Authorization

The ClientCredentialsAuth class

class firecrest.ClientCredentialsAuth(client_id: str, client_secret: str, token_uri: str, min_token_validity: int = 10, client_auth_method: str = 'client_secret_post')

Bases: object

Client Credentials Authorization class.

Parameters:

  • client_id (string) – name of the client as registered in the authorization server

  • client_secret (string) – secret associated to the client

  • token_uri (string) – URI of the token request in the authorization server (e.g. https://auth.your-server.com/auth/realms/cscs/protocol/openid-connect/token)

  • min_token_validity (float) – reuse OIDC token until {min_token_validity} sec before the expiration time (by default 10). Since the token will be checked by different microservices, setting more time in min_token_validity will ensure that the token doesn’t expire in the middle of the request.

  • client_auth_method (string) – client authentication method used to send the credentials to the token endpoint. Either "client_secret_post" (default), which sends the credentials in the request body, or "client_secret_basic", which sends them using HTTP Basic authentication.

timeout: float | Tuple[float, float] | Tuple[float, None] | None

It will be passed to all the requests that will be made. How many seconds to wait for the server to send data before giving up. After that time a requests.exceptions.Timeout error will be raised.

It can be a float or a tuple. More details here: https://requests.readthedocs.io.

disable_client_logging: bool

Disable all logging from this authorization object.

get_access_token() → str

Returns an access token to be used for accessing resources. If the request fails the token will be None

auth_headers() → Dict[str, str]

Return the HTTP headers that authenticate a request to FirecREST.

The TokenCommandAuth class

class firecrest.TokenCommandAuth(command: str)

Bases: object

Authorization class that obtains a token by running a shell command.

The command is executed on every call to get_access_token(), so it naturally handles token refresh. The token is read from the command’s stdout (stripped of surrounding whitespace).

Parameters:

command (str) – Shell command whose stdout is the bearer token.

get_access_token() → str

Run the configured command and return its stdout as the access token.

auth_headers() → Dict[str, str]

Return the HTTP headers that authenticate a request to FirecREST.

The ApiKeyAuth class

class firecrest.ApiKeyAuth(api_key: str, header_name: str = 'X-API-Key')

Bases: object

Authorization class for API keys (e.g. FirecREST service accounts).

The key is sent on every request in a dedicated header instead of the Authorization: Bearer header used by token-based authorization.

Parameters:

  • api_key (str) – the API key.

  • header_name (str) – name of the header carrying the key (by default X-API-Key).

auth_headers() → Dict[str, str]

Return the HTTP headers that authenticate a request to FirecREST.