lepture/authlib

Features

• Identity Servers - Provides a comprehensive platform for building centralized authentication, authorization, and federation servers.
• OAuth and OpenID Connect Libraries - Provides a comprehensive suite of tools for implementing both OpenID Connect and OAuth 1.0/2.0 clients and servers.
• JWT and Token Management - Provides comprehensive utilities for generating, signing, and validating JSON Web Tokens.
• OAuth 1.0 Authenticators - Implements OAuth 1.0 authenticators for signing and transmitting requests to legacy APIs.
• Access and Refresh Token Issuances - Generates signed access and refresh tokens containing identity claims based on specific grant types and scopes.
• JWT Format Tokens - Generates access tokens in JSON Web Token format to allow for efficient local verification by relying parties.
• Python JWT Libraries - Ships a Python library for encoding, decoding, and validating JSON Web Tokens using various algorithms.
• Authorization Code Issuances - Issues short-lived authorization codes that confidential clients exchange for access and refresh tokens.
• Bearer Token Authentication - Verifies the authenticity and validity of bearer tokens to protect protected resource endpoints.
• OpenID Connect Token Validations - Parses and validates identity tokens from OpenID Connect providers to secure API access.
• JSON Web Encryption - Implements the JWE standard for encrypting and decrypting JSON-formatted data tokens to ensure confidentiality.
• JOSE Specifications - Provides a full implementation of JOSE specifications for signing and encrypting claims via JWS, JWE, and JWK.
• JSON Web Signatures - Implements the JWS standard to create signed payloads and ensure data integrity.
• JWT Parsing - Translates compact JWT strings back into payload dictionaries through decryption or signature validation.
• Token Encodings - Creates signed JWT strings by encoding a payload and header with a cryptographic key.
• JWT Claim Validation - Verifies standard claims within JSON Web Tokens against essential fields and allowed values.
• JSON Web - Provides specialized management of keys following the JSON Web Key standard for token distribution.
• OAuth 1.0 Authentication Strategies - Manages the full lifecycle of OAuth 1.0 authentication for both clients and providers.
• OAuth 2.0 Authorization Flows - Executes multiple standard OAuth 2.0 grant types, including authorization code, implicit, and client credentials.
• OAuth 2.0 Client Implementations - Provides an OAuth 2.0 client implementation capable of making asynchronous HTTP requests to protected endpoints.
• OAuth 2.0 Authorization Servers - Provides a server implementation that manages client registrations, identifiers, secrets, and redirect URIs.
• OAuth 2.0 Resource Servers - Implements OAuth 2.0 resource servers that validate access tokens and verify required scopes for API protection.
• Authorization Server Implementations - Provides a full framework for building OAuth authorization servers that manage consent and issue tokens.
• Grant-Based Token Lifecycles - Models authorization flows as distinct grant types to handle the logic of exchanging credentials for tokens.
• OIDC Protocol Implementations - Implements a complete OpenID Connect client for authenticating users via external identity providers.
• Grant Handling - Handles diverse OIDC grant flows, including Code, Implicit, and Hybrid, with mandatory nonce verification.
• Outgoing Request Signing - Enables cryptographic signing of outbound HTTP requests to ensure authenticity and integrity.
• Server Capability Discovery - Exposes standardized server capabilities and supported algorithms via a public endpoint to automate client configuration.
• OAuth Client Registrations - Implements standard OAuth discovery and dynamic client registration endpoints for automated client onboarding.
• Authorization Management - Validates authorization requests and generates the credentials required to grant third-party access to resources.
• OAuth 1.0 Provider Implementations - Manages the issuance of tokens and validates signed requests from third-party OAuth 1.0 clients.
• Access Token Applications - Provides functionality to attach access tokens to outgoing HTTP requests for authenticated API access.
• Token Issuance Tracking - Tracks token issuance and associates tokens with specific users and clients for server-side management.
• Token Revocation - Provides a revocation endpoint that allows clients to invalidate access or refresh tokens.
• Assertion-Based Authentications - Authenticates service accounts using signed tokens to request access without interactive user login.
• ECDSA Signing Implementations - Produces digital signatures using the Elliptic Curve Digital Signature Algorithm with P-curves and SHA-2 hashes.
• RSA Signing Implementations - Employs RSA public-key cryptography with PKCS1v15 or PSS padding for asymmetric signing and verification.
• Consent Management - Provides tools for managing user consent and validating requests for authorization pages.
• Octet Key Pair Management - Implements importing and exporting of cryptographic keys using specific digital signature and key exchange algorithms.
• ECDH-ES Implementations - Provides implementations of the Elliptic Curve Diffie-Hellman Ephemeral Static algorithm for encryption within the JWE framework.
• HMAC JWT Signers - Generates cryptographic signatures for JSON Web Tokens using shared symmetric keys and HMAC-SHA-2.
• Service Account Authorization - Automates service account authorization using assertions and private keys for server-to-server communication.
• Service Account Authenticators - Supports non-interactive service account authentication using signed tokens and assertions.
• OAuth Device Flows - Implements OAuth 2.0 device authorization flows for devices with limited input capabilities.
• Identity Provider Compliance Fixes - Applies technical corrections to identity provider responses to ensure they align with official protocol specifications.
• JSON Web Key Imports - Converts PEM, JSON, or bytes into standardized JSON Web Key structures for various algorithms.
• Key Resolution - Provides mechanisms to resolve the correct cryptographic key for token verification by matching key identifiers in headers.
• Client Authentications - Secures token endpoints by signing client authentication requests using secret or private key profiles.
• PKCE Authorization Flows - Secures authorization flows by implementing Proof Key for Code Exchange (PKCE) for public clients.
• Metadata Publication - Exposes standardized configuration endpoints that describe server capabilities and endpoints according to RFC 8414.
• OAuth Client Authentications - Verifies client identities using HTTP Basic, POST parameters, and custom authentication functions.
• UserInfo Endpoints - Provides a protected endpoint that returns authenticated user profile data as JSON or signed JWTs.
• JWT Token Validators - Verifies the signature and claims of JSON Web Tokens to protect resource endpoints.
• Token Introspection - Implements token introspection to verify the current validity and metadata of a token via a remote endpoint.
• EdDSA Signatures - Uses the Edwards-curve Digital Signature Algorithm to create secure digital signatures for tokens and payloads.
• JWT Grant Validation - Validates signed JSON Web Tokens used as authorization grants to issue access tokens.
• Device Grant Implementations - Implements the OAuth 2.0 Device Authorization Grant for authenticating users on input-limited hardware.
• Pushed Authorization Requests - Implements pushed authorization requests by transmitting payloads as signed JWTs to increase integrity.
• OAuth Client Metadata Validations - Provides verification of registered client configurations to enforce security constraints like redirect URIs.
• Pluggable - Features a pluggable architecture allowing users to swap synchronous or asynchronous HTTP client implementations.
• Authentication and Authorization - Authentication library for OAuth and OpenID.
• Authentication Libraries - Comprehensive library for OAuth and OpenID services.

Historique des stars