Python (FastAPI)

IDRA_ISSUER=https://<your-org>.idra.team/api/auth
IDRA_CLIENT_ID=<Client ID>
IDRA_CLIENT_SECRET=<client secret>
APP_URL=http://localhost:8000
SESSION_SECRET=<output of: openssl rand -hex 32>

python3 -m venv .venv && source .venv/bin/activate
pip install fastapi==0.162.0 uvicorn==0.54.0 authlib==1.9.1 httpx==0.28.1 itsdangerous==2.2.0

import json
import os
from urllib.parse import urlencode

from authlib.integrations.starlette_client import OAuth
from fastapi import FastAPI, Request
from fastapi.responses import HTMLResponse, RedirectResponse
from starlette.middleware.sessions import SessionMiddleware

ISSUER = os.environ["IDRA_ISSUER"]
APP_URL = os.environ["APP_URL"]

app = FastAPI()
app.add_middleware(
    SessionMiddleware,
    secret_key=os.environ["SESSION_SECRET"],
    same_site="lax",
    https_only=APP_URL.startswith("https://"),
)

oauth = OAuth()
idra = oauth.register(
    "idra",
    client_id=os.environ["IDRA_CLIENT_ID"],
    client_secret=os.environ["IDRA_CLIENT_SECRET"],
    server_metadata_url=f"{ISSUER}/.well-known/openid-configuration",
    client_kwargs={
        "scope": "openid profile email groups",
        "code_challenge_method": "S256",
        "token_endpoint_auth_method": "client_secret_basic",
    },
)


@app.get("/", response_class=HTMLResponse)
async def home(request: Request):
    user = request.session.get("user")
    if not user:
        return '<h1>Signed out</h1><a href="/login">Sign in with IdRa</a>'
    body = json.dumps(user, indent=2).replace("<", "&lt;")
    return f'<h1>Signed in</h1><pre>{body}</pre><a href="/logout">Sign out</a>'


@app.get("/login")
async def login(request: Request):
    return await idra.authorize_redirect(request, f"{APP_URL}/callback")


@app.get("/callback")
async def callback(request: Request):
    try:
        token = await idra.authorize_access_token(request)
        # The ID token has no email or name: they come from UserInfo.
        request.session["user"] = dict(await idra.userinfo(token=token))
        request.session["id_token"] = token["id_token"]
    except Exception as e:
        print(f"Sign-in failed: {e!r}")
        return HTMLResponse(f"Sign-in failed: {e}".replace("<", "&lt;"), status_code=400)
    return RedirectResponse("/", status_code=302)


@app.get("/logout")
async def logout(request: Request):
    id_token = request.session.get("id_token")
    request.session.clear()
    if not id_token:
        return RedirectResponse("/", status_code=302)
    metadata = await idra.load_server_metadata()
    query = urlencode({"id_token_hint": id_token, "post_logout_redirect_uri": f"{APP_URL}/"})
    return RedirectResponse(f"{metadata['end_session_endpoint']}?{query}", status_code=302)

set -a; source .env; set +a
uvicorn app:app --port 8000