django-oauth2-codeflow 1.0.0__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (28) hide show
  1. django_oauth2_codeflow-1.0.0/CHANGELOG.md +138 -0
  2. django_oauth2_codeflow-1.0.0/LICENSE +21 -0
  3. django_oauth2_codeflow-1.0.0/OP.md +60 -0
  4. django_oauth2_codeflow-1.0.0/PKG-INFO +238 -0
  5. django_oauth2_codeflow-1.0.0/README.md +193 -0
  6. django_oauth2_codeflow-1.0.0/oauth2_authcodeflow/__init__.py +0 -0
  7. django_oauth2_codeflow-1.0.0/oauth2_authcodeflow/admin.py +3 -0
  8. django_oauth2_codeflow-1.0.0/oauth2_authcodeflow/apps.py +5 -0
  9. django_oauth2_codeflow-1.0.0/oauth2_authcodeflow/auth.py +253 -0
  10. django_oauth2_codeflow-1.0.0/oauth2_authcodeflow/conf.py +207 -0
  11. django_oauth2_codeflow-1.0.0/oauth2_authcodeflow/constants.py +25 -0
  12. django_oauth2_codeflow-1.0.0/oauth2_authcodeflow/management/__init__.py +0 -0
  13. django_oauth2_codeflow-1.0.0/oauth2_authcodeflow/management/commands/__init__.py +0 -0
  14. django_oauth2_codeflow-1.0.0/oauth2_authcodeflow/management/commands/oidc_urls.py +29 -0
  15. django_oauth2_codeflow-1.0.0/oauth2_authcodeflow/management/commands/purge_blacklisted_tokens.py +11 -0
  16. django_oauth2_codeflow-1.0.0/oauth2_authcodeflow/middleware.py +329 -0
  17. django_oauth2_codeflow-1.0.0/oauth2_authcodeflow/migrations/0001_initial.py +29 -0
  18. django_oauth2_codeflow-1.0.0/oauth2_authcodeflow/migrations/0002_auto_20210528_1422.py +18 -0
  19. django_oauth2_codeflow-1.0.0/oauth2_authcodeflow/migrations/0003_auto_20210528_1432.py +18 -0
  20. django_oauth2_codeflow-1.0.0/oauth2_authcodeflow/migrations/0004_blacklistedtoken_constraint.py +30 -0
  21. django_oauth2_codeflow-1.0.0/oauth2_authcodeflow/migrations/0005_alter_blacklistedtoken.py +28 -0
  22. django_oauth2_codeflow-1.0.0/oauth2_authcodeflow/migrations/__init__.py +0 -0
  23. django_oauth2_codeflow-1.0.0/oauth2_authcodeflow/models.py +75 -0
  24. django_oauth2_codeflow-1.0.0/oauth2_authcodeflow/py.typed +0 -0
  25. django_oauth2_codeflow-1.0.0/oauth2_authcodeflow/urls.py +14 -0
  26. django_oauth2_codeflow-1.0.0/oauth2_authcodeflow/utils.py +83 -0
  27. django_oauth2_codeflow-1.0.0/oauth2_authcodeflow/views.py +409 -0
  28. django_oauth2_codeflow-1.0.0/pyproject.toml +117 -0
django_oauth2_codeflow-1.0.0/CHANGELOG.md ADDED
@@ -0,0 +1,138 @@
1
+ # Changelog
2
+ All notable changes to this project will be documented in this file.
3
+
4
+ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.1.0/)
5
+ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
6
+
7
+ ## 1.2.3
8
+ ### Changed
9
+ - Security update for `python-jose` from version `3.3.0` to `3.4.0`
10
+
11
+ ## 1.2.2
12
+ ### Fixed
13
+ - 'Origin' header should NOT be present if the Azure app is not a SPA.
14
+ ### Added
15
+ - Explicit compatibility with django 5.1
16
+
17
+ ## 1.2.1
18
+ ### Fixed
19
+ - Fix a migration error from version `1.1.0` on a non-empty database (gitlab #26).
20
+ ### Added
21
+ - Explicit compatibility with django 5.1
22
+
23
+ ## 1.2.0
24
+ ### Security
25
+ - Security package upgrades
26
+ ### Fixed
27
+ - Azure tenant PKCE public app fix (Origin header was missing)
28
+ - Final fix for mysql on InnoDB with max key of 3072 by having the constraint as a lonely migration (github #21). Thanks Jurymax99 for the suggested merge request.
29
+ - Allow to logout even when using the Django `ModelBackend` (github #25)
30
+ ### Changed
31
+ - Do not send the client secret, even if defined, with `PKCE` by default (github #18)
32
+ This can be overriden with the `OIDC_RP_FORCE_SECRET_WITH_PKCE` parameter.
33
+ - Gitlab CI upgrades
34
+
35
+ ## 1.1.0
36
+ ### Fixed
37
+ - redirect after total logout could happen with a GET (#10)
38
+ - allow empty client secret (QE-625, gitlab #9)
39
+ ### Added
40
+ - User logged in signal doc example, thanks @pinoatrome (github #16)
41
+ - Drop python 3.7, support python 3.12 and django 5
42
+
43
+ ## 1.0.1
44
+ ### Fixed
45
+ - Fix timestamp-awareness inside `RefreshSession` and `RefreshAccessToken` middlewares
46
+
47
+ ## 1.0.0
48
+ ### Changed
49
+ - Each log (debug, warning, error) is now correctly bound to the module name.
50
+ - Mypy 1.0
51
+ ### Added
52
+ - Added documentation and changelog urls for PyPI
53
+
54
+ ## 0.9.0
55
+ ### Fixed
56
+ - Default value for `jwks` in `BearerAuthenticationBackend` should be dict, not a list.
57
+ - Fix blacklist expiration for token where seconds where used as hours
58
+ - Fix `_clear_cache` method in `CacheBaseView`: was not clearing the session correctly.
59
+ - Configuration cannot be updated when using unit tests. This is now fixed. No impact on lib usage.
60
+ - Respect the optional `fail` parameter of `@login_required` decorator.
61
+ - Middlewares should not inherit depraceted `MiddlewareMixin`.
62
+ - If user does not exist on request, should not crash in `Oauth2MiddlewareMixin.is_oidc_enabled`.
63
+ ### Changed
64
+ - Allow to override `MIN_SECONDS` in `RefreshSessionMiddleware`.
65
+ - Use UTC time in `RefreshAccessTokenMiddleware`, `RefreshSessionMiddleware`.
66
+ ### Added
67
+ - `LoginRequiredMiddleware`
68
+ - Documentation about `@login_required`
69
+ ### Removed
70
+ - `pytz` removed. `datetime.timezone.utc` is the only thing required.
71
+
72
+ ## 0.8.1
73
+ ### Fixed
74
+ - urls listed in `OIDC_MIDDLEWARE_NO_AUTH_URL_PATTERNS` will not be tried on authentication in `auth.py`
75
+
76
+ ## 0.8.0
77
+ ### Added
78
+ - Allow to specify `userinfo` and `id_token` individual claims to get along with the id token request if the OP supports it (Eric Plaster, mr !12).
79
+ ### Changed
80
+ - `OIDC_EXTEND_USER` callable can now takes a `request` and `access_token` as additional arguments (compatibility is assured).
81
+ - Migrate can raise an `IntegrityError` (ticket #7).
82
+ - All parameters that accept a function can also accept a dotted string to import the function.
83
+ - Migrate from `pipenv` to `poetry` system.
84
+
85
+ ## 0.7.0
86
+ ### Added
87
+ - Missing Django migration
88
+ ### Changed
89
+ - Allow Django 4.1+ (but not 5.0)
90
+ - Add Python 3.11 in classifier
91
+ - Dependencies upgrade
92
+
93
+ ## 0.6.0
94
+ ### Changed
95
+ - Allow usage with Django 4.0 and update classifiers
96
+ - Make the code compatible with Python 3.7
97
+
98
+ ## 0.5.0
99
+ ### Added
100
+ - Allow to scramble the password only when creating an account instead of each SSO connection/renewal
101
+
102
+ ## 0.4.0
103
+ ### Added
104
+ - Allow `user` extension with a callable using `claims`
105
+ ### Fixed
106
+ - User `email` field was filled with raw `email` value instead of actual value if `OIDC_EMAIL_CLAIM` was not set.
107
+
108
+ ## 0.3.2
109
+ ### Fixed
110
+ - No error 500 on expired authentication because the database session might not be found
111
+
112
+ ## 0.3.1
113
+ ### Fixed
114
+ - Prevent infinite redirect to authenticate view when using any middleware (session was not cleared properly)
115
+
116
+ ## 0.3.0
117
+ ### Changed
118
+ - Use `Authorization` header for `USERINFO` instead of request param
119
+ - `token` field in `BlacklistedToken` table changed from `TextField` to `CharField(max_length=15000)` for MySql compatibility
120
+ ### Fixed
121
+ - register json web keys to session only if not already registered
122
+ - fix error handling by adding required method parameter
123
+ - `email`, `first_name` and `last_name` cannot be None. Fallback to empty string.
124
+ - correctly check for status code ok when getting access token.
125
+
126
+ ## 0.2.1
127
+ ### Fixed
128
+ - fix doc about `SESSION_COOKIE_SECURE`
129
+ - fix typo in f-string
130
+
131
+ ## 0.2.0
132
+ ### Added
133
+ - OP.md with settings examples for multiple OIDC Providers
134
+ ### Fixed
135
+ - Management commands were not included in the package
136
+
137
+ ## 0.1.0
138
+ Initialize library
django_oauth2_codeflow-1.0.0/LICENSE ADDED
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2020 Systra / Qeto
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.
django_oauth2_codeflow-1.0.0/OP.md ADDED
@@ -0,0 +1,60 @@
1
+ Known working settings for OP
2
+ =============================
3
+
4
+ Here are presented settings known to work for a specific OIDC Provider.
5
+
6
+ `OIDC_RP_CLIENT_ID` and `OIDC_RP_CLIENT_SECRET` will not be listed.
7
+
8
+ Azure
9
+ -----
10
+
11
+ | Setting | Value |
12
+ | ------- | ----- |
13
+ | `OIDC_OP_DISCOVERY_DOCUMENT_URL` | `'https://login.microsoftonline.com/<tenant_id>/v2.0/.well-known/openid-configuration'` |
14
+ | `OIDC_DJANGO_USERNAME_FUNC` | `'myapp.utils.get_azure_django_username'` |
15
+
16
+ With the following definition in `myapp/utils.py` module:
17
+
18
+ ```python
19
+ def get_azure_django_username(claims):
20
+ return claims['oid']
21
+ ```
22
+
23
+ `oid` is a special Azure Object ID that uniquely identify the user.
24
+
25
+ Azure B2C
26
+ ---------
27
+
28
+ Azure B2C does not offer a termination point for user.
29
+
30
+ The configuration is similar to that of Azure AD but requires some small changes.
31
+
32
+
33
+ | Setting | Value |
34
+ | ------- | ----- |
35
+ | `OIDC_OP_DISCOVERY_DOCUMENT_URL` | `'https://<azure_b2c_endpoint>/v2.0/.well-known/openid-configuration'` |
36
+ | `OIDC_OP_FETCH_USER_INFO` | `False` |
37
+ | `OIDC_OP_EXPECTED_EMAIL_CLAIM` | `'emails'` |
38
+ | `OIDC_DJANGO_USERNAME_FUNC` | `'myapp.utils.get_azure_django_username'` |
39
+
40
+ With the same definition of `myappr.utils.get_azure_django_username` as above.
41
+
42
+ Gitlab
43
+ ------
44
+
45
+ | Setting | Value |
46
+ | ------- | ----- |
47
+ | `OIDC_OP_DISCOVERY_DOCUMENT_URL` | `'https://gitlab.com/.well-known/openid-configuration'` |
48
+ | `OIDC_RP_SCOPES` | ` = ['openid', 'email', 'profile']` |
49
+ | `OIDC_RP_USE_PKCE` | ` = False` |
50
+ | `OIDC_RP_FORCE_CONSENT` | ` = True` |
51
+ | `OIDC_FIRSTNAME_CLAIM` | ` = lambda claims: claims['name'].split(' ', 1)[0]` |
52
+ | `OIDC_LASTNAME_CLAIM` | ` = lambda claims: claims['name'].split(' ', 1)[1]` |
53
+ | `OIDC_DJANGO_USERNAME_FUNC` | `'myapp.utils.get_gitlab_django_username'` |
54
+
55
+ With the following definition in `myapp/utils.py` module:
56
+
57
+ ```python
58
+ def get_gitlab_django_username(claims):
59
+ return claims['nickname']
60
+ ```
django_oauth2_codeflow-1.0.0/PKG-INFO ADDED
@@ -0,0 +1,238 @@
1
+ Metadata-Version: 2.3
2
+ Name: django-oauth2-codeflow
3
+ Version: 1.0.0
4
+ Summary: Authenticate with any OpenId Connect/Oauth2 provider through authorization code flow. PKCE is also supported.
5
+ License: MIT
6
+ Keywords: oauth2,oidc,openid
7
+ Author: Melih Sünbül
8
+ Author-email: m.sunbul@excellence-cloud.com
9
+ Maintainer: Melih Sünbül
10
+ Maintainer-email: m.sunbul@excellence-cloud.com
11
+ Requires-Python: >=3.8,<4.0
12
+ Classifier: Development Status :: 5 - Production/Stable
13
+ Classifier: Environment :: Web Environment
14
+ Classifier: Framework :: Django
15
+ Classifier: Framework :: Django :: 4.2
16
+ Classifier: Framework :: Django :: 5.0
17
+ Classifier: Framework :: Django :: 5.1
18
+ Classifier: Framework :: Django :: 5.2
19
+ Classifier: Intended Audience :: Developers
20
+ Classifier: License :: OSI Approved :: MIT License
21
+ Classifier: Natural Language :: English
22
+ Classifier: Operating System :: OS Independent
23
+ Classifier: Programming Language :: Python :: 3
24
+ Classifier: Programming Language :: Python :: 3.8
25
+ Classifier: Programming Language :: Python :: 3.9
26
+ Classifier: Programming Language :: Python :: 3.10
27
+ Classifier: Programming Language :: Python :: 3.11
28
+ Classifier: Programming Language :: Python :: 3.12
29
+ Classifier: Programming Language :: Python :: 3.13
30
+ Classifier: Topic :: Internet :: WWW/HTTP :: Session
31
+ Classifier: Topic :: Security
32
+ Classifier: Topic :: Software Development :: Libraries :: Python Modules
33
+ Classifier: Typing :: Typed
34
+ Requires-Dist: django (>=4.2)
35
+ Requires-Dist: python-jose[cryptography] (>=3.3)
36
+ Requires-Dist: requests (>=2.28)
37
+ Project-URL: Bug Tracker, https://github.com/ExcellenceCloudGmbH/django-oauth2-codeflow/issues
38
+ Project-URL: Changelog, https://github.com/ExcellenceCloudGmbH/django-oauth2-codeflow/blob/master/CHANGELOG.md
39
+ Project-URL: Contributing, https://github.com/ExcellenceCloudGmbH/django-oauth2-codeflow/blob/master/CONTRIBUTING.md
40
+ Project-URL: Documentation, https://github.com/ExcellenceCloudGmbH/django-oauth2-codeflow/blob/master/README.md
41
+ Project-URL: Github mirror, https://github.com/ExcellenceCloudGmbH/django-oauth2-codeflow
42
+ Project-URL: Repository, https://github.com/ExcellenceCloudGmbH/django-oauth2-codeflow
43
+ Description-Content-Type: text/markdown
44
+
45
+ Summary
46
+ =======
47
+
48
+ [![pypi downloads][dl-image]][pypi-url]
49
+ [![pypi status][status-image]][pypi-url]
50
+ [![python versions][py-image]][pypi-url]
51
+ [![django versions][django-image]][pypi-url]
52
+ [![pipeline status][pipeline-image]][pipeline-url]
53
+ [![coverage status][coverage-image]][coverage-url]
54
+ [![license][license-image]](./LICENSE)
55
+
56
+ [pypi-url]: https://pypi.org/project/django-oauth2-authcodeflow/
57
+ [dl-image]: https://img.shields.io/pypi/dm/django-oauth2-authcodeflow
58
+ [status-image]: https://img.shields.io/pypi/status/django-oauth2-authcodeflow
59
+ [py-image]: https://img.shields.io/pypi/pyversions/django-oauth2-authcodeflow.svg
60
+ [django-image]: https://img.shields.io/pypi/djversions/django-oauth2-authcodeflow.svg
61
+ [pipeline-image]: https://gitlab.com/systra/qeto/lib/django-oauth2-authcodeflow/badges/master/pipeline.svg?ignore_skipped=true
62
+ [pipeline-url]: https://gitlab.com/systra/qeto/lib/django-oauth2-authcodeflow/-/commits/master
63
+ [coverage-image]: https://gitlab.com/systra/qeto/lib/django-oauth2-authcodeflow/badges/master/coverage.svg
64
+ [coverage-url]: https://gitlab.com/systra/qeto/lib/django-oauth2-authcodeflow/-/commits/master
65
+ [license-image]: https://img.shields.io/pypi/l/django-oauth2-authcodeflow.svg
66
+
67
+ Authenticate with any OpenId Connect/Oauth2 provider through authorization code flow with [Django](https://www.djangoproject.com/).
68
+
69
+ Supported protocols:
70
+
71
+ - [Oauth 2.0](https://www.rfc-editor.org/rfc/rfc6749)
72
+ - [PKCE](https://www.rfc-editor.org/rfc/rfc7636)
73
+ - [OpenIDConnect 1.0](https://openid.net/specs/openid-connect-rpinitiated-1_0.html)
74
+
75
+ Wording
76
+ -------
77
+
78
+ - OP = OpenId Connect Provider, the auth server
79
+ - RP = Relying Party, the client, your application
80
+
81
+ Setup
82
+ -----
83
+
84
+ - add `oauth2_authcodeflow` to the `INSTALLED_APPS` (after `django.contrib.auth` and `django.contrib.sessions` apps)
85
+ - add `path('oidc/', include('oauth2_authcodeflow.urls')),` in your global `urls.py` file.
86
+
87
+ You can change the path prefix to what you want
88
+
89
+ - add `oauth2_authcodeflow.auth.AuthenticationBackend` to the `AUTHENTICATION_BACKENDS` config.
90
+
91
+ You can keep `django.contrib.auth.backends.ModelBackend` as a second-fallback auth mechanism.
92
+
93
+ - get your callback urls by doing:
94
+ ```sh
95
+ ./manage.py oidc_urls [--secure] <HOST_NAME>
96
+ ```
97
+ - Configure your application on the OpenId Connect Provider.
98
+
99
+ This should give you a `client_id` and a `secret_id`.
100
+
101
+ You will need to fill the `redirect_url` and `logout_url` there.
102
+
103
+ - Ensue to include the `sid`, email, first name, last name (if applicable) parameters in the id token claims on the OP.
104
+ - Ensure that `django.contrib.sessions.middleware.SessionMiddleware` is in `MIDDLEWARE`
105
+
106
+ Minimal configuration
107
+ ---------------------
108
+
109
+ - `SESSION_COOKIE_SECURE` to `True` if your Django is served through *HTTPS*
110
+ - `OIDC_OP_DISCOVERY_DOCUMENT_URL` to the well-known openid configuration url of the OP
111
+ - `OIDC_RP_CLIENT_ID` client id provided by the OP
112
+ - `OIDC_RP_CLIENT_SECRET` secrect id provided by the OP
113
+
114
+ Login
115
+ -----
116
+
117
+ Get your browser/frontend to go to the `oidc_authentication` page name (`/oidc/authenticate` by default) with the following parameters:
118
+
119
+ - `next`: the url to redirect on success
120
+ - `fail`: the url to redirect on failure, `error` query string may contain an error description
121
+
122
+ Logout
123
+ ------
124
+
125
+ Get your browser/frontend to go to the `oidc_logout` page name (`/oidc/logout` by default) with the following parameters:
126
+
127
+ - `next`: the url to redirect on success
128
+ - `fail`: the url to redirect on failure, `error` query string may contain an error description
129
+
130
+ Logout from the OP as well
131
+ --------------------------
132
+
133
+ This will logout the user from the application but also from the OP (if user say yes) and the OP should also logout the user from all other apps connected to this OP.
134
+
135
+ The spec is not well followed by the OP, so you mileage may vary.
136
+
137
+ Get your browser/frontend to go to the `oidc_total_logout` page name (`/oidc/total_logout` by default) with the following parameters:
138
+
139
+ - `next`: the url to redirect on success
140
+ - `fail`: the url to redirect on failure, `error` query string may contain an error description
141
+
142
+ Protect your urls
143
+ -----------------
144
+
145
+ At least three options are possible.
146
+
147
+ 1. Use default django way to [limit access to logged-in users](https://docs.djangoproject.com/en/4.1/topics/auth/default/#limiting-access-to-logged-in-users) by defining `LOGIN_URL` in your settings and and `login_required` decorators in your views.
148
+ ```python
149
+ # settings.py
150
+ from django.urls import reverse_lazy
151
+ from django.utils.text import format_lazy
152
+ LOGIN_URL = format_lazy('{url}?fail=/', url=reverse_lazy(OIDC_URL_AUTHENTICATION_NAME))
153
+ # urls.py
154
+ from django.contrib.auth.decorators import login_required
155
+ path('restricted_url/', login_required(your_view)),
156
+ ```
157
+ 2. A slightly different version, by directly and only using the `login_required` from `oauth2_authcodeflow.utils`.
158
+ 3. Use the `LoginRequiredMiddleware` with `OIDC_MIDDLEWARE_NO_AUTH_URL_PATTERNS` configuration.
159
+
160
+ Optional middlewares
161
+ --------------------
162
+
163
+ You can add some middlewares to add some features:
164
+
165
+ - `oauth2_authcodeflow.middleware.LoginRequiredMiddleware` to automaticaly force a login request to urls not in `OIDC_MIDDLEWARE_NO_AUTH_URL_PATTERNS` if not authenticated.
166
+ - `oauth2_authcodeflow.middleware.RefreshAccessTokenMiddleware` to automaticaly refresh the access token when it’s expired.
167
+ - `oauth2_authcodeflow.middleware.RefreshSessionMiddleware` to automaticaly ask for a new id token when it’s considered expired.
168
+ - `oauth2_authcodeflow.middleware.BearerAuthMiddleware` to authenticate the user using `Authorization` HTTP header (API, scripts, CLI usage).
169
+
170
+ `LoginRequiredMiddleware` will refresh to the original page uppon user logged-in.
171
+
172
+ `RefreshAccessTokenMiddleware` and `RefreshSessionMiddleware` will try the refresh and return a redirect to the same page (or the one configured as next in the login phase) if the refresh cannot happen.
173
+
174
+ Use them to silently refresh your access/id tokens.
175
+
176
+ BearerAuthMiddleware will use `oauth2_authcodeflow.auth.BearerAuthenticationBackend` to authenticate the user based on `Authorization` HTTP header instead of using the sessions.
177
+
178
+ Use this to allow to authenticate without cookies/session. You then need to login with `from_cli=1` in your `login` url. You then needs to go to the displayed url with a browser and copy the result http header to make further requests.
179
+
180
+ Signals
181
+ -------
182
+
183
+ One can use Django `user_logged_in` and `user_logged_out` [signals](https://docs.djangoproject.com/en/5.0/ref/contrib/auth/#module-django.contrib.auth.signals) to know and act when a user is logged in or disconnected.
184
+
185
+ Full configuration
186
+ ------------------
187
+ Secure session cookie settings:
188
+
189
+ - `SESSION_COOKIE_AGE` to a reasonable time (default 2 weeks)
190
+ - `SESSION_COOKIE_HTTPONLY` **must** be `True` (default `True`)
191
+ - `SESSION_COOKIE_PATH` be sure to use `/` to prevent some weird behavior (default `/`)
192
+ - `SESSION_COOKIE_SAMESITE` **should** be `Lax` (default `Lax`)
193
+ - `SESSION_COOKIE_SECURE` **should** be `True` in *https* context (default `False`)
194
+
195
+ Specific OIDC settings:
196
+
197
+ | Settings | Description | Default |
198
+ | -------- | ----------- | ------- |
199
+ | `OIDC_OP_DISCOVERY_DOCUMENT_URL` | URL of your OpenID connect Provider discovery document url (*recommended*).<br>If you provide this, the following configs will be ignored:<br>- `OIDC_OP_AUTHORIZATION_URL`<br>- `OIDC_OP_TOKEN_URL`<br>- `OIDC_OP_USERINFO_URL`<br>- `OIDC_OP_JWKS_URL` | `None` |
200
+ | `OIDC_OP_AUTHORIZATION_URL` | URL of your OpenID connect Provider authorization endpoint (**not recommended**, `OIDC_OP_DISCOVERY_DOCUMENT_URL` is preferred). | `None` |
201
+ | `OIDC_OP_TOKEN_URL` | URL of your OpenID connect Provider token endpoint (**not recommended**, `OIDC_OP_DISCOVERY_DOCUMENT_URL` is preferred). | `None` |
202
+ | `OIDC_OP_USERINFO_URL` | URL of your OpenID connect Provider userinfo endpoint (**not recommended**, `OIDC_OP_DISCOVERY_DOCUMENT_URL` is preferred). | `None` |
203
+ | `OIDC_OP_JWKS_URL` | URL of your OpenId connect Provider endpoint to get public signing keys (in `PEM` or `DER` format).<br>This is used to verify the `id_token`.<br>This is **not recommended** to provide this url here but rather use `OIDC_OP_DISCOVERY_DOCUMENT_URL` config. | `None` |
204
+ | `OIDC_OP_END_SESSION_URL` | URL of your OpenID connect Provider end session endpoint (not recommended, `OIDC_OP_DISCOVERY_DOCUMENT_URL` is preferred). | `None` |
205
+ | `OIDC_OP_FETCH_USER_INFO` | Fetch user info on login or not. | `True` |
206
+ | `OIDC_OP_TOTAL_LOGOUT` | Do a call to total logout will call the OP for a logout. Default true.<br>Be careful, some OP will not follow the RFC and will not allow the user to NOT logout all connected apps.<br>Azure is such a bad example. | `True` |
207
+ | `OIDC_OP_EXPECTED_EMAIL_CLAIM` | expected email key. | `'email'` |
208
+ | `OIDC_OP_EXPECTED_CLAIMS` | `OIDC_OP_EXPECTED_EMAIL_CLAIM` value is automatically included in this list. | `[]` |
209
+ | `OIDC_RP_CLIENT_ID` | OpenID Connect client ID provided for your Relaying Party/client by your OpenIdConnect Provider | |
210
+ | `OIDC_RP_CLIENT_SECRET` | OpenID Connect client secret provided for your Relaying Party/client by your OpenIdConnect Provider.<br>Could be empty in PKCE case. | |
211
+ | `OIDC_RP_USE_PKCE` | `PKCE` improve security, disable it only if your provider cannot handle it. | `True` |
212
+ | `OIDC_RP_FORCE_SECRET_WITH_PKCE` | Force to send the client secret even when using `PKCE`.<br>Only use this option if your provider don’t support PKCE without secret. | `False` |
213
+ | `OIDC_RP_FORCE_CONSENT_PROMPT` | Force to ask for consent on login, even if `offline_access` is not in scopes | `False` |
214
+ | `OIDC_RP_AZURE_SPA` | Azure require the 'Origin' header when using PKCE and SPA | `False` |
215
+ | `OIDC_RP_SCOPES` | The OpenID Connect scopes to request during login.<br>The scopes could be usefull later to get access to other ressources.<br>`openid` must be in the list.<br>You can also include the `email` scope to ensure that the email field will be in the claims (*recommended*).<br>You can also include the `profile` scope to get more (like names, …) info in the `id_token` (*recommended*).<br>You can also get a `refresh_token` by specifying the `offline_access` scope. | `['openid', 'email', 'profile', 'offline_access']` |
216
+ | `OIDC_RP_USERINFO_CLAIMS` | OpenID Connect authorization [request parameter `userinfo` member](https://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter) to optionaly add to id token request (dict type). | `None` |
217
+ | `OIDC_RP_TOKEN_CLAIMS` | OpenID Connect authorization [request parameter `id_token` member](https://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter) to optionaly add to id token request (dict type). | `None` |
218
+ | `OIDC_RP_SIGN_ALGOS_ALLOWED` | Sets the algorithms the IdP may use to sign ID tokens.<br>Typical values ar `HS256` (no key required) and `RS256` (public key required)<br>The public keys might be defined in `OIDC_RP_IDP_SIGN_KEY` or deduced using the `OIDC_OP_JWKS_URL` config. | `['HS256', 'HS384', 'HS512', 'RS256', 'RS384', 'RS512']` |
219
+ | `OIDC_RP_IDP_SIGN_KEY` | Public RSA used to verify signatures. Overrides keys from JWKS endpoint.<br>Should be in `PEM` or `DER` format. | `None` |
220
+ | `OIDC_CREATE_USER` | Enables or disables automatic user creation during authentication | `True` |
221
+ | `OIDC_RANDOM_SIZE` | Sets the length of the random string used in the OAuth2 protocol. | `32` |
222
+ | `OIDC_PROXY` | Defines a proxy for all requests to the OpenID Connect provider (fetch JWS, retrieve JWT tokens, Userinfo Endpoint).<br>The default is set to `None` which means the library will not use a proxy and connect directly.<br>For configuring a proxy check the Python requests documentation: <https://requests.readthedocs.io/en/master/user/advanced/#proxies> | `None` |
223
+ | `OIDC_TIMEOUT` | Defines a timeout for all requests to the OpenID Connect provider (fetch JWS, retrieve JWT tokens, Userinfo Endpoint).<br>The default is set to `None` which means the library will wait indefinitely.<br>The time can be defined as seconds (integer).<br>More information about possible configuration values, see Python requests: <https://requests.readthedocs.io/en/master/user/quickstart/#timeouts> | `None` |
224
+ | `OIDC_REDIRECT_OK_FIELD_NAME` | Sets the GET parameter that is being used to define the redirect URL after succesful authentication | `'next'` |
225
+ | `OIDC_REDIRECT_ERROR_FIELD_NAME` | Sets the GET parameter that is being used to define the redirect URL after failed authentication | `'fail'` |
226
+ | `OIDC_DJANGO_USERNAME_FUNC` | Function or dotted path to a function that compute the django username based on claims.<br>The username should be unique for this app.<br>The default is to use a base64 url encode of the email hash (sha1). | `get_default_django_username` |
227
+ | `OIDC_EMAIL_CLAIM` | Claim name for email<br>`None` value means use `OIDC_OP_EXPECTED_EMAIL_CLAIM` value<br>You can also provide a lambda that takes all the claims as argument and return an email | `None` |
228
+ | `OIDC_FIRSTNAME_CLAIM` | You can also provide a lambda that takes all the claims as argument and return a firstname | `'given_name'` |
229
+ | `OIDC_LASTNAME_CLAIM` | You can also provide a lambda that takes all the claims as argument and return a lastname | `'family_name'` |
230
+ | `OIDC_EXTEND_USER` | Callable that takes the `user`, the `claims` and optionaly the `request` and `access_token` as arguments and that can extend user properties.<br>You can also specify a dotted path to a callable. | `None` |
231
+ | `OIDC_UNUSABLE_PASSWORD` | Scramble the password on each SSO connection/renewal.<br>If `False`, it will only scramble it when creating an account | `True` |
232
+ | `OIDC_BLACKLIST_TOKEN_TIMEOUT_SECONDS` | 7 days by default | `7 * 86400` |
233
+ | `OIDC_AUTHORIZATION_HEADER_PREFIX` | Only used when using authorization in header:<br>`Authorization: Bearer id_token`<br>This is only possible if `oauth2_authcodeflow.middleware.BearerAuthMiddleware` has been added to `MIDDLEWARE` setting list. | `'Bearer'` |
234
+ | `OIDC_MIDDLEWARE_NO_AUTH_URL_PATTERNS` | The `RefreshAccessTokenMiddleware` and `RefreshSessionMiddleware` will use this list to bypass auth checks.<br>Any url listed here will not be tried to be authenticated using Auth Code Flow.<br>You should include at least any failure/error or admin urls in it. | `[]` |
235
+ | `OIDC_MIDDLEWARE_LOGIN_REQUIRED_REDIRECT` | Redirect to login page if not authenticated when using `LoginRequiredMiddleware`. | `True` |
236
+ | `OIDC_MIDDLEWARE_API_URL_PATTERNS` | The `RefreshAccessTokenMiddleware` and `RefreshSessionMiddleware` will use this list to answer JSON response in case of refresh failure.<br>Expected list of regexp URL patterns. | `['^/api/']` |
237
+ | `OIDC_MIDDLEWARE_SESSION_TIMEOUT_SECONDS` | 7 days by default | `7 * 86400` |
238
+
django_oauth2_codeflow-1.0.0/README.md ADDED
@@ -0,0 +1,193 @@
1
+ Summary
2
+ =======
3
+
4
+ [![pypi downloads][dl-image]][pypi-url]
5
+ [![pypi status][status-image]][pypi-url]
6
+ [![python versions][py-image]][pypi-url]
7
+ [![django versions][django-image]][pypi-url]
8
+ [![pipeline status][pipeline-image]][pipeline-url]
9
+ [![coverage status][coverage-image]][coverage-url]
10
+ [![license][license-image]](./LICENSE)
11
+
12
+ [pypi-url]: https://pypi.org/project/django-oauth2-authcodeflow/
13
+ [dl-image]: https://img.shields.io/pypi/dm/django-oauth2-authcodeflow
14
+ [status-image]: https://img.shields.io/pypi/status/django-oauth2-authcodeflow
15
+ [py-image]: https://img.shields.io/pypi/pyversions/django-oauth2-authcodeflow.svg
16
+ [django-image]: https://img.shields.io/pypi/djversions/django-oauth2-authcodeflow.svg
17
+ [pipeline-image]: https://gitlab.com/systra/qeto/lib/django-oauth2-authcodeflow/badges/master/pipeline.svg?ignore_skipped=true
18
+ [pipeline-url]: https://gitlab.com/systra/qeto/lib/django-oauth2-authcodeflow/-/commits/master
19
+ [coverage-image]: https://gitlab.com/systra/qeto/lib/django-oauth2-authcodeflow/badges/master/coverage.svg
20
+ [coverage-url]: https://gitlab.com/systra/qeto/lib/django-oauth2-authcodeflow/-/commits/master
21
+ [license-image]: https://img.shields.io/pypi/l/django-oauth2-authcodeflow.svg
22
+
23
+ Authenticate with any OpenId Connect/Oauth2 provider through authorization code flow with [Django](https://www.djangoproject.com/).
24
+
25
+ Supported protocols:
26
+
27
+ - [Oauth 2.0](https://www.rfc-editor.org/rfc/rfc6749)
28
+ - [PKCE](https://www.rfc-editor.org/rfc/rfc7636)
29
+ - [OpenIDConnect 1.0](https://openid.net/specs/openid-connect-rpinitiated-1_0.html)
30
+
31
+ Wording
32
+ -------
33
+
34
+ - OP = OpenId Connect Provider, the auth server
35
+ - RP = Relying Party, the client, your application
36
+
37
+ Setup
38
+ -----
39
+
40
+ - add `oauth2_authcodeflow` to the `INSTALLED_APPS` (after `django.contrib.auth` and `django.contrib.sessions` apps)
41
+ - add `path('oidc/', include('oauth2_authcodeflow.urls')),` in your global `urls.py` file.
42
+
43
+ You can change the path prefix to what you want
44
+
45
+ - add `oauth2_authcodeflow.auth.AuthenticationBackend` to the `AUTHENTICATION_BACKENDS` config.
46
+
47
+ You can keep `django.contrib.auth.backends.ModelBackend` as a second-fallback auth mechanism.
48
+
49
+ - get your callback urls by doing:
50
+ ```sh
51
+ ./manage.py oidc_urls [--secure] <HOST_NAME>
52
+ ```
53
+ - Configure your application on the OpenId Connect Provider.
54
+
55
+ This should give you a `client_id` and a `secret_id`.
56
+
57
+ You will need to fill the `redirect_url` and `logout_url` there.
58
+
59
+ - Ensue to include the `sid`, email, first name, last name (if applicable) parameters in the id token claims on the OP.
60
+ - Ensure that `django.contrib.sessions.middleware.SessionMiddleware` is in `MIDDLEWARE`
61
+
62
+ Minimal configuration
63
+ ---------------------
64
+
65
+ - `SESSION_COOKIE_SECURE` to `True` if your Django is served through *HTTPS*
66
+ - `OIDC_OP_DISCOVERY_DOCUMENT_URL` to the well-known openid configuration url of the OP
67
+ - `OIDC_RP_CLIENT_ID` client id provided by the OP
68
+ - `OIDC_RP_CLIENT_SECRET` secrect id provided by the OP
69
+
70
+ Login
71
+ -----
72
+
73
+ Get your browser/frontend to go to the `oidc_authentication` page name (`/oidc/authenticate` by default) with the following parameters:
74
+
75
+ - `next`: the url to redirect on success
76
+ - `fail`: the url to redirect on failure, `error` query string may contain an error description
77
+
78
+ Logout
79
+ ------
80
+
81
+ Get your browser/frontend to go to the `oidc_logout` page name (`/oidc/logout` by default) with the following parameters:
82
+
83
+ - `next`: the url to redirect on success
84
+ - `fail`: the url to redirect on failure, `error` query string may contain an error description
85
+
86
+ Logout from the OP as well
87
+ --------------------------
88
+
89
+ This will logout the user from the application but also from the OP (if user say yes) and the OP should also logout the user from all other apps connected to this OP.
90
+
91
+ The spec is not well followed by the OP, so you mileage may vary.
92
+
93
+ Get your browser/frontend to go to the `oidc_total_logout` page name (`/oidc/total_logout` by default) with the following parameters:
94
+
95
+ - `next`: the url to redirect on success
96
+ - `fail`: the url to redirect on failure, `error` query string may contain an error description
97
+
98
+ Protect your urls
99
+ -----------------
100
+
101
+ At least three options are possible.
102
+
103
+ 1. Use default django way to [limit access to logged-in users](https://docs.djangoproject.com/en/4.1/topics/auth/default/#limiting-access-to-logged-in-users) by defining `LOGIN_URL` in your settings and and `login_required` decorators in your views.
104
+ ```python
105
+ # settings.py
106
+ from django.urls import reverse_lazy
107
+ from django.utils.text import format_lazy
108
+ LOGIN_URL = format_lazy('{url}?fail=/', url=reverse_lazy(OIDC_URL_AUTHENTICATION_NAME))
109
+ # urls.py
110
+ from django.contrib.auth.decorators import login_required
111
+ path('restricted_url/', login_required(your_view)),
112
+ ```
113
+ 2. A slightly different version, by directly and only using the `login_required` from `oauth2_authcodeflow.utils`.
114
+ 3. Use the `LoginRequiredMiddleware` with `OIDC_MIDDLEWARE_NO_AUTH_URL_PATTERNS` configuration.
115
+
116
+ Optional middlewares
117
+ --------------------
118
+
119
+ You can add some middlewares to add some features:
120
+
121
+ - `oauth2_authcodeflow.middleware.LoginRequiredMiddleware` to automaticaly force a login request to urls not in `OIDC_MIDDLEWARE_NO_AUTH_URL_PATTERNS` if not authenticated.
122
+ - `oauth2_authcodeflow.middleware.RefreshAccessTokenMiddleware` to automaticaly refresh the access token when it’s expired.
123
+ - `oauth2_authcodeflow.middleware.RefreshSessionMiddleware` to automaticaly ask for a new id token when it’s considered expired.
124
+ - `oauth2_authcodeflow.middleware.BearerAuthMiddleware` to authenticate the user using `Authorization` HTTP header (API, scripts, CLI usage).
125
+
126
+ `LoginRequiredMiddleware` will refresh to the original page uppon user logged-in.
127
+
128
+ `RefreshAccessTokenMiddleware` and `RefreshSessionMiddleware` will try the refresh and return a redirect to the same page (or the one configured as next in the login phase) if the refresh cannot happen.
129
+
130
+ Use them to silently refresh your access/id tokens.
131
+
132
+ BearerAuthMiddleware will use `oauth2_authcodeflow.auth.BearerAuthenticationBackend` to authenticate the user based on `Authorization` HTTP header instead of using the sessions.
133
+
134
+ Use this to allow to authenticate without cookies/session. You then need to login with `from_cli=1` in your `login` url. You then needs to go to the displayed url with a browser and copy the result http header to make further requests.
135
+
136
+ Signals
137
+ -------
138
+
139
+ One can use Django `user_logged_in` and `user_logged_out` [signals](https://docs.djangoproject.com/en/5.0/ref/contrib/auth/#module-django.contrib.auth.signals) to know and act when a user is logged in or disconnected.
140
+
141
+ Full configuration
142
+ ------------------
143
+ Secure session cookie settings:
144
+
145
+ - `SESSION_COOKIE_AGE` to a reasonable time (default 2 weeks)
146
+ - `SESSION_COOKIE_HTTPONLY` **must** be `True` (default `True`)
147
+ - `SESSION_COOKIE_PATH` be sure to use `/` to prevent some weird behavior (default `/`)
148
+ - `SESSION_COOKIE_SAMESITE` **should** be `Lax` (default `Lax`)
149
+ - `SESSION_COOKIE_SECURE` **should** be `True` in *https* context (default `False`)
150
+
151
+ Specific OIDC settings:
152
+
153
+ | Settings | Description | Default |
154
+ | -------- | ----------- | ------- |
155
+ | `OIDC_OP_DISCOVERY_DOCUMENT_URL` | URL of your OpenID connect Provider discovery document url (*recommended*).<br>If you provide this, the following configs will be ignored:<br>- `OIDC_OP_AUTHORIZATION_URL`<br>- `OIDC_OP_TOKEN_URL`<br>- `OIDC_OP_USERINFO_URL`<br>- `OIDC_OP_JWKS_URL` | `None` |
156
+ | `OIDC_OP_AUTHORIZATION_URL` | URL of your OpenID connect Provider authorization endpoint (**not recommended**, `OIDC_OP_DISCOVERY_DOCUMENT_URL` is preferred). | `None` |
157
+ | `OIDC_OP_TOKEN_URL` | URL of your OpenID connect Provider token endpoint (**not recommended**, `OIDC_OP_DISCOVERY_DOCUMENT_URL` is preferred). | `None` |
158
+ | `OIDC_OP_USERINFO_URL` | URL of your OpenID connect Provider userinfo endpoint (**not recommended**, `OIDC_OP_DISCOVERY_DOCUMENT_URL` is preferred). | `None` |
159
+ | `OIDC_OP_JWKS_URL` | URL of your OpenId connect Provider endpoint to get public signing keys (in `PEM` or `DER` format).<br>This is used to verify the `id_token`.<br>This is **not recommended** to provide this url here but rather use `OIDC_OP_DISCOVERY_DOCUMENT_URL` config. | `None` |
160
+ | `OIDC_OP_END_SESSION_URL` | URL of your OpenID connect Provider end session endpoint (not recommended, `OIDC_OP_DISCOVERY_DOCUMENT_URL` is preferred). | `None` |
161
+ | `OIDC_OP_FETCH_USER_INFO` | Fetch user info on login or not. | `True` |
162
+ | `OIDC_OP_TOTAL_LOGOUT` | Do a call to total logout will call the OP for a logout. Default true.<br>Be careful, some OP will not follow the RFC and will not allow the user to NOT logout all connected apps.<br>Azure is such a bad example. | `True` |
163
+ | `OIDC_OP_EXPECTED_EMAIL_CLAIM` | expected email key. | `'email'` |
164
+ | `OIDC_OP_EXPECTED_CLAIMS` | `OIDC_OP_EXPECTED_EMAIL_CLAIM` value is automatically included in this list. | `[]` |
165
+ | `OIDC_RP_CLIENT_ID` | OpenID Connect client ID provided for your Relaying Party/client by your OpenIdConnect Provider | |
166
+ | `OIDC_RP_CLIENT_SECRET` | OpenID Connect client secret provided for your Relaying Party/client by your OpenIdConnect Provider.<br>Could be empty in PKCE case. | |
167
+ | `OIDC_RP_USE_PKCE` | `PKCE` improve security, disable it only if your provider cannot handle it. | `True` |
168
+ | `OIDC_RP_FORCE_SECRET_WITH_PKCE` | Force to send the client secret even when using `PKCE`.<br>Only use this option if your provider don’t support PKCE without secret. | `False` |
169
+ | `OIDC_RP_FORCE_CONSENT_PROMPT` | Force to ask for consent on login, even if `offline_access` is not in scopes | `False` |
170
+ | `OIDC_RP_AZURE_SPA` | Azure require the 'Origin' header when using PKCE and SPA | `False` |
171
+ | `OIDC_RP_SCOPES` | The OpenID Connect scopes to request during login.<br>The scopes could be usefull later to get access to other ressources.<br>`openid` must be in the list.<br>You can also include the `email` scope to ensure that the email field will be in the claims (*recommended*).<br>You can also include the `profile` scope to get more (like names, …) info in the `id_token` (*recommended*).<br>You can also get a `refresh_token` by specifying the `offline_access` scope. | `['openid', 'email', 'profile', 'offline_access']` |
172
+ | `OIDC_RP_USERINFO_CLAIMS` | OpenID Connect authorization [request parameter `userinfo` member](https://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter) to optionaly add to id token request (dict type). | `None` |
173
+ | `OIDC_RP_TOKEN_CLAIMS` | OpenID Connect authorization [request parameter `id_token` member](https://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter) to optionaly add to id token request (dict type). | `None` |
174
+ | `OIDC_RP_SIGN_ALGOS_ALLOWED` | Sets the algorithms the IdP may use to sign ID tokens.<br>Typical values ar `HS256` (no key required) and `RS256` (public key required)<br>The public keys might be defined in `OIDC_RP_IDP_SIGN_KEY` or deduced using the `OIDC_OP_JWKS_URL` config. | `['HS256', 'HS384', 'HS512', 'RS256', 'RS384', 'RS512']` |
175
+ | `OIDC_RP_IDP_SIGN_KEY` | Public RSA used to verify signatures. Overrides keys from JWKS endpoint.<br>Should be in `PEM` or `DER` format. | `None` |
176
+ | `OIDC_CREATE_USER` | Enables or disables automatic user creation during authentication | `True` |
177
+ | `OIDC_RANDOM_SIZE` | Sets the length of the random string used in the OAuth2 protocol. | `32` |
178
+ | `OIDC_PROXY` | Defines a proxy for all requests to the OpenID Connect provider (fetch JWS, retrieve JWT tokens, Userinfo Endpoint).<br>The default is set to `None` which means the library will not use a proxy and connect directly.<br>For configuring a proxy check the Python requests documentation: <https://requests.readthedocs.io/en/master/user/advanced/#proxies> | `None` |
179
+ | `OIDC_TIMEOUT` | Defines a timeout for all requests to the OpenID Connect provider (fetch JWS, retrieve JWT tokens, Userinfo Endpoint).<br>The default is set to `None` which means the library will wait indefinitely.<br>The time can be defined as seconds (integer).<br>More information about possible configuration values, see Python requests: <https://requests.readthedocs.io/en/master/user/quickstart/#timeouts> | `None` |
180
+ | `OIDC_REDIRECT_OK_FIELD_NAME` | Sets the GET parameter that is being used to define the redirect URL after succesful authentication | `'next'` |
181
+ | `OIDC_REDIRECT_ERROR_FIELD_NAME` | Sets the GET parameter that is being used to define the redirect URL after failed authentication | `'fail'` |
182
+ | `OIDC_DJANGO_USERNAME_FUNC` | Function or dotted path to a function that compute the django username based on claims.<br>The username should be unique for this app.<br>The default is to use a base64 url encode of the email hash (sha1). | `get_default_django_username` |
183
+ | `OIDC_EMAIL_CLAIM` | Claim name for email<br>`None` value means use `OIDC_OP_EXPECTED_EMAIL_CLAIM` value<br>You can also provide a lambda that takes all the claims as argument and return an email | `None` |
184
+ | `OIDC_FIRSTNAME_CLAIM` | You can also provide a lambda that takes all the claims as argument and return a firstname | `'given_name'` |
185
+ | `OIDC_LASTNAME_CLAIM` | You can also provide a lambda that takes all the claims as argument and return a lastname | `'family_name'` |
186
+ | `OIDC_EXTEND_USER` | Callable that takes the `user`, the `claims` and optionaly the `request` and `access_token` as arguments and that can extend user properties.<br>You can also specify a dotted path to a callable. | `None` |
187
+ | `OIDC_UNUSABLE_PASSWORD` | Scramble the password on each SSO connection/renewal.<br>If `False`, it will only scramble it when creating an account | `True` |
188
+ | `OIDC_BLACKLIST_TOKEN_TIMEOUT_SECONDS` | 7 days by default | `7 * 86400` |
189
+ | `OIDC_AUTHORIZATION_HEADER_PREFIX` | Only used when using authorization in header:<br>`Authorization: Bearer id_token`<br>This is only possible if `oauth2_authcodeflow.middleware.BearerAuthMiddleware` has been added to `MIDDLEWARE` setting list. | `'Bearer'` |
190
+ | `OIDC_MIDDLEWARE_NO_AUTH_URL_PATTERNS` | The `RefreshAccessTokenMiddleware` and `RefreshSessionMiddleware` will use this list to bypass auth checks.<br>Any url listed here will not be tried to be authenticated using Auth Code Flow.<br>You should include at least any failure/error or admin urls in it. | `[]` |
191
+ | `OIDC_MIDDLEWARE_LOGIN_REQUIRED_REDIRECT` | Redirect to login page if not authenticated when using `LoginRequiredMiddleware`. | `True` |
192
+ | `OIDC_MIDDLEWARE_API_URL_PATTERNS` | The `RefreshAccessTokenMiddleware` and `RefreshSessionMiddleware` will use this list to answer JSON response in case of refresh failure.<br>Expected list of regexp URL patterns. | `['^/api/']` |
193
+ | `OIDC_MIDDLEWARE_SESSION_TIMEOUT_SECONDS` | 7 days by default | `7 * 86400` |