Implement default configuration.

rohe · rohe · commit aca18578a8c6 · 2023-06-14T10:37:09.000+02:00
diff --git a/src/idpyoidc/node.py b/src/idpyoidc/node.py
@@ -3,8 +3,10 @@
 from typing import Union
 
 from cryptojwt import KeyJar
+from cryptojwt.key_jar import build_keyjar
 from cryptojwt.key_jar import init_key_jar
 
+from idpyoidc.client.defaults import DEFAULT_KEY_DEFS
 from idpyoidc.configure import Configuration
 from idpyoidc.impexp import ImpExp
 from idpyoidc.util import instantiate
@@ -101,9 +103,9 @@ def __init__(
         key_conf = key_conf or config.get("key_conf", config.get("keys"))
 
         if not keyjar and not key_conf:
+            keyjar = KeyJar()
             _jwks = config.get("jwks")
             if _jwks:
-                keyjar = KeyJar()
                 keyjar.import_jwks_as_json(_jwks, client_id)
 
         if keyjar or key_conf:
@@ -123,7 +125,9 @@ def __init__(
                     self.keyjar.add_symmetric(client_id, _key)
                     self.keyjar.add_symmetric("", _key)
             else:
-                self.keyjar = None
+                self.keyjar = build_keyjar(DEFAULT_KEY_DEFS)
+                if issuer_id:
+                    self.keyjar.import_jwks(self.keyjar.export_jwks(private=True), issuer_id)
 
         self.httpc_params = httpc_params or config.get("httpc_params", {})
 
diff --git a/src/idpyoidc/server/configure.py b/src/idpyoidc/server/configure.py
@@ -7,16 +7,14 @@
 from typing import List
 from typing import Optional
 
+from idpyoidc.client.defaults import OAUTH2_SERVER_METADATA_URL
 from idpyoidc.configure import Base
 from idpyoidc.server.client_configure import verify_oidc_client_information
 from idpyoidc.server.scopes import SCOPE2CLAIMS
 
 logger = logging.getLogger(__name__)
 
-OP_DEFAULT_CONFIG = {
-    "preference": {
-        "subject_types_supported": ["public", "pairwise"],
-    },
+_DEFAULT_CONFIG = {
     "cookie_handler": {
         "class": "idpyoidc.server.cookie_handler.CookieHandler",
         "kwargs": {
@@ -39,7 +37,83 @@
             },
         },
     },
-    "claims_interface": {"class": "idpyoidc.server.session.claims.ClaimsInterface", "kwargs": {}},
+    "claims_interface": {
+        "class": "idpyoidc.server.session.claims.ClaimsInterface",
+        "kwargs": {}
+    },
+    "httpc_params": {"verify": False, "timeout": 4},
+    "issuer": "https://{domain}:{port}",
+    "template_dir": "templates"
+}
+
+AS_DEFAULT_CONFIG = copy.deepcopy(_DEFAULT_CONFIG)
+_C = {
+    "authz": {
+        "class": "idpyoidc.server.authz.AuthzHandling",
+        "kwargs": {
+            "grant_config": {
+                "usage_rules": {
+                    "authorization_code": {
+                        "supports_minting": ["access_token", "refresh_token"],
+                        "max_usage": 1,
+                        "expires_in": 120  # 2 minutes
+                    },
+                    "access_token": {"expires_in": 3600},  # An hour
+                    "refresh_token": {
+                        "supports_minting": ["access_token", "refresh_token"],
+                        "expires_in": 86400,  # One day
+                    },
+                },
+                "expires_in": 2592000,  # a month, 30 days
+            }
+        }
+    },
+    "claims_interface": {
+        "class": "idpyoidc.server.session.claims.ClaimsInterface",
+        "kwargs": {
+            "claims_release_points": ["introspection", "access_token"]
+        }
+    },
+    "endpoint": {
+        "provider_info": {
+            "path": OAUTH2_SERVER_METADATA_URL[3:],
+            "class": "idpyoidc.server.oauth2.server_metadata.ServerMetadata",
+            "kwargs": {"client_authn_method": None},
+        },
+        "authorization": {
+            "path": "authorization",
+            "class": "idpyoidc.server.oauth2.authorization.Authorization",
+            "kwargs": {
+                "client_authn_method": None,
+                "claims_parameter_supported": True,
+                "request_parameter_supported": True,
+                "request_uri_parameter_supported": True,
+                "response_types_supported": ["code"],
+                "response_modes_supported": ["query", "fragment", "form_post"],
+            },
+        },
+        "token": {
+            "path": "token",
+            "class": "idpyoidc.server.oauth2.token.Token",
+            "kwargs": {
+                "client_authn_method": [
+                    "client_secret_post",
+                    "client_secret_basic",
+                    "client_secret_jwt",
+                    "private_key_jwt",
+                ]
+            }
+        }
+    }
+}
+
+AS_DEFAULT_CONFIG.update(_C)
+
+OP_DEFAULT_CONFIG = copy.deepcopy(_DEFAULT_CONFIG)
+OP_DEFAULT_CONFIG.update({
+    "preference": {
+        "subject_types_supported": ["public", "pairwise"],
+    },
     "authz": {
         "class": "idpyoidc.server.authz.AuthzHandling",
         "kwargs": {
@@ -52,18 +126,22 @@
                             "id_token",
                         ],
                         "max_usage": 1,
+                        'expires_in': 120  # 2 minutes
                     },
-                    "access_token": {},
+                    "access_token": {'expires_in': 3600},  # An hour
                     "refresh_token": {
-                        "supports_minting": ["access_token", "refresh_token"],
-                        "expires_in": -1,
+                        "supports_minting": ["access_token", "refresh_token", "id_token"],
+                        "expires_in": 86400,  # One day
                     },
                 },
-                "expires_in": 43200,
+                "expires_in": 2592000,  # a month, 30 days
             }
         },
     },
-    "httpc_params": {"verify": False, "timeout": 4},
+    "claims_interface": {
+        "class": "idpyoidc.server.session.claims.ClaimsInterface",
+        "kwargs": {}
+    },
     "endpoint": {
         "provider_info": {
             "path": ".well-known/openid-configuration",
@@ -109,8 +187,6 @@
             "kwargs": {"claim_types_supported": ["normal", "aggregated", "distributed"]},
         },
     },
-    "issuer": "https://{domain}:{port}",
-    "template_dir": "templates",
     "token_handler_args": {
         "jwks_file": "private/token_jwks.json",
         "code": {"kwargs": {"lifetime": 600}},
@@ -125,13 +201,8 @@
         "id_token": {"class": "idpyoidc.server.token.id_token.IDToken", "kwargs": {}},
     },
     "scopes_to_claims": SCOPE2CLAIMS,
-}
+})
 
-AS_DEFAULT_CONFIG = copy.deepcopy(OP_DEFAULT_CONFIG)
-AS_DEFAULT_CONFIG["claims_interface"] = {
-    "class": "idpyoidc.server.session.claims.OAuth2ClaimsInterface",
-    "kwargs": {},
-}
 
 
 class EntityConfiguration(Base):
@@ -160,15 +231,15 @@ class EntityConfiguration(Base):
     }
 
     def __init__(
-        self,
-        conf: Dict,
-        base_path: Optional[str] = "",
-        entity_conf: Optional[List[dict]] = None,
-        domain: Optional[str] = "",
-        port: Optional[int] = 0,
-        file_attributes: Optional[List[str]] = None,
-        dir_attributes: Optional[List[str]] = None,
-        upstream_get: Optional[Callable] = None,
+            self,
+            conf: Dict,
+            base_path: Optional[str] = "",
+            entity_conf: Optional[List[dict]] = None,
+            domain: Optional[str] = "",
+            port: Optional[int] = 0,
+            file_attributes: Optional[List[str]] = None,
+            dir_attributes: Optional[List[str]] = None,
+            upstream_get: Optional[Callable] = None,
     ):
 
         conf = copy.deepcopy(conf)
@@ -232,14 +303,14 @@ class OPConfiguration(EntityConfiguration):
     )
 
     def __init__(
-        self,
-        conf: Dict,
-        base_path: Optional[str] = "",
-        entity_conf: Optional[List[dict]] = None,
-        domain: Optional[str] = "",
-        port: Optional[int] = 0,
-        file_attributes: Optional[List[str]] = None,
-        dir_attributes: Optional[List[str]] = None,
+            self,
+            conf: Dict,
+            base_path: Optional[str] = "",
+            entity_conf: Optional[List[dict]] = None,
+            domain: Optional[str] = "",
+            port: Optional[int] = 0,
+            file_attributes: Optional[List[str]] = None,
+            dir_attributes: Optional[List[str]] = None,
     ):
         super().__init__(
             conf=conf,
@@ -256,14 +327,14 @@ class ASConfiguration(EntityConfiguration):
     "Authorization server configuration"
 
     def __init__(
-        self,
-        conf: Dict,
-        base_path: Optional[str] = "",
-        entity_conf: Optional[List[dict]] = None,
-        domain: Optional[str] = "",
-        port: Optional[int] = 0,
-        file_attributes: Optional[List[str]] = None,
-        dir_attributes: Optional[List[str]] = None,
+            self,
+            conf: Dict,
+            base_path: Optional[str] = "",
+            entity_conf: Optional[List[dict]] = None,
+            domain: Optional[str] = "",
+            port: Optional[int] = 0,
+            file_attributes: Optional[List[str]] = None,
+            dir_attributes: Optional[List[str]] = None,
     ):
         EntityConfiguration.__init__(
             self,
diff --git a/src/idpyoidc/server/session/claims.py b/src/idpyoidc/server/session/claims.py
@@ -1,4 +1,5 @@
 import logging
+from typing import List
 from typing import Optional
 from typing import Union
 
@@ -26,8 +27,10 @@ class ClaimsInterface:
     init_args = {"add_claims_by_scope": False, "enable_claims_per_client": False}
     claims_release_points = ["userinfo", "introspection", "id_token", "access_token"]
 
-    def __init__(self, upstream_get):
+    def __init__(self, upstream_get, claims_release_points:List[str] = None):
         self.upstream_get = upstream_get
+        if claims_release_points:
+            self.claims_release_points = claims_release_points
 
     def authorization_request_claims(
         self,
diff --git a/tests/private/token_jwks.json b/tests/private/token_jwks.json
@@ -1 +1 @@
-{"keys": [{"kty": "oct", "use": "enc", "kid": "code", "k": "vSHDkLBHhDStkR0NWu8519rmV5zmnm5_"}, {"kty": "oct", "use": "enc", "kid": "refresh", "k": "vqIt8YWhzwe9_Ws49kIJVoW3-Y60T_z_"}]}
+{"keys": [{"kty": "oct", "use": "enc", "kid": "code", "k": "vSHDkLBHhDStkR0NWu8519rmV5zmnm5_"}]}
diff --git a/tests/static/jwks.json b/tests/static/jwks.json
@@ -1 +1 @@
-{"keys": [{"kty": "RSA", "use": "sig", "kid": "YnNESFhyQjloMnYzV2VqRGR2a3VCblFLX2h4VGl3TDVlY3FUNkViUE90bw", "e": "AQAB", "n": "2iMaDALTQolz4UaT--GhjriLMyNbrDGlIXxSmgRh17Cm3cuHiyPOIQv1pjZVg4ATU1aafxmFyTfrmtf56tPuJ8yqcNNZC8XadYPAw7PTW9g8GJgLtC8GURJ9GQZD6FYIE6YCou8fYo6yd4b99y2y_vsl06cm9xQnstfp6eyMkcgQyrmdmlbyeuXwvcxsxtGX61MTJtCp4VELmDctJiYP_bD7HNRPV7uqXDMNmWSY0TYL-tg0As4y8-w3wSwmtcfWhnQEraFT0-m4hBpEWHlouuFNXRQIrXbamKxeh6kJNO0wJN8fZ4Ovygf8sE4kEwBPfWO59wxDF7camTpDUqg29Q"}, {"kty": "EC", "use": "sig", "kid": "aWhtalRSTDZmNmRTd1ZDNWZmY3ZGMTNqM1dnLVA2RjQyMi1CNGdOSUNKVQ", "crv": "P-256", "x": "Ww5XVT3CxYN88BpJDZGodRiar0qr8UvPFaRoqzyD1Io", "y": "w23EDFAvwe03NjL5NKtUXwxuVMFmEn3ecJOPbljiDkg"}]}
+{"keys": [{"kty": "RSA", "use": "sig", "kid": "YnNESFhyQjloMnYzV2VqRGR2a3VCblFLX2h4VGl3TDVlY3FUNkViUE90bw", "n": "2iMaDALTQolz4UaT--GhjriLMyNbrDGlIXxSmgRh17Cm3cuHiyPOIQv1pjZVg4ATU1aafxmFyTfrmtf56tPuJ8yqcNNZC8XadYPAw7PTW9g8GJgLtC8GURJ9GQZD6FYIE6YCou8fYo6yd4b99y2y_vsl06cm9xQnstfp6eyMkcgQyrmdmlbyeuXwvcxsxtGX61MTJtCp4VELmDctJiYP_bD7HNRPV7uqXDMNmWSY0TYL-tg0As4y8-w3wSwmtcfWhnQEraFT0-m4hBpEWHlouuFNXRQIrXbamKxeh6kJNO0wJN8fZ4Ovygf8sE4kEwBPfWO59wxDF7camTpDUqg29Q", "e": "AQAB"}, {"kty": "EC", "use": "sig", "kid": "aWhtalRSTDZmNmRTd1ZDNWZmY3ZGMTNqM1dnLVA2RjQyMi1CNGdOSUNKVQ", "crv": "P-256", "x": "Ww5XVT3CxYN88BpJDZGodRiar0qr8UvPFaRoqzyD1Io", "y": "w23EDFAvwe03NjL5NKtUXwxuVMFmEn3ecJOPbljiDkg"}]}
diff --git a/tests/test_server_24_oauth2_token_endpoint_def_conf.py b/tests/test_server_24_oauth2_token_endpoint_def_conf.py
diff --git a/tests/test_server_35_oidc_token_endpoint_def_conf.py b/tests/test_server_35_oidc_token_endpoint_def_conf.py

Original file line number	Diff line number	Diff line change
`@@ -1 +1 @@`
`1`		`-{"keys": [{"kty": "oct", "use": "enc", "kid": "code", "k": "vSHDkLBHhDStkR0NWu8519rmV5zmnm5_"}, {"kty": "oct", "use": "enc", "kid": "refresh", "k": "vqIt8YWhzwe9_Ws49kIJVoW3-Y60T_z_"}]}`
	`1`	`+{"keys": [{"kty": "oct", "use": "enc", "kid": "code", "k": "vSHDkLBHhDStkR0NWu8519rmV5zmnm5_"}]}`
Original file line number	Diff line number	Diff line change
`@@ -1 +1 @@`
`1`		-{"keys": [{"kty": "RSA", "use": "sig", "kid": "YnNESFhyQjloMnYzV2VqRGR2a3VCblFLX2h4VGl3TDVlY3FUNkViUE90bw", "e": "AQAB", "n": "2iMaDALTQolz4UaT--GhjriLMyNbrDGlIXxSmgRh17Cm3cuHiyPOIQv1pjZVg4ATU1aafxmFyTfrmtf56tPuJ8yqcNNZC8XadYPAw7PTW9g8GJgLtC8GURJ9GQZD6FYIE6YCou8fYo6yd4b99y2y_vsl06cm9xQnstfp6eyMkcgQyrmdmlbyeuXwvcxsxtGX61MTJtCp4VELmDctJiYP_bD7HNRPV7uqXDMNmWSY0TYL-tg0As4y8-w3wSwmtcfWhnQEraFT0-m4hBpEWHlouuFNXRQIrXbamKxeh6kJNO0wJN8fZ4Ovygf8sE4kEwBPfWO59wxDF7camTpDUqg29Q"}, {"kty": "EC", "use": "sig", "kid": "aWhtalRSTDZmNmRTd1ZDNWZmY3ZGMTNqM1dnLVA2RjQyMi1CNGdOSUNKVQ", "crv": "P-256", "x": "Ww5XVT3CxYN88BpJDZGodRiar0qr8UvPFaRoqzyD1Io", "y": "w23EDFAvwe03NjL5NKtUXwxuVMFmEn3ecJOPbljiDkg"}]}
	`1`	+{"keys": [{"kty": "RSA", "use": "sig", "kid": "YnNESFhyQjloMnYzV2VqRGR2a3VCblFLX2h4VGl3TDVlY3FUNkViUE90bw", "n": "2iMaDALTQolz4UaT--GhjriLMyNbrDGlIXxSmgRh17Cm3cuHiyPOIQv1pjZVg4ATU1aafxmFyTfrmtf56tPuJ8yqcNNZC8XadYPAw7PTW9g8GJgLtC8GURJ9GQZD6FYIE6YCou8fYo6yd4b99y2y_vsl06cm9xQnstfp6eyMkcgQyrmdmlbyeuXwvcxsxtGX61MTJtCp4VELmDctJiYP_bD7HNRPV7uqXDMNmWSY0TYL-tg0As4y8-w3wSwmtcfWhnQEraFT0-m4hBpEWHlouuFNXRQIrXbamKxeh6kJNO0wJN8fZ4Ovygf8sE4kEwBPfWO59wxDF7camTpDUqg29Q", "e": "AQAB"}, {"kty": "EC", "use": "sig", "kid": "aWhtalRSTDZmNmRTd1ZDNWZmY3ZGMTNqM1dnLVA2RjQyMi1CNGdOSUNKVQ", "crv": "P-256", "x": "Ww5XVT3CxYN88BpJDZGodRiar0qr8UvPFaRoqzyD1Io", "y": "w23EDFAvwe03NjL5NKtUXwxuVMFmEn3ecJOPbljiDkg"}]}