| OLD | NEW |
| 1 # -*- coding: utf-8 -*- | 1 # -*- coding: utf-8 -*- |
| 2 # | 2 # |
| 3 # Copyright 2014 Google Inc. All rights reserved. | 3 # Copyright 2014 Google Inc. All rights reserved. |
| 4 # | 4 # |
| 5 # Licensed under the Apache License, Version 2.0 (the "License"); | 5 # Licensed under the Apache License, Version 2.0 (the "License"); |
| 6 # you may not use this file except in compliance with the License. | 6 # you may not use this file except in compliance with the License. |
| 7 # You may obtain a copy of the License at | 7 # You may obtain a copy of the License at |
| 8 # | 8 # |
| 9 # http://www.apache.org/licenses/LICENSE-2.0 | 9 # http://www.apache.org/licenses/LICENSE-2.0 |
| 10 # | 10 # |
| 11 # Unless required by applicable law or agreed to in writing, software | 11 # Unless required by applicable law or agreed to in writing, software |
| 12 # distributed under the License is distributed on an "AS IS" BASIS, | 12 # distributed under the License is distributed on an "AS IS" BASIS, |
| 13 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | 13 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 14 # See the License for the specific language governing permissions and | 14 # See the License for the specific language governing permissions and |
| 15 # limitations under the License. | 15 # limitations under the License. |
| 16 """Crypto-related routines for oauth2client.""" | 16 """Crypto-related routines for oauth2client.""" |
| 17 | 17 |
| 18 import json | 18 import json |
| 19 import logging | 19 import logging |
| 20 import time | 20 import time |
| 21 | 21 |
| 22 from oauth2client._helpers import _from_bytes | 22 from oauth2client._helpers import _from_bytes |
| 23 from oauth2client._helpers import _json_encode | 23 from oauth2client._helpers import _json_encode |
| 24 from oauth2client._helpers import _to_bytes | 24 from oauth2client._helpers import _to_bytes |
| 25 from oauth2client._helpers import _urlsafe_b64decode | 25 from oauth2client._helpers import _urlsafe_b64decode |
| 26 from oauth2client._helpers import _urlsafe_b64encode | 26 from oauth2client._helpers import _urlsafe_b64encode |
| 27 from oauth2client._pure_python_crypt import RsaSigner |
| 28 from oauth2client._pure_python_crypt import RsaVerifier |
| 27 | 29 |
| 28 | 30 |
| 29 CLOCK_SKEW_SECS = 300 # 5 minutes in seconds | 31 CLOCK_SKEW_SECS = 300 # 5 minutes in seconds |
| 30 AUTH_TOKEN_LIFETIME_SECS = 300 # 5 minutes in seconds | 32 AUTH_TOKEN_LIFETIME_SECS = 300 # 5 minutes in seconds |
| 31 MAX_TOKEN_LIFETIME_SECS = 86400 # 1 day in seconds | 33 MAX_TOKEN_LIFETIME_SECS = 86400 # 1 day in seconds |
| 32 | 34 |
| 33 logger = logging.getLogger(__name__) | 35 logger = logging.getLogger(__name__) |
| 34 | 36 |
| 35 | 37 |
| 36 class AppIdentityError(Exception): | 38 class AppIdentityError(Exception): |
| (...skipping 21 matching lines...) Expand all Loading... |
| 58 PyCryptoSigner = None | 60 PyCryptoSigner = None |
| 59 | 61 |
| 60 | 62 |
| 61 if OpenSSLSigner: | 63 if OpenSSLSigner: |
| 62 Signer = OpenSSLSigner | 64 Signer = OpenSSLSigner |
| 63 Verifier = OpenSSLVerifier | 65 Verifier = OpenSSLVerifier |
| 64 elif PyCryptoSigner: # pragma: NO COVER | 66 elif PyCryptoSigner: # pragma: NO COVER |
| 65 Signer = PyCryptoSigner | 67 Signer = PyCryptoSigner |
| 66 Verifier = PyCryptoVerifier | 68 Verifier = PyCryptoVerifier |
| 67 else: # pragma: NO COVER | 69 else: # pragma: NO COVER |
| 68 raise ImportError('No encryption library found. Please install either ' | 70 Signer = RsaSigner |
| 69 'PyOpenSSL, or PyCrypto 2.6 or later') | 71 Verifier = RsaVerifier |
| 70 | 72 |
| 71 | 73 |
| 72 def make_signed_jwt(signer, payload): | 74 def make_signed_jwt(signer, payload, key_id=None): |
| 73 """Make a signed JWT. | 75 """Make a signed JWT. |
| 74 | 76 |
| 75 See http://self-issued.info/docs/draft-jones-json-web-token.html. | 77 See http://self-issued.info/docs/draft-jones-json-web-token.html. |
| 76 | 78 |
| 77 Args: | 79 Args: |
| 78 signer: crypt.Signer, Cryptographic signer. | 80 signer: crypt.Signer, Cryptographic signer. |
| 79 payload: dict, Dictionary of data to convert to JSON and then sign. | 81 payload: dict, Dictionary of data to convert to JSON and then sign. |
| 82 key_id: string, (Optional) Key ID header. |
| 80 | 83 |
| 81 Returns: | 84 Returns: |
| 82 string, The JWT for the payload. | 85 string, The JWT for the payload. |
| 83 """ | 86 """ |
| 84 header = {'typ': 'JWT', 'alg': 'RS256'} | 87 header = {'typ': 'JWT', 'alg': 'RS256'} |
| 88 if key_id is not None: |
| 89 header['kid'] = key_id |
| 85 | 90 |
| 86 segments = [ | 91 segments = [ |
| 87 _urlsafe_b64encode(_json_encode(header)), | 92 _urlsafe_b64encode(_json_encode(header)), |
| 88 _urlsafe_b64encode(_json_encode(payload)), | 93 _urlsafe_b64encode(_json_encode(payload)), |
| 89 ] | 94 ] |
| 90 signing_input = b'.'.join(segments) | 95 signing_input = b'.'.join(segments) |
| 91 | 96 |
| 92 signature = signer.sign(signing_input) | 97 signature = signer.sign(signing_input) |
| 93 segments.append(_urlsafe_b64encode(signature)) | 98 segments.append(_urlsafe_b64encode(signature)) |
| 94 | 99 |
| 95 logger.debug(str(segments)) | 100 logger.debug(str(segments)) |
| 96 | 101 |
| 97 return b'.'.join(segments) | 102 return b'.'.join(segments) |
| 98 | 103 |
| (...skipping 135 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 234 # Verify that the signature matches the message. | 239 # Verify that the signature matches the message. |
| 235 _verify_signature(message_to_sign, signature, certs.values()) | 240 _verify_signature(message_to_sign, signature, certs.values()) |
| 236 | 241 |
| 237 # Verify the issued at and created times in the payload. | 242 # Verify the issued at and created times in the payload. |
| 238 _verify_time_range(payload_dict) | 243 _verify_time_range(payload_dict) |
| 239 | 244 |
| 240 # Check audience. | 245 # Check audience. |
| 241 _check_audience(payload_dict, audience) | 246 _check_audience(payload_dict, audience) |
| 242 | 247 |
| 243 return payload_dict | 248 return payload_dict |
| OLD | NEW |