()
return abort(
        HTTP_STATUS_CODE_BAD_REQUEST, 'User is not authenticated.')
Handler for the Google OpenID Connect callback.

    Reference:
    https://developers.google.com/identity/protocols/OpenIDConnect

    Returns:
        Redirect response.
Handler for the Google OpenID Connect callback.
Handler for the Google OpenID Connect callback .
def google_openid_connect():
    """Handler for the Google OpenID Connect callback.

    Reference:
    https://developers.google.com/identity/protocols/OpenIDConnect

    Returns:
        Redirect response.
    """
    error = request.args.get('error', None)

    if error:
        current_app.logger.error('OAuth2 flow error: {}'.format(error))
        return abort(
            HTTP_STATUS_CODE_BAD_REQUEST,
            'OAuth2 flow error: {0!s}'.format(error))

    try:
        code = request.args['code']
        client_csrf_token = request.args.get('state')
        server_csrf_token = session[CSRF_KEY]
    except KeyError as e:
        return abort(
            HTTP_STATUS_CODE_BAD_REQUEST,
            'Client CSRF error, no CSRF key stored')

    if client_csrf_token != server_csrf_token:
        return abort(HTTP_STATUS_CODE_BAD_REQUEST, 'Invalid CSRF token')

    try:
        encoded_jwt = get_encoded_jwt_over_https(code)
    except JwtFetchError as e:
        return abort(
            HTTP_STATUS_CODE_BAD_REQUEST,
            'Jwt Fetch error, {0!s}'.format(e))

    try:
        discovery_document = get_oauth2_discovery_document()
    except DiscoveryDocumentError as e:
        return abort(
            HTTP_STATUS_CODE_BAD_REQUEST,
            'Unable to discover document, with error: {0!s}'.format(e))

    algorithm = discovery_document['id_token_signing_alg_values_supported'][0]
    expected_audience = current_app.config.get('GOOGLE_OIDC_CLIENT_ID')
    expected_domain = current_app.config.get('GOOGLE_OIDC_HOSTED_DOMAIN')
    expected_issuer = discovery_document['issuer']

    # Fetch the public key and try to validate the JWT.
    try:
        public_key = get_public_key_for_jwt(
            encoded_jwt, discovery_document['jwks_uri'])
        decoded_jwt = decode_jwt(
            encoded_jwt, public_key, algorithm, expected_audience)
        validate_jwt(
            decoded_jwt, expected_issuer, expected_domain)
    except (JwtValidationError, JwtKeyError) as e:
        current_app.logger.error('{}'.format(e))
        return abort(
            HTTP_STATUS_CODE_UNAUTHORIZED,
            'Unable to validate request, with error: {0!s}'.format(e))

    validated_email = decoded_jwt.get('email')
    allowed_users = current_app.config.get('GOOGLE_OIDC_ALLOWED_USERS')

    # Check if the authenticating user is allowed.
    if allowed_users:
        if validated_email not in allowed_users:
            return abort(
                HTTP_STATUS_CODE_UNAUTHORIZED,
                'Unauthorized request, user not allowed')

    user = User.get_or_create(username=validated_email, name=validated_email)
    login_user(user)

    # Log the user in and setup the session.
    if current_user.is_authenticated:
        return redirect(request.args.get('next') or '/')

    return abort(
        HTTP_STATUS_CODE_BAD_REQUEST, 'User is not authenticated.')
def google_openid_connect ( ) : error = request . args . get ( 'error' , None ) if error : current_app . logger . error ( 'OAuth2 flow error: {}' . format ( error ) ) return abort ( HTTP_STATUS_CODE_BAD_REQUEST , 'OAuth2 flow error: {0!s}' . format ( error ) ) try : code = request . args [ 'code' ] client_csrf_token = request . args . get ( 'state' ) server_csrf_token = session [ CSRF_KEY ] except KeyError as e : return abort ( HTTP_STATUS_CODE_BAD_REQUEST , 'Client CSRF error, no CSRF key stored' ) if client_csrf_token != server_csrf_token : return abort ( HTTP_STATUS_CODE_BAD_REQUEST , 'Invalid CSRF token' ) try : encoded_jwt = get_encoded_jwt_over_https ( code ) except JwtFetchError as e : return abort ( HTTP_STATUS_CODE_BAD_REQUEST , 'Jwt Fetch error, {0!s}' . format ( e ) ) try : discovery_document = get_oauth2_discovery_document ( ) except DiscoveryDocumentError as e : return abort ( HTTP_STATUS_CODE_BAD_REQUEST , 'Unable to discover document, with error: {0!s}' . format ( e ) ) algorithm = discovery_document [ 'id_token_signing_alg_values_supported' ] [ 0 ] expected_audience = current_app . config . get ( 'GOOGLE_OIDC_CLIENT_ID' ) expected_domain = current_app . config . get ( 'GOOGLE_OIDC_HOSTED_DOMAIN' ) expected_issuer = discovery_document [ 'issuer' ] # Fetch the public key and try to validate the JWT. try : public_key = get_public_key_for_jwt ( encoded_jwt , discovery_document [ 'jwks_uri' ] ) decoded_jwt = decode_jwt ( encoded_jwt , public_key , algorithm , expected_audience ) validate_jwt ( decoded_jwt , expected_issuer , expected_domain ) except ( JwtValidationError , JwtKeyError ) as e : current_app . logger . error ( '{}' . format ( e ) ) return abort ( HTTP_STATUS_CODE_UNAUTHORIZED , 'Unable to validate request, with error: {0!s}' . format ( e ) ) validated_email = decoded_jwt . get ( 'email' ) allowed_users = current_app . config . get ( 'GOOGLE_OIDC_ALLOWED_USERS' ) # Check if the authenticating user is allowed. if allowed_users : if validated_email not in allowed_users : return abort ( HTTP_STATUS_CODE_UNAUTHORIZED , 'Unauthorized request, user not allowed' ) user = User . get_or_create ( username = validated_email , name = validated_email ) login_user ( user ) # Log the user in and setup the session. if current_user . is_authenticated : return redirect ( request . args . get ( 'next' ) or '/' ) return abort ( HTTP_STATUS_CODE_BAD_REQUEST , 'User is not authenticated.' )