Verify OIDC JWT identity tokens using OIDC discovery
Verified details
These details have been verified by PyPIProject links
GitHub Statistics
Maintainers
Project description
Python library to verify id tokens using OIDC discovery
OpenID connect identity tokens are a popular choice for federating identity between different systems without the need to share secrets. For example Trusted publishing on PyPI allows use of OIDC tokens created by GitHub or GitLab CI jobs to be used to authenticate when uploading new Python packages. Similarly, OIDC tokens can be used to authenticate to Google Cloud, AWS and Azure from any OIDC identity provider.
The jwt.io and jwt.ms tools allow validating OIDC id tokens without first configuring public keys by means of the OpenID connect discovery protocol.
This library implements the OpenID Connect discovery standard in Python to allow verification of OpenID Connect id tokens without previous configuration of public keys, etc.
Both synchronous and asynchronous (asyncio) implementations are provided.
Example
Suppose you created a GitLab OIDC token as part of a CI job to make an authenticated HTTP GET request to some service:
# .gitlab-ci.yml within https://gitlab.com/my-group/my-project
job_with_id_token:
id_tokens:
ID_TOKEN:
aud: https://my-service.example.com
script:
- curl -X GET -H "Authorization: Bearer $ID_TOKEN" https://my-service.example.com
The following example shows how to verify the OIDC token came from a specific project within a backend implementation:
from typing import Any
from federatedidentity import Issuer, verifiers, verify_id_token
# Use OIDC discovery to fetch public keys for verifying GitLab tokens.
GITLAB_ISSUER = Issuer.from_discovery("https://gitlab.com")
# Expected project path for id token
EXPECTED_PROJECT_PATH = "my-group/my-project"
# Expected audience claim for id token.
EXPECTED_AUDIENCE_CLAIM = "https://my-service.example.com"
def verify_gitlab_token(token: str) -> dict[str, Any]:
"""
Verify an OIDC token from GitLab and return the dictionary of claims. Raises
federatedidentity.exceptions.FederatedIdentityError if the token failed verification.
"""
return verify_id_token(
token,
valid_issuers=[GITLAB_ISSUER],
valid_audiences=[EXPECTED_AUDIENCE_CLAIM],
required_claims=[
# The "project_path" claim must match the expected project.
{"project_path": EXPECTED_PROJECT_PATH},
],
)
See the full documentation for more examples.
Project details
Verified details
These details have been verified by PyPIProject links
GitHub Statistics
Maintainers
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
File details
Details for the file verify_oidc_identity-0.4.30.tar.gz.
File metadata
- Download URL: verify_oidc_identity-0.4.30.tar.gz
- Upload date:
- Size: 7.9 kB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via: twine/6.1.0 CPython/3.12.9
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 | c937f352ce74e942e8eb26722625942c1a3fbc599f448edf38dd4077c6f1b404 |
|
| MD5 | a0c5b065f23c8d96df047a99f5f015cd |
|
| BLAKE2b-256 | 5ac1d08b3a688d941990353ce9463337abcfcf1dc3549f4f8e74e067357a92b4 |
Provenance
The following attestation bundles were made for verify_oidc_identity-0.4.30.tar.gz:
Publisher:
main.yml on rjw57/verify-oidc-identity
-
Statement:
- Statement type:
https://in-toto.io/Statement/v1 - Predicate type:
https://docs.pypi.org/attestations/publish/v1 - Subject name:
verify_oidc_identity-0.4.30.tar.gz - Subject digest:
c937f352ce74e942e8eb26722625942c1a3fbc599f448edf38dd4077c6f1b404 - Sigstore transparency entry: 190108849
- Sigstore integration time:
- Permalink:
rjw57/verify-oidc-identity@11b4e945c06593354a703f897c4bfdd7338a98a3 - Branch / Tag:
refs/heads/main - Owner: https://github.com/rjw57
- Access:
public
- Token Issuer:
https://token.actions.githubusercontent.com - Runner Environment:
github-hosted - Publication workflow:
main.yml@11b4e945c06593354a703f897c4bfdd7338a98a3 - Trigger Event:
push
- Statement type:
File details
Details for the file verify_oidc_identity-0.4.30-py3-none-any.whl.
File metadata
- Download URL: verify_oidc_identity-0.4.30-py3-none-any.whl
- Upload date:
- Size: 10.5 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via: twine/6.1.0 CPython/3.12.9
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 | 57330d46d145aa20d77a91b3671a7297e18fa28ec05b6869e30199c004e6c545 |
|
| MD5 | afd6a072fdb35c87d1b536b9a3a6c64a |
|
| BLAKE2b-256 | 96b0df3a2ab0444952e43b42a3f235f0a38e207bc3755bcaa4f7b03b5ffc6c36 |
Provenance
The following attestation bundles were made for verify_oidc_identity-0.4.30-py3-none-any.whl:
Publisher:
main.yml on rjw57/verify-oidc-identity
-
Statement:
- Statement type:
https://in-toto.io/Statement/v1 - Predicate type:
https://docs.pypi.org/attestations/publish/v1 - Subject name:
verify_oidc_identity-0.4.30-py3-none-any.whl - Subject digest:
57330d46d145aa20d77a91b3671a7297e18fa28ec05b6869e30199c004e6c545 - Sigstore transparency entry: 190108851
- Sigstore integration time:
- Permalink:
rjw57/verify-oidc-identity@11b4e945c06593354a703f897c4bfdd7338a98a3 - Branch / Tag:
refs/heads/main - Owner: https://github.com/rjw57
- Access:
public
- Token Issuer:
https://token.actions.githubusercontent.com - Runner Environment:
github-hosted - Publication workflow:
main.yml@11b4e945c06593354a703f897c4bfdd7338a98a3 - Trigger Event:
push
- Statement type:
