Package: django-oauth-toolkit-scopes-backend
OAuth2 goodies for the Djangonauts!If you are facing one or more of the following:Your Django app exposes a web API you want to protect with OAuth2 authentication,You need to implement an OAuth2 authorization server to provide tokens management for your infrastructure,Django OAuth Toolkit can help you providing out of the box all the endpoints, data and logic needed to add OAuth2
capabilities to your Django projects. Django OAuth Toolkit makes extensive use of the excellentOAuthLib, so that everything isrfc-compliant.SupportIf you need support please send a message to theDjango OAuth Toolkit Google GroupContributingWe love contributions, so please feel free to fix bugs, improve things, provide documentation. Justfollow the
guidelinesand submit a PR.Reporting security issuesIf you believe you’ve found an issue with security implications, please send a detailed description via email tosecurity@evonove.it.
Mail sent to that address reaches the Django OAuth Toolkit core team, who can solve (or forward) the security issue as soon as possible. After
our acknowledge, we may decide to open a public discussion in our mailing list or issues tracker.Once you’ve submitted an issue via email, you should receive a response from the core team within 48 hours, and depending on the action to be
taken, you may receive further followup emails.RequirementsPython 2.7, 3.2, 3.3, 3.4, 3.5Django 1.7, 1.8, 1.9InstallationInstall with pip:pip install django-oauth-toolkitAddoauth2_providerto yourINSTALLED_APPSINSTALLED_APPS=(...'oauth2_provider',)If you need an OAuth2 provider you’ll want to add the following to your urls.py.
Notice thatoauth2_providernamespace is mandatory.urlpatterns=patterns(...url(r'^o/',include('oauth2_provider.urls',namespace='oauth2_provider')),)DocumentationThefull documentationis onRead the Docs.Licensedjango-oauth-toolkit is released under the terms of theBSD license. Full details inLICENSEfile.Roadmap / Todo list (help wanted)OAuth1 supportOpenID connectorNonrel storages supportChangelogDevelopment#396: added an IsAuthenticatedOrTokenHasScope Permission#357: Support multiple-user clients by allowing User to be NULL for Applications0.10.0 [2015-12-14]#322: dropping support for python 2.6 and django 1.4, 1.5, 1.6#310: Fixed error that could occur sometimes when checking validity of incomplete AccessToken/Grant#333: Added possibility to specify the default list of scopes returned when scope parameter is missing#325: Added management views of issued tokens#249: Added a command to clean expired tokens#323: Application registration view uses custom application model in form class#299: ‘server_class’ is now pluggable through Django settings#309: Add the py35-django19 env to travis#308: Use compact syntax for tox envs#306: Django 1.9 compatibility#288: Put additional information when generating token responses#297: Fixed doc about SessionAuthenticationMiddleware#273: Generic read write scope by resource0.9.0 [2015-07-28]oauthlib_backend_classis now pluggable through Django settings#127:application/jsonContent-Type is now supported usingJSONOAuthLibCore#238: Fixed redirect uri handling in case of error#229: Invalidate access tokens when getting a new refresh tokenadded support for oauthlib 1.00.8.2 [2015-06-25]Fix the migrations to be two-step and allow upgrade from 0.7.20.8.1 [2015-04-27]South migrations fixed. Added new django migrations.0.8.0 [2015-03-27]Several docs improvements and minor fixes#185: fixed vulnerabilities on Basic authentication#173: ProtectResourceMixin now allows OPTIONS requestsFixed client_id and client_secret characters set#169: hide sensitive informations in error emails#161: extend search to all token types when revoking a token#160: return empty response on successful token revocation#157: skip authorization form withskip_authorization_completelyclass field#155: allow custom uri schemesfixedget_application_modelon Django 1.7fixed non rotating refresh tokens#137: fixed base templatecustomizedclient_secretlenght#38: create access tokens not bound to a user instance forclient credentialsflow0.7.2 [2014-07-02]Don’t pin oauthlib0.7.1 [2014-04-27]Added database indexes to the OAuth2 related models to improve performances.Warning: schema migration does not work for sqlite3 database, migration should be performed manually0.7.0 [2014-03-01]Created a setting for the default value for approval prompt.Improved docsDon’t pin django-braces and six versionsBackwards incompatible changes in 0.7.0Make Application model truly “swappable” (introduces a new non-namespaced setting OAUTH2_PROVIDER_APPLICATION_MODEL)0.6.1 [2014-02-05]added support forscopequery parameter keeping backwards compatibility for the originalscopesparameter.__str__ method in Application model returns content ofnamefield when available0.6.0 [2014-01-26]oauthlib 0.6.1 supportDjango dev branch supportPython 2.6 supportSkip authorization form viaapproval_promptparameterBugfixesSeveral fixes to the docsIssue #71: Fix migrationsIssue #65: Use OAuth2 password grant with multiple devicesIssue #84: Add information about login template to tutorial.Issue #64: Fix urlencode clientid secret0.5.0 [2013-09-17]oauthlib 0.6.0 supportBackwards incompatible changes in 0.5.0backends.pymodule has been renamed tooauth2_backends.pyso you should change your imports whether
you’re extending this moduleBugfixesIssue #54: Auth backend proposal to address #50Issue #61: Fix contributing pageIssue #55: Add support for authenticating confidential client with request body paramsIssue #53: Quote characters in the url query that are safe for Django but not for oauthlib0.4.1 [2013-09-06]Optimize queries on access token validation0.4.0 [2013-08-09]New FeaturesAdd Application management views, you no more need the admin to register, update and delete your application.Add support to configurable application modelAdd support for function based viewsBackwards incompatible changes in 0.4.0SCOPEattribute in settings is now a dictionary to store{‘scope_name’: ‘scope_description’}Namespace ‘oauth2_provider’ is mandatory in urls. See issue #36BugfixesIssue #25: Bug in the Basic Auth parsing in Oauth2RequestValidatorIssue #24: Avoid generation of client_id with “:” colon char when using HTTP Basic AuthIssue #21: IndexError when trying to authorize an applicationIssue #9: Default_redirect_uri is mandatory when grant_type is implicit, authorization_code or all-in-oneIssue #22: Scopes need a verbose descriptionIssue #33: Add django-oauth-toolkit version on example main pageIssue #36: Add mandatory namespace to urlsIssue #31: Add docstring to OAuthToolkitError and FatalClientErrorIssue #32: Add docstring to validate_urisIssue #34: Documentation tutorial part1 needs corsheaders explanationIssue #36: Add mandatory namespace to urlsIssue #45: Add docs for AbstractApplicationIssue #47: Add docs for views decorators0.3.2 [2013-07-10]Bugfix #37: Error in migrations with custom user on Django 1.50.3.1 [2013-07-10]Bugfix #27: OAuthlib refresh token refactoring0.3.0 [2013-06-14]Django REST Frameworkintegration layerBugfix #13: Populate request with client and user in validate_bearer_tokenBugfix #12: Fix paths in documentationBackwards incompatible changes in 0.3.0requested_scopesparameter in ScopedResourceMixin changed torequired_scopes0.2.1 [2013-06-06]Core optimizations0.2.0 [2013-06-05]Add support for Django1.4 and Django1.6Add support for Python 3.3Add a default ReadWriteScoped viewAdd tutorial to docs0.1.0 [2013-05-31]Support OAuth2 Authorization Flows0.0.0 [2013-05-17]Discussion with Daniel Greenfeld at Django CircusIgnition