provide DOT policy for client authentication

Author: Massimiliano Pippi

oauth2_provider/oauth2_validators.py

@@ -20,23 +20,35 @@
     'authorization_code': (Application.GRANT_ALLINONE, Application.GRANT_AUTHORIZATION_CODE),
     'password': (Application.GRANT_ALLINONE, Application.GRANT_PASSWORD),
     'client_credentials': (Application.GRANT_ALLINONE, Application.GRANT_CLIENT_CREDENTIALS),
-    'refresh_token': (Application.GRANT_ALLINONE, Application.GRANT_AUTHORIZATION_CODE, Application.GRANT_PASSWORD,
-                      Application.GRANT_CLIENT_CREDENTIALS)
+    'refresh_token': (Application.GRANT_ALLINONE, Application.GRANT_AUTHORIZATION_CODE,
+                      Application.GRANT_PASSWORD, Application.GRANT_CLIENT_CREDENTIALS)
 }
 
 
 class OAuth2Validator(RequestValidator):
-    def _authenticate_basic_auth(self, request):
+    def _extract_basic_auth(self, request):
         """
-        Authenticates with HTTP Basic Auth
+        Return authentication string if request contains basic auth credentials, else return None
         """
         auth = request.headers.get('HTTP_AUTHORIZATION', None)
-
         if not auth:
-            return False
+            return None
 
         auth_type, auth_string = auth.split(' ')
         if auth_type != "Basic":
+            return None
+
+        return auth_string
+
+    def _authenticate_basic_auth(self, request):
+        """
+        Authenticates with HTTP Basic Auth.
+
+        Note: as stated in rfc:`2.3.1`, client_id and client_secret must be encoded with
+        "application/x-www-form-urlencoded" encoding algorithm.
+        """
+        auth_string = self._extract_basic_auth(request)
+        if not auth_string:
             return False
 
         encoding = request.encoding or 'utf-8'
@@ -45,38 +57,83 @@ def _authenticate_basic_auth(self, request):
         client_id, client_secret = auth_string_decoded.split(':', 1)
 
         try:
-            request.client = Application.objects.get(client_id=unquote_plus(client_id), client_secret=unquote_plus(client_secret))
+            request.client = Application.objects.get(client_id=unquote_plus(client_id),
+                                                     client_secret=unquote_plus(client_secret))
             return True
 
         except Application.DoesNotExist:
+            log.debug("Failed basic auth: Application %s do not exists" % unquote_plus(client_id))
             return False
 
     def _authenticate_request_body(self, request):
         """
         Try to authenticate the client using client_id and client_secret parameters
         included in body.
 
-        Remember that this method is NOT RECOMMENDED and SHOULD be limited to clients unable to directly utilize
-        the HTTP Basic authentication scheme. See rfc:`2.3.1` for more details.
+        Remember that this method is NOT RECOMMENDED and SHOULD be limited to clients unable to
+        directly utilize the HTTP Basic authentication scheme. See rfc:`2.3.1` for more details.
         """
         client_id = request.client_id
         client_secret = request.client_secret
 
-        if not client_id:
+        if not client_id or not client_secret:
             return False
 
         try:
-            request.client = Application.objects.get(client_id=client_id, client_secret=client_secret)
+            request.client = Application.objects.get(client_id=client_id,
+                                                     client_secret=client_secret)
             return True
 
         except Application.DoesNotExist:
+            log.debug("Failed body authentication: Application %s do not exists" % client_id)
             return False
 
+    def _load_application(self, client_id, request):
+        """
+        If request.client was not set, load application instance for given client_id and store it
+        in request.client
+        """
+        try:
+            request.client = request.client or Application.objects.get(client_id=client_id)
+        except Application.DoesNotExist:
+            log.debug("Application %s do not exists" % client_id)
+
+    def client_authentication_required(self, request, *args, **kwargs):
+        """
+        Determine if the client has to be authenticated
+
+        This method is called only for grant types that supports client authentication:
+            * Authorization code grant
+            * Resource owner password grant
+            * Refresh token grant
+
+        If the request contains authorization headers, always authenticate the client no matter
+        the grant type.
+
+        If the request does not contain authorization headers, proceed with authentication only if
+        the client is of type `Confidential`.
+
+        If something goes wrong, call oauthlib implementation of the method.
+        """
+        if self._extract_basic_auth(request):
+            return True
+
+        if request.client_id and request.client_secret:
+            return True
+
+        self._load_application(request.client_id, request)
+        if request.client:
+            return request.client.client_type == Application.CLIENT_CONFIDENTIAL
+
+        return super(OAuth2Validator, self).client_authentication_required(request,
+                                                                           *args, **kwargs)
+
     def authenticate_client(self, request, *args, **kwargs):
         """
         Check if client exists and it's authenticating itself as in rfc:`3.2.1`
 
-        First we try to authenticate with HTTP Basic Auth, and that is the PREFERRED authentication method.
+        First we try to authenticate with HTTP Basic Auth, and that is the PREFERRED
+        authentication method.
         Whether this fails we support including the client credentials in the request-body, but
         this method is NOT RECOMMENDED and SHOULD be limited to clients unable to directly utilize
         the HTTP Basic authentication scheme. See rfc:`2.3.1` for more details
@@ -90,8 +147,9 @@ def authenticate_client(self, request, *args, **kwargs):
 
     def authenticate_client_id(self, client_id, request, *args, **kwargs):
         """
-        If we are here, the client did not authenticate itself as in rfc:`3.2.1` and we can proceed only if the client
-        exists and it's not of type 'Confidential'. Also assign Application instance to request.client.
+        If we are here, the client did not authenticate itself as in rfc:`3.2.1` and we can
+        proceed only if the client exists and it's not of type 'Confidential'.
+        Also assign Application instance to request.client.
         """
 
         try:
@@ -119,14 +177,11 @@ def invalidate_authorization_code(self, client_id, code, request, *args, **kwarg
 
     def validate_client_id(self, client_id, request, *args, **kwargs):
         """
-        Ensure an Application exists with given client_id. Also assign Application instance to request.client.
+        Ensure an Application exists with given client_id. If it exists, it's assigned to
+        request.client.
         """
-        try:
-            request.client = request.client or Application.objects.get(client_id=client_id)
-            return True
-
-        except Application.DoesNotExist:
-            return False
+        self._load_application(client_id, request)
+        return request.client is not None
 
     def get_default_redirect_uri(self, client_id, request, *args, **kwargs):
         return request.client.default_redirect_uri
@@ -139,7 +194,8 @@ def validate_bearer_token(self, token, scopes, request):
             return False
 
         try:
-            access_token = AccessToken.objects.select_related("application", "user").get(token=token)
+            access_token = AccessToken.objects.select_related("application", "user").get(
+                token=token)
             if access_token.is_valid(scopes):
                 request.client = access_token.application
                 request.user = access_token.user
@@ -173,8 +229,8 @@ def validate_grant_type(self, client_id, grant_type, client, request, *args, **k
 
     def validate_response_type(self, client_id, response_type, client, request, *args, **kwargs):
         """
-        We currently do not support the Authorization Endpoint Response Types registry as in rfc:`8.4`, so validate
-        the response_type only if it matches 'code' or 'token'
+        We currently do not support the Authorization Endpoint Response Types registry as in
+        rfc:`8.4`, so validate the response_type only if it matches 'code' or 'token'
         """
         if response_type == 'code':
             return client.authorization_grant_type == Application.GRANT_AUTHORIZATION_CODE
@@ -196,14 +252,17 @@ def validate_redirect_uri(self, client_id, redirect_uri, request, *args, **kwarg
         return request.client.redirect_uri_allowed(redirect_uri)
 
     def save_authorization_code(self, client_id, code, request, *args, **kwargs):
-        expires = timezone.now() + timedelta(seconds=oauth2_settings.AUTHORIZATION_CODE_EXPIRE_SECONDS)
-        g = Grant(application=request.client, user=request.user, code=code['code'], expires=expires,
-                  redirect_uri=request.redirect_uri, scope=' '.join(request.scopes))
+        expires = timezone.now() + timedelta(
+            seconds=oauth2_settings.AUTHORIZATION_CODE_EXPIRE_SECONDS)
+        g = Grant(application=request.client, user=request.user, code=code['code'],
+                  expires=expires, redirect_uri=request.redirect_uri,
+                  scope=' '.join(request.scopes))
         g.save()
 
     def save_bearer_token(self, token, request, *args, **kwargs):
         """
-        Save access and refresh token, If refresh token is issued, remove old refresh tokens as in rfc:`6`
+        Save access and refresh token, If refresh token is issued, remove old refresh tokens as
+        in rfc:`6`
         """
         if request.refresh_token:
             # remove used refresh token
@@ -247,7 +306,8 @@ def validate_user(self, username, password, client, request, *args, **kwargs):
         return False
 
     def get_original_scopes(self, refresh_token, request, *args, **kwargs):
-        # TODO: since this method is invoked *after* validate_refresh_token, could we avoid this second query for RefreshToken?
+        # TODO: since this method is invoked *after* validate_refresh_token, could we avoid this
+        # second query for RefreshToken?
         rt = RefreshToken.objects.get(token=refresh_token)
         return rt.access_token.scope