Moved metadata, usage and behaviour information into a class of its own.

Author: rohe

doc/client/config.rst

@@ -5,11 +5,12 @@ RP/Client Configuration
 -----------------------
 
 As you may have guessed by now a lot of the work you have to do to use this
-packages lies in the RP configuration.
+packages lies in the RP/Client configuration.
+I'll use just RP in the rest of the document but everywhere you see RP you
+can also think Client (in the OAuth2 sense).
 
-The configuration parameters fall into 2 groups, one general that is the
-same for all RP/clients and one which is specific for a specific
-OP/AS
+The configuration parameters fall into 2 groups, one with basic information
+that are independent of which OpenID Provider (OP) that RP
 
 General configuration parameters
 --------------------------------

src/idpyoidc/actor/client/oidc/registration.py

@@ -166,7 +166,7 @@ def add_client_behaviour_preference(self, request_args=None, **kwargs):
                 continue
 
             try:
-                request_args[prop] = _context.behaviour[prop]
+                request_args[prop] = _context.specs.behaviour[prop]
             except KeyError:
                 try:
                     request_args[prop] = _context.client_preferences[prop]

src/idpyoidc/client/client_auth.py

@@ -105,7 +105,7 @@ def _get_user(service, **kwargs):
         try:
             user = kwargs["user"]
         except KeyError:
-            user = service.client_get("service_context").get_metadata("client_id")
+            user = service.client_get("service_context").get_client_id()
         return user
 
     def _get_authentication_token(self, request, service, **kwargs):
@@ -140,7 +140,7 @@ def _with_or_without_client_id(request, service):
         ):
             if "client_id" not in request:
                 try:
-                    request["client_id"] = service.client_get("service_context").get_metadata("client_id")
+                    request["client_id"] = service.client_get("service_context").get_client_id()
                 except AttributeError:
                     pass
         else:
@@ -228,7 +228,7 @@ def modify_request(self, request, service, **kwargs):
                     raise AuthnFailure("Missing client secret")
 
         # Set the client_id in the the request
-        request["client_id"] = _context.get_metadata("client_id")
+        request["client_id"] = _context.get_client_id()
 
     def construct(self, request, service=None, http_args=None, **kwargs):
         """

src/idpyoidc/client/entity.py

@@ -83,6 +83,7 @@ def __init__(
             services: Optional[dict] = None,
             jwks_uri: Optional[str] = "",
             httpc_params: Optional[dict] = None,
+            client_type: Optional[str] = ""
     ):
         self.extra = {}
         if httpc_params:
@@ -98,7 +99,8 @@ def __init__(
             _kj = None
 
         self._service_context = ServiceContext(
-            keyjar=keyjar, config=config, jwks_uri=jwks_uri, httpc_params=self.httpc_params
+            keyjar=keyjar, config=config, jwks_uri=jwks_uri, httpc_params=self.httpc_params,
+            client_type=client_type
         )
 
         if config:
@@ -113,13 +115,6 @@ def __init__(
                                       metadata=config.conf.get("metadata", {}),
                                       usage=config.conf.get("usage", {}))
 
-        # MUST not overwrite service specific usage and metadata
-        for key, val in config.conf.get("usage", {}).items():
-            self.set_usage_value(key, val)
-
-        for key, val in config.conf.get("metadata", {}).items():
-            self.set_metadata_value(key, val)
-
         self.setup_client_authn_methods(config)
 
         jwks_uri = jwks_uri or self.get_metadata_value("jwks_uri")
@@ -161,7 +156,7 @@ def get_entity(self):
         return self
 
     def get_client_id(self):
-        return self._service_context.get_metadata("client_id")
+        return self._service_context.get_client_id()
 
     def setup_client_authn_methods(self, config):
         self._service_context.client_authn_method = client_auth_setup(
@@ -172,32 +167,32 @@ def collect_metadata(self):
         res = {}
         for service in self._service.values():
             res.update(service.metadata)
-        res.update(self._service_context.metadata)
+        res.update(self._service_context.specs.get_all())
         return res
 
     def collect_usage(self):
         res = {}
         for service in self._service.values():
             res.update(service.usage)
-        res.update(self._service_context.usage)
+        res.update(self._service_context.specs.usage)
         return res
 
     def get_metadata_value(self, attribute, default=None):
         for service in self._service.values():
             if attribute in service.metadata_attributes:
                 return service.get_metadata(attribute, default)
 
-        if attribute in self._service_context.metadata_attributes:
-            return self._service_context.get_metadata(attribute, default)
+        if attribute in self._service_context.specs.attributes:
+            return self._service_context.specs.get_metadata(attribute, default)
 
-        raise KeyError(f"Unknown metadata attribute: {attribute}")
+        raise KeyError(f"Unknown specs attribute: {attribute}")
 
     def get_metadata_attributes(self):
         attr = []
         for service in self._service.values():
             attr.extend(list(service.metadata_attributes.keys()))
 
-        attr.extend(list(self._service_context.metadata_attributes.keys()))
+        attr.extend(list(self._service_context.specs.attributes.keys()))
 
         return attr
 
@@ -212,8 +207,8 @@ def value_in_metadata_attribute(self, attribute, value):
                     if value == _val:
                         return True
 
-        if attribute in self._service_context.metadata_attributes.keys():
-            _val = self._service_context.get_metadata(attribute)
+        if attribute in self._service_context.specs.attributes.keys():
+            _val = self._service_context.specs.get_metadata(attribute)
             if isinstance(_val, list):
                 if value in _val:
                     return True
@@ -229,8 +224,8 @@ def will_use(self, attribute):
                 if service.usage.get(attribute):
                     return True
 
-        if attribute in self._service_context.usage_rules.keys():
-            if self._service_context.usage.get(attribute):
+        if attribute in self._service_context.specs.rules.keys():
+            if self._service_context.specs.get_usage(attribute):
                 return True
         return False
 
@@ -249,18 +244,18 @@ def set_metadata_value(self, attribute, value):
                         service.metadata[attribute] = value
                         return True
 
-        if attribute in self._service_context.metadata_attributes:
-            _def_val = self._service_context.metadata_attributes[attribute]
+        if attribute in self._service_context.specs.attributes:
+            _def_val = self._service_context.specs.attributes[attribute]
             if _def_val is None:
-                self._service_context.metadata[attribute] = value
+                self._service_context.specs.set_metadata(attribute, value)
                 return True
             else:
-                if self._service_context.metadata[attribute] == _def_val:
-                    self._service_context.metadata[attribute] = value
+                if self._service_context.specs.get_metadata(attribute, _def_val):
+                    self._service_context.specs.set_metadata(attribute, value)
                     return True
             return True
 
-        logger.info(f"Unknown set metadata attribute: {attribute}")
+        logger.info(f"Unknown set specs attribute: {attribute}")
         return False
 
     def set_usage_value(self, attribute, value):
@@ -278,14 +273,14 @@ def set_usage_value(self, attribute, value):
                         service.usage[attribute] = value
                         return True
 
-        if attribute in self._service_context.usage_rules:
-            _def_val = self._service_context.usage_rules[attribute]
+        if attribute in self._service_context.specs.rules:
+            _def_val = self._service_context.specs.rules[attribute]
             if _def_val is None:
-                self._service_context.usage[attribute] = value
+                self._service_context.specs.set_usage(attribute, value)
                 return True
             else:
-                if self._service_context.usage[attribute] == _def_val:
-                    self._service_context.usage[attribute] = value
+                if self._service_context.specs.usage[attribute] == _def_val:
+                    self._service_context.specs.set_usage(attribute, value)
                     return True
 
         logger.info(f"Unknown set usage attribute: {attribute}")
@@ -299,9 +294,10 @@ def get_usage_value(self, attribute, default=None):
                 else:
                     return default
 
-        if attribute in self._service_context.usage_rules:
-            if attribute in self._service_context.usage:
-                return self._service_context.usage[attribute]
+        if attribute in self._service_context.specs.rules:
+            _val = self._service_context.specs.get_usage(attribute)
+            if _val:
+                return _val
             else:
                 return default
 
@@ -319,10 +315,10 @@ def construct_uris(self, issuer, hash_seed, callback):
         for service in self._service.values():
             service.construct_uris(_base_url, _hex)
 
-        if not self._service_context.get_metadata("redirect_uris"):
-            self._service_context.construct_redirect_uris(_base_url, _hex, callback)
+        if not self._service_context.specs.get_metadata("redirect_uris"):
+            self._service_context.specs.construct_redirect_uris(_base_url, _hex, callback)
 
-        self._service_context.construct_uris(_base_url, _hex)
+        self._service_context.specs.construct_uris(_base_url, _hex)
 
     def backward_compatibility(self, config):
         _uris = config.get("redirect_uris")
@@ -357,14 +353,14 @@ def config_args(self):
                 "usage": service.usage_rules
             }
         res[""] = {
-            "metadata": self._service_context.metadata_attributes,
-            "usage": self._service_context.usage_rules
+            "metadata": self._service_context.specs.attributes,
+            "usage": self._service_context.specs.rules
         }
         return res
 
     def get_callback_uris(self):
         res = []
         for service in self._service.values():
             res.extend(service.callback_uris)
-        res.extend(self._service_context.callback_uris)
+        res.extend(self._service_context.specs.callback_uris)
         return res

src/idpyoidc/client/oauth2/utils.py

@@ -36,21 +36,21 @@ def pick_redirect_uri(
     if "redirect_uri" in request_args:
         return request_args["redirect_uri"]
 
-    if context.callback:
+    if context.specs.callback:
         if not response_type:
-            _conf_resp_types = context.behaviour.get("response_types", [])
+            _conf_resp_types = context.specs.behaviour.get("response_types", [])
             response_type = request_args.get("response_type")
             if not response_type and _conf_resp_types:
                 response_type = _conf_resp_types[0]
 
         _response_mode = request_args.get("response_mode")
 
         if _response_mode == "form_post" or response_type == ["form_post"]:
-            redirect_uri = context.callback["form_post"]
+            redirect_uri = context.specs.callback["form_post"]
         elif response_type == "code" or response_type == ["code"]:
-            redirect_uri = context.callback["code"]
+            redirect_uri = context.specs.callback["code"]
         else:
-            redirect_uri = context.callback["implicit"]
+            redirect_uri = context.specs.callback["implicit"]
 
         logger.debug(
             f"pick_redirect_uris: response_type={response_type}, response_mode={_response_mode}, "
@@ -71,9 +71,7 @@ def pre_construct_pick_redirect_uri(
         request_args: Optional[Union[Message, dict]] = None, service: Optional[Service] = None,
         **kwargs
 ):
-    _context = service.client_get("service_context")
-    _redirect_uris = service.client_get("entity").get_metadata_value("redirect_uris")
-    request_args["redirect_uri"] = pick_redirect_uri(_context,
+    request_args["redirect_uri"] = pick_redirect_uri(service.client_get("service_context"),
                                                      entity=service.client_get("entity"),
                                                      request_args=request_args)
     return request_args, {}

src/idpyoidc/client/oidc/access_token.py

@@ -55,7 +55,7 @@ def gather_verify_arguments(
         except KeyError:
             pass
 
-        _verify_args = _context.behaviour.get("verify_args")
+        _verify_args = _context.specs.behaviour.get("verify_args")
         if _verify_args:
             if _verify_args:
                 kwargs.update(_verify_args)
@@ -83,7 +83,8 @@ def update_service_context(self, resp, key="", **kwargs):
         _state_interface.store_item(resp, "token_response", key)
 
     def get_authn_method(self):
+        _specs = self.client_get("service_context").specs
         try:
-            return self.client_get("service_context").behaviour["token_endpoint_auth_method"]
+            return _specs.behaviour["token_endpoint_auth_method"]
         except KeyError:
             return self.default_authn_method

src/idpyoidc/client/oidc/authorization.py

@@ -93,7 +93,7 @@ def oidc_pre_construct(self, request_args=None, post_args=None, **kwargs):
         try:
             _response_types = [request_args["response_type"]]
         except KeyError:
-            _response_types = _context.behaviour.get("response_types")
+            _response_types = _context.specs.behaviour.get("response_types")
             if _response_types:
                 request_args["response_type"] = _response_types[0]
             else:
@@ -151,8 +151,9 @@ def get_request_object_signing_alg(self, **kwargs):
                 break
 
         if not alg:
+            _context = self.client_get("service_context")
             try:
-                alg = self.client_get("service_context").behaviour["request_object_signing_alg"]
+                alg = _context.specs.behaviour["request_object_signing_alg"]
             except KeyError:  # Use default
                 alg = "RS256"
         return alg
@@ -195,7 +196,7 @@ def construct_request_parameter(
         # This is the issuer of the JWT, that is me !
         _issuer = kwargs.get("issuer")
         if _issuer is None:
-            kwargs["issuer"] = _srv_cntx.get_metadata("client_id")
+            kwargs["issuer"] = _srv_cntx.get_client_id()
 
         if kwargs.get("recv") is None:
             try:
@@ -254,15 +255,15 @@ def oidc_post_construct(self, req, **kwargs):
         if _request_param:
             del kwargs["request_param"]
         else:
-            if _context.get_usage("request_uri"):
+            if _context.specs.get_usage("request_uri"):
                 _request_param = "request_uri"
-            elif _context.get_usage("request_parameter"):
+            elif _context.specs.get_usage("request_parameter"):
                 _request_param = "request"
 
         _req = None  # just a flag
         if _request_param == "request_uri":
             kwargs["base_path"] = _context.get("base_url") + "/" + "requests"
-            kwargs["local_dir"] = _context.config.conf.get("requests_dir", "./requests")
+            kwargs["local_dir"] = _context.specs.get("requests_dir", "./requests")
             _req = self.construct_request_parameter(req, _request_param, **kwargs)
             req["request_uri"] = self.store_request_on_file(_req, **kwargs)
         elif _request_param == "request":
@@ -295,7 +296,7 @@ def gather_verify_arguments(
             "skew": _context.clock_skew,
         }
 
-        _client_id = _context.get_metadata("client_id")
+        _client_id = _context.get_client_id()
         if _client_id:
             kwargs["client_id"] = _client_id
 
@@ -312,7 +313,7 @@ def gather_verify_arguments(
         except KeyError:
             pass
 
-        _verify_args = _context.behaviour.get("verify_args")
+        _verify_args = _context.specs.behaviour.get("verify_args")
         if _verify_args:
             kwargs.update(_verify_args)
 

src/idpyoidc/client/oidc/provider_info_discovery.py

@@ -99,7 +99,7 @@ def match_preferences(self, pcr=None, issuer=None):
 
         regreq = oidc.RegistrationRequest
 
-        _behaviour = _context.behaviour
+        _behaviour = _context.specs.behaviour
 
         for _pref, _prov in PREFERENCE2PROVIDER.items():
             if _pref in ["scope"]:
@@ -168,5 +168,5 @@ def match_preferences(self, pcr=None, issuer=None):
             if key not in PREFERENCE2PROVIDER:
                 _behaviour[key] = val
 
-        _context.behaviour = _behaviour
+        _context.specs.behaviour = _behaviour
         logger.debug("service_context behaviour: {}".format(_behaviour))

src/idpyoidc/client/oidc/refresh_access_token.py

@@ -8,7 +8,8 @@ class RefreshAccessToken(refresh_access_token.RefreshAccessToken):
     error_msg = oidc.ResponseMessage
 
     def get_authn_method(self):
+        _specs = self.client_get("service_context").specs
         try:
-            return self.client_get("service_context").behaviour["token_endpoint_auth_method"]
+            return _specs.behaviour["token_endpoint_auth_method"]
         except KeyError:
             return self.default_authn_method