Package: kinto-fxa
Firefox Accounts support in KintoKinto-fxaenables authentication inKintoapplications usingFirefox AccountsOAuth2 bearer tokens.N.B. This project used to be calledcliquet-fxa, but was renamed tokinto-fxafollowing the rename of thecliquetproject tokinto.It provides:An authentication policy class;Integration withKintocache backend for token verifications;Integration withKintofor heartbeat view checks;Some optional endpoints to perform theOAuthdance (optional).Kinto documentationIssue trackerInstallationAsstated in the official documentation,
Firefox Accounts OAuth integration is currently limited to Mozilla relying services.Install the Python package:pip install kinto-fxaInclude the package in the project configuration:kinto.includes = kinto_fxaAnd configure authentication policy usingpyramid_multiauthformalism:multiauth.policies = fxa
multiauth.policy.fxa.use = kinto_fxa.authentication.FxAOAuthAuthenticationPolicyBy default, it will rely on the cache configured inKinto.ConfigurationFill those settings with the values obtained during the application registration:fxa-oauth.client_id = 89513028159972bc
fxa-oauth.client_secret = 9aced230585cc0aaea0a3467dd800
fxa-oauth.oauth_uri = https://oauth-stable.dev.lcip.org/v1
fxa-oauth.requested_scope = profile kinto
fxa-oauth.required_scope = kinto
fxa-oauth.webapp.authorized_domains = *
# fxa-oauth.cache_ttl_seconds = 300
# fxa-oauth.state.ttl_seconds = 3600In case the application shall not behave as a relier (a.k.a. OAuth dance
endpoints disabled):fxa-oauth.relier.enabled = falseIf necessary, override default values for authentication policy:# multiauth.policy.fxa.realm = RealmHandling multiple FxA clientsIf you want to isolate data between two FxA apps using the same Kinto
service to sync their data you can define client specific
configuration:fxa-oauth.clients.notes.client_id = 89513028159972bc
fxa-oauth.clients.notes.required_scope = profile app-notes

fxa-oauth.clients.todo.client_id = 1805184631529d5a
fxa-oauth.clients.todo.required_scope = profile app-todoDepending on the requested scopes, Kinto Fxa will assign a user id or
another (using a suffix):fxa:{user_id}-notesfor the formerfxa:{user_id}-todofor the laterNote that you can still usefxa:{user_id}to explicitely share data between
apps for a given FxA user.If you don’t give any specific permission, it will be impossible for
someone logged in in with theapp-notesscope in their Bearer token to
access the todo app data.The default buckets will also be isolated, one fornotesand one fortodo.Login flowOAuth Bearer tokenUse the OAuth token with this header:Authorization: Bearer <oauth_token>notes:If the token is not valid, this will result in a401error response.Obtain token using Web UINavigate the client toGET/fxa-oauth/login?redirect=http://app-endpoint/#.
There, a session cookie will be set, and the client will be redirected to a login
form on the FxA content server;After submitting the credentials on the login page, the client will
be redirected tohttp://app-endpoint/#{token}(the web-app).Obtain token custom flowTheGET/v1/fxa-oauth/paramsendpoint can be use to get the
configuration in order to trade theFirefox AccountsBrowserID with aBearer Token.See Firefox Account documentation about this behavior$ http GET http://localhost:8000/v0/fxa-oauth/params -vGET/v0/fxa-oauth/paramsHTTP/1.1Accept:*/*Accept-Encoding:gzip, deflateHost:localhost:8000User-Agent:HTTPie/0.8.0HTTP/1.1 200 OK
Content-Length: 103
Content-Type: application/json; charset=UTF-8
Date: Thu, 19 Feb 2015 09:28:37 GMT
Server: waitress

{
    "client_id": "89513028159972bc",
    "oauth_uri": "https://oauth-stable.dev.lcip.org",
    "scope": "profile"
}ScriptsThekinto-fxalibrary installs akinto-fxacommand which is
used to run utility scripts that come with thekinto-fxaplugin. Right now the only one isprocess-account-events, which
listens to an Amazon SQS queue for account deletion events and tries
to delete a user’s data to comply with GDPR.These scripts have some additional dependencies; you may need topip installkinto-fxa[scripts]to install them.To use them, runkinto-fxa[script-name][arguments].ChangelogThis document describes changes between each past release.2.5.3 (2019-07-02)OptimizationTry to keepOAuthClientaround longer to take advantage of HTTP keepalives (#133).2.5.2 (2018-07-05)Bug fixesFix theprocess-account-eventsscript to take client user ID suffixes into account (fixes #61)2.5.1 (2018-06-28)Set up metrics on theprocess-account-eventsscript (#57).Set up logging on thekinto_fxa.scriptsprograms (#58).2.5.0 (2018-05-17)Introduce newkinto_fxa.scripts. Right now the only script
available isprocess-account-events, which listens to an SQS
queue for user delete events and deletes data from that user’s
default bucket, in order to comply with GDPR.2.4.1 (2018-03-15)Move kinto-fxa to the Kinto github org. (#54)2.4.0 (2017-11-27)Add support for multiple FxA Clients (#52)2.3.1 (2017-01-30)Bug fixesMake sure that caching of token verification nevers prevents from authenticating
requests (see Mozilla/PyFxA#48)2.3.0 (2016-12-22)Internal changesMigrate schemas to Cornice 2 #382.2.0 (2016-10-27)New featuresImprove FxA error messages (fixes #1)Bug fixesOptimize authentication policy to avoid validating the token several times
per request (fixes #33)Internal changesUse Service from kinto.core (fixes #28)Make sure it does not catch Cornice 2 dependency (#36)2.1.0 (2016-09-08)Add the plugin version in the capability.2.0.0 (2016-05-19)Breaking changesProject renamed toKinto-fxato match the rename ofcliquettokinto.core.Update tokinto.corefor compatibility with Kinto 3.0. This
release is no longer compatible with Kinto < 3.0, please upgrade!WithKinto> 2.12*, the settingmultiauth.policy.fxa.usemust now
be explicitly set tokinto_fxa.authentication.FxAOAuthAuthenticationPolicyBug fixesFix checking ofAuthorizationheader when python is ran-O(ref mozilla-services/cliquet#592)1.4.0 (2015-10-28)Updated toCliquet2.9.0Breaking changescliquet-fxacannot be included usingpyramid.includessetting.
Usecliquet.includesinstead.1.3.2 (2015-10-22)Bug fixesIn case the Oauth dance is interrupted, return a408 Request Timeouterror instead of the401 Unauthenticatedone. (#11)Do not callcliquet.load_default_settingsfrom cliquet-fxa (#12)1.3.1 (2015-09-29)Separate multiple scopes by a + in login URL.1.3.0 (2015-09-29)Bug fixesMultiple scopes can be requested on the login flow.Multiple scopes can be required for the app.Configuration changesfxa-oauth.scopeis now deprecated.fxa-oauth.requested_scopeandfxa-oauth.required_scopeshould be used instead.1.2.0 (2015-06-24)Add default settings to define a policy “fxa”.
It is now possible to just includecliquet_fxaand
addfxatomultiauth.policiessetting list.Do not check presence of cliquet cache in initialization
phase.Do not use Cliquet logger to prevent initialization errors.1.1.0 (2015-06-18)Do not prefix authenticated user withfxa_anymore (#5)1.0.0 (2015-06-09)Imported code fromCliquetContributorsAlexis Metaireau <alexis@mozilla.com>Mathieu Leplatre <mathieu@mozilla.com>Nicolas Perriault <nperriault@mozilla.com>Rémy Hubscher <rhubscher@mozilla.com>Tarek Ziade <tarek@mozilla.com>Lavish Aggarwal <lucky.lavish@gmail.com>