def createTemporaryCredentials(clientId, accessToken, start, expiry, scopes, name=None):
    """ Create a set of temporary credentials

    Callers should not apply any clock skew; clock drift is accounted for by
    auth service.

    clientId: the issuing clientId
    accessToken: the issuer's accessToken
    start: start time of credentials (datetime.datetime)
    expiry: expiration time of credentials, (datetime.datetime)
    scopes: list of scopes granted
    name: credential name (optional)

    Returns a dictionary in the form:
        { 'clientId': str, 'accessToken: str, 'certificate': str}
    """

    for scope in scopes:
        if not isinstance(scope, six.string_types):
            raise exceptions.TaskclusterFailure('Scope must be string')

    # Credentials can only be valid for 31 days.  I hope that
    # this is validated on the server somehow...

    if expiry - start > datetime.timedelta(days=31):
        raise exceptions.TaskclusterFailure('Only 31 days allowed')

    # We multiply times by 1000 because the auth service is JS and as a result
    # uses milliseconds instead of seconds
    cert = dict(
        version=1,
        scopes=scopes,
        start=calendar.timegm(start.utctimetuple()) * 1000,
        expiry=calendar.timegm(expiry.utctimetuple()) * 1000,
        seed=utils.slugId().encode('ascii') + utils.slugId().encode('ascii'),
    )

    # if this is a named temporary credential, include the issuer in the certificate
    if name:
        cert['issuer'] = utils.toStr(clientId)

    sig = ['version:' + utils.toStr(cert['version'])]
    if name:
        sig.extend([
            'clientId:' + utils.toStr(name),
            'issuer:' + utils.toStr(clientId),
        ])
    sig.extend([
        'seed:' + utils.toStr(cert['seed']),
        'start:' + utils.toStr(cert['start']),
        'expiry:' + utils.toStr(cert['expiry']),
        'scopes:'
    ] + scopes)
    sigStr = '\n'.join(sig).encode()

    if isinstance(accessToken, six.text_type):
        accessToken = accessToken.encode()
    sig = hmac.new(accessToken, sigStr, hashlib.sha256).digest()

    cert['signature'] = utils.encodeStringForB64Header(sig)

    newToken = hmac.new(accessToken, cert['seed'], hashlib.sha256).digest()
    newToken = utils.makeB64UrlSafe(utils.encodeStringForB64Header(newToken)).replace(b'=', b'')

    return {
        'clientId': name or clientId,
        'accessToken': newToken,
        'certificate': utils.dumpJson(cert),
    }
def createTemporaryCredentials ( clientId , accessToken , start , expiry , scopes , name = None ) : for scope in scopes : if not isinstance ( scope , six . string_types ) : raise exceptions . TaskclusterFailure ( 'Scope must be string' ) if expiry - start > datetime . timedelta ( days = 31 ) : raise exceptions . TaskclusterFailure ( 'Only 31 days allowed' ) cert = dict ( version = 1 , scopes = scopes , start = calendar . timegm ( start . utctimetuple ( ) ) * 1000 , expiry = calendar . timegm ( expiry . utctimetuple ( ) ) * 1000 , seed = utils . slugId ( ) . encode ( 'ascii' ) + utils . slugId ( ) . encode ( 'ascii' ) , ) if name : cert [ 'issuer' ] = utils . toStr ( clientId ) sig = [ 'version:' + utils . toStr ( cert [ 'version' ] ) ] if name : sig . extend ( [ 'clientId:' + utils . toStr ( name ) , 'issuer:' + utils . toStr ( clientId ) , ] ) sig . extend ( [ 'seed:' + utils . toStr ( cert [ 'seed' ] ) , 'start:' + utils . toStr ( cert [ 'start' ] ) , 'expiry:' + utils . toStr ( cert [ 'expiry' ] ) , 'scopes:' ] + scopes ) sigStr = '\n' . join ( sig ) . encode ( ) if isinstance ( accessToken , six . text_type ) : accessToken = accessToken . encode ( ) sig = hmac . new ( accessToken , sigStr , hashlib . sha256 ) . digest ( ) cert [ 'signature' ] = utils . encodeStringForB64Header ( sig ) newToken = hmac . new ( accessToken , cert [ 'seed' ] , hashlib . sha256 ) . digest ( ) newToken = utils . makeB64UrlSafe ( utils . encodeStringForB64Header ( newToken ) ) . replace ( b'=' , b'' ) return { 'clientId' : name or clientId , 'accessToken' : newToken , 'certificate' : utils . dumpJson ( cert ) , }
Create a set of temporary credentials

    Callers should not apply any clock skew; clock drift is accounted for by
    auth service.

    clientId: the issuing clientId
    accessToken: the issuer's accessToken
    start: start time of credentials (datetime.datetime)
    expiry: expiration time of credentials, (datetime.datetime)
    scopes: list of scopes granted
    name: credential name (optional)

    Returns a dictionary in the form:
        { 'clientId': str, 'accessToken: str, 'certificate': str}