Skip to main content

CERN-specific Flask-Multipass providers

Project description

Flask-Multipass-CERN

This package provides the cern auth and identity providers for Flask-Multipass.

These providers are only useful if you are at CERN and intend to use Flask-Multipass with the new Keycloak-based CERN authentication infrastructure.

In its current state it also overkill if all you want to do is logging in via OIDC. If that's your goal use the authlib multipass provider since Keycloak works perfectly fine with it.

In case you need access to arbitrary group membership information (e.g. for user-managed ACLs) and the ability to search for CERN users, then this is a good choice for you.

CERN usage details

The following permissions (requested through the application portal) are needed:

  • Token exchange with authorization-service-api for basic login functionality
  • Group membership in authorization-service-groups-readers for group functionality
  • Group membership in authorization-service-identity-readers for user search functionality
  • Tokens with group membership information (optional) - this needs to be requested directly from the authorization service team

Requesting them will most likely require you to have a professional justification.

Performance

When using group membership or user search, the library need to get an "API access" token from keycloak which typically takes 200-300ms. Set the cache key of the multipass identity provider configuration to the import path of a Flask-Caching instance or a function returning such an instance, or the instance itself to enable caching of tokens (until they expire) and group data (30 minutes).

If group membership information is included in tokens, it will be cached during login so the extra API call when checking whether a user is in a group won't be needed unless the cached data already expired.

Note

In applying the MIT license, CERN does not waive the privileges and immunities granted to it by virtue of its status as an Intergovernmental Organization or submit itself to any jurisdiction.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

Flask-Multipass-CERN-2.1.tar.gz (6.9 kB view hashes)

Uploaded Source

Built Distribution

Flask_Multipass_CERN-2.1-py3-none-any.whl (7.5 kB view hashes)

Uploaded Python 3

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page