# 5.4 Securing a Python Application

ZTrust integrates with **Python** using **OpenID Connect (OIDC)** to handle authentication and authorization. This setup enables secure login and role-based access for your applications.

### Prerequisites

Before integrating your Spring Boot application with ZTrust, ensure the following are in place:

* **ZTrust SSO** – A running ZTrust instance that will act as the identity and access management provider.
* **Configured Realm and Client** – A realm and client must already be created in ZTrust, with the client configured for OIDC. These settings will be used by your Python app to authenticate users and validate tokens.

With these prerequisites, your application will be ready to establish a secure connection with ZTrust using OpenID Connect.

### Set up ZTrust

1. Log in to ZTrust Admin Console.\\

   <figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2F3CFYuMdQrGvZPh4mvkcp%2Fimage.png?alt=media&#x26;token=9079e2dd-a3bb-4d08-9098-253df7399217" alt=""><figcaption><p>Fig 5.4.a: Master realm welcome page</p></figcaption></figure>

2. Click on **Manage Realms** in the sidebar to view the list of realms available in your **ZTrust**.\\

   <figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FAeVUxDaUMgQmnQCTpMUr%2Fimage.png?alt=media&#x26;token=f7f3b7ea-5ec8-4e54-a154-7c63d41acf11" alt=""><figcaption><p>Fig 5.4.b: List of avalible realms under manage realms</p></figcaption></figure>

3. From the list of realms, select the **realm** where you want to integrate the Python Application.\\

   <figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FbXaN7CWO4K9CysxuHMZS%2Fimage.png?alt=media&#x26;token=fad61d41-6047-4f93-8f26-5a765d1f1fe6" alt=""><figcaption><p>Fig 5.4.c: Welcome to Demo realm</p></figcaption></figure>

4. From the left **sidebar**, navigate to the **Clients** section.\\

   <figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FzLIQGWWP8e1pOtG3ysBb%2Fimage.png?alt=media&#x26;token=55f3b23d-9037-4b21-81ae-fce5663d011c" alt="" width="96"><figcaption><p>Fig 5.4.d: Navigating to clients section in side bar</p></figcaption></figure>

5. You will see a list of **clients** (applications). Choose/ Create the **client** for which you want to secure Python Application.

   <figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FttHYZyuPI0rcn0tVpaY1%2Fimage.png?alt=media&#x26;token=da300fb0-bbd7-44de-aeb0-da039572a484" alt=""><figcaption><p>Fig 5.4.e: List of available clients</p></figcaption></figure>

6. After select your client, it will take you to the settings page

   <figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FJCOYp8cJCdfmtSDS6gfp%2Fimage.png?alt=media&#x26;token=79909526-fa70-421b-9bf0-7a1b4175388a" alt=""><figcaption><p>Fig 5.4.f: Client settings page</p></figcaption></figure>

7. Enter your application’s **redirect URL** in the **Valid Redirect URIs** field.\\

   <figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FsaKFca9umI7oth9lsqvR%2Fimage.png?alt=media&#x26;token=34c7e4f1-5338-4d74-980f-a6210d9d8614" alt=""><figcaption><p>Fig 5.4.g: In client settings tab general settings fields</p></figcaption></figure>

8. Then under **Capability** config turn on **Client authentication** and save\\

   <figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FtmgLB1TxpKk5cHyNVjJj%2Fimage.png?alt=media&#x26;token=73c4ece9-4b12-45a3-b2da-7de89e2d5919" alt="" width="563"><figcaption><p>Fig 5.4.h: In client settings tab capability config options</p></figcaption></figure>

9. You will now see a new tab enabled, called **Credentials**.

   <figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FJv4WE8S0Smys5dlq9kr0%2Fimage.png?alt=media&#x26;token=4fcca624-e941-427b-9482-dc8c84d2644c" alt=""><figcaption><p>Fig 5.4.i: Client settings tab</p></figcaption></figure>

10. Navigate to the **Credentials** tab, where you can view and copy the **Client Secret**.

    <figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FaTvNeGG19XnXkSRpHuBq%2Fimage.png?alt=media&#x26;token=a0290819-dd50-4c78-9b4c-2d22a23f884b" alt=""><figcaption><p>Fig 5.4.j: Navigating to Credentials tab</p></figcaption></figure>

11. With the ZTrust configuration complete, we can now move on to the Python side of the setup.

### Set up Python

**1. Load ZTrust Configuration**

The application reads ZTrust authentication details (URL, realm, client ID, secret) from  environment variables. &#x20;

```
ZTRUST_AUTH_URL = os.getenv("ZTRUST_AUTH_URL")
ZTRUST_REALM = os.getenv("ZTRUST_REALM")
ZTRUST_CLIENT_ID = os.getenv("ZTRUST_CLIENT_ID")
ZTRUST_CLIENT_SECRET = os.getenv("ZTRUST_CLIENT_SECRET")
```

**2. Fetch ZTrust Public Keys (JWKS)**

&#x20;  Python application retrieves ZTrust’s official public keys to validate tokens.

```
JWKS_URL = f"{ZTRUST_AUTH_URL}/realms/{ZTRUST_REALM}/protocol/openid-connect/certs"
jwks_data = requests.get(JWKS_URL).json()
```

**3. Validate User Token**

When a user logs in, ZTrust issues a JWT (JSON Web Token).The app verifies the token and extracts user identity details.

```python
def get_current_user(token: str = Depends(OAUTH2_SCHEME)) -> dict:
    payload = jwt.decode(
        token,
        key=get_public_key(token),
        algorithms=['RS256']
    )
```

**4. Enforce Role-Based Access**

User roles (e.g., Admin, SuperAdmin, User) are checked before allowing actions.

```python
def role_checker(required_role: list[str]):
    def wrapper(user: dict = Depends(get_current_user)):
        roles = user.get("realm_access", {}).get("roles", [])
        if not any(role in roles for role in required_role):
            raise HTTPException(status_code=403, detail="Missing required role")
        return user
    return wrapper
```

**5. Authentication & Security Dependencies**

To implement secure authentication and integration with ZTrust, the following Python libraries were used:

* python-jose (3.5.0) – For handling JWT (JSON Web Token) encoding, decoding, and validation.
* python-multipart (0.0.9) – For managing form data and file uploads in FastAPI requests.
* requests (2.32.3) – For making HTTP requests, such as retrieving ZTrust’s public keys (JWKS).
* python-dotenv (1.0.1) – For securely loading environment variables (authentication URLs, client IDs, secrets) without hardcoding them in the codebase.
