Groups are not standardised in OIDC, so this is provider-specific.
(provider, oauth_token, id_token)
| 48 | |
| 49 | |
| 50 | def _get_groups(provider, oauth_token, id_token): |
| 51 | """Groups are not standardised in OIDC, so this is provider-specific.""" |
| 52 | try: |
| 53 | access_token = _parse_access_token(provider, oauth_token) |
| 54 | except DecodeError: |
| 55 | # Failed to parse the access_token as JWT. Most probably, the required |
| 56 | # information about groups is in the id_token. |
| 57 | access_token = {} |
| 58 | |
| 59 | groups = [] |
| 60 | |
| 61 | # Amazon Cognito |
| 62 | groups.extend(access_token.get("cognito:groups", [])) |
| 63 | |
| 64 | # Okta |
| 65 | groups.extend(id_token.get("groups", [])) |
| 66 | |
| 67 | # ADFS |
| 68 | groups.append(id_token.get("group")) |
| 69 | |
| 70 | # RedHat KeyCloak |
| 71 | clients = access_token.get("resource_access", {}) |
| 72 | client = clients.get(provider.client_id, {}) |
| 73 | groups.extend(client.get("roles", [])) |
| 74 | |
| 75 | # Auth0 |
| 76 | groups.extend(access_token.get("permissions", [])) |
| 77 | |
| 78 | # Please feel free to provider PRs for further providers. |
| 79 | |
| 80 | return set([g for g in groups if g is not None]) |
| 81 | |
| 82 | |
| 83 | def handle_oauth(provider, oauth_token): |
no test coverage detected