Python message.AuthorizationRequest类代码示例

    def test_token_endpoint_malformed(self):
        authreq = AuthorizationRequest(state="state",
                                       redirect_uri="http://example.com/authz",
                                       client_id=CLIENT_ID,
                                       response_type="code",
                                       scope=["openid"])

        _sdb = self.provider.sdb
        sid = _sdb.access_token.key(user="sub", areq=authreq)
        access_grant = _sdb.access_token(sid=sid)
        ae = AuthnEvent("user", "salt")
        _sdb[sid] = {
            "oauth_state": "authz",
            "authn_event": ae,
            "authzreq": authreq.to_json(),
            "client_id": CLIENT_ID,
            "code": access_grant,
            "code_used": False,
            "scope": ["openid"],
            "redirect_uri": "http://example.com/authz",
        }
        _sdb.do_sub(sid, "client_salt")

        # Construct Access token request
        areq = AccessTokenRequest(code=access_grant[0:len(access_grant) - 1],
                                  client_id=CLIENT_ID,
                                  redirect_uri="http://example.com/authz",
                                  client_secret=CLIENT_SECRET,
                                  grant_type='authorization_code')

        txt = areq.to_urlencoded()

        resp = self.provider.token_endpoint(request=txt)
        atr = TokenErrorResponse().deserialize(resp.message, "json")
        assert atr['error'] == "access_denied"

def test_server_parse_parse_authorization_request():
    srv = Server()
    srv.keyjar = KEYJ
    ar = AuthorizationRequest(response_type=["code"], client_id="foobar",
                              redirect_uri="http://foobar.example.com/oaclient",
                              state="cold", nonce="NONCE", scope=["openid"])

    uencq = ar.to_urlencoded()

    areq = srv.parse_authorization_request(query=uencq)

    assert areq.type() == "AuthorizationRequest"
    assert areq["response_type"] == ["code"]
    assert areq["client_id"] == "foobar"
    assert areq["redirect_uri"] == "http://foobar.example.com/oaclient"
    assert areq["state"] == "cold"

    urluenc = "%s?%s" % ("https://example.com/authz", uencq)

    areq = srv.parse_authorization_request(url=urluenc)

    assert areq.type() == "AuthorizationRequest"
    assert areq["response_type"] == ["code"]
    assert areq["client_id"] == "foobar"
    assert areq["redirect_uri"] == "http://foobar.example.com/oaclient"
    assert areq["state"] == "cold"

def test_server_authorization_endpoint_request():
    server = provider_init

    bib = {"scope": ["openid"],
           "state": "id-6da9ca0cc23959f5f33e8becd9b08cae",
           "redirect_uri": "http://localhost:8087/authz",
           "response_type": ["code", "id_token"],
           "client_id": "a1b2c3",
           "nonce": "Nonce",
           "prompt": ["none"]}

    req = AuthorizationRequest(**bib)
    ic = {"claims": {"sub": { "value":"username" }}}
    _keys = server.keyjar.get_signing_key(type="rsa")
    req["request"] = make_openid_request(req, _keys, idtoken_claims=ic,
                                         algorithm="RS256")

    environ = BASE_ENVIRON.copy()
    environ["QUERY_STRING"] = req.to_urlencoded()

    resp = server.authorization_endpoint(environ, start_response)

    print resp
    line = resp[0]
    assert "error=login_required" in line

    def test_token_endpoint(self):
        authreq = AuthorizationRequest(state="state",
                                       redirect_uri="http://example.com/authz",
                                       client_id=CLIENT_ID,
                                       response_type="code",
                                       scope=["openid"])

        _sdb = self.provider.sdb
        sid = _sdb.token.key(user="sub", areq=authreq)
        access_grant = _sdb.token(sid=sid)
        ae = AuthnEvent("user", "salt")
        _sdb[sid] = {
            "oauth_state": "authz",
            "authn_event": ae,
            "authzreq": authreq.to_json(),
            "client_id": CLIENT_ID,
            "code": access_grant,
            "code_used": False,
            "scope": ["openid"],
            "redirect_uri": "http://example.com/authz",
        }
        _sdb.do_sub(sid, "client_salt")

        # Construct Access token request
        areq = AccessTokenRequest(code=access_grant, client_id=CLIENT_ID,
                                  redirect_uri="http://example.com/authz",
                                  client_secret=CLIENT_SECRET)

        txt = areq.to_urlencoded()

        resp = self.provider.token_endpoint(request=txt)
        atr = AccessTokenResponse().deserialize(resp.message, "json")
        assert _eq(atr.keys(),
                   ['token_type', 'id_token', 'access_token', 'scope',
                    'expires_in', 'refresh_token'])

 def setup_token_endpoint(self):
     authreq = AuthorizationRequest(state="state",
                                    redirect_uri=self.redirect_urls[0],
                                    client_id=CLIENT_ID,
                                    response_type="code",
                                    scope=["openid"])
     _sdb = self.provider.sdb
     sid = _sdb.token.key(user="sub", areq=authreq)
     access_grant = _sdb.token(sid=sid)
     ae = AuthnEvent("user", "salt")
     _sdb[sid] = {
         "oauth_state": "authz",
         "authn_event": ae,
         "authzreq": authreq.to_json(),
         "client_id": CLIENT_ID,
         "code": access_grant,
         "code_used": False,
         "scope": ["openid"],
         "redirect_uri": self.redirect_urls[0],
     }
     _sdb.do_sub(sid, "client_salt")
     # Construct Access token request
     areq = AccessTokenRequest(code=access_grant, client_id=CLIENT_ID,
                               redirect_uri=self.redirect_urls[0],
                               client_secret="client_secret_1")
     txt = areq.to_urlencoded()
     resp = self.provider.token_endpoint(request=txt)
     responses.add(
         responses.POST,
         self.op_base + "token",
         body=resp.message,
         status=200,
         content_type='application/json')

    def test_session_state_in_auth_req_for_session_support(self):
        provider = Provider(
            "foo",
            SessionDB(SERVER_INFO["issuer"]),
            CDB,
            AUTHN_BROKER,
            USERINFO,
            AUTHZ,
            verify_client,
            SYMKEY,
            urlmap=URLMAP,
            keyjar=KEYJAR,
            capabilities={"check_session_iframe": "https://op.example.com/check_session"},
        )

        req_args = {
            "scope": ["openid"],
            "redirect_uri": "http://localhost:8087/authz",
            "response_type": ["code"],
            "client_id": "a1b2c3",
        }
        areq = AuthorizationRequest(**req_args)
        resp = provider.authorization_endpoint(request=areq.to_urlencoded())
        aresp = self.cons.parse_response(AuthorizationResponse, resp.message, sformat="urlencoded")
        assert "session_state" in aresp

def test_static_client_registration(server_url, provider_info, browser):
    redirect_uri = "http://localhost:8090"
    browser.get(server_url + "/client_registration")
    new_url_input = browser.find_element_by_xpath("/html/body/div/div/div[1]/div[1]/form/div/input")
    new_url_input.send_keys(redirect_uri)
    add_btn = browser.find_element_by_xpath("/html/body/div/div/div[1]/div[1]/form/div/span/button")
    add_btn.click()

    submit_btn = browser.find_element_by_xpath("/html/body/div/div/div[2]/button")
    submit_btn.click()

    client_credentials = get_client_credentials_from_page(browser)

    args = {
        "client_id": client_credentials["client_id"],
        "scope": "openid",
        "response_type": "id_token",
        "redirect_uri": redirect_uri,
        "state": "state0",
        "nonce": "nonce0"
    }
    auth_req = AuthorizationRequest(**args)
    request = auth_req.request(provider_info["authorization_endpoint"])
    browser.get(request)

    fill_login_details(browser)

    urlencoded_resp = urlparse(browser.current_url).fragment
    auth_resp = AuthorizationResponse().from_urlencoded(urlencoded_resp)
    idt = IdToken().from_jwt(auth_resp["id_token"], verify=False)
    assert browser.current_url.startswith(redirect_uri)
    assert auth_resp["state"] == "state0"
    assert idt["nonce"] == "nonce0"

def test_authz_req():
    areq = AuthorizationRequest(
        **{'state': 'vMTF1dV5yyEiPFR6',
           'redirect_uri': 'https://localhost:8088/authz_cb',
           'response_type': 'code', 'client_id': u'iSKYyH32tzC5',
           'scope': 'openid',
           'claims': {'id_token': {'sub': {"value": "-fdfb4a841dce167"}}}})

    print areq.to_urlencoded()

 def test_parse_authorization_request(self):
     areq = AuthorizationRequest(response_type="code", client_id="client_id",
                                 redirect_uri="http://example.com/authz",
                                 scope=["openid"], state="state0",
                                 nonce="N0nce")
     qdict = self.srv.parse_authorization_request(query=areq.to_urlencoded())
     assert _eq(qdict.keys(), ['nonce', 'state', 'redirect_uri',
                               'response_type', 'client_id', 'scope'])
     assert qdict["state"] == "state0"

    def test_request_info_simple(self):
        self.client.authorization_endpoint = "https://example.com/authz"
        uri, body, h_args, cis = self.client.request_info(AuthorizationRequest)

        # default == "POST"
        assert uri == "https://example.com/authz"
        areq = AuthorizationRequest().from_urlencoded(body)
        assert _eq(areq.keys(), ["nonce", "redirect_uri", "response_type", "client_id"])
        assert h_args == {"headers": {"content-type": "application/x-www-form-urlencoded"}}
        assert cis.type() == "AuthorizationRequest"

def vetting_result():
    data = flask.request.get_json()
    qrcode = data.get('qrcode')

    try:
        qrdata = parse_opaque_data(qrcode)
    except InvalidOpaqueDataError as e:
        return make_response(str(e), 400)

    auth_req_data = current_app.authn_requests.pop(qrdata['nonce'])
    if not auth_req_data:
        # XXX: Short circuit vetting process for special nonce during development
        if qrdata['nonce'] in current_app.config.get('TEST_NONCE', []):
            current_app.logger.debug('Found test nonce {}'.format(qrdata['nonce']))
            return development_license_check(data)
        # XXX: End remove later
        current_app.logger.debug('Received unknown nonce \'{}\''.format(qrdata['nonce']))
        return make_response('Unknown nonce', 400)

    auth_req = AuthorizationRequest(**auth_req_data)
    user_id = auth_req['user_id']

    try:
        current_app.logger.debug('Vetting data received: {}'.format(data))
        # Check vetting data received
        parsed_data = parse_vetting_data(data)
        current_app.logger.debug('Vetting data parsed: {!r}'.format(parsed_data))
    except ValueError as e:
        current_app.logger.error('Received malformed vetting data \'{}\''.format(data))
        current_app.logger.error(e)
        return make_response('Malformed vetting data', 400)
    except KeyError as e:
        current_app.logger.error('Missing vetting data: \'{}\''.format(e))
        return make_response('Missing vetting data: {}'.format(e), 400)

    # Save information needed for the next vetting step that uses the api
    try:
        yubico_state = current_app.yubico_states[auth_req['state']]
    except KeyError:
        yubico_state = {
            'created': time(),
            'state': auth_req['state'],
            'client_id': auth_req['client_id'],
            'user_id': user_id
        }
    else:
        # Yubico state already created via the api
        yubico_state.update({'client_id': auth_req['client_id'], 'user_id': user_id})
    current_app.yubico_states[auth_req['state']] = yubico_state

    # Add soap license check to queue
    current_app.mobile_verify_service_queue.enqueue(verify_license, auth_req.to_dict(), parsed_data['front_image_data'],
                                                    parsed_data['barcode_data'], parsed_data['mibi_data'])

    return make_response('OK', 200)

    def test_request_info_simple_get(self):
        uri, body, h_args, cis = self.client.request_info(AuthorizationRequest, method="GET")

        (url, query) = uri.split("?")
        areq = AuthorizationRequest().from_urlencoded(query)
        assert _eq(areq.keys(), ["nonce", "redirect_uri", "response_type", "client_id"])
        assert areq["redirect_uri"] == "http://client.example.com/authz"

        assert body is None
        assert h_args == {}
        assert cis.type() == "AuthorizationRequest"

    def _authz_req(self):
        req_args = {"scope": ["openid", "profile"],
                    "redirect_uri": "http://localhost:8087/authz",
                    "response_type": ["code"],
                    "client_id": "client1"
                    }
        areq = AuthorizationRequest(**req_args)
        resp = self.provider.authorization_endpoint(areq.to_urlencoded())

        return AuthorizationResponse().deserialize(
            urlparse(resp.message).query, "urlencoded")

    def test_authorization_endpoint_id_token(self):
        bib = {
            "scope": ["openid"],
            "state": "id-6da9ca0cc23959f5f33e8becd9b08cae",
            "redirect_uri": "http://localhost:8087/authz",
            "response_type": ["code", "id_token"],
            "client_id": "a1b2c3",
            "nonce": "Nonce",
            "prompt": ["none"],
        }

        req = AuthorizationRequest(**bib)
        areq = AuthorizationRequest(
            response_type="code",
            client_id="client_1",
            redirect_uri="http://example.com/authz",
            scope=["openid"],
            state="state000",
        )

        sdb = self.provider.sdb
        ae = AuthnEvent("userX", "salt")
        sid = sdb.create_authz_session(ae, areq)
        sdb.do_sub(sid, "client_salt")
        _info = sdb[sid]
        # All this is jut removed when the id_token is constructed
        # The proper information comes from the session information
        _user_info = IdToken(
            iss="https://foo.example.om",
            sub="foo",
            aud=bib["client_id"],
            exp=epoch_in_a_while(minutes=10),
            acr="2",
            nonce=bib["nonce"],
        )

        idt = self.provider.id_token_as_signed_jwt(_info, access_token="access_token", user_info=_user_info)

        req["id_token"] = idt
        query_string = req.to_urlencoded()

        # client_id not in id_token["aud"] so login required
        resp = self.provider.authorization_endpoint(request=query_string, cookie="FAIL")
        parsed_resp = parse_qs(urlparse(resp.message).fragment)
        assert parsed_resp["error"][0] == "login_required"

        req["client_id"] = "client_1"
        query_string = req.to_urlencoded()

        # client_id is in id_token["aud"] so no login required
        resp = self.provider.authorization_endpoint(request=query_string, cookie="FAIL")

        assert resp.message.startswith("http://localhost:8087/authz")

def test_authz_request():
    example = "https://server.example.com/authorize?response_type=token%20id_token&client_id=0acf77d4-b486-4c99-bd76-074ed6a64ddf&redirect_uri=https%3A%2F%2Fclient.example.com%2Fcb&scope=openid%20profile&state=af0ifjsldkj&nonce=n-0S6_WzA2Mj"

    req = AuthorizationRequest().deserialize(example.split("?")[1],
                                             "urlencoded")

    print req.keys()
    assert _eq(req.keys(), ['nonce', 'state', 'redirect_uri', 'response_type',
                            'client_id', 'scope'])

    assert req["response_type"] == ["token", "id_token"]
    assert req["scope"] == ["openid", "profile"]