Skip to content

academy.exchange.cloud.authenticate

Authenticate users from request headers.

Authenticator

Bases: Protocol

Authenticate users from request headers.

authenticate_user async 

authenticate_user(headers: Mapping[str, str]) -> ClientInfo

Authenticate user from request headers.

Warning

This method must be thread safe!

Parameters:

Returns:

  • ClientInfo –

    A user id upon authentication success.

Raises:

Source code in academy/exchange/cloud/authenticate.py 
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
async def authenticate_user(
    self,
    headers: Mapping[str, str],
) -> ClientInfo:
    """Authenticate user from request headers.

    Warning:
        This method must be thread safe!

    Args:
        headers: Request headers.

    Returns:
        A user id upon authentication success.

    Raises:
        ForbiddenError: user is authenticated but is missing permissions
            or accessing forbidden resources.
        UnauthorizedError: user authentication fails.
    """
    ...

NullAuthenticator

Authenticator that implements no authentication.

authenticate_user async 

authenticate_user(headers: Mapping[str, str]) -> ClientInfo

Authenticate user from request headers.

Parameters:

Returns:

  • ClientInfo –

    Null user regardless of provided headers.

Source code in academy/exchange/cloud/authenticate.py 
62
63
64
65
66
67
68
69
70
71
72
73
74
async def authenticate_user(
    self,
    headers: Mapping[str, str],
) -> ClientInfo:
    """Authenticate user from request headers.

    Args:
        headers: Request headers.

    Returns:
        Null user regardless of provided headers.
    """
    return ClientInfo(client_id='', group_memberships=set())

GlobusAuthenticator 

GlobusAuthenticator(
    client_id: str | None = None,
    client_secret: str | None = None,
    *,
    token_cache_limit: int = 1024,
    token_ttl_s: int = 60,
    group_info_cache_ttl_s: int = 60
)

Globus Auth authorizer.

Parameters:

  • client_id (str | None, default: None ) –

    Globus application client ID. If either client_id or client_secret is None, the values will be read from the environment variables as described in get_confidential_app_auth_client. Ignored if auth_client is provided.

  • client_secret (str | None, default: None ) –

    Globus application client secret. See client_id for details. Ignored if auth_client is provided.

  • token_cache_limit (int, default: 1024 ) –

    Maximum number of (token, identity) mappings to store in memory.

  • token_ttl_s (int, default: 60 ) –

    Time in seconds before invalidating cached tokens.

Source code in academy/exchange/cloud/authenticate.py 
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
def __init__(
    self,
    client_id: str | None = None,
    client_secret: str | None = None,
    *,
    token_cache_limit: int = 1024,
    token_ttl_s: int = 60,
    group_info_cache_ttl_s: int = 60,
) -> None:
    self._local_data = threading.local()
    self.executor = ThreadPoolExecutor(
        thread_name_prefix='exchange-auth-thread',
    )
    self.client_id = client_id or get_academy_exchange_client_id()
    self.client_secret = client_secret or get_academy_exchange_secret()
    self.audience = AcademyExchangeScopes.resource_server

    self.token_cache = TTLCache(
        maxsize=token_cache_limit,
        ttl=token_ttl_s,
    )
    self.dependent_token_cache = TTLCache(
        maxsize=token_cache_limit,
        ttl=group_info_cache_ttl_s,
    )
    self.groups_info_cache = TTLCache(
        maxsize=token_cache_limit,
        ttl=group_info_cache_ttl_s,
    )

auth_client property 

auth_client: ConfidentialAppAuthClient

A thread local copy of the Globus AuthClient.

authenticate_user async 

authenticate_user(headers: Mapping[str, str]) -> ClientInfo

Authenticate a Globus Auth user from request header.

This follows from the Globus Sample Data Portal example.

The underlying auth client is not thread safe, but this method is made thread safe using a lock.

Parameters:

  • headers (Mapping[str, str]) –

    Request headers to extract tokens from.

Returns:

Raises:

  • UnauthorizedError –

    if the authorization header is missing or the header is malformed.

  • ForbiddenError –

    if the tokens have expired or been revoked.

  • ForbiddenError –

    if audience is not included in the token's audience.

Source code in academy/exchange/cloud/authenticate.py 
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
async def authenticate_user(
    self,
    headers: Mapping[str, str],
) -> ClientInfo:
    """Authenticate a Globus Auth user from request header.

    This follows from the [Globus Sample Data Portal](https://github.com/globus/globus-sample-data-portal/blob/30e30cd418ee9b103e04916e19deb9902d3aafd8/service/decorators.py)
    example.

    The underlying auth client is not thread safe, but this method is made
    thread safe using a lock.

    Args:
        headers: Request headers to extract tokens from.

    Returns:
        Globus Auth identity returned via \
        [token introspection](https://docs.globus.org/api/auth/reference/#token-introspect).

    Raises:
        UnauthorizedError: if the authorization header is missing or
            the header is malformed.
        ForbiddenError: if the tokens have expired or been revoked.
        ForbiddenError: if `audience` is not included in the token's
            audience.
    """
    token = get_token_from_headers(headers)
    loop = asyncio.get_running_loop()
    token_meta = await loop.run_in_executor(
        self.executor,
        self._token_introspect,
        token,
    )

    if not token_meta.get('active'):
        raise ForbiddenError('Token is expired or has been revoked.')

    if self.audience is not None and self.audience not in token_meta.get(
        'aud',
        [],
    ):
        raise ForbiddenError(
            f'Token audience does not include "{self.audience}". This '
            'could result in a confused deputy attack. Ensure the correct '
            'scopes are requested when the token is created.',
        )

    dependent_tokens = await loop.run_in_executor(
        self.executor,
        self._get_dependent_tokens,
        token,
    )

    groups_info = await loop.run_in_executor(
        self.executor,
        self._get_groups_and_memberships,
        dependent_tokens,
    )

    client_info = ClientInfo(
        client_id=token_meta.get('username'),
        group_memberships=groups_info,
    )
    return client_info

get_authenticator 

get_authenticator(
    config: ExchangeAuthConfig,
) -> Authenticator

Create an authenticator from a configuration.

Parameters:

Returns:

Raises:

  • ValueError –

    if the authentication method in the config is unknown.

Source code in academy/exchange/cloud/authenticate.py 
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
def get_authenticator(config: ExchangeAuthConfig) -> Authenticator:
    """Create an authenticator from a configuration.

    Args:
        config: Configuration.

    Returns:
        Authenticator.

    Raises:
        ValueError: if the authentication method in the config is unknown.
    """
    if config.method is None:
        return NullAuthenticator()
    elif config.method == 'globus':
        return GlobusAuthenticator(**config.kwargs)
    else:
        raise ValueError(f'Unknown authentication method "{config.method}."')

get_token_from_headers 

get_token_from_headers(headers: Mapping[str, str]) -> str

Extract token from websockets headers.

The header is expected to have the format Authorization: Bearer <TOKEN>.

Parameters:

  • headers (Mapping[str, str]) –

    Request headers to extract tokens from.

Returns:

  • str –

    String token.

Raises:

Source code in academy/exchange/cloud/authenticate.py 
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
def get_token_from_headers(headers: Mapping[str, str]) -> str:
    """Extract token from websockets headers.

    The header is expected to have the format `Authorization: Bearer <TOKEN>`.

    Args:
         headers: Request headers to extract tokens from.

    Returns:
        String token.

    Raises:
        UnauthorizedError: if the authorization header is missing.
        UnauthorizedError: if the authorization header is malformed.
    """
    if 'Authorization' not in headers:
        raise UnauthorizedError(
            'Request headers are missing authorization header.',
        )

    auth_header_parts = headers['Authorization'].split(' ')

    if len(auth_header_parts) != 2 or auth_header_parts[0] != 'Bearer':  # noqa: PLR2004
        raise UnauthorizedError(
            'Bearer token in authorization header is malformed.',
        )

    return auth_header_parts[1]