{"id":21896054,"url":"https://github.com/rjw57/verify-oidc-identity","last_synced_at":"2025-04-15T16:43:18.644Z","repository":{"id":263313245,"uuid":"890003490","full_name":"rjw57/verify-oidc-identity","owner":"rjw57","description":"Verify OIDC JWT identity tokens using OIDC discovery","archived":false,"fork":false,"pushed_at":"2025-04-05T17:11:31.000Z","size":321,"stargazers_count":3,"open_issues_count":2,"forks_count":1,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-04-05T18:22:41.987Z","etag":null,"topics":["federated-identity","oauth2","oauth2-server","oidc","oidc-token","oidc-token-management","python","workload-identity","workload-identity-federation"],"latest_commit_sha":null,"homepage":"https://rjw57.github.io/verify-oidc-identity/","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/rjw57.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-11-17T19:16:21.000Z","updated_at":"2025-03-31T10:49:58.000Z","dependencies_parsed_at":"2025-03-07T08:22:33.459Z","dependency_job_id":"216cd2da-cb99-46d5-9014-737c79b0d02d","html_url":"https://github.com/rjw57/verify-oidc-identity","commit_stats":null,"previous_names":["rjw57/verify-oidc-identity"],"tags_count":44,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rjw57%2Fverify-oidc-identity","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rjw57%2Fverify-oidc-identity/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rjw57%2Fverify-oidc-identity/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rjw57%2Fverify-oidc-identity/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/rjw57","download_url":"https://codeload.github.com/rjw57/verify-oidc-identity/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":249110664,"owners_count":21214376,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["federated-identity","oauth2","oauth2-server","oidc","oidc-token","oidc-token-management","python","workload-identity","workload-identity-federation"],"created_at":"2024-11-28T13:42:20.787Z","updated_at":"2025-04-15T16:43:18.639Z","avatar_url":"https://github.com/rjw57.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Python library to verify id tokens using OIDC discovery\n\n[![PyPI - Version](https://img.shields.io/pypi/v/verify-oidc-identity)](https://pypi.org/p/verify-oidc-identity/)\n![PyPI - Python Version](https://img.shields.io/pypi/pyversions/verify-oidc-identity)\n[![GitHub Release](https://img.shields.io/github/v/release/rjw57/verify-oidc-identity)](https://github.com/rjw57/verify-oidc-identity/releases)\n[![Test suite status](https://github.com/rjw57/verify-oidc-identity/actions/workflows/main.yml/badge.svg?branch=main)](https://github.com/rjw57/verify-oidc-identity/actions/workflows/main.yml?query=branch%3Amain)\n\n[OpenID connect][oidc] identity tokens are a popular choice for federating identity between\ndifferent systems without the need to share secrets. For example [Trusted publishing on\nPyPI](https://docs.pypi.org/trusted-publishers/) allows use of OIDC tokens created by\nGitHub or GitLab CI jobs to be used to authenticate when uploading new Python packages.\nSimilarly, OIDC tokens can be used to authenticate to [Google\nCloud](https://cloud.google.com/iam/docs/workload-identity-federation),\n[AWS](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction_access-management.html#intro-access-roles)\nand\n[Azure](https://learn.microsoft.com/en-us/graph/api/resources/federatedidentitycredentials-overview?view=graph-rest-1.0)\nfrom any OIDC identity provider.\n\nThe [jwt.io](https://jwt.io/) and [jwt.ms](https://jwt.ms/) tools allow validating OIDC\nid tokens without first configuring public keys by means of the [OpenID connect\ndiscovery][oidc-discovery] protocol.\n\nThis library implements the OpenID Connect discovery standard in Python to allow\nverification of OpenID Connect id tokens without previous configuration of public keys,\netc.\n\nBoth synchronous and asynchronous (`asyncio`) implementations are provided.\n\n[oidc]: https://openid.net/specs/openid-connect-core-1_0.html\n[oidc-discovery]: https://openid.net/specs/openid-connect-discovery-1_0.html\n\n## Example\n\nSuppose you created a [GitLab OIDC\ntoken](https://docs.gitlab.com/ee/ci/secrets/id_token_authentication.html) as part of a\nCI job to make an authenticated HTTP GET request to some service:\n\n```yaml\n# .gitlab-ci.yml within https://gitlab.com/my-group/my-project\n\njob_with_id_token:\n  id_tokens:\n    ID_TOKEN:\n      aud: https://my-service.example.com\n  script:\n    - curl -X GET -H \"Authorization: Bearer $ID_TOKEN\" https://my-service.example.com\n```\n\nThe following example shows how to verify the OIDC token came from a specific project\nwithin a backend implementation:\n\n```py\nfrom typing import Any\nfrom federatedidentity import Issuer, verifiers, verify_id_token\n\n# Use OIDC discovery to fetch public keys for verifying GitLab tokens.\nGITLAB_ISSUER = Issuer.from_discovery(\"https://gitlab.com\")\n\n# Expected project path for id token\nEXPECTED_PROJECT_PATH = \"my-group/my-project\"\n\n# Expected audience claim for id token.\nEXPECTED_AUDIENCE_CLAIM = \"https://my-service.example.com\"\n\ndef verify_gitlab_token(token: str) -\u003e dict[str, Any]:\n    \"\"\"\n    Verify an OIDC token from GitLab and return the dictionary of claims. Raises\n    federatedidentity.exceptions.FederatedIdentityError if the token failed verification.\n    \"\"\"\n    return verify_id_token(\n        token,\n        valid_issuers=[GITLAB_ISSUER],\n        valid_audiences=[EXPECTED_AUDIENCE_CLAIM],\n        required_claims=[\n            # The \"project_path\" claim must match the expected project.\n            {\"project_path\": EXPECTED_PROJECT_PATH},\n        ],\n    )\n```\n\nSee [the full documentation](https://rjw57.github.io/verify-oidc-identity/) for more\nexamples.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frjw57%2Fverify-oidc-identity","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frjw57%2Fverify-oidc-identity","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frjw57%2Fverify-oidc-identity/lists"}