Mercurial > p > roundup > code

comparison scripts/oauth-get-token.py @ 7090:8cda8e05c9a0

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Update oauth-get-token script Detect if the redirect URI is http or https, additional options to force tls or force no tls. More documentation on default certificat/key plus add options to set cert- and keyfile.
author Ralf Schlatterbeck <rsc@runtux.com>
date Wed, 30 Nov 2022 15:41:24 +0100
parents 8d9a6063cb22
children b26207712c2b
comparison
equal deleted inserted replaced
7089:4d7977d51a4e 7090:8cda8e05c9a0
16 self.args = args 16 self.args = args
17 self.session = requests.session () 17 self.session = requests.session ()
18 self.url = '/'.join ((args.url.rstrip ('/'), args.tenant)) 18 self.url = '/'.join ((args.url.rstrip ('/'), args.tenant))
19 self.url = '/'.join ((self.url, 'oauth2/v2.0')) 19 self.url = '/'.join ((self.url, 'oauth2/v2.0'))
20 self.state = None 20 self.state = None
21 self.use_tls = self.args.use_tls
22 if self.use_tls is None:
23 self.use_tls = self.args.redirect_uri.startswith ('https')
21 # end def __init__ 24 # end def __init__
22 25
23 def check_err (self, r): 26 def check_err (self, r):
24 if not 200 <= r.status_code <= 299: 27 if not 200 <= r.status_code <= 299:
25 raise RuntimeError \ 28 raise RuntimeError \
143 self.wfile.flush () 146 self.wfile.flush ()
144 147
145 port = self.args.https_server_port 148 port = self.args.https_server_port
146 httpd = HTTPServer (('localhost', port), RQ_Handler) 149 httpd = HTTPServer (('localhost', port), RQ_Handler)
147 150
148 httpd.socket = ssl.wrap_socket \ 151 if self.use_tls:
149 ( httpd.socket 152 httpd.socket = ssl.wrap_socket \
150 , keyfile = "/etc/ssl/private/ssl-cert-snakeoil.key" 153 ( httpd.socket
151 , certfile = "/etc/ssl/certs/ssl-cert-snakeoil.pem" 154 , keyfile = self.args.keyfile
152 , server_side = True 155 , certfile = self.args.certfile
153 ) 156 , server_side = True
157 )
154 158
155 while not self.request_received: 159 while not self.request_received:
156 httpd.handle_request () 160 httpd.handle_request ()
157 # end def https_server 161 # end def https_server
158 162
174 put the client id (also called application id) into the file 178 put the client id (also called application id) into the file
175 'oauth/client_id' and the corresponding secret into the file 179 'oauth/client_id' and the corresponding secret into the file
176 'oauth/client_secret'. 180 'oauth/client_secret'.
177 181
178 By default calling the script with no arguments, the whole process is 182 By default calling the script with no arguments, the whole process is
179 automatic, but you may want to specify the tenant explicitly using: 183 automatic. Note that the default TLS key used for the built-in server is
184 a self-signed certificate which is automatically created on Debian-based
185 (including Ubuntu) Linux distributions. But the key-file is not readable
186 for everyone, you need to be in the group 'ssl-cert' or need otherwise
187 elevated privileges. If you're using a http (as opposed to https)
188 redirect URI, of course no TLS files are needed. You may want to specify
189 the tenant explicitly using:
180 190
181 ./oauth-get-token.py -t $TENANT 191 ./oauth-get-token.py -t $TENANT
182 192
183 Specifying the tenant explicitly will select the customized company 193 Specifying the tenant explicitly will select the customized company
184 login form directly. 194 login form directly.
236 246
237 def main (): 247 def main ():
238 cmd = ArgumentParser \ 248 cmd = ArgumentParser \
239 (epilog=epilog, formatter_class=RawDescriptionHelpFormatter) 249 (epilog=epilog, formatter_class=RawDescriptionHelpFormatter)
240 cmd.add_argument \ 250 cmd.add_argument \
241 ( '-T', '--request-token'
242 , help = "Run only the token-request step"
243 , action = 'store_true'
244 )
245 cmd.add_argument \
246 ( '-b', '--browser' 251 ( '-b', '--browser'
247 , help = "Use non-default browser" 252 , help = "Use non-default browser"
253 )
254 cmd.add_argument \
255 ( '--certfile'
256 , help = "TLS certificate file, default=%(default)s"
257 , default = "/etc/ssl/certs/ssl-cert-snakeoil.pem"
258 )
259 cmd.add_argument \
260 ( '--keyfile'
261 , help = "TLS key file, default=%(default)s"
262 , default = "/etc/ssl/private/ssl-cert-snakeoil.key"
248 ) 263 )
249 cmd.add_argument \ 264 cmd.add_argument \
250 ( '-n', '--dont-request-tokens' 265 ( '-n', '--dont-request-tokens'
251 , dest = 'request_tokens' 266 , dest = 'request_tokens'
252 , help = "Do not request tokens, just write authcode" 267 , help = "Do not request tokens, just write authcode"
272 "to transmit auth code via GET request" 287 "to transmit auth code via GET request"
273 , action = 'store_false' 288 , action = 'store_false'
274 , default = True 289 , default = True
275 ) 290 )
276 cmd.add_argument \ 291 cmd.add_argument \
292 ( '-T', '--request-token'
293 , help = "Run only the token-request step"
294 , action = 'store_true'
295 )
296 cmd.add_argument \
277 ( '-t', '--tenant' 297 ( '-t', '--tenant'
278 , help = "Tenant part of url, default=%(default)s" 298 , help = "Tenant part of url, default=%(default)s"
279 , default = 'organizations' 299 , default = 'organizations'
300 )
301 cmd.add_argument \
302 ( '--use-tls'
303 , help = "Enforce use of TLS even if the redirect uri is http"
304 , action = 'store_true'
305 , default = None
306 )
307 cmd.add_argument \
308 ( '--no-use-tls', '--dont-use-tls'
309 , help = "Disable use of TLS even if the redirect uri is https"
310 , dest = 'use_tls'
311 , action = 'store_false'
312 , default = None
280 ) 313 )
281 cmd.add_argument \ 314 cmd.add_argument \
282 ( '-u', '--url' 315 ( '-u', '--url'
283 , help = "Base url for requests, default=%(default)s" 316 , help = "Base url for requests, default=%(default)s"
284 , default = 'https://login.microsoftonline.com' 317 , default = 'https://login.microsoftonline.com'
Roundup Issue Tracker: http://roundup-tracker.org/