authlib/authlib

Features

• JOSE Specifications - Provides a comprehensive implementation of JOSE standards, including JWS, JWE, and JWK.
• OAuth 2.0 Authorization Servers - Provides a full authorization server implementation that manages client registrations and issues access tokens.
• OpenID Connect Support - Provides a comprehensive implementation of the OpenID Connect protocol for user authentication and profile management.
• Access and Refresh Token Issuances - Generates and stores access and refresh tokens after successful authorization flows.
• JWT Format Tokens - Generates signed JSON Web Tokens as access tokens containing identity claims and expiration timestamps.
• OpenID Connect Token Validations - Parses and validates OpenID Connect identity tokens to establish and verify user identity.
• Metadata Validations - Validates client configurations including allowed grant types and redirect URIs for authorization requests.
• Token Lifecycle Management - Tracks token expiration and revocation status to manage the validity of active sessions.
• JWT Parsing - Implements the process of decoding compact token strings and retrieving payloads through signature validation.
• JWT Claim Validation - Verifies standard claims within JSON Web Tokens to ensure essential payload data is present and valid.
• JWT Generation - Implements the process of creating signed or encrypted JSON Web Tokens for secure data transmission.
• Token Generation - Creates token dictionaries including access and refresh tokens based on grant types and requested scopes.
• OAuth 2.0 Authorization Flows - Implements standard OAuth 2.0 client flows for exchanging authorization codes and managing tokens.
• Client Registrations - Provides an API endpoint for dynamic OAuth client registration, including support for JWT software statements.
• OAuth 2.0 Client Implementations - Integrates with external authorization servers to request access tokens and authenticate users across environments.
• OAuth 2.0 Resource Servers - Provides a full implementation for building OAuth 2.0 resource servers that protect APIs through token validation.
• OAuth and OpenID Connect Libraries - Serves as a comprehensive Python library for building OAuth 1.0, OAuth 2.0, and OpenID Connect clients and servers.
• OAuth Grant Type Handlers - Routes authorization requests to specific handler logic based on the OAuth 2.0 grant type parameter.
• OpenID Connect Providers - Implements OpenID Connect providers to issue identity tokens and enable standardized single sign-on.
• Grant Handling - Implements OpenID Connect authorization request handling with support for code, implicit, and hybrid flows.
• JWT Signing and Verification - Provides capabilities for creating and validating JSON Web Tokens using HMAC, RSA, and ECDSA signatures.
• Token Signing Operations - Implements cryptographic signing of tokens using private keys to ensure client authenticity and integrity.
• Authorization Code Management - Manages the creation and validation of short-lived authorization codes for confidential clients.
• OAuth Client Metadata Validations - Validates incoming request parameters against registered client configurations to enforce redirect URIs and grant permissions.
• Stateless Token Validation - Verifies JWT authenticity and claims locally using cryptographic signatures without database lookups.
• OAuth Bearer Token Middlewares - Provides middleware to validate bearer tokens and verify permissions for protecting API endpoints.
• OAuth Client Management - Allows editing and deleting registered OAuth clients via an API using the Dynamic Client Registration Management Protocol.
• OAuth Client Registrations - Exposes standard endpoints for dynamic client registration and discovery according to RFC specifications.
• OAuth 1.0 Authenticators - Implements the OAuth 1.0 protocol to authenticate requests to legacy APIs.
• Token Revocation - Implements a dedicated endpoint for invalidating access and refresh tokens to prevent unauthorized continued use.
• ECDSA JWT Signers - Uses the Elliptic Curve Digital Signature Algorithm to create compact asymmetric signatures for JSON Web Tokens.
• RSA Signing Implementations - Implements RSA public-key cryptography with PKCS1v15 or PSS padding for asymmetric token signing.
• Encrypted JWT Generation - Secures token payloads using symmetric or asymmetric encryption algorithms via the JWE standard.
• JSON Web Key Pair Management - Provides tools to import and export JSON Web Keys using specific curve specifications like Ed25519 and X25519.
• ECDH-ES Implementations - Implements the Elliptic Curve Diffie-Hellman Ephemeral Static algorithm for JSON Web Encryption.
• HMAC JWT Signers - Implements symmetric signing for JSON Web Tokens using shared secrets and HMAC-SHA hashing.
• Service Account Authorization - Handles automatic token authorization for service-to-service account communication using the Assertion Framework.
• Service Account Authenticators - Obtains authorization grants using assertion-based service accounts to enable non-interactive logins.
• OAuth Device Flows - Facilitates the OAuth 2.0 Device Authorization Grant for users on input-constrained devices.
• JSON Web Key Imports - Converts PEM, JSON, or raw bytes into standardized JSON Web Key (JWK) structures.
• Key Resolution - Identifies and selects the correct public key from a set to verify a specific token signature.
• JSON Web Signatures - Implements the JWS standard to create and verify signed payloads using symmetric and asymmetric algorithms.
• JWT Authentication - Verifies the identity of a client using signed JWT assertions with symmetric or asymmetric keys.
• JSON Web - Configures and manages cryptographic keys following the JSON Web Key (JWK) standard.
• JSON Web Encryption Decryptions - Decodes compact JWE strings back into their original header and payload using private keys.
• OAuth 1.0 Authentication Strategies - Manages authorization requests and user approval flows specifically for the OAuth 1.0 protocol.
• PKCE Authorization Flows - Secures authorization code flows using code challenges and verifiers to protect public clients from interception.
• OAuth Client Authentications - Verifies client identities using multiple methods, including HTTP Basic, POST parameters, or custom logic.
• Token Payload Encryption - Secures token content using key wrapping and encryption algorithms such as RSA, AES, and ECDH-ES.
• Client Registrations - Provides registration and configuration of third-party services as OIDC clients with support for OIDC-specific metadata.
• UserInfo Endpoints - Exposes UserInfo endpoints to return authenticated user profile information as JSON payloads or signed JWTs.
• Pluggable Token Persistence - Allows developers to define custom storage logic for access and refresh tokens via callbacks.
• Bearer Token Validators - Provides tools to verify that bearer access tokens are active and possess the required scopes.
• JWT Token Validators - Verifies the authenticity, expiration, and claims of incoming JSON Web Tokens to protect resources.
• Token Introspection - Checks the current validity and metadata of a token by querying a remote introspection endpoint.
• Token Introspection and Revocation Endpoints - Exposes standard OAuth 2.0 endpoints for checking token validity and metadata.
• EdDSA Signatures - Uses the Edwards-curve Digital Signature Algorithm to sign payloads within JSON Web Signatures.
• JWT Grant Validation - Validates signed tokens as authorization grants to issue access tokens without traditional credentials.
• Device Grant Implementations - Implements the OAuth 2.0 Device Authorization Grant, coordinating device codes and user verification.
• Async-Sync Compatibility Layers - Provides an architectural bridge allowing authentication logic to work in both synchronous and asynchronous Python environments.
• Authentication - Listed in the “Authentication” section of the Awesome Python awesome list.
• Authentication and Permissions - JavaScript Object Signing and Encryption draft implementation.

Star-Verlauf