Skip to main content

Client library for accessing GaaP services

Project description

Accessing GaaP Services Client

Test result

Python package providing a WSGI middleware for accessing GaaP services.


pip3 install ags_client



You will need a client ID and client secret from the GaaP Identity Broker. You can’t get these yet, but soon will by emailing us with a brief summary of:

  • who you are

  • what project you’re going to be using it on

Quick Start


For example: given your Flask app is defined in in a variable named app, create a file called

import ags

from webservice import app

app.wsgi_app = ags.Client(app.wsgi_app)

Then start your app with a WSGI server such as Gunicorn or uWSGI. Eg:

gunicorn wsgi:app


The middleware looks for certain environment variables for settings. The following variables are REQUIRED:


The URL of the OIDC identity broker


The client ID that you have been issued


The client secret that you have been issued


Comma separated list of paths in your web application that require authentication. May include regular expressions.


Path to sign out view in your application - default: sign-out

The following variables are OPTIONAL:


If set to True, errors will be handled by the Werkzeug debugger. DO NOT USE IN PRODUCTION!


Log to the specified file, in addition to console


The name of the cookie used to store the session ID - default: ags_client_session


The secret key use to encrypt the session cookie - default: generates a new secret on start-up

The following variables can be used to override defaults, but usually should not be used:


Overrides default OIDC callback path


The name of the cookie used to store the feature flag status - default: ags_client_active


The default state of the feature flag if the cookie is not set - default: True


If False, verification of the broker’s SSL certificate is skipped


When activated, the middleware will intercept requests to the paths specified in the AGS_CLIENT_AUTHENTICATED_PATHS environment variable and perform OpenID Connect authentication before passing the user authentication details on to the wrapped application.

It will also intercept requests to the AGS_CLIENT_SIGN_OUT_PATH and end the session on the identity broker before passing through to the wrapped application.


The middleware is activated by default, unless the AGS_CLIENT_FEATURE_FLAG_DEFAULT environment variable is set to False.

The middleware is activated or deactivated via a feature flag cookie, which can be toggled by browsing to /toggle-feature/{FLAG}, where {FLAG} is the value of the AGS_CLIENT_FEATURE_FLAG_COOKIE environment variable or the default value ags_client_active.


This source code is provided as-is, with no incident response or support levels. Please log all questions, issues, and feature requests in the Github issue tracker for this repo, and we’ll take a look as soon as we can. If you’re reporting a bug, then it really helps if you can provide the smallest possible bit of code that reproduces the issue. A failing test is even better!


  • Check out the latest master to make sure the feature hasn’t been implemented or the bug hasn’t been fixed

  • Check the issue tracker to make sure someone hasn’t already requested and/or contributed the feature

  • Fork the project

  • Start a feature/bugfix branch

  • Commit and push until you are happy with your contribution

  • Make sure your changes are covered by unit tests, so that we don’t break it unintentionally in the future.

  • Please don’t mess with, version or history.

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

ags_client-0.1.12.tar.gz (11.4 kB view hashes)

Uploaded source

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page