Salesforceの認証を外部アプリから使う – OpenID Connect編

1$ pip install flask authlib requests python-dotenv

1CLIENT_ID = '接続アプリケーションのコンシューマー鍵'
2CLIENT_SECRET = '接続アプリケーションのコンシューマーの秘密'
3OP_DOMAIN = 'デジタルエクスペリエンスサイトのURL(https://xxxx.develop.my.site.com/xx)'
4WELL_KNOWN_URL = ${OP_DOMAIN}/.well-known/openid-configuration

1import os
2import urllib.request, urllib.parse
3import flask 
4from flask import session, redirect, render_template, request
5import json
6from authlib.integrations.flask_client import OAuth
7from authlib.jose import jwt, JsonWebKey
8from dotenv import load_dotenv
9
10#Init
11load_dotenv()
12
13app = flask.Flask(__name__)
14app.secret_key = os.urandom(32).hex()
15
16#環境変数呼び出し
17OP_DOMAIN = os.environ['OP_DOMAIN']
18CLIENT_ID = os.environ['CLIENT_ID']
19CLIENT_SECRET = os.environ['CLIENT_SECRET']
20WELL_KNOWN_URL = os.environ['WELL_KNOWN_URL']
21
22#OPのメタデータ取得
23def get_op_metadata():
24    response = urllib.request.urlopen(WELL_KNOWN_URL)
25    return json.loads(response.read())
26
27#OAuthインスタンス
28oauth = OAuth(app)
29metadata = get_op_metadata()
30oauth.register(
31    name='salesforce',
32    client_id=CLIENT_ID,
33    client_secret=CLIENT_SECRET,
34    client_kwrgs={
35        'scope': 'openid profile'
36    },
37    server_metadata_url=WELL_KNOWN_URL,
38)
39
40@app.route('/login')
41def login():
42    callback_url=flask.url_for('auth_callback', _external=True)
43    return oauth.salesforce.authorize_redirect(callback_url)
44
45
46@app.route('/callback')
47def auth_callback():
48    resp = oauth.salesforce.authorize_access_token()
49    if resp is None:
50        return 'Nothing data', 403
51    
52    # OPのJWKSを取得
53    key = urllib.request.urlopen(metadata['jwks_uri'])
54    jwks = JsonWebKey.import_key_set(json.loads(key.read()))
55    #IDトークンをデコードして検証
56    try:
57        claims = jwt.decode(resp['id_token'], jwks)
58        claims.validate()
59    except Exception as e:
60        print(e)
61        return 'Something wrong', 403
62    #クレームに対するチェック
63    if claims['iss'] != OP_DOMAIN:
64        return 'Invalid Issuer', 403
65    if claims['aud'] != CLIENT_ID:
66        return 'Invalid Audience', 403
67    
68    #Userinfoエンドポイントコール
69    apiHeaders = {
70        'Authorization': 'Bearer ' + resp["access_token"],
71        'Accept': 'application/json'
72    }
73    userInfoReq = urllib.request.Request(metadata['userinfo_endpoint'], headers=apiHeaders)
74    userInfoResp = urllib.request.urlopen(userInfoReq)
75    userinfo = json.loads(userInfoResp.read())
76    flask.session['profile'] = {
77        'id': userinfo['preferred_username'],
78        'name': userinfo['family_name'] + ' ' + userinfo['given_name'],
79        'picture': userinfo['picture'],
80        'email': userinfo['email'],
81    }
82
83    return flask.redirect(flask.url_for('index'))
84
85
86@app.route('/logout')
87def logout():
88    del flask.session['profile']
89
90    params = {'returnTo': flask.url_for('index', _external=True), 'client_id': CLIENT_ID}
91    return flask.redirect(metadata['end_session_endpoint'] + '?' + urllib.parse.urlencode(params))
92
93
94@app.route('/')
95def index():
96    if 'profile' in flask.session:
97        loggined = True
98        return render_template("index.html", loggined=loggined, userinfo=flask.session['profile'])
99    else:
100        loggined = False
101        return render_template("index.html", loggined=loggined)
102    
103    
104if __name__ == '__main__':
105    app.run()

1{% block body %}
2  <h1 class="text-center">Customer Identity Demo</h1>
3  <div class="row">
4    <div class="col-sm-6 offset-sm-3">
5      <div class="jumbotron">
6        {% if loggined %}
7          <h2>あなたは、{{ userinfo['name'] }} さんですね。</h2><br>
8          <ul>
9            <li><img src={{ userinfo['picture'] }}></li>
10            <li>email: <a href="mailto:{{ userinfo['email'] }}">{{ userinfo['email'] }}</a></li>
11            <li>ユーザID: {{ userinfo['id'] }}</li>
12        </ul>
13          <a class="p-2 text-dark" href="/logout">Logout</a></br>
14        {% else %}
15          <a class="p-2 text-dark" href="/login">Log In / Register</a></br>
16        {% endif %}
17        Welcome to OpenID Connect RP Demo App! </br>
18      </div>
19    </div>
20  </div>
21{% endblock %}

1$ python app.py