Skip to content

Commit 83ed3d5

Browse files
xpavlicnijel
xpavlic
authored and
nijel
committed
feat(backends): Lifescience AAI implementation
1 parent 61823fa commit 83ed3d5

File tree

2 files changed

+303
-0
lines changed

2 files changed

+303
-0
lines changed

‎social_core/backends/lifescience.py‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
"""
2+
Backend for OpenID Connect Life Science AAI
3+
https://lifescience-ri.eu/ls-login.html
4+
"""
5+
6+
from social_core.backends.open_id_connect import OpenIdConnectAuth
7+
8+
9+
class LifeScienceOpenIdConnect(OpenIdConnectAuth):
10+
name = "life_science"
11+
OIDC_ENDPOINT = "https://login.aai.lifescience-ri.eu/oidc"
12+
EXTRA_DATA = [
13+
("expires_in", "expires_in", True),
14+
("refresh_token", "refresh_token", True),
15+
("id_token", "id_token", True),
16+
("other_tokens", "other_tokens", True),
17+
]
18+
# In order to get any scopes, you have to register your service with
19+
# Life science, see documentation at
20+
# https://lifescience-ri.eu/ls-login.html
21+
DEFAULT_SCOPE = ["openid", "email"]
22+
JWT_DECODE_OPTIONS = {"verify_at_hash": False}
23+
24+
def get_user_details(self, response):
25+
username_key = self.setting("USERNAME_KEY", default=self.USERNAME_KEY)
26+
name = response.get("name") or ""
27+
fullname, first_name, last_name = self.get_user_names(name)
28+
return {
29+
"username": response.get(username_key),
30+
"email": response.get("email"),
31+
"fullname": fullname,
32+
"first_name": first_name,
33+
"last_name": last_name,
34+
}

‎social_core/tests/backends/test_lifescience.py‎

Lines changed: 269 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,269 @@
1+
import json
2+
3+
from .oauth import BaseAuthUrlTestMixin, OAuth2Test
4+
from .test_open_id_connect import OpenIdConnectTestMixin
5+
6+
7+
class LifeScienceOpenIdConnectTest(
8+
OpenIdConnectTestMixin, OAuth2Test, BaseAuthUrlTestMixin
9+
):
10+
backend_path = "social_core.backends.lifescience.LifeScienceOpenIdConnect"
11+
issuer = "https://login.aai.lifescience-ri.eu/oidc/"
12+
user_data_url = "https://login.aai.lifescience-ri.eu/oidc/userinfo"
13+
openid_config_body = """
14+
{
15+
"request_parameter_supported": true,
16+
"claims_parameter_supported": false,
17+
"introspection_endpoint": "https://login.aai.lifescience-ri.eu/oidc/introspect",
18+
"scopes_supported": [
19+
"openid",
20+
"profile",
21+
"email",
22+
"address",
23+
"phone",
24+
"offline_access",
25+
"perun_api",
26+
"eduperson_principal_name",
27+
"country",
28+
"eduperson_assurance",
29+
"negotiator_api",
30+
"beacon_network_api",
31+
"beacon_api",
32+
"ssh_public_key",
33+
"crypt4ghPublicKeys",
34+
"gpgPublicKeys",
35+
"negotiator_monitoring",
36+
"eduperson_entitlement",
37+
"voperson_external_affiliation",
38+
"ga4gh_passport_v1",
39+
"perun_admin",
40+
"eduperson_orcid",
41+
"elixir_eduperson_unique_id",
42+
"elixir_eduperson_principal_name",
43+
"schac_home_organization",
44+
"eduperson_scoped_affiliation",
45+
"voperson_current_external_affiliation",
46+
"authenticating_entity",
47+
"minio_policies",
48+
"max_user_authentication_capability",
49+
"voperson_external_id",
50+
"eduperson_unique_id"
51+
],
52+
"issuer": "https://login.aai.lifescience-ri.eu/oidc/",
53+
"acr_values_supported": [
54+
"urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified",
55+
"urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
56+
"https://refeds.org/profile/sfa",
57+
"https://refeds.org/profile/mfa"
58+
],
59+
"userinfo_encryption_enc_values_supported": [
60+
"XC20P",
61+
"A256CBC+HS512",
62+
"A256GCM",
63+
"A192GCM",
64+
"A128GCM",
65+
"A128CBC-HS256",
66+
"A192CBC-HS384",
67+
"A256CBC-HS512",
68+
"A128CBC+HS256"
69+
],
70+
"id_token_encryption_enc_values_supported": [
71+
"XC20P",
72+
"A256CBC+HS512",
73+
"A256GCM",
74+
"A192GCM",
75+
"A128GCM",
76+
"A128CBC-HS256",
77+
"A192CBC-HS384",
78+
"A256CBC-HS512",
79+
"A128CBC+HS256"
80+
],
81+
"authorization_endpoint": "https://login.aai.lifescience-ri.eu/oidc/authorize",
82+
"request_object_encryption_enc_values_supported": [
83+
"XC20P",
84+
"A256CBC+HS512",
85+
"A256GCM",
86+
"A192GCM",
87+
"A128GCM",
88+
"A128CBC-HS256",
89+
"A192CBC-HS384",
90+
"A256CBC-HS512",
91+
"A128CBC+HS256"
92+
],
93+
"device_authorization_endpoint": "https://login.aai.lifescience-ri.eu/oidc/devicecode",
94+
"userinfo_signing_alg_values_supported": [
95+
"HS256",
96+
"HS384",
97+
"HS512",
98+
"RS256",
99+
"RS384",
100+
"RS512",
101+
"ES256",
102+
"ES384",
103+
"ES512",
104+
"PS256",
105+
"PS384",
106+
"PS512"
107+
],
108+
"claims_supported": [
109+
"schac_home_organization",
110+
"sub",
111+
"country",
112+
"zoneinfo",
113+
"negotiator_monitoring",
114+
"voperson_external_affiliation",
115+
"birthdate",
116+
"beacon_api",
117+
"elixir_eduperson_unique_id",
118+
"gender",
119+
"preferred_username",
120+
"locale",
121+
"eduperson_principal_name",
122+
"eduperson_entitlement",
123+
"elixir_eduperson_principal_name",
124+
"minio_policies",
125+
"updated_at",
126+
"crypt4ghPublicKeys",
127+
"nickname",
128+
"eduperson_scoped_affiliation",
129+
"eduperson_unique_id",
130+
"voperson_current_external_affiliation",
131+
"email",
132+
"voperson_external_id",
133+
"website",
134+
"email_verified",
135+
"address",
136+
"profile",
137+
"phone_number_verified",
138+
"max_user_authentication_capability",
139+
"given_name",
140+
"middle_name",
141+
"picture",
142+
"ssh_public_key",
143+
"authenticating_entity",
144+
"beacon_network_api",
145+
"name",
146+
"phone_number",
147+
"eduperson_assurance",
148+
"perun_admin",
149+
"family_name",
150+
"ga4gh_passport_v1",
151+
"perun_api",
152+
"negotiator_api",
153+
"gpgPublicKeys",
154+
"eduperson_orcid"
155+
],
156+
"claim_types_supported": [
157+
"normal"
158+
],
159+
"token_endpoint_auth_methods_supported": [
160+
"client_secret_basic",
161+
"client_secret_post",
162+
"none"
163+
],
164+
"token_endpoint": "https://login.aai.lifescience-ri.eu/oidc/token",
165+
"response_types_supported": [
166+
"code",
167+
"token id_token"
168+
],
169+
"request_uri_parameter_supported": false,
170+
"userinfo_encryption_alg_values_supported": [
171+
"RSA-OAEP-512",
172+
"RSA-OAEP",
173+
"RSA-OAEP-256",
174+
"RSA1_5",
175+
"RSA-OAEP-384"
176+
],
177+
"grant_types_supported": [
178+
"authorization_code",
179+
"implicit",
180+
"client_credentials",
181+
"refresh_token",
182+
"urn:ietf:params:oauth:grant-type:token-exchange",
183+
"urn:ietf:params:oauth:grant-type:device_code"
184+
],
185+
"end_session_endpoint": "https://login.aai.lifescience-ri.eu/oidc/endsession",
186+
"revocation_endpoint": "https://login.aai.lifescience-ri.eu/oidc/revoke",
187+
"userinfo_endpoint": "https://login.aai.lifescience-ri.eu/oidc/userinfo",
188+
"token_endpoint_auth_signing_alg_values_supported": [
189+
"HS256",
190+
"HS384",
191+
"HS512",
192+
"RS256",
193+
"RS384",
194+
"RS512",
195+
"ES256",
196+
"ES384",
197+
"ES512",
198+
"PS256",
199+
"PS384",
200+
"PS512"
201+
],
202+
"require_request_uri_registration": false,
203+
"code_challenge_methods_supported": [
204+
"plain",
205+
"S256",
206+
"none"
207+
],
208+
"id_token_encryption_alg_values_supported": [
209+
"RSA-OAEP-512",
210+
"RSA-OAEP",
211+
"RSA-OAEP-256",
212+
"RSA1_5",
213+
"RSA-OAEP-384"
214+
],
215+
"jwks_uri": "https://login.aai.lifescience-ri.eu/oidc/jwk",
216+
"subject_types_supported": [
217+
"public"
218+
],
219+
"id_token_signing_alg_values_supported": [
220+
"HS256",
221+
"HS384",
222+
"HS512",
223+
"RS256",
224+
"RS384",
225+
"RS512",
226+
"ES256",
227+
"ES384",
228+
"ES512",
229+
"PS256",
230+
"PS384",
231+
"PS512",
232+
"none"
233+
],
234+
"registration_endpoint": "https://login.aai.lifescience-ri.eu/oidc/register",
235+
"request_object_signing_alg_values_supported": [
236+
"HS256",
237+
"HS384",
238+
"HS512",
239+
"RS256",
240+
"RS384",
241+
"RS512",
242+
"ES256",
243+
"ES384",
244+
"ES512",
245+
"PS256",
246+
"PS384",
247+
"PS512"
248+
],
249+
"request_object_encryption_alg_values_supported": [
250+
"RSA-OAEP-512",
251+
"RSA-OAEP",
252+
"RSA-OAEP-256",
253+
"RSA1_5",
254+
"RSA-OAEP-384"
255+
]
256+
}
257+
"""
258+
expected_username = "foo@lifescience-ri.eu"
259+
access_token_body = json.dumps({"access_token": "foobar", "token_type": "bearer"})
260+
user_data_body = json.dumps(
261+
{
262+
"preferred_username": "foo@lifescience-ri.eu",
263+
"email": "foo@bar.com",
264+
"name": "Foo Bar",
265+
}
266+
)
267+
268+
def test_login(self):
269+
self.do_login()

0 commit comments

Comments
 (0)