Repository: mozilla/kitsune

Issue:
Add support for Auth0
Currently SUMO locks `/admin` behind Auth0 and SSO on the webserver level. 

Use [mozilla-django-iodc](https://github.com/mozilla/mozilla-django-oidc/) to move the authentication on the App level.


Discussion:

Resolving patch:
diff --git a/kitsune/settings.py b/kitsune/settings.py
--- a/kitsune/settings.py
+++ b/kitsune/settings.py
@@ -409,6 +409,7 @@ def path(*parts):
     'wafflejs',
     'geoip-suggestion',
     'contribute.json',
+    'oidc',
 )
 
 # Make this unique, and don't share it with anybody.
@@ -527,7 +528,23 @@ def path(*parts):
 )
 if READ_ONLY:
     AUTHENTICATION_BACKENDS = ('kitsune.sumo.readonlyauth.ReadOnlyBackend',)
-
+    OIDC_ENABLE = False
+    ENABLE_ADMIN = False
+else:
+    OIDC_ENABLE = config('OIDC_ENABLE', default=False, cast=bool)
+    ENABLE_ADMIN = config('ENABLE_ADMIN', default=OIDC_ENABLE, cast=bool)
+    if OIDC_ENABLE:
+        MIDDLEWARE_CLASSES += ('mozilla_django_oidc.middleware.RefreshIDToken',)
+        AUTHENTICATION_BACKENDS = ('mozilla_django_oidc.auth.OIDCAuthenticationBackend',)
+
+        OIDC_OP_AUTHORIZATION_ENDPOINT = config('OIDC_OP_AUTHORIZATION_ENDPOINT')
+        OIDC_OP_TOKEN_ENDPOINT = config('OIDC_OP_TOKEN_ENDPOINT')
+        OIDC_OP_USER_ENDPOINT = config('OIDC_OP_USER_ENDPOINT')
+        OIDC_RP_CLIENT_ID = config('OIDC_RP_CLIENT_ID')
+        OIDC_RP_CLIENT_SECRET = config('OIDC_RP_CLIENT_SECRET')
+        OIDC_CREATE_USER = config('OIDC_CREATE_USER', default=False, cast=bool)
+
+ADMIN_REDIRECT_URL = config('ADMIN_REDIRECT_URL', default=None)
 
 AUTH_PROFILE_MODULE = 'users.Profile'
 USER_AVATAR_PATH = 'uploads/avatars/'
@@ -555,7 +572,7 @@ def path(*parts):
     'django.contrib.sites',
     'django.contrib.messages',
     'django.contrib.staticfiles',
-    'django.contrib.admin',
+    'mozilla_django_oidc',
     'corsheaders',
     'kitsune.users',
     'dennis.django_dennis',
@@ -622,6 +639,9 @@ def path(*parts):
     # In Django <= 1.6, this "must be placed somewhere after all the apps that
     # are going to be generating activities". Putting it at the end is the safest.
     'actstream',
+
+    # Last so we can override admin templates.
+    'django.contrib.admin',
 )
 
 TEST_RUNNER = 'kitsune.sumo.tests.TestSuiteRunner'
diff --git a/kitsune/sumo/monkeypatch.py b/kitsune/sumo/monkeypatch.py
--- a/kitsune/sumo/monkeypatch.py
+++ b/kitsune/sumo/monkeypatch.py
@@ -90,12 +90,12 @@ def _collect(self, objs, source_attr=None, **kwargs):
 
     # Monkey-patch admin site.
     from django.contrib import admin
-    from django.contrib.auth.decorators import login_required
     from adminplus.sites import AdminSitePlus
 
     # Patch the admin
     admin.site = AdminSitePlus()
-    admin.site.login = login_required(admin.site.login)
+    admin.site.site_header = 'Kitsune Administration'
+    admin.site.site_title = 'Mozilla Support'
 
     # Monkey patch django's csrf
     import session_csrf
diff --git a/kitsune/urls.py b/kitsune/urls.py
--- a/kitsune/urls.py
+++ b/kitsune/urls.py
@@ -42,9 +42,6 @@
     (r'^community', include('kitsune.community.urls')),
     (r'^badges/', include('kitsune.kbadge.urls')),
 
-    # Kitsune admin (not Django admin).
-    (r'^admin/', include(admin.site.urls)),
-
     # Javascript translations.
     url(r'^jsi18n/.*$', cache_page(60 * 60 * 24 * 365)(javascript_catalog),
         {'domain': 'djangojs', 'packages': ['kitsune']}, name='jsi18n'),
@@ -100,3 +97,17 @@
         (r'^%s/(?P<path>.*)$' % media_url, 'kitsune.sumo.views.serve_cors',
          {'document_root': settings.MEDIA_ROOT}),
     )
+
+
+if settings.ENABLE_ADMIN:
+    urlpatterns += [
+        url(r'^admin/', include(admin.site.urls)),
+    ]
+elif settings.ADMIN_REDIRECT_URL:
+    urlpatterns.append(
+         url(r'^admin/', RedirectView.as_view(url=settings.ADMIN_REDIRECT_URL))
+     )
+
+
+if settings.OIDC_ENABLE:
+    urlpatterns.append(url(r'^oidc/', include('mozilla_django_oidc.urls')))


Test patch: