woggioni
3ebf079533
Replace wrapper-based SessionMiddleware/OIDCApp with KayaMixin subclasses applied via KayaApp(mixins=[...]). Mixins hook into handle_request and handle_websocket via before/after hooks, so both ASGI and RSGI keep working. Mixin dependencies are applied automatically and deduplicated.
74 lines
2.2 KiB
Markdown
74 lines
2.2 KiB
Markdown
# kaya-oidc
|
|
|
|
OpenID Connect authentication for the Kaya web framework.
|
|
|
|
Built on top of `kaya-session` and implements the OIDC **Authorization Code
|
|
Flow with PKCE**.
|
|
|
|
## Usage
|
|
|
|
```python
|
|
import os
|
|
from kaya.core import HttpContext, KayaApp
|
|
from kaya.session import SessionMixin, InMemorySessionStore
|
|
from kaya.oidc import OIDCConfig, OIDCMixin
|
|
|
|
session = SessionMixin(InMemorySessionStore())
|
|
oidc = OIDCMixin(
|
|
OIDCConfig(
|
|
issuer=os.environ['OIDC_ISSUER'],
|
|
client_id=os.environ['OIDC_CLIENT_ID'],
|
|
client_secret=os.environ.get('OIDC_CLIENT_SECRET'),
|
|
redirect_uri='http://localhost:8000/auth/callback',
|
|
fetch_userinfo=True,
|
|
),
|
|
session=session,
|
|
)
|
|
app = KayaApp(mixins=[session, oidc])
|
|
|
|
@app.GET('/')
|
|
async def home(ctx: HttpContext):
|
|
await ctx.send_str(200, 'public home')
|
|
|
|
@app.GET('/profile')
|
|
@oidc.require_auth
|
|
async def profile(ctx: HttpContext):
|
|
user = oidc.get_user(ctx)
|
|
await ctx.send_str(200, f'Hello {user.email or user.sub}')
|
|
```
|
|
|
|
`OIDCMixin` depends on `SessionMixin`; passing only `oidc` to `KayaApp(mixins=...)`
|
|
also works because the app applies mixin dependencies automatically.
|
|
|
|
## Features
|
|
|
|
- Generic OIDC discovery
|
|
- Authorization Code Flow with PKCE (S256)
|
|
- ID token signature validation with JWKS
|
|
- `state` and `nonce` protection
|
|
- Session fixation defense via `regenerate_id()` after login
|
|
- Optional userinfo endpoint fetch
|
|
- Refresh token support
|
|
- RP-initiated logout (when provider advertises `end_session_endpoint`)
|
|
- Composable with any other `KayaMixin` (RSGI, MCP, etc.)
|
|
|
|
## Security notes
|
|
|
|
- The `none` signing algorithm is rejected by default.
|
|
- Only algorithms listed in `OIDCConfig.allowed_id_token_algorithms` are accepted.
|
|
- Always use HTTPS for `redirect_uri` in production.
|
|
|
|
## Supported flows
|
|
|
|
Only the Authorization Code Flow with PKCE is supported. Implicit and Hybrid
|
|
flows are intentionally not implemented.
|
|
|
|
## Supported algorithms
|
|
|
|
ID token signature verification supports:
|
|
`RS256`, `RS384`, `RS512`, `PS256`, `PS384`, `PS512`,
|
|
`ES256`, `ES384`, `ES512`, and `EdDSA`.
|
|
|
|
HMAC algorithms (`HS*`) are disabled by default and can be enabled by adding
|
|
them to `allowed_id_token_algorithms` if your provider uses them.
|