Changeset 8195 for trunk/ndg_oauth/ndg_oauth_server
- Timestamp:
- 19/10/12 10:52:53 (8 years ago)
- Location:
- trunk/ndg_oauth/ndg_oauth_server/ndg/oauth/server
- Files:
-
- 7 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/ndg_oauth/ndg_oauth_server/ndg/oauth/server/examples/bearer_tok/bearer_tok_server_app_serve.py
r8153 r8195 180 180 if opt.withSSL.lower() == 'true': 181 181 ssl_context = SSL.Context(SSL.SSLv23_METHOD) 182 # ssl_context.set_options(SSL.OP_NO_SSLv2) 183 182 183 ssl_context.set_session_id('oauthserver') 184 184 ssl_context.use_privatekey_file(opt.priKeyFilePath) 185 185 ssl_context.use_certificate_file(opt.certFilePath) -
trunk/ndg_oauth/ndg_oauth_server/ndg/oauth/server/lib/authorization_server.py
r8119 r8195 16 16 import urllib 17 17 18 from ndg.oauth.server.lib.access_token.make_access_token import make_access_token 18 from ndg.oauth.server.lib.access_token.make_access_token import \ 19 make_access_token 19 20 from ndg.oauth.server.lib.oauth.access_token import AccessTokenRequest 20 from ndg.oauth.server.lib.oauth.authorize import AuthorizeRequest, AuthorizeResponse 21 from ndg.oauth.server.lib.oauth.authorize import (AuthorizeRequest, 22 AuthorizeResponse) 21 23 from ndg.oauth.server.lib.oauth.oauth_exception import OauthException 22 24 from ndg.oauth.server.lib.register.access_token import AccessTokenRegister 23 25 from ndg.oauth.server.lib.register.client import ClientRegister 24 from ndg.oauth.server.lib.register.authorization_grant import AuthorizationGrantRegister 26 from ndg.oauth.server.lib.register.authorization_grant import \ 27 AuthorizationGrantRegister 25 28 26 29 log = logging.getLogger(__name__) … … 46 49 authenticated and that the user has authorised the client and scope. 47 50 48 Request query parameters (from http://tools.ietf.org/html/draft-ietf-oauth-v2-22): 51 Request query parameters (from 52 http://tools.ietf.org/html/draft-ietf-oauth-v2-22): 49 53 50 54 response_type … … 128 132 129 133 client_error = self.client_register.is_valid_client( 130 131 134 auth_request.client_id, 135 auth_request.redirect_uri) 132 136 if client_error: 133 137 log.error("Invalid client: %s", client_error) 134 138 return (None, httplib.BAD_REQUEST, client_error) 135 139 136 # redirect_uri must be included in the request if the client has more137 # than one registered.140 # redirect_uri must be included in the request if the client has 141 # more than one registered. 138 142 client = self.client_register.register[auth_request.client_id] 139 143 if len(client.redirect_uris) != 1 and not auth_request.redirect_uri: … … 197 201 ) 198 202 if not redirect_uri: 199 return(None, httplib.BAD_REQUEST, 200 'An authorization request has been made without a return URI.') 203 return ( 204 None, 205 httplib.BAD_REQUEST, 206 'An authorization request has been made without a return URI.') 201 207 202 208 # Redirect back to client with authorization code or error. … … 251 257 Handles a request for an access token. 252 258 253 Request parameters in post data (from http://tools.ietf.org/html/draft-ietf-oauth-v2-22): 259 Request parameters in post data (from 260 http://tools.ietf.org/html/draft-ietf-oauth-v2-22): 254 261 255 262 The client makes a request to the token endpoint by adding the … … 302 309 log.debug("Client id: %s", client_id) 303 310 304 # redirect_uri is only required if it was included in the authorization request. 311 # redirect_uri is only required if it was included in the 312 # authorization request. 305 313 required_parameters = ['grant_type', 'code'] 306 314 for param in required_parameters: … … 308 316 log.error("Missing request parameter %s from inputs: %s", 309 317 param, params) 310 raise OauthException('invalid_request', 311 ("Missing request parameter: %s" % param)) 318 raise OauthException( 319 'invalid_request', 320 "Missing request parameter: %s" % param) 312 321 313 322 except OauthException, exc: … … 331 340 332 341 if response: 333 return (self._access_token_response(response), None, None)342 return self._access_token_response(response), None, None 334 343 else: 335 return (None, httplib.INTERNAL_SERVER_ERROR,336 'Access token generation failed.')344 return (None, httplib.INTERNAL_SERVER_ERROR, 345 'Access token generation failed.') 337 346 338 347 def _access_token_response(self, resp): … … 453 462 else: 454 463 required_scope = params.get('scope', None) 455 (token, error)= self.access_token_register.get_token(access_token,456 required_scope)464 error = self.access_token_register.get_token(access_token, 465 required_scope)[-1] 457 466 458 467 status = {'invalid_request': httplib.BAD_REQUEST, … … 510 519 else: 511 520 required_scope = params.get('scope', None) 512 (token, error) = self.access_token_register.get_token(access_token, 521 522 token, error = self.access_token_register.get_token(access_token, 513 523 required_scope) 514 524 … … 518 528 None: httplib.OK}.get(error, httplib.BAD_REQUEST) 519 529 520 return (token, status, error)530 return token, status, error 521 531 522 532 def is_registered_client(self, request): … … 530 540 client_id = request.params.get('client_id', None) 531 541 if not client_id: 532 return ('invalid_request', 'Missing request parameter: client_id')542 return 'invalid_request', 'Missing request parameter: client_id' 533 543 else: 534 544 error_description = self.client_register.is_registered_client( 535 545 client_id) 536 546 if error_description: 537 return ('unauthorized_client', error_description)547 return 'unauthorized_client', error_description 538 548 539 return (None, None)549 return None, None -
trunk/ndg_oauth/ndg_oauth_server/ndg/oauth/server/lib/register/access_token.py
r8057 r8195 67 67 log.debug("Request for token of ID that is not registered: %s", 68 68 token_id) 69 return (None, 'invalid_token')69 return None, 'invalid_token' 70 70 71 71 if not token.valid: 72 72 log.debug("Request for invalid token of ID: %s", token_id) 73 return (None, 'invalid_token') 73 return None, 'invalid_token' 74 74 75 if token.expires <= datetime.utcnow(): 75 76 log.debug("Request for expired token of ID: %s", token_id) 76 return (None, 'invalid_token') 77 return None, 'invalid_token' 78 77 79 # Check scope 78 80 if not scopeutil.isScopeGranted(token.scope, 79 81 scopeutil.scopeStringToList(scope)): 80 log.debug("Request for token of ID: %s - token was not granted scope %s", 81 token_id, scope) 82 return (None, 'insufficient_scope') 83 return (token, None) 82 log.debug("Request for token of ID: %s - token was not granted " 83 "scope %s", token_id, scope) 84 return None, 'insufficient_scope' 85 86 return token, None -
trunk/ndg_oauth/ndg_oauth_server/ndg/oauth/server/lib/register/client.py
r8033 r8195 7 7 __contact__ = "Philip.Kershaw@stfc.ac.uk" 8 8 __revision__ = "$Id$" 9 10 9 import logging 11 10 from ConfigParser import SafeConfigParser 12 11 log = logging.getLogger(__name__) 12 13 13 14 14 class ClientRegistration(object): … … 16 16 An entry in the client register. 17 17 """ 18 def __init__(self, name, client_id, client_type, redirect_uris, authentication_data): 18 def __init__(self, name, client_id, client_type, redirect_uris, 19 authentication_data): 19 20 self.name = name 20 21 self.client_id = client_id … … 25 26 self.redirect_uris = [] 26 27 self.authentication_data = authentication_data 28 27 29 28 30 class ClientRegister(object): … … 68 70 if redirect_uri is None: 69 71 if len(client.redirect_uris) != 1: 70 return 'No redirect URI is registered for the client or specified in the request.' 72 return ('No redirect URI is registered for the client or ' 73 'specified in the request.') 71 74 if redirect_uri is not None and redirect_uri not in client.redirect_uris: 72 75 return 'Redirect URI is not registered.' -
trunk/ndg_oauth/ndg_oauth_server/ndg/oauth/server/lib/register/client_authorization.py
r8057 r8195 7 7 __contact__ = "Philip.Kershaw@stfc.ac.uk" 8 8 __revision__ = "$Id$" 9 import ndg.oauth.server.lib.register.scopeutil as scopeutil 9 10 10 import ndg.oauth.server.lib.register.scopeutil as scopeutil11 11 12 12 class ClientAuthorization(object): … … 29 29 requested scopes that are not granted, otherwise False 30 30 """ 31 return ( (self.user == other.user)32 and (self.client_id == other.client_id)31 return (self.user == other.user 32 and self.client_id == other.client_id 33 33 and scopeutil.isScopeGranted(self.scope, other.scope)) 34 34 35 35 def __repr__(self): 36 return ("user: %s client_id: %s scope: %s granted: %s" % (self.user, self.client_id, self.scope, self.is_authorized)) 36 return "user: %s client_id: %s scope: %s granted: %s" % ( 37 self.user, 38 self.client_id, 39 self.scope, 40 self.is_authorized) 37 41 38 42 class ClientAuthorizationRegister(object): … … 44 48 45 49 def add_client_authorization(self, client_authorization): 46 user_authorizations = self.register.setdefault(client_authorization.user, {}) 47 client_authorizations = user_authorizations.setdefault(client_authorization.client_id, []) 50 user_authorizations = self.register.setdefault( 51 client_authorization.user, {}) 52 client_authorizations = user_authorizations.setdefault( 53 client_authorization.client_id, []) 48 54 for auth in client_authorizations: 49 55 if auth.eq_authz_basis(client_authorization): 50 56 auth.is_authorized = client_authorization.is_authorized 51 57 52 user_authorizations[client_authorization.client_id].append(client_authorization) 58 user_authorizations[client_authorization.client_id].append( 59 client_authorization) 53 60 54 61 … … 58 65 if user_authorizations: 59 66 client_authorizations = user_authorizations.get(client_id, []) 60 # Assume small number of authorization types per user/client (probably typically one). 67 # Assume small number of authorization types per user/client 68 # (probably typically one). 61 69 for auth in client_authorizations: 62 70 if auth.eq_authz_basis(client_authorization): -
trunk/ndg_oauth/ndg_oauth_server/ndg/oauth/server/lib/register/register_base.py
r7952 r8195 33 33 'cache.expire': config.get(base + 'expire', None), 34 34 'cache.type': config.get(base + 'type', 'file'), 35 'cache.data_dir': config.get(base + 'data_dir', '/tmp/ndgoauth/cache/' + name), 35 'cache.data_dir': config.get(base + 'data_dir', 36 '/tmp/ndgoauth/cache/' + name), 36 37 'cache.lock_dir': config.get(base + 'lock_dir', None) 37 38 } -
trunk/ndg_oauth/ndg_oauth_server/ndg/oauth/server/wsgi/oauth2_server.py
r8119 r8195 223 223 log.debug("%s not in environ - authentication required", 224 224 self.user_identifier_env_key) 225 start_response(self._get_http_status_string(httplib.UNAUTHORIZED), []) 225 start_response(self._get_http_status_string(httplib.UNAUTHORIZED), 226 []) 226 227 return [] 227 228 228 229 # User authorization for the client is also required. 229 (client_authorized, authz_uri) = self._check_client_authorization(user, req) 230 (client_authorized, authz_uri) = self._check_client_authorization(user, 231 req) 230 232 if authz_uri: 231 233 log.debug("Redirecting to %s", authz_uri) … … 238 240 (redirect_uri, 239 241 error, 240 error_description) = self._authorizationServer.authorize(req, 242 error_description) = self._authorizationServer.authorize( 243 req, 241 244 client_authorized) 242 245 if error: … … 392 395 393 396 if status == httplib.OK: 394 (token, status, 395 error) = self._authorizationServer.get_registered_token(req, dn) 397 (token, 398 status, 399 error) = self._authorizationServer.get_registered_token(req, dn) 396 400 397 401 if status == httplib.OK:
Note: See TracChangeset
for help on using the changeset viewer.