Package: dj-authentication
Nice authentication support for DjangoThis is a simple, ready-to-use module for handling any standard kind of authentication in Django apps, without writing any code. However - if you have greater needs - this is also a uniform, configurable and extensible framework you can use to do whatever you need.FeaturesPer-request authentication: common base for supporting any number of standard HTTP auth methods, and HTTP Basic and OAuth Bearer Token auth methods includedOpenID Connect module: support for OpenID Connect token verification and issuance.Modular, uniform architecture: you can mix and match different auth mechanisms, and everything will just work!We are only getting started. More generic auth mechanisms are going to be added in the future (see Planned features).RequirementsDjango 2.0+Installationpipinstalldj-authenticationsettings.pyAdd'dj_authentication'to the list ofINSTALLED_APPS.Remove'django.contrib.auth.middleware.AuthenticationMiddleware'from the list ofMIDDLEWAREs.Adddj_authentication.request_http_auth.HTTPAuthMiddlewareto the list ofMIDDLEWAREs.Choose backends used for determiningrequest.user, for example:REQUEST_USER_BACKENDS=['dj_authentication.methods.basic',# HTTP Basic Auth'dj_authentication.methods.bearer',# OAuth Bearer Token Auth'django.contrib.auth',]Per-request auth methodsBasic authThis method checks the provided username and password against configured Django authentication backends.TipsTo trigger an authentication dialog in a browser, if the user is not authenticated:ifnotrequest.user.is_authenticated:returnHttpResponse(status=401)Bearer authThis method checks the provided bearer token against the OpenID Connect module, described below.openidmodule - OpenID Connect / OAuth supportdj_authenticationincludes an implementation of OpenID Connect / OAuth token verification and issuance.You can configure the list of trusted OpenID Providers by providing their URLs thru(*_)AUTH_URLenvironment variables, like:GOOGLE_AUTH_URL=https://client_id@accounts.google.comFACEBOOK_AUTH_URL=facebook+https://app_id@facebook.comAll conforming OpenID Providers are supported; some other services too - see the list atpython-openid-connect. However, only conforming OpenID Providers that issue id_tokens are supported automatically in the Bearer auth.Token verificationYou can verify tokens using:dj_authentication.openid.verify()function - on the OAuth callback URL, you should pass all the GET parameters you've received to this function. Some of the understood parameters areid_token,iss(for non-OpenID OAuth servers, for examplehttps://facebook.com),token_type,access_token. Note that providing theissparameter isrequiredfor legacy OAuth servers.dj_authentication.methods.bearerrequest.user backend - you can passid_tokens returned by the OpenID Providers in theAuthorization: Bearerheader, and this backend will automatically verify them to provide request.user.How it works?For OpenID Providers,id_tokens are verified against thejwks_uri.For supported legacy OAuth servers,access_tokens are used to access userinfo endpoints and obtain user information.User mappingBy default,dj_authentication.methods.bearersets therequest.userto a dict with the data decoded from the id_token, withis_authenticated = Trueproperty added.To have it automatically map the ID data to a true user object, set theMAP_ID_TO_USER_FUNCvariable. dj_authentication provides two ready-to-use functions:'dj_authentication.user_mappings:map_email'- it looks up the users by the email address'dj_authentication.user_mappings:map_sub_to_username'- it looks up the users using OpenID token subject as the usernameIssuing your own tokensYou can also issue and verify your own JWT id_tokens - just setOPENID_PROVIDER = 'dj_authentication.openid:SimpleDjangoProvider'in thesettings.pyfile and use thedj_authentication.openid.issue()function. They will be signed with the DjangoSECRET_KEY.Example configurationsApp that supports session-less HTTP Basic auth in addition to standard Django sessionsREQUEST_USER_BACKENDS = [
    'dj_authentication.methods.basic',
    'django.contrib.auth',
]Session-less app that supports only Google id_tokens passed as Bearer tokensAUTHENTICATION_BACKENDS = [] # Fully disable session-based auth; you may choose to delete django.contrib.auth from INSTALLED_APPS too.

REQUEST_USER_BACKENDS = [
    'dj_authentication.methods.bearer',
]

os.environ['GOOGLE_AUTH_URL'] = 'https://client_id@accounts.google.com'App that supports both email-based, Google and Facebook loginREQUEST_USER_BACKENDS = [
    'django.contrib.auth',
]

OPENID_PROVIDER = 'dj_authentication.openid:SimpleDjangoProvider' # for tokens sent in email verification messages

os.environ['GOOGLE_AUTH_URL'] = 'https://client_id@accounts.google.com'
os.environ['FACEBOOK_AUTH_URL'] = 'facebook+https://app_id@facebook.com'App that supports both email-based, Google and Facebook login; and session-less Google id_tokens passed as Bearer tokensREQUEST_USER_BACKENDS = [
    'dj_authentication.methods.bearer',
    'django.contrib.auth',
]

OPENID_PROVIDER = 'dj_authentication.openid:SimpleDjangoProvider' # for tokens sent in email verification messages

MAP_ID_TO_USER_FUNC = 'dj_authentication.user_mappings:map_email'

os.environ['GOOGLE_AUTH_URL'] = 'https://client_id@accounts.google.com'
os.environ['FACEBOOK_AUTH_URL'] = 'facebook+https://app_id@facebook.com'Planned featuresVerification ofaccess_tokenandcodeagainstat_hashandc_hash- to return them fromverify()Support for opaqueid_tokens verified against a single configured OAuth/OIDC auth server thruIntrospection EndpointSupport for opaqueid_tokens verified against the Django session system (aka sending the session key as the Bearer token)Support for client certificates (see alsoOAuth 2.0 Mutual TLS)Support forOIDCprivate_key_jwtschemeSupport for asymmetric signing methods for the issued tokens