SealSkin

sso

Web sign-in routes (see app.sso).

router is public: it starts and finishes the provider flows, serves this server's SAML metadata, takes the provider's logout notices, answers the check of a reverse proxy that signs users in (app.proxy_auth), and turns the grant of a finished flow, or the root key, into a sign-in the browser keeps in a cookie. A finished flow sends the browser to the web app with the grant, or the code of what went wrong, in the URL fragment, which reaches neither a server nor a Referer. Signing out is here too, outside the encrypted lane, whose answers carry no cookies.

attributelogger
= logging.getLogger(__name__)
attributerouter
= APIRouter()
func_base(request) -> str

Return the base URL the browser reached this server on; public_url when set.

paramrequestRequest

Returns

str
func_start_session(response, started) -> dict[str, Any]

Hand the browser the cookie of a started sign-in.

paramresponseResponse
paramstarteddict[str, Any]

Returns

dict[str, typing.Any]
func_web_only(request) -> None

Refuse a sign-in that did not come from the web app's own page over this node's proxy.

paramrequestRequest

Returns

None
func_to_app(fragment) -> RedirectResponse

Send the browser to the web app with fragment.

paramfragmentstr

Returns

fastapi.responses.RedirectResponse
func_failed(exc) -> RedirectResponse

Log a refused sign-in and send the browser to the web app with its code, ending the flow's cookie.

paramexcsso.SignInError

Returns

fastapi.responses.RedirectResponse
func_begin(request, start) -> Response

Start a provider flow bound to this browser by a cookie and redirect to the provider.

paramrequestRequest
paramstartCallable[[str, str], Awaitable[str]]

Returns

fastapi.Response
funcsign_in_config() -> dict[str, Any]

Return the sign-ins this server offers, and the provider it sends a signed-out browser to at once.

Returns

dict[str, typing.Any]
funcproxy_check(request) -> Response

Say what a request carried when it arrived, for the check of the reverse proxy in front.

paramrequestRequest

Returns

fastapi.Response
funcoidc_login(request) -> Response

Send the browser to the OpenID Connect provider.

paramrequestRequest

Returns

fastapi.Response
funcoidc_callback(request, state='', code='', error='') -> Response

Finish an OpenID Connect flow and hand the web app its grant.

paramrequestRequest
paramstatestr
= ''
paramcodestr
= ''
paramerrorstr
= ''

Returns

fastapi.Response
funcoidc_backchannel_logout(logout_token=Form('')) -> Response

End the sign-ins a back-channel logout token of the provider names.

paramlogout_tokenstr
= Form('')

Returns

fastapi.Response
funcoidc_frontchannel_logout(iss='', sid='') -> Response

End the sign-ins of the session a front-channel logout of the provider names.

paramissstr
= ''
paramsidstr
= ''

Returns

fastapi.Response
funcsaml_login(request) -> Response

Send the browser to the SAML provider.

paramrequestRequest

Returns

fastapi.Response
funcsaml_acs(SAMLResponse=Form(''), RelayState=Form('')) -> Response

Check the provider's assertion, then finish in the browser's own request, which carries the cookie.

paramSAMLResponsestr
= Form('')
paramRelayStatestr
= Form('')

Returns

fastapi.Response
funcsaml_done(request, ticket='') -> Response

Hand the web app the grant for an assertion saml_acs checked.

paramrequestRequest
paramticketstr
= ''

Returns

fastapi.Response
funcsaml_metadata(request) -> Response

Return the SAML metadata an administrator registers this server with.

paramrequestRequest

Returns

fastapi.Response
funcsaml_logout(request) -> Response

End the sign-ins a logout request of the provider names and answer it.

paramrequestRequest

Returns

fastapi.Response
funcregister(req, request, response) -> dict[str, Any]

Start the sign-in a finished provider flow granted, in the browser that went through it.

paramreqSignInRegistrationRequest
paramrequestRequest
paramresponseResponse

Returns

dict[str, typing.Any]
funckey_sign_in(req, request, response) -> dict[str, Any]

Sign the built-in administrator in with one of their application keys, the root key; refused where root_sign_in is off.

Another user's key answers 403 notRoot: it signs the companion apps in, the web is for the identity provider.

paramreqKeySignInRequest
paramrequestRequest
paramresponseResponse

Returns

dict[str, typing.Any]
funcsign_out(request) -> Response

End the web sign-in the caller's cookie names and take the cookie back.

A key-file client has no sign-in to end, and a user a reverse proxy signed in has none here either; both are answered the same.

paramrequestRequest

Returns

fastapi.Response