feat: added Refresh Token web interaction in userinfo.html #264

rglauco · 2023-07-04T13:25:24Z

fixed #261
fixed specific version of pydantic

# Conflicts: # spid_cie_oidc/relying_party/utils.py

Refresh token interface

setup.py

peppelinux · 2023-07-04T14:03:36Z

spid_cie_oidc/__init__.py

@@ -1 +1 @@
-__version__ = "0.8.15"
+__version__ = "0.8.16"


Suggested change

__version__ = "0.8.16"

__version__ = "0.9.0"

what about this @rglauco ?
It seems that we're introducing several, even if "missing", features

agree on that

spid_cie_oidc/relying_party/views/rp_extend_session.py

peppelinux · 2023-07-04T14:08:10Z

spid_cie_oidc/relying_party/templates/echo_attributes.html

+<div class="col-12 p-4">
+<h4>Attenzione:</h4>
+    <p>per abilitare le sessioni lunghe revocabili si deve valorizzare <em>OIDCFED_ACR_PROFILES</em> in settingslocal.py del Relying Party <em>OIDCFED_ACR_PROFILES=["https://www.spid.gov.it/SpidL2","https://www.spid.gov.it/SpidL1"]</em></p>
+{% else %}
+<div class="col-6 p-4">
+        <h4 class="text-left">ACCESS TOKEN</h4>
+    <p> L'access token <em>{{ rt_jti }}</em> <br />
+        scade tra <span id="at_time">{{ at_expiration }}</span> </p>
+</div>
+<div class="col-6 p-4">
+        <h4 class="text-left">REFRESH TOKEN <a href="{% url 'spid_cie_rp_extend_session' %}" class="btn btn-primary btn-xs btn-me" role="button">Prolunga Sessione</a></h4>
+
+    <p> Il Refresh Token <em>{{ rt_jti }}</em> <br />
+        scade tra <span id="rt_time">{{ rt_expiration }}</span> </p>
+    <div class="alert alert-warning" role="alert">
+        <p>NB: il numero di Refresh Token rilasciabili per una singola sessione &egrave; settato nella configurazione degli OP <em>OIDCFED_PROVIDER_MAX_REFRESH</em>. Superato questo numero il sistema restituisce errore HTTP/400</p>
+    </div>
+</div>
+{% endif %}


Suggested change

<div class="col-12 p-4">

<h4>Attenzione:</h4>

<p>per abilitare le sessioni lunghe revocabili si deve valorizzare <em>OIDCFED_ACR_PROFILES</em> in settingslocal.py del Relying Party <em>OIDCFED_ACR_PROFILES=["https://www.spid.gov.it/SpidL2","https://www.spid.gov.it/SpidL1"]</em></p>

{% else %}

<div class="col-6 p-4">

<h4 class="text-left">ACCESS TOKEN</h4>

<p> L'access token <em>{{ rt_jti }}</em> <br />

scade tra <span id="at_time">{{ at_expiration }}</span> </p>

</div>

<div class="col-6 p-4">

<h4 class="text-left">REFRESH TOKEN <a href="{% url 'spid_cie_rp_extend_session' %}" class="btn btn-primary btn-xs btn-me" role="button">Prolunga Sessione</a></h4>

<p> Il Refresh Token <em>{{ rt_jti }}</em> <br />

scade tra <span id="rt_time">{{ rt_expiration }}</span> </p>

<div class="alert alert-warning" role="alert">

<p>NB: il numero di Refresh Token rilasciabili per una singola sessione è settato nella configurazione degli OP <em>OIDCFED_PROVIDER_MAX_REFRESH</em>. Superato questo numero il sistema restituisce errore HTTP/400</p>

</div>

</div>

{% endif %}

<div class="col-12 p-4">

<h4>{% trans "Attenzione" %}:</h4>

<p>{% trans 'Per abilitare le sessioni lunghe revocabili si deve valorizzare <em>OIDCFED_ACR_PROFILES</em> in settingslocal.py del Relying Party <em>OIDCFED_ACR_PROFILES=["https://www.spid.gov.it/SpidL2","https://www.spid.gov.it/SpidL1"]</em>' %}</p>

{% else %}

<div class="col-6 p-4">

<h4 class="text-left">ACCESS TOKEN</h4>

<p> L'access token <em>{{ rt_jti }}</em> <br />

scade tra <span id="at_time">{{ at_expiration }}</span> </p>

</div>

<div class="col-6 p-4">

<h4 class="text-left">REFRESH TOKEN <a href="{% url 'spid_cie_rp_extend_session' %}" class="btn btn-primary btn-xs btn-me" role="button">{% trans "Prolunga Sessione" %}</a></h4>

<p>{% trans "The" %} Refresh Token <em>{{ rt_jti }}</em> <br />

{% trans "scade tra" %} <span id="rt_time">{{ rt_expiration }}</span> </p>

<div class="alert alert-warning" role="alert">

<p>{% trans "NB: il numero di Refresh Token rilasciabili per una singola sessione è settato nella configurazione degli OP <em>OIDCFED_PROVIDER_MAX_REFRESH</em>. Superato questo numero il sistema restituisce errore HTTP/400" %}</p>

</div>

</div>

{% endif %}

We have the requirement to localize each text string and have by default english and not italian

@rglauco can you please apply my suggestion and then rework to english?

peppelinux · 2023-07-04T14:09:25Z

spid_cie_oidc/relying_party/templates/rp_landing.html

@@ -63,6 +63,18 @@ <h3 class="text-left">
                                    {% endif %}
                                </a>
                            </li>
+                         <li>
+                            <a href="{% url 'spid_cie_rp_begin' %}?provider={{sub}}&profile=spid&scope=openid offline_access" id="provider-spid-refresh_token">
+                                <span class="spid-sr-only">{{ attrs.organization_name }} SESSIONE A LUNGO TERMINE</span>


as well here, {% trans "" %} block is then required for every text string given to the users

Op test revision

…evision

peppelinux · 2023-07-07T12:59:49Z

spid_cie_oidc/provider/tests/test_03_refresh_token.py

+            # code = "code",
+            # code_verifier = "code_verifier"


Suggested change

# code = "code",

# code_verifier = "code_verifier"

peppelinux · 2023-07-07T13:00:36Z

spid_cie_oidc/provider/tests/test_03_refresh_token.py


        )
        res = client.post(url, request)
        self.assertTrue(res.status_code == 200)
        refresh_token = verify_jws(res.json().get("refresh_token"), op_conf_priv_jwk)
-        self.assertEqual(refresh_token["sub"], RP_SUB)
+        self.assertEqual(refresh_token["aud"], RP_SUB)


aud could be the endpoint of the callback and not the entity_id/SUB

so this may be misleading

changed with RP_CLIENT_ID

peppelinux · 2023-07-07T13:01:33Z

spid_cie_oidc/provider/tests/test_03_refresh_token.py

+            code="code",
+            code_verifier="code_verifier"


we have removed this from the view but we keep these in the test

if removed in the refresh floe they should be removed from the test as well

peppelinux · 2023-07-07T13:02:48Z

spid_cie_oidc/provider/views/token_endpoint.py

+            self.authz = OidcSession.objects.filter(
+                auth_code=request.POST["code"],
+                revoked=False
+            ).first()



else?

what happens if not auth code?

merged with the lower if/else

peppelinux · 2023-07-07T13:06:29Z

spid_cie_oidc/relying_party/views/rp_extend_session.py

+                )
+
+            except Exception as e:  # pragma: no cover
+                logger.error(f"Something went wrong: {e}")


please extend this message, something went wrong "with what?"
please give a reference of the failed process/session/transaction

feat: added RP token calls common method and introspection view

…esh token tests

…_token [1.15.5 technical rules]

setup.py

rglauco added 8 commits July 1, 2023 19:20

fix: added code_verifier min/max length

288eca4

Merge branch 'main' of github.com:rglauco/spid-cie-oidc-django into main

0605b66

Merge branch 'main' of github.com:rglauco/spid-cie-oidc-django into main

ed398f6

# Conflicts: # spid_cie_oidc/relying_party/utils.py

feat: added refresh token interface

c7dba66

fix: correct html

198fbaa

fix: specific versions of pydantic

6da5acd

Merge pull request #2 from rglauco/refresh_token_interface

a4ab5ca

Refresh token interface

chore: added explanation in webpage to enable SpidL1

353fa93

peppelinux requested changes Jul 4, 2023

View reviewed changes

peppelinux changed the base branch from main to cjwt July 4, 2023 14:05

peppelinux requested changes Jul 4, 2023

View reviewed changes

rglauco added 11 commits July 4, 2023 17:54

chore: changed language

1b2f8c1

fix: [OP] updated tests

5af845f

fix: adjusted some OP and RP tests

a09e236

Merge pull request #3 from rglauco/op_test_revision

04098d2

Op test revision

feat: extend RP base class

c562423

Merge remote-tracking branch 'origin/op_test_revision' into op_test_r…

e9800b4

…evision

feat: added RP token calls common method and introspection view

cc9b0f5

feat: added RP token calls common method and introspection view

fe3f765

feat: added RP token calls common method and introspection view

2304201

Merge remote-tracking branch 'origin/op_test_revision' into op_test_r…

1861237

…evision

chore: clean unused code

cd00a19

peppelinux requested changes Jul 7, 2023

View reviewed changes

rglauco added 7 commits July 7, 2023 21:39

Merge pull request #4 from rglauco/op_test_revision

2dd2122

feat: added RP token calls common method and introspection view

fix: pydantic versioning and removed code and code_verifier from refr…

c7c4b46

…esh token tests

fix: pydantic versioning and removed code and code_verifier from refr…

5846274

…esh token tests

chore: change MINOR version

a5866fe

Merge branch 'main' of github.com:rglauco/spid-cie-oidc-django into main

45bcedc

fix: merged authorization_code condition in token_endpoint post function

493f50b

test: added double verification "iss" and "aud" in test_grant_refresh…

b0f72f7

…_token [1.15.5 technical rules]

peppelinux approved these changes Jul 8, 2023

View reviewed changes

setup.py Outdated Show resolved Hide resolved

peppelinux added 2 commits July 8, 2023 10:56

update pydantic version

e397fce

Merge branch 'cjwt' into main

1182cf2

peppelinux merged commit 6912388 into italia:cjwt Jul 8, 2023
1 of 3 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: added Refresh Token web interaction in userinfo.html #264

feat: added Refresh Token web interaction in userinfo.html #264

rglauco commented Jul 4, 2023

peppelinux Jul 4, 2023

rglauco Jul 7, 2023

peppelinux Jul 4, 2023

peppelinux Jul 4, 2023

peppelinux Jul 4, 2023

peppelinux Jul 7, 2023

peppelinux Jul 7, 2023

rglauco Jul 7, 2023

peppelinux Jul 7, 2023

peppelinux Jul 7, 2023

rglauco Jul 7, 2023

peppelinux Jul 7, 2023

feat: added Refresh Token web interaction in userinfo.html #264

feat: added Refresh Token web interaction in userinfo.html #264

Conversation

rglauco commented Jul 4, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment