darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-24 00:07:02 -04:00
Code Issues Packages Projects Releases Wiki Activity

comment out check for now

Browse Source
This commit is contained in:
Kenneth Kehl
2024-10-18 07:23:19 -07:00
parent 00f63aed23
commit eaed2fc879
1 changed files with 31 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

57
app/main/views/sign_in.py
View File

@@ -1,4 +1,4 @@
import json # import json
import os import os
import secrets import secrets
import time import time
@@ -43,7 +43,7 @@ def _reformat_keystring(orig): # pragma: no cover
def _get_access_token(code, state): # pragma: no cover def _get_access_token(code, state): # pragma: no cover
client_id = os.getenv("LOGIN_DOT_GOV_CLIENT_ID") client_id = os.getenv("LOGIN_DOT_GOV_CLIENT_ID")
access_token_url = os.getenv("LOGIN_DOT_GOV_ACCESS_TOKEN_URL") access_token_url = os.getenv("LOGIN_DOT_GOV_ACCESS_TOKEN_URL")
certs_url = os.getenv("LOGIN_DOT_GOV_CERTS_URL") # certs_url = os.getenv("LOGIN_DOT_GOV_CERTS_URL")
keystring = os.getenv("LOGIN_PEM") keystring = os.getenv("LOGIN_PEM")
if " " in keystring: if " " in keystring:
keystring = _reformat_keystring(keystring) keystring = _reformat_keystring(keystring)
@@ -66,33 +66,38 @@ def _get_access_token(code, state): # pragma: no cover
response = requests.post(url, headers=headers) response = requests.post(url, headers=headers)
response_json = response.json() response_json = response.json()
try:
encoded_id_token = response_json["id_token"] # TODO nonce check intermittently fails, investifix
except KeyError as e: # Presumably the nonce is not yet in the session when there
current_app.logger.exception(f"Error when getting id token {response_json}") # is an invite involved?
raise KeyError(f"'access_token' {response.json()}") from e
# try:
# encoded_id_token = response_json["id_token"]
# except KeyError as e:
# current_app.logger.exception(f"Error when getting id token {response_json}")
# raise KeyError(f"'access_token' {response.json()}") from e
# Getting Login.gov signing keys for unpacking the id_token correctly. # Getting Login.gov signing keys for unpacking the id_token correctly.
jwks = requests.get(certs_url).json() # jwks = requests.get(certs_url).json()
public_keys = { # public_keys = {
jwk["kid"]: { # jwk["kid"]: {
"key": jwt.algorithms.RSAAlgorithm.from_jwk(json.dumps(jwk)), # "key": jwt.algorithms.RSAAlgorithm.from_jwk(json.dumps(jwk)),
"algo": jwk["alg"], # "algo": jwk["alg"],
} # }
for jwk in jwks["keys"] # for jwk in jwks["keys"]
} # }
kid = jwt.get_unverified_header(encoded_id_token)["kid"] # kid = jwt.get_unverified_header(encoded_id_token)["kid"]
pub_key = public_keys[kid]["key"] # pub_key = public_keys[kid]["key"]
algo = public_keys[kid]["algo"] # algo = public_keys[kid]["algo"]
id_token = jwt.decode( # id_token = jwt.decode(
encoded_id_token, pub_key, audience=client_id, algorithms=[algo] # encoded_id_token, pub_key, audience=client_id, algorithms=[algo]
) # )
# nonce = id_token["nonce"]
nonce = id_token["nonce"] # saved_nonce = session.pop("nonce")
saved_nonce = session.pop("nonce") # if nonce != saved_nonce:
if nonce != saved_nonce: # current_app.logger.error(f"Nonce Error: {nonce} != {saved_nonce}")
current_app.logger.error(f"Nonce Error: {nonce} != {saved_nonce}") # abort(403)
abort(403)
try: try:
access_token = response_json["access_token"] access_token = response_json["access_token"]