8.5 Configuring Events

Resource Owner: An entity capable of granting access to a protected resource. When the resource owner is a person, it is referred to as an end-user.

Resource Server: The server hosting the protected resources, capable of accepting and responding to protected resource requests using access tokens.

Client: An application making protected resource requests on behalf of the resource owner and with its authorization. The term "client" does not imply any particular implementation characteristics.

Authorization Server: The server issuing access tokens to the client after successfully authenticating the resource owner and obtaining authorization.

Sample script (oauth2_test.py)

1.  from bottle import Bottle, request, run, redirect, SimpleTemplate, template  
2.	from urllib.parse import urlparse, urlunparse, urlencode,quote  
3.  import urllib.request  
4.	import base64  
5.  import ssl  
6.	import json  
7.    
8.	app = Bottle()  
9.    
10.	client_id = 'id-rSCzuBLQgXCATfkXZ4fsedAo8sPsWxSs'  
11.  client_secret = 'secret-91DpzWFD26RriURR7KJ1pryFx7V9QeDm'  
12.	redirect_uri = 'http://localhost:8088/'  # this app callback URI  
13.  authorization_endpoint = 'https://192.168.0.151/osp/a/TOP/auth/oauth2/grant'  
14.  attributes_endpoint = 'https://192.168.0.151/osp/a/TOP/auth/oauth2/getattributes'  
15.  state = {}  
16.	 
17.  @app.get('/getattr')  
18.	def get_attributes():  
19.      params = urlencode({  
20.	        'attributes': 'client username userRepository user_dn user_cn mail sid upn netbiosName',  
21.	        'access_token': state['access_token']  
22.      })  
23.	    url = attributes_endpoint + '?' + params  
24.      print('getattr url: {}\n'.format(url))  
25.	    req = urllib.request.Request(url)  
26.      gcontext = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)  # avoid cert checking  
27.	    with urllib.request.urlopen(req, context=gcontext) as response:  # perform GET request and read response  
28.	        rsp = response.read()  
29.      attributes = json.loads(rsp.decode('utf-8'))  
30.	    return template('attributes.html', items=attributes.items(), refresh_token=urllib.parse.quote(state['refresh_token']))  
31.	 
32.   
33.	@app.get('/')  
34.  def do_get():  
35.	    code = request.query.get('code')  
36.      if code:  
37.	        # got code from OAuth 2 authentication server  
38.          token = get_token_code(code)  
39.	        state.update(token)  
40.          return template('token.html', items=token.items(), refresh_token=urllib.parse.quote(token['refresh_token']))  
41.      else:  
42.	        return template('main.html')  
43.   
44.	 
45.  @app.get('/logon')  
46.	def do_logon():  
47.      pr=list(urlparse(authorization_endpoint))  
48.	    # set query  
49.      pr[4]=urlencode({  
50.	        'response_type': 'code',  
51.          'client_id': client_id,  
52.	        'redirect_uri': redirect_uri  
53.      })  
54.	    # perform redirection to OAuth 2 authentication server  
55.      redirect(urlunparse(pr))  
56.	 
57.  @app.get('/logon-implicit')  
58.	def do_logon_implicit():  
59.      # parse authorization_endpoint URL  
60.	    pr = list(urlparse(authorization_endpoint))  
61.      # set query  
62.	    pr[4] = urlencode({  
63.          'response_type': 'token',  
64.	        'client_id': client_id,  
65.      })  
66.	    # perform redirection to OAuth 2 authentication server  
67.      redirect(urlunparse(pr))  
68.	 
69.  @app.get('/logon-creds')  
70.	def do_logon_creds():  
71.      return template('logonform.html')  
72.	 
73.  @app.post('/logon-creds')  
74.	def do_logon_creds_post():  
75.      username = request.forms.get('username')  
76.	    password = request.forms.get('password')  
77.      token = get_token_password(username, password)  
78.	    state.update(token)  
79.      return template('token.html', items=token.items(), refresh_token=urllib.parse.quote(token['refresh_token']))  
80.    
81.	def get_token_password(username, password):  
82.      # prepare POST parameters - encode them to urlencoded  
83.	    data = urlencode({  
84.          'grant_type': 'password',  
85.	        'username': username,  
86.          'password': password  
87.	    })  
88.      data = data.encode('ascii')  # data should be bytes  
89.	    resp_text = post_data(data, prepare_headers())  
90.      print(resp_text)  
91.	    return json.loads(resp_text)  
92.   
93.	@app.get('/refresh')  
94.  def do_refresh():  
95.	    token = refresh_access_token(request.query.get('refresh_token'))  
96.      state.update(token)  
97.	    return template('token.html', items=token.items(), refresh_token=state.get('refresh_token', ''))  
98.	  
99.  def get_token_code(code):  
100.	    # prepare POST parameters - encode them to urlencoded  
101.      data = urlencode({  
102.	        'grant_type': 'authorization_code',  
103.          'code': code,  
104.	        'redirect_uri': redirect_uri  
105.      })  
106.	    data = data.encode('ascii')  # data should be bytes  
107.      resp_text = post_data(data, prepare_headers())  
108.	    print(resp_text)  
109.      return json.loads(resp_text)  
110.	  
111.  def refresh_access_token(refresh_token):  
112.	    print('refresh_token: {}'.format(refresh_token))  
113.      # prepare POST parameters - encode them to urlencoded  
114.	    data = urlencode({  
115.          'grant_type': 'refresh_token',  
116.	        'refresh_token': refresh_token,  
117.      })  
118.	    data = data.encode('ascii')  # data should be bytes  
119.      resp_text = post_data(data, prepare_headers())  
120.	    print(resp_text)  
121.      return json.loads(resp_text)  
122.	  
123.  def prepare_headers(use_content_type_hdr = True):  
124.	    hdrs = {  
125.          'Authorization': 'Basic {}'.format(base64.b64encode(  
126.	            '{}:{}'.format(quote(client_id, safe=''), quote(client_secret, safe='')).encode('ascii')).decode(  
127.	            'ascii')),  
128.      }  
129.	    if use_content_type_hdr:  
130.          hdrs.update({'Content-type': 'application/x-www-form-urlencoded'})  
131.      return hdrs  
132.    
133.  def post_data(data, headers):  
134.      print('post_data\nheaders:\n{}\ndata:\n{}'.format(headers, data))  
135.      req = urllib.request.Request(authorization_endpoint, data, headers)  
136.      gcontext = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)  # avoid cert checking  
137.	    with urllib.request.urlopen(req, context=gcontext) as response:  # perform POST request and read response  
138.	        rsp = response.read()  
139.      return rsp.decode('utf-8')  
140.	  
141.  run(app, host='0.0.0.0', port=8088) 

Main menu (main.html)

1.  <!DOCTYPE html>  
2.	<html>  
3.  <head lang="en">  
4.	    <meta charset="UTF-8">  
5.      <title></title>  
6.	    <script type="text/javascript">  
7.           //<![CDATA[ 
8.	            function getHashParam(name) { 
9.                  var hash = window.location.hash; 
10.	                if (hash) { 
11.                      if (name = (new RegExp('[#&]' + encodeURIComponent(name) + '=([^&]*)')).exec(hash)) 
12.                      return decodeURIComponent(name[1]); 
13.	                } 
14.              } 
15.	            function showResult() { 
16.                  if (window.location.hash) { 
17.	                    document.getElementById('result').innerHTML = '<table border="1">'+ 
18.	                        '<tr><td>access_token</td><td>'+getHashParam('access_token')+'</td></tr>'+ 
19.	                        '<tr><td>token_type</td><td>'+getHashParam('token_type')+'</td></tr>'+ 
20.	                        '<tr><td>expires_in</td><td>'+getHashParam('expires_in')+'</td></tr>'+ 
21.	                        '</table>'; 
22.                  } else { 
23.	                    document.getElementById('result').innerHTML = 'Implicit granted token is not found'; 
24.	                } 
25.              } 
26.	          // ]]>  
27.          </script>  
28.	</head>  
29.  <body onload="showResult();">  
30.	<div id="result">result</div><br/>  
31.  <br/>  
32.	Click <a href="/logon">here</a> to obtain an authentication token through Authorization Code Grant<br/>  
33.	Click <a href="/logon-implicit">here</a> to obtain an authentication token through Implicit Grant (the token will be received in hash part of THIS page)<br/>  
34.  Click <a href="/logon-creds">here</a> to obtain an authentication token through Resource Owner Password Credentials Grant<br/>  
35.  </body>  
36.	</html>  

Token information (token.html)

1.  <!DOCTYPE html>  
2.	<html>  
3.  <head lang="en">  
4.	    <meta charset="UTF-8">  
5.      <title></title>  
6.	</head>  
7.  <body>  
8.	Token<br/>  
9.  <table border="1">  
10.	    % for k, v in items:  
11.      <tr>  
12.	        <td>{{k}}</td>  
13.          <td>{{v}}</td>  
14.	    </tr>  
15.      % end  
16.	</table>  
17.  <br/>  
18.	<a href="/getattr">Get attributes</a><br/>  
19.  <a href="/refresh?refresh_token={{refresh_token}}">Refresh token</a>  
20.	</body>  
21.  </html>  

Attributes information (attributes.html)

1.  <!DOCTYPE html>  
2.	<html>  
3.  <head lang="en">  
4.	    <meta charset="UTF-8">  
5.      <title></title>  
6.	</head>  
7.  <body>  
8.	Attributes<br/>  
9.  <table border="1">  
10.	    % for k, v in items:  
11.      <tr>  
12.	        <td>{{k}}</td>  
13.          <td>{{v}}</td>  
14.	    </tr>  
15.      % end  
16.	</table>  
17.  <br/>  
18.	<a href="/refresh?refresh_token={{refresh_token}}">Refresh token</a>  
19.  </body>  
20.	</html>  

Logon form for Resource Owner Password Credentials Grant mode (logonform.html)

1.  <!DOCTYPE html>  
2.	<html>  
3.  <head lang="en">  
4.	    <meta charset="UTF-8">  
5.      <title></title>  
6.	</head>  
7.  <body>  
8.	<form method="post" action="/logon-creds">  
9.      User name: <input type="text" name="username"><br/>  
10.	    Password: <input type="password" name="password"><br/>  
11.      <input type="submit">  
12.	</form>  
13.  </body>  
14.	</html>