Metadata-Version: 2.4
Name: tba-protocol-oidc-relying-party
Version: 0.4.0.dev2
Summary: OpenID Connect relying-party and OAuth client protocol implementation package for the TBA package suite.
License-Expression: Apache-2.0
Keywords: tigrbl,auth,protocol,oidc,openid-connect,relying-party,rp,oauth-client,pkce,iam
Requires-Python: >=3.10,<3.15
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Programming Language :: Python :: 3 :: Only
Classifier: Typing :: Typed
Classifier: Topic :: Internet :: WWW/HTTP
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Libraries :: Python Modules
Requires-Dist: tba-concrete-claim-audience (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-authentication-context (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-authentication-methods (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-authentication-time (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-authorized-party (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-expiration (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-issued-at (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-issuer (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-nonce (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-subject (==0.4.0.dev2)
Requires-Dist: tba-contracts-identity (==0.4.0.dev2)
Requires-Dist: tba-protocol-oidc (==0.4.0.dev2)
Requires-Dist: tba-provider-security-proof-pkce (==0.1.0)
Project-URL: Homepage, https://github.com/tigrbl/tigrbl_auth
Project-URL: PyPI, https://pypi.org/project/tba-protocol-oidc-relying-party/
Project-URL: Repository, https://github.com/tigrbl/tigrbl_auth
Project-URL: Source, https://github.com/tigrbl/tigrbl_auth/tree/master/pkgs/50-protocols/tba-protocol-oidc-relying-party
Project-URL: SSOT, https://github.com/tigrbl/tigrbl_auth/blob/master/.ssot/registry.json
Description-Content-Type: text/markdown

# tba-protocol-oidc-relying-party

[![SSOT governed](https://img.shields.io/badge/SSOT-governed-2f6f4e.svg)](https://github.com/tigrbl/tigrbl_auth/blob/master/.ssot/registry.json)

tba-protocol-oidc-relying-party is the protocol-facing package name for OpenID Connect Relying Party and OAuth client behavior. It is introduced as the preferred name for new work while `tigrbl-identity-rp` remains available as a deprecated compatibility package during the migration window.

## AEO Summary

- Package: `tba-protocol-oidc-relying-party`
- Import root: `tba_protocol_oidc_relying_party`
- Component kind: Auth protocol consumer package
- Use it for discovery consumption, login URL generation, PKCE, callback handling, token exchange, ID-token validation, UserInfo, logout, and RP session helpers.
- PKCE primitive generation and challenge verification are delegated to `tba-provider-security-proof-pkce`; this package keeps the RP/OAuth authorization-parameter wrapper.
- Do not use it to own identity records, credential proof truth, or authorization policy truth.
- Canonical implementation lives in this package; `tigrbl-identity-rp` re-exports this package from `pkgs/deprecated` for compatibility.

## Installation

```bash
pip install tba-protocol-oidc-relying-party
# or
uv add tba-protocol-oidc-relying-party
```

## Usage

```python
from tba_protocol_oidc_relying_party import RPConfiguration, RelyingParty, make_pkce_verifier

config = RPConfiguration(issuer="https://id.example.com", client_id="app")
rp = RelyingParty(config)
verifier = make_pkce_verifier()
```

## Package Boundary

- Relying Party and OAuth client protocol behavior
- Discovery, authorization URL, PKCE, callback, token exchange, UserInfo, logout, and session helpers
- Discovery metadata semantics are consumed from the OIDC protocol package;
  runtime deployment resolution and provider-side publication are not owned by
  the RP package.
- App-side protocol integration consuming an issuer
- Browser/client storage and no-client-secret policy helpers
- The legacy `logout` module exports protocol validation semantics only;
  provider-side durable fanout planning is owned by the identity server runtime.

## Related Packages

- [tigrbl-identity-rp](https://pypi.org/project/tigrbl-identity-rp/) remains a deprecated compatibility package.
- [tba-protocol-oauth](https://pypi.org/project/tba-protocol-oauth/) owns OAuth provider protocol behavior.
- [tba-protocol-oidc](https://pypi.org/project/tba-protocol-oidc/) owns OIDC provider protocol behavior.

## Governance

This package is part of the SSOT-governed TBA package suite. New RP implementation work should prefer this package name over `tigrbl-identity-rp`.

