Python JWT.pack方法代碼示例

# 需要導入模塊: from oic.utils.jwt import JWT [as 別名]
# 或者: from oic.utils.jwt.JWT import pack [as 別名]
def test_jwt_pack_and_unpack():
    srv = JWT(keyjar, iss=issuer)
    _jwt = srv.pack(sub="sub")

    info = srv.unpack(_jwt)

    assert _eq(info.keys(), ["jti", "iat", "exp", "iss", "sub", "kid"])

# 需要導入模塊: from oic.utils.jwt import JWT [as 別名]
# 或者: from oic.utils.jwt.JWT import pack [as 別名]
def test_jwt_pack_and_unpack():
    srv = JWT(keyjar, iss=issuer)
    _jwt = srv.pack(sub='sub')

    info = srv.unpack(_jwt)

    assert _eq(info.keys(), ['jti', 'iat', 'exp', 'iss', 'sub'])

# 需要導入模塊: from oic.utils.jwt import JWT [as 別名]
# 或者: from oic.utils.jwt.JWT import pack [as 別名]
def test_verify_id_token_at_hash_and_chash():
    token = 'AccessTokenWhichCouldBeASignedJWT'
    at_hash = left_hash(token)
    code = 'AccessCode1'
    c_hash = left_hash(code)

    idt = IdToken(**{
        "sub": "553df2bcf909104751cfd8b2",
        "aud": [
            "5542958437706128204e0000",
            "554295ce3770612820620000"
            ],
        "auth_time": 1441364872,
        "azp": "554295ce3770612820620000",
        "at_hash": at_hash,
        'c_hash': c_hash
        })

    kj = KeyJar()
    kj.add_symmetric("", 'dYMmrcQksKaPkhdgRNYk3zzh5l7ewdDJ', ['sig'])
    kj.add_symmetric("https://sso.qa.7pass.ctf.prosiebensat1.com",
                     'dYMmrcQksKaPkhdgRNYk3zzh5l7ewdDJ', ['sig'])
    packer = JWT(kj, sign_alg='HS256',
                 iss="https://sso.qa.7pass.ctf.prosiebensat1.com",
                 lifetime=3600)
    _jws = packer.pack(**idt.to_dict())
    msg = AuthorizationResponse(access_token=token, id_token=_jws, code=code)
    verify_id_token(msg, check_hash=True, keyjar=kj,
                    iss="https://sso.qa.7pass.ctf.prosiebensat1.com",
                    client_id="554295ce3770612820620000")

# 需要導入模塊: from oic.utils.jwt import JWT [as 別名]
# 或者: from oic.utils.jwt.JWT import pack [as 別名]
def test_verify_id_token_missing_c_hash():
    code = 'AccessCode1'

    idt = IdToken(**{
        "sub": "553df2bcf909104751cfd8b2",
        "aud": [
            "5542958437706128204e0000",
            "554295ce3770612820620000"
            ],
        "auth_time": 1441364872,
        "azp": "554295ce3770612820620000",
        })

    kj = KeyJar()
    kj.add_symmetric("", 'dYMmrcQksKaPkhdgRNYk3zzh5l7ewdDJ', ['sig'])
    kj.add_symmetric("https://sso.qa.7pass.ctf.prosiebensat1.com",
                     'dYMmrcQksKaPkhdgRNYk3zzh5l7ewdDJ', ['sig'])
    packer = JWT(kj, sign_alg='HS256',
                 iss="https://sso.qa.7pass.ctf.prosiebensat1.com",
                 lifetime=3600)
    _jws = packer.pack(**idt.to_dict())
    msg = AuthorizationResponse(code=code, id_token=_jws)
    with pytest.raises(MissingRequiredAttribute):
        verify_id_token(msg, check_hash=True, keyjar=kj,
                        iss="https://sso.qa.7pass.ctf.prosiebensat1.com",
                        client_id="554295ce3770612820620000")

# 需要導入模塊: from oic.utils.jwt import JWT [as 別名]
# 或者: from oic.utils.jwt.JWT import pack [as 別名]
def test_verify_id_token_at_hash_fail():
    token = 'AccessTokenWhichCouldBeASignedJWT'
    token2 = 'ACompletelyOtherAccessToken'
    lhsh = left_hash(token)

    idt = IdToken(**{
        "sub": "553df2bcf909104751cfd8b2",
        "aud": [
            "5542958437706128204e0000",
            "554295ce3770612820620000"
            ],
        "auth_time": 1441364872,
        "azp": "554295ce3770612820620000",
        "at_hash": lhsh
        })

    kj = KeyJar()
    kj.add_symmetric("", 'dYMmrcQksKaPkhdgRNYk3zzh5l7ewdDJ', ['sig'])
    kj.add_symmetric("https://sso.qa.7pass.ctf.prosiebensat1.com",
                     'dYMmrcQksKaPkhdgRNYk3zzh5l7ewdDJ', ['sig'])
    packer = JWT(kj, sign_alg='HS256',
                 iss="https://sso.qa.7pass.ctf.prosiebensat1.com",
                 lifetime=3600)
    _jws = packer.pack(**idt.to_dict())
    msg = AuthorizationResponse(access_token=token2, id_token=_jws)
    with pytest.raises(AtHashError):
        verify_id_token(msg, check_hash=True, keyjar=kj,
                        iss="https://sso.qa.7pass.ctf.prosiebensat1.com",
                        client_id="554295ce3770612820620000")

# 需要導入模塊: from oic.utils.jwt import JWT [as 別名]
# 或者: from oic.utils.jwt.JWT import pack [as 別名]
 def test_unpack_verify_key(self):
     srv = JWT(keyjar, iss=issuer)
     _jwt = srv.pack(sub="sub")
     # Remove the signing key from keyjar
     keyjar.remove_key("", "RSA", "")
     # And add it back as verify
     kb = keybundle_from_local_file(os.path.join(BASE_PATH, "cert.key"), "RSA", ["ver"])
     # keybundle_from_local_file doesn'assign kid, so assign manually
     kb._keys[0].kid = kidd["sig"]["RSA"]
     keyjar.add_kb("", kb)
     info = srv.unpack(_jwt)
     assert info["sub"] == "sub"

# 需要導入模塊: from oic.utils.jwt import JWT [as 別名]
# 或者: from oic.utils.jwt.JWT import pack [as 別名]
def make_software_statement(keyjar, iss, **kwargs):
    params = list(inspect.signature(JWT.__init__).parameters.keys())
    params.remove('self')

    args = {}
    for param in params:
        try:
            args[param] = kwargs[param]
        except KeyError:
            pass
        else:
            del kwargs[param]

    _jwt = JWT(keyjar, msgtype=SoftwareStatement, iss=iss, **args)
    return _jwt.pack(**kwargs)

# 需要導入模塊: from oic.utils.jwt import JWT [as 別名]
# 或者: from oic.utils.jwt.JWT import pack [as 別名]
def test_verify_token_encrypted_no_key():
    idt = IdToken(sub='553df2bcf909104751cfd8b2', aud=['5542958437706128204e0000', '554295ce3770612820620000'],
                  auth_time=1441364872, azp='554295ce3770612820620000')
    kj = KeyJar()
    kb = KeyBundle()
    kb.do_local_der(os.path.join(os.path.dirname(__file__), 'data', 'keys', 'cert.key'), 'some', ['enc', 'sig'])
    kj.add_kb('', kb)
    kj.add_kb('https://sso.qa.7pass.ctf.prosiebensat1.com', kb)

    packer = JWT(kj, lifetime=3600, iss='https://sso.qa.7pass.ctf.prosiebensat1.com', encrypt=True)
    _jws = packer.pack(**idt.to_dict())
    msg = AuthorizationResponse(id_token=_jws)
    # Do not pass they keyjar with keys
    with pytest.raises(VerificationError):
        verify_id_token(msg, keyjar=KeyJar(),
                        iss="https://sso.qa.7pass.ctf.prosiebensat1.com",
                        client_id="554295ce3770612820620000")

# 需要導入模塊: from oic.utils.jwt import JWT [as 別名]
# 或者: from oic.utils.jwt.JWT import pack [as 別名]
def test_verify_token_encrypted():
    idt = IdToken(sub='553df2bcf909104751cfd8b2', aud=['5542958437706128204e0000', '554295ce3770612820620000'],
                  auth_time=1441364872, azp='554295ce3770612820620000')
    kj = KeyJar()
    kb = KeyBundle()
    kb.do_local_der(os.path.join(os.path.dirname(__file__), 'data', 'keys', 'cert.key'), 'some', ['enc', 'sig'])
    kj.add_kb('', kb)
    kj.add_kb('https://sso.qa.7pass.ctf.prosiebensat1.com', kb)

    packer = JWT(kj, lifetime=3600, iss='https://sso.qa.7pass.ctf.prosiebensat1.com', encrypt=True)
    _jws = packer.pack(**idt.to_dict())
    msg = AuthorizationResponse(id_token=_jws)
    vidt = verify_id_token(msg, keyjar=kj,
                           iss="https://sso.qa.7pass.ctf.prosiebensat1.com",
                           client_id="554295ce3770612820620000")
    assert vidt
    assert vidt.jwe_header == {'enc': 'A128CBC-HS256', 'alg': 'RSA1_5', 'cty': 'JWT'}

# 需要導入模塊: from oic.utils.jwt import JWT [as 別名]
# 或者: from oic.utils.jwt.JWT import pack [as 別名]
def test_rpt():
    kb = KeyBundle(JWKS["keys"])
    kj = KeyJar()
    kj.issuer_keys[''] = [kb]

    token_factory = JWT(kj, lifetime=3600, iss=issuer)

    client_id = 'https://example.com/client'
    ressrv_id = 'https://rs.example.org/'

    rpt = token_factory.pack(kid='sign1', aud=[client_id, ressrv_id],
                             azp=ressrv_id, type='rpt')

    _rj = jws.factory(rpt)
    jti = json.loads(_rj.jwt.part[1].decode('utf8'))['jti']

    info = token_factory.unpack(rpt)
    assert set(info.keys()), {'aud', 'azp', 'ext', 'iat', 'iss', 'jti', 'kid',
                              'type'}

# 需要導入模塊: from oic.utils.jwt import JWT [as 別名]
# 或者: from oic.utils.jwt.JWT import pack [as 別名]
def test_verify_id_token_iss_not_in_keyjar():
    idt = IdToken(**{
        "sub": "553df2bcf909104751cfd8b2",
        "aud": [
            "5542958437706128204e0000",
            "554295ce3770612820620000"
            ],
        "auth_time": 1441364872,
        "azp": "554295ce3770612820620000",
        })

    kj = KeyJar()
    kj.add_symmetric("", 'dYMmrcQksKaPkhdgRNYk3zzh5l7ewdDJ', ['sig'])
    kj.add_symmetric("https://sso.qa.7pass.ctf.prosiebensat1.com",
                     'dYMmrcQksKaPkhdgRNYk3zzh5l7ewdDJ', ['sig'])
    packer = JWT(kj, sign_alg='HS256', lifetime=3600,
                 iss='https://example.com/op')
    _jws = packer.pack(**idt.to_dict())
    msg = AuthorizationResponse(id_token=_jws)
    with pytest.raises(ValueError):
        verify_id_token(msg, check_hash=True, keyjar=kj,
                        iss="https://sso.qa.7pass.ctf.prosiebensat1.com",
                        client_id="554295ce3770612820620000")

# 需要導入模塊: from oic.utils.jwt import JWT [as 別名]
# 或者: from oic.utils.jwt.JWT import pack [as 別名]
    def pack_metadata_statement(self, metadata, keyjar=None, iss=None, alg='',
                                **kwargs):
        """

        :param metas: Original metadata statement as a MetadataStatement
        instance
        :param keyjar: KeyJar in which the necessary keys should reside
        :param alg: Which signing algorithm to use
        :param kwargs: Additional metadata statement attribute values
        :return: A JWT
        """
        if iss is None:
            iss = self.iss
        if keyjar is None:
            keyjar = self.keyjar

        # Own copy
        _metadata = copy.deepcopy(metadata)
        _metadata.update(kwargs)
        _jwt = JWT(keyjar, iss=iss, msgtype=_metadata.__class__)
        if alg:
            _jwt.sign_alg = alg

        return _jwt.pack(cls_instance=_metadata)

# 需要導入模塊: from oic.utils.jwt import JWT [as 別名]
# 或者: from oic.utils.jwt.JWT import pack [as 別名]
def test_verify_id_token():
    idt = IdToken(**{
        "sub": "553df2bcf909104751cfd8b2",
        "aud": [
            "5542958437706128204e0000",
            "554295ce3770612820620000"
            ],
        "auth_time": 1441364872,
        "azp": "554295ce3770612820620000",
        })

    kj = KeyJar()
    kj.add_symmetric("", 'dYMmrcQksKaPkhdgRNYk3zzh5l7ewdDJ', ['sig'])
    kj.add_symmetric("https://sso.qa.7pass.ctf.prosiebensat1.com",
                     'dYMmrcQksKaPkhdgRNYk3zzh5l7ewdDJ', ['sig'])
    packer = JWT(kj, sign_alg='HS256',
                 iss="https://sso.qa.7pass.ctf.prosiebensat1.com",
                 lifetime=3600)
    _jws = packer.pack(**idt.to_dict())
    msg = AuthorizationResponse(id_token=_jws)
    vidt = verify_id_token(msg, keyjar=kj,
                           iss="https://sso.qa.7pass.ctf.prosiebensat1.com",
                           client_id="554295ce3770612820620000")
    assert vidt

# 需要導入模塊: from oic.utils.jwt import JWT [as 別名]
# 或者: from oic.utils.jwt.JWT import pack [as 別名]
 def create_access_token(self, key_thumbprint):
     # creating the access_token
     jwt_constructor = JWT(self.keyjar, iss=self.me)
     # Audience is myself
     return jwt_constructor.pack(
         kid='abc', cnf={'kid': key_thumbprint}, aud=self.me)

# 需要導入模塊: from oic.utils.jwt import JWT [as 別名]
# 或者: from oic.utils.jwt.JWT import pack [as 別名]
class ADB(object):
    """ Expects to be one ADB instance per Resource Server """

    def __init__(self, keyjar, rpt_lifetime, iss, ressrv_id, rsr_path,
                 ticket_lifetime=3600):
        # database with all permission requests
        self.permission_requests = PermissionRequests()
        # database with all authorization decisions
        self.authz_db = AuthzDB()
        # database with all registered permissions
        self.permit = Permission()
        # database with all the registered resource sets
        self.resource_set = MemResourceSetDB(
            rsr_path=rsr_path, delete_rsid=self.permit.delete_rsid)

        self.map_rsid_id = {}
        self.map_id_rsid = {}
        self.map_user_id = {}

        self.rpt_factory = JWT(keyjar, lifetime=rpt_lifetime, iss=iss)
        self.ticket_factory = JWT(keyjar, lifetime=ticket_lifetime, iss=iss)
        self.authzdesc_lifetime = 3600
        self.client_id = ressrv_id
        self.rsr_path = rsr_path
        self.ad2rpt = {}
        self.rpt2adid = {}

    def pending_permission_requests(self, owner, user):
        """
        Return outstanding permission requests that is known to belong to
        an owner and bound to a requestor.

        :param owner:
        :param user:
        :return:
        """
        res = []
        for tick in self.permission_requests.requestor2tickets(user):
            rsid = self.permission_requests.ticket2rsid(tick)
            if self.resource_set.belongs_to(rsid, owner):
                res.append(tick)
        return res

    def is_expired(self, tinfo):
        if utc_time_sans_frac() <= tinfo['exp']:
            return False
        return True

    def permission_request_allowed(self, ticket, identity):
        """
        Verify that whatever permission requests the ticket represents
        they are now allow.

        :param ticket: The ticket
        :param identity: Who has the ticket
        :return: Dictionary, with permission request as key and
            identifiers of authz decisions that permits the requests as values.
        """

        _tinfo = self.rpt_factory.unpack(ticket)
        if self.is_expired(_tinfo):
            raise TicketError('expired',
                              '{} > {}'.format(utc_time_sans_frac(),
                                               _tinfo['exp']))

        try:
            prrs = self.permission_requests[ticket]
        except KeyError:
            logger.warning("Someone is using a ticket that doesn't exist")
            raise TicketError('invalid', ticket)
        else:
            result = {}
            for prr in prrs:
                owner = self.resource_set.owner(prr['resource_set_id'])
                _adids = self.authz_db.match(owner, identity, **prr.to_dict())
                if not _adids:
                    # all or nothing
                    raise TicketError('not_authorized')
                result[prr.to_json()] = _adids
            return result

    def store_permission(self, permission, owner):
        """
        Store a permission

        :param permission: The permission to store
        :param owner: The user setting the permission
        :return: A permission ID
        """
        max_scopes = self.resource_set.read(
            owner, permission['resource_set_id'])["scopes"]

        # if no scopes are defined == all are requested
        try:
            _scopes = permission['scopes']
        except KeyError:
            permission['scopes'] = max_scopes
        else:
            permission['scopes'] = [s for s in _scopes if s in max_scopes]

#.........這裏部分代碼省略.........