Skip to content

Commit b21777c

Browse files
dariakashchaJon Wayne Parrott
dariakashcha
authored and
Jon Wayne Parrott
committed
Implementation for reauth credentials (google#2)
1 parent 58c7ee1 commit b21777c

12 files changed

+1548
-4
lines changed

‎.coveragerc

+1
Original file line numberDiff line numberDiff line change
@@ -9,3 +9,4 @@ exclude_lines =
99
pragma: NO COVER
1010
# Ignore debug-only repr
1111
def __repr__
12+
pass

‎google_reauth/_helpers.py

+44
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# Copyright 2017 Google Inc. All rights reserved.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
import getpass
16+
import sys
17+
18+
19+
def get_user_password(text):
20+
"""Get password from user.
21+
22+
Override this function with a different logic if you are using this library
23+
outside a CLI.
24+
25+
Args:
26+
text: message for the password prompt.
27+
28+
Returns: password string.
29+
"""
30+
return getpass.getpass(text)
31+
32+
33+
def is_interactive():
34+
"""Check if we are in an interractive environment.
35+
36+
If the rapt token needs refreshing, the user needs to answer the
37+
challenges.
38+
If the user is not in an interractive environment, the challenges can not
39+
be answered and we just wait for timeout for no reason.
40+
41+
Returns: True if is interactive environment, False otherwise.
42+
"""
43+
44+
return sys.stdin.isatty()

‎google_reauth/_reauth_client.py

+148
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
# Copyright 2018 Google Inc. All rights reserved.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
"""Client for interacting with the Reauth HTTP API.
16+
17+
This module provides the ability to do the following with the API:
18+
19+
1. Get a list of challenges needed to obtain additional authorization.
20+
2. Send the result of the challenge to obtain a rapt token.
21+
3. A modified version of the standard OAuth2.0 refresh grant that takes a rapt
22+
token.
23+
"""
24+
25+
import json
26+
27+
from six.moves import urllib
28+
29+
from google_reauth import errors
30+
31+
_REAUTH_API = 'https://reauth.googleapis.com/v2/sessions'
32+
33+
34+
def _handle_errors(msg):
35+
"""Raise an exception if msg has errors.
36+
37+
Args:
38+
msg: parsed json from http response.
39+
40+
Returns: input response.
41+
Raises: ReauthAPIError
42+
"""
43+
if 'error' in msg:
44+
raise errors.ReauthAPIError(msg['error']['message'])
45+
return msg
46+
47+
48+
def _endpoint_request(http_request, path, body, access_token):
49+
_, content = http_request(
50+
uri='{0}{1}'.format(_REAUTH_API, path),
51+
method='POST',
52+
body=json.dumps(body),
53+
headers={'Authorization': 'Bearer {0}'.format(access_token)}
54+
)
55+
response = json.loads(content)
56+
_handle_errors(response)
57+
return response
58+
59+
60+
def get_challenges(
61+
http_request, supported_challenge_types, access_token,
62+
requested_scopes=None):
63+
"""Does initial request to reauth API to get the challenges.
64+
65+
Args:
66+
http_request (Callable): callable to run http requests. Accepts uri,
67+
method, body and headers. Returns a tuple: (response, content)
68+
supported_challenge_types (Sequence[str]): list of challenge names
69+
supported by the manager.
70+
access_token (str): Access token with reauth scopes.
71+
requested_scopes (list[str]): Authorized scopes for the credentials.
72+
73+
Returns:
74+
dict: The response from the reauth API.
75+
"""
76+
body = {'supportedChallengeTypes': supported_challenge_types}
77+
if requested_scopes:
78+
body['oauthScopesForDomainPolicyLookup'] = requested_scopes
79+
80+
return _endpoint_request(
81+
http_request, ':start', body, access_token)
82+
83+
84+
def send_challenge_result(
85+
http_request, session_id, challenge_id, client_input, access_token):
86+
"""Attempt to refresh access token by sending next challenge result.
87+
88+
Args:
89+
http_request (Callable): callable to run http requests. Accepts uri,
90+
method, body and headers. Returns a tuple: (response, content)
91+
session_id (str): session id returned by the initial reauth call.
92+
challenge_id (str): challenge id returned by the initial reauth call.
93+
client_input: dict with a challenge-specific client input. For example:
94+
``{'credential': password}`` for password challenge.
95+
access_token (str): Access token with reauth scopes.
96+
97+
Returns:
98+
dict: The response from the reauth API.
99+
"""
100+
body = {
101+
'sessionId': session_id,
102+
'challengeId': challenge_id,
103+
'action': 'RESPOND',
104+
'proposalResponse': client_input,
105+
}
106+
107+
return _endpoint_request(
108+
http_request, '/{0}:continue'.format(session_id), body, access_token)
109+
110+
111+
def refresh_grant(
112+
http_request, client_id, client_secret, refresh_token,
113+
token_uri, scopes=None, rapt=None, headers={}):
114+
"""Implements the OAuth 2.0 Refresh Grant with the addition of the reauth
115+
token.
116+
117+
Args:
118+
http_request (Callable): callable to run http requests. Accepts uri,
119+
method, body and headers. Returns a tuple: (response, content)
120+
client_id (str): client id to get access token for reauth scope.
121+
client_secret (str): client secret for the client_id
122+
refresh_token (str): refresh token to refresh access token
123+
token_uri (str): uri to refresh access token
124+
scopes (str): scopes required by the client application as a
125+
comma-joined list.
126+
rapt (str): RAPT token
127+
headers (dict): headers for http request
128+
129+
Returns:
130+
Tuple[str, dict]: http response and parsed response content.
131+
"""
132+
parameters = {
133+
'grant_type': 'refresh_token',
134+
'client_id': client_id,
135+
'client_secret': client_secret,
136+
'refresh_token': refresh_token,
137+
'scope': scopes,
138+
'rapt': rapt,
139+
}
140+
141+
body = urllib.parse.urlencode(parameters)
142+
143+
response, content = http_request(
144+
uri=token_uri,
145+
method='POST',
146+
body=body,
147+
headers=headers)
148+
return response, content

‎google_reauth/challenges.py

+132
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
# Copyright 2017 Google Inc. All rights reserved.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
import abc
16+
import base64
17+
import sys
18+
19+
import pyu2f.convenience.authenticator
20+
import pyu2f.errors
21+
import pyu2f.model
22+
import six
23+
24+
from google_reauth import _helpers
25+
26+
27+
REAUTH_ORIGIN = 'https://accounts.google.com'
28+
29+
30+
@six.add_metaclass(abc.ABCMeta)
31+
class ReauthChallenge(object):
32+
"""Base class for reauth challenges."""
33+
34+
@property
35+
@abc.abstractmethod
36+
def name(self):
37+
"""Returns the name of the challenge."""
38+
pass
39+
40+
@property
41+
@abc.abstractmethod
42+
def is_locally_eligible(self):
43+
"""Returns true if a challenge is supported locally on this machine."""
44+
pass
45+
46+
@abc.abstractmethod
47+
def obtain_challenge_input(self, metadata):
48+
"""Performs logic required to obtain credentials and returns it.
49+
50+
Args:
51+
metadata: challenge metadata returned in the 'challenges' field in
52+
the initial reauth request. Includes the 'challengeType' field
53+
and other challenge-specific fields.
54+
55+
Returns:
56+
response that will be send to the reauth service as the content of
57+
the 'proposalResponse' field in the request body. Usually a dict
58+
with the keys specific to the challenge. For example,
59+
{'credential': password} for password challenge.
60+
"""
61+
pass
62+
63+
64+
class PasswordChallenge(ReauthChallenge):
65+
"""Challenge that asks for user's password."""
66+
67+
@property
68+
def name(self):
69+
return 'PASSWORD'
70+
71+
@property
72+
def is_locally_eligible(self):
73+
return True
74+
75+
def obtain_challenge_input(self, unused_metadata):
76+
passwd = _helpers.get_user_password('Please enter your password:')
77+
if not passwd:
78+
passwd = ' ' # avoid the server crashing in case of no password :D
79+
return {'credential': passwd}
80+
81+
82+
class SecurityKeyChallenge(ReauthChallenge):
83+
"""Challenge that asks for user's security key touch."""
84+
85+
@property
86+
def name(self):
87+
return 'SECURITY_KEY'
88+
89+
@property
90+
def is_locally_eligible(self):
91+
return True
92+
93+
def obtain_challenge_input(self, metadata):
94+
sk = metadata['securityKey']
95+
challenges = sk['challenges']
96+
app_id = sk['applicationId']
97+
98+
challenge_data = []
99+
for c in challenges:
100+
kh = c['keyHandle'].encode('ascii')
101+
key = pyu2f.model.RegisteredKey(
102+
bytearray(base64.urlsafe_b64decode(kh)))
103+
challenge = c['challenge'].encode('ascii')
104+
challenge = base64.urlsafe_b64decode(challenge)
105+
challenge_data.append({'key': key, 'challenge': challenge})
106+
107+
try:
108+
api = pyu2f.convenience.authenticator.CreateCompositeAuthenticator(
109+
REAUTH_ORIGIN)
110+
response = api.Authenticate(app_id, challenge_data,
111+
print_callback=sys.stderr.write)
112+
return {'securityKey': response}
113+
except pyu2f.errors.U2FError as e:
114+
if e.code == pyu2f.errors.U2FError.DEVICE_INELIGIBLE:
115+
sys.stderr.write('Ineligible security key.\n')
116+
elif e.code == pyu2f.errors.U2FError.TIMEOUT:
117+
sys.stderr.write(
118+
'Timed out while waiting for security key touch.\n')
119+
else:
120+
raise e
121+
except pyu2f.errors.NoDeviceFoundError:
122+
sys.stderr.write('No security key found.\n')
123+
return None
124+
125+
126+
AVAILABLE_CHALLENGES = {
127+
challenge.name: challenge
128+
for challenge in [
129+
SecurityKeyChallenge(),
130+
PasswordChallenge()
131+
]
132+
}

‎google_reauth/errors.py

+62
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
# Copyright 2017 Google Inc. All rights reserved.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
"""A module that provides rapt authentication errors."""
15+
16+
17+
class ReauthError(Exception):
18+
"""Base exception for reauthentication."""
19+
pass
20+
21+
22+
class HttpAccessTokenRefreshError(Exception):
23+
"""Error (with HTTP status) trying to refresh an expired access token."""
24+
def __init__(self, message, status=None):
25+
super(HttpAccessTokenRefreshError, self).__init__(message)
26+
self.status = status
27+
28+
29+
class ReauthUnattendedError(ReauthError):
30+
"""An exception for when reauth cannot be answered."""
31+
32+
def __init__(self):
33+
super(ReauthUnattendedError, self).__init__(
34+
'Reauthentication challenge could not be answered because you are '
35+
'not in an interactive session.')
36+
37+
38+
class ReauthFailError(ReauthError):
39+
"""An exception for when reauth failed."""
40+
41+
def __init__(self, message=None):
42+
super(ReauthFailError, self).__init__(
43+
'Reauthentication challenge failed. {0}'.format(message))
44+
45+
46+
class ReauthAPIError(ReauthError):
47+
"""An exception for when reauth API returned something we can't handle."""
48+
49+
def __init__(self, api_error):
50+
super(ReauthAPIError, self).__init__(
51+
'Reauthentication challenge failed due to API error: {0}.'.format(
52+
api_error))
53+
54+
55+
class ReauthAccessTokenRefreshError(ReauthError):
56+
"""An exception for when we can't get an access token for reauth."""
57+
58+
def __init__(self, message=None, status=None):
59+
super(ReauthAccessTokenRefreshError, self).__init__(
60+
'Failed to get an access token for reauthentication. {0}'.format(
61+
message))
62+
self.status = status

0 commit comments

Comments
 (0)