spakky-oidc

spakky-oidc는 OIDC/OAuth bearer JWT credential을 검증하는 인증 provider 플러그인입니다. 검증된 claim을 spakky.auth.AuthContext로 매핑하고 bearer authentication capability를 제공합니다.

이 플러그인은 spakky.contributions.spakky.auth entry point로 AuthCapability.AUTHENTICATION을 제공합니다. Browser login, callback, session, refresh, logout route는 포함하지 않습니다. FastAPI, gRPC, Typer 같은 inbound adapter가 경계에서 bearer credential을 읽고 provider-neutral IAuthenticationProvider port로 전달합니다.

제공 기능

  • issuer/.well-known/openid-configuration 또는 명시적 discovery URL 기반 OIDC discovery
  • kid 기반 JWKS key 선택과 RS256 signature 검증
  • issuer, audience, azp, exp, nbf, iat, clock skew 검증
  • sub, 표시 이름, tenant, role, scope, 선택된 safe claim의 AuthContext 매핑
  • raw bearer token을 AuthContext.claims, metadata, credential_carrier에 남기지 않음

설치

pip install spakky-auth spakky-oidc spakky-fastapi

사용법

from fastapi import FastAPI
from spakky.auth import protected, require_scope
from spakky.core.application.application import SpakkyApplication
from spakky.core.application.application_context import ApplicationContext
from spakky.plugins.fastapi.routes import get
from spakky.plugins.fastapi.stereotypes.api_controller import ApiController
import spakky.auth
import spakky.plugins.fastapi
import spakky.plugins.oidc


@ApiController("/documents")
class DocumentController:
    @get("/{document_id}")
    @require_scope("documents:read")
    @protected
    def read(self, document_id: str) -> dict[str, str]:
        return {"id": document_id}


app = (
    SpakkyApplication(ApplicationContext())
    .load_plugins(
        include={
            spakky.auth.PLUGIN_NAME,
            spakky.plugins.fastapi.PLUGIN_NAME,
            spakky.plugins.oidc.PLUGIN_NAME,
        }
    )
    .add(DocumentController)
    .start()
)
api = app.container.get(FastAPI)

OidcProviderConfig는 Spakky @Configuration Pod입니다. SPAKKY_OIDC_ISSUER, SPAKKY_OIDC_AUDIENCE, SPAKKY_OIDC_CLIENT_ID와 SPAKKY_OIDC_ROLES_CLAIM, SPAKKY_OIDC_SCOPES_CLAIM, SPAKKY_OIDC_TENANT_CLAIM, SPAKKY_OIDC_DISPLAY_NAME_CLAIM 같은 claim 매핑 환경변수로 설정합니다. 기본 scope claim은 표준 공백 구분 scope 문자열을 허용하며, role과 custom scope claim은 문자열 배열도 허용합니다.

Inbound adapter는 boundary에서 bearer credential을 관찰하고 provider-neutral auth port를 호출해 AuthContext를 저장합니다. 애플리케이션 코드는 provider를 직접 호출하지 않고 spakky-auth decorator로 요구사항을 선언합니다.

라이선스

MIT

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (8.0.0)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for Spakky from gravatar.com Spakky

Credits

PyPI data
Data sourced directly from PyPI's database.

Author: Spakky

License

MIT

Requires

Python >=3.12

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

spakky_oidc-6.10.0.tar.gz (7.0 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

spakky_oidc-6.10.0-py3-none-any.whl (9.5 kB view details)

Uploaded Python 3

File details

Details for the file spakky_oidc-6.10.0.tar.gz.

File metadata

  • Download URL: spakky_oidc-6.10.0.tar.gz
  • Upload date:
  • Size: 7.0 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for spakky_oidc-6.10.0.tar.gz
Algorithm Hash digest
SHA256 d87274873c8e656c2140f3a279b86ed7c0a0cec068ffc3bce4bde45ccf48e070
MD5 a885b7b76ed79dbedd9b33929a4305f7
BLAKE2b-256 fe40ef3b7249e1f62834e4bc65c2552e2726bcd871d3381abfe33bdaec9a0ebb

See more details on using hashes here.

Provenance

The following attestation bundles were made for spakky_oidc-6.10.0.tar.gz:

Publisher: release.yml on E5presso/spakky-framework

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file spakky_oidc-6.10.0-py3-none-any.whl.

File metadata

  • Download URL: spakky_oidc-6.10.0-py3-none-any.whl
  • Upload date:
  • Size: 9.5 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for spakky_oidc-6.10.0-py3-none-any.whl
Algorithm Hash digest
SHA256 4657aa7dc2ff562d042715df4ecd6fcf4463805621e81ed60e668b4d9bd54ca1
MD5 f70afc536c8446831e13746819f1aea5
BLAKE2b-256 c09980d8552a8a69deb7c18a4ef95cbd5d36ca22680ec44309fcd9208b4b7628

See more details on using hashes here.

Provenance

The following attestation bundles were made for spakky_oidc-6.10.0-py3-none-any.whl:

Publisher: release.yml on E5presso/spakky-framework

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page