Package: cernrequests
CERN RequestsEnables usingrequestswithout having to configure the CERN Root certificates or getting an API access token manually.Inspired bycertifi,requests-kerberos,cern-sso-pythonandapi-access-examples.The Root certificate bundle is copied from thelinuxsoft cern pageand can also be created manually by downloading the CERN Grid Certification Authority files fromcafiles.cern.ch/cafiles.InstallationWarningWe are no longer supporting Python 2.7.Requires Python 3.6+.pipinstallcernrequestsPrerequisitesFor sites requiring an SSL Grid certificateRequest aGrid User Certificate(with password) and convert into public and private key:mkdir-p~/private
opensslpkcs12-inmyCertificate.p12-clcerts-nokeys-out~/private/usercert.pem# Will ask for the certificate passwordopensslpkcs12-inmyCertificate.p12-nocerts-nodes-out~/private/userkey.pem# Will ask for the certificate passwordThe.pemcertificates have to bepasswordless.For CERN APIs using the ""new"" SSOAn.envfile at the root of your project with the following variables set:SSO_CLIENT_IDSSO_CLIENT_SECRET(You can rename the.env_samplefile to.envand add the values there).To request them, you will need to register your application:Create an SSO registration for your application
on theCERN Application Portal:Add an application identifier and description:TheApplication Identifiercan be anything, it's like a username for your application.tClickSubmit.Go back to the Application Portal and edit the SSO application (green button). Then, go to theSSO Registrationtab and click the plus button:Fill out the form of the new SSO registration as follows:You can put any value in theRedirect URI(s), e.g.http://localhost/*Same for theBase URLMake sure you clickMy application will need to get tokens using its own client ID and secret.Submit the form:Note theclient idandclient secretthat the form will show you.UsageExampleWith Grid Certificatesimportcernrequestsurl="https://<your-cern-website>"response=cernrequests.get(url)With API TokenIf you want to access a website which requires a (""new"") CERN Single Sign-on token you can do the following:importcernrequestsurl="https://<your-cern-website-url>"reponse=cernrequests.get_with_token(url,target_audience="<the SSO id of the target URL>")NoteThetarget_audiencedepends on the SSO registration name of thetargetapplication. E.g.
if you want to access the development instance of Run Registry,target_audienceshould bedev-cmsrunregistry-sso-proxy.
In case of doubt, communicate with the app's developers directly.Theget_with_tokenmethod also accepts anapi_tokenargument, in case you want to reuse an already issued and non-expired one that you got fromget_api_token.get_api_tokenThis is a method that needs atarget_applicationparameter and will try and get an API token, using theSSO_CLIENT_IDandSSO_CLIENT_SECRETprovided as environment variables.Atupleis returned:api_token(str) and theexpiration_datetime(datetime).NoteTheexpiration_datetimeis not used internally, so it's returned
to the user, if they need to check when the token expires.Alternative usageIf you want to userequestsdirectly without the CERN wrapper you can get the exact same functionality by doing:importrequestsfromcernrequestsimportcertsurl="https://<your-cern-website>"cert=certs.default_user_certificate_paths()ca_bundle=certs.where()response=requests.get(url,cert=cert,verify=ca_bundle)ConfigurationGrid certificatesThe default user certificate paths are first~\private\and~\.globus\for fallback. The defaultpublickey file name isusercert.pemand the defaultprivatekey file name isuserkey.pemYou can configure the default grid user certificate path by setting theCERN_CERTIFICATE_PATHenvironment variable.For example:exportCERN_CERTIFICATE_PATH=${HOME}/my_custom_folderThis will still assume that your filenames areusercert.pemanduserkey.pemWrite this line in your.bashrcto make the configuration persistent.Alternatively you can also specify the paths directly in your code:importcernrequestsurl="https://<your-cern-website>"cert="my/custom/path/cert.pem"# Public key pathkey="my/custom/path/key.pem"# Private key pathcernrequests.get(url,cert=(cert,key))This way you can even use custom names such ascert.pemandkey.pemTestingLocallypython-mvenvvenvsourcevenv/bin/activate
pipinstall-e.
pipinstall-rtesting-requirements.txt
pytestGitHub actionsTo run the tests on GitHub, we have uploaded a set ofuserkey.pemandusercert.pemfiles, encrypted with GPG. Those are decrypted, using a secret and then used normally.Seethe yaml filefor more details.NoteIf the actions are failing, make sure that the Grid Certificates are still valid. You may need to recreate them. For instructions, seehere. Create new grid certificates, encrypt them with a password and replacetests/usercert.pem.gpgandtests/userkey.pem.gpg. You will also need to update theGPG_ENC_PASSWORDsecret with the password you used to encrypt them.[Package developers] Updating the package on PyPIpython3-mpipinstall--upgradepipbuildtwine
python3-mbuild
python3-mtwineupload--skip-existing--repositorypypidist/*Instructions fromhere.FAQI'm gettingcertificate verify failed! What should I do?Thecernrequests/cern-cacerts.pemfile has expired, and will need to be updated by the library maintainer.gitclonehttps://gitlab.cern.ch/linuxsupport/rpms/cern-ca-certs/cdcern-ca-certs/srcmakeThis will create aCERN-bundle.pemfile.Rename it tocern-cacerts.pemand replace the original.pemcertificate chain.Verify that the certs work by runningpytest.I'm getting403 Client Error: Forbidden for url: https://login.cern.ch/adfs/ls/auth/sslclienterrors!1 What should I do?Your grid certificate may have expired. Try creating a new one.You may be trying to access a CERN webpage using a grid certificate, but this method may be deprecated. Make sure that the web page allows SSL certificate authentication.Referenceshttp://docs.python-requests.org/en/master/https://certifi.io/en/latest/https://github.com/cerndb/cern-sso-pythonhttps://linux.web.cern.ch/linux/docs/cernssocookie.shtmlhttp://linuxsoft.cern.ch/cern/centos/7/cern/x86_64/repoview/CERN-CA-certs.htmlhttps://ca.cern.ch/ca/https://auth.docs.cern.ch