No users in store. Run "
"local-identity init first.
Dev/test only. Tokens carry
iss: local-identity — production systems reject them.
Authenticating for {_he(client_id) or "(unknown client)"}
""" self._send_html(form) # ---------------------------------------------------------------- # # Endpoint: POST /auth — process login form # # ---------------------------------------------------------------- # def _handle_auth_post(self) -> None: body = self._read_form_body() username = body.get("username", [""])[0] client_id = body.get("client_id", [""])[0] redirect_uri = body.get("redirect_uri", [""])[0] state = body.get("state", [""])[0] nonce = body.get("nonce", [""])[0] if not redirect_uri: self._send_json( {"error": "invalid_request", "error_description": "missing redirect_uri"}, HTTPStatus.BAD_REQUEST, ) return try: store.read_user(username) except FileNotFoundError: self._send_error_redirect(redirect_uri, "access_denied", state) return # Expire stale codes on each write now = time.time() stale = [c for c, v in self._codes.items() if v["expires_at"] < now] for c in stale: del self._codes[c] code = secrets.token_urlsafe(32) self._codes[code] = { "username": username, "client_id": client_id, "redirect_uri": redirect_uri, "nonce": nonce or None, "expires_at": now + _CODE_TTL, } audit.log_event("serve/auth", username, "auth_request") sep = "&" if "?" in redirect_uri else "?" location = ( f"{redirect_uri}{sep}code={urllib.parse.quote(code)}" f"&state={urllib.parse.quote(state)}" ) self.send_response(HTTPStatus.FOUND) self.send_header("Location", location) self.end_headers() # ---------------------------------------------------------------- # # Endpoint: POST /token # # ---------------------------------------------------------------- # def _handle_token(self) -> None: body = self._read_form_body() grant_type = body.get("grant_type", [""])[0] if grant_type != "authorization_code": self._send_json( {"error": "unsupported_grant_type"}, HTTPStatus.BAD_REQUEST, ) return code = body.get("code", [""])[0] client_id = body.get("client_id", [""])[0] code_data = self._codes.pop(code, None) if code_data is None: self._send_json( {"error": "invalid_grant", "error_description": "unknown or expired code"}, HTTPStatus.BAD_REQUEST, ) return if time.time() > code_data["expires_at"]: self._send_json( {"error": "invalid_grant", "error_description": "code expired"}, HTTPStatus.BAD_REQUEST, ) return try: user = store.read_user(code_data["username"]) except FileNotFoundError: self._send_json( {"error": "invalid_grant", "error_description": "user not found"}, HTTPStatus.BAD_REQUEST, ) return token = create_token( private_key=self._private_key, kid=self._kid, sub=user.username, iss=_ISSUER, aud=code_data.get("client_id") or client_id or "local-identity", email=user.email, name=user.fullname, preferred_username=user.username, ttl=self._token_ttl, nonce=code_data.get("nonce"), ) audit.log_event("serve/token", user.username, "token_issued") self._send_json({ "access_token": token, "id_token": token, "token_type": "Bearer", "expires_in": self._token_ttl, }) # ---------------------------------------------------------------- # # Endpoint: GET /userinfo # # ---------------------------------------------------------------- # def _handle_userinfo(self) -> None: auth_header = self.headers.get("Authorization", "") if not auth_header.startswith("Bearer "): self.send_response(HTTPStatus.UNAUTHORIZED) self.send_header("WWW-Authenticate", 'Bearer realm="local-identity"') self.end_headers() return token = auth_header[len("Bearer "):] try: payload = verify_token(token, self._private_key.public_key()) except JWTError as exc: audit.log_event("serve/userinfo", None, f"invalid_token: {exc}") self._send_json( {"error": "invalid_token", "error_description": str(exc)}, HTTPStatus.UNAUTHORIZED, ) return jti = payload.get("jti", "") sub = payload.get("sub") if jti and revoke_mod.is_revoked(jti): audit.log_event("serve/userinfo", sub, "revoked_token") self._send_json( {"error": "invalid_token", "error_description": "token has been revoked"}, HTTPStatus.UNAUTHORIZED, ) return audit.log_event("serve/userinfo", sub, "ok") self._send_json({ "sub": sub, "email": payload.get("email"), "name": payload.get("name"), "preferred_username": payload.get("preferred_username"), }) # ---------------------------------------------------------------- # # Helpers # # ---------------------------------------------------------------- # def _base_url(self) -> str: host, port = self.server.server_address return f"{self._scheme}://{host}:{port}" def _read_form_body(self) -> dict: length = int(self.headers.get("Content-Length", 0)) raw = self.rfile.read(length).decode("utf-8") return urllib.parse.parse_qs(raw, keep_blank_values=True) def _send_json(self, data: dict, status: HTTPStatus = HTTPStatus.OK) -> None: body = json.dumps(data).encode("utf-8") self.send_response(status) self.send_header("Content-Type", "application/json") self.send_header("Content-Length", str(len(body))) self.end_headers() self.wfile.write(body) def _send_html(self, html: str, status: HTTPStatus = HTTPStatus.OK) -> None: body = html.encode("utf-8") self.send_response(status) self.send_header("Content-Type", "text/html; charset=utf-8") self.send_header("Content-Length", str(len(body))) self.end_headers() self.wfile.write(body) def _send_error_redirect( self, redirect_uri: str, error: str, state: str ) -> None: if not redirect_uri: self._send_json({"error": error}, HTTPStatus.BAD_REQUEST) return sep = "&" if "?" in redirect_uri else "?" location = ( f"{redirect_uri}{sep}error={urllib.parse.quote(error)}" f"&state={urllib.parse.quote(state)}" ) self.send_response(HTTPStatus.FOUND) self.send_header("Location", location) self.end_headers() # ------------------------------------------------------------------ # # Public entry point # # ------------------------------------------------------------------ # def run_server(port: int = 8443, token_ttl: int = 3600) -> None: """ Start the local-identity OIDC server on 127.0.0.1:{port} with TLS. Blocks until Ctrl+C. The server always binds to 127.0.0.1. External binding (0.0.0.0) is not supported and is not offered as an option. """ if not store.store_exists(): print( "Error: store not initialised. Run 'local-identity init' first.", file=sys.stderr, ) sys.exit(1) enforce_permissions() private_key = ensure_signing_key() cert_path, key_path = ensure_tls_cert() HandlerClass = make_handler(private_key, key_id(private_key), token_ttl, scheme="https") httpd = http.server.HTTPServer((_BIND_HOST, port), HandlerClass) ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER) ctx.load_cert_chain(str(cert_path), str(key_path)) httpd.socket = ctx.wrap_socket(httpd.socket, server_side=True) base_url = f"https://{_BIND_HOST}:{port}" print(f"local-identity OIDC server") print(f" URL: {base_url}") print(f" Discovery: {base_url}/.well-known/openid-configuration") print(f" Token TTL: {token_ttl}s") print(f" Bound to: {_BIND_HOST} (localhost only)") print("Press Ctrl+C to stop.") try: httpd.serve_forever() except KeyboardInterrupt: pass finally: httpd.server_close()