Package: django-jwt-oidc
Django jwtDjango library that implements the authentification for OpenID Connect with JWT.
This authentification is compatible with django session workflow and the RestFramework library.InstallationInstall the library with pippipinstalldjango-jwt-oidcAdd thedjango_jwtpackage into yourINSTALLED_APPSin your settings.py fileINSTALLED_APPS=[...'django_jwt',...]Add django-jwt-oidc urls to your urls.py. You can change the path to the one you prefer.urlpatterns=[...path('openid/',include('django_jwt.urls')),...]Set up clientThedjango-jwt-oidcis a library that allows to implement a OIDC client in order to identify a user from a provider.MiddlewareAddJWTAuthenticationMiddlewareinto your middleware afterSessionMiddleware. You can optionally remove theAuthenticationMiddlewareif you are not using other ways to log in.MIDDLEWARE=[...'django.contrib.sessions.middleware.SessionMiddleware',...'django.contrib.auth.middleware.AuthenticationMiddleware','django_jwt.middleware.JWTAuthenticationMiddleware',...]If you removed theAuthenticationMiddleware, you will need to add this settings:SILENCED_SYSTEM_CHECKS=['admin.E408']Set the django settingLOGOUT_REDIRECT_URLin order to redirect after logout.Add redirects to theoidc_loginandoidc_logout. To make it default you can setLOGIN_URL = 'oidc_login'.UsageGetting authenticated user from request:request.user.Getting the ID token claims from the user:request.user_claims.Getting the userinfo from the endpoint from the user:request.userinfo.Getting a valid access token from the user:request.get_access_token().RestFramework [Optional]This settings are for views inherits RestFramework library from Django.You will need toinstall RestFrameworkon your own to your app firstView settingYou can add this to your APIviews class by addingJWTTokenAuthenticationtoauthentification_classesattribute.
In this example, the view requires that all requests must have ID Token JWT Bearer Authentication.fromrest_frameworkimportpermissions,viewsfromdjango_jwtimportJWTTokenAuthenticationclassExampleAPIView(view.APIView):authentication_classes=[JWTTokenAuthentication]permission_classes=[permissions.IsAuthenticated]Global settingIf all your application can work with JWT Bearer Authentication you can add theJWTTokenAuthenticationclass toDEFAULT_AUTHENTICATION_CLASSESsetting on settings.py of your app.REST_FRAMEWORK={'DEFAULT_AUTHENTICATION_CLASSES':['django_jwt.rest_framework.JWTTokenAuthentication',]}SettingsSettingsAll settings from thedjango-jwt-oidclibrary will be set inside aJWT_OIDCdictionary onsettings.py.JWT_OIDC={...}TYPE [Required]Set this toclient.JWT_OIDC={...'TYPE':'client',...}DISCOVERY_ENDPOINT [Required]Set this to the discovery endpoint of the provider.JWT_OIDC={...'DISCOVERY_ENDPOINT':'https://domain/.well-known/openid-configuration',...}CLIENT_ID [Required]Set this to the client ID of your application in the provider.JWT_OIDC={...'CLIENT_ID':'some_string',...}RESPONSE_TYPE [Required]Set this to the response type of your application in the provider. This determines the flow of your authentication.JWT_OIDC={...'RESPONSE_TYPE':'code',# Recommended to use Authorization Code flow...}CLIENT_SECRETSet this to the client secret of your application in the provider. This setting is required if want to Hybrid flow or Authorization Code flow (Settingcodeinside theRESPONSE_TYPE)JWT_OIDC={...'CLIENT_SECRET':'some_string',...}SCOPESet this to set the scope of the authentication flow.JWT_OIDC={...'SCOPE':'openid',# Default...}IDENTIFICATION_CLAIMSet this if you want to use some other claim as identifier for your user model. Default:'sub'JWT_OIDC={...'IDENTIFICATION_CLAIM':'sub',# default...}ID_TOKEN_RENAME_ATTRIBUTESSet this to change the claims names to be translated to your User model fields.{'claim_name': 'model_field_name'}JWT_OIDC={...'ID_TOKEN_RENAME_ATTRIBUTES':{},# Default...}CREATE_USERSet this toTrueif you want to create users that they not exist.JWT_OIDC={...'CREATE_USER':False,# Default...}USER_DEFAULT_ATTRIBUTESSet this to set defaults values to users that log in with the OIDC.JWT_OIDC={...'USER_DEFAULT_ATTRIBUTES':{},# Default...}PKCE_EXTENSIONSet this to activate the PKCE_EXTENSION. It is recommended.JWT_OIDC={...'PKCE_EXTENSION':False,# Default...}CODE_CHALLENGE_METHODSet this for the PKCE_EXTENSION method. Only'S256'supported.JWT_OIDC={...'CODE_CHALLENGE_METHOD':'S256',# Default...}CLIENT_DISPLAYSetting display for the authentication flow. Options: page, popup, touch and wap.JWT_OIDC={...'CLIENT_DISPLAY':'',# Default...}CLIENT_PROMPTSetting prompt for the authentication flow. Options: login, consent, select_account and none.JWT_OIDC={...'CLIENT_PROMPT':'',# Default...}CLIENT_MAX_AGESetting max_age for the authentication flow. How many seconds the user has logged in the provider.JWT_OIDC={...'CLIENT_PROMPT':'',# Default...}OTHEROther settings for the authentication flow.CLIENT_UI_LOCALESCLIENT_CLAIMS_LOCALESCLIENT_ID_TOKEN_HINTCLIENT_LOGIN_HINTCLIENT_ACR_VALUESSet up providerThis is an extra app of the django_jwt app that deploys a OpenID Connect provider with implicit flow (Not recommended), Hybrid flow, Authorization Code flow and Authorization Code flow with PKCE.
The JWTs are signed by RSA or ECC keys that are being regenerated to improve security.Django JWT Server does not provide for a login view.InstallationInstalldjango-cors-headerslibrary into your app. Required in order to control the CORS policy from your apps.There is no need to add the domains one by oneInstalldjangorestframeworklibrary into your app.Adddjango_jwt.serverto your installed apps.Migrate the database withpython manage.py migrate.Add your implemented Django log in intoLOGIN_URLsetting onsettings.py.Run your app in order to set up your hosts into the admin page.SettingsAll settings from thedjango-jwt-oidclibrary will be set inside aJWT_OIDCdictionary onsettings.py.JWT_OIDC={...}TYPE [Required]Set this toprovider.JWT_OIDC={...'TYPE':'provider',...}DISCOVERY_ENDPOINT [Required]Set this to your discovery endpoint of the provider.JWT_OIDC={...'DISCOVERY_ENDPOINT':'https://my-domain/.well-known/openid-configuration',...}SIGNATURE_ALGSet this to the algorithm used to sign tokens. ECC is recommended.JWT_OIDC={...'SIGNATURE_ALG':'ES512',# Default...}JWK_EXPIRATION_TIMEExpiration time (in seconds) of the RSA or ECC keys. They will be stopped to be used forsigningafter this time.
They will be deleted after not needed again for validation.JWT_OIDC={...'JWK_EXPIRATION_TIME':3600,# Default...}JWT_ID_TOKEN_EXPIRATION_TIMEExpiration time (in seconds) of the ID tokens.JWT_OIDC={...'JWT_ID_TOKEN_EXPIRATION_TIME':2700,# Default...}JWT_ACCESS_TOKEN_EXPIRATION_TIMEExpiration time (in seconds) of the access tokens. Recommended to be low.JWT_OIDC={...'JWT_ACCESS_TOKEN_EXPIRATION_TIME':600,# Default...}JWT_REFRESH_TOKEN_EXPIRATION_TIMEExpiration time (in seconds) of the refresh tokens. Must be higher than access tokens.JWT_OIDC={...'JWT_ACCESS_TOKEN_EXPIRATION_TIME':3600,# Default...}MAX_REFRESHSet this in order to only be able to refresh tokens x times.JWT_OIDC={...'MAX_REFRESH':10,# Default...}USERINFO_SERIALIZERUser model serializer.JWT_OIDC={...'USERINFO_SERIALIZER':'django_jwt.server.serializers.UserSerializer',# Default...}USERINFO_SERIALIZER_EXCLUDEExclude fields of the User model in the'django_jwt.server.serializers.UserSerializer'.JWT_OIDC={...'USERINFO_SERIALIZER_EXCLUDE':['password'],# Default...}Set up fake server for deploymentThis is an extra functionality of thedjango_jwtapp that makes a OpenId server with oauth 2.0 with implicit flow with an input to "log in" as whatever sub value you want.Not maintained to changes of the 1.0 version.InstallationInstalldjango-cors-headerslibrary into your app. Required in order to control the CORS policy from your frontend.Add your frontend domain intoCORS_ALLOWED_ORIGINS.Change theJWT_OIDC['TYPE']setting to'fake'.Set up theJWT_OIDC['CLIENT_ID']setting to the same client id your frontend is targeting.Set up theDEFAULT_DOMAINsetting on your Django settings. Example:DEFAULT_DOMAIN='https://localhost:8000'Set up your frontend url into the path that you included inurls.py.<style>
details summary > * {  
    display: inline; 
}
details {
    margin-top: 25px;
}
</style>