Part 3 - OAuth2 token authentication

Scenario

You want to use an Access Token to authenticate users against Django’s authentication system.

Setup a provider

You need a fully-functional OAuth2 provider which is able to release access tokens: just follow the steps in the part 1 of the tutorial. To enable OAuth2 token authentication you need a middleware that checks for tokens inside requests and a custom authentication backend which takes care of token verification. In your settings.py:

  1. AUTHENTICATION_BACKENDS = (
  2.     'oauth2_provider.backends.OAuth2Backend',
  3.     # Uncomment following if you want to access the admin
  4.     #'django.contrib.auth.backends.ModelBackend'
  5.     '...',
  6. )
  8. MIDDLEWARE = (
  9.     '...',
  10.     # If you use SessionAuthenticationMiddleware, be sure it appears before OAuth2TokenMiddleware.
  11.     # SessionAuthenticationMiddleware is NOT required for using django-oauth-toolkit.
  12.     'django.contrib.auth.middleware.SessionAuthenticationMiddleware',
  13.     'oauth2_provider.middleware.OAuth2TokenMiddleware',
  14.     '...',
  15. )
  17. # Or on Django<1.10:
  18. MIDDLEWARE_CLASSES = (
  19.     '...',
  20.     'django.contrib.auth.middleware.SessionAuthenticationMiddleware',
  21.     'oauth2_provider.middleware.OAuth2TokenMiddleware',
  22.     '...',
  23. )

You will likely use the django.contrib.auth.backends.ModelBackend along with the OAuth2 backend (or you might not be able to log in into the admin), only pay attention to the order in which Django processes authentication backends.

If you put the OAuth2 backend after the AuthenticationMiddleware and request.user is valid, the backend will do nothing; if request.user is the Anonymous user it will try to authenticate the user using the OAuth2 access token.

If you put the OAuth2 backend before AuthenticationMiddleware, or AuthenticationMiddleware is not used at all, it will try to authenticate user with the OAuth2 access token and set request.user and request._cached_user fields so that AuthenticationMiddleware (when active) will not try to get user from the session.

If you use SessionAuthenticationMiddleware, be sure it appears before OAuth2TokenMiddleware. However SessionAuthenticationMiddleware is NOT required for using django-oauth-toolkit.

Protect your view

The authentication backend will run smoothly with, for example, login_required decorators, so that you can have a view like this in your views.py module:

  1. from django.contrib.auth.decorators import login_required
  2. from django.http.response import HttpResponse
  4. @login_required()
  5. def secret_page(request, *args, **kwargs):
  6.     return HttpResponse('Secret contents!', status=200)

To check everything works properly, mount the view above to some url:

  1. urlpatterns = [
  2.     path('secret', 'my.views.secret_page', name='secret'),
  3.     '...',
  4. ]

You should have an Application registered at this point, if you don’t, follow the steps in the previous tutorials to create one. Obtain an Access Token, either following the OAuth2 flow of your application or manually creating in the Django admin. Now supposing your access token value is 123456 you can try to access your authenticated view:

  1. curl -H "Authorization: Bearer 123456" -X GET http://localhost:8000/secret