
    qhP
                     f    S r SSKJrJr  SSKJrJrJr  SSKJ	r	  SSK
Jr  SSKJr   " S S\5      rg	)
z"
Ping Auth OpenID Connect backend
    )jwkjwt)ExpiredSignatureErrorJWTClaimsErrorJWTError)base64url_decode)OpenIdConnectAuth)AuthTokenErrorc                   :    \ rS rSrSrSrSrSrSrS r	S r
S	 rS
rg)PingOpenIdConnect   ping Fcodepreferred_usernamec                    U R                  5        Hp  n[        R                  " USS9nUR                  SS5      u  pE[	        UR                  S5      5      nUR                  UR                  S5      U5      (       d  Mn  Us  $    g )NRS256	algorithm.   utf-8)get_jwks_keysr   	constructrsplitr   encodeverify)selfid_tokenkeyrsakeymessageencoded_sigdecoded_sigs          K/var/www/html/env/lib/python3.13/site-packages/social_core/backends/ping.pyfind_valid_key PingOpenIdConnect.find_valid_key   sq    %%'C]]3':F#+??3#: G*;+=+=g+FGK}}W^^G4kBB
 (     c           
         U R                  5       u  p4U R                  U5      nU(       d  [        U S5      e[        R                  " USS9n [
        R                  " UUR                  5       R                  S5      U R                  UU R                  5       UU R                  S9nU R                  U5        U$ ! [         a    [        U S5      e[         a  n[        U [        U5      5      eSnAf[         a    [        U S5      ef = f)	zz
Validates the id_token according to the steps at
http://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation.
zSignature verification failedr   r   r   )
algorithmsaudienceissueraccess_tokenoptionszSignature has expiredNzInvalid signature)get_key_and_secretr&   r
   r   r   r   decodeto_pemJWT_ALGORITHMSid_token_issuerJWT_DECODE_OPTIONSr   r   strr   validate_claims)	r   r   r-   	client_idclient_secretr    r!   claimserrors	            r%   validate_and_return_id_token.PingOpenIdConnect.validate_and_return_id_token   s    
 $(#:#:#< 	!!(+ 'FGGsg6	<ZZ&&w/.."++-)//F  	V$ % 	@ '>?? 	3 s5z22 	< ':;;	<s   AB9 9DC--Dc                     U R                  SU R                  S9nU R                  UR                  S5      UR                  S5      S9u  p4nUR                  U5      UR                  S5      UUUS.$ )NUSERNAME_KEY)default
given_namefamily_name)
first_name	last_nameemail)usernamerD   fullnamerB   rC   )settingr>   get_user_namesget)r   responseusername_keyrF   rB   rC   s         r%   get_user_details"PingOpenIdConnect.get_user_detailsA   sx    ||ND<M<M|N*.*=*=||L1X\\-=X +> +
'i !\2\\'* $"
 	
r(    N)__name__
__module____qualname____firstlineno__nameOIDC_ENDPOINTREDIRECT_STATERESPONSE_TYPEr>   r&   r;   rL   __static_attributes__rN   r(   r%   r   r      s+    DMNM'L!F
r(   r   N)__doc__joser   r   jose.exceptionsr   r   r   
jose.utilsr   $social_core.backends.open_id_connectr	   social_core.exceptionsr
   r   rN   r(   r%   <module>r^      s+     K K ' B 1?
) ?
r(   