oidcauthlib
OIDC userinfo scopes (OidcUserInfoManager)
Some providers (e.g. Okta employee access tokens) only carry openid profile email groups in the JWT;
the scopes that authorize a caller appear only on the OIDC userinfo response.
oidcauthlib.auth.userinfo.oidc_userinfo_manager.OidcUserInfoManager resolves a token's effective
scopes from the token's own claims plus the userinfo endpoint, and caches the userinfo-derived scopes in
a key-value store.
manager = OidcUserInfoManager(
auth_config_reader=auth_config_reader,
well_known_configuration_manager=well_known_configuration_manager,
store=store, # py-key-value-aio store; yours, not shared with other services
cache_collection="oidc-user-info-cache",
cache_ttl_seconds=86400,
fetch_timeout_seconds=30,
scope_claims=["custom:scope"], # optional extra claims holding scopes
group_claims=["groups"], # optional claims holding group names, used whole as scopes
scope_remove_prefixes=["fhir/prod/"],
)
scopes = await manager.get_scopes_from_user_info_async(access_token=token)
- Scope derivation follows fhir-server-ui's
jwtParser: thescopeclaim (plusscp), thenscope_claims, thengroup_claims(each value taken whole). Commas separate like spaces, results are de-duplicated, andscope_remove_prefixesare stripped (first match wins). Nothing beyondscope/scpis read unless configured. - Provider is matched to the token's
iss: an exactissuer, else awell_known_urion the same scheme, host and port whose path segments start with the issuer's. Only a token with noissat all is matched by its client id. A token matching no provider raisesValueError; it is never sent to another provider. - Subject check: for a token that has a
sub, the userinfo response must carry the samesub(OIDC Core 5.3.2); a missing or different one raisesValueErrorand nothing is cached. - Cache key is
oidc-userinfo-scopes:<issuer>:<client_id>:<sub>|v1with each segment percent-encoded (so values containing:cannot collide, and two providers never share an entry); only the userinfo-derived scopes are stored, never the userinfo response. The token's own scopes are re-derived on every call. A token withoutsubor without an issuer, or an empty scope list, is not cached. Changes to a user's entitlements are visible after at mostcache_ttl_seconds. - Failures: the cache never fails a lookup. A write failure is logged and swallowed; a read failure or a malformed entry is logged and treated as a miss, and the refetched scopes overwrite the bad entry. A userinfo HTTP error, a missing provider or a mismatched subject is raised, so each service decides whether to fail closed or degrade.
1 maintainer
Metadata
1 maintainer
Release files for oidcauthlib 3.0.24
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| oidcauthlib-3.0.24.tar.gz | 83.3 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| oidcauthlib-3.0.24-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 194.4 kB
Release files / oidcauthlib-3.0.24.tar.gz
| Download URL | oidcauthlib-3.0.24.tar.gz |
|---|---|
| Size | 83.3 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
b47480891aa7e907f49d707b0fda02c259ca67ca9d2d5cc68edd1ca52535694b
|
|
BLAKE2b-256 checksum How to use checksums |
103bb3aead1aac62ffaf1faa9141543105961b1d7f594e9110ce25325dc9caa3
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.12.15
|
Release files / oidcauthlib-3.0.24-py3-none-any.whl
| Download URL | oidcauthlib-3.0.24-py3-none-any.whl |
|---|---|
| Size | 111.0 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
42118c161cb9c8fd638e4e2504f3fc14136041800d43f0af95cb63275d089162
|
|
BLAKE2b-256 checksum How to use checksums |
adf680a972018f8bab0535adea9847a763ca1029564a523c861b2e422b6a7c0e
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.12.15
|
