Install & Compatibility
Where this runs
tested against v1.7.0 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslpy 3.10–3.920 runs
installs and imports cleanly · install 0.0s · import 0.000s · 63.6MB
glibcpy 3.10–3.920 runs
installs and imports cleanly · install 6.2s · import 0.000s · 64MB
64MB installed
● package 64MB
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
Client
✓ from oic import Client
✗ from oic.oic.client import Client
This quickstart demonstrates the initial steps of setting up an OIDC Relying Party (client) using `oic`: client initialization, provider discovery, and generating the authorization request URL. For a full authentication flow, a web server is required to handle the redirect URI and process the authorization code exchange.
import os
from oic.oic.client import Client
from oic.utils.keyio import KeyJar
# Configure these environment variables for a real flow
ISSUER = os.environ.get("OIDC_ISSUER", "https://accounts.google.com")
CLIENT_ID = os.environ.get("OIDC_CLIENT_ID", "your_client_id_here")
CLIENT_SECRET = os.environ.get("OIDC_CLIENT_SECRET", "your_client_secret_here")
REDIRECT_URI = os.environ.get("OIDC_REDIRECT_URI", "http://localhost:8080/cb")
# 1. Initialize the OIDC Client
# A KeyJar is essential for managing cryptographic keys (e.g., for JWTs)
keyjar = KeyJar()
client = Client(client_id=CLIENT_ID, client_secret=CLIENT_SECRET, keyjar=keyjar)
print(f"Initialized OIDC Client for issuer: {ISSUER}")
try:
# 2. Discover the OIDC Provider's configuration
# This fetches endpoints, supported algorithms, etc., from the issuer.
client.provider_config(ISSUER)
print(f"Discovered OIDC Provider config for {ISSUER}")
print(f"Authorization endpoint: {client.authorization_endpoint}")
# 3. Construct an Authorization Request
# This generates the URL to which the user's browser should be redirected.
auth_req = client.construct_AuthorizationRequest(
request_args={
"scope": ["openid", "profile", "email"], # Request standard OIDC scopes
"redirect_uri": REDIRECT_URI,
"response_type": ["code"], # Request an authorization code
"state": "some_random_state_string", # CSRF protection
"nonce": "another_random_nonce_string", # Replay attack protection for ID Tokens
}
)
login_url = auth_req.request(client.authorization_endpoint)
print(f"\nUser should be redirected to:\n{login_url}")
print("\nAfter user authenticates, they will be redirected back to `REDIRECT_URI`")
print("with `code`, `state` (and potentially `id_token`, `access_token`) parameters.")
print("Further steps involve handling this redirect and exchanging the code for tokens.")
except Exception as e:
print(f"An error occurred during client setup or discovery: {e}")
print("Ensure `OIDC_ISSUER`, `OIDC_CLIENT_ID`, `OIDC_CLIENT_SECRET` are correctly configured.")
print("For a full OIDC flow, a web server is required to handle redirects.")
Upgrade
Version history
1.7.0latest on PyPI · released Apr 25, 2024
Audit
Dependencies
requestsrequiredHTTP client for network communication with OIDC providers.
pycryptodomerequiredCryptographic primitives for token signing/encryption and key management.
Jinja2requiredUsed for templating, especially in examples and potentially internal message structures.
pydanticrequiredData validation and settings management; used for message parsing and validation.