Package: django-simple-sso
DocumentationSeeREQUIREMENTSin thesetup.pyfile for additional dependencies:Django Simple SSO Specification (DRAFT)TerminologyServerThe server is a Django website that holds all the user information and
authenticates users.ClientThe client is a Django website that provides login via SSO using theServer.
It does not hold any user information.KeyA unique key identifying aClient. This key can be made public.SecretA secret key shared between theServerand a singleClient. This secret
should never be shared with anyone other than theServerandClientand
must not be transferred unencrypted.WorkflowUser wants to log into aClientby clicking a “Login” button. The
initially requested URL can be passed using thenextGET parameter.TheClient’s Python code does a HTTP request to theServerto request a
authentication token, this is called theRequest Token Request.TheServerreturns aRequest Token.TheClientredirects the User to a view on theServerusing theRequest Token, this is theAuthorization Request.If the user is not logged in the theServer, they are prompted to log in.The user is redirected to theClientincluding theRequest Tokenand aAuth Token, this is theAuthentication Request.TheClient’s Python code does a HTTP request to theServerto verify theAuth Token, this is called theAuth Token Verification Request.If theAuth Tokenis valid, theServerreturns a serialized Django User
object.TheClientlogs the user in using the Django User recieved from theServer.RequestsGeneralAll requests have asignatureandkeyparameter, seeSecurity.Request Token RequestClient: PythonTarget:ServerMethod: GETExtra Parameters: NoneResponses:200: Everything went fine, the body of the response is a url encoded
query string containing with therequest_tokenkey holding theRequest Tokenas well as thesignature.400: Bad request (missing GET parameters)403: Forbidden (invalid signature)Authorization RequestClient: Browser (User)Target:ServerMethod: GETExtra Parameters:request_tokenResponses:200: Everything okay, prompt user to log in or continue.400: Bad request (missing GET parameter).403: Forbidden (invalidRequest Token).Authentication RequestClient: Browser (User)Target:ClientMethod: GETExtra Parameters:request_token: TheRequest Tokenreturned by theRequest Token Request.auth_token: TheAuth Tokengenerated by theAuthorization Request.Responses:200: Everything went fine, the user is now logged in.400: Bad request (missing GET parameters).403: Forbidden (invalidRequest Token).Auth Token Verification RequestClient: PythonTarget:ServerMethod: GETExtra Parameters:auth_token: TheAuth Tokenobtained by theAuthentication Request.Responses:200: Everything went fine, the body of the response is a url encoded
query string containing theuserkey which is the JSON serialized
representation of the Django user to create as well as thesignature.SecurityEvery request is signed using HMAC-SHA256. The signature is in thesignatureparameter. The signature message is the urlencoded, alphabetically ordered
query string. The signature key is theSecretof theClient. To verify
the signature thekeyparamater holding thekeyof theClientis
also sent with every request from theClientto theServer.ExampleGET Request with the GET parameterskey=bundle123and the private keysecret key:fbf6396d0fc40d563e2be3c861f7eb5a1b821b76c2ac943d40a7a63b288619a9The User objectThe User object returned by a successfulAuth Token Verification Requestdoes not contain all the information about the Django User, in particular, it
does not contain the password.The user object contains must contain at least the following data:username: The unique username of this user.email: The email of this user.first_name: The first name of this user, this field is required, but may
be empty.last_name: The last name of this user, this field is required, but may
be empty.is_staff: Can this user access the Django admin on theClient?is_superuser: Does this user have superuser access to theClient?is_active: Is the user active?ImplementationOn the serverAddsimple_sso.sso_servertoINSTALLED_APPS.Create an instance (potentially of a subclass) ofsimple_sso.sso_server.server.Serverand include the return value of theget_urlsmethod on that instance into your url patterns.On the clientCreate a new instance ofsimple_sso.sso_server.models.Consumeron theServer.Add theSIMPLE_SSO_SECRETandSIMPLE_SSO_KEYsettings as provided by
theServer’ssimple_sso.sso_server.models.Clientmodel.Add theSIMPLE_SSO_SERVERsetting which is the absolute URL pointing to
the root where thesimple_sso.sso_server.urlswhere include on theServer.Add thesimple_sso.sso_client.urlspatterns somewhere on the client.Running TestsYou can run tests by executing:virtualenv env
source env/bin/activate
pip install -r tests/requirements.txt
python setup.py test