Python (Flask)

IDRA_ISSUER=https://<your-org>.idra.team/api/auth
IDRA_CLIENT_ID=<Client ID>
IDRA_CLIENT_SECRET=<client secret>
APP_URL=http://localhost:5050
SESSION_SECRET=<output of: openssl rand -hex 32>

python3 -m venv .venv && source .venv/bin/activate
pip install flask authlib requests

import json
import os
from urllib.parse import urlencode

from authlib.integrations.flask_client import OAuth
from flask import Flask, redirect, session

ISSUER = os.environ["IDRA_ISSUER"]
SECRET = os.environ.get("IDRA_CLIENT_SECRET")
APP_URL = os.environ["APP_URL"]

app = Flask(__name__)
app.secret_key = os.environ["SESSION_SECRET"]
app.config.update(
    SESSION_COOKIE_SAMESITE="Lax",
    SESSION_COOKIE_SECURE=APP_URL.startswith("https://"),
)

oauth = OAuth(app)
idra = oauth.register(
    "idra",
    client_id=os.environ["IDRA_CLIENT_ID"],
    client_secret=SECRET,
    server_metadata_url=f"{ISSUER}/.well-known/openid-configuration",
    client_kwargs={
        "scope": "openid profile email groups",
        "code_challenge_method": "S256",
        # With a secret: client_secret_basic. Without one: a public client.
        "token_endpoint_auth_method": "client_secret_basic" if SECRET else "none",
    },
)


@app.get("/")
def home():
    user = session.get("user")
    if not user:
        return '<h1>Signed out</h1><a href="/login">Sign in with IdRa</a>'
    body = json.dumps(user, indent=2).replace("<", "&lt;")
    return f'<h1>Signed in</h1><pre>{body}</pre><a href="/logout">Sign out</a>'


@app.get("/login")
def login():
    return idra.authorize_redirect(f"{APP_URL}/callback")


@app.get("/callback")
def callback():
    try:
        token = idra.authorize_access_token()
        # The ID token has no email or name: they come from UserInfo.
        session["user"] = dict(idra.userinfo(token=token))
        session["id_token"] = token["id_token"]
    except Exception as e:
        app.logger.exception("Sign-in failed")
        return f"Sign-in failed: {e}", 400
    return redirect("/")


@app.get("/logout")
def logout():
    id_token = session.get("id_token")
    session.clear()
    if not id_token:
        return redirect("/")
    query = urlencode({"id_token_hint": id_token, "post_logout_redirect_uri": f"{APP_URL}/"})
    return redirect(f"{idra.load_server_metadata()['end_session_endpoint']}?{query}")


if __name__ == "__main__":
    app.run(port=int(os.environ.get("PORT", 5050)))

set -a; source .env; set +a
python app.py