()
return abort(
        HTTP_STATUS_CODE_BAD_REQUEST, 'User is not authenticated.')
Handler for logging in using an authenticated session for the API.

    Returns:
        A simple page indicating the user is authenticated.
Handler for logging in using an authenticated session for the API.
Handler for logging in using an authenticated session for the API .
def validate_api_token():
    """Handler for logging in using an authenticated session for the API.

    Returns:
        A simple page indicating the user is authenticated.
    """
    try:
        token = oauth2.rfc6749.tokens.get_token_from_header(request)
    except AttributeError:
        token = None

    if not token:
        return abort(
            HTTP_STATUS_CODE_UNAUTHORIZED, 'Request not authenticated.')

    id_token = request.args.get('id_token')
    if not id_token:
        return abort(
            HTTP_STATUS_CODE_UNAUTHORIZED, 'No ID token supplied.')

    client_id = current_app.config.get('GOOGLE_OIDC_API_CLIENT_ID')
    if not client_id:
        return abort(
            HTTP_STATUS_CODE_BAD_REQUEST,
            'No OIDC API client ID defined in the configuration file.')

    # Authenticating session, see more details here:
    # https://www.oauth.com/oauth2-servers/signing-in-with-google/\
    #     verifying-the-user-info/
    # Sending a request to Google to verify that the access token
    # is valid, to be able to validate the session.
    data = {
        'access_token': token}
    bearer_token_response = requests.post(TOKEN_URI, data=data)
    if bearer_token_response.status_code != HTTP_STATUS_CODE_OK:
        return abort(
            HTTP_STATUS_CODE_BAD_REQUEST, 'Unable to validate access token.')
    bearer_token_json = bearer_token_response.json()

    data = {
        'id_token': id_token
    }
    token_response = requests.post(TOKEN_URI, data=data)
    token_json = token_response.json()

    verified = token_json.get('email_verified', False)
    if not verified:
        return abort(
            HTTP_STATUS_CODE_UNAUTHORIZED,
            'Session not authenticated or account not verified')

    if bearer_token_json.get('azp', 'a') != token_json.get('azp', 'x'):
        return abort(
            HTTP_STATUS_CODE_UNAUTHORIZED,
            'Auth token and client tokens don\'t match, azp differs.')

    if bearer_token_json.get('email', 'a') != token_json.get('email', 'b'):
        return abort(
            HTTP_STATUS_CODE_UNAUTHORIZED,
            'Auth token and client tokens don\'t match, email differs.')

    try:
        discovery_document = get_oauth2_discovery_document()
    except DiscoveryDocumentError as e:
        return abort(
            HTTP_STATUS_CODE_BAD_REQUEST,
            'Unable to discover document, with error: {0!s}'.format(e))

    expected_issuer = discovery_document['issuer']
    try:
        validate_jwt(token_json, expected_issuer)
    except (ImportError, NameError, UnboundLocalError):
        raise
    except (JwtValidationError, JwtKeyError, Exception) as e:  # pylint: disable=broad-except
        return abort(
            HTTP_STATUS_CODE_UNAUTHORIZED,
            'Unable to validate the JWT token, with error: {0!s}.'.format(e))

    read_client_id = token_json.get('aud', '')
    if read_client_id != client_id:
        return abort(
            HTTP_STATUS_CODE_UNAUTHORIZED,
            'Client ID {0:s} does not match server configuration for '
            'client'.format(read_client_id))

    read_scopes = bearer_token_json.get('scope', '').split()
    if not set(read_scopes) == set(SCOPES):
        return abort(
            HTTP_STATUS_CODE_UNAUTHORIZED,
            'Client scopes differ from what they should be (email, openid, '
            'profile) = {} VS {}'.format(SCOPES, read_scopes))

    validated_email = token_json.get('email')

    # Check if the authenticating user is part of the allowed domains.
    hosted_domains = current_app.config.get('GOOGLE_OIDC_HOSTED_DOMAIN')
    if hosted_domains:
        _, _, domain = validated_email.partition('@')
        if domain.lower() != hosted_domains.lower():
            return abort(
                HTTP_STATUS_CODE_UNAUTHORIZED,
                'Domain {0:s} is not allowed to authenticate against this '
                'instance.'.format(domain))

    allowed_users = current_app.config.get('GOOGLE_OIDC_ALLOWED_USERS')
    # TODO: Remove that after a 6 months, this following check is to ensure
    # compatibility of config file
    if not allowed_users:
        current_app.logger.warning('Warning, GOOGLE_OIDC_USER_WHITELIST has '
                                   'been deprecated. Please update '
                                   'timesketch.conf.')
        allowed_users = current_app.config.get('GOOGLE_OIDC_USER_WHITELIST', [])

    # Check if the authenticating user is on the allow list.
    if allowed_users:
        if validated_email not in allowed_users:
            return abort(
                HTTP_STATUS_CODE_UNAUTHORIZED,
                'Unauthorized request, user not allowed')

    user = User.get_or_create(username=validated_email, name=validated_email)
    login_user(user)

    # Log the user in and setup the session.
    if current_user.is_authenticated:
        return """
<h1>Authenticated</h1>
        """

    return abort(
        HTTP_STATUS_CODE_BAD_REQUEST, 'User is not authenticated.')
def validate_api_token ( ) : try : token = oauth2 . rfc6749 . tokens . get_token_from_header ( request ) except AttributeError : token = None if not token : return abort ( HTTP_STATUS_CODE_UNAUTHORIZED , 'Request not authenticated.' ) id_token = request . args . get ( 'id_token' ) if not id_token : return abort ( HTTP_STATUS_CODE_UNAUTHORIZED , 'No ID token supplied.' ) client_id = current_app . config . get ( 'GOOGLE_OIDC_API_CLIENT_ID' ) if not client_id : return abort ( HTTP_STATUS_CODE_BAD_REQUEST , 'No OIDC API client ID defined in the configuration file.' ) # Authenticating session, see more details here: # https://www.oauth.com/oauth2-servers/signing-in-with-google/\ #     verifying-the-user-info/ # Sending a request to Google to verify that the access token # is valid, to be able to validate the session. data = { 'access_token' : token } bearer_token_response = requests . post ( TOKEN_URI , data = data ) if bearer_token_response . status_code != HTTP_STATUS_CODE_OK : return abort ( HTTP_STATUS_CODE_BAD_REQUEST , 'Unable to validate access token.' ) bearer_token_json = bearer_token_response . json ( ) data = { 'id_token' : id_token } token_response = requests . post ( TOKEN_URI , data = data ) token_json = token_response . json ( ) verified = token_json . get ( 'email_verified' , False ) if not verified : return abort ( HTTP_STATUS_CODE_UNAUTHORIZED , 'Session not authenticated or account not verified' ) if bearer_token_json . get ( 'azp' , 'a' ) != token_json . get ( 'azp' , 'x' ) : return abort ( HTTP_STATUS_CODE_UNAUTHORIZED , 'Auth token and client tokens don\'t match, azp differs.' ) if bearer_token_json . get ( 'email' , 'a' ) != token_json . get ( 'email' , 'b' ) : return abort ( HTTP_STATUS_CODE_UNAUTHORIZED , 'Auth token and client tokens don\'t match, email differs.' ) try : discovery_document = get_oauth2_discovery_document ( ) except DiscoveryDocumentError as e : return abort ( HTTP_STATUS_CODE_BAD_REQUEST , 'Unable to discover document, with error: {0!s}' . format ( e ) ) expected_issuer = discovery_document [ 'issuer' ] try : validate_jwt ( token_json , expected_issuer ) except ( ImportError , NameError , UnboundLocalError ) : raise except ( JwtValidationError , JwtKeyError , Exception ) as e : # pylint: disable=broad-except return abort ( HTTP_STATUS_CODE_UNAUTHORIZED , 'Unable to validate the JWT token, with error: {0!s}.' . format ( e ) ) read_client_id = token_json . get ( 'aud' , '' ) if read_client_id != client_id : return abort ( HTTP_STATUS_CODE_UNAUTHORIZED , 'Client ID {0:s} does not match server configuration for ' 'client' . format ( read_client_id ) ) read_scopes = bearer_token_json . get ( 'scope' , '' ) . split ( ) if not set ( read_scopes ) == set ( SCOPES ) : return abort ( HTTP_STATUS_CODE_UNAUTHORIZED , 'Client scopes differ from what they should be (email, openid, ' 'profile) = {} VS {}' . format ( SCOPES , read_scopes ) ) validated_email = token_json . get ( 'email' ) # Check if the authenticating user is part of the allowed domains. hosted_domains = current_app . config . get ( 'GOOGLE_OIDC_HOSTED_DOMAIN' ) if hosted_domains : _ , _ , domain = validated_email . partition ( '@' ) if domain . lower ( ) != hosted_domains . lower ( ) : return abort ( HTTP_STATUS_CODE_UNAUTHORIZED , 'Domain {0:s} is not allowed to authenticate against this ' 'instance.' . format ( domain ) ) allowed_users = current_app . config . get ( 'GOOGLE_OIDC_ALLOWED_USERS' ) # TODO: Remove that after a 6 months, this following check is to ensure # compatibility of config file if not allowed_users : current_app . logger . warning ( 'Warning, GOOGLE_OIDC_USER_WHITELIST has ' 'been deprecated. Please update ' 'timesketch.conf.' ) allowed_users = current_app . config . get ( 'GOOGLE_OIDC_USER_WHITELIST' , [ ] ) # Check if the authenticating user is on the allow list. if allowed_users : if validated_email not in allowed_users : return abort ( HTTP_STATUS_CODE_UNAUTHORIZED , 'Unauthorized request, user not allowed' ) user = User . get_or_create ( username = validated_email , name = validated_email ) login_user ( user ) # Log the user in and setup the session. if current_user . is_authenticated : return """
<h1>Authenticated</h1>
        """ return abort ( HTTP_STATUS_CODE_BAD_REQUEST , 'User is not authenticated.' )