Package: cedar-adfs-forked
ADFS Authentication for DjangoA Django authentication backend for Microsoft ADFS and Azure ADFree software: BSD LicenseHomepage:https://github.com/jobec/django-auth-adfsDocumentation:http://django-auth-adfs.readthedocs.io/FeaturesIntegrates Django with Active Directory on Windows 2012 R2, 2016 or Azure AD in the cloud.Provides seamless single sign on (SSO) for your Django project on intranet environments.Auto creates users and adds them to Django groups based on info received from ADFS.Django Rest Framework (DRF) integration: Authenticate against your API with an ADFS access token.InstallationPython package:pip install django-auth-adfsIn your project’ssettings.pyadd these settings.AUTHENTICATION_BACKENDS=(...'django_auth_adfs.backend.AdfsAuthCodeBackend',...)INSTALLED_APPS=(...# Needed for the ADFS redirect URI to function'django_auth_adfs',...# checkout the documentation for more settingsAUTH_ADFS={"SERVER":"adfs.yourcompany.com","CLIENT_ID":"your-configured-client-id","RELYING_PARTY_ID":"your-adfs-RPT-name",# Make sure to read the documentation about the AUDIENCE setting# when you configured the identifier as a URL!"AUDIENCE":"microsoft:identityserver:your-RelyingPartyTrust-identifier","CA_BUNDLE":"/path/to/ca-bundle.pem","CLAIM_MAPPING":{"first_name":"given_name","last_name":"family_name","email":"email"},}# Configure django to redirect users to the right URL for loginLOGIN_URL="django_auth_adfs:login"LOGIN_REDIRECT_URL="/"######################### OPTIONAL SETTINGS########################MIDDLEWARE=(...# With this you can force a user to login without using# the LoginRequiredMixin on every view class## You can specify URLs for which login is not enforced by# specifying them in the LOGIN_EXEMPT_URLS setting.'django_auth_adfs.middleware.LoginRequiredMiddleware',)In your project’surls.pyadd these paths:urlpatterns=[...path('oauth2/',include('django_auth_adfs.urls')),]This will add these paths to Django:/oauth2/loginwhere users are redirected to, to initiate the login with ADFS./oauth2/login_no_ssowhere users are redirected to, to initiate the login with ADFS but forcing a login screen./oauth2/callbackwhere ADFS redirects back to after login. So make sure you set the redirect URI on ADFS to this./oauth2/logoutwhich logs out the user from both Django and ADFS.You can use them like this in your django templates:<ahref="{% url 'django_auth_adfs:logout' %}">Logout</a><ahref="{% url 'django_auth_adfs:login' %}">Login</a><ahref="{% url 'django_auth_adfs:login-no-sso' %}">Login (no SSO)</a>ContributingContributions to the code are more then welcome.
For more details have a look at theCONTRIBUTING.rstfile.Changelog1.3.0- 2019-03-??AddedAdded settingSETTINGS_CLASS, defaulting todjango_auth_adfs.config.Settings. This provides a mechanism to load theAUTH_ADFSconfig from sources other than Django settings.1.2.0- 2019-03-01RemovedDjango 1.8, 1.9 and 1.10 support. They are end of extended support and keeping support for them was becoming too
complex.FixedThe django templates were missing in the wheel1.1.2- 2018-12-11AddedAdded views to selectively disable SSO for login linksFixedExisting users with an empty password raised an exception1.1.1- 2018-12-07AddedAdd a setting to force a login screen and disable SSO on ADFS.Documentation about how to enable SSO for other browsers than IE & Edge.FixedPrevent username field from being overwritten by a claim mapping.Prevent traceback upon logout when ADFS config is not yet loaded.Fix fields in log messages being swapped.SecurityDon’t allow the audience claim to be ignored. Preventing access token reuse.Set an unusable password on newly created user instead of leaving it empty.1.0.0- 2018-12-05This version contains backwards incompatible changes. Make sure to read the entire release notesAddedWindows 2016 (a.k.a. ADFS 4.0) SupportAzureAD support (check the settingTENANT_ID)Django Rest Framework support.Add aRETRIESandTIMEOUTsetting for requests towards the ADFS server.Add theCLIENT_SECRETsetting to support client secrets in the OAuth2 Flow.Users are now redirected back to the page that triggered the login instead of the main page.Groups a user belongs to can now be automatically created in Django (check theMIRROR_GROUPSsetting)ChangedDjango 2.1 supportAll settings that can be determined automatically are now set automaticallyWhen a claim mapped to a non-required field in the user model is missing,
a warning is logged instead of an exception raisedIncompatible changesBecause of the login and logout views that were added, the redirect URI back from ADFS should
now point to/oauth2/callback. Keeping it at/oauth2/loginwould have caused a potential redirect loop.Deprecatedthese settings are now loaded from ADFS metadata automatically and have been deprecated:AUTHORIZE_PATHLOGIN_REDIRECT_URLISSUERREDIR_URISIGNING_CERTTOKEN_PATH0.2.1- 2017-10-20Django 2.0 support and tests.0.2.0- 2017-09-14Fixed a bug were authentication failed when the last ADFS signing key was not the one that signed the JWT token.Django 1.11 support and tests.Proper handling the absence of ‘code’ query parameter after ADFS redirect.Added ADFS configuration guide to docs.Allow boolean user model fields to be set based on claims.Thenamespaceargument forinclude()is not needed anymore on Django >=1.9.Fixed some Django 2.0 deprecation warnings, improving future django support.0.1.2- 2017-03-11Support for django 1.10 new style middleware using theMIDDLEWAREsetting.0.1.1- 2016-12-13Numerous typos fixed in code and documentation.Proper handling of class variables to allow inheriting from the classAdfsBackend.0.1.0- 2016-12-11By default, the ADFS signing certificate is loaded from theFederationMetadata.xmlfile every 24 hours.
Allowing to automatically follow certificate updates when the ADFS settings forAutoCertificateRolloveris set toTrue(the default).Group assignment optimisation. Users are not removed and added to all groups anymore. Instead only the
groups that need to be removed or added are handled.Backwards incompatible changesThe redundantADFS_prefix was removed from the configuration variables.TheREQUIRE_LOGIN_EXEMPT_URLSvariable was renamed toLOGIN_EXEMPT_URLS0.0.5- 2016-12-10User update code in authentication backend split into separate functions.0.0.4- 2016-03-14Made the absence of the group claim non-fatal to allow users without a group.0.0.3- 2016-02-21ADFS_REDIR_URI is now a required settingNow supports Python 2.7, 3.4 and 3.5Now supports Django 1.7, 1.8 and 1.9Added debug logging to aid in troubleshootingAdded unit testsLot’s of code cleanup0.0.2- 2016-02-11Fixed a possible issue with the cryptography package when used with apache + mod_wsgi.Added a optional context processor to make the ADFS authentication URL available as a template variable (ADFS_AUTH_URL).Added a optional middleware class to be able force an anonymous user to authenticate.0.0.1 - 2016-02-09Initial release