如何在Python 3.8（Odoo框架）中解码SSO JWT Token？

在Python 3.8的Odoo框架中，尝试使用标准jwt库解码SSO JWT Token时遇到错误，代码及报错信息如下：

代码实现 #

import jwt

def _auth_oauth_get_tokens_implicit_flow(self, params):
    print("-----------------------")
    print(params)
    print("----------------------")
    token_data = params.get('response_type').split('?token_data=')[1]
    decoded_data = jwt.decode(jwt=token_data, key='secret', algorithms=["HS256"])
    print(decoded_data)

报错回溯 #

-----------------------
{'response_type': 'code?token_data=eyJhY2Nlc3NfdG9rZW4iOiJzRXQ1ZUxjTnFiUTdSOU9wYXI1Sm1ONVZWalk0ZlRLUVE4dEt0bGdhbklaIiwiZXhwaXJlc19pbiI6MzYwMCwiaWRfdG9rZW4iOiJleUpoYkdjaU9pSlNVekkxTmlJc0luUjVjQ0k2SWtwWFZDSjkuZXlKMWMyVnlTV1FpT2pRME5URXNJbVZ0WVdsc0lqb2lWa3N4TmsxQldVRkhSVTVEV1VCNWIzQnRZV2xzTG1OdmJTSXNJbTVoYldVaU9pSldTekUyVFVGWklFRkhSVTVEV1NJc0luVnpaWEpVZVhCbElqb3lMQ0p5YjJ4bFNXUWlPaklzSW1WdVlXSnNaV1F5Wm1FaU9pSXdJaXdpZG1WeWFXWnBaV1F5Wm1FaU9uUnlkV1VzSW5SdmEyVnVJam9pY0hVME56VmtjbUowY0RFMk9EYzBPVE0xTlRBNU5UbHBkRzU2TUhGd05tNTBOVzFpZFd0bGVXNTJiWEUwZHpSa09XUnFJaXdpWVdkbGJtTjVJanB1ZFd4c0xDSjBjbUZrWlhKUVpYSnpiMjRpT201MWJHd3NJbk5sYzNOcGIyNUpaQ0k2TVRBM05URXNJblJwYldWNmIyNWxJam9pUVhOcFlTOURZV3hqZFhSMFlTSXNJbkJvYjI1bFEyOWtaU0k2T1RFc0luQm9iMjVsSWpvaU9UZ3hNekE1T0RFek1TSXNJbWxoZENJNk1UWTROelE1TXpVMU1Dd2laWGh3SWpveE56SXpPVFE1TXpVMU1IMC5EaWZkam96TzZJUGpnT1dacDhYeVA3TnZLV1BMRXg1VHpRWkptbEFiWEZtdUhKd2dvQjhaOUg4TkZ5SXJ4UVhSN2hvY0VGZ2JPRGVxR0RITUQtODROS0d5WmFQLTdFb3lDVk9fMzVIMjYtRHVNWWs5ZVhadUtHUVhXemMtNEpmelYwRnAzY2JkeDRiQ3hKVlltZC0zZXN4cnRrYm1TRkw2bkhXcGd4cmEwREVidUN1aEFDcnlyeWNSdzU2Rm1mVlNEb3JJU0tOY1JKeF9aSUlPTDVJNlBKWWxfek5ONWIteVNieDFxeTktSF8zdUtYblBBeG42UlhjNFYtZ1BiaUhsU0JVUFNjN19Kb0I3dXhUT2hOenYtTnZrVnhqTzI0ZW5YVkg0Z1NpMDBVdnFFSTBDZ2lfMzVMVkZ6b1dZMXRCLXo2UTN0YlE1Q015NlJJelZEaFg4alEiLCJzY29wZSI6Im9wZW5pZCIsInRva2VuX3R5cGUiOiJCZWFyZXIifQ=='}
----------------------
2023-06-23 04:12:31,015 77080 ERROR dev_v6 odoo.http: Exception during request handling. 
Traceback (most recent call last):
  File "/opt/odoo16/odoo-venv/lib/python3.8/site-packages/jwt/api_jws.py", line 250, in _load
    signing_input, crypto_segment = jwt.rsplit(b".", 1)
ValueError: not enough values to unpack (expected 2, got 1)


File "/opt/odoo16/odoo-venv/lib/python3.8/site-packages/jwt/api_jws.py", line 253, in _load
    raise DecodeError("Not enough segments") from err
jwt.exceptions.DecodeError: Not enough segments

问题根源 #

你提取的token_data是URL安全Base64编码的JSON字符串，并非标准JWT格式（JWT由Header、Payload、Signature三部分用.分隔组成）。

修复步骤 #

1. 对提取到的Base64字符串进行解码，得到原始JSON数据
2. 从JSON中取出真正的JWT字段（如access_token或id_token）
3. 使用真实JWT调用jwt.decode方法

修正后的代码 #

import jwt
import base64
import json

def _auth_oauth_get_tokens_implicit_flow(self, params):
    print("-----------------------")
    print(params)
    print("----------------------")
    # 提取Base64编码的token数据
    token_data_b64 = params.get('response_type').split('?token_data=')[1]
    # 补充Base64缺失的填充字符
    token_data_b64 += '=' * (-len(token_data_b64) % 4)
    # URL安全Base64解码并转成JSON
    token_data_json = base64.urlsafe_b64decode(token_data_b64).decode('utf-8')
    token_data = json.loads(token_data_json)
    print("解析后的Token数据:", token_data)
    
    # 提取实际的JWT（根据你的JSON结构选择对应字段）
    actual_jwt = token_data.get('access_token') or token_data.get('id_token')
    if not actual_jwt:
        raise ValueError("未找到有效的JWT Token")
    
    # 解码JWT，可先关闭签名验证确认有效性，后续再替换真实密钥开启验证
    decoded_data = jwt.decode(
        jwt=actual_jwt, 
        key='secret', 
        algorithms=["HS256"], 
        options={"verify_signature": False}
    )
    print("解码后的JWT数据:", decoded_data)

注意事项 #

• 必须使用urlsafe_b64decode处理URL中的Base64编码（自动替换-为+、_为/）
• 替换'secret'为SSO提供商提供的真实密钥，算法需与SSO配置一致
• 调试阶段可关闭签名验证，确认Token有效后再开启

内容的提问来源于stack exchange，提问作者hardik device