OpenID Connect inspect setup.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Set up OpenID APIs\n",
    "Inspect an OpenID connect well-known JSON for the variables you need elsewhere\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Enter the .well-known URL for the auth service you want to use\n",
    "WELL_KNOWN_URL = input('Enter .well-known/openid-configuration URL: ') or 'https://accounts.google.com/.well-known/openid-configuration'"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "import json\n",
    "import requests\n",
    "from urllib.parse import urlparse\n",
    "\n",
    "def get_json(url):\n",
    "    resp = requests.get(url)\n",
    "    try:\n",
    "        resp.raise_for_status()\n",
    "    except Exception as ex:\n",
    "        print(resp.content)\n",
    "        raise ex\n",
    "    return resp.json()\n",
    "\n",
    "url_info = urlparse(WELL_KNOWN_URL)\n",
    "DOMAIN, _, _ = url_info.netloc.partition(':') # removes the port \n",
    "print(f\"Looking up details for {DOMAIN}\")\n",
    "\n",
    "SSL_KEY_PATH = \"/Users/nick/Devel/cloud_storage/BankingCerts/Fractal2/obseal-obwac/transport-WIM6jzA_tjOdB5nqga0dAAjrdp4.pem\" #\"/Users/nick/Devel/cloud_storage/BankingCerts/Fractal/eidas/QWAC.key\" #\"./local/TPP_OB_Transport.key\"\n",
    "SSL_CERT_PATH = \"/Users/nick/Devel/cloud_storage/BankingCerts/Fractal2/obseal-obwac/transport.key\" #\"/Users/nick/Devel/cloud_storage/BankingCerts/Fractal/eidas/QWAC.2m-5W3Zk1oWnTKzaKEFSNQAt8_U.pem\" #\"./local/TTP_OB_Transport.pem\"\n",
    "\n",
    "try:\n",
    "    WELL_KNOWN = get_json(WELL_KNOWN_URL)\n",
    "except:\n",
    "    WELL_KNOWN = json.loads(input(\"Enter your .well-known JSON here: \"))\n",
    "\n",
    "print(json.dumps(WELL_KNOWN, indent=2))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "AUTH_METHODS = WELL_KNOWN.get('token_endpoint_auth_methods_supported', [])\n",
    "AUTHORIZATION_URL = WELL_KNOWN.get('authorization_endpoint')\n",
    "TOKEN_URL = WELL_KNOWN.get('token_endpoint')\n",
    "REGISTER_URL = WELL_KNOWN.get('registration_endpoint')\n",
    "ISSUER = WELL_KNOWN.get('issuer')\n",
    "\n",
    "print(f\"Issuer: {ISSUER}\")\n",
    "print(f\"Token endpoint auth methods: {', '.join(AUTH_METHODS)}\")\n",
    "print(f\"AUTHORIZATION_URL: {AUTHORIZATION_URL}\")\n",
    "print(f\"TOKEN_URL: {TOKEN_URL}\")\n",
    "print(f\"REGISTER_URL: {REGISTER_URL}\")\n",
    "\n",
    "#assert \"code id_token\" in WELL_KNOWN.get(\"response_types_supported\", [])\n",
    "assert \"authorization_code\" in WELL_KNOWN.get(\"grant_types_supported\", [])\n",
    "assert \"client_credentials\" in WELL_KNOWN.get(\"grant_types_supported\", [])\n",
    "#assert \"refresh_token\" in WELL_KNOWN.get(\"grant_types_supported\", [])\n",
    "#assert \"openid\" in WELL_KNOWN.get(\"scopes_supported\", [])\n",
    "assert \"accounts\" in WELL_KNOWN.get(\"scopes_supported\", [])\n",
    "#assert \"payments\" in WELL_KNOWN.get(\"scopes_supported\", [])\n",
    "if \"private_key_jwt\" in AUTH_METHODS:\n",
    "    assert \"PS256\" in WELL_KNOWN.get('token_endpoint_auth_signing_alg_values_supported', [])\n",
    "assert \"PS256\" in WELL_KNOWN.get('request_object_signing_alg_values_supported', [])\n",
    "#assert \"PS256\" in WELL_KNOWN.get('id_token_signing_alg_values_supported', [])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Create APIs for Dynamic Registration"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Enter intended project's APImetrics API key here:\n",
    "API_KEY = input(\"Enter your APImetrics API key for the intended project: \")\n",
    "SOFTWARE_STATEMENT = input(\"Enter the Software statement you wish to use: \") or \"{{software_statement}}\"\n",
    "\n",
    "if len(AUTH_METHODS) == 1:\n",
    "    AUTH_METHOD = AUTH_METHODS[0]\n",
    "else:\n",
    "    AUTH_METHOD = input('Auth method (tls_client_auth): ') or 'tls_client_auth'"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Helper functions\n",
    "import requests\n",
    "import json\n",
    "import urllib\n",
    "from apimetrics_api import APImetricsAPI \n",
    "    \n",
    "# An instance of the class that calls the APImetrics API\n",
    "CLIENT = APImetricsAPI(API_KEY)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# First, create APImetrics API Auth Setting\n",
    "tag = 'auth:apimetrics_api'\n",
    "if tag not in CLIENT.auths_by_tag:\n",
    "    setup = {\n",
    "        \"meta\": {\n",
    "            \"domain\": \"client.apimetrics.io\",\n",
    "            \"documentation\": {\n",
    "                \"keys\": \"https://client.apimetrics.io/settings/api-key\",\n",
    "                \"docs\": \"https://apimetrics.readme.io/v2/reference\",\n",
    "                \"apps\": \"\",\n",
    "                \"provider\": \"https://client.apimetrics.io/\",\n",
    "            },\n",
    "            \"name\": \"APImetrics API\",\n",
    "            \"tags\": [tag],\n",
    "            \"description\": \"API that allows you to call APImetrics' API.\",\n",
    "        },\n",
    "        \"settings\": {\"auth_type\": \"MANUAL\"}\n",
    "    }\n",
    "    auth = CLIENT.create_auth(setup)\n",
    "    print(f\"Created Auth Setting {auth['meta']['name']} with id {auth['id']}\")\n",
    "else:\n",
    "    print(f\"Found Auth Setting {CLIENT.auths_by_tag[tag]}\")\n",
    "\n",
    "# Next, Create Token\n",
    "if CLIENT.auths_by_tag[tag] not in CLIENT.tokens_by_auth:\n",
    "    setup = {\n",
    "        'meta': {\n",
    "            'name': 'Project Access Token',\n",
    "            'domain': 'client.apimetrics.io',\n",
    "            'auth_id': CLIENT.auths_by_tag[tag]\n",
    "        },\n",
    "        'token': {\n",
    "            'headers': [\n",
    "              {\n",
    "                'p_key': 'Authorization',\n",
    "                'p_val': f'Bearer {API_KEY}',\n",
    "              },\n",
    "            ],\n",
    "        }\n",
    "    }\n",
    "    token = CLIENT.create_token(setup)\n",
    "    print(f\"Created Auth Token {token['meta']['name']} with id {token['id']}\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Create Auth Setting for Bank API\n",
    "tag = 'auth:bank_matls'\n",
    "if tag not in CLIENT.auths_by_tag:\n",
    "\n",
    "    ssl_key = None\n",
    "    ssl_cert = None\n",
    "\n",
    "    if SSL_KEY_PATH:\n",
    "        with open(SSL_KEY_PATH) as stream:\n",
    "            ssl_key = stream.read()\n",
    "\n",
    "    if SSL_CERT_PATH:\n",
    "        with open(SSL_CERT_PATH) as stream:\n",
    "            ssl_cert = stream.read()\n",
    "    \n",
    "    setup = {\n",
    "        \"access\": {\n",
    "            \"keys\": False,\n",
    "            \"org_keys\": False,\n",
    "            \"org_settings\": True,\n",
    "            \"settings\": False,\n",
    "        },\n",
    "        \"keys\": {},\n",
    "        \"meta\": {\n",
    "            \"domain\": DOMAIN,\n",
    "            \"documentation\": {\"keys\": \"\", \"docs\": \"\", \"apps\": \"\", \"provider\": \"\"},\n",
    "            \"name\": \"Transport MATLS\",\n",
    "            \"tags\": [tag],\n",
    "            \"description\": \"Mutual Authenticated TLS for calls to bank APIs\",\n",
    "        },\n",
    "        \"settings\": {\n",
    "            \"auth_type\": \"MANUAL\",\n",
    "            \"ssl_key\": ssl_key,\n",
    "            \"ssl_cert\": ssl_cert,\n",
    "        },\n",
    "    }\n",
    "#     if OAUTH_METHOD == \"client_secret_post\" or OAUTH_METHOD == \"client_secret_basic\":\n",
    "#         setup[\"keys\"][\"client_id\"] = CLIENT_ID\n",
    "#         setup[\"keys\"][\"client_secret\"] = CLIENT_SECRET\n",
    "    \n",
    "    auth = CLIENT.create_auth(setup)\n",
    "    print(f\"Created Auth Setting {auth['meta']['name']} with id {auth['id']}\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# For user authentication\n",
    "tag = 'jwt:sign:dynamic_registration'\n",
    "if tag not in CLIENT.calls_by_tag:\n",
    "    auth_tag = 'auth:apimetrics_api'\n",
    "    auth_id = CLIENT.auths_by_tag[auth_tag]\n",
    "    token_id = CLIENT.tokens_by_auth[auth_id]\n",
    "    \n",
    "    if \"tls_client_auth\" == AUTH_METHOD:\n",
    "    \n",
    "        payload = {\n",
    "            \"redirect_uris\": [\n",
    "              \"https://google.api.expert/get\",\n",
    "              \"https://client.apimetrics.io/tokens/callback/\"\n",
    "            ],\n",
    "            \"token_endpoint_auth_method\": \"tls_client_auth\",\n",
    "            \"tls_client_auth_dn\": \"C = GB, O = OpenBanking, OU = 00158000016i44aAAA, CN = ccS2Kwyg38PrOmCQO5WOXU\",\n",
    "            \"grant_types\": [\n",
    "              \"authorization_code\",\n",
    "              \"client_credentials\"\n",
    "            ],\n",
    "            \"response_types\": [\n",
    "              \"code id_token\"\n",
    "            ],\n",
    "            \"software_id\": \"{{ssa_id}}\",\n",
    "            \"software_statement\": SOFTWARE_STATEMENT,\n",
    "            \"application_type\": \"web\",\n",
    "            \"scope\": \"openid accounts payments\" if \"payments\" in WELL_KNOWN.get(\"scopes_supported\", []) else \"openid accounts\",\n",
    "            \"id_token_signed_response_alg\": \"PS256\",\n",
    "            \"request_object_signing_alg\": \"PS256\"\n",
    "        }\n",
    "\n",
    "    elif \"private_key_jwt\" == AUTH_METHOD:\n",
    "        payload = {\n",
    "            \"redirect_uris\": [\n",
    "              \"https://google.api.expert/get\",\n",
    "              \"https://client.apimetrics.io/tokens/callback/\"\n",
    "            ],\n",
    "            \"token_endpoint_auth_method\": \"private_key_jwt\",\n",
    "            \"token_endpoint_auth_signing_alg\": \"PS256\",\n",
    "            \"grant_types\": [\n",
    "              \"authorization_code\",\n",
    "              \"client_credentials\"\n",
    "            ],\n",
    "            \"response_types\": [\n",
    "              \"code id_token\"\n",
    "            ],\n",
    "            \"software_id\": \"{{ssa_id}}\",\n",
    "            \"software_statement\": SOFTWARE_STATEMENT,\n",
    "            \"application_type\": \"web\",\n",
    "            \"scope\": \"openid accounts payments\" if \"payments\" in WELL_KNOWN.get(\"scopes_supported\", []) else \"openid accounts\",\n",
    "            \"id_token_signed_response_alg\": \"PS256\",\n",
    "            \"request_object_signing_alg\": \"PS256\"\n",
    "        }\n",
    "    else: \n",
    "        payload = {\n",
    "            \"redirect_uris\": [\n",
    "              \"https://google.api.expert/get\",\n",
    "              \"https://client.apimetrics.io/tokens/callback/\"\n",
    "            ],\n",
    "            \"token_endpoint_auth_method\": AUTH_METHOD,\n",
    "            \"grant_types\": [\n",
    "              \"authorization_code\",\n",
    "              \"client_credentials\"\n",
    "            ],\n",
    "            \"response_types\": [\n",
    "              \"code id_token\"\n",
    "            ],\n",
    "            \"software_id\": \"{{ssa_id}}\",\n",
    "            \"software_statement\": SOFTWARE_STATEMENT,\n",
    "            \"application_type\": \"web\",\n",
    "            \"scope\": \"openid accounts payments\" if \"payments\" in WELL_KNOWN.get(\"scopes_supported\", []) else \"openid accounts\",\n",
    "            \"id_token_signed_response_alg\": \"PS256\",\n",
    "            \"request_object_signing_alg\": \"PS256\"\n",
    "        }\n",
    "\n",
    "    if \"refresh_token\" in WELL_KNOWN.get('grant_types_supported', []):\n",
    "        payload['grant_types'].append('refresh_token')\n",
    "        \n",
    "    body = {\n",
    "        \"header\": {},\n",
    "        \"payload\": payload,\n",
    "        \"private_key\": {\n",
    "            \"versionId\": '{{kid_cert_version}}'\n",
    "        }\n",
    "    }\n",
    "    \n",
    "    body_str = json.dumps(body, indent=2)\n",
    "    \n",
    "    setup = {\n",
    "        \"meta\": {\n",
    "            \"tags\": [\"api_type:create\", \"sector:devtools\", tag],\n",
    "            \"name\": \"Sign Dynamic Client Registration JWT with KMS Cert\",\n",
    "            \"workspace\": \"global\",\n",
    "        },\n",
    "        \"request\": {\n",
    "            \"body\": body_str,\n",
    "            \"parameters\": [\n",
    "                {\"value\": \"{{kid}}\", \"key\": \"kid\"},\n",
    "                {\"value\": \"PS256\", \"key\": \"alg\"},\n",
    "                {\"value\": \"{{ssa_id}}\", \"key\": \"iss\"},\n",
    "                {\"value\": \"{{aud}}\", \"key\": \"aud\"},\n",
    "                {\"value\": \"10m\", \"key\": \"expiresIn\"},\n",
    "                {\"value\": \"%%GUID%%\", \"key\": \"jti\"},\n",
    "            ],\n",
    "            \"url\": \"https://us-central1-viatests.cloudfunctions.net/jwt-kms-signer\",\n",
    "            \"auth_id\": auth_id,\n",
    "            \"headers\": [\n",
    "                {\"key\": \"Accept\", \"value\": \"application/json\"},\n",
    "                {\"key\": \"Content-Type\", \"value\": \"application/json\"},\n",
    "            ],\n",
    "            \"token_id\": token_id,\n",
    "            \"method\": \"POST\",\n",
    "        },\n",
    "    }\n",
    "    call = CLIENT.create_call(setup)\n",
    "    print(f\"Created Call {call['meta']['name']} with id {call['id']}\")\n",
    "    \n",
    "    conditions = {\n",
    "        \"conditions\": [\n",
    "            {\n",
    "              \"source\": \"RESPONSE_BODY\", \n",
    "              \"test_result_on_true\": None, \n",
    "              \"val\": \"\", \n",
    "              \"variable_path\": \"token\", \n",
    "              \"variable_name\": \"JWT_TOKEN\", \n",
    "              \"test_result_on_false\": \"CONTENT_ERROR\", \n",
    "              \"condition\": \"EXISTS\"\n",
    "            },\n",
    "          ]\n",
    "    }\n",
    "    CLIENT.set_call_conditions(call['id'], conditions)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "tag = 'banks:3.1:dynamic_registration:create'\n",
    "if tag not in CLIENT.calls_by_tag:\n",
    "    setup = {\n",
    "      \"meta\": {\n",
    "        \"description\": None, \n",
    "        \"tags\": [\n",
    "            \"api_type:create\", \n",
    "            \"sector:financial\",\n",
    "            tag,\n",
    "        ], \n",
    "        \"name\": \"Dynamic Client Registration: Create\", \n",
    "        \"workspace\": \"global\"\n",
    "      }, \n",
    "      \"request\": {\n",
    "        \"body\": \"__JWT_TOKEN__\", \n",
    "        \"parameters\": [], \n",
    "        \"url\": REGISTER_URL, \n",
    "        \"auth_id\": CLIENT.auths_by_tag['auth:bank_matls'], \n",
    "        \"headers\": [\n",
    "          {\n",
    "            \"value\": \"application/jose\", \n",
    "            \"key\": \"Content-Type\"\n",
    "          }\n",
    "        ], \n",
    "        \"token_id\": None, \n",
    "        \"method\": \"POST\"\n",
    "      }\n",
    "    }\n",
    "    call = CLIENT.create_call(setup)\n",
    "    print(f\"Created Call {call['meta']['name']} with id {call['id']}\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "tag = 'banks:3.1:dynamic_registration'\n",
    "if tag not in CLIENT.workflows_by_tag:\n",
    "    call_tags = [\n",
    "        'jwt:sign:dynamic_registration',\n",
    "        'banks:3.1:dynamic_registration:create',\n",
    "    ]\n",
    "    for t in call_tags:\n",
    "        assert t in CLIENT.calls_by_tag, f\"API {t} does not exist\"\n",
    "\n",
    "    setup = {\n",
    "      \"meta\": {\n",
    "        \"name\": \"Dynamic Client Registration\", \n",
    "        \"workspace\": \"global\", \n",
    "        \"tags\": [tag], \n",
    "      }, \n",
    "      \"workflow\": {\n",
    "        \"handle_cookies\": False,\n",
    "        \"stop_on_failure\": True,\n",
    "        \"call_ids\": [CLIENT.calls_by_tag[t] for t in call_tags]\n",
    "      }\n",
    "    }\n",
    "    workflow = CLIENT.create_workflow(setup)\n",
    "    print(f\"Created Workflow {workflow['meta']['name']} with id {workflow['id']}\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Set Environment Variables"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "CLIENT.set_env_variable(\"global\", \"ssa_id\", input(\"Software Statement ID: \") or \"ccS2Kwyg38PrOmCQO5WOXU\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "#CLIENT.set_env_variable(\"global\", \"software_statement\", input(\"Software Statement: \") )"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "CLIENT.set_env_variable(\"global\", \"kid\", input(\"Key ID: \") or \"Lu1iJaKRqUvGS25yv-040yYGT2o\" )"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "CLIENT.set_env_variable(\"global\", \"kid_cert_version\", input(\"KMS cert version: \") or \"1\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "CLIENT.set_env_variable(\"global\", \"aud\", ISSUER)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "CLIENT.set_env_variable(\"global\", \"redirect_uri\", \"https://client.apimetrics.io/tokens/callback/\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.8.3"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}