def generate_auth_token(service_account_id) -> dict: """Generates an authentication token for a service account.""" token_info = local_auth.generate_and_store_token(service_account_id, days=36500, prefix=b'SRV') return token_info
def oauth_callback(provider): if current_user.is_authenticated: return redirect(url_for('main.homepage')) oauth = OAuthSignIn.get_provider(provider) try: oauth_user = oauth.callback() except OAuthCodeNotProvided as e: log.error(e) raise wz_exceptions.Forbidden() if oauth_user.id is None: log.debug('Authentication failed for user with {}'.format(provider)) return redirect(url_for('main.homepage')) # Find or create user user_info = {'id': oauth_user.id, 'email': oauth_user.email, 'full_name': ''} db_user = find_user_in_db(user_info, provider=provider) db_id, status = upsert_user(db_user) token = generate_and_store_token(db_id) # Login user pillar.auth.login_user(token['token'], load_from_db=True) if provider == 'blender-id' and current_user.is_authenticated: # Check with Blender ID to update certain user roles. update_subscription() next_after_login = session.pop('next_after_login', None) if next_after_login: log.debug('Redirecting user to %s', next_after_login) return redirect(next_after_login) return redirect(url_for('main.homepage'))
def login_local(): """Login with a local account, as an alternative to OAuth. This provides access only to the web application.""" form = forms.UserLoginForm() # Forward credentials to server if form.validate_on_submit(): user = get_local_user(form.username.data, form.password.data) token = generate_and_store_token(user['_id']) pillar.auth.login_user(token['token']) return redirect(url_for('main.homepage')) return render_template('users/login.html', form=form)
def oauth_callback(provider): import datetime from pillar.api.utils.authentication import store_token from pillar.api.utils import utcnow next_after_login = session.pop('next_after_login', None) or url_for('main.homepage') if current_user.is_authenticated: log.debug('Redirecting user to %s', next_after_login) return redirect(next_after_login) oauth = OAuthSignIn.get_provider(provider) try: oauth_user = oauth.callback() except OAuthCodeNotProvided as e: log.error(e) raise wz_exceptions.Forbidden() if oauth_user.id is None: log.debug('Authentication failed for user with {}'.format(provider)) return redirect(next_after_login) # Find or create user user_info = { 'id': oauth_user.id, 'email': oauth_user.email, 'full_name': '' } db_user = find_user_in_db(user_info, provider=provider) db_id, status = upsert_user(db_user) # TODO(Sybren): If the user doesn't have any badges, but the access token # does have 'badge' scope, we should fetch the badges in the background. if oauth_user.access_token: # TODO(Sybren): make nr of days configurable, or get from OAuthSignIn subclass. token_expiry = utcnow() + datetime.timedelta(days=15) token = store_token(db_id, oauth_user.access_token, token_expiry, oauth_scopes=oauth_user.scopes) else: token = generate_and_store_token(db_id) # Login user pillar.auth.login_user(token['token'], load_from_db=True) if provider == 'blender-id' and current_user.is_authenticated: # Check with Blender ID to update certain user roles. update_subscription() log.debug('Redirecting user to %s', next_after_login) return redirect(next_after_login)