Metadata-Version: 2.5
Name: pyobs-auth
Version: 2.1.1
Summary: Shared Keycloak/OIDC authentication client for pyobs web services
Project-URL: Homepage, https://www.pyobs.org
Project-URL: Documentation, https://docs.pyobs.org
Project-URL: Repository, https://github.com/pyobs/pyobs-auth
Project-URL: Issues, https://github.com/pyobs/pyobs-auth/issues
Author-email: Tim-Oliver Husser <thusser@uni-goettingen.de>
License-Expression: MIT
License-File: LICENSE
Requires-Python: >=3.11
Requires-Dist: django<7,>=5.2
Requires-Dist: djangorestframework>=3.15
Requires-Dist: pyjwt[crypto]<3,>=2.10.1
Requires-Dist: requests<3,>=2.32.3
Description-Content-Type: text/markdown

# pyobs-auth

Shared Keycloak/OIDC authentication client for pyobs web services (`pyobs-archive`,
`pyobs-portal`, and future services), so each one doesn't reimplement OIDC discovery,
token validation, and user mapping on its own.

Single issuer only, by design: every service trusts exactly one Keycloak realm. Any upstream
identity provider (an institute's SSO, a self-hosted `observation-portal`, ...) is meant to be
brokered *behind* that Keycloak instance, not validated directly by this library - see
[`docs/source/architecture.rst`](docs/source/architecture.rst) for the full reasoning.

## Documentation

Full installation (adding this to a Django project), configuration (every `PYOBS_AUTH` key),
architecture, and API reference: see [`docs/source/`](docs/source/) (built with Sphinx —
`cd docs && uv run --group dev make html`).

## Development

```bash
git clone https://github.com/pyobs/pyobs-auth.git
cd pyobs-auth
uv sync --group dev
uv run pytest
uv run ruff check pyobs_auth/
uv run black --check .
uv run pyrefly check pyobs_auth
```
