Ligare.web.middleware.sso

Ligare.web’s IAM controls and integration with Ligare.identity.

Functions

_delete_username_cookie(response, log)
apikey_auth(token, required_scopes)	This is used by Connexion to authorize requests.
get_username(log)
idp_initiated(idp_name, saml2_client, ...)
login_required([roles, auth_check_override])	Require a valid Flask session before calling the decorated function.
logout(log)
make_session_permanent(config)
remove_username_cookie_without_session(...)
sp_initiated(idp_name, saml2_client, config, log)
user(log)

Classes

LoginManager(user_loader, app, log[, ...])
SAML2MiddlewareModule()
Username
_LoginUserMixin()	Used strictly for typecasting.
_SessionValueNames()

protocol Ligare.web.middleware.sso.AuthCheckOverrideCallable

typing.Protocol.

Classes that implement this protocol must have the following methods / attributes:

__call__(user, *args, **kwargs)

Call self as a function.

Return type:

bool

protocol Ligare.web.middleware.sso.AuthCheckUser

typing.Protocol.

Classes that implement this protocol must have the following methods / attributes:

id: UserId

roles: Sequence[Role]

class Ligare.web.middleware.sso.LoginManager(user_loader, app, log, add_context_processor=True)

__init__(user_loader, app, log, add_context_processor=True)

unauthorized()

Raises an Unauthorized exception.

class Ligare.web.middleware.sso.SAML2MiddlewareModule

class SAML2Middleware(app)

__init__(app)

configure(binder)

Override to configure bindings.

Return type:

None

static get_config_type()

Return type:

type[AbstractConfig]

register_middleware(app)

class Ligare.web.middleware.sso.Username

username: NotRequired[str]

Ligare.web.middleware.sso.apikey_auth(token, required_scopes)

This is used by Connexion to authorize requests. It is specified in API-v1.yaml. token is the value passed either through Connexion ingesting the session cookie, or through the manually set value in the Swagger UI. The session cookie is available after authenticating.

Ligare.web.middleware.sso.get_username(log)

Return type:

Username

Ligare.web.middleware.sso.idp_initiated(idp_name, saml2_client, user_loader, config, sso_config, log)

Ligare.web.middleware.sso.login_required(roles=None, auth_check_override=None, /)

Require a valid Flask session before calling the decorated function.

This method uses the list of roles to determine whether the current session user has any of the roles listed. Alternatively, the use of auth_check_override is used to bypass the role check. If the auth_check_override method returns True, the user is considered to have access to the decorated API endpoint. If the auth_check_override method returns False, login_required falls back to checking roles.

If roles is a list, the user must have been assigned one of the roles specified. If roles is None, or if the decorator is not explicitly called, this will only require a valid Flask session regardless of the user’s roles.

If both auth_check_override and roles are None, this returns flask_login.login_required. Call this directly, rather than as a decorator. See https://flask-login.readthedocs.io/en/latest/#flask_login.login_required for more information.

If roles is a callable and auth_check_override is None, this executes flask_login.login_required in its usual way. This is the same as using flask_login.login_required as a decorator. See https://flask-login.readthedocs.io/en/latest/#flask_login.login_required for more information.

If roles is a list of User Roles and the current session user’s roles intersect with roles, this returns True. If the current session user’s roles do not intersect with roles, this returns False.

Return type:

Union[Callable[[Callable[[ParamSpec(P)], TypeVar(R)]], Callable[[ParamSpec(P)], TypeVar(R)]], Callable[[ParamSpec(P)], TypeVar(R)], Callable[..., Any]]

If auth_check_override is a callable, it will be called with the following parameters:

• user is the current session user

• *args will be any arguments passed without argument keywords. When using login_required as a decorator, this will be an empty tuple.

• **kwargs will be any parameters specified with keywords. When using login_required as a decorator, this will be the parameters passed into the decorated method. In the case of a Flask API endpoint, for example, this will be all of the endpoint method parameters.

Ligare.web.middleware.sso.logout(log)

Ligare.web.middleware.sso.make_session_permanent(config)

Ligare.web.middleware.sso.remove_username_cookie_without_session(response, log)

Ligare.web.middleware.sso.sp_initiated(idp_name, saml2_client, config, log)

Ligare.web.middleware.sso.user(log)