Package: pebbleauthclient
IntroductionThis library offer a client for authenticate user and licence management
written in Python compatible with may python API Server.InstallationRequirementsThe following procedures explains the installation of the following packages :Python 3.9 or higherpip (provided with Python package)PyJWT (tested with version 2.8.0)cryptography (tested with version 41.0.5)Solution 1 : requirement.txt configurationIf your project use a requirement.txt configuration file, simply add the
following.requirement.txt file addition:pebbleauthclient>=0.2.0Then run this command on your project :pip install -r requirements.txtOr in Dockerfile :RUNpipinstall-rrequirements.txtSolution 2 : Local installationCheck python3 is properly installed on your local machine (with pip working),
then run the following in the application directory.pip install pebbleauthclientOr in Dockerfile :RUNpipinstallpebbleauthclientNoteWe suggest to use the requirement.txt solution if you are using Docker.UsageConfigurationBefore you can work with the library, you must define a system environment
variable with the URI of the public Json Web Key Set (remote JWKS file).This file will be requested and storetemporaryon your API Server.
Your server should be able to write on./var/credentials/auth/jwks.json.
If the file does not exist, it will be created.If you start your server directly from a terminal, run this command on
your terminal before starting your server :export PBL_JWKS_REMOTE_URI=https://SERVER_URI/path/jwks.jsonIf you start your server within a Docker container, you should add this
line to your Dockefile :ENVPBL_JWKS_REMOTE_URI=https://SERVER_URI/path/jwks.jsonOther configurationsYou can add more configuration by defining some more environment variables on your
system. These configurations have values by default that works for most of the cases.Environment variableDefaultDescriptionPBL_JWKS_REMOTE_URIUnsetMANDATORYURI of the remote jwks.json file. This file contains all active public keys to decode token.PBL_CERTS_FOLDER./var/credentials/authLocal folder for temporary store authentication credentials. Storing locally the credentials improves server response.PBL_JWKS_EXP_TIME86400Duration in seconds after which Keys Set (JWKS) is considered as expired. All local copy of the keys must be destroyed and the remote server will be requested to create the new copy.Test keys pairAttention!These key files are not secured and must be used FOR TESTING PURPOSE
ONLY on a local development environment !JWKS URI (for PBL_JWKS_REMOTE_URI environment variable)https://storage.googleapis.com/pebble-public-cdn/test_auth/jwks_test.jsonPublic and private keys used to sign a tokenhttps://storage.googleapis.com/pebble-public-cdn/test_auth/public_test.pemhttps://storage.googleapis.com/pebble-public-cdn/test_auth/private_test.pemAuthenticate with token stringfrompebbleauthclient.authimportauthtry:authToken=auth("---A_valid_token---")print(authToken)print(authToken.get_user())print(authToken.get_authenticated_licence())exceptExceptionase:print("ERROR: "+e)Authenticate with HTTP Authorization headerNoteThis example shows one way to serverside authenticate a user with the Authorization
header. The important thing is to communicate a dict toauth_from_http_headers()function with a valid Authorization key value.fromhttp.serverimportHTTPServer,BaseHTTPRequestHandlerfrompebbleauthclient.authimportauth_from_http_headersclassHandleRequest(BaseHTTPRequestHandler):defdo_GET(self):try:auth_token=auth_from_http_headers(self.headers)licence=auth_token.get_authenticated_licence()user=auth_token.get_user()print(licence)print(user)self.send_response(200)self.send_header('Content-Type','text/plain')self.end_headers()self.wfile.write(bytes("Welcome "+user.username,'utf-8'))exceptException:self.send_response(401)self.end_headers()server=HTTPServer(('',8084),HandleRequest)print("Server is waiting...")server.serve_forever()server.server_close()Check the audienceAudience identifies the recipients that the token is intended for. Each resource
server MUST be identified by its audience name and the authorization process MUST
check that this audience exists in the token.WarningBy default, audience is not checked by the authentication process. It is
the responsibility of the resource server to communicate its audience name
in order to only accept token that has been generated for the this specific
resource server.To check the audience, add anoptionsdictionary to theauth()orauth_from_http_headers()functions.# Check that the provided token has a valid audience for api.pebble.solutions/v5/my-resourceauth_token=auth("----my.valid.token----",options={'audience':"api.pebble.solutions/v5/my-resource"})# Check that token communicate through authorization header has a valid audience# for api.pebble.solutions/v5/my-resourceauth_token=auth_from_http_headers(headers,options={'audience':"api.pebble.solutions/v5/my-resource"})