{"id":13502156,"url":"https://github.com/pyeve/flask-sentinel","last_synced_at":"2025-04-06T11:10:23.047Z","repository":{"id":26222457,"uuid":"29669024","full_name":"pyeve/flask-sentinel","owner":"pyeve","description":"OAuth2 Server bundled as a Flask extension","archived":false,"fork":false,"pushed_at":"2022-12-26T20:00:13.000Z","size":491,"stargazers_count":159,"open_issues_count":12,"forks_count":41,"subscribers_count":8,"default_branch":"master","last_synced_at":"2025-03-30T10:08:55.073Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/pyeve.png","metadata":{"files":{"readme":"README.rst","changelog":"CHANGES","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2015-01-22T08:33:38.000Z","updated_at":"2025-02-24T19:22:54.000Z","dependencies_parsed_at":"2023-01-14T04:13:54.843Z","dependency_job_id":null,"html_url":"https://github.com/pyeve/flask-sentinel","commit_stats":null,"previous_names":[],"tags_count":5,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pyeve%2Fflask-sentinel","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pyeve%2Fflask-sentinel/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pyeve%2Fflask-sentinel/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pyeve%2Fflask-sentinel/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/pyeve","download_url":"https://codeload.github.com/pyeve/flask-sentinel/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247471521,"owners_count":20944158,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-07-31T22:02:03.934Z","updated_at":"2025-04-06T11:10:23.025Z","avatar_url":"https://github.com/pyeve.png","language":"Python","funding_links":[],"categories":["Python"],"sub_categories":[],"readme":"Flask-Sentinel\n==============\nOAuth2 Provider currently supporting the Resource Owner Password Credentials\nGrant as described in Section 1.3.3 of `RFC 6749`_.\n\nPowered by Flask-OAuthlib, Redis and MongoDB.\n\nDeployment\n----------\n\n.. code-block:: console\n\n    $ pip install flask-sentinel\n\nUsage\n-----\nOnce the extension and its dependencies are installed, you can use it like any\nother Flask extension:\n\n.. code-block:: python\n\n    from flask import Flask\n    from flask.ext.sentinel import ResourceOwnerPasswordCredentials, oauth\n\n\n    app = Flask(__name__)\n\n    # optionally load settings from py module\n    app.config.from_object('settings')\n\n    @app.route('/endpoint')\n    @oauth.require_oauth()\n    def restricted_access():\n        return \"You made it through and accessed the protected resource!\"\n\n    if __name__ == '__main__':\n        ResourceOwnerPasswordCredentials(app)\n        app.run(ssl_context='adhoc')\n\nUser and Client Management\n--------------------------\nYou can create users and clients through the default management interface\navailable at ``https://localhost:5000/oauth/management``.\n\n.. image:: https://raw.githubusercontent.com/pyeve/flask-sentinel/master/static/console.png\n   :scale: 25 %\n\nYou can override the default page above with your own. Just drop your custom\n``management.html`` file in a ``templates`` folder residing in your application\nroot.\n\nThis page can and should have restricted access. In order to achieve that, set\n``SENTINEL_MANAGEMENT_USERNAME`` and ``SENTINEL_MANAGEMENT_PASSWORD`` in your\napplication settings. This will fire up a Basic Auth dialog when the page is\naccessed with a browser.\n\nTesting\n-------\nAfter creating a user and client, you may use ``curl`` to test the application.\n\nGenerating a Bearer Token\n~~~~~~~~~~~~~~~~~~~~~~~~~\n\n.. code-block:: console\n\n    $ curl -k -X POST -d \"client_id=9qFbZD4udTzFVYo0u5UzkZX9iuzbdcJDRAquTfRk\u0026grant_type=password\u0026username=jonas\u0026password=pass\" https://localhost:5000/oauth/token\n    {\"access_token\": \"NYODXSR8KalTPnWUib47t5E8Pi8mo4\", \"token_type\": \"Bearer\", \"refresh_token\": \"s6L6OPL2bnKSRSbgQM3g0wbFkJB4ML\", \"scope\": \"\"}\n\nGenerating a Bearer Token Using a Retrieved Refresh Token\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\n.. code-block:: console\n\n    $ curl -X POST -d \"client_id=9qFbZD4udTzFVYo0u5UzkZX9iuzbdcJDRAquTfRk\u0026grant_type=refresh_token\u0026refresh_token=s6L6OPL2bnKSRSbgQM3g0wbFkJB4ML\" https://localhost:5000/oauth/token\n    {\"access_token\": \"RmPAfqfsDoMCbQ2DUUehwcw1hMCMJj\", \"token_type\": \"Bearer\", \"expires_in\": 3600, \"refresh_token\": \"s6L6OPL2bnKSRSbgQM3g0wbFkJB4ML\", \"scope\": \"\"}\n\nAccessing a Protected Resource Using Retrieved Bearer Token\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\n.. code-block:: console\n\n    $ curl -k -H \"Authorization: Bearer NYODXSR8KalTPnWUib47t5E8Pi8mo4\" https://localhost:5000/endpoint\n    You made it through and accessed the protected resource!\n\n\nConfiguration\n-------------\nConfiguration works like any other `Flask configuration`_. Here are\nthe built-in defaults:\n\n======================================= ======================================\n``SENTINEL_ROUTE_PREFIX``               Default prefix for OAuth endpoints.\n                                        Defaults to ``/oauth``. Prepends both\n                                        token and management urls.\n\n``SENTINEL_TOKEN_URL``                  Url for token creation endpoint. Set to\n                                        ``False`` to disable this feature.\n                                        Defaults to ``/token``, so the\n                                        complete url is ``/oauth/token``.\n\n``SENTINEL_MANAGEMENT_URL``             Url for management endpoint. Set to\n                                        ``False`` to disable this feature.\n                                        Defaults to ``/management``, so the\n                                        complete url is ``/oauth/management``.\n\n``SENTINEL_REDIS_URL``                  Url for the redis server. Defaults to\n                                        ``redis://localhost:6379/0``.\n\n``SENTINEL_MONGO_DBNAME``               Mongo database name. Defaults to\n                                        ``oauth``.\n\n``SENTINEL_MANAGEMENT_USERNAME``        Username needed to access the\n                                        management page.\n\n``SENTINEL_MANAGEMENT_PASSWORD``        Password needed to access the\n                                        management page.\n\n``OAUTH2_PROVIDER_ERROR_URI``           The error page when there is an error,\n                                        default value is ``/oauth/errors``.\n\n``OAUTH2_PROVIDER_TOKEN_EXPIRES_IN``    Default Bearer token expires time,\n                                        default is ``3600``.\n\n``OAUTH2_PROVIDER_ERROR_ENDPOINT``      You can also configure the error page\n                                        uri with an endpoint name.\n\n======================================= ======================================\n\nOther standard PyMongo settings such as ``MONGO_HOST``, ``MONGO_PORT``,\n``MONGO_URI`` are also supported; just prefix them with ``SENTINEL_`` as\nseen above.\n\nWhen a token is created it is added to both the database and the Redis cache.\nIn Redis, ``key`` is the access token itself while ``value`` is the id of the\nuser who requested the token. This allows for fast token\nauthentication/verification bypassing the database lookup. This tecnique can be\nused, for example, when integrating ``flask-sentinel`` with `Eve`_ powered REST\nAPI instances.\n\nUsing Flask-Sentinel with Eve\n-----------------------------\nSee the `Eve-OAuth2`_ example project.\n\nSecurity\n--------\nSSL/TLS\n~~~~~~~\nWhen working with OAuth 2.0, all communications must be encrypted with SSL/TLS.\nThis example uses auto-generated SSL certificates, however in a production\nenvironment you should use a more formal, widely trusted certificate associated\nwith your domain. In addition, requests should be handled by something like\nNGINX and proxied to the authentication service.\n\n*Note: Add `-k` to your `curl` arguments if you are working with an untrusted\ndevelopment server running under SSL/TLS.*\n\nPassword Hashing\n~~~~~~~~~~~~~~~~\nBcrypt and a randomly generated salt are used to hash each user password before\nit is added to the database. You should never store passwords in plain text!\n\nLicense\n-------\nFlask-Sentinel is a `Nicola Iarocci`_ and `Gestionali Amica`_ open source\nproject distributed under the `BSD license`_.\n\nAcknowledgement\n---------------\nThis work is based on the `yoloAPI`_ project by `Josh Brandoff`_ and `Jonas\nBrunsgaard`_.\n\n.. _`RFC 6749`: http://tools.ietf.org/html/rfc6749#section-1.3.3\n.. _`yoloAPI`: https://github.com/brunsgaard/yoloAPI\n.. _`Josh Brandoff`: https://github.com/EmergentBehavior\n.. _`Jonas Brunsgaard`: https://github.com/brunsgaard\n.. _`Nicola Iarocci`: http://nicolaiarocci.com\n.. _`Gestionali Amica`: http://gestionaleamica.com\n.. _`BSD license`: https://github.com/pyeve/flask-sentinel/blob/master/LICENSE\n.. _`Eve-OAuth2`: https://github.com/pyeve/eve-oauth2\n.. _`Eve`: http://python-eve.org\n.. _`Flask configuration`: http://flask.pocoo.org/docs/0.10/config/\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpyeve%2Fflask-sentinel","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpyeve%2Fflask-sentinel","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpyeve%2Fflask-sentinel/lists"}