oidcauthlib
OIDC userinfo scopes (OidcUserInfoManager)
Some providers (e.g. Okta employee access tokens) only carry openid profile email groups in the JWT;
the scopes that authorize a caller appear only on the OIDC userinfo response.
oidcauthlib.auth.userinfo.oidc_userinfo_manager.OidcUserInfoManager resolves a token's effective
scopes from the token's own claims plus the userinfo endpoint, and caches the userinfo-derived scopes in
a key-value store.
manager = OidcUserInfoManager(
auth_config_reader=auth_config_reader,
well_known_configuration_manager=well_known_configuration_manager,
store=store, # py-key-value-aio store; yours, not shared with other services
cache_collection="oidc-user-info-cache",
cache_ttl_seconds=86400,
fetch_timeout_seconds=30,
scope_claims=["custom:scope"], # optional extra claims holding scopes
group_claims=["groups"], # optional claims holding group names, used whole as scopes
scope_remove_prefixes=["fhir/prod/"],
)
scopes = await manager.get_scopes_from_user_info_async(access_token=token)
- Scope derivation follows fhir-server-ui's
jwtParser: thescopeclaim (plusscp), thenscope_claims, thengroup_claims(each value taken whole). Commas separate like spaces, results are de-duplicated, andscope_remove_prefixesare stripped (first match wins). Nothing beyondscope/scpis read unless configured. - Provider is matched to the token's
iss: an exactissuer, else awell_known_urion the same scheme, host and port whose path segments start with the issuer's. Only a token with noissat all is matched by its client id. A token matching no provider raisesValueError; it is never sent to another provider. - Subject check: the userinfo response's
submust equal the token'ssub(OIDC Core 5.3.2); otherwise the lookup raisesValueErrorand nothing is cached. - Cache key is
oidc-userinfo-scopes:<issuer>:<client_id>:<sub>|v1with each segment percent-encoded (so values containing:cannot collide, and two providers never share an entry); only the userinfo-derived scopes are stored, never the userinfo response. The token's own scopes are re-derived on every call. A token withoutsubor without an issuer, or an empty scope list, is not cached. Changes to a user's entitlements are visible after at mostcache_ttl_seconds. - Failures: the cache never fails a lookup. A write failure is logged and swallowed; a read failure or a malformed entry is logged and treated as a miss, and the refetched scopes overwrite the bad entry. A userinfo HTTP error, a missing provider or a mismatched subject is raised, so each service decides whether to fail closed or degrade.
1 maintainer
Metadata
1 maintainer
Release files for oidcauthlib 3.0.23
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| oidcauthlib-3.0.23.tar.gz | 83.2 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| oidcauthlib-3.0.23-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 194.1 kB
Release files / oidcauthlib-3.0.23.tar.gz
| Download URL | oidcauthlib-3.0.23.tar.gz |
|---|---|
| Size | 83.2 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
c52639511a4b91f583bfc1ae044c216901fd1fbf1043c87e24d361925066605e
|
|
BLAKE2b-256 checksum How to use checksums |
b96bac5a29e7c023dae4ead58d520e06bfaa0640d4379b409668182221e35831
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.12.15
|
Release files / oidcauthlib-3.0.23-py3-none-any.whl
| Download URL | oidcauthlib-3.0.23-py3-none-any.whl |
|---|---|
| Size | 110.9 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
d681de9f9c1d1b154bd4baaac425db4c2540d6409c281e73c32ea2d68b0bf203
|
|
BLAKE2b-256 checksum How to use checksums |
b8e974b78af14fbc632985123e55f5a9d82f2cbb43e7a07052b755e681e7e8d8
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.12.15
|
