Difficulty in implementing application flow #35
Description
I use solid-auth-client as the mechanism to authenticate users and the app to access their PODs. I understand that once authenticated solid-auth-client places an object that is used later for interacting with their PODs into local storage. When I interact with the POD from the client using solid-auth-client everything works ok in spite of the app being built in Python and compiled to Javascript via Skulpt.
I am trying to re-use the solid-auth-client object from the browser by passing it on to the server so that the server can independently access the POD. There are many obvious use cases for this pattern. For example, I log in to the app and ask it to access my POD every night and send watermarked thumbnails of all new photos to an aggregator.
My choice of using Python wherever possible may have inter-op issues with the object in local storage, but theoretically shouldn't. I have been trying to follow the pattern set out in the updated spec for Sending a Request.
The authentication details are retrieved from localStorage with a javascript function:
function getSolidAuthClient () {
let solid_auth_client = JSON.parse(window.localStorage.getItem("solid-auth-client"))
console.log({"localStorage": solid_auth_client, type:
typeof(solid_auth_client)})
return solid_auth_client
}When the authentication details are passed to the Python server from local storage, it is held in a variable called solid_auth_client. First I set up the pop_token as a json object:
session = solid_auth_client["session"]
pop_token = {
"iss" : "https://solid-sparql.anvil.app",
"aud" : "https://anvil1.inrupt.net",
"exp" : session["idClaims"]["exp"],
"iat" : session["idClaims"]["iat"],
"id_token" : session["authorization"]["id_token"],
"token_type" : "pop"
}I then retrieve the private_key from solid_auth_client and convert it to PEM format:
rehydrate = jwk.JWK.from_json(solid_auth_client["oidc.session.privateKey"])
private_key = rehydrate.export_to_pem(private_key=True, password=None)I use the PEM version of the key to sign the jwt of the pop_token:
pop_token = jwt.encode(pop_token, private_key, algorithm="RS256")Finally, I use the pop_token as an authorization header in the http GET from the PODs private area.
try:
resp = anvil.http.request(
method = "GET",
headers={
"authorization": "Bearer "+pop_token.decode("utf-8")
},
url="https://anvil1.inrupt.net/private/test.ttl"
)
except Exception as e:
print("HTTP error", e)This results in HTTP error 401.