What is Authlib<\/h2>\n
Open Authorization (OAuth)<\/a> is an open standard predicated on using a token system for securing applications. The general flow of things is that a user logs in via their username and password, and the application will provide a special token that will expire after X amount of time. That token will then be checked everytime that user wishes to access the application. Once the token expires, the user will then be required to log in again and be to be issued a brand new token.<\/p>\n Normally, this sort of implementation is done via SQL-based databases, meaning unders some circumstances, the developer may be forced into juggling multiple different databases for just one application.<\/p>\n Generally, when an application needs to be secure in some way — there is no better option than OAuth. This is mostly because it is an open-standard with a vast track record of flexibility and effectiveness. It works via HTTP which means it can used in a wide variety of applications and is understood by a large majority of developers. Strictly speaking, there are very cases in which OAuth (and by extension Authlib) is not the best option for a new application.<\/p>\n As already alluded to, the main reason as to why a developer or organization would want to use GridDB to handle their users\/authentication for their application, is simply reducing the amount of databases in use. If your application is already using GridDB because of the numerous<\/a> benefits<\/a>, then adding in functionality for authentication will be of a great benefit.<\/p>\n To implement Authlib with GridDB, we can follow along with the Sample OAuth Server<\/a> and make a few key changes to get it working; the purpose of most of the changes made will be altering from using a SQL-based database to the specific code GridDB requires.<\/p>\n First, the obvious ( The First we need to import the GridDB credentials.<\/p>\n And then it’s making sure the OAuth functionality works. First it needs to check for the user and its password in the DB to ensure the credentials match. To do this with GridDB, we simply run a query to check for the saved user:<\/p>\n Next, our application needs to be able to save the OAuth-issued tokens into GridDB.<\/p>\n To start the saving process, we create the schema for a The server also needs to be able to check the validity of the token passed to it. To do so, we once again make a query to our GridDB server with our BearerTokenValidator class<\/p>\n If the passed token exists in the GridDB And so, everytime a user logs in these functions will run to make sure first the password matches, and then once the token is issued, if the user tries to access content that is secured, it will also make sure the token is valid.<\/p>\n The First, let’s take a look at the So, once you’ve got your API server running, try this Here I am creating a new user Whether the command was successful or not will be apparent via the server logs. Once you’ve got your user signed up and registered, we can try to log in. To do, we use the If all is successful, you should get back a token string. This is your OAuth-issued token for accessing the And now to see if make sure that the entire system is working as expected, you can make the request again but with the token attached as an authentication header like so:<\/p>\n If successful, your API server should respond with the following message: Here is a diagram of the general flow of things:<\/p>\nWhen to use Authlib<\/h3>\n
Using GridDB with Authlib<\/h2>\n
How it’s Implemented<\/h3>\n
griddb.py<\/code>):<\/p>\nimport griddb_python\ngriddb = griddb_python\nfactory = griddb.StoreFactory.get_instance()\n\ngridstore = factory.get_store(\n host=\"239.0.0.1\",\n port=31999,\n cluster_name=\"defaultCluster\",\n username=\"admin\",\n password=\"admin\"\n)<\/code><\/pre>\n<\/div>\noauth.py<\/h4>\n
oauth.py<\/code> file is responsible for handling password and token and checking for veracity against the database.<\/p>\nfrom .griddb import griddb, gridstore <\/code><\/pre>\n<\/div>\n try:\n\n con = gridstore.get_container(\"USERS\")\n q = con.query(\"select * where username = '\"+username+\"'\")\n rs = q.fetch(False)\n if rs.has_next():\n u = rs.next()\n except:\n print(\"Exception finding user\")\n abort(401, \"UNAUTHORIZED\")\n if u:\n user = User(u)\n if user.check_password(password):\n return user\n print(\"pass doesnt match\")\n\n abort(401, \"UNAUTHORIZED\")<\/code><\/pre>\n<\/div>\ncollection container<\/code> called TOKENS<\/code>. This container needs to have 4 saved rows: token string, expires time, issued time, and the user id associated with the token. The nice thing is that with the GridDB Python container, we can set the container’s schema as a variable like so:<\/p>\ndef save_token(token, request):\n\n conInfo = griddb.ContainerInfo(\"TOKENS\",\n [[\"token\", griddb.Type.STRING],\n [\"expires_at\", griddb.Type.TIMESTAMP],\n [\"issued_at\", griddb.Type.TIMESTAMP],\n [\"userid\", griddb.Type.STRING]],\n griddb.ContainerType.COLLECTION, True)\n cn = gridstore.put_container(conInfo)\n\n cn.set_auto_commit(False)\n cn.create_index(\"token\")\n cn.put([token['access_token'], datetime.datetime.utcfromtimestamp(time.time()+token['expires_in']), datetime.datetime.utcnow(), request.user.username])\n cn.commit()<\/code><\/pre>\n<\/div>\nclass MyBearerTokenValidator(BearerTokenValidator):\n def authenticate_token(self, token_string):\n try:\n cn = griddb.get_container(\"TOKENS\")\n q = con.query(\"select * where token = '\"+token_string+\"'\")\n rs = q.fetch(False)\n if rs.has_next():\n return OAuth2Token(rs.next())\n else:\n return None\n except:\n return None\n return None<\/code><\/pre>\n<\/div>\nTOKENS<\/code> container, then the application accepts the token as valid, if not, it will return as invalid.<\/p>\nroutes.py<\/h4>\n
routes.py<\/code> file handles our server’s endpoints\/API calls. For our specific example, we will focus on three different endpoints: the home endpoint (“\/”), the endpoint used to sign up (“\/sign_up”), and the endpoint used to verify our token works (“\/private”).<\/p>\n\/sign_up<\/code> endpoint. To test this out on your own, you can clone the repo and run the API server: flask run --host=0.0.0.0<\/code>. Once it’s running, you can try signing up. This process will create the USERS<\/code> collection container on your GridDB server and save the credentials of the user you POST<\/code>.<\/p>\ncurl<\/code> command:<\/p>\ncurl --request POST \n--url 'http:\/\/52.250.124.168:5000\/sign_up' \n--header 'Content-Type: application\/x-www-form-urlencoded' \n--data 'grant_type=password' \n--data 'scope=all' \n--data 'username=israel' \n--data 'password=imru'<\/code><\/pre>\n<\/div>\nisrael<\/code> with password imru<\/code>.<\/p>\n\/<\/code> endpoint along with our credentials to test if the user is present in our database.<\/p>\ncurl --location --request POST 'http:\/\/52.250.124.168:5000\/' \n--form 'username=\"israel\"' \n--form 'password=\"imru\"' \n--form 'grant_type=\"password\"' \n--form 'scope=\"all\"'<\/code><\/pre>\n<\/div>\n\/private<\/code> endpoint. So first, we can try accessing the endpoint without our token. If the token is invalid, or not found in your DB, you will receive a 401 server error code:<\/p>\n{\n \"error\": \"invalid_token\",\n \"error_description\": \"The access token provided is expired, revoked, malformed, or invalid for other reasons.\"\n}<\/code><\/pre>\n<\/div>\ncurl --location --request GET 'http:\/\/52.250.124.168:5000\/private' \n--header 'Authorization: Bearer ZcoI1Rxgcw8rx8z0uFjCArdqacjM8lyE0K6fNWf2zz'<\/code><\/pre>\n<\/div>\nThis is a private page only viewable if you're logged in<\/code>. This is working as intended.<\/p>\n
![\"\"](\"https:\/\/griddb.net\/wp-content\/uploads\/2021\/11\/Authlib.png\")
<\/a><\/p>\n