bluesky_httpserver.authenticators.EntraAuthenticator

class bluesky_httpserver.authenticators.EntraAuthenticator(audience: str, client_id: str, well_known_uri: str, device_flow_client_id: str, extra_scopes: list[str] | None = None, confirmation_message: str = '', scopes_map: dict[str, list[str]] | None = None, client_secret: str = '', redirect_on_success: str | None = None, graph_username_attribute: str | None = None)[source]

__init__(audience: str, client_id: str, well_known_uri: str, device_flow_client_id: str, extra_scopes: list[str] | None = None, confirmation_message: str = '', scopes_map: dict[str, list[str]] | None = None, client_secret: str = '', redirect_on_success: str | None = None, graph_username_attribute: str | None = None)[source]

A MS Entra specific version of the OIDC authenticator

It attempts to extract a username from the standard list of claims returned from the token Entra provides. Alternatively if a graph_username_attribute is used then a call is made to MSGraphAPI to get the provided user attribute and use it as the username instead.

The graph API call is the recommended way to authenticate with MS products, as all claims in the token are inconsistent and not guaranteed.

Methods

`__init__`(audience, client_id, ...[, ...])	A MS Entra specific version of the OIDC authenticator
`auth_code_exchange`(request)	Perform the authorization code exchange
`authenticate`(request)	Complete the Entra OIDC authorization-code flow and return a session.
`create_usersession`(access_token, ...)	Create usersession from tokens and final username
`decode_token`(id_token[, access_token])
`get_username_from_graph`(access_token)	Attempts to get the username from either claims or MSGraphAPI call
`graph_lookup`(access_token, user_param)	Uses the access token provided in the auth flow to lookup a user parameter
`keys`()
`log_token_claims`(verified_body)	log token claims Includes logging of the token claims so misconfigurations are easier to diagnose.

Attributes

`authorization_endpoint`
`client_id`
`configuration_schema`
`device_authorization_endpoint`
`end_session_endpoint`
`id_token_signing_alg_values_supported`
`issuer`
`jwks_uri`
`oauth2_schema`
`scopes`
`token_endpoint`