Skip to main content

A Django OpenID Connect (OIDC) authentication backend

Project description

This module makes it easy to integrate OpenID Connect as an authentication source in a Django project.

Behind the scenes, it uses Roland Hedberg’s great pyoidc library.

Modified by JHUAPL BOSS to support Python3

Modified by Thomas Frössman with fixes and additional modifications.

Quickstart

Install djangooidc:

# Latest (pre) release
pip install django-oidc-tf


# Latest code - unstable!
pip install git+https://github.com/thomasf/django-oidc.git

Then to use it in a Django project, add this to your urls.py:

url(r'openid/', include('djangooidc.urls')),

Then add the following items to your settings.py:

  • add ‘djangooidc.backends.OpenIdConnectBackend’ to AUTHENTICATION_BACKENDS after the default ‘django.contrib.auth.backends.ModelBackend’

  • set LOGIN_URL = ‘openid’

  • add the specific OIDC parameters (change the absolute URLs to yours):

    # Information used when registering the client, this may be the same for all OPs
    # Ignored if auto registration is not used.
    OIDC_DYNAMIC_CLIENT_REGISTRATION_DATA = {
        "application_type": "web",
        "contacts": ["ops@example.com"],
        "redirect_uris": ["http://localhost:8000/openid/callback/login/", ],
        "post_logout_redirect_uris": ["http://localhost:8000/openid/callback/logout/", ]
    }
    
    # Default is using the 'code' workflow, which requires direct connectivity from your website to the OP.
    OIDC_DEFAULT_BEHAVIOUR = {
        "response_type": "code",
        "scope": ["openid", "profile", "email", "address", "phone"],
    }

The configuration above is enough to use OIDC providers (OP) that support discovery and self client registration. In addition, you may want to use a specific OpenID Connect provider that is not auto-discoverable. This is done by adding items to the OIDC_PROVIDERS dictionary. See full documentation for parameter names.

For example, an Azure AD OP would be:

OIDC_PROVIDERS = {
    "Azure Active Directory": {
        "srv_discovery_url": "https://sts.windows.net/aaaaaaaa-aaaa-1111-aaaa-xxxxxxxxxxxxx/",
        "behaviour": OIDC_DEFAULT_BEHAVIOUR,
        "client_registration": {
            "client_id": "your_client_id",
            "client_secret": "your_client_secret",
            "redirect_uris": ["http://localhost:8000/openid/callback/login/"],
            "post_logout_redirect_uris": ["http://localhost:8000/openid/callback/logout/"],
        }
    }
}

You may now test the authentication by going to (on the development server) http://localhost:8000/openid/login or to any of your views that requires authentication.

Features

  • Ready to use Django authentication backend

  • No models stored in database - just some configuration in settings.py to keep it simple

  • Fully integrated with Django’s internal accounts and permission system

  • Support for all OIDC workflows: Authorization Code flow, Implicit flow, Hybrid flow. Don’t worry if you don’t know what these are - the package comes with great defaults.

  • Includes logout at the provider level

History

0.1.0 (2015-05-08)

  • First release

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

django-oidc-tf-0.0.7.tar.gz (17.5 kB view hashes)

Uploaded Source

Built Distribution

django_oidc_tf-0.0.7-py3-none-any.whl (16.8 kB view hashes)

Uploaded Python 3

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page