86 lines
2.7 KiB
Python
86 lines
2.7 KiB
Python
import base64
|
|
import json
|
|
import hmac
|
|
import hashlib
|
|
import urlparse
|
|
|
|
from django.db import models
|
|
from django.utils.translation import ugettext_lazy as _
|
|
from django.utils.timezone import now
|
|
from django.conf import settings
|
|
|
|
from authentic2_auth_oidc.utils import parse_timestamp
|
|
|
|
from . import app_settings
|
|
|
|
|
|
def base64url_decode(input):
|
|
rem = len(input) % 4
|
|
if rem > 0:
|
|
input += b'=' * (4 - rem)
|
|
return base64.urlsafe_b64decode(input)
|
|
|
|
|
|
def parse_id_token(id_token, client_id=None, client_secret=None):
|
|
try:
|
|
splitted = str(id_token).split('.')
|
|
except:
|
|
return None, 'invalid id_token'
|
|
if len(splitted) != 3:
|
|
return None, 'invalid id_token'
|
|
header, payload, signature = splitted
|
|
try:
|
|
signature = base64url_decode(signature)
|
|
except (ValueError, TypeError):
|
|
return None, 'invalid signature'
|
|
signed = '%s.%s' % (header, payload)
|
|
if client_secret is not None:
|
|
h = hmac.HMAC(key=client_secret, msg=signed, digestmod=hashlib.sha256)
|
|
if h.digest() != signature:
|
|
return None, 'hmac signature does not match'
|
|
payload = base64url_decode(str(payload))
|
|
try:
|
|
payload = json.loads(payload)
|
|
except ValueError:
|
|
return None, 'invalid payload'
|
|
if client_id and ('aud' not in payload or payload['aud'] != client_id):
|
|
return None, 'invalid audience'
|
|
if 'exp' not in payload or parse_timestamp(payload['exp']) < now():
|
|
return None, 'id_token is expired'
|
|
parsed = urlparse.urlparse(app_settings.authorize_url)
|
|
if 'iss' not in payload or payload['iss'] != '%s://%s/' % (parsed.scheme, parsed.netloc):
|
|
return None, 'wrong issuer received, %r' % payload['iss']
|
|
return payload, None
|
|
|
|
|
|
class FcAccount(models.Model):
|
|
user = models.ForeignKey(
|
|
to=settings.AUTH_USER_MODEL,
|
|
verbose_name=_('user'),
|
|
related_name='fc_accounts')
|
|
sub = models.TextField(
|
|
verbose_name=_('sub'),
|
|
db_index=True)
|
|
token = models.TextField(verbose_name=_('access token'))
|
|
user_info = models.TextField(verbose_name=_('access token'), blank=True, null=True)
|
|
|
|
@property
|
|
def id_token(self):
|
|
return parse_id_token(self.get_token()['id_token'])
|
|
|
|
def get_token(self):
|
|
return json.loads(self.token)
|
|
|
|
def get_user_info(self):
|
|
return json.loads(self.user_info)
|
|
|
|
def __unicode__(self):
|
|
user_info = self.get_user_info()
|
|
id_token = self.id_token
|
|
display_name = []
|
|
if 'given_name' in user_info:
|
|
display_name.append(user_info['given_name'])
|
|
if 'family_name' in user_info:
|
|
display_name.append(user_info['family_name'])
|
|
return ' '.join(display_name)
|