get('keyjar')
26+
# _kj = init_key_jar(storage_conf=key_jar_conf, **_kj_args)
27+
# else:
28+
# _kj = init_key_jar(**_kj_args)
29+
# # make sure I have a set of keys under my 'real' name
30+
# _kj.import_jwks_as_json(_kj.export_jwks_as_json(True, ''), iss)
31+
32+
endpoint_context = EndpointContext(_server_info_config, cwd=folder)
3033

3134
for endp in endpoint_context.endpoint.values():
3235
p = urlparse(endp.endpoint_path)

‎flask_op/config.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@ op:
112112
path: '.well-known/webfinger'
113113
class: oidcendpoint.oidc.discovery.Discovery
114114
kwargs:
115-
client_authn_method: []
115+
client_authn_method: null
116116
provider_info:
117117
path: ".well-known/openid-configuration"
118118
class: oidcendpoint.oidc.provider_config.ProviderConfiguration

‎flask_op/config_persistent.yaml‎

Lines changed: 294 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,294 @@
1+
logging:
2+
version: 1
3+
root:
4+
handlers:
5+
- default
6+
- console
7+
level: DEBUG
8+
loggers:
9+
bobcat_idp:
10+
level: DEBUG
11+
handlers:
12+
default:
13+
class: logging.FileHandler
14+
filename: 'debug.log'
15+
formatter: default
16+
console:
17+
class: logging.StreamHandler
18+
stream: 'ext://sys.stdout'
19+
formatter: default
20+
formatters:
21+
default:
22+
format: '%(asctime)s %(name)s %(levelname)s %(message)s'
23+
24+
port: &port 5000
25+
domain: &domain 127.0.0.1
26+
server_name: '{domain}:{port}'
27+
base_url: &base_url 'https://{domain}:{port}'
28+
29+
key_def: &key_def
30+
-
31+
type: RSA
32+
use:
33+
- sig
34+
-
35+
type: EC
36+
crv: "P-256"
37+
use:
38+
- sig
39+
40+
OIDC_KEYS: &oidc_keys
41+
'private_path': "private/jwks.json"
42+
'key_defs': *key_def
43+
'public_path': 'static/jwks.json'
44+
'read_only': False
45+
# otherwise OP metadata will have jwks_uri: https://127.0.0.1:5000/None!
46+
'uri_path': 'static/jwks.json'
47+
48+
49+
op:
50+
server_info:
51+
issuer: *base_url
52+
http_params:
53+
verify_ssl: False
54+
session_key:
55+
filename: private/session_jwk.json
56+
type: OCT
57+
use: sig
58+
capabilities:
59+
subject_types_supported:
60+
- public
61+
- pairwise
62+
grant_types_supported:
63+
- authorization_code
64+
- implicit
65+
- urn:ietf:params:oauth:grant-type:jwt-bearer
66+
- refresh_token
67+
template_dir: templates
68+
id_token:
69+
class: oidcendpoint.id_token.IDToken
70+
kwargs:
71+
default_claims:
72+
email:
73+
essential: True
74+
email_verified:
75+
essential: True
76+
token_handler_args:
77+
jwks_def:
78+
private_path: 'private/token_jwks.json'
79+
read_only: False
80+
key_defs:
81+
-
82+
type: oct
83+
bytes: 24
84+
use:
85+
- enc
86+
kid: code
87+
-
88+
type: oct
89+
bytes: 24
90+
use:
91+
- enc
92+
kid: refresh
93+
code:
94+
lifetime: 600
95+
token:
96+
class: oidcendpoint.jwt_token.JWTToken
97+
lifetime: 3600
98+
add_claims:
99+
- email
100+
- email_verified
101+
- phone_number
102+
- phone_number_verified
103+
add_claim_by_scope: True
104+
aud:
105+
- https://example.org/appl
106+
refresh:
107+
lifetime: 86400
108+
keys:
109+
*oidc_keys
110+
endpoint:
111+
webfinger:
112+
path: '.well-known/webfinger'
113+
class: oidcendpoint.oidc.discovery.Discovery
114+
kwargs:
115+
client_authn_method: null
116+
provider_info:
117+
path: ".well-known/openid-configuration"
118+
class: oidcendpoint.oidc.provider_config.ProviderConfiguration
119+
kwargs:
120+
client_authn_method: null
121+
registration:
122+
path: registration
123+
class: oidcendpoint.oidc.registration.Registration
124+
kwargs:
125+
client_authn_method: null
126+
client_secret_expiration_time: 432000
127+
registration_api:
128+
path: registration_api
129+
class: oidcendpoint.oidc.read_registration.RegistrationRead
130+
kwargs:
131+
client_authn_method:
132+
- bearer_header
133+
introspection:
134+
path: introspection
135+
class: oidcendpoint.oauth2.introspection.Introspection
136+
kwargs:
137+
client_authn_method:
138+
- client_secret_post
139+
release:
140+
- username
141+
authorization:
142+
path: authorization
143+
class: oidcendpoint.oidc.authorization.Authorization
144+
kwargs:
145+
client_authn_method: null
146+
claims_parameter_supported: True
147+
request_parameter_supported: True
148+
request_uri_parameter_supported: True
149+
response_types_supported:
150+
- code
151+
- token
152+
- id_token
153+
- "code token"
154+
- "code id_token"
155+
- "id_token token"
156+
- "code id_token token"
157+
- none
158+
response_modes_supported:
159+
- query
160+
- fragment
161+
- form_post
162+
token:
163+
path: token
164+
class: oidcendpoint.oidc.token.AccessToken
165+
kwargs:
166+
client_authn_method:
167+
- client_secret_post
168+
- client_secret_basic
169+
- client_secret_jwt
170+
- private_key_jwt
171+
userinfo:
172+
path: userinfo
173+
class: oidcendpoint.oidc.userinfo.UserInfo
174+
kwargs:
175+
claim_types_supported:
176+
- normal
177+
- aggregated
178+
- distributed
179+
end_session:
180+
path: session
181+
class: oidcendpoint.oidc.session.Session
182+
kwargs:
183+
logout_verify_url: verify_logout
184+
post_logout_uri_path: post_logout
185+
signing_alg: "ES256"
186+
frontchannel_logout_supported: True
187+
frontchannel_logout_session_supported: True
188+
backchannel_logout_supported: True
189+
backchannel_logout_session_supported: True
190+
check_session_iframe: 'check_session_iframe'
191+
userinfo:
192+
class: oidcendpoint.user_info.UserInfo
193+
kwargs:
194+
db_file: users.json
195+
authentication:
196+
user:
197+
acr: oidcendpoint.user_authn.authn_context.INTERNETPROTOCOLPASSWORD
198+
class: oidcendpoint.user_authn.user.UserPassJinja2
199+
kwargs:
200+
verify_endpoint: 'verify/user'
201+
template: user_pass.jinja2
202+
db:
203+
class: oidcendpoint.util.JSONDictDB
204+
kwargs:
205+
json_path: passwd.json
206+
page_header: "Testing log in"
207+
submit_btn: "Get me in!"
208+
user_label: "Nickname"
209+
passwd_label: "Secret sauce"
210+
#anon:
211+
#acr: oidcendpoint.user_authn.authn_context.UNSPECIFIED
212+
#class: oidcendpoint.user_authn.user.NoAuthn
213+
#kwargs:
214+
#user: diana
215+
cookie_dealer:
216+
class: oidcendpoint.cookie.CookieDealer
217+
kwargs:
218+
sign_jwk:
219+
filename: 'private/cookie_sign_jwk.json'
220+
type: OCT
221+
kid: cookie_sign_key_id
222+
enc_jwk:
223+
filename: 'private/cookie_enc_jwk.json'
224+
type: OCT
225+
kid: cookie_enc_key_id
226+
# enc_jwk: 'private/cookie_enc_jwk.json'
227+
default_values:
228+
name: oidc_op
229+
domain: *domain
230+
path: /
231+
max_age: 3600
232+
login_hint2acrs:
233+
class: oidcendpoint.login_hint.LoginHint2Acrs
234+
kwargs:
235+
scheme_map:
236+
email:
237+
- oidcendpoint.user_authn.authn_context.INTERNETPROTOCOLPASSWORD
238+
239+
# this adds PKCE support as mandatory - disable it if needed (essential: False)
240+
add_on:
241+
pkce:
242+
function: oidcendpoint.oidc.add_on.pkce.add_pkce_support
243+
kwargs:
244+
essential: false
245+
code_challenge_method:
246+
#plain
247+
S256
248+
S384
249+
S512
250+
251+
claims:
252+
function: oidcendpoint.oidc.add_on.custom_scopes.add_custom_scopes
253+
kwargs:
254+
research_and_scholarship:
255+
- name
256+
- given_name
257+
- family_name
258+
- email
259+
- email_verified
260+
- sub
261+
- iss
262+
- eduperson_scoped_affiliation
263+
db_conf:
264+
abstract_storage_cls: abstorage.base.LabeledAbstractStorage
265+
keyjar:
266+
handler: abstorage.storages.abfile.AbstractFileSystem
267+
fdir: storage/keyjar
268+
key_conv: abstorage.converter.QPKey
269+
value_conv: cryptojwt.serialize.item.KeyIssuer
270+
label: 'x'
271+
default:
272+
handler: abstorage.storages.abfile.AbstractFileSystem
273+
fdir: storage
274+
key_conv: abstorage.converter.QPKey
275+
value_conv: abstorage.converter.JSON
276+
session:
277+
handler: abstorage.storages.abfile.AbstractFileSystem
278+
fdir: storage/session
279+
key_conv: abstorage.converter.QPKey
280+
value_conv: abstorage.converter.JSON
281+
sso:
282+
handler: abstorage.storages.abfile.AbstractFileSystem
283+
fdir: storage/sso
284+
key_conv: abstorage.converter.QPKey
285+
value_conv: abstorage.converter.JSON
286+
287+
webserver:
288+
server_cert: 'certs/89296913_127.0.0.1.cert'
289+
server_key: 'certs/89296913_127.0.0.1.key'
290+
ca_bundle: null
291+
verify_user: false
292+
port: *port
293+
domain: *domain
294+
debug: true

‎flask_op/server.py‎

Lines changed: 29 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -20,35 +20,35 @@
2020
logger = logging.getLogger(__name__)
2121

2222

23-
class PeerCertWSGIRequestHandler(werkzeug.serving.WSGIRequestHandler):
24-
"""
25-
We subclass this class so that we can gain access to the connection
26-
property. self.connection is the underlying client socket. When a TLS
27-
connection is established, the underlying socket is an instance of
28-
SSLSocket, which in turn exposes the getpeercert() method.
29-
30-
The output from that method is what we want to make available elsewhere
31-
in the application.
32-
"""
33-
34-
def make_environ(self):
35-
"""
36-
The superclass method develops the environ hash that eventually
37-
forms part of the Flask request object.
38-
39-
We allow the superclass method to run first, then we insert the
40-
peer certificate into the hash. That exposes it to us later in
41-
the request variable that Flask provides
42-
"""
43-
environ = super(PeerCertWSGIRequestHandler, self).make_environ()
44-
x509_binary = self.connection.getpeercert(True)
45-
if x509_binary:
46-
x509 = OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_ASN1, x509_binary)
47-
environ['peercert'] = x509
48-
else:
49-
logger.warning('No peer certificate')
50-
environ['peercert'] = ''
51-
return environ
23+
# class PeerCertWSGIRequestHandler(werkzeug.serving.WSGIRequestHandler):
24+
# """
25+
# We subclass this class so that we can gain access to the connection
26+
# property. self.connection is the underlying client socket. When a TLS
27+
# connection is established, the underlying socket is an instance of
28+
# SSLSocket, which in turn exposes the getpeercert() method.
29+
#
30+
# The output from that method is what we want to make available elsewhere
31+
# in the application.
32+
# """
33+
#
34+
# def make_environ(self):
35+
# """
36+
# The superclass method develops the environ hash that eventually
37+
# forms part of the Flask request object.
38+
#
39+
# We allow the superclass method to run first, then we insert the
40+
# peer certificate into the hash. That exposes it to us later in
41+
# the request variable that Flask provides
42+
# """
43+
# environ = super(PeerCertWSGIRequestHandler, self).make_environ()
44+
# x509_binary = self.connection.getpeercert(True)
45+
# if x509_binary:
46+
# x509 = OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_ASN1, x509_binary)
47+
# environ['peercert'] = x509
48+
# else:
49+
# logger.warning('No peer certificate')
50+
# environ['peercert'] = ''
51+
# return environ
5252

5353

5454
def main(config_file, args):

0 commit comments

Comments
 (0)