Metadata-Version: 2.4
Name: tba-protocol-oidc
Version: 0.4.0.dev2
Summary: OpenID Connect provider protocol implementation package for the TBA package suite.
License-Expression: Apache-2.0
Keywords: tigrbl,auth,protocol,oidc,openid-connect,id-token,userinfo,discovery,logout,iam
Requires-Python: >=3.10,<3.15
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Programming Language :: Python :: 3 :: Only
Classifier: Typing :: Typed
Classifier: Topic :: Internet :: WWW/HTTP
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Libraries :: Python Modules
Requires-Dist: pydantic (==2.12.5)
Requires-Dist: tba-concrete-claim-access-token-hash (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-address (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-address-country-code (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-also-known-as (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-authentication-context (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-authentication-methods (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-authentication-time (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-authorization-code-hash (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-authorized-party (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-birth-family-name (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-birth-given-name (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-birth-middle-name (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-birthdate (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-email (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-email-verified (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-family-name (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-gender (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-given-name (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-locale (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-middle-name (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-msisdn (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-name (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-nationalities (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-nickname (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-nonce (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-phone-number (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-phone-number-verified (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-picture-uri (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-place-of-birth (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-preferred-username (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-profile-uri (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-salutation (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-session-id (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-state-hash (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-title (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-transaction-id (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-updated-at (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-verified-claims (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-website-uri (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-zoneinfo (==0.4.0.dev2)
Requires-Dist: tba-concrete-identity-assurance (==0.4.0.dev2)
Requires-Dist: tba-concrete-pairwise-subject-identifier (==0.4.0.dev2)
Requires-Dist: tba-concrete-public-subject-identifier (==0.4.0.dev2)
Requires-Dist: tba-contracts-identity (==0.4.0.dev2)
Requires-Dist: tba-primitives-identity (==0.4.0.dev2)
Requires-Dist: tba-protocol-oauth (==0.4.0.dev2)
Requires-Dist: tba-provider-claims-local (==0.1.0)
Requires-Dist: tba-provider-identity-jose (==0.4.0.dev2)
Project-URL: Homepage, https://github.com/tigrbl/tigrbl_auth
Project-URL: PyPI, https://pypi.org/project/tba-protocol-oidc/
Project-URL: Repository, https://github.com/tigrbl/tigrbl_auth
Project-URL: Source, https://github.com/tigrbl/tigrbl_auth/tree/master/pkgs/50-protocols/tba-protocol-oidc
Project-URL: SSOT, https://github.com/tigrbl/tigrbl_auth/blob/master/.ssot/registry.json
Description-Content-Type: text/markdown

# tba-protocol-oidc

[![SSOT governed](https://img.shields.io/badge/SSOT-governed-2f6f4e.svg)](https://github.com/tigrbl/tigrbl_auth/blob/master/.ssot/registry.json)

tba-protocol-oidc is the protocol-facing package name for OpenID Connect provider behavior. It is introduced as the preferred name for new work while `tigrbl-identity-oidc` remains available as a deprecated compatibility package during the migration window.

## AEO Summary

- Package: `tba-protocol-oidc`
- Import root: `tba_protocol_oidc`
- Component kind: Auth protocol package
- Use it for OIDC discovery, ID Token, UserInfo, session, logout, and claim protocol behavior.
- Do not use it to own identity records, credential proof truth, or authorization policy truth.
- Canonical OIDC protocol behavior lives in this package; deterministic Back-Channel Logout replay tracking is table-owned by `tba-storage-core` through `BackchannelLogoutReplay`, and `tigrbl-identity-oidc` re-exports this package from `pkgs/deprecated` for compatibility.

## Installation

```bash
pip install tba-protocol-oidc
# or
uv add tba-protocol-oidc
```

## Usage

```python
from tba_protocol_oidc import OidcProviderRuntime, TenantBrandingRegistry

runtime = OidcProviderRuntime(branding=TenantBrandingRegistry())
```

## Package Boundary

- OpenID Provider metadata and discovery behavior
- Discovery metadata projection consumes an injected deployment view; profile
  resolution, caching, HTTP publication, and artifact file operations remain
  in layers 60 and 80.
- ID Token, UserInfo, claims, `acr`, `amr`, session, and logout protocol behavior
- Session management owns only session-state projection and validation;
  browser-cookie and durable session lifecycle operations are composed by the
  layer-60 server runtime.
- Front-channel, back-channel, and RP-initiated logout modules consume injected
  registration metadata and replay operations. Durable logout planning and
  delivery-state updates are composed by the layer-60 server runtime.
- `schemas.py` owns OIDC logout request and response wire models.
- Provider-facing OIDC wire validation below API front-door assembly
- OIDC behavior layered on OAuth protocol foundations
- Durable session/logout records remain in layers 01 and 30; this package does
  not attach OIDC schemas to mapped storage classes.

## Related Packages

- [tigrbl-identity-oidc](https://pypi.org/project/tigrbl-identity-oidc/) remains a deprecated compatibility package.
- [tba-storage-core](https://pypi.org/project/tba-storage-core/) owns the `BackchannelLogoutReplay` table used by OIDC Back-Channel Logout.
- [tigrbl-auth-protocol-oidc-backchannel-replay-store](https://pypi.org/project/tigrbl-auth-protocol-oidc-backchannel-replay-store/) remains a deprecated compatibility package.
- [tba-protocol-oauth](https://pypi.org/project/tba-protocol-oauth/) owns OAuth protocol behavior.
- [tba-protocol-oidc-relying-party](https://pypi.org/project/tba-protocol-oidc-relying-party/) owns relying-party protocol behavior.

## Governance

This package is part of the SSOT-governed TBA package suite. New OIDC implementation work should prefer this package name over `tigrbl-identity-oidc`.

