Package: django-authlib
authlib is a collection of authentication utilities for implementing
passwordless authentication. This is achieved by either sending
cryptographically signed links by email, or by fetching the email
address from third party providers such as Google, Facebook and Twitter.
After all, what’s the point in additionally requiring a password for
authentication when the password can be easily resetted on most websites
when an attacker has access to the email address?GoalsStay small, simple and extensible.Offer tools and utilities instead of imposing a framework on you.UsageInstalldjango-authlibusing pip into your virtualenv.Addauthlib.backends.EmailBackendtoAUTHENTICATION_BAcKENDS.AddingauthlibtoINSTALLED_APPSis optional and only useful
if you want to use the bundled translation files. There are no
required database tables or anything of the sort.Have a user model which has a email field namedemailas username.
For convenience a base user model and manager are available in theauthlib.base_usermodule,BaseUserandBaseUserManager.
TheBaseUserManageris automatically available asobjectswhen
you extend theBaseUser.Use the bundled views or write your own. The bundled views give
feedback usingdjango.contrib.messages, so you may want to check
that those messages are visible to the user.The Google, Facebook and Twitter OAuth clients require the following
settings:GOOGLE_CLIENT_IDGOOGLE_CLIENT_SECRETFACEBOOK_CLIENT_IDFACEBOOK_CLIENT_SECRETTWITTER_CLIENT_IDTWITTER_CLIENT_SECRETNote that you have to configure the Twitter app to allow email access,
this is not enabled by default.NoteIf you want to use OAuth2 providers in development mode (without HTTPS) you
could add the following lines to yoursettings.py:ifDEBUG:# NEVER set this variable in production environments!os.environ["OAUTHLIB_INSECURE_TRANSPORT"]="1"This is required because of the strictness ofoauthlibwhich only wants HTTPS
URLs (and rightly so).Use of bundled viewsThe following URL patterns are an example for using the bundled views.
For now you’ll have to dig into the code (it’s not much, at the time of
writingdjango-authlib’s Python code is less than 500 lines):fromdjango.conf.urlsimporturlfromauthlibimportviewsfromauthlib.facebookimportFacebookOAuth2Clientfromauthlib.googleimportGoogleOAuth2Clientfromauthlib.twitterimportTwitterOAuthClienturlpatterns=[url(r"^login/$",views.login,name="login",),url(r"^oauth/facebook/$",views.oauth2,{"client_class":FacebookOAuth2Client,},name="accounts_oauth_facebook",),url(r"^oauth/google/$",views.oauth2,{"client_class":GoogleOAuth2Client,},name="accounts_oauth_google",),url(r"^oauth/twitter/$",views.oauth2,{"client_class":TwitterOAuthClient,},name="accounts_oauth_twitter",),url(r"^email/$",views.email_registration,name="email_registration",),url(r"^email/(?P<code>[^/]+)/$",views.email_registration,name="email_registration_confirm",),url(r"^logout/$",views.logout,name="logout",),]Admin OAuth2Theauthlib.admin_oauthapp allows using Google OAuth2 to allow all
users with the same email domain to authenticate for Django’s
administration interface. You have to use authlib’s authentication
backend (EmailBackend) for this.Installation is as follows:Follow the steps in the “Usage” section above.Addauthlib.admin_oauthto yourINSTALLED_APPSbeforedjango.contrib.admin, so that our login template is picked up.AddGOOGLE_CLIENT_IDandGOOGLE_CLIENT_SECRETto your settings
as described above.Add aADMIN_OAUTH_PATTERNSsetting. The first item is the domain,
the second the email address of a staff account. If no matching staff
account exists, authentication fails:ADMIN_OAUTH_PATTERNS=[(r"@example\.com$","admin@example.com"),]Add an entry to your URLconf:urlpatterns=[url(r"",include("authlib.admin_oauth.urls")),# ...]Addhttps://yourdomain.com/admin/__oauth__/as a valid redirect
URI in your Google developers console.Please note that theauthlib.admin_oauth.urlsmodule assumes that the admin
site is registered at/admin/. If this is not the case you can integrate
the view yourself under a different URL.It is also allowed to use a callable instead of the email address in theADMIN_OAUTH_PATTERNSsetting; the callable is passed the result of matching
the regex. If a resulting email address does not exist, authentication (of
course) fails:ADMIN_OAUTH_PATTERNS=[(r"^.*@example\.org$",lambdamatch:match[0]),]If a pattern succeeds but no matching user with staff access is found
processing continues with the next pattern. This means that you can
authenticate users with their individual accounts (if they have one) and
fall back to an account for everyone having a Google email address on
your domain:ADMIN_OAUTH_PATTERNS=[(r"^.*@example\.org$",lambdamatch:match[0]),(r"@example\.com$","admin@example.com"),]You could also remove the fallback line; in this case users can only
authenticate if they have a personal staff account.Little AuthTheauthlib.little_authapp contains a basic user model with email
as username that can be used if you do not want to write your own user
model but still profit from authlib’s authentication support.Usage is as follows:Addauthlib.little_authto yourINSTALLED_APPSSetAUTH_USER_MODEL = "little_auth.User"Optionally also follow any of the steps above.Email RegistrationFor email registration to work, two templates are needed:registration/email_registration_email.txtregistration/email_registration.htmlA starting point would be:email_registration_email.txt:Subject (1st line)

Body (3rd line onwards)
{{ url }}
...email_registration.html:{% if messages %}<ulclass="messages">{% for message in messages %}<li{%ifmessage.tags%}class="{{ message.tags }}"{%endif%}>{% if message.level == DEFAULT_MESSAGE_LEVELS.ERROR %}Important: {% endif %}
        {{ message }}</li>{% endfor %}</ul>{% endif %}

{% if form.errors and not form.non_field_errors %}<pclass="errornote">{% if form.errors.items|length == 1 %}
    {% translate "Please correct the error below." %}
    {% else %}
    {% translate "Please correct the errors below." %}
    {% endif %}</p>{% endif %}

{% if form.non_field_errors %}
{% for error in form.non_field_errors %}<pclass="errornote">{{ error }}</p>{% endfor %}
{% endif %}<formaction='{% url "email_registration" %}'method="post">{% csrf_token %}<table>{{ form }}</table><inputtype="submit"value="login"></form>The above template is inspired from:Messages Django documentationDjango login templateMore details are documented inthe relevant module.