Skip to content

Commit

Permalink
Merge pull request #344 from Flor1an-dev/proxy-timeout-feature
Browse files Browse the repository at this point in the history 
Added configuration options to define a timeout and a proxy
  • Loading branch information
@akatsoulas
akatsoulas committed Jun 26, 2020
2 parents eb93c1a + 07f4302 commit f2b0a01
Show file tree
Hide file tree
Showing 3 changed files with 62 additions and 14 deletions.
20 changes: 20 additions & 0 deletions docs/settings.rst
View file
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,26 @@ of ``mozilla-django-oidc``.

Controls whether the OpenID Connect client verifies the SSL certificate of the OP responses

.. py:attribute:: OIDC_TIMEOUT
:default: ``None``

Defines a timeout for all requests to the OpenID Connect provider (fetch JWS,
retrieve JWT tokens, Userinfo Endpoint). The default is set to `None` which means
the library will wait indefinitely. The time can be defined as seconds (integer).
More information about possible configuration values, see Python `requests`:
https://requests.readthedocs.io/en/master/user/quickstart/#timeouts

.. py:attribute:: OIDC_PROXY
:default: ``None``

Defines a proxy for all requests to the OpenID Connect provider (fetch JWS,
retrieve JWT tokens, Userinfo Endpoint). The default is set to `None` which means
the library will not use a proxy and connect directly. For configuring a proxy
check the Python `requests` documentation:
https://requests.readthedocs.io/en/master/user/advanced/#proxies

.. py:attribute:: OIDC_EXEMPT_URLS
:default: ``[]``
Expand Down
12 changes: 9 additions & 3 deletions mozilla_django_oidc/auth.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -141,7 +141,9 @@ def retrieve_matching_jwk(self, token):
"""Get the signing key by exploring the JWKS endpoint of the OP."""
response_jwks = requests.get(
self.OIDC_OP_JWKS_ENDPOINT,
verify=self.get_settings('OIDC_VERIFY_SSL', True)
verify=self.get_settings('OIDC_VERIFY_SSL', True),
timeout=self.get_settings('OIDC_TIMEOUT', None),
proxies=self.get_settings('OIDC_PROXY', None)
)
response_jwks.raise_for_status()
jwks = response_jwks.json()
Expand Down Expand Up @@ -221,7 +223,9 @@ def get_token(self, payload):
self.OIDC_OP_TOKEN_ENDPOINT,
data=payload,
auth=auth,
verify=self.get_settings('OIDC_VERIFY_SSL', True))
verify=self.get_settings('OIDC_VERIFY_SSL', True),
timeout=self.get_settings('OIDC_TIMEOUT', None),
proxies=self.get_settings('OIDC_PROXY', None))
response.raise_for_status()
return response.json()

Expand All @@ -234,7 +238,9 @@ def get_userinfo(self, access_token, id_token, payload):
headers={
'Authorization': 'Bearer {0}'.format(access_token)
},
verify=self.get_settings('OIDC_VERIFY_SSL', True))
verify=self.get_settings('OIDC_VERIFY_SSL', True),
timeout=self.get_settings('OIDC_TIMEOUT', None),
proxies=self.get_settings('OIDC_PROXY', None))
user_response.raise_for_status()
return user_response.json()

Expand Down
44 changes: 33 additions & 11 deletions tests/test_auth.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -256,11 +256,15 @@ def test_successful_authentication_existing_user_namespaced(self, token_mock, re
request_mock.post.assert_called_once_with('https://server.example.com/token',
data=post_data,
auth=None,
verify=True)
verify=True,
timeout=None,
proxies=None)
request_mock.get.assert_called_once_with(
'https://server.example.com/user',
headers={'Authorization': 'Bearer access_granted'},
verify=True
verify=True,
timeout=None,
proxies=None
)

@patch('mozilla_django_oidc.auth.requests')
Expand Down Expand Up @@ -299,11 +303,15 @@ def test_successful_authentication_existing_user(self, token_mock, request_mock)
request_mock.post.assert_called_once_with('https://server.example.com/token',
data=post_data,
auth=None,
verify=True)
verify=True,
timeout=None,
proxies=None)
request_mock.get.assert_called_once_with(
'https://server.example.com/user',
headers={'Authorization': 'Bearer access_granted'},
verify=True
verify=True,
timeout=None,
proxies=None
)

@override_settings(OIDC_STORE_ACCESS_TOKEN=True)
Expand Down Expand Up @@ -344,11 +352,15 @@ def test_successful_authentication_existing_user_upper_case(self, token_mock, re
request_mock.post.assert_called_once_with('https://server.example.com/token',
data=post_data,
auth=None,
verify=True)
verify=True,
timeout=None,
proxies=None)
request_mock.get.assert_called_once_with(
'https://server.example.com/user',
headers={'Authorization': 'Bearer access_granted'},
verify=True
verify=True,
timeout=None,
proxies=None
)
self.assertEqual(auth_request.session.get('oidc_id_token'), 'id_token')
self.assertEqual(auth_request.session.get('oidc_access_token'), 'access_granted')
Expand Down Expand Up @@ -393,11 +405,15 @@ def test_failed_authentication_verify_claims(self, claims_mock, token_mock, requ
request_mock.post.assert_called_once_with('https://server.example.com/token',
data=post_data,
auth=None,
verify=True)
verify=True,
timeout=None,
proxies=None)
request_mock.get.assert_called_once_with(
'https://server.example.com/user',
headers={'Authorization': 'Bearer access_granted'},
verify=True
verify=True,
timeout=None,
proxies=None
)

@patch.object(settings, 'OIDC_USERNAME_ALGO')
Expand Down Expand Up @@ -441,11 +457,15 @@ def test_successful_authentication_new_user(self, token_mock, request_mock, algo
request_mock.post.assert_called_once_with('https://server.example.com/token',
data=post_data,
auth=None,
verify=True)
verify=True,
timeout=None,
proxies=None)
request_mock.get.assert_called_once_with(
'https://server.example.com/user',
headers={'Authorization': 'Bearer access_granted'},
verify=True
verify=True,
timeout=None,
proxies=None,
)

@override_settings(OIDC_TOKEN_USE_BASIC_AUTH=True)
Expand Down Expand Up @@ -510,7 +530,9 @@ def test_successful_authentication_basic_auth_token(self, token_mock, request_mo
request_mock.get.assert_called_once_with(
'https://server.example.com/user',
headers={'Authorization': 'Bearer access_granted'},
verify=True
verify=True,
timeout=None,
proxies=None
)
self.assertEqual(auth_request.session.get('oidc_id_token'), 'id_token')
self.assertEqual(auth_request.session.get('oidc_access_token'), 'access_granted')
Expand Down

0 comments on commit f2b0a01

Please sign in to comment.