Browse Source
fix: Refactor auto refresh (#415)
fix: Refactor auto refresh (#415)
* refactor: Factor our OpenIdConnectionManager class and deprecate old methods * refactor: Refactor keycloak uma client to use openid connection manager * fix: Perform token renewal at 90% of lifetime * refactor: Add optional openid connection constructor param to keycloak admin * refactor: Remove auto_refresh_token in favour of automatic refresh on expiry * refactor: move KeycloakOpenIDConnectionManager to a separate file * docs: uma additions and fixes * refactor: rename token_renewal_fraction->token_lifetime_fraction * refactor: shorten KeycloakOpenIDConnectionManager->KeycloakOpenIDConnection * docs: incorporate review commentspull/420/head v2.13.2
Nuwan Goonasekera
2 years ago
committed by
GitHub
GitHub
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
11 changed files with 1105 additions and 538 deletions
-
53README.md
-
47poetry.lock
-
2pyproject.toml
-
2src/keycloak/__init__.py
-
804src/keycloak/keycloak_admin.py
-
77src/keycloak/keycloak_uma.py
-
408src/keycloak/openid_connection.py
-
54tests/conftest.py
-
141tests/test_keycloak_admin.py
-
3tests/test_keycloak_openid.py
-
52tests/test_keycloak_uma.py
804
src/keycloak/keycloak_admin.py
File diff suppressed because it is too large
View File
File diff suppressed because it is too large
View File
@ -0,0 +1,408 @@ |
|||||
|
# -*- coding: utf-8 -*- |
||||
|
# |
||||
|
# The MIT License (MIT) |
||||
|
# |
||||
|
# Copyright (C) 2017 Marcos Pereira <marcospereira.mpj@gmail.com> |
||||
|
# |
||||
|
# Permission is hereby granted, free of charge, to any person obtaining a copy of |
||||
|
# this software and associated documentation files (the "Software"), to deal in |
||||
|
# the Software without restriction, including without limitation the rights to |
||||
|
# use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of |
||||
|
# the Software, and to permit persons to whom the Software is furnished to do so, |
||||
|
# subject to the following conditions: |
||||
|
# |
||||
|
# The above copyright notice and this permission notice shall be included in all |
||||
|
# copies or substantial portions of the Software. |
||||
|
# |
||||
|
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR |
||||
|
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS |
||||
|
# FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR |
||||
|
# COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER |
||||
|
# IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN |
||||
|
# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. |
||||
|
|
||||
|
"""Keycloak OpenID Connection Manager module. |
||||
|
|
||||
|
The module contains mainly the implementation of KeycloakOpenIDConnection class. |
||||
|
This is an extension of the ConnectionManager class, and handles the automatic refresh |
||||
|
of openid tokens when required. |
||||
|
""" |
||||
|
|
||||
|
from datetime import datetime, timedelta |
||||
|
|
||||
|
from .connection import ConnectionManager |
||||
|
from .exceptions import KeycloakPostError |
||||
|
from .keycloak_openid import KeycloakOpenID |
||||
|
|
||||
|
|
||||
|
class KeycloakOpenIDConnection(ConnectionManager): |
||||
|
"""A class to help with OpenID connections which can auto refresh tokens. |
||||
|
|
||||
|
:param object: _description_ |
||||
|
:type object: _type_ |
||||
|
""" |
||||
|
|
||||
|
_server_url = None |
||||
|
_username = None |
||||
|
_password = None |
||||
|
_totp = None |
||||
|
_realm_name = None |
||||
|
_client_id = None |
||||
|
_verify = None |
||||
|
_client_secret_key = None |
||||
|
_connection = None |
||||
|
_custom_headers = None |
||||
|
_user_realm_name = None |
||||
|
_expires_at = None |
||||
|
|
||||
|
def __init__( |
||||
|
self, |
||||
|
server_url, |
||||
|
username=None, |
||||
|
password=None, |
||||
|
token=None, |
||||
|
totp=None, |
||||
|
realm_name="master", |
||||
|
client_id="admin-cli", |
||||
|
verify=True, |
||||
|
client_secret_key=None, |
||||
|
custom_headers=None, |
||||
|
user_realm_name=None, |
||||
|
timeout=60, |
||||
|
): |
||||
|
"""Init method. |
||||
|
|
||||
|
:param server_url: Keycloak server url |
||||
|
:type server_url: str |
||||
|
:param username: admin username |
||||
|
:type username: str |
||||
|
:param password: admin password |
||||
|
:type password: str |
||||
|
:param token: access and refresh tokens |
||||
|
:type token: dict |
||||
|
:param totp: Time based OTP |
||||
|
:type totp: str |
||||
|
:param realm_name: realm name |
||||
|
:type realm_name: str |
||||
|
:param client_id: client id |
||||
|
:type client_id: str |
||||
|
:param verify: True if want check connection SSL |
||||
|
:type verify: bool |
||||
|
:param client_secret_key: client secret key |
||||
|
(optional, required only for access type confidential) |
||||
|
:type client_secret_key: str |
||||
|
:param custom_headers: dict of custom header to pass to each HTML request |
||||
|
:type custom_headers: dict |
||||
|
:param user_realm_name: The realm name of the user, if different from realm_name |
||||
|
:type user_realm_name: str |
||||
|
:param timeout: connection timeout in seconds |
||||
|
:type timeout: int |
||||
|
""" |
||||
|
# token is renewed when it hits 90% of its lifetime. This is to account for any possible |
||||
|
# clock skew. |
||||
|
self.token_lifetime_fraction = 0.9 |
||||
|
self.server_url = server_url |
||||
|
self.username = username |
||||
|
self.password = password |
||||
|
self.token = token |
||||
|
self.totp = totp |
||||
|
self.realm_name = realm_name |
||||
|
self.client_id = client_id |
||||
|
self.verify = verify |
||||
|
self.client_secret_key = client_secret_key |
||||
|
self.user_realm_name = user_realm_name |
||||
|
self.timeout = timeout |
||||
|
|
||||
|
if self.token is None: |
||||
|
self.get_token() |
||||
|
|
||||
|
self.headers = ( |
||||
|
{ |
||||
|
"Authorization": "Bearer " + self.token.get("access_token"), |
||||
|
"Content-Type": "application/json", |
||||
|
} |
||||
|
if self.token is not None |
||||
|
else {} |
||||
|
) |
||||
|
self.custom_headers = custom_headers |
||||
|
|
||||
|
super().__init__( |
||||
|
base_url=self.server_url, headers=self.headers, timeout=60, verify=self.verify |
||||
|
) |
||||
|
|
||||
|
@property |
||||
|
def server_url(self): |
||||
|
"""Get server url. |
||||
|
|
||||
|
:returns: Keycloak server url |
||||
|
:rtype: str |
||||
|
""" |
||||
|
return self.base_url |
||||
|
|
||||
|
@server_url.setter |
||||
|
def server_url(self, value): |
||||
|
self.base_url = value |
||||
|
|
||||
|
@property |
||||
|
def realm_name(self): |
||||
|
"""Get realm name. |
||||
|
|
||||
|
:returns: Realm name |
||||
|
:rtype: str |
||||
|
""" |
||||
|
return self._realm_name |
||||
|
|
||||
|
@realm_name.setter |
||||
|
def realm_name(self, value): |
||||
|
self._realm_name = value |
||||
|
|
||||
|
@property |
||||
|
def client_id(self): |
||||
|
"""Get client id. |
||||
|
|
||||
|
:returns: Client id |
||||
|
:rtype: str |
||||
|
""" |
||||
|
return self._client_id |
||||
|
|
||||
|
@client_id.setter |
||||
|
def client_id(self, value): |
||||
|
self._client_id = value |
||||
|
|
||||
|
@property |
||||
|
def client_secret_key(self): |
||||
|
"""Get client secret key. |
||||
|
|
||||
|
:returns: Client secret key |
||||
|
:rtype: str |
||||
|
""" |
||||
|
return self._client_secret_key |
||||
|
|
||||
|
@client_secret_key.setter |
||||
|
def client_secret_key(self, value): |
||||
|
self._client_secret_key = value |
||||
|
|
||||
|
@property |
||||
|
def username(self): |
||||
|
"""Get username. |
||||
|
|
||||
|
:returns: Admin username |
||||
|
:rtype: str |
||||
|
""" |
||||
|
return self._username |
||||
|
|
||||
|
@username.setter |
||||
|
def username(self, value): |
||||
|
self._username = value |
||||
|
|
||||
|
@property |
||||
|
def password(self): |
||||
|
"""Get password. |
||||
|
|
||||
|
:returns: Admin password |
||||
|
:rtype: str |
||||
|
""" |
||||
|
return self._password |
||||
|
|
||||
|
@password.setter |
||||
|
def password(self, value): |
||||
|
self._password = value |
||||
|
|
||||
|
@property |
||||
|
def totp(self): |
||||
|
"""Get totp. |
||||
|
|
||||
|
:returns: TOTP |
||||
|
:rtype: str |
||||
|
""" |
||||
|
return self._totp |
||||
|
|
||||
|
@totp.setter |
||||
|
def totp(self, value): |
||||
|
self._totp = value |
||||
|
|
||||
|
@property |
||||
|
def token(self): |
||||
|
"""Get token. |
||||
|
|
||||
|
:returns: Access and refresh token |
||||
|
:rtype: dict |
||||
|
""" |
||||
|
return self._token |
||||
|
|
||||
|
@token.setter |
||||
|
def token(self, value): |
||||
|
self._token = value |
||||
|
self._expires_at = datetime.now() + timedelta( |
||||
|
seconds=int(self.token_lifetime_fraction * self.token["expires_in"] if value else 0) |
||||
|
) |
||||
|
|
||||
|
@property |
||||
|
def expires_at(self): |
||||
|
"""Get token expiry time. |
||||
|
|
||||
|
:returns: Datetime at which the current token will expire |
||||
|
:rtype: datetime |
||||
|
""" |
||||
|
return self._expires_at |
||||
|
|
||||
|
@property |
||||
|
def user_realm_name(self): |
||||
|
"""Get user realm name. |
||||
|
|
||||
|
:returns: User realm name |
||||
|
:rtype: str |
||||
|
""" |
||||
|
return self._user_realm_name |
||||
|
|
||||
|
@user_realm_name.setter |
||||
|
def user_realm_name(self, value): |
||||
|
self._user_realm_name = value |
||||
|
|
||||
|
@property |
||||
|
def custom_headers(self): |
||||
|
"""Get custom headers. |
||||
|
|
||||
|
:returns: Custom headers |
||||
|
:rtype: dict |
||||
|
""" |
||||
|
return self._custom_headers |
||||
|
|
||||
|
@custom_headers.setter |
||||
|
def custom_headers(self, value): |
||||
|
self._custom_headers = value |
||||
|
if self.custom_headers is not None: |
||||
|
# merge custom headers to main headers |
||||
|
self.headers.update(self.custom_headers) |
||||
|
|
||||
|
def get_token(self): |
||||
|
"""Get admin token. |
||||
|
|
||||
|
The admin token is then set in the `token` attribute. |
||||
|
""" |
||||
|
if self.user_realm_name: |
||||
|
token_realm_name = self.user_realm_name |
||||
|
elif self.realm_name: |
||||
|
token_realm_name = self.realm_name |
||||
|
else: |
||||
|
token_realm_name = "master" |
||||
|
|
||||
|
self.keycloak_openid = KeycloakOpenID( |
||||
|
server_url=self.server_url, |
||||
|
client_id=self.client_id, |
||||
|
realm_name=token_realm_name, |
||||
|
verify=self.verify, |
||||
|
client_secret_key=self.client_secret_key, |
||||
|
timeout=self.timeout, |
||||
|
) |
||||
|
|
||||
|
grant_type = [] |
||||
|
if self.client_secret_key: |
||||
|
if self.user_realm_name: |
||||
|
self.realm_name = self.user_realm_name |
||||
|
grant_type.append("client_credentials") |
||||
|
elif self.username and self.password: |
||||
|
grant_type.append("password") |
||||
|
|
||||
|
if grant_type: |
||||
|
self.token = self.keycloak_openid.token( |
||||
|
self.username, self.password, grant_type=grant_type, totp=self.totp |
||||
|
) |
||||
|
else: |
||||
|
self.token = None |
||||
|
|
||||
|
def refresh_token(self): |
||||
|
"""Refresh the token. |
||||
|
|
||||
|
:raises KeycloakPostError: In case the refresh token request failed. |
||||
|
""" |
||||
|
refresh_token = self.token.get("refresh_token", None) if self.token else None |
||||
|
if refresh_token is None: |
||||
|
self.get_token() |
||||
|
else: |
||||
|
try: |
||||
|
self.token = self.keycloak_openid.refresh_token(refresh_token) |
||||
|
except KeycloakPostError as e: |
||||
|
list_errors = [ |
||||
|
b"Refresh token expired", |
||||
|
b"Token is not active", |
||||
|
b"Session not active", |
||||
|
] |
||||
|
if e.response_code == 400 and any(err in e.response_body for err in list_errors): |
||||
|
self.get_token() |
||||
|
else: |
||||
|
raise |
||||
|
|
||||
|
self.add_param_headers("Authorization", "Bearer " + self.token.get("access_token")) |
||||
|
|
||||
|
def _refresh_if_required(self): |
||||
|
if datetime.now() >= self.expires_at: |
||||
|
self.refresh_token() |
||||
|
|
||||
|
def raw_get(self, *args, **kwargs): |
||||
|
"""Call connection.raw_get. |
||||
|
|
||||
|
If auto_refresh is set for *get* and *access_token* is expired, it will refresh the token |
||||
|
and try *get* once more. |
||||
|
|
||||
|
:param args: Additional arguments |
||||
|
:type args: tuple |
||||
|
:param kwargs: Additional keyword arguments |
||||
|
:type kwargs: dict |
||||
|
:returns: Response |
||||
|
:rtype: Response |
||||
|
""" |
||||
|
self._refresh_if_required() |
||||
|
r = super().raw_get(*args, **kwargs) |
||||
|
return r |
||||
|
|
||||
|
def raw_post(self, *args, **kwargs): |
||||
|
"""Call connection.raw_post. |
||||
|
|
||||
|
If auto_refresh is set for *post* and *access_token* is expired, it will refresh the token |
||||
|
and try *post* once more. |
||||
|
|
||||
|
:param args: Additional arguments |
||||
|
:type args: tuple |
||||
|
:param kwargs: Additional keyword arguments |
||||
|
:type kwargs: dict |
||||
|
:returns: Response |
||||
|
:rtype: Response |
||||
|
""" |
||||
|
self._refresh_if_required() |
||||
|
r = super().raw_post(*args, **kwargs) |
||||
|
return r |
||||
|
|
||||
|
def raw_put(self, *args, **kwargs): |
||||
|
"""Call connection.raw_put. |
||||
|
|
||||
|
If auto_refresh is set for *put* and *access_token* is expired, it will refresh the token |
||||
|
and try *put* once more. |
||||
|
|
||||
|
:param args: Additional arguments |
||||
|
:type args: tuple |
||||
|
:param kwargs: Additional keyword arguments |
||||
|
:type kwargs: dict |
||||
|
:returns: Response |
||||
|
:rtype: Response |
||||
|
""" |
||||
|
self._refresh_if_required() |
||||
|
r = super().raw_put(*args, **kwargs) |
||||
|
return r |
||||
|
|
||||
|
def raw_delete(self, *args, **kwargs): |
||||
|
"""Call connection.raw_delete. |
||||
|
|
||||
|
If auto_refresh is set for *delete* and *access_token* is expired, |
||||
|
it will refresh the token and try *delete* once more. |
||||
|
|
||||
|
:param args: Additional arguments |
||||
|
:type args: tuple |
||||
|
:param kwargs: Additional keyword arguments |
||||
|
:type kwargs: dict |
||||
|
:returns: Response |
||||
|
:rtype: Response |
||||
|
""" |
||||
|
self._refresh_if_required() |
||||
|
r = super().raw_delete(*args, **kwargs) |
||||
|
return r |
||||
Write
Preview
Loading…
Cancel
Save
Reference in new issue