0001-idp_oidc-make-access_token-validity-depends-on-expir.patch

Benjamin Dauvergne, 27 novembre 2020 08:12

Voir les différences: en ligne côte à côte

Subject: [PATCH] idp_oidc: make access_token validity depends on expiration or
 session existence (#48889)

 .../migrations/0014_auto_20201126_1812.py     | 18 ++++++
 src/authentic2_idp_oidc/models.py             | 36 ++++++-----
 src/authentic2_idp_oidc/views.py              | 27 +++++---
 tests/test_idp_oidc.py                        | 64 ++++++++++++++++++-
 4 files changed, 118 insertions(+), 27 deletions(-)
 create mode 100644 src/authentic2_idp_oidc/migrations/0014_auto_20201126_1812.py

     # Generated by Django 2.2.17 on 2020-11-26 17:12
     from django.db import migrations, models
     class Migration(migrations.Migration):
         dependencies = [
             ('authentic2_idp_oidc', '0013_auto_20200630_1007'),
+        ]
         operations = [
             migrations.AlterField(
                 model_name='oidcaccesstoken',
                 name='expired',
                 field=models.DateTimeField(null=True, verbose_name='expire'),
             ),
+        ]

     from django.utils.translation import ugettext_lazy as _
     from django.conf import settings
     from django.utils import six
     from django.utils.functional import cached_property
     from django.utils.timezone import now
     from django.utils.six.moves.urllib import parse as urlparse
     from django.contrib.contenttypes.fields import GenericForeignKey, GenericRelation
-...
         return u'\n'.join([url for url in data.split()])
     def get_session(session_key):
         engine = import_module(settings.SESSION_ENGINE)
         session = engine.SessionStore(session_key=session_key)
         session.load()
         if session._session_key == session_key:
             return session
         return None
     class OIDCClient(Service):
         POLICY_UUID = 1
         POLICY_PAIRWISE = 2
-...
         objects = managers.OIDCExpiredManager()
         @property
         @cached_property
         def session(self):
             if not hasattr(self, '_session'):
                 engine = import_module(settings.SESSION_ENGINE)
                 session = engine.SessionStore(session_key=self.session_key)
                 session.load()
                 if session._session_key == self.session_key:
                     self._session = session
             return getattr(self, '_session', None)
             return self.session_key and get_session(self.session_key)
         def scope_set(self):
             return utils.scope_set(self.scopes)
-...
             verbose_name=_('created'),
             auto_now_add=True)
         expired = models.DateTimeField(
             verbose_name=_('expire'))
             verbose_name=_('expire'),
             null=True)
         objects = managers.OIDCExpiredManager()
         def scope_set(self):
             return utils.scope_set(self.scopes)
         @property
         @cached_property
         def session(self):
             if not hasattr(self, '_session'):
                 engine = import_module(settings.SESSION_ENGINE)
                 session = engine.SessionStore(session_key=self.session_key)
                 if session._session_key == self.session_key:
                     self._session = session
             return getattr(self, '_session', None)
             return self.session_key and get_session(self.session_key)
         def is_valid(self):
             return self.expired >= now() and self.session is not None
             return ((self.expired is None or self.expired >= now())
                     and (self.session_key == ''
                          or get_session(self.session_key) is not None))
         def __repr__(self):
             return '<OIDCAccessToken uuid:%s client:%s user:%s expired:%s scopes:%s>' % (

         return client.idtoken_duration or datetime.timedelta(seconds=app_settings.IDTOKEN_DURATION)
     def access_token_duration(client):
         return client.access_token_duration or datetime.timedelta(seconds=app_settings.IDTOKEN_DURATION)
     def allowed_scopes(client):
         return client.scope_set() or app_settings.SCOPES or ['openid', 'email', 'profile']
-...
         else:
             # FIXME: we should probably factorize this part with the token endpoint similar code
             need_access_token = 'token' in response_type.split()
             expires_in = access_token_duration(client)
             if need_access_token:
                 if client.access_token_duration is None:
                     expires_in = datetime.timedelta(request.session.get_expiry_age())
                     expired = None
                 else:
                     expires_in = client.access_token_duration
                     expired = start + client.access_token_duration
                 access_token = models.OIDCAccessToken.objects.create(
                     client=client,
                     user=request.user,
                     scopes=u' '.join(scopes),
                     session_key=request.session.session_key,
                     expired=start + expires_in)
                     expired=expired)
             acr = '0'
             if nonce is not None and last_auth.get('nonce') == nonce:
                 acr = '1'
-...
         exponential_backoff.success(*backoff_keys)
         start = now()
         # make access_token
         expires_in = access_token_duration(client)
         if client.access_token_duration is None:
             expires_in = datetime.timedelta(seconds=app_settings.ACCESS_TOKEN_DURATION)
         else:
             expires_in = client.access_token_duration
         access_token = models.OIDCAccessToken.objects.create(
             client=client,
             user=user,
-...
         redirect_uri = request.POST.get('redirect_uri')
         if oidc_code.redirect_uri != redirect_uri:
             return invalid_request_response('invalid redirect_uri')
         expires_in = access_token_duration(client)
         if client.access_token_duration is None:
             expires_in = datetime.timedelta(oidc_code.session.get_expiry_age())
             expired = None
         else:
             expires_in = client.access_token_duration
             expired = oidc_code.created + expires_in
         access_token = models.OIDCAccessToken.objects.create(
             client=client,
             user=oidc_code.user,
             scopes=oidc_code.scopes,
             session_key=oidc_code.session_key,
             expired=oidc_code.created + expires_in)
             expired=expired)
         start = now()
         acr = '0'
         if (oidc_code.nonce is not None

     # along with this program.  If not, see <http://www.gnu.org/licenses/>.
     import base64
     import json
     import datetime
     from importlib import import_module
     import json
     import pytest
-...
             'button', {'class': 'authorized-oauth-services--revoke-button'})) == 1
         assert OIDCAuthorization.objects.filter(
             client_ct=ContentType.objects.get_for_model(OU)).count() == 0
     @pytest.fixture
     def session(settings, db):
         engine = import_module(settings.SESSION_ENGINE)
         session = engine.SessionStore()
         session.create()
         return session
     def test_access_token_is_valid_session(simple_oidc_client, simple_user, session):
         token = OIDCAccessToken.objects.create(
             client=simple_oidc_client,
             user=simple_user,
             scopes='openid',
             session_key=session.session_key)
         assert token.is_valid()
         session.flush()
         assert not token.is_valid()
     def test_access_token_is_valid_expired(simple_oidc_client, simple_user, freezer):
         start = now()
         expired = start + datetime.timedelta(seconds=30)
         token = OIDCAccessToken.objects.create(
             client=simple_oidc_client,
             user=simple_user,
             scopes='openid',
             expired=expired)
         assert token.is_valid()
         freezer.move_to(expired)
         assert token.is_valid()
         freezer.move_to(expired + datetime.timedelta(seconds=1))
         assert not token.is_valid()
     def test_access_token_is_valid_session_and_expired(simple_oidc_client,
                                                        simple_user,
                                                        session, freezer):
         start = now()
         expired = start + datetime.timedelta(seconds=30)
         token = OIDCAccessToken.objects.create(
             client=simple_oidc_client,
             user=simple_user,
             scopes='openid',
             session_key=session.session_key,
             expired=expired)
         assert token.is_valid()
         freezer.move_to(expired)
         assert token.is_valid()
         freezer.move_to(expired + datetime.timedelta(seconds=1))
         assert not token.is_valid()
         freezer.move_to(start)
         assert token.is_valid()
         session.flush()
         assert not token.is_valid()
+    -

Projet

Général

Profil

Produits Entr'ouvert » Authentic 2

0001-idp_oidc-make-access_token-validity-depends-on-expir.patch