{ "info": { "author": "Andrew Grytsenko", "author_email": "darkanthey@gmail.com", "bugtrack_url": null, "classifiers": [ "Development Status :: 4 - Beta", "License :: OSI Approved :: MIT License", "Programming Language :: Python :: 2", "Programming Language :: Python :: 2.7", "Programming Language :: Python :: 3", "Programming Language :: Python :: 3.4", "Programming Language :: Python :: 3.5", "Programming Language :: Python :: 3.6" ], "description": "# Oauth2-stateless\n\nOauth2-stateless is a framework that aims at making it easy to provide authentication\nvia [OAuth 2.0](http://tools.ietf.org/html/rfc6749) within an application stack.\nMain difference of this library is the simplicity\nand the ability to work without any database just with 'stateless'\ntokens based on **JWT** [JSON Web Tokens](https://en.wikipedia.org/wiki/JSON_Web_Token).\n\n[Documentation](http://oauth2-stateless.readthedocs.org/en/latest/index.html)\n\n\n# Status\n\n[![Travis Build Status][build-badge]][build]\n[](LICENSE)\n\nOauth2-stateless has reached its beta phase. All main parts of the [OAuth 2.0 RFC](http://tools.ietf.org/html/rfc6749) such as the various types of Grants, Refresh Token and Scopes have been implemented.\n\n\n# Installation\n\noauth2-stateless is [available on PyPI](http://pypi.python.org/pypi/oauth2-stateless/)\n\n``` bash\npip install oauth2-stateless\n```\n\n\n# Usage\n\n## Example Authorization server\n\n``` python\n from wsgiref.simple_server import make_server\n import oauth2\n import oauth2.grant\n import oauth2.error\n from oauth2.store.memory import ClientStore\n from oauth2.store.stateless import Token Store\n import oauth2.tokengenerator\n import oauth2.web.wsgi\n\n\n # Create a SiteAdapter to interact with the user.\n # This can be used to display confirmation dialogs and the like.\n class ExampleSiteAdapter(oauth2.web.AuthorizationCodeGrantSiteAdapter, oauth2.web.ImplicitGrantSiteAdapter):\n TEMPLATE = '''\n \n
\n\n confirm\n
\n\n deny\n
\n \n '''\n\n def authenticate(self, request, environ, scopes, client):\n # Check if the user has granted access\n if request.post_param(\"confirm\") == \"confirm\":\n return {}\n\n raise oauth2.error.UserNotAuthenticated\n\n def render_auth_page(self, request, response, environ, scopes, client):\n url = request.path + \"?\" + request.query_string\n response.body = self.TEMPLATE.format(url=url)\n return response\n\n def user_has_denied_access(self, request):\n # Check if the user has denied access\n if request.post_param(\"deny\") == \"deny\":\n return True\n return False\n\n # Create an in-memory storage to store your client apps.\n client_store = ClientStore()\n # Add a client\n client_store.add_client(client_id=\"abc\", client_secret=\"xyz\", redirect_uris=[\"http://localhost/callback\"])\n\n site_adapter = ExampleSiteAdapter()\n\n # Create an in-memory storage to store issued tokens.\n # LocalTokenStore can store access and auth tokens\n stateless_token = oauth2.tokengenerator.StatelessTokenGenerator(secret_key='xxx')\n token_store = TokenStore(stateless)\n\n # Create the controller.\n provider = oauth2.Provider(\n access_token_store=token_store,\n auth_code_store=token_store,\n client_store=client_store,\n token_generator=stateless_token)\n )\n\n # Add Grants you want to support\n provider.add_grant(oauth2.grant.AuthorizationCodeGrant(site_adapter=site_adapter))\n provider.add_grant(oauth2.grant.ImplicitGrant(site_adapter=site_adapter))\n\n # Add refresh token capability and set expiration time of access tokens to 30 days\n provider.add_grant(oauth2.grant.RefreshToken(expires_in=2592000))\n\n # Wrap the controller with the Wsgi adapter\n app = oauth2.web.wsgi.Application(provider=provider)\n\n if __name__ == \"__main__\":\n httpd = make_server('', 8080, app)\n httpd.serve_forever()\n```\n\nThis example only shows how to instantiate the server.\nIt is not a working example as a client app is missing.\nTake a look at the [examples](docs/examples/) directory.\n\nOr just run this example:\n\n``` bash\npython docs/examples/stateless_client_server.py\n```\n\nThis is already a workable example. They can work without database\nbecause oauth token already contain all the necessary information like\na user_id, grant_type, data, scopes and client_id.\nIf you want to check user state like a ban, disable, etc.\nYou can check this param on server site from database. By adding this check to\n/api/me or redefine oauth2.tokengenerator and add specific logic.\n\n\n# Supported storage backends\n\nOauth2-stateless does not force you to use a specific database or you\ncan work without database with stateless token.\n\nIt currently supports these storage backends out-of-the-box:\n\n- MongoDB\n- MySQL\n- Redis\n- Memcached\n- Dynamodb\n\nHowever, you are not not bound to these implementations.\nBy adhering to the interface defined by the base classes in **oauth2.store**,\nyou can easily add an implementation of your backend.\nIt also is possible to mix different backends and e.g. read data of a client\nfrom MongoDB while saving all tokens in memcached for fast access.\n\nTake a look at the examples in the [examples](docs/examples/) directory of the project.\n\n\n# Site adapter\n\n- aiohttp\n- flask\n- tornado\n- uwsgi\n\nLike for storage, oauth2-stateless does not define how you identify a\nuser or show a confirmation dialogue.\nInstead your application should use the API defined by _oauth2.web.SiteAdapter_.\n\n\n# Contributors\n\n[