Add OAuth 2.0 support for BTP ABAP Environment (Steampunk)

sap/adt/core.py

@@ -101,7 +101,8 @@ class Connection:
     """
 
     # pylint: disable=too-many-arguments
-    def __init__(self, host, client, user, password, port=None, ssl=True, verify=True, ssl_server_cert=None):
+    def __init__(self, host, client, user, password, port=None, ssl=True, verify=True, ssl_server_cert=None,
+                 token_url=None, client_id=None, client_secret=None):
         """Parameters:
             - host: string host name
             - client: string SAP client
@@ -124,10 +125,13 @@ def __init__(self, host, client, user, password, port=None, ssl=True, verify=Tru
             port=port,
             user=user,
             password=password,
-            saml2=False,
+            saml2=None if (token_url and client_id and client_secret) else False,
             client=client,
             verify=verify,
             ssl_server_cert=ssl_server_cert,
+            token_url=token_url,
+            client_id=client_id,
+            client_secret=client_secret,
             # This must be the default login path because newer ABAP systems
             # did not return cookies and CSRF token with the old default login
             # path (GET /sap/bc/adt/discovery) and thus did not work with

sap/cli/__init__.py

@@ -129,7 +129,10 @@ def adt_connection_from_args(args):
     return sap.adt.Connection(
         args.ashost, args.client, args.user, args.password,
         port=args.port, ssl=args.ssl, verify=args.verify,
-        ssl_server_cert=args.ssl_server_cert)
+        ssl_server_cert=args.ssl_server_cert,
+        token_url=getattr(args, 'token_url', None),
+        client_id=getattr(args, 'client_id', None),
+        client_secret=getattr(args, 'client_secret', None))
 
 
 def rfc_connection_from_args(args):
@@ -202,6 +205,9 @@ def build_empty_connection_values():
         ssl_server_cert=None,
         user=None,
         password=None,
+        token_url=None,
+        client_id=None,
+        client_secret=None,
     )
 
 
@@ -285,6 +291,15 @@ def resolve_default_connection_values(args):
     if not args.password:
         args.password = os.getenv('SAP_PASSWORD') or config_values.get('password')
 
+    if not getattr(args, 'token_url', None):
+        args.token_url = os.getenv('SAP_TOKEN_URL') or config_values.get('token_url')
+
+    if not getattr(args, 'client_id', None):
+        args.client_id = os.getenv('SAP_CLIENT_ID') or config_values.get('client_id')
+
+    if not getattr(args, 'client_secret', None):
+        args.client_secret = os.getenv('SAP_CLIENT_SECRET') or config_values.get('client_secret')
+
     if hasattr(args, 'corrnr') and args.corrnr is None:
         args.corrnr = os.getenv('SAP_CORRNR')
 

sap/cli/_entry.py

@@ -16,6 +16,7 @@
 import sap.rfc
 from sap.config import ConfigFile
 from sap.http import TimedOutRequestError as HttpTimedOutRequestError
+from sap.http.oauth import get_cached_token, get_cached_refresh_token
 from sap.odata.errors import TimedOutRequestError as ODataTimedOutRequestError
 
 # pylint: disable=invalid-name
@@ -157,7 +158,15 @@ def parse_command_line(argv):
         if not args.user:
             args.user = input('Login:')
 
-        if not args.password:
+        token_url = getattr(args, 'token_url', None)
+        client_id = getattr(args, 'client_id', None)
+        has_valid_token = (
+            token_url and client_id and (
+                get_cached_token(token_url, client_id) or
+                get_cached_refresh_token(token_url, client_id)
+            )
+        )
+        if not args.password and not has_valid_token:
             args.password = getpass.getpass()
 
     return args

sap/config.py

@@ -23,6 +23,7 @@ class SAPCliConfigError(SAPCliError):
     'ashost', 'sysnr', 'client', 'port', 'ssl', 'ssl_verify',
     'ssl_server_cert', 'mshost', 'msserv', 'sysid', 'group',
     'snc_qop', 'snc_myname', 'snc_partnername', 'snc_lib',
+    'token_url', 'client_id', 'client_secret',
 )
 
 USER_FIELDS = (

sap/http/client.py

@@ -2,14 +2,26 @@
 
 import requests
 import requests.exceptions
-from requests.auth import HTTPBasicAuth
+from requests.auth import AuthBase, HTTPBasicAuth
 
 from sap import get_logger, config_get
 from sap.http.errors import (
     HTTPRequestError,
     UnauthorizedError,
     TimedOutRequestError,
 )
+from sap.http.oauth import get_token
+
+
+class BearerAuth(AuthBase):
+    """Requests auth handler that injects an OAuth 2.0 Bearer token."""
+
+    def __init__(self, token):
+        self._token = token
+
+    def __call__(self, r):
+        r.headers['Authorization'] = f'Bearer {self._token}'
+        return r
 
 
 def build_query_args(client=None, saml2=None):
@@ -63,7 +75,10 @@ def __init__(self,
                  verify=None,
                  ssl_server_cert=None,
                  login_path='',
-                 login_method='HEAD'
+                 login_method='HEAD',
+                 token_url=None,
+                 client_id=None,
+                 client_secret=None,
                  ):
 
         self.ssl = ssl
@@ -91,7 +106,11 @@ def __init__(self,
 
         self.timeout = config_get('http_timeout')
 
-        self._auth = HTTPBasicAuth(user, password)
+        if token_url and client_id and client_secret:
+            token = get_token(token_url, client_id, client_secret, user=user, password=password)
+            self._auth = BearerAuth(token)
+        else:
+            self._auth = HTTPBasicAuth(user, password)
 
         self.error_handlers = [default_http_error_handler]
         self._connection_error_handler = None

sap/http/oauth.py

@@ -0,0 +1,129 @@
+"""OAuth 2.0 password grant flow with token caching for BTP Steampunk."""
+
+import json
+import os
+import time
+from pathlib import Path
+
+import requests
+
+TOKEN_CACHE_PATH = Path('~/.sapcli/tokens.json').expanduser()
+REFRESH_MARGIN = 60
+
+
+# ---------------------------------------------------------------------------
+# Token cache
+# ---------------------------------------------------------------------------
+
+def _load_token_cache():
+    try:
+        with open(TOKEN_CACHE_PATH, 'r', encoding='utf-8') as f:
+            return json.load(f)
+    except (OSError, json.JSONDecodeError):
+        return {}
+
+
+def _save_token_cache(cache):
+    TOKEN_CACHE_PATH.parent.mkdir(parents=True, exist_ok=True)
+    fd = os.open(TOKEN_CACHE_PATH, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, 'w', encoding='utf-8') as f:
+        json.dump(cache, f, indent=2)
+
+
+def _cache_key(token_url, client_id):
+    return f'{token_url}|{client_id}'
+
+
+def get_cached_token(token_url, client_id):
+    cache = _load_token_cache()
+    entry = cache.get(_cache_key(token_url, client_id))
+    if not entry:
+        return None
+    if time.time() > entry.get('expires_at', 0) - REFRESH_MARGIN:
+        return None
+    return entry['access_token']
+
+
+def get_cached_refresh_token(token_url, client_id):
+    cache = _load_token_cache()
+    entry = cache.get(_cache_key(token_url, client_id))
+    if not entry:
+        return None
+    return entry.get('refresh_token')
+
+
+def save_token_response(token_url, client_id, token_response):
+    cache = _load_token_cache()
+    expires_in = token_response.get('expires_in', 3600)
+    cache[_cache_key(token_url, client_id)] = {
+        'access_token': token_response['access_token'],
+        'refresh_token': token_response.get('refresh_token'),
+        'expires_at': time.time() + expires_in,
+    }
+    _save_token_cache(cache)
+
+
+# ---------------------------------------------------------------------------
+# Token refresh
+# ---------------------------------------------------------------------------
+
+def refresh_access_token(token_url, client_id, client_secret, refresh_token):
+    response = requests.post(
+        token_url.rstrip('/') + '/oauth/token',
+        auth=(client_id, client_secret),
+        data={'grant_type': 'refresh_token', 'refresh_token': refresh_token},
+        timeout=30,
+    )
+    if not response.ok:
+        return None
+    token_data = response.json()
+    save_token_response(token_url, client_id, token_data)
+    return token_data['access_token']
+
+
+# ---------------------------------------------------------------------------
+# Interactive password grant
+# ---------------------------------------------------------------------------
+
+def fetch_token_with_credentials(token_url, client_id, client_secret, user, password):
+    """Obtain a Bearer token via OAuth 2.0 password grant using provided credentials."""
+
+    response = requests.post(
+        token_url.rstrip('/') + '/oauth/token',
+        auth=(client_id, client_secret),
+        data={
+            'grant_type': 'password',
+            'username': user,
+            'password': password,
+        },
+        timeout=30,
+    )
+
+    if not response.ok:
+        raise RuntimeError(
+            f'OAuth login failed ({response.status_code}): {response.text}'
+        )
+
+    token_data = response.json()
+    save_token_response(token_url, client_id, token_data)
+    return token_data['access_token']
+
+
+# ---------------------------------------------------------------------------
+# Entry point
+# ---------------------------------------------------------------------------
+
+def get_token(token_url, client_id, client_secret, user=None, password=None):
+    """Return a valid Bearer token — from cache, refresh, or credentials grant."""
+
+    token = get_cached_token(token_url, client_id)
+    if token:
+        return token
+
+    refresh_token = get_cached_refresh_token(token_url, client_id)
+    if refresh_token:
+        token = refresh_access_token(token_url, client_id, client_secret, refresh_token)
+        if token:
+            return token
+
+    return fetch_token_with_credentials(token_url, client_id, client_secret, user, password)