Python oauth2.Client类代码示例

def test_client_secret_post():
    client = Client("A")
    client.client_secret = "boarding pass"

    cis = AccessTokenRequest(code="foo", redirect_uri="http://example.com")

    csp = ClientSecretPost(client)
    http_args = csp.construct(cis)

    print cis
    assert cis["client_id"] == "A"
    assert cis["client_secret"] == "boarding pass"
    print http_args
    assert http_args is None

    cis = AccessTokenRequest(code="foo", redirect_uri="http://example.com")

    request_args = {}
    http_args = csp.construct(cis, request_args,
                              http_args={"client_secret": "another"})

    print cis
    assert cis["client_id"] == "A"
    assert cis["client_secret"] == "another"
    print http_args
    assert http_args == {}

def test_bearer_header_with_http_args():
    client = Client("A")
    client.client_secret = "boarding pass"

    request_args = {"access_token": "Sesame"}

    cis = ResourceRequest()

    bh = BearerHeader(client)
    http_args = bh.construct(cis, request_args, http_args={"foo": "bar"})

    print cis
    print http_args
    assert _eq(http_args.keys(), ["foo", "headers"])
    assert http_args["headers"] == {"Authorization": "Bearer Sesame"}

    # -----------------

    request_args = {"access_token": "Sesame"}

    bh = BearerHeader(client)
    http_args = bh.construct(cis, request_args,
                             http_args={"headers": {"x-foo": "bar"}})

    print cis
    print http_args
    assert _eq(http_args.keys(), ["headers"])
    assert _eq(http_args["headers"].keys(), ["Authorization", "x-foo"])
    assert http_args["headers"]["Authorization"] == "Bearer Sesame"

def test_bearer_body():
    client = Client("A")
    client.client_secret = "boarding pass"

    request_args = {"access_token": "Sesame"}

    cis = ResourceRequest()
    http_args = BearerBody(client).construct(cis, request_args)
    assert cis["access_token"] == "Sesame"
    print http_args
    assert http_args is None

    # ----------
    resp = AuthorizationResponse(code="code", state="state")
    grant = Grant()
    grant.add_code(resp)

    atr = AccessTokenResponse(access_token="2YotnFZFEjr1zCsicMWpAA",
                              token_type="example",
                              refresh_token="tGzv3JOkF0XG5Qx2TlKWIA",
                              example_parameter="example_value",
                              scope=["inner", "outer"])

    grant.add_token(atr)
    client.grant["state"] = grant

    cis = ResourceRequest()
    http_args = BearerBody(client).construct(cis, {}, state="state",
                                             scope="inner")
    assert cis["access_token"] == "2YotnFZFEjr1zCsicMWpAA"
    print http_args
    assert http_args is None

def test_client_secret_basic():
    client = Client("A")
    client.client_secret = "boarding pass"

    cis = AccessTokenRequest(code="foo", redirect_uri="http://example.com")

    http_args = oauth2.client_secret_basic(client, cis)

    assert http_args == {"auth": ("A", "boarding pass")}

    def test_construct_access_token_req_expired_grant(self):
        resp = AuthorizationResponse(code="code", state="state")
        grant = Grant(-10)  # expired grant
        grant.add_code(resp)

        client = Client()
        client.grant["openid"] = grant
        with pytest.raises(GrantExpired):
            client.construct_AccessTokenRequest(state="openid")

def test_client_secret_basic():
    client = Client("A")
    client.client_secret = "boarding pass"

    cis = AccessTokenRequest(code="foo", redirect_uri="http://example.com")

    csb = ClientSecretBasic(client)
    http_args = csb.construct(cis)

    assert http_args == {"headers": {'Authorization': 'Basic %s'
                                     % base64.b64encode('A:boarding pass')}}

    def phaseN(self, environ, info, server_env, sid):
        session = server_env["CACHE"][sid]

        callback = server_env["base_url"] + self.social_endpoint

        client = Client(client_id=self.client_id,
                        client_authn_method=CLIENT_AUTHN_METHOD)
        response = client.parse_response(AuthorizationResponse, info, "dict")
        logger.info("Response: %s" % response)

        if isinstance(response, ErrorResponse):
            logger.info("%s" % response)
            session["authentication"] = "FAILED"
            return False, "Authentication failed or permission not granted"

        req_args = {
            "redirect_uri": callback,
            "client_secret": self.client_secret,
        }

        client.token_endpoint = self.extra["token_endpoint"]
        tokenresp = client.do_access_token_request(
            scope=self._scope,
            body_type=self.token_response_body_type,
            request_args=req_args,
            authn_method="client_secret_post",
            state=response["state"],
            response_cls=self.access_token_response)

        if isinstance(tokenresp, ErrorResponse):
            logger.info("%s" % tokenresp)
            session["authentication"] = "FAILED"
            return False, "Authentication failed or permission not granted"

        # Download the user profile and cache a local instance of the
        # basic profile info
        result = client.fetch_protected_resource(
            self.userinfo_endpoint(tokenresp), token=tokenresp["access_token"])

        logger.info("Userinfo: %s" % result.text)
        root = ET.fromstring(result.text)
        jsontext = json.dumps(root.attrib)
        profile = json.loads(jsontext)
        profile = self.convert(profile)
        logger.info("PROFILE: %s" % (profile, ))
        session["service"] = self.name
        session["authentication"] = "OK"
        session["status"] = "SUCCESS"
        session["authn_auth"] = self.authenticating_authority
        session["permanent_id"] = profile["uid"]

        server_env["CACHE"][sid] = session

        return True, profile, session

def test_get_access_token_request():
    resp = AuthorizationResponse(code="code", state="state")
    grant = Grant(1)
    grant.add_code(resp)

    client = Client()
    client.grant["openid"] = grant
    time.sleep(2)
    try:
        client.construct_AccessTokenRequest(state="openid")
    except Exception, err:
        assert err.__class__.__name__ == "GrantExpired"

def test_bearer_header_2():
    client = Client("A")
    client.client_secret = "boarding pass"

    cis = ResourceRequest(access_token="Sesame")

    http_args = oauth2.bearer_header(client, cis)

    print cis
    assert "access_token" not in cis
    print http_args
    assert http_args == {"headers": {"Authorization": "Bearer Sesame"}}

def test_client_get_grant():
    cli = Client()

    resp = AuthorizationResponse(code="code", state="state")
    grant = Grant()
    grant.add_code(resp)

    cli.grant["state"] = grant

    gr1 = cli.grant_from_state("state")

    assert gr1.code == "code"

    def test_pkce_verify_512(self, session_db_factory):
        _cli = Client(config={'code_challenge': {'method': 'S512', 'length': 96}})
        args, cv = _cli.add_code_challenge()

        authn_broker = AuthnBroker()
        authn_broker.add("UNDEFINED", DummyAuthn(None, "username"))
        _prov = Provider("as",
                         session_db_factory('https://connect-op.heroku.com'), {},
                         authn_broker, Implicit(), verify_client)

        assert _prov.verify_code_challenge(cv, args['code_challenge'], 'S512') is True
        resp = _prov.verify_code_challenge('XXX', args['code_challenge'])
        assert isinstance(resp, Response)
        assert resp.info()['status_code'] == 401

def test_parse_access_token_response_missing_attribute():
    at = AccessTokenResponse(access_token="SlAV32hkKG", token_type="Bearer", refresh_token="8xLOxBtZp8", expire_in=3600)

    atdict = at.to_dict()
    del atdict["access_token"]
    atj = json.dumps(atdict)
    print atj
    client = Client()
    ATR = AccessTokenResponse

    try:
        client.parse_response(ATR, info=atj)
    except Exception, err:
        assert err.__class__.__name__ == "MissingRequiredAttribute"

def test_client_parse_extra_args():
    cli = Client()

    args = {
        "response_type": "",
        "client_id": "client_id",
        "redirect_uri": "http://example.com/authz",
        "scope": "scope",
        "state": "state",
        "extra_session": "home",
    }
    ar_args = cli._parse_args(AuthorizationRequest, **args)

    assert _eq(ar_args.keys(), ["state", "redirect_uri", "response_type", "client_id", "scope", "extra_session"])

def test_bearer_header():
    client = Client("A")
    client.client_secret = "boarding pass"

    request_args = {"access_token": "Sesame"}

    cis = ResourceRequest()

    bh = BearerHeader(client)
    http_args = bh.construct(cis, request_args)

    print cis
    print http_args
    assert http_args == {"headers": {"Authorization": "Bearer Sesame"}}

def test_private_key_jwt():
    cli = Client("FOO")
    cli.token_endpoint = "https://example.com/token"
    cli.keyjar[""] = KC_RSA

    cis = AccessTokenRequest()
    pkj = PrivateKeyJWT(cli)
    http_args = pkj.construct(cis, algorithm="RS256")
    assert http_args == {}
    cas = cis["client_assertion"]
    header, claim, crypto, header_b64, claim_b64 = jwkest.unpack(cas)
    jso = json.loads(claim)
    assert _eq(jso.keys(), ["aud", "iss", "sub", "jti", "exp", "iat"])
    print header
    assert header == {'alg': 'RS256'}