Package: cliquet-fxa
Deprecation NoticeWith the rename of cliquet to kinto.core, this package is no longer supported. Please upgrade to kinto-fxa instead!Firefox Accounts support in CliquetCliquet-fxaenables authentication inCliquetapplications usingFirefox AccountsOAuth2 bearer tokens.It provides:An authentication policy class;Integration withCliquetcache backend for token verifications;Integration withCliquetfor heartbeat view checks;Some optional endpoints to perform theOAuthdance (optional).Cliquet documentationIssue trackerInstallationAsstated in the official documentation,
Firefox Accounts OAuth integration is currently limited to Mozilla relying services.Install the Python package:pip install cliquet-fxaInclude the package in the project configuration:cliquet.includes = cliquet_fxaAnd configure authentication policy usingpyramid_multiauthformalism:multiauth.policies = fxaBy default, it will rely on the cache configured inCliquet.ConfigurationFill those settings with the values obtained during the application registration:fxa-oauth.client_id = 89513028159972bc
fxa-oauth.client_secret = 9aced230585cc0aaea0a3467dd800
fxa-oauth.oauth_uri = https://oauth-stable.dev.lcip.org
fxa-oauth.requested_scope = profile kinto
fxa-oauth.required_scope = kinto
fxa-oauth.webapp.authorized_domains = *.firefox.com
# fxa-oauth.cache_ttl_seconds = 300
# fxa-oauth.state.ttl_seconds = 3600In case the application shall not behave as a relier (a.k.a. OAuth dance
endpoints disabled):fxa-oauth.relier.enabled = falseIf necessary, override default values for authentication policy:# multiauth.policy.fxa.realm = Realm
# multiauth.policy.fxa.use = cliquet_fxa.authentication.FxAOAuthAuthenticationPolicyLogin flowOAuth Bearer tokenUse the OAuth token with this header:Authorization: Bearer <oauth_token>notes:If the token is not valid, this will result in a401error response.Obtain token using Web UINavigate the client toGET/fxa-oauth/login?redirect=http://app-endpoint/#.
There, a session cookie will be set, and the client will be redirected to a login
form on the FxA content server;After submitting the credentials on the login page, the client will
be redirected tohttp://app-endpoint/#{token}(the web-app).Obtain token custom flowTheGET/v1/fxa-oauth/paramsendpoint can be use to get the
configuration in order to trade theFirefox AccountsBrowserID with aBearer Token.See Firefox Account documentation about this behavior$ http GET http://localhost:8000/v0/fxa-oauth/params -vGET/v0/fxa-oauth/paramsHTTP/1.1Accept:*/*Accept-Encoding:gzip, deflateHost:localhost:8000User-Agent:HTTPie/0.8.0HTTP/1.1 200 OK
Content-Length: 103
Content-Type: application/json; charset=UTF-8
Date: Thu, 19 Feb 2015 09:28:37 GMT
Server: waitress

{
    "client_id": "89513028159972bc",
    "oauth_uri": "https://oauth-stable.dev.lcip.org",
    "scope": "profile"
}ChangelogThis document describes changes between each past release.1.4.0 (2015-10-28)Updated toCliquet2.9.0Breaking changescliquet-fxacannot be included usingpyramid.includessetting.
Usecliquet.includesinstead.1.3.2 (2015-10-22)Bug fixesIn case the Oauth dance is interrupted, return a408 Request Timeouterror instead of the401 Unauthenticatedone. (#11)Do not callcliquet.load_default_settingsfrom cliquet-fxa (#12)1.3.1 (2015-09-29)Separate multiple scopes by a + in login URL.1.3.0 (2015-09-29)Bug fixesMultiple scopes can be requested on the login flow.Multiple scopes can be required for the app.Configuration changesfxa-oauth.scopeis now deprecated.fxa-oauth.requested_scopeandfxa-oauth.required_scopeshould be used instead.1.2.0 (2015-06-24)Add default settings to define a policy “fxa”.
It is now possible to just includecliquet_fxaand
addfxatomultiauth.policiessetting list.Do not check presence of cliquet cache in initialization
phase.Do not use Cliquet logger to prevent initialization errors.1.1.0 (2015-06-18)Do not prefix authenticated user withfxa_anymore (#5)1.0.0 (2015-06-09)Imported code fromCliquetContributorsAlexis Metaireau <alexis@mozilla.com>Mathieu Leplatre <mathieu@mozilla.com>Nicolas Perriault <nperriault@mozilla.com>Rémy Hubscher <rhubscher@mozilla.com>Tarek Ziade <tarek@mozilla.com>