2iX d Z ddlmZ ddlZddlZddlZddlZddlmZ ddl Z ddl
Z
ddl m Z m
Z
ddlmZmZmZ ddlmZ ej0 e Zd@d
Zd Z d Z d@d
Z d Z d Z d Z!d Z" G d de
Z# G d de e$ Z% G d de% Z& G d de$ Z'edk( rddl(Z(ddl)Z)dd l*m+Z+ ejX ejZ e(j\ e(j^ e d z xZ0Z1e0je d d!d"# e0je d$d%& e0je d'e3dd() e0je d*e3d+d,) e0je d-d.d/0 e0je d1dd20 e1ji Z5 e+d3e5jl ie5jn Z8 e'e5jr 4 5 Z:e8jw e5jx re5jx j{ ndd5j} e5j~ e:j 6 7 ZA eB e)j e:j eAd8 d9d:d;e5j eAd< = d>? ddd yy# e$ r ddlm Z m
Z
ddlmZmZ dd lmZ ddlmZ Y 8w xY w# 1 sw Y yxY w)Aa$ A one-stop helper for desktop app to acquire an authorization code.
It starts a web server to listen redirect_uri, waiting for auth code.
It optionally opens a browser window to guide a human user to manually login.
After obtaining an auth code, the web server will automatically shut down.
) defaultdictN)Template)
HTTPServerBaseHTTPRequestHandler)urlparseparse_qs urlencode)escape)r r )r c t | 5 }|j |d j d cd d d S # 1 sw Y y xY w)Nportz
Open this link to Sign In
(You may want to use incognito window)
Abort
)auth_uriwelcome_templatecode)AuthCodeReceiverget_auth_responseget) listen_portr receivers M/var/www/html/qr/venv/lib/python3.12/site-packages/msal/oauth2cli/authcode.pyobtain_auth_coder sG { + x)) " * c&k s "9Ac L t d 5 } | j D ]B }|j dd d j }|j dk7 s: d d d y d d d t
j j d S # 1 sw Y (xY w# t $ r Y 6w xY w)Nz/proc/1/cgroup: /Tz /.dockerenv)open readlinessplitstripIOErrorospathexists)fline cgroup_paths r _is_inside_dockerr' + s
"
# q
"jja 0 3 9 9 ; $$&#-
77>>- ((
s; B A
B B B "B $B BB B#"B#c dd l } | j }t |d|d j }t |d|d j }|dk( xr d|v S )Nr systemreleaser linux microsoft)platformunamegetattrlower)r- r.
platform_namer* s r is_wslr2 9 s^
NN EE8U1X6<<>MeYa1779G G # > w(>> c V t }|j dvr!t j d|j y t fddD rt j d ydd l}|r!|j | j }n|j }|sCt r9dd l
} |j d
g }|dk( }|s |j d g }|d v }|S |S # t $ r t j d Y yw xY w# t $ r Y Nw xY w# t $ r Y |S w xY w)
zJBrowse uri with named browser. Default browser is customizable by $BROWSER)httphttpsz"Invalid URI scheme for browser: %sFzInvalid URI: %sc 3 & K | ] }|v
y wN ).0cr s r z_browse..O s
+Q1=
+s z
zInvalid characters in URIr Nwslviewz explorer.exe)r )
r schemeloggerwarning
ValueErrorany
webbrowserr r r2
subprocesscallFileNotFoundError)r browser_name
parsed_urirD browser_openedrE exit_codes ` r _browserL E s? h'
$5 5 NN?ARAR S 6
+(
++23# 5::8D $ 2 fh "H(=>I &!^N
'OO^X,F G !*f!4 >? ((3* ! %
s5 9C' 1D D ' D D DD D('D(c | j D ci c]+ \ }}|t |t rt | dk( r|d n|- c}}S c c}}w )z;Flatten parse_qs()'s single-item lists into the item itselfr> r )items
isinstancelistlen)qskvs r _qs2kvrU n sL HHJ Aq
z!T*s1v{qt A s 0Ac $ | j d S )N<)
startswithtexts r _is_htmlr[ t s ??3 r3 c h | j D ci c] \ }}|t | c}}S c c}}w r8 )rN r
)key_value_pairsrS rT s r _escaper^ x s+ %4%:%:%< =TQAvayL == =s .c \ t | t r| j s t | S | S r8 )rO str isprintablereprrY s r _printifyrc { s% #D#.t7G7G7I4:StSr3 c , e Zd Zd Zd Zd ZddZd Zy)_AuthCodeHandlerc t t | j j }|j dd g d }|j dd g d }|dk( r&| j | j j y |dk( r| j dd y |r| j d d y | j d
d y ) Nwelcomer errortrueabortzAuthentication abortedFis_okzresponse_mode=query is not supported for authentication responses. This application operates in response_mode=form_post mode only.z_Authentication could not be completed. You can close this window and return to the application.)r r r" queryr _send_full_responseserver welcome_page)selfrR
welcome_param error_params r do_GETz_AuthCodeHandler.do_GET s
htyy)//
0y4&1!4
ffWtf-a0 F " $ $T[[%=%= >
G
# $ $%=U $ K
$ $R
%
$ $q
%
r3 c X t | j j dd }| j j | j d }t
| }|j d s|j d r| j t | y | j dd y ) NzContent-Lengthr utf-8r rh zInvalid POST requestFrk )
intheadersr rfilereaddecoder _process_auth_responserU rn )rq content_length post_datarR s r do_POSTz_AuthCodeHandler.do_POST s T\\ - -.> BCJJOON3::7C
i
66&>RVVG_ ' 'r
3 $ $%;5 $ Ir3 c t j d| | j j r<| j j |j d k7 r| j dd yd|v r| j j n| j j }t |j r t | }n|}t t | }| j |j di | || j _ y) z:Process the auth response from either GET or POST request.zGot auth response: %sstatez>State mismatch. Waiting for next response... or you may abort.Frk r Nr9 )r@ debugro
auth_stater rn success_templateerror_templater[ templater^ r r` safe_substitute
auth_response)rq r r safe_data filled_datas r r| z'_AuthCodeHandler._process_auth_response s ,m< ;; ! !dkk&<&<
@Q@QRY@Z&Z
$ $PX]
%
_ ]* 4404 0J0J
))* #M 2 ) %c95K $ $%=X%=%=%L %L M(5DKK %r3 c | j |rdnd t | rdnd}| j d| | j | j j |j
d y )N i z text/htmlz
text/plainz Content-typerv )
send_responser[ send_header end_headerswfilewriteencode)rq bodyrl content_types r rn z$_AuthCodeHandler._send_full_response sX %3S1&.tn{, 6
W-.r3 c L t j |gt t | y r8 )r@ r maprc )rq formatargss r log_messagez _AuthCodeHandler.log_message s V3c)T 23r3 N)T)__name__
__module__ __qualname__rt r r| rn r r9 r3 r re re s * J6&/4r3 re c $ e Zd Z fdZd Z xZS )_AuthCodeHttpServerc |\ }}|r$t j dk( s
t rd| _ t t
| |g|i | y )Nwin32F)sysr- r2 allow_reuse_addresssuperr __init__)rq server_addressr kwargs_r
__class__s r r z _AuthCodeHttpServer.__init__ sB 4 S\\W,
(-D $
!41.R4R6Rr3 c t d )Nz"Timeout. No auth response arrived.) RuntimeErrorrq s r handle_timeoutz"_AuthCodeHttpServer.handle_timeout s ?@@r3 )r r r r r
__classcell__)r s @r r r s SAr3 r c $ e Zd Zej Zy)_AuthCodeHttpServer6N)r r r socketAF_INET6address_familyr9 r3 r r r s __Nr3 r c D e Zd Zd dZd Zd
dZ d dZd Zd Zd Z y) r Nc t rdnd}t |xs g | _ d|v rt nt } |||xs dft
| _ d| _ y)a Create a Receiver waiting for incoming auth response.
:param port:
The local web server will listen at http://...:
You need to use the same port when you register with your app.
If your Identity Provider supports dynamic port, you can use port=0 here.
Port 0 means to use an arbitrary unused port, per this official example:
https://docs.python.org/2.7/library/socketserver.html#asynchronous-mixins
:param scheduled_actions:
For example, if the input is
``[(10, lambda: print("Got stuck during sign in? Call 800-000-0000"))]``
then the receiver would call that lambda function after
waiting the response for 10 seconds.
z0.0.0.0 127.0.0.1r r FN)r' sorted_scheduled_actionsr r re _server_closing)rq r
scheduled_actionsaddressServers r r zAuthCodeReceiver.__init__ sU 1 2) #)):)@b"A ), %=P w 24DE
r3 c 4 | j j d S )z*The port this server actually listening tor> )r r r s r get_portzAuthCodeReceiver.get_port s ||**1--r3 c i }t j | j |f| }d|_ |j t j
}|rt j
|z
|k rn t j d |j sn| j rt j
|z
| j d d kD r\| j j d \ }} | | j r+t j
|z
| j d d kD r\|r t j
|z
|k rn|xs dS )a Wait and return the auth response. Raise RuntimeError when timeout.
:param str auth_uri:
If provided, this function will try to open a local browser.
Starting from 2026, the built-in http server will require response_mode=form_post.
:param int timeout: In seconds. None means wait indefinitely.
:param str state:
You may provide the state you used in auth_uri,
then we will use it to validate incoming response.
:param str welcome_template:
If provided, your end user will see it instead of the auth_uri.
When present, it shall be a plaintext or html template following
`Python Template string syntax `_,
and include some of these placeholders: $auth_uri and $abort_uri.
:param str success_template:
The page will be displayed when authentication was largely successful.
Placeholders can be any of these:
https://tools.ietf.org/html/rfc6749#section-5.1
:param str error_template:
The page will be displayed when authentication encountered error.
Placeholders can be any of these:
https://tools.ietf.org/html/rfc6749#section-5.2
:param callable auth_uri_callback:
A function with the shape of lambda auth_uri: ...
When a browser was unable to be launch, this function will be called,
so that the app could tell user to manually visit the auth_uri.
:param str browser_name:
If you did
``webbrowser.register("xyz", None, BackgroundBrowser("/path/to/browser"))``
beforehand, you can pass in the name "xyz" to use that browser.
The default value ``None`` means using default browser,
which is customizable by env var $BROWSER.
:return:
The auth response of the first leg of Auth Code flow,
typically {"code": "...", "state": "..."} or {"error": "...", ...}
See https://tools.ietf.org/html/rfc6749#section-4.1.2
and https://openid.net/specs/openid-connect-core-1_0.html#AuthResponse
Returns None when the state was mismatched, or when timeout occurred.
)targetr r Tr> r N)
threadingThread_get_auth_responsedaemonstarttimesleepis_aliver pop)rq timeoutr resulttbeginr callbacks r r z"AuthCodeReceiver.get_auth_response s l **&6
K 18tyy{U"W,d JJqM::<** e+d.E.Ea.H.KK " 5 5 9 9! < 8
** e+d.E.Ea.H.KK 29tyy{U"W,d ~ r3 c
b dj | j }
dj |
} t j d| |r>t t | j } | j dd g d dk( sJ d t |xs d
j || | j _ |rs|r|
d z n|}
t j d
|
z d} t |
| }|s@|s6t j dj |
|| j n ||
d}t |xs d|z | j _ t |xs d|z | j _ || j _ i | j _ || j _ | j* s>| j j- | j j& rn
| j* s>|j/ | j j& y # t j d Y CxY w)Nzhttp://localhost:{p})pz{loc}?error=abort)loczAbort by visit %s
response_moder form_postziThe built-in http server supports HTTP POST only. The auth_uri must be built with response_mode=form_post )r abort_uriz
?welcome=truez*Open a browser on this device to visit: %sF)rH z_browse(...) unsuccessfula Found no browser in current environment. If this program is being run inside a container which either (1) has access to host network (i.e. started by `docker run --net=host -it ...`), or (2) published port {port} to host network (i.e. started by `docker run -p 127.0.0.1:{port}:{port} -it ...`), you can use browser on host to visit the following link. Otherwise, this auth attempt would either timeout (current timeout setting is {timeout}) or be aborted by CTRL+C. Auth URI: {auth_uri})r r r
z`For your security: Do not share the contents of this page, the address bar, or take screenshots.z\Authentication complete. You can return to the application. Please close this browser tab.
zBAuthentication failed. $error: $error_description. ($error_uri).
)r r r@ r r r rm r r r r rp inforL exceptionrA r r r r r r handle_requestupdate)rq r r r r r r r auth_uri_callbackrH netlocr params_urirJ recommendations r r z#AuthCodeReceiver._get_auth_responseH s
(.. .A'..6.: ()4 hx 0 6 67F::ov6q9[H
KJ
KH %--=-C$D$T$T %U %4 ! 1AF_,xD KKDtK L "N
>!(L!I
"(NN H IO%)7 IO IR S &d+{(01A 2~ lo} }) %&.~ 0d
SUc c 'e # ' %' ""' --
LL ' ' )||))
--
dll001Q
> !<=s
H H.c F d| _ | j j y)zGEither call this eventually; or use the entire class as context managerTN)r r server_closer s r closezAuthCodeReceiver.close s
!!#r3 c | S r8 r9 r s r __enter__zAuthCodeReceiver.__enter__ s r3 c $ | j y r8 )r )rq exc_typeexc_valexc_tbs r __exit__zAuthCodeReceiver.__exit__ s
r3 )NNr8 )NNNNNNNN)
r r r r r r r r r r r9 r3 r r r s: ! F.
D L MQIM " B2H$
r3 r __main__r> )Client)levelz/The auth code received will be shown at stdout.)formatter_class descriptionz
--endpointz The auth endpoint for your app.z>https://login.microsoftonline.com/common/oauth2/v2.0/authorize)helpdefault client_idz!The client_id of your application)r z--portzThe port in redirect_uri)typer r z --timeout< zTimeout value, in secondz--hostr zThe host of redirect_uri)r r z--scopezThe scope listauthorization_endpointr zhttp://{h}:{p})hr )scope redirect_urir zBSign In, or AbortzOh no. $errorzOh yeah. Got $coder )r r r r r r )indentr8 )F__doc__ collectionsr loggingr! r r stringr r r http.serverr r urllib.parser r r htmlr
ImportErrorBaseHTTPServerurllibcgi getLoggerr r@ r r' r2 rL rU r[ r^ rc re objectr r r argparsejsonoauth2r basicConfigINFOArgumentParser ArgumentDefaultsHelpFormatterr parser add_argumentrw
parse_argsr endpointr clientr
r initiate_auth_code_flowr r r hostr flowprintdumpsr r r9 r3 r r s $
>::
8 $ ) ?&R >T>4- >4BA*f A(%. %}v }B z Ggll+((( >> OOQ QA NN<P R NN;%HNINN8#q7QNRNN;S";UNVNN8[7QNRNN9d1ANB D
-t}}=t~~
NF tyy )
X--(,
$**""$)00499@Q@Q@S0T . jdjj33*%T7 1LLw- 4
# I A+ j
s I (B"I<!I98I9<J