mongo-oidc-human-callback 0.1.0

OIDC Human Callback for MongoDB: browser-based OAuth 2.0 Authorization Code Flow with PKCE (Azure AD and other OIDC providers).

mongo-oidc-human-callback

OIDC Human Callback for MongoDB Atlas authentication: OAuth 2.0 Authorization Code flow with PKCE (Azure AD and other OIDC providers).

Single dependency: pymongo (stdlib for the rest: urllib, logging, http.server, etc.).

Installation

pip install mongo-oidc-human-callback

Usage

from pymongo import MongoClient
from mongo_oidc_human_callback import OIDCHumanCallback

# Connect with human callback (browser opens + PKCE)
client = MongoClient(
    "mongodb+srv://<cluster>.mongodb.net/",
    authMechanism="MONGODB-OIDC",
    authMechanismProperties={"OIDC_CALLBACK": OIDCHumanCallback()},
)
# First access: browser opens to sign in (e.g. Azure AD)
client.admin.command("ping")

Callback options

OIDCHumanCallback(
    redirect_path="redirect",  # or "callback" depending on Azure AD config
    port=27097,                # local callback server port
)

Features

• PKCE (Proof Key for Code Exchange)
• Token caching to avoid re-authenticating on each connection
• Local HTTP server to receive the OAuth redirect
• Automatic browser opening
• Azure AD compatibility (endpoints /oauth2/v2.0/authorize and /oauth2/v2.0/token)

Azure AD configuration

In the Azure portal, for your app registration:

1. Authentication → Redirect URI: http://localhost:27097/redirect (or the port/redirect_path you use).
2. API permissions → Microsoft Graph (or target API): e.g. openid, profile, email.

Publishing (PyPI)

Via GitHub Actions

The .github/workflows/publish-pypi.yml workflow publishes to PyPI:

• On each release: create a release (tag) on GitHub → the workflow runs.
• On demand: Actions → Publish to PyPI → Run workflow.

PyPI setup (trusted publishing, no secrets):

1. PyPI → your project → Publishing → Add a new trusted publisher.
2. Enter exactly (as on GitHub):
   • Owner: mreouven (your GitHub username, not display name)
   • Repository: mongo-oidc-human-callback
   • Workflow: publish-pypi.yml
3. Save. Future workflow runs will publish without PYPI_API_TOKEN.

If you get invalid-publisher, ensure Owner is the GitHub username of the repo (e.g. mreouven), not the org or display name.

Alternative (API token): add the PYPI_API_TOKEN secret in the repo (Settings → Secrets) and use a workflow that sets TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }} if you prefer not to use trusted publishing.

From your machine

pip install build twine
python -m build
twine upload dist/*

License

MIT