Python SessionDB.refresh_token方法代码示例

# 需要导入模块: from oic.utils.sdb import SessionDB [as 别名]
# 或者: from oic.utils.sdb.SessionDB import refresh_token [as 别名]
def test_revoke_token():
    sdb = SessionDB()
    sid = sdb.create_authz_session("user_id", AREQ)

    grant = sdb[sid]["code"]
    _dict = sdb.update_to_token(grant)

    token = _dict["access_token"]
    rtoken = _dict["refresh_token"]
    
    assert sdb.is_valid(token)

    sdb.revoke_token(token)
    assert sdb.is_valid(token) is False

    dict2 = sdb.refresh_token(rtoken)
    token = dict2["access_token"]
    assert sdb.is_valid(token)

    sdb.revoke_token(rtoken)
    assert sdb.is_valid(rtoken) is False

    raises(ExpiredToken, 'sdb.refresh_token(rtoken)')

    assert sdb.is_valid(token)

    # --- new token ----

    sdb = SessionDB()
    sid = sdb.create_authz_session("user_id", AREQ)

    grant = sdb[sid]["code"]
    sdb.revoke_token(grant)
    assert sdb.is_valid(grant) is False

# 需要导入模块: from oic.utils.sdb import SessionDB [as 别名]
# 或者: from oic.utils.sdb.SessionDB import refresh_token [as 别名]
def test_refresh_token():
    sdb = SessionDB()
    sid = sdb.create_authz_session("user_id", AREQ)
    grant = sdb[sid]["code"]
    _dict = sdb.update_to_token(grant)
    dict1 = _dict.copy()

    rtoken = _dict["refresh_token"]
    time.sleep(1)
    dict2 = sdb.refresh_token(rtoken)
    print dict2
    
    assert dict1["issued"] != dict2["issued"]
    assert dict1["access_token"] != dict2["access_token"]

    raises(Exception, 'sdb.refresh_token(dict2["access_token"])')

# 需要导入模块: from oic.utils.sdb import SessionDB [as 别名]
# 或者: from oic.utils.sdb.SessionDB import refresh_token [as 别名]
def test_refresh_token():
    sdb = SessionDB(BASE_URL)
    ae = AuthnEvent("sub")
    sid = sdb.create_authz_session(ae, AREQ)
    grant = sdb[sid]["code"]
    _dict = sdb.upgrade_to_token(grant)
    dict1 = _dict.copy()

    rtoken = _dict["refresh_token"]
    time.sleep(1)
    dict2 = sdb.refresh_token(rtoken)
    print dict2
    
    assert dict1["token_expires_at"] != dict2["token_expires_at"]
    assert dict1["access_token"] != dict2["access_token"]

    raises(Exception, 'sdb.refresh_token(dict2["access_token"])')

# 需要导入模块: from oic.utils.sdb import SessionDB [as 别名]
# 或者: from oic.utils.sdb.SessionDB import refresh_token [as 别名]
def test_is_valid():
    sdb = SessionDB(BASE_URL)
    ae1 = AuthnEvent("sub")
    sid = sdb.create_authz_session(ae1, AREQ)
    grant = sdb[sid]["code"]

    assert sdb.is_valid(grant)

    _dict = sdb.upgrade_to_token(grant)
    assert sdb.is_valid(grant) is False
    token1 = _dict["access_token"]
    assert sdb.is_valid(token1)

    rtoken = _dict["refresh_token"]
    assert sdb.is_valid(rtoken)

    dict2 = sdb.refresh_token(rtoken)
    token2 = dict2["access_token"]
    assert sdb.is_valid(token2)

    # replace refresh_token

    dict2["refresh_token"] = token2
    assert sdb.is_valid(rtoken) is False
    
    # mess with the time-line

    dict2["token_expires_at"] = utc_time_sans_frac() - 86400
    assert sdb.is_valid(token2) is False

    # replace access_token

    dict2["access_token"] = token1
    assert sdb.is_valid(token2) is False

    ae = AuthnEvent("another:user")
    sid = sdb.create_authz_session(ae, AREQ)
    grant = sdb[sid]["code"]

    gdict = sdb[grant]
    gdict["token_expires_at"] = utc_time_sans_frac() - 86400
    assert sdb.is_valid(grant) is False

# 需要导入模块: from oic.utils.sdb import SessionDB [as 别名]
# 或者: from oic.utils.sdb.SessionDB import refresh_token [as 别名]
def test_is_valid():
    sdb = SessionDB()
    sid = sdb.create_authz_session("user_id", AREQ)
    grant = sdb[sid]["code"]

    assert sdb.is_valid(grant)

    _dict = sdb.update_to_token(grant)
    assert sdb.is_valid(grant) is False
    token1 = _dict["access_token"]
    assert sdb.is_valid(token1)

    rtoken = _dict["refresh_token"]
    assert sdb.is_valid(rtoken)

    dict2 = sdb.refresh_token(rtoken)
    token2 = dict2["access_token"]
    assert sdb.is_valid(token2)

    # replace refresh_token

    dict2["refresh_token"] = token2
    assert sdb.is_valid(rtoken) is False
    
    # mess with the time-line

    dict2["expires_at"] = utc_time_sans_frac() - 86400  # like yesterday
    assert sdb.is_valid(token2) is False

    # replace access_token

    dict2["access_token"] = token1
    assert sdb.is_valid(token2) is False

    sid = sdb.create_authz_session("another:user", AREQ)
    grant = sdb[sid]["code"]

    gdict = sdb[grant]
    gdict["expires_at"] = utc_time_sans_frac() - 86400  # like yesterday
    assert sdb.is_valid(grant) is False

# 需要导入模块: from oic.utils.sdb import SessionDB [as 别名]
# 或者: from oic.utils.sdb.SessionDB import refresh_token [as 别名]
def test_revoke_token():
    sdb = SessionDB(BASE_URL)
    ae1 = AuthnEvent("sub")
    sid = sdb.create_authz_session(ae1, AREQ)

    grant = sdb[sid]["code"]
    _dict = sdb.upgrade_to_token(grant)

    token = _dict["access_token"]
    rtoken = _dict["refresh_token"]
    
    assert sdb.is_valid(token)

    sdb.revoke_token(token)
    assert sdb.is_valid(token) is False

    dict2 = sdb.refresh_token(rtoken)
    token = dict2["access_token"]
    assert sdb.is_valid(token)

    sdb.revoke_token(rtoken)
    assert sdb.is_valid(rtoken) is False

    raises(ExpiredToken, 'sdb.refresh_token(rtoken)')

    assert sdb.is_valid(token)

    # --- new token ----

    sdb = SessionDB(BASE_URL)
    ae2 = AuthnEvent("sub")
    sid = sdb.create_authz_session(ae2, AREQ)

    grant = sdb[sid]["code"]
    sdb.revoke_token(grant)
    assert sdb.is_valid(grant) is False

# 需要导入模块: from oic.utils.sdb import SessionDB [as 别名]
# 或者: from oic.utils.sdb.SessionDB import refresh_token [as 别名]
class TestSessionDB(object):
    @pytest.fixture(autouse=True)
    def create_sdb(self):
        kb = KeyBundle(JWKS["keys"])
        kj = KeyJar()
        kj.issuer_keys[''] = [kb]

        self.sdb = SessionDB(
            "https://example.com/",
            token_factory=JWTToken('T', keyjar=kj,
                                   lt_pattern={'code': 3600, 'token': 900},
                                   iss='https://example.com/as',
                                   sign_alg='RS256'),
            refresh_token_factory=JWTToken(
                'R', keyjar=kj, lt_pattern={'': 24 * 3600},
                iss='https://example.com/as')
        )

    def test_create_authz_session(self):
        ae = AuthnEvent("uid", "salt")
        sid = self.sdb.create_authz_session(ae, AREQ)
        self.sdb.do_sub(sid, "client_salt")

        info = self.sdb[sid]
        assert info["oauth_state"] == "authz"

    def test_create_authz_session_without_nonce(self):
        ae = AuthnEvent("sub", "salt")
        sid = self.sdb.create_authz_session(ae, AREQ)
        info = self.sdb[sid]
        assert info["oauth_state"] == "authz"

    def test_create_authz_session_with_nonce(self):
        ae = AuthnEvent("sub", "salt")
        sid = self.sdb.create_authz_session(ae, AREQN)
        info = self.sdb[sid]
        assert info["nonce"] == "something"

    def test_create_authz_session_with_id_token(self):
        ae = AuthnEvent("sub", "salt")
        sid = self.sdb.create_authz_session(ae, AREQN, id_token="id_token")

        info = self.sdb[sid]
        assert info["id_token"] == "id_token"

    def test_create_authz_session_with_oidreq(self):
        ae = AuthnEvent("sub", "salt")
        sid = self.sdb.create_authz_session(ae, AREQN, oidreq=OIDR)
        info = self.sdb[sid]
        assert "id_token" not in info
        assert "oidreq" in info

    def test_create_authz_session_with_sector_id(self):
        ae = AuthnEvent("sub", "salt")
        sid = self.sdb.create_authz_session(ae, AREQN, oidreq=OIDR)
        self.sdb.do_sub(sid, "client_salt", "http://example.com/si.jwt",
                        "pairwise")

        info_1 = self.sdb[sid].copy()
        assert "id_token" not in info_1
        assert "oidreq" in info_1
        assert info_1["sub"] != "sub"

        self.sdb.do_sub(sid, "client_salt", "http://example.net/si.jwt",
                        "pairwise")

        info_2 = self.sdb[sid]
        assert info_2["sub"] != "sub"
        assert info_2["sub"] != info_1["sub"]

    def test_upgrade_to_token(self):
        ae1 = AuthnEvent("uid", "salt")
        sid = self.sdb.create_authz_session(ae1, AREQ)
        self.sdb[sid]['sub'] = 'sub'
        grant = self.sdb[sid]["code"]
        _dict = self.sdb.upgrade_to_token(grant)

        #print(_dict.keys())
        assert _eq(list(_dict.keys()),
                   ['authn_event', 'code', 'authzreq', 'revoked',
                    'access_token', 'token_type', 'state', 'redirect_uri',
                    'code_used', 'client_id', 'scope', 'oauth_state',
                    'access_token_scope', 'sub', 'response_type'])

        # can't update again
        with pytest.raises(AccessCodeUsed):
            self.sdb.upgrade_to_token(grant)
            self.sdb.upgrade_to_token(_dict["access_token"])

    def test_upgrade_to_token_refresh(self):
        ae1 = AuthnEvent("sub", "salt")
        sid = self.sdb.create_authz_session(ae1, AREQO)
        self.sdb.do_sub(sid, ae1.salt)
        grant = self.sdb[sid]["code"]
        _dict = self.sdb.upgrade_to_token(grant, issue_refresh=True)

        #print(_dict.keys())
        assert _eq(_dict.keys(),
                   ['authn_event', 'code', 'authzreq', 'revoked',
                    'access_token', 'response_type',
#.........这里部分代码省略.........

# 需要导入模块: from oic.utils.sdb import SessionDB [as 别名]
# 或者: from oic.utils.sdb.SessionDB import refresh_token [as 别名]
class MyFakeOICServer(Server):
    def __init__(self, name=""):
        Server.__init__(self)
        self.sdb = SessionDB()
        self.name = name
        self.client = {}
        self.registration_expires_in = 3600
        self.host = ""
        self.webfinger = WebFinger()

    #noinspection PyUnusedLocal
    def http_request(self, path, method="GET", **kwargs):
        part = urlparse(path)
        path = part[2]
        query = part[4]
        self.host = "%s://%s" % (part.scheme, part.netloc)

        response = Response
        response.status_code = 500
        response.text = ""

        if path == ENDPOINT["authorization_endpoint"]:
            assert method == "GET"
            response = self.authorization_endpoint(query)
        elif path == ENDPOINT["token_endpoint"]:
            assert method == "POST"
            response = self.token_endpoint(kwargs["data"])
        elif path == ENDPOINT["user_info_endpoint"]:
            assert method == "POST"
            response = self.userinfo_endpoint(kwargs["data"])
        elif path == ENDPOINT["refresh_session_endpoint"]:
            assert method == "GET"
            response = self.refresh_session_endpoint(query)
        elif path == ENDPOINT["check_session_endpoint"]:
            assert method == "GET"
            response = self.check_session_endpoint(query)
        elif path == ENDPOINT["end_session_endpoint"]:
            assert method == "GET"
            response = self.end_session_endpoint(query)
        elif path == ENDPOINT["registration_endpoint"]:
            if method == "POST":
                response = self.registration_endpoint(kwargs["data"])
        elif path == "/.well-known/webfinger":
            assert method == "GET"
            qdict = parse_qs(query)
            response.status_code = 200
            response.text = self.webfinger.response(qdict["resource"][0],
                                                    "%s/" % self.name)
        elif path == "/.well-known/openid-configuration":
            assert method == "GET"
            response = self.openid_conf()

        return response

    def authorization_endpoint(self, query):
        req = self.parse_authorization_request(query=query)
        sid = self.sdb.create_authz_session(sub="user", areq=req)
        _info = self.sdb[sid]
        _info["sub"] = _info["local_sub"]

        if "code" in req["response_type"]:
            if "token" in req["response_type"]:
                grant = _info["code"]
                _dict = self.sdb.upgrade_to_token(grant)
                _dict["oauth_state"] = "authz",

                _dict = by_schema(AuthorizationResponse(), **_dict)
                resp = AuthorizationResponse(**_dict)
                #resp.code = grant
            else:
                resp = AuthorizationResponse(state=req["state"],
                                             code=_info["code"])

        else:  # "implicit" in req.response_type:
            grant = _info["code"]
            params = AccessTokenResponse.c_param.keys()

            _dict = dict([(k, v) for k, v in
                          self.sdb.upgrade_to_token(grant).items() if k in
                                                                     params])
            try:
                del _dict["refresh_token"]
            except KeyError:
                pass

            if "id_token" in req["response_type"]:
                _idt = self.make_id_token(_info, issuer=self.name,
                                          access_token=_dict["access_token"])
                alg = "RS256"
                ckey = self.keyjar.get_signing_key(alg2keytype(alg),
                                                   _info["client_id"])
                _dict["id_token"] = _idt.to_jwt(key=ckey, algorithm=alg)

            resp = AccessTokenResponse(**_dict)

        location = resp.request(req["redirect_uri"])
        response = Response()
        response.headers = {"location": location}
        response.status_code = 302
        response.text = ""
#.........这里部分代码省略.........

# 需要导入模块: from oic.utils.sdb import SessionDB [as 别名]
# 或者: from oic.utils.sdb.SessionDB import refresh_token [as 别名]
class MyFakeOICServer(Server):
    def __init__(self, jwt_keys=None, name=""):
        Server.__init__(self, jwt_keys=jwt_keys)
        self.sdb = SessionDB()
        self.name = name
        self.client = {}
        self.registration_expires_in = 3600
        self.host = ""

    #noinspection PyUnusedLocal
    def http_request(self, path, method="GET", **kwargs):
        part = urlparse.urlparse(path)
        path = part[2]
        query = part[4]
        self.host = "%s://%s" % (part.scheme, part.netloc)

        response = Response
        response.status_code = 500
        response.text = ""

        if path == ENDPOINT["authorization_endpoint"]:
            assert method == "GET"
            response = self.authorization_endpoint(query)
        elif path == ENDPOINT["token_endpoint"]:
            assert method == "POST"
            response = self.token_endpoint(kwargs["data"])
        elif path == ENDPOINT["user_info_endpoint"]:
            assert method == "POST"
            response = self.userinfo_endpoint(kwargs["data"])
        elif path == ENDPOINT["refresh_session_endpoint"]:
            assert method == "GET"
            response = self.refresh_session_endpoint(query)
        elif path == ENDPOINT["check_session_endpoint"]:
            assert method == "GET"
            response = self.check_session_endpoint(query)
        elif path == ENDPOINT["end_session_endpoint"]:
            assert method == "GET"
            response = self.end_session_endpoint(query)
        elif path == ENDPOINT["registration_endpoint"]:
            if method == "POST":
                response = self.registration_endpoint(kwargs["data"])
        elif path == "/.well-known/simple-web-discovery":
            assert method == "GET"
            response = self.issuer(query)
        elif path == "/swd_server":
            assert method == "GET"
            response = self.swd_server(query)
        elif path == "/.well-known/openid-configuration"\
        or path == "/providerconf/.well-known/openid-configuration":
            assert method == "GET"
            response = self.openid_conf()

        return response

    def authorization_endpoint(self, query):
        req = self.parse_authorization_request(query=query)
        sid = self.sdb.create_authz_session(user_id="user", areq=req)
        _info = self.sdb[sid]

        if "code" in req["response_type"]:
            if "token" in req["response_type"]:
                grant = _info["code"]
                _dict = self.sdb.update_to_token(grant)
                _dict["oauth_state"]="authz",

                _dict = by_schema(AuthorizationResponse(), **_dict)
                resp = AuthorizationResponse(**_dict)
                #resp.code = grant
            else:
                resp = AuthorizationResponse(state=req["state"],
                                             code=_info["code"])

        else: # "implicit" in req.response_type:
            grant = _info["code"]
            params = AccessTokenResponse.c_param.keys()

            _dict = dict([(k,v) for k,
                        v in self.sdb.update_to_token(grant).items() if k in
                                                                    params])
            try:
                del _dict["refresh_token"]
            except KeyError:
                pass

            if "id_token" in req["response_type"]:
                _dict["id_token"] = self.make_id_token(_info, issuer=self.name,
                                            access_token=_dict["access_token"])

            resp = AccessTokenResponse(**_dict)

        location = resp.request(req["redirect_uri"])
        response= Response()
        response.headers = {"location":location}
        response.status_code = 302
        response.text = ""
        return response

    def token_endpoint(self, data):
        if "grant_type=refresh_token" in data:
            req = self.parse_refresh_token_request(body=data)
#.........这里部分代码省略.........

# 需要导入模块: from oic.utils.sdb import SessionDB [as 别名]
# 或者: from oic.utils.sdb.SessionDB import refresh_token [as 别名]

#.........这里部分代码省略.........
    def test_upgrade_to_token(self):
        ae1 = AuthnEvent("uid", "salt")
        sid = self.sdb.create_authz_session(ae1, AREQ)
        self.sdb[sid]['sub'] = 'sub'
        grant = self.sdb[sid]["code"]
        _dict = self.sdb.upgrade_to_token(grant)

        print(_dict.keys())
        assert _eq(list(_dict.keys()),
                   ['authn_event', 'code', 'authzreq', 'revoked',
                    'access_token', 'token_expires_at', 'expires_in',
                    'token_type', 'state', 'redirect_uri', 'code_used',
                    'client_id', 'scope', 'oauth_state', 'access_token_scope',
                    'sub'])

        # can't update again
        with pytest.raises(AccessCodeUsed):
            self.sdb.upgrade_to_token(grant)
            self.sdb.upgrade_to_token(_dict["access_token"])

    def test_upgrade_to_token_refresh(self):
        ae1 = AuthnEvent("sub", "salt")
        sid = self.sdb.create_authz_session(ae1, AREQO)
        self.sdb.do_sub(sid, ae1.salt)
        grant = self.sdb[sid]["code"]
        _dict = self.sdb.upgrade_to_token(grant, issue_refresh=True)

        print(_dict.keys())
        assert _eq(_dict.keys(),
                   ['authn_event', 'code', 'authzreq', 'revoked',
                    'access_token', 'token_expires_at', 'expires_in',
                    'token_type', 'state', 'redirect_uri', 'code_used',
                    'client_id', 'scope', 'oauth_state', 'access_token_scope',
                    'refresh_token', 'sub'])

        # can't update again
        with pytest.raises(AccessCodeUsed):
            self.sdb.upgrade_to_token(grant)
            self.sdb.upgrade_to_token(_dict["access_token"])

    def test_upgrade_to_token_with_id_token_and_oidreq(self):
        ae2 = AuthnEvent("another_user_id", "salt")
        sid = self.sdb.create_authz_session(ae2, AREQ)
        self.sdb[sid]['sub'] = 'sub'
        grant = self.sdb[sid]["code"]

        _dict = self.sdb.upgrade_to_token(grant, id_token="id_token",
                                          oidreq=OIDR)
        print(_dict.keys())
        assert _eq(list(_dict.keys()),
                   ['authn_event', 'code', 'authzreq', 'revoked', 'oidreq',
                    'access_token', 'id_token', 'token_expires_at',
                    'expires_in', 'token_type', 'state', 'redirect_uri',
                    'code_used', 'client_id', 'scope', 'oauth_state',
                    'access_token_scope', 'sub'])

        assert _dict["id_token"] == "id_token"
        assert isinstance(_dict["oidreq"], OpenIDRequest)

    def test_refresh_token(self):
        ae = AuthnEvent("uid", "salt")
        sid = self.sdb.create_authz_session(ae, AREQ)
        self.sdb[sid]['sub'] = 'sub'
        grant = self.sdb[sid]["code"]

        with mock.patch("time.gmtime", side_effect=[

# 需要导入模块: from oic.utils.sdb import SessionDB [as 别名]
# 或者: from oic.utils.sdb.SessionDB import refresh_token [as 别名]
class MyFakeOAuth2Server(Server):
    def __init__(self, jwt_keys=None, name=""):
        Server.__init__(self, jwt_keys=jwt_keys)
        self.sdb = SessionDB()
        self.name = name
        self.client = {}
        self.registration_expires_in = 3600
        self.host = ""

    #noinspection PyUnusedLocal
    def http_request(self, url, method="GET", **kwargs):
        part = urlparse.urlparse(url)
        path = part[2]
        query = part[4]
        self.host = "%s://%s" % (part.scheme, part.netloc)

        response = Response
        response.status_code = 500
        response.text = ""

        if path == ENDPOINT["authorization_endpoint"]:
            assert method == "GET"
            response = self.authorization_endpoint(query)
        elif path == ENDPOINT["token_endpoint"]:
            assert method == "POST"
            response = self.token_endpoint(kwargs["data"])

        return response

    def authorization_endpoint(self, query):
        req = self.parse_authorization_request(query=query)
        sid = self.sdb.create_authz_session(user_id="user", areq=req)
        _info = self.sdb[sid]

        if "code" in req["response_type"]:
            if "token" in req["response_type"]:
                grant = _info["code"]
                _dict = self.sdb.update_to_token(grant)
                _dict["oauth_state"]="authz",

                _dict = by_schema(AuthorizationResponse(), **_dict)
                resp = AuthorizationResponse(**_dict)
                #resp.code = grant
            else:
                resp = AuthorizationResponse(state=req["state"],
                                             code=_info["code"])

        else: # "implicit" in req.response_type:
            grant = _info["code"]
            params = AccessTokenResponse.c_param.keys()

            _dict = dict([(k,v) for k,
                                    v in self.sdb.update_to_token(grant).items() if k in
                                                                                    params])
            try:
                del _dict["refresh_token"]
            except KeyError:
                pass

            resp = AccessTokenResponse(**_dict)

        location = resp.request(req["redirect_uri"])
        response= Response()
        response.headers = {"location":location}
        response.status_code = 302
        response.text = ""
        return response

    def token_endpoint(self, data):
        if "grant_type=refresh_token" in data:
            req = self.parse_refresh_token_request(body=data)
            _info = self.sdb.refresh_token(req["refresh_token"])
        elif "grant_type=authorization_code":
            req = self.parse_token_request(body=data)
            _info = self.sdb.update_to_token(req["code"])
        else:
            response = TokenErrorResponse(error="unsupported_grant_type")
            return response, ""

        resp = AccessTokenResponse(**by_schema(AccessTokenResponse, **_info))
        response = Response()
        response.headers = {"content-type":"application/json"}
        response.text = resp.to_json()

        return response