Package: astronauth
ASTRONauthDjango App for quickly adding authentication to any Django app.astronauthis based on theallauthpackage and updates the templates for follow the Design in ASTRON style (DIAS).InstallationThe package is available on pypi:pipinstallastronauthDjango SettingsThe following settings are the minimal settings required (also check thesettings.pyfile.):SITE_IDis used byallauth, usually it can be set to1without any issue. See theDjango documentationfor more info.INSTALLED_APPS: make sureastronauthis listed beforeallauthsince it overrides templatesINSTALLED_APPS=[# These are the default and should already be included'django.contrib.admin','django.contrib.auth','django.contrib.contenttypes','django.contrib.sessions','django.contrib.messages','django.contrib.staticfiles',"my_app",# if you override any of the templates, this should be here (e.g. custom navigation bar)## These are required for ASTRONauth'django.contrib.sites',"astronauth",# it is important that astronauth is included before allauth'allauth','allauth.account','allauth.socialaccount','allauth.socialaccount.providers.keycloak',]SOCIALACCOUNT_PROVIDERS: is a list of auth providers.astronauthmainly uses Keycloak:SOCIALACCOUNT_PROVIDERS={'keycloak':{'KEYCLOAK_URL':'https://sdc-dev.astron.nl/auth',# replace by https://keycloak.astron.nl/auth for production'KEYCLOAK_REALM':'SDC',# change this depending on which realm to use'SCOPE':['openid','profile','email']}}LOGIN_REDIRECT_URLis used to determine where users should be redirected after login. Usually the main index page is a good one (http://localhost:8000/is used in development)WhileDEBUG=TrueDjango hosts the file. For production purposes, consider the Django recommendations form theirdocumentation.Important: with this configured, you should migrate the database:python manage.py migratebefore further configuration. Also create asuperuser:$DJANGO_SUPERUSER_PASSWORD=passwordpythonmanage.pycreatesuperuser--usernameadmin--emailno-reply@example.com--noinputImportant: replace the username/password and email where necessarySinceastronauthis based onallauth, please take a look at theirdocumentationfor all available settings.Rename session and CSRF CookiesIf multiple apps or services are hosted at the same machine/url, their session or csrf cookies might interfere.
Therefore it is necessary to rename the session and csrf cookies to include the name of the app.
Add the following to yoursettings.pyin your Django project folder:SESSION_COOKIE_NAME='my_service_name_session_id'CSRF_COOKIE_NAME='my_service_csrftoken'Adding a providerBefore adding the provider in your app, make sure you have arealm setup in Keycloakandconfigured a clientin that Keycloak realm. Take note of theClient ID, since you will use it inastronauth.Make sure that the following options are set:Client Protocolisopenid-connectFor granting acces there are two options:Front-end applications:Acces TypeispublicBack-end applications:Acces Typeisconfidential+Authorization EnabledisOn(it also setsService Account EnabledtoOn). Note that is provides aSecret keyin theCredentialstab that you need to configure later in your application.Valid Redirect URIscontains a list or URI for your application. Includehttp://localhost:8000/for development (Important: not recommended for production clients!)Django Admin configurationLog into the Django admin interface (http://localhost:8000/admin/in development)Make sure theSitescontains an entry (should be done by themigratecommand) and update them if you need toIn theSocial Accountssection, clickaddonSocial applicationsand use the following settingsProvider=>KeycloakName=>Keycloak(could be anything)Client id=> The Client ID configured in your Keycloak Realm.Secret=> TheSecret keyprovided by the Keycloak Realm in theCredentialstabSites=> Make sure the site is added, otherwise you will run intoNo providers availableerrors.Adding a custom NavbarYou probably should override the navigation bar, so that it uses the logo of your own application and redirects to the correct view if you click on the logo.
This can be done by creating a template file in one of your apps. Checkintegration/my_app/templates/astronauth/navbar.html.Note: Make sure that your app is aboveastronauthin theINSTALLED_APPSsetting for this to work.DeploymentTODOexample of hosting static files with nginxexample of docker-compose with traefik as reverse proxyContributingThis repository contains a minimal Django project for local development usage.# Install as an editable package so changes are reflected immediatelypipinstall-e.# then from the integration directorycdintegration# Run the migrationspythonmanage.pymigrate# Create a super userDJANGO_SUPERUSER_PASSWORD=passwordpythonmanage.pycreatesuperuser--usernameadmin--emailno-reply@example.com--noinput# Load the setup datapythonmanage.pyloaddatafixtures/test_data.json# the app is then served via "http://localhost:8000/"pythonmanage.pyrunserver# set the secret key from the KeyCloak realm in the administrator console for the Social Application Keycloak# Follow the configuration steps mentioned above for adding a superuser and configuring a client.Code FormatThe providedtox.inifiles has a commandtox -e formatto format your code for you.AcknowledgementsTODODetermine which grants are applicable.