Package: django3-auth-saml2
Django3 Auth SAML2 IntegrationAs a developer of Django3 applications I need to integrate a SAML2 based
Single-Sign-On (SSO) User authentication system, for example withOkta.  I know there are a number of existing packages
out there, but I want something super-simple that does not require a lot of
configuration in mysettings.pyfile.  I also need this integration to work
with exsitng Django solutions thatdo not allow me to modify settings.py
directly, as is the case withNetbox.Thisdjango3_auth_saml2package was inspired by the existingdjango-saml2-auth.Notable Changes:Django3 / Python3 code baseProvides two Views: one for the login redirect to the SSO and the other for the SSO signinUses Django RemoteUserBackend (or subclass) to handle User creation and configuration processProvide the SAML2 authenticate response payload inresponse.META['SAML2_AUTH_RESPONSE']Any errors result inPermissionDeniedexceptions to allow for app specific handlingConfiguration can be store indjango3_auth_saml2.config.SAML2_AUTH_CONFIGas an alternative
to using the Djangosettings.pyfileSystem RequirementsThis package requires thexmlseclibrary to be installed.ViewsThis package provides two views:login- The URL View should be called when the User attempts to login directly to the appacs- This URL View should be called by the SSO system (Okta)When the User attempts to uselogin, the View will redirect the User's web
browser to the SSO system for authentication.  Once the User authenticates at
the SSO system, the SSO system will then call theacsURL view to sign into
the Django app.In your ROOT_URLCONF.urlpatterns you will need to define two URLs.  The first
is for the SSO system, and the second is your login URL that will force the
User to authenticate via the SSO first.  You can change these to suit your
specific app API.Keep in mind that the 'django3_auth_saml2.urls' provides the 'acs' view, so
that the example below would result in the app API "/sso/acs/" and "/sso/login/".urlpatterns=[path('sso/',include('django3_auth_saml2.urls')),path('login/',RedirectView.as_view(url='/sso/login/')),]Django System ConfigurationThe options have been streamlined from the original django-sam2-auth package,
only the following are supported:RequiredAUTHENTICATION_BACKEND(NEW) the dotted string name of the backend, for example:"django.contrib.auth.backends.RemoteUserBackend"One of:A)METADATA_AUTO_CONF_URLThe URL to the SSO system where the metadata document can be retrieved, for example:"https://mycorp.oktapreview.com/app/sadjfalkdsflkads/sso/saml/metadata"B)METADATA_LOCAL_FILE_PATHAs an alternative to using the URL, you can store the metadata contents to a local file, for example:"/etc/oktapreview-netbox-metadata.xml"OptionalDEFAULT_NEXT_URLThe next URL used to redirect the User after login is successful.  Defaults to/.DEFAULT_SSO_ACS_URLThe URL to be used for SSO sign-in purposes.  Defaults to/sso/acs/.ENTITY_IDThis is generally the URL to your application, for example:"https://okta-devtest.ngrok.io"ASSERTION_URL- same
This is generally the URL to your application, for example:"https://okta-devtest.ngrok.io"NAME_ID_FORMATIdentifies the format of the User name, seedocsfor options.
This value defaults to using email.By default the User name value will be taken from the SAML responsename_id.textvalue.  For example, if the NAME_ID_FORMAT is set to use email,
then the User name value will be the User's email address.For more information on these terms, refer todocs.ExampleYou should create theSAML2_AUTH_CONFIGdictionary in the Djangosettings.pyfile,
for example:SAML2_AUTH_CONFIG={# Using default remote backend'AUTHENTICATION_BACKEND':'django.contrib.auth.backends.RemoteUserBackend',# Metadata is required, choose either remote url or local file path'METADATA_AUTO_CONF_URL':"https://mycorp.oktapreview.com/app/sadjfalkdsflkads/sso/saml/metadata"}User Create & Configuration via RemoteUserBackendBy defaultacswill define theremote_userparameter from thesaml2_auth_resp.name_id.textvalue when it calls the backendauthenticate()method.  For example, if the SSO system (Okta) has configured the name ID
format as email (as shown in the example above), then the User name will be the
Users email address.TheacsView will set theresponse.META['SAML2_AUTH_RESPONSE']to thesaml2.response.AuthnResponseinstance so that you can access this
information.Whenacscalls the backendauthenticate(), the User will be created if it
does not exist by defaul; see class propertycreate_unknown_user.  In this
case theRemoteUserBackend.configure_user()method is called.You can subclass RemoteUserBackend, implemeting your ownauthenticate()andconfigure_user()methods to use theresponse.META['SAML2_AUTH_RESPONSE']data. You can to access the SAML2 user identiy attributes.  See samples inbackends.py.Using Netbox?If you are usingNetboxand you do
not want to fork/modify the systemsettings.pyfile, please refer tonetbox-plugin-auth-saml2