Python requests auth windows

Authentication for Requests

Provides authentication classes to be used with requests authentication parameter.

Картинка с сайта: colin-b.github.io

Some of the supported authentication

Available authentication

• OAuth2
  • Authorization Code Flow
    • Okta
  • Authorization Code Flow with PKCE
    • Okta
  • Resource Owner Password Credentials flow
  • Client Credentials Flow
    • Okta
  • Implicit Flow
    • Microsoft Entra (Access Token)
    • Microsoft Entra (ID token)
    • Okta (Access Token)
    • Okta (ID token)
  • Managing token cache
  • Managing browser
• API key
  • In header
  • In query
• Basic
• NTLM (Windows)
• Multiple authentication at once
• Endorsements

OAuth 2

Most of OAuth2 flows are supported.

If the one you are looking for is not yet supported, feel free to ask for its implementation.

Authorization Code Grant is implemented following rfc6749.

Use requests_auth.OAuth2AuthorizationCode to configure this kind of authentication.

import requests
from requests_auth import OAuth2AuthorizationCode

requests.get('https://www.example.com', auth=OAuth2AuthorizationCode('https://www.authorization.url', 'https://www.token.url'))

Note:

• You can persist tokens thanks to the token cache.
• You can tweak web browser interaction thanks to the display settings.

Parameters

Any other parameter will be put as query parameter in the authorization URL and as body parameters in the token URL.

Usual extra parameters are:

Common providers

Most of OAuth2 Authorization Code Grant providers are supported.

If the one you are looking for is not yet supported, feel free to ask for its implementation.

Okta (OAuth2 Authorization Code)

Okta Authorization Code Grant providing access tokens is supported.

Use requests_auth.OktaAuthorizationCode to configure this kind of authentication.

import requests
from requests_auth import OktaAuthorizationCode


okta = OktaAuthorizationCode(instance='testserver.okta-emea.com', client_id='54239d18-c68c-4c47-8bdd-ce71ea1d50cd')
requests.get('https://www.example.com', auth=okta)

Note:

• You can persist tokens thanks to the token cache.
• You can tweak web browser interaction thanks to the display settings.

Parameters

Any other parameter will be put as query parameter in the authorization URL.

Usual extra parameters are:

WakaTime (OAuth2 Authorization Code)

WakaTime Authorization Code Grant providing access tokens is supported.

Use requests_auth.WakaTimeAuthorizationCode to configure this kind of authentication.

import requests
from requests_auth import WakaTimeAuthorizationCode


waka_time = WakaTimeAuthorizationCode(client_id="aPJQV0op6Pu3b66MWDi9b1wB", client_secret="waka_sec_0c5MB", scope="email")
requests.get('https://wakatime.com/api/v1/users/current', auth=waka_time)

Note:

• You can persist tokens thanks to the token cache.
• You can tweak web browser interaction thanks to the display settings.

Parameters

Any other parameter will be put as query parameter in the authorization URL.

Authorization Code Flow with Proof Key for Code Exchange

Proof Key for Code Exchange is implemented following rfc7636.

Use requests_auth.OAuth2AuthorizationCodePKCE to configure this kind of authentication.

import requests
from requests_auth import OAuth2AuthorizationCodePKCE

requests.get('https://www.example.com', auth=OAuth2AuthorizationCodePKCE('https://www.authorization.url', 'https://www.token.url'))

Note:

• You can persist tokens thanks to the token cache.
• You can tweak web browser interaction thanks to the display settings.

Parameters

Any other parameter will be put as query parameter in the authorization URL and as body parameters in the token URL.

Usual extra parameters are:

Common providers

Most of OAuth2 Proof Key for Code Exchange providers are supported.

If the one you are looking for is not yet supported, feel free to ask for its implementation.

Okta (OAuth2 Proof Key for Code Exchange)

Okta Proof Key for Code Exchange providing access tokens is supported.

Use requests_auth.OktaAuthorizationCodePKCE to configure this kind of authentication.

import requests
from requests_auth import OktaAuthorizationCodePKCE


okta = OktaAuthorizationCodePKCE(instance='testserver.okta-emea.com', client_id='54239d18-c68c-4c47-8bdd-ce71ea1d50cd')
requests.get('https://www.example.com', auth=okta)

Note:

• You can persist tokens thanks to the token cache.
• You can tweak web browser interaction thanks to the display settings.

Parameters

Any other parameter will be put as query parameter in the authorization URL and as body parameters in the token URL.

Usual extra parameters are:

Resource Owner Password Credentials flow

Resource Owner Password Credentials Grant is implemented following rfc6749.

Use requests_auth.OAuth2ResourceOwnerPasswordCredentials to configure this kind of authentication.

import requests
from requests_auth import OAuth2ResourceOwnerPasswordCredentials

requests.get('https://www.example.com', auth=OAuth2ResourceOwnerPasswordCredentials('https://www.token.url', 'user name', 'user password'))

Note:

• You can persist tokens thanks to the token cache.

Parameters

Any other parameter will be put as body parameter in the token URL.

Common providers

Most of OAuth2 Resource Owner Password Credentials providers are supported.

If the one you are looking for is not yet supported, feel free to ask for its implementation.

Okta (OAuth2 Resource Owner Password Credentials)

Okta Resource Owner Password Credentials providing access tokens is supported.

Use requests_auth.OktaResourceOwnerPasswordCredentials to configure this kind of authentication.

import requests
from requests_auth import OktaResourceOwnerPasswordCredentials


okta = OktaResourceOwnerPasswordCredentials(instance='testserver.okta-emea.com', username='user name', password='user password', client_id='54239d18-c68c-4c47-8bdd-ce71ea1d50cd', client_secret="0c5MB")
requests.get('https://www.example.com', auth=okta)

Note:

• You can persist tokens thanks to the token cache.

Parameters

Any other parameter will be put as body parameters in the token URL.

Client Credentials flow

Client Credentials Grant is implemented following rfc6749.

Use requests_auth.OAuth2ClientCredentials to configure this kind of authentication.

import requests
from requests_auth import OAuth2ClientCredentials

requests.get('https://www.example.com', auth=OAuth2ClientCredentials('https://www.token.url', client_id='id', client_secret='secret'))

Note:

• You can persist tokens thanks to the token cache.

Parameters

Any other parameter will be put as body parameter in the token URL.

Common providers

Most of OAuth2 Client Credentials Grant providers are supported.

If the one you are looking for is not yet supported, feel free to ask for its implementation.

Okta (OAuth2 Client Credentials)

Okta Client Credentials Grant providing access tokens is supported.

Use requests_auth.OktaClientCredentials to configure this kind of authentication.

import requests
from requests_auth import OktaClientCredentials


okta = OktaClientCredentials(instance='testserver.okta-emea.com', client_id='54239d18-c68c-4c47-8bdd-ce71ea1d50cd', client_secret="secret", scope=["scope1", "scope2"])
requests.get('https://www.example.com', auth=okta)

Note:

• You can persist tokens thanks to the token cache.

Parameters

Any other parameter will be put as query parameter in the token URL.

Implicit flow

Implicit Grant is implemented following rfc6749.

Use requests_auth.OAuth2Implicit to configure this kind of authentication.

import requests
from requests_auth import OAuth2Implicit

requests.get('https://www.example.com', auth=OAuth2Implicit('https://www.authorization.url'))

Note:

• You can persist tokens thanks to the token cache.
• You can tweak web browser interaction thanks to the display settings.

Parameters

Any other parameter will be put as query parameter in the authorization URL.

Usual extra parameters are:

Common providers

Most of OAuth2 Implicit Grant providers are supported.

If the one you are looking for is not yet supported, feel free to ask for its implementation.

Microsoft — Azure Active Directory (OAuth2 Access Token)

Microsoft identity platform access tokens are supported.

Use requests_auth.AzureActiveDirectoryImplicit to configure this kind of authentication.

import requests
from requests_auth import AzureActiveDirectoryImplicit


aad = AzureActiveDirectoryImplicit(tenant_id='45239d18-c68c-4c47-8bdd-ce71ea1d50cd', client_id='54239d18-c68c-4c47-8bdd-ce71ea1d50cd')
requests.get('https://www.example.com', auth=aad)

Note:

• You can persist tokens thanks to the token cache.
• You can tweak web browser interaction thanks to the display settings.

You can retrieve Microsoft Azure Active Directory application information thanks to the application list on Azure portal.

Parameters

Any other parameter will be put as query parameter in the authorization URL.

Usual extra parameters are:

Microsoft — Azure Active Directory (OpenID Connect ID token)

Microsoft identity platform ID tokens are supported.

Use requests_auth.AzureActiveDirectoryImplicitIdToken to configure this kind of authentication.

import requests
from requests_auth import AzureActiveDirectoryImplicitIdToken


aad = AzureActiveDirectoryImplicitIdToken(tenant_id='45239d18-c68c-4c47-8bdd-ce71ea1d50cd', client_id='54239d18-c68c-4c47-8bdd-ce71ea1d50cd')
requests.get('https://www.example.com', auth=aad)

Note:

• You can persist tokens thanks to the token cache.
• You can tweak web browser interaction thanks to the display settings.

You can retrieve Microsoft Azure Active Directory application information thanks to the application list on Azure portal.

Parameters

Any other parameter will be put as query parameter in the authorization URL.

Usual extra parameters are:

Okta (OAuth2 Implicit Access Token)

Okta Implicit Grant providing access tokens is supported.

Use requests_auth.OktaImplicit to configure this kind of authentication.

import requests
from requests_auth import OktaImplicit


okta = OktaImplicit(instance='testserver.okta-emea.com', client_id='54239d18-c68c-4c47-8bdd-ce71ea1d50cd')
requests.get('https://www.example.com', auth=okta)

Note:

• You can persist tokens thanks to the token cache.
• You can tweak web browser interaction thanks to the display settings.

Parameters

Any other parameter will be put as query parameter in the authorization URL.

Usual extra parameters are:

Okta (OpenID Connect Implicit ID token)

Okta Implicit Grant providing ID tokens is supported.

Use requests_auth.OktaImplicitIdToken to configure this kind of authentication.

import requests
from requests_auth import OktaImplicitIdToken


okta = OktaImplicitIdToken(instance='testserver.okta-emea.com', client_id='54239d18-c68c-4c47-8bdd-ce71ea1d50cd')
requests.get('https://www.example.com', auth=okta)

Note:

• You can persist tokens thanks to the token cache.
• You can tweak web browser interaction thanks to the display settings.

Parameters

Any other parameter will be put as query parameter in the authorization URL.

Usual extra parameters are:

Managing token cache

To avoid asking for a new token every new request, a token cache is used.

Default cache is in memory, but it is also possible to use a physical cache.

You need to provide the location of your token cache file. It can be a full or relative path (str or `pathlib.Path).

If the file already exists it will be used, if the file do not exist it will be created.

from requests_auth import OAuth2, JsonTokenFileCache

OAuth2.token_cache = JsonTokenFileCache('path/to/my_token_cache.json')

Managing the web browser

You can configure the browser display settings thanks to requests_auth.OAuth2.display as in the following:

from requests_auth import OAuth2, DisplaySettings

OAuth2.display = DisplaySettings()

The following parameters can be provided to DisplaySettings:

You can send an API key inside the header of your request using requests_auth.HeaderApiKey.

import requests
from requests_auth import HeaderApiKey

requests.get('https://www.example.com', auth=HeaderApiKey('my_api_key'))

Parameters

API key in query

You can send an API key inside the query parameters of your request using requests_auth.QueryApiKey.

import requests
from requests_auth import QueryApiKey

requests.get('https://www.example.com', auth=QueryApiKey('my_api_key'))

Parameters

Basic

You can use basic authentication using requests_auth.Basic.

The only advantage of using this class instead of requests native support of basic authentication, is to be able to use it in multiple authentication.

import requests
from requests_auth import Basic

requests.get('https://www.example.com', auth=Basic('username', 'password'))

Parameters

NTLM

Requires requests-negotiate-sspi module or requests_ntlm module depending on provided parameters.

You can use Windows authentication using requests_auth.NTLM.

import requests
from requests_auth import NTLM

requests.get('https://www.example.com', auth=NTLM())

Parameters

Multiple authentication at once

You can also use a combination of authentication using + or & as in the following sample:

import requests
from requests_auth import HeaderApiKey, OAuth2Implicit

api_key = HeaderApiKey('my_api_key')
oauth2 = OAuth2Implicit('https://www.example.com')
requests.get('https://www.example.com', auth=api_key + oauth2)

This is supported on every authentication class exposed by requests_auth, but you can also enable it on your own authentication classes by using requests_auth.SupportMultiAuth as in the following sample:

from requests_auth import SupportMultiAuth
# TODO Import your own auth here
from my_package import MyAuth

class MyMultiAuth(MyAuth, SupportMultiAuth):
    pass

Available pytest fixtures

Testing the code using requests_auth authentication classes can be achieved using provided pytest fixtures.

token_cache_mock

from requests_auth.testing import token_cache_mock, token_mock

def test_something(token_cache_mock):
    # perform code using authentication
    pass

Use this fixture to mock authentication success for any of the following classes:

• OAuth2AuthorizationCodePKCE
• OktaAuthorizationCodePKCE
• OAuth2Implicit
• OktaImplicit
• OktaImplicitIdToken
• AzureActiveDirectoryImplicit
• AzureActiveDirectoryImplicitIdToken
• OAuth2AuthorizationCode
• OktaAuthorizationCode
• OAuth2ClientCredentials
• OktaClientCredentials
• OAuth2ResourceOwnerPasswordCredentials,

By default, an access token with value 2YotnFZFEjr1zCsicMWpAA is generated.

You can however return your custom token by providing your own token_mock fixture as in the following sample:

import pytest

from requests_auth.testing import token_cache_mock


@pytest.fixture
def token_mock() -> str:
    return "MyCustomTokenValue"


def test_something(token_cache_mock):
    # perform code using authentication
    pass

You can even return a more complex token by using the create_token function.

Note that pyjwt is a required dependency in this case as it is used to generate the token returned by the authentication.

import pytest

from requests_auth.testing import token_cache_mock, create_token


@pytest.fixture
def token_mock() -> str:
    expiry = None  # TODO Compute your expiry
    return create_token(expiry)


def test_something(token_cache_mock):
    # perform code using authentication
    pass

Advanced testing

token_cache

This pytest fixture will return the token cache and ensure it is reset at the end of the test case.

from requests_auth.testing import token_cache

def test_something(token_cache):
    # perform code using authentication
    pass

browser_mock

This pytest fixture will allow to mock the behavior of a web browser.

With this pytest fixture you will be allowed to fine tune your authentication related failures handling.

pyjwt is a required dependency if you use create_token helper function.

import datetime

from requests_auth.testing import browser_mock, BrowserMock, create_token

def test_something(browser_mock: BrowserMock):
    token_expiry = datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(hours=1)
    token = create_token(token_expiry)
    tab = browser_mock.add_response(
        opened_url="http://url_opened_by_browser?state=1234",
        reply_url=f"http://localhost:5000#access_token={token}&state=1234",
    )

    # perform code using authentication

    tab.assert_success()

Endorsements

I love requests_auth. As a ~15 year pythonista, this library makes working with OAuth services a breeze. <333

Randall Degges, Head of Evangelism, Okta

Recently I was working on a unit project to realize python automation, but in the first step, I was turned away. I checked the information and asked the big guys and asked our developers. It was done from Monday to Friday.

Next to share with you

Project background: Our system is implemented based on the Windows platform, and the login method is Windows identity authentication

1. Web login mode, selenium module implementation

1. I originally wanted to use selenium to achieve it. Can I use WinSpy to locate it on the web and use pywin32 to achieve it. I tried it and found that the tool WinSpy could not locate my login window at all. The entire black positioning frame could not locate the login pop-up window. The Autoit method mentioned is probably similar to this one. It is all operating Windows windows. I don’t know how to do it. I didn’t study it to understand, as shown in the figure:

2. In the middle, I also thought about using the requests library to request and obtain the cookie (the second method below). The requests library initiates the request, returns the Set-Cookie in the request header, uses the sessionid in the Set-Cookie and other When the webdriver in selenium initiates a request, it will bring a series of parameters such as sessionid, and use this method to achieve Windows authentication, but it still doesn’t work. It will report an error directly, saying it is an invalid cookie domain. , The specific error message is as follows:

3. The web method is even more exotic. It took me a week and a half. After consulting our little Jane and Benben, it still hasn’t been settled. It’s not my mentality. Self-confidence is completely destroyed. I browsed through search sites such as Baidu and Bing. During the period, my classmate L was always with me to help me solve the problem, including the implementation steps, screenshots, and videos. Finally, I finally got it done. Let me tell you that some students will encounter Windows identity authentication in the future, and they can use this method for login authentication.

In fact, the principle is very simple, and I have seen a post to talk about this method, which is to write the user name and password into the url, but I was unsuccessful at the time. The key lies in the special characters.

The syntax is:http://username:password@url

The implementation code is as follows, for example:

from selenium import webdriver


driver = webdriver.Chrome()
url = r"http://d%5cyuaxxx:[email protected]/"　　# The user name contains special symbols, which is the escaped user name
driver.get(url)

Be careful here, if your username and password contain special characters, such as:! @#￥%……&*Wait,Must be converted to UrlEncode format, Otherwise the login must be unsuccessful, a history of blood and tears

Special thanks to my sister L. I can’t solve this problem without her.

Provide a transcoded URL:https://tool.chinaz.com/tools/urlencode.aspx

For example: «admin@1234» this string, after transcoding:

Second, use the requests library in python to implement Windows authentication login

First install the requests library, requests_ntlm library

pip install requests
pip install requests_ntlm

Log in as Windows

import requests
from requests_ntlm import HttpNtlmAuth

requests.get("http://xxx.com",auth=HttpNtlmAuth('domain\\username','pwd'))

for example:

Login is successful, and you can get some information such as header request header, sessionid, etc.

Reference article:https://www.cnblogs.com/xbzhu/p/7743584.html