repository·master·Indexed 42 days ago
https://github.com/aliev/aioauthAn asynchronous OAuth 2.0 framework for Python 3.9+ designed for asyncio-compatible web frameworks like FastAPI, Starlette, and aiohttp. It supports RFC 6749 (Authorization Framework), RFC 7662 (Token Introspection), RFC 7636 (PKCE), and OpenID. The framework is database agnostic, allowing integration with MongoDB, PostgreSQL, and MySQL via the BaseStorage interface.
aioauth is a spec-compliant, asynchronous OAuth 2.0 framework for Python 3. It is designed to be framework-agnostic, providing plug-and-play methods that integrate with various asynchronous ecosystems.
Compatible Server Frameworks:
Compatible Database Modules/ORMs:
aioauth is an asynchronous OAuth 2.0 framework for Python 3. It is designed to work with asynchronous web frameworks and various database backends.
asyncio, making it compatible with frameworks like FastAPI, Starlette, and aiohttp.MongoDB, PostgreSQL, MySQL, etc., via the BaseStorage interface.In aioauth, a Grant Type is the mechanism used by a client to obtain an access token. The aioauth.grant_type module provides the base abstractions for implementing different OAuth 2.0 flows (such as authorization_code, client_credentials, or password).
To implement a custom grant type or use an existing one, you interact with the GrantType abstraction which handles the logic of validating requests and issuing tokens according to the specific RFC requirements.
aioauth.oidc.core.grant_type, the framework defines the core abstractions for different OAuth 2.0 and OpenID Connect (OIDC) grant types. Grant types determine the mechanism by which a client obtains an access token. When implementing or extending OIDC flows, you will interact with these grant type definitions to handle specific authorization flows (such as authorization_code, client_credentials, or refresh_token).aioauth.oidc.core.responses module contains the core response objects used in OpenID Connect (OIDC) flows. These objects represent the different types of responses sent by an OIDC provider, such as Token Responses or ID Token responses, ensuring they adhere to the expected structure and security requirements of the OIDC specification.aioauth.storage module provides the interface for persisting OAuth 2.0 data (such as tokens, codes, and states). To use a custom storage backend (e.g., a database like PostgreSQL or Redis), you must implement a class that follows the expected storage interface. This allows aioauth to remain agnostic of your specific persistence layer while ensuring that sensitive OAuth credentials are saved and retrieved correctly during the authentication flow.aioauth with any database or ORM (such as SQLAlchemy, Gino, or databases) by implementing the BaseStorage interface located in aioauth/storage.py. This allows the framework to remain decoupled from specific database implementations.aioauth.collections module provides tools for managing collections of OAuth 2.0 related entities. This module is part of the core aioauth framework and is used to organize and access different components of the OAuth flow.To explore a working implementation of aioauth integrated with a FastAPI server and an in-memory database, clone the repository and install the required dependencies from the examples directory.
$ git clone git@github.com:aliev/aioauth.git
$ cd aioauth/examples
$ pip install -r requirements.txt
$ python3 fastapi_example.pyInstall the stable version of aioauth using pip. For development or to access pre-release versions, install directly from the GitHub repository.
pip install aioauth
# To install pre-releases:
pip install git+https://github.com/aliev/aioauthThe Authorization Code flow involves several steps to exchange an authorization code for an access token.
Start by sending a GET request to the /oauth/authorize endpoint. This will prompt the resource owner to authenticate (via a login form) and approve or deny the client's access request.
Example URL:
http://localhost:8000/oauth/authorize?client_id=test_client&redirect_uri=https%3A%2F%2Fwww.example.com%2Fredirect&response_type=code&state=somestate&scope=email
redirect_uri with a code and the original state.
https://www.example.com/redirect?state=somestate&code=AUTHORIZATION_CODE&scope=emailerror parameter.
https://www.example.com/redirect?error=access_denied&state=somestateUse the /oauth/tokenize endpoint to exchange the code for tokens using Basic Authentication for the client credentials.
curl localhost:8000/oauth/tokenize \
-u 'test_client:password' \
-d 'grant_type=authorization_code' \
-d 'code=AUTHORIZATION_CODE' \
-d 'redirect_uri=https://www.example.com/redirect'When the access token expires, use the refresh_token grant type at the /oauth/tokenize endpoint to obtain a new set of tokens.
curl localhost:8000/oauth/tokenize \
-u 'test_client:password' \
-d 'grant_type=refresh_token' \
-d 'refresh_token=REFRESH_TOKEN'# Exchange code for token
curl localhost:8000/oauth/tokenize \
-u 'test_client:password' \
-d 'grant_type=authorization_code' \
-d 'code=EJKOGQhY7KcWjNGI2UbCnOrqAGtRiCEJnAYNwYJ8M5'\
-d 'redirect_uri=https://www.example.com/redirect'Install the aioauth package using pip to add asynchronous OAuth 2.0 support to your Python 3.9+ project.
python -m pip install aioauth