oidcauthlib
OIDC userinfo scopes (OidcUserInfoManager)
Some providers (e.g. Okta employee access tokens) only carry openid profile email groups in the JWT;
the scopes that authorize a caller appear only on the OIDC userinfo response.
oidcauthlib.auth.userinfo.oidc_userinfo_manager.OidcUserInfoManager resolves a token's effective
scopes from the token's own claims plus the userinfo endpoint, and caches the userinfo-derived scopes in
a key-value store.
manager = OidcUserInfoManager(
auth_config_reader=auth_config_reader,
well_known_configuration_manager=well_known_configuration_manager,
store=store, # py-key-value-aio store; yours, not shared with other services
cache_collection="oidc-user-info-cache",
cache_ttl_seconds=86400,
fetch_timeout_seconds=30,
scope_claims=["custom:scope"], # optional extra claims holding scopes
group_claims=["groups"], # optional claims holding group names, used whole as scopes
scope_remove_prefixes=["fhir/prod/"],
)
scopes = await manager.get_scopes_from_user_info_async(access_token=token)
- Scope derivation follows fhir-server-ui's
jwtParser: thescopeclaim (plusscp), thenscope_claims, thengroup_claims(each value taken whole). Commas separate like spaces, results are de-duplicated, andscope_remove_prefixesare stripped (first match wins). Nothing beyondscope/scpis read unless configured. - Provider is matched to the token's
iss(exactissuer, thenwell_known_uriequal to or beneath the issuer at a path boundary), then its client id. A token matching no provider raisesValueError; it is never sent to another provider. - Cache key is
oidc-userinfo-scopes:<issuer>:<client_id>:<sub>|v1with each segment percent-encoded (so values containing:cannot collide, and two providers never share an entry); only the userinfo-derived scopes are stored, never the userinfo response. The token's own scopes are re-derived on every call. A token withoutsub, or an empty scope list, is not cached. Changes to a user's entitlements are visible after at mostcache_ttl_seconds. - Failures: a cache write failure is logged and swallowed. A cache read failure, malformed cache entry, userinfo HTTP error or missing provider is raised, so each service decides whether to fail closed or degrade.
1 maintainer
Metadata
1 maintainer
Release files for oidcauthlib 3.0.22
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| oidcauthlib-3.0.22.tar.gz | 82.1 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| oidcauthlib-3.0.22-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 192.0 kB
Release files / oidcauthlib-3.0.22.tar.gz
| Download URL | oidcauthlib-3.0.22.tar.gz |
|---|---|
| Size | 82.1 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
161fd8dbb6f295355466e72cb7e13398653a710ce78730fa3d5f16b669c25151
|
|
BLAKE2b-256 checksum How to use checksums |
e5dd99e5bf483e7173d832a6da533fb6de9f7ebf5ced34c019b57ab689c501a7
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.12.15
|
Release files / oidcauthlib-3.0.22-py3-none-any.whl
| Download URL | oidcauthlib-3.0.22-py3-none-any.whl |
|---|---|
| Size | 109.9 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
c95dcf22e372196d7de4bd0cc479d053a2077168a1de30b08571954db02be766
|
|
BLAKE2b-256 checksum How to use checksums |
06c424f8451db7646c5e3141e7d5c835e0768c93f0395fa95d4fc1587be438a6
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.12.15
|
