Produits Entr'ouvert » Authentic 2

import logging

logger = logging.getLogger(__name__)

    def a2_hook_idp_oidc_modify_user_info(self, client, user, scope_set, user_info, profile=None):

        """Removes any extra scope and their associated claims whenever the user selects a profile"""

        from authentic2_idp_oidc.models import OIDCClaim

        extra_scopes = scope_set - {'openid', 'email', 'profile'}

        if profile and extra_scopes:

            logger.info(

                'idp_oidc: profile of type %s chosen by user %s for client %s, discarding scopes %s',

                profile.profile_type,

                user,

                client,

                ' '.join(extra_scopes),

            )

            scope_set -= extra_scopes

            extra_claims = []

            for claim in OIDCClaim.objects.filter(client=client, name__in=user_info.keys()):

                if set(claim.get_scopes()) & extra_scopes and not set(claim.get_scopes()) & scope_set:

                    extra_claims.append(claim.name)

            for claim in extra_claims:

                user_info.pop(claim)

      <div id="profile-validation">

      <p>{% trans "You may authenticate as owner of the following management profile, which may change the aforementioned information." %}</p>

      {% if "email" in scopes %}

      <p>{% blocktrans with client_name=client.name %}In this case, {{ client_name }} will collect your managenement profile email address instead of your personal email address.{% endblocktrans %}</p>

      {% endif %}

      {% if "profile" in scopes %}

      <p>{% blocktrans with client_name=client.name %}{{ client_name }} will still collect your first name, your last name and your username.{% endblocktrans %}</p>

      {% endif %}

      {% if extra_scopes %}

      {% blocktrans with client_name=client.name %}Additional personal info will not be sent to {{ client_name }}.{% endblocktrans %}

      {% endif %}

    extra_scopes = scopes - {'openid', 'email', 'profile'}

                        'extra_scopes': extra_scopes,

from authentic2_idp_oidc.models import OIDCAccessToken, OIDCAuthorization, OIDCClaim, OIDCCode

def test_scopes_minimization(app, oidc_client, profile_user, profile_settings):

    oidc_client.idtoken_algo = oidc_client.ALGO_HMAC

    oidc_client.activate_user_profiles = True

    oidc_client.perform_sub_profile_substitution = True

    oidc_client.scope = 'openid profile email custom1 custom2 custom3'

    oidc_client.save()

    redirect_uri = oidc_client.redirect_uris.split()[0]

    oidcclaim_mapping = {

        'custom1': 'first_name',

        'custom2': 'last_name',

        'custom3': 'is_active',

    }

    for claim, value in oidcclaim_mapping.items():

        OIDCClaim.objects.create(

            client=oidc_client,

            name=claim,

            scopes=claim,

            value=value,

        )

    params = {

        'client_id': oidc_client.client_id,

        'scope': 'openid profile email custom1 custom2 custom3',

        'redirect_uri': redirect_uri,

        'state': 'xxx',

        'nonce': 'yyy',

        'login_hint': 'backoffice john@example.com',

        'response_type': 'code',

    }

    assert not OIDCCode.objects.count()

    assert not OIDCAuthorization.objects.count()

    authorize_url = make_url('oidc-authorize', params=params)

    utils.login(app, profile_user)

    response = app.get(authorize_url)

    response.form.set('profile-validation', profile_user.profiles.first().id)

    response = response.form.submit('accept')

    location = urllib.parse.urlparse(response['Location'])

    query = urllib.parse.parse_qs(location.query)

    code = query['code'][0]

    token_url = make_url('oidc-token')

    response = app.post(

        token_url,

        params={

            'grant_type': 'authorization_code',

            'code': code,

            'redirect_uri': oidc_client.redirect_uris.split()[0],

        },

        headers=client_authentication_headers(oidc_client),

    )

    assert response.json['access_token']

    id_token = response.json['id_token']

    k = base64.b64encode(oidc_client.client_secret.encode('utf-8'))

    key = JWK(kty='oct', k=force_text(k))

    algs = ['HS256']

    jwt = JWT(jwt=id_token, key=key, algs=algs)

    claims = json.loads(jwt.claims)

    assert not set(oidcclaim_mapping.keys()) & set(claims.keys())