Package: id4me-rp-client
id4me-rp-clientPython Relying Party client library for ID4me protocol.
For details of the protocol, please visit:https://id4me.orgLibrary offers Relying Party functionality for authentication with Identity Authority and claim request from the Identity Agent..Specification referencehttps://gitlab.com/ID4me/documentation/blob/master/id4ME%20Technical%20Specification.adocVersion: 1.0Revision: 02Installationpipinstallid4me-rp-clientUsageRegister the client and authorize with Identity Authorityfromid4me_rp_clientimport*# these imports are just needed in this examplefrombuiltinsimportinputimportjsonimportuuidregistrations=dict()# a routine to save client registration at authoritydefsave_authority_registration(auth_name,auth_content):registrations[auth_name]=auth_contentpass# a routine to load client registration at authoritydefload_authority_registration(auth_name):returnregistrations[auth_name]# create client object with basic parameters of your appclient=ID4meClient(get_client_registration=load_authority_registration,save_client_registration=save_authority_registration,app_type=OIDCApplicationType.web,validate_url='https://dynamicdns.domainconnect.org/ddnscode',client_name='Foo app',logo_url='https://upload.wikimedia.org/wikipedia/commons/7/76/Foobar2000_logo_2014.png',policy_url='https://foo.com/policy',tos_url='https://foo.com/tos',private_jwks_json=ID4meClient.generate_new_private_keys_set())try:# make a discovery of identity authority and register if needed# find_authority and save_authority are optional, but when missing client will be registered each time anewctx=client.get_rp_context(id4me='id200.connect.domains')# get a link to login routinelink=client.get_consent_url(ctx,claimsrequest=ID4meClaimsRequest(userinfo_claims={OIDCClaim.name:ID4meClaimRequestProperties(reason='To call you by name'),OIDCClaim.email:ID4meClaimRequestProperties(essential=True,reason='To be able to contact you'),OIDCClaim.email_verified:ID4meClaimRequestProperties(reason='To know if your E-mail was verified'),}),state=str(uuid.uuid4()))print('Please open the link:\n{}'.format(link))# Normally code will arrive as query param on client.validateUrlcode=input('Please enter code: ')# Get ID tokenid_token=client.get_idtoken(context=ctx,code=code)print('ID Token:\n{}'.format(json.dumps(id_token,sort_keys=True,indent=4)))# Get User Infouserinfo=client.get_user_info(context=ctx)print('User Info:\n{}'.format(json.dumps(userinfo,sort_keys=True,indent=4)))exceptID4meExceptionase:print('Exception:{}'.format(e))Output:Resolving "_openid.id200.connect.domains."
Checking TXT record "v=OID1;iss=id.test.denic.de;clp=identityagent.de"
identity_authority = auth.freedom-id.de
registering with new identity authority (auth.freedom-id.de)
destination = https://auth.freedom-id.de/login?scope=openid&response_type=code&client_id=hmkzay2riyon4&redirect_uri=https%3A//foo.com/validate&login_hint=id200.connect.domains&state=&claims=%7B%22userinfo%22%3A%20%7B%22email_verified%22%3A%20%7B%22reason%22%3A%20%22To%20know%20if%20your%20E-mail%20was%20verified%22%7D%2C%20%22email%22%3A%20%7B%22reason%22%3A%20%22To%20be%20able%20to%20contact%20you%22%2C%20%22essential%22%3A%20true%7D%2C%20%22name%22%3A%20%7B%22reason%22%3A%20%22To%20call%20you%20by%20name%22%7D%7D%7D
Please open the link:
https://auth.freedom-id.de/login?scope=openid&response_type=code&client_id=hmkzay2riyon4&redirect_uri=https%3A//foo.com/validate&login_hint=id200.connect.domains&state=&claims=%7B%22userinfo%22%3A%20%7B%22email_verified%22%3A%20%7B%22reason%22%3A%20%22To%20know%20if%20your%20E-mail%20was%20verified%22%7D%2C%20%22email%22%3A%20%7B%22reason%22%3A%20%22To%20be%20able%20to%20contact%20you%22%2C%20%22essential%22%3A%20true%7D%2C%20%22name%22%3A%20%7B%22reason%22%3A%20%22To%20call%20you%20by%20name%22%7D%7D%7D
Please enter code: >? 9jNXCX9OZ4HQLr2YZWKisw.5mSDkoR-5YJQoTp3f1vuxg
User Info:
{
    "aud": "hmkzay2riyon4", 
    "email": "foo@bar.de", 
    "email_verified": true, 
    "exp": 1538762218, 
    "iat": 1538761918, 
    "id4me.identifier": "id200.connect.domains", 
    "id4me.identity": "id200.connect.domains", 
    "iss": "https://auth.freedom-id.de", 
    "nbf": 1538761918, 
    "sub": "uiw3pTRRLVaKJqbnbSwr4EVuhEPTHvRgci91RbhYU2rab/YVDqDmqTKzTVAdDMm+", 
    "updated_at": 1538564738
}Requesting custom claimsIn order to request a custom claim, it's enough to pass its name as a key inuserinfo_claimsorid_token_claimsparameters ofID4meClient.get_consent_urlmethod.Example...link=client.get_consent_url(ctx=context,claimsrequest=ID4meClaimsRequest(userinfo_claims={OIDCClaim.email:ID4meClaimRequestProperties(essential=True,reason='Test other confusing reason'),'id4me.custom':ID4meClaimRequestProperties(essential=True,reason='Custom claim reason')}))...CHANGELOG:versiondatechanges0.0.242019-11-26NEW FEATURE: Support "none" as "alg" of id_tokenNEW FEATURE: allow override of authority lookupNEW FEATURE: userinfo_signing_required now can be configured in client codeNEW FEATURE: RS384 and RS512 added as supported signature optionsREFACTORING: cleaned up the code of dynamic client registrationBUGFIX: using 'none' algorithms only if supported0.0.232019-10-04NEW FEATURE: plain JSON user info support addedNEW FEATURE: use of scope parameter instead of claims if not supported by IdPNEW: example code included0.0.222019-07-29BUGFIX: id4me_rp_client.helper not exported to the release library0.0.212019-07-29BUGFIX: YXDOMAIN case not properly handledBUGFIX: avoid trying to resolve empty domain namesBUGFIX: added better handling when state is emptyLOGGING: added logging of all exceptions (debug level)0.0.202019-05-23NEW FEATURE: E-mail address hashing as per spec change proposed inhttps://gitlab.com/ID4me/documentation/merge_requests/7MINOR CHANGE: finally deprecatedpreferred_client_idfrom registrationNEW FEATURE: timeout configurable via NetworkConfig0.0.192019-03-24TEST: added Kopano to the integration testBUGFIX: leeway to re-register set to 5 minutes istead of 2 hoursTEST: added password to mojeid test account0.0.182019-03-23NEW FEATURE: added support for E-mail like identifiers (just replace @ with .)NEW FEATURE: requesting claims with scopeWORKAROUND: accepting token_type as 'Bearer' and 'bearer'BUGFIX: 'tos_uri' assigned properly0.0.172019-03-19SECURITY FIX: Limited timeouts and size of downloaded data (DOS prevention)SECURITY FIX: Limited recoursion level of distributed claims (DOS prevention)0.0.162019-03-11MAJOR CHANGE: removed back-compatibility with old _openid record format0.0.152019-02-27- NEW FEATURE: Automatically re-register expired client registration- explicit parameter to enable/block automatic client registration0.0.142019-02-25No functional changes. Example code in README fixed0.0.132019-02-25No functional changes. TEST & EXAMPLE for custom claims added0.0.122019-02-21BUGFIX: Exception when no encryption used but private key missing0.0.112019-02-21BUGFIX, error when serializing ID4meContext0.0.102019-02-18API BREAKING CHANGE: client configuration loading callback moved to client object in order to remove secret data from the ID4meContext which can be in some frameworks sent over cookies