django-sanction 0.1.0

Provider agnostic

There is no assumption made about what providers should be accounted for (as in the core sanction module). This means that while providers that follow the OAuth2 spec should be handled by default, deviant providers may have to have custom implementations for certain handlers (see stackexchange and facebook examples in the examples directory). This also means that the user will need to have at least a basic understanding of OAuth2 and provider implementations. However, the upside is that the library is flexible in that library maintenance does not need to occur in order to support new OAuth2 providers.

Persistence agnostic

django_sanction doesn’t care if you use the provided django_sanction.models.User model (which is an extension of the contrib.auth User model) or a custom nonrel user class, as long as a few required attributes exist on the model:

• access_token Resource access token granted by the OAuth2 provider

• expires The token expiry date (if applicable, will be set to -1 if non-expiring)

• provider_id The user ID as specified by the OAuth2 provider. This is a required field in the OAuth2 spec (while e-mail addresses are not).

• provider_key The key (or name) or the provider used for a given user. This is used in order to look up the provider in the application’s settings.py file.

Flexible

While most functionality is accounted for and provided out of the box, django_sanction is flexible where it makes sense to be. See the settings section for more details.

Required settings

Define a list of providers in your settings.py file:

OAUTH2_PROVIDERS = {
    "google": {
        "client_id": "421833888173.apps.googleusercontent.com",
        "client_secret": "VueqKFZyz-aoL4rQFleEIT1j",
        "auth_endpoint": "https://accounts.google.com/o/oauth2/auth",
        "token_endpoint": "https://accounts.google.com/o/oauth2/token",
        "resource_endpoint": "https://www.googleapis.com/oauth2/v1",
        "scope": ("email", "https://www.googleapis.com/auth/userinfo.profile",)
    },
    "facebook": {
        "client_id": "152107704926343",
        "client_secret": "80c81e4d7d5bc68ecc8cf1da0213382e",
        "auth_endpoint": "https://www.facebook.com/dialog/oauth",
        "token_endpoint": "https://graph.facebook.com/oauth/access_token",
        "resource_endpoint": "https://graph.facebook.com",
        "scope": ("email",),
        "parser": parse_url
    },
}

As django_sanction and its parent module sanction are provider- agnostic, you must supply the relevant data for each.

Authentication

Implement an authentication routine (see the example project for implementation details) and add it to your settings file:

OAUTH2_AUTH_FN = "example.auth.authenticate"

Backend

Add the authentication backend to your settings:

AUTHENTICATION_BACKENDS = (
    "django_sanction.backends.AuthenticationBackend",
)

django_sanction will play nicely with authentication backends, so it’s perfectly valid to have multiple backends listed here.

Installed application

Add django_sanction to your list of INSTALLED_APPS:

INSTALLED_APPS = (
    # ...
    "django_sanction",
)

URLs

Add this to your urls:

urlpatterns = pattenrs("",
    # o/ can be sustituted for anything
    url(r'^o/", include(django_sanction.urls)),
)

Resource middleware

By using the ResourceMiddleware, a fully usable sanction Client will be added to the current request.user.

Add the middleware:

MIDDLEWARE_CLASSES = (
    # ...
    "django_sanction.middleware.ResourceMiddleware"
)

Access resources (i.e. Facebook) once a user has been authenticated:

request.user.resource.request("/me")