From 5a8c9d7b694d8af53930b706e4f73881205a400a Mon Sep 17 00:00:00 2001 From: jccaldw1 Date: Tue, 30 Apr 2024 21:33:23 -0700 Subject: [PATCH 1/3] refresh token if expired --- okta/oauth.py | 8 ++++++-- tester.py | 48 ++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 54 insertions(+), 2 deletions(-) create mode 100644 tester.py diff --git a/okta/oauth.py b/okta/oauth.py index 0ff189236..43211c537 100644 --- a/okta/oauth.py +++ b/okta/oauth.py @@ -1,6 +1,8 @@ from urllib.parse import urlencode, quote from okta.jwt import JWT +from jose.jwt import get_unverified_claims from okta.http_client import HTTPClient +import time class OAuth: @@ -37,9 +39,11 @@ async def get_access_token(self): str, Exception: Tuple of the access token, error that was raised (if any) """ - # Return token if already generated + # Return token if already generated and token is not expired. if self._access_token: - return (self._access_token, None) + claims = get_unverified_claims(self._access_token) + if time.time() <= claims['exp']: + return (self._access_token, None) # Otherwise create new one # Get JWT and create parameters for new Oauth token diff --git a/tester.py b/tester.py new file mode 100644 index 000000000..c049bfc5a --- /dev/null +++ b/tester.py @@ -0,0 +1,48 @@ +from okta.client import Client +import asyncio + +pem_key='''-----BEGIN PRIVATE KEY----- +MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDUqh8xBac0HlQe +euxSwmLPoEzjO/gjSpa+dzg2kXQvbAqA4LGiA4iVAT0UcPGtiyWyKYMXpzezj7/U +NPezjmoDzfPUDWZoCASzRdBM+4NOiqsUgNjwVsip9LVg9ALFEV+C3oCEhY2Gh3e9 +OzbmNycobZjRrAexrg/XdTkA6AqtobXpHBsF+7/7I7mEHPvVajLuX3C5/bHYUaMb +dyfYFGESr/ZaVTOcaZ8pbkr3zXtHa5sERihFm8v9TiI68PyIadQcN5pf0e1axvC5 +JhKqsJvbuO0Ja/TVOiEnJr/nHDu0h5fjp/cP1kyQ+OD7uktQ3r0v9LeEcohnty5E +alK9HO15AgMBAAECggEAHrpkHmO4OK4nLm5Jhl3DBEgfw/euz36gEG5Oh4f110JP +tDaDRCspiYovxqvZJ9/Ctx8La5gEUuQy7hknL2ElDV6tXBcBlIeQEk1En1L6MpeT +x7ckYXnQrcoHiTZIzivH9rNqs3tOq0EYupV7RcFzXYKUgbtPM0u4y0OLVIeyv0qq +dZ/FsLYedlqCfKsNfCPpZK2jgtXtgOOqr82Xxwg7UMJfSDH2XDxt6z3pv3Ty0ijA +v7RYlpRr6kyiDQ3fHsPgNUNOb5lwI4GsGkxZG9Uiy5+SkwHQLqhWIxogpmlbCFjw +vmv5XP8yXXHjZgWHPsA4efQSqTmT+3yBLcXSpYgI5wKBgQDwtvwt3gbfI1X/4cW1 +utHzU2KTNJClfGz9EdGCx26F+2sYQMYqwAKPWqU8j2NuTGjC2IjIMp50Wtw9NzTh +dZEoURLyZB8BqH9k0/pgb7en00jvLgtyzH6c3RJ40xiJVdBO2VlJSL4Q4pnoRNZ2 +YPx6EKKwGq/+TkSZAxGxGhI5EwKBgQDiKyg7HAomRHfa/U9O4oBqvGolUxqA+cuL +mV3ad7cigHscSkSG5wFzHPWOBrGoHPbKJ6DD5lsfvEZVRNXMCRnFImHNVVxyC07e +qTy+Z4SmGZgeVhoC4TVB09oGlk4w3vCRd/BBGeYPu7gRHXyRTbTyYU86UuxQrVac +md6Z8xk8wwKBgQCmmC3t3KTq17zUTEAWJwbZHZOyh4W4UmXnu+ZBWZ8fcULMVUAR +JDRhXH3RbPeGxbEXcN8xlv7dTmjwoP2jMEfXHE09npdrAV+xu5ekGI2FxA/NIRPh +TrAuBj6bipWHrvFtMLW/p22LqBiWjNXUtgjmvg6qTL4TBb4qG9qptH56KwKBgQC/ +RoSVyRcEWi+Lc2QZcRHuMz8KJghqP9hXTfPECi9F7Kcxu9XMyZ2+PyWlYh/p7+T/ +/xfF1hIG+vH4t2ihUKkMwhE42RKAGPQw96w5086ps0elkGgbO2ARNhxUKdYjGskW +HfuA82hQsg/v2aI6OR/pRUb+KpdVe+OeObu7M4+KhQKBgQC1smUHvYFQimyhOcA2 +B5b9M0q+cUknMwM9GbgNT1sV6tkYlj6Va86DzFEVqmkBU42y4jm/3ChPXlmuC4Nv +l4s4uWqf8JX7GExXfrd0ERy713NlLEBW5c66RaTI4k9YoPoWI4rc91FGhBIVkJV4 +2l2MlYySZbX2T2crKlN4+ESg1Q== +-----END PRIVATE KEY-----''' + +okta_client = Client({ + 'orgUrl': 'https://trial-5149309.okta.com', + 'authorizationMode': 'PrivateKey', + 'clientId': '0oadsp75t8VEatJK1697', + 'scopes': ['okta.users.manage'], + 'privateKey': pem_key, # this parameter should be type of str + 'kid': 'bu5MAM6TzARaIcvJ9Q2NInbb7nkqIeVgh_VOuVHQnB4' # if a key ID needs to be provided, it can be provided here or part of the privateKey under "kid"}) +}) + +user, res, err = asyncio.run(okta_client.get_user('00udsp6xx9iFA0mRr697')) + +print(user) +print(res) +print(err) + +asyncio.run(okta_client._request_executor._oauth.get_access_token()) \ No newline at end of file From 8332e3128eaeb78fa663565d161aae50a0820b7f Mon Sep 17 00:00:00 2001 From: jccaldw1 Date: Thu, 2 May 2024 14:07:17 -0700 Subject: [PATCH 2/3] outsource expiry check to utils --- okta/oauth.py | 8 +++----- okta/utils.py | 6 ++++++ output.txt | 0 tester.py | 13 +++++++++++++ 4 files changed, 22 insertions(+), 5 deletions(-) create mode 100644 output.txt diff --git a/okta/oauth.py b/okta/oauth.py index 43211c537..c6298140c 100644 --- a/okta/oauth.py +++ b/okta/oauth.py @@ -1,8 +1,8 @@ from urllib.parse import urlencode, quote from okta.jwt import JWT -from jose.jwt import get_unverified_claims from okta.http_client import HTTPClient import time +from okta.utils import is_jwt_token_expired class OAuth: @@ -40,10 +40,8 @@ async def get_access_token(self): (if any) """ # Return token if already generated and token is not expired. - if self._access_token: - claims = get_unverified_claims(self._access_token) - if time.time() <= claims['exp']: - return (self._access_token, None) + if self._access_token and not is_jwt_token_expired(self._access_token): + return (self._access_token, None) # Otherwise create new one # Get JWT and create parameters for new Oauth token diff --git a/okta/utils.py b/okta/utils.py index a4be0a74c..bbc0d9efc 100644 --- a/okta/utils.py +++ b/okta/utils.py @@ -5,6 +5,8 @@ from enum import Enum from datetime import datetime as dt from urllib.parse import urlsplit, urlunsplit +from jose.jwt import get_unverified_claims +import time from okta.constants import DATETIME_FORMAT, EPOCH_DAY, EPOCH_MONTH,\ EPOCH_YEAR @@ -74,3 +76,7 @@ def convert_absolute_url_into_relative_url(absolute_url): """ url_parts = urlsplit(absolute_url) return urlunsplit(('', '', url_parts[2], url_parts[3], url_parts[4])) + +def is_jwt_token_expired(jwt_token): + claims = get_unverified_claims(jwt_token) + return time.time() > claims['exp'] \ No newline at end of file diff --git a/output.txt b/output.txt new file mode 100644 index 000000000..e69de29bb diff --git a/tester.py b/tester.py index c049bfc5a..93d88c400 100644 --- a/tester.py +++ b/tester.py @@ -1,5 +1,6 @@ from okta.client import Client import asyncio +import time pem_key='''-----BEGIN PRIVATE KEY----- MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDUqh8xBac0HlQe @@ -45,4 +46,16 @@ print(res) print(err) +asyncio.run(okta_client._request_executor._oauth.get_access_token()) +time.sleep(600) +asyncio.run(okta_client._request_executor._oauth.get_access_token()) +time.sleep(600) +asyncio.run(okta_client._request_executor._oauth.get_access_token()) +time.sleep(600) +asyncio.run(okta_client._request_executor._oauth.get_access_token()) +time.sleep(600) +asyncio.run(okta_client._request_executor._oauth.get_access_token()) +time.sleep(600) +asyncio.run(okta_client._request_executor._oauth.get_access_token()) +time.sleep(630) asyncio.run(okta_client._request_executor._oauth.get_access_token()) \ No newline at end of file From e59377b3f8114ab81465d4f9a3234c6f32bfaf12 Mon Sep 17 00:00:00 2001 From: jccaldw1 Date: Thu, 2 May 2024 21:38:01 -0700 Subject: [PATCH 3/3] remove test files --- okta/oauth.py | 1 - output.txt | 0 tester.py | 61 --------------------------------------------------- 3 files changed, 62 deletions(-) delete mode 100644 output.txt delete mode 100644 tester.py diff --git a/okta/oauth.py b/okta/oauth.py index c6298140c..f48827cff 100644 --- a/okta/oauth.py +++ b/okta/oauth.py @@ -1,7 +1,6 @@ from urllib.parse import urlencode, quote from okta.jwt import JWT from okta.http_client import HTTPClient -import time from okta.utils import is_jwt_token_expired diff --git a/output.txt b/output.txt deleted file mode 100644 index e69de29bb..000000000 diff --git a/tester.py b/tester.py deleted file mode 100644 index 93d88c400..000000000 --- a/tester.py +++ /dev/null @@ -1,61 +0,0 @@ -from okta.client import Client -import asyncio -import time - -pem_key='''-----BEGIN PRIVATE KEY----- -MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDUqh8xBac0HlQe -euxSwmLPoEzjO/gjSpa+dzg2kXQvbAqA4LGiA4iVAT0UcPGtiyWyKYMXpzezj7/U -NPezjmoDzfPUDWZoCASzRdBM+4NOiqsUgNjwVsip9LVg9ALFEV+C3oCEhY2Gh3e9 -OzbmNycobZjRrAexrg/XdTkA6AqtobXpHBsF+7/7I7mEHPvVajLuX3C5/bHYUaMb -dyfYFGESr/ZaVTOcaZ8pbkr3zXtHa5sERihFm8v9TiI68PyIadQcN5pf0e1axvC5 -JhKqsJvbuO0Ja/TVOiEnJr/nHDu0h5fjp/cP1kyQ+OD7uktQ3r0v9LeEcohnty5E -alK9HO15AgMBAAECggEAHrpkHmO4OK4nLm5Jhl3DBEgfw/euz36gEG5Oh4f110JP -tDaDRCspiYovxqvZJ9/Ctx8La5gEUuQy7hknL2ElDV6tXBcBlIeQEk1En1L6MpeT -x7ckYXnQrcoHiTZIzivH9rNqs3tOq0EYupV7RcFzXYKUgbtPM0u4y0OLVIeyv0qq -dZ/FsLYedlqCfKsNfCPpZK2jgtXtgOOqr82Xxwg7UMJfSDH2XDxt6z3pv3Ty0ijA -v7RYlpRr6kyiDQ3fHsPgNUNOb5lwI4GsGkxZG9Uiy5+SkwHQLqhWIxogpmlbCFjw -vmv5XP8yXXHjZgWHPsA4efQSqTmT+3yBLcXSpYgI5wKBgQDwtvwt3gbfI1X/4cW1 -utHzU2KTNJClfGz9EdGCx26F+2sYQMYqwAKPWqU8j2NuTGjC2IjIMp50Wtw9NzTh -dZEoURLyZB8BqH9k0/pgb7en00jvLgtyzH6c3RJ40xiJVdBO2VlJSL4Q4pnoRNZ2 -YPx6EKKwGq/+TkSZAxGxGhI5EwKBgQDiKyg7HAomRHfa/U9O4oBqvGolUxqA+cuL -mV3ad7cigHscSkSG5wFzHPWOBrGoHPbKJ6DD5lsfvEZVRNXMCRnFImHNVVxyC07e -qTy+Z4SmGZgeVhoC4TVB09oGlk4w3vCRd/BBGeYPu7gRHXyRTbTyYU86UuxQrVac -md6Z8xk8wwKBgQCmmC3t3KTq17zUTEAWJwbZHZOyh4W4UmXnu+ZBWZ8fcULMVUAR -JDRhXH3RbPeGxbEXcN8xlv7dTmjwoP2jMEfXHE09npdrAV+xu5ekGI2FxA/NIRPh -TrAuBj6bipWHrvFtMLW/p22LqBiWjNXUtgjmvg6qTL4TBb4qG9qptH56KwKBgQC/ -RoSVyRcEWi+Lc2QZcRHuMz8KJghqP9hXTfPECi9F7Kcxu9XMyZ2+PyWlYh/p7+T/ -/xfF1hIG+vH4t2ihUKkMwhE42RKAGPQw96w5086ps0elkGgbO2ARNhxUKdYjGskW -HfuA82hQsg/v2aI6OR/pRUb+KpdVe+OeObu7M4+KhQKBgQC1smUHvYFQimyhOcA2 -B5b9M0q+cUknMwM9GbgNT1sV6tkYlj6Va86DzFEVqmkBU42y4jm/3ChPXlmuC4Nv -l4s4uWqf8JX7GExXfrd0ERy713NlLEBW5c66RaTI4k9YoPoWI4rc91FGhBIVkJV4 -2l2MlYySZbX2T2crKlN4+ESg1Q== ------END PRIVATE KEY-----''' - -okta_client = Client({ - 'orgUrl': 'https://trial-5149309.okta.com', - 'authorizationMode': 'PrivateKey', - 'clientId': '0oadsp75t8VEatJK1697', - 'scopes': ['okta.users.manage'], - 'privateKey': pem_key, # this parameter should be type of str - 'kid': 'bu5MAM6TzARaIcvJ9Q2NInbb7nkqIeVgh_VOuVHQnB4' # if a key ID needs to be provided, it can be provided here or part of the privateKey under "kid"}) -}) - -user, res, err = asyncio.run(okta_client.get_user('00udsp6xx9iFA0mRr697')) - -print(user) -print(res) -print(err) - -asyncio.run(okta_client._request_executor._oauth.get_access_token()) -time.sleep(600) -asyncio.run(okta_client._request_executor._oauth.get_access_token()) -time.sleep(600) -asyncio.run(okta_client._request_executor._oauth.get_access_token()) -time.sleep(600) -asyncio.run(okta_client._request_executor._oauth.get_access_token()) -time.sleep(600) -asyncio.run(okta_client._request_executor._oauth.get_access_token()) -time.sleep(600) -asyncio.run(okta_client._request_executor._oauth.get_access_token()) -time.sleep(630) -asyncio.run(okta_client._request_executor._oauth.get_access_token()) \ No newline at end of file