Authentication Validation Service
Relevant source files
The following files were used as context for generating this wiki page:
The Authentication Validation Service is a core component of the flext-oracle-oic extension, responsible for managing, refreshing, and validating OAuth2 credentials required to interact with Oracle Integration Cloud (OIC). It ensures that all requests to the OIC API are authorized through a robust client credentials flow, including token lifecycle management and validation against defined security constraints.
This service integrates with the broader FLEXT ecosystem by utilizing unified models for configuration and railway-oriented programming patterns for error handling. It provides a secure bridge between local configurations and Oracle's Identity and Access Management (IDCS/IAM) systems.
Sources: src/flext_oracle_oic/api.py:35-43, src/flext_oracle_oic/ext_client.py:23-31
Service Architecture and Mixins
The authentication logic is distributed across a facade and specific mixins to provide a clean API surface. The FlextOracleOicAuthMixin provides the primary interface for service-level token operations, delegating actual execution to an internal authenticator or client.
Authentication Flow
The service follows a standard OAuth2 Client Credentials flow. The FlextOracleOicClient manages the state of the access token and handles the low-level HTTP Basic authentication required to request new tokens.
The diagram illustrates the internal sequence for acquiring a valid OAuth2 token using client credentials.
Sources: src/flext_oracle_oic/ext_client.py:112-120, src/flext_oracle_oic/ext_client.py:279-301
Data Models and Validation
Authentication requires specific configuration parameters validated via Pydantic models. The OICAuthConfig model ensures that sensitive data like client secrets are handled as secret strings and that URLs are correctly formatted.
Key Configuration Fields
| Field | Type | Description |
|---|---|---|
oauth_client_id | str | The unique identifier for the OAuth client application. |
oauth_client_secret | SecretStr | The secret key for the OAuth client (masked in logs). |
oauth_token_url | str | The identity service endpoint for token issuance. |
oauth_scope | str | The permission scope requested (e.g., urn:opc:resource:consumer:all). |
Sources: tests/unit/test_models.py:20-35, src/flext_oracle_oic/ext_client.py:164-173
Validation Logic
The FlextOracleOicUtilitiesAuthenticationValidation utility provides static methods to verify credentials before they are used in network calls. This includes checking minimum lengths and regex patterns for client IDs.
# Example validation constraints from constants
MIN_CLIENT_ID_LENGTH: Final[int] = 1
MIN_CLIENT_SECRET_LENGTH: Final[int] = 8
CLIENT_ID_RE: Final[t.RegexPattern] = re.compile(r"^[a-zA-Z0-9_\-\.]+$")
Sources: src/flext_oracle_oic/constants.py:214-219, src/flext_oracle_oic/_utilities/authentication_validation.py
Token Management Operations
The service exposes two primary operations through the FlextOracleOicAuthMixin: token refreshing and token validation. These methods wrap the internal client operations in a result container (p.Result) to handle network failures gracefully.
Token Refreshing
The refresh_auth_token method attempts to obtain a new token from the identity provider. It checks if the authenticator is initialized and verifies the presence of the required refresh functionality.
Sources: src/flext_oracle_oic/services/auth.py:21-38
Token Validation
The validate_auth_token method checks the validity of a provided token. In the context of OIC, this often involves a local check or a lightweight call to a validation endpoint.
Sources: src/flext_oracle_oic/services/auth.py:40-57
This flowchart shows the error handling logic within the authentication mixin.
Sources: src/flext_oracle_oic/services/auth.py:25-38
Implementation Details
The FlextOracleOicClient is the primary executor for authentication. It performs credential encoding and manages the authenticated FlextApi instance.
Credential Encoding
Credentials are encoded using Base64 for the Authorization: Basic header during the token request.
def encode_client_credentials(self) -> str:
client_id = self.auth_config.oauth_client_id
client_secret = self.auth_config.oauth_client_secret.get_secret_value()
credentials = f"{client_id}:{client_secret}"
return base64.b64encode(credentials.encode()).decode()
Sources: src/flext_oracle_oic/ext_client.py:88-93
API Request Authentication
Once a token is obtained, it is injected into the headers of every subsequent API request to OIC using the Bearer token scheme.
Sources: src/flext_oracle_oic/ext_client.py:228-240
Conclusion
The Authentication Validation Service ensures that communication between the FLEXT extension and Oracle Integration Cloud remains secure and authorized. By centralizing token acquisition, validation, and lifecycle management, it abstracts the complexity of OIC's identity requirements from the business logic of integration management.