83 lines
2.0 KiB
Python
83 lines
2.0 KiB
Python
import time
|
|
|
|
from authlib.common.security import generate_token
|
|
from authlib.jose import jwt
|
|
|
|
|
|
def sign_jwt_bearer_assertion(
|
|
key,
|
|
issuer,
|
|
audience,
|
|
subject=None,
|
|
issued_at=None,
|
|
expires_at=None,
|
|
claims=None,
|
|
header=None,
|
|
**kwargs,
|
|
):
|
|
if header is None:
|
|
header = {}
|
|
alg = kwargs.pop("alg", None)
|
|
if alg:
|
|
header["alg"] = alg
|
|
if "alg" not in header:
|
|
raise ValueError("Missing 'alg' in header")
|
|
|
|
payload = {"iss": issuer, "aud": audience}
|
|
|
|
# subject is not required in Google service
|
|
if subject:
|
|
payload["sub"] = subject
|
|
|
|
if not issued_at:
|
|
issued_at = int(time.time())
|
|
|
|
expires_in = kwargs.pop("expires_in", 3600)
|
|
if not expires_at:
|
|
expires_at = issued_at + expires_in
|
|
|
|
payload["iat"] = issued_at
|
|
payload["exp"] = expires_at
|
|
|
|
if claims:
|
|
payload.update(claims)
|
|
|
|
return jwt.encode(header, payload, key)
|
|
|
|
|
|
def client_secret_jwt_sign(
|
|
client_secret, client_id, token_endpoint, alg="HS256", claims=None, **kwargs
|
|
):
|
|
return _sign(client_secret, client_id, token_endpoint, alg, claims, **kwargs)
|
|
|
|
|
|
def private_key_jwt_sign(
|
|
private_key, client_id, token_endpoint, alg="RS256", claims=None, **kwargs
|
|
):
|
|
return _sign(private_key, client_id, token_endpoint, alg, claims, **kwargs)
|
|
|
|
|
|
def _sign(key, client_id, token_endpoint, alg, claims=None, **kwargs):
|
|
# REQUIRED. Issuer. This MUST contain the client_id of the OAuth Client.
|
|
issuer = client_id
|
|
# REQUIRED. Subject. This MUST contain the client_id of the OAuth Client.
|
|
subject = client_id
|
|
# The Audience SHOULD be the URL of the Authorization Server's Token Endpoint.
|
|
audience = token_endpoint
|
|
|
|
# jti is required
|
|
if claims is None:
|
|
claims = {}
|
|
if "jti" not in claims:
|
|
claims["jti"] = generate_token(36)
|
|
|
|
return sign_jwt_bearer_assertion(
|
|
key=key,
|
|
issuer=issuer,
|
|
audience=audience,
|
|
subject=subject,
|
|
claims=claims,
|
|
alg=alg,
|
|
**kwargs,
|
|
)
|