Skip to content

cmem_client.auth_provider.client_credentials¤

Client Credentials OAuth 2.0 flow authentication provider.

This module implements the Client Credentials Flow authentication method for accessing eccenca Corporate Memory via OAuth 2.0. This flow is designed for machine-to-machine authentication where no user interaction is required.

The Client Credentials Flow exchanges client ID and client secret for an access token directly with the authorization server. It’s ideal for backend services, APIs, and automated systems that need to authenticate without user involvement.

This implementation handles token caching and automatic renewal when tokens expire.

Classes:

Attributes:

ClientCredentialsFlow¤

ClientCredentialsFlow(config, client_id, client_secret)

Bases: AuthProvider

Client Credentials OAuth 2.0 flow authentication provider.

Implements the Client Credentials Flow (RFC 6749, section 4.4) for machine-to-machine authentication with Corporate Memory via Keycloak. This flow exchanges client credentials (client ID and secret) directly for access tokens without user interaction.

The provider handles automatic token caching and refresh, ensuring that get_access_token() always returns a valid, non-expired token. It’s designed for backend services, CLIs, daemons, and other automated systems that need to authenticate as an application rather than on behalf of a user.

Attributes:

  • client_id (str) – The OAuth 2.0 client identifier for the application.
  • client_secret (str) – The confidential client secret for authentication.
  • config (Config) – Corporate Memory configuration containing endpoint URLs.
  • httpx (Client) – HTTP client for making token requests to the OAuth server.
  • token (KeycloakToken) – Currently cached Keycloak token with expiration tracking.
See Also

https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-credentials-flow https://tools.ietf.org/html/rfc6749#section-4.4

Functions:

  • fetch_new_token – Fetch a new access token from the OAuth 2.0 token endpoint.
  • from_cmempy – Create a Client Credentials Flow provider from a cmempy environment.
  • from_context – Create an authentication provider from a cmem-plugin-base context object.
  • from_dict – Create a Client Credentials Flow provider from a plain dictionary.
  • from_env – Create a Client Credentials Flow provider from environment variables.
  • get_access_token – Get the access token for Bearer Authorization header.

Creates a new provider instance and immediately fetches an initial access token. The provider will handle token refresh automatically when needed.

Parameters:

  • config (Config) – Corporate Memory configuration containing OAuth endpoint URLs and other connection details.
  • client_id (str) – The OAuth 2.0 client identifier registered with the authorization server.
  • client_secret (str) – The confidential client secret associated with the client_id for authentication.

Raises:

  • HTTPError – If the initial token request fails due to network issues or invalid credentials.
  • ValidationError – If the token response cannot be parsed as a valid Keycloak token.
Note

The constructor makes an immediate HTTP request to fetch the initial token, so ensure network connectivity and valid credentials before instantiation.

client_id¤

client_id: str = client_id

OAuth 2.0 client identifier used to identify the application to the authorization server.

client_secret¤

client_secret: str = client_secret

Confidential client secret used to authenticate the application with the OAuth server.

config¤

config: Config = config

Corporate Memory configuration containing OAuth token endpoint and other URLs.

fetch_new_token¤

fetch_new_token()

Fetch a new access token from the OAuth 2.0 token endpoint.

Makes an HTTP POST request to the Keycloak token endpoint using the Client Credentials Flow parameters. The response is parsed and returned as a KeycloakToken object with automatic expiration tracking.

Returns:

Raises:

  • HTTPError – If the token request fails due to network issues, invalid credentials, or server errors.
  • ValidationError – If the token response cannot be parsed as a valid Keycloak token format.
Note

This method performs a synchronous HTTP request and should not be called directly in most cases. Use get_access_token() instead, which handles caching and only calls this method when necessary.

Implementation Details
  • Uses the standard OAuth 2.0 Client Credentials Flow parameters
  • Sends credentials in the request body (not in Authorization header)
  • Automatically decodes the JSON response and validates the format
  • Extracts JWT claims for expiration tracking

from_cmempy¤

from_cmempy(config)

Create a Client Credentials Flow provider from a cmempy environment.

from_context¤

from_context(context)

Create an authentication provider from a cmem-plugin-base context object.

Wraps the token callable exposed by the context’s UserContext in a ProvidedToken provider.

Parameters:

  • context (object) – An ExecutionContext or PluginContext instance from cmem-plugin-base. Must expose a user attribute (UserContext) with a token() method that returns a valid bearer token.

Returns:

  • AuthProvider – A ProvidedToken authentication provider backed by the
  • AuthProvider – context’s UserContext.token() method.

from_dict¤

from_dict(config, d)

Create a Client Credentials Flow provider from a plain dictionary.

Parameters:

  • config (Config) – Corporate Memory configuration containing OAuth endpoint URLs.
  • d (dict[str, str]) – Dictionary of configuration values. Expected keys: OAUTH_CLIENT_ID (optional, defaults to "cmem-service-account") and OAUTH_CLIENT_SECRET (required).

Returns:

Raises:

from_env¤

from_env(config)

Create a Client Credentials Flow provider from environment variables.

This factory method creates a provider instance by reading OAuth client credentials from environment variables. It’s the recommended way to create providers in production environments where credentials are managed externally.

Parameters:

  • config (Config) – Corporate Memory configuration containing OAuth endpoint URLs.

Returns:

Raises:

Environment Variables

OAUTH_CLIENT_ID (optional): The OAuth 2.0 client identifier. Defaults to “cmem-service-account” if not specified. OAUTH_CLIENT_SECRET (required): The confidential client secret for authentication. Must be provided.

Security Note

Client secrets should be stored securely and never committed to version control. Use environment variables or secure secret management systems in production.

get_access_token¤

get_access_token()

Get the access token for Bearer Authorization header.

Also sets the preferred username for the authentication provider via the extracted token.

Returns:

  • str – A valid access token string.

Raises:

  • ValueError – If the provider returned no access token.
Note

Implementations should handle token refresh logic internally when tokens expire, ensuring this method always returns a valid token.

httpx¤

httpx: httpx.Client = httpx.Client(verify=config.verify, headers=config.extra_headers)

HTTP client instance used for making requests to the OAuth token endpoint.

logger¤

logger: logging.Logger = logging.getLogger(__name__)

Logger object for logging.

preferred_username¤

preferred_username: str

The preferred username for the authentication provider.

token¤

token: KeycloakToken = self.fetch_new_token()

Currently cached access token with automatic expiration tracking and JWT parsing.

DEFAULT_OAUTH_CLIENT_SECRET¤

DEFAULT_OAUTH_CLIENT_SECRET = 'c8c12828-000c-467b-9b6d-2d6b5e16df4a'

Comments