Django library that implements the authentification for OpenId SSO with JWT from oauth2.
Django library that implements the authentification for OpenID Connect with JWT. This authentification is compatible with django session workflow and the RestFramework library.
pip install django-jwt-oidc
django_jwt package into your INSTALLED_APPS in your settings.py fileINSTALLED_APPS = [
...
'django_jwt',
...
]
urlpatterns = [
...
path('openid/', include('django_jwt.urls')),
...
]
The django-jwt-oidc is a library that allows to implement a OIDC client in order to identify a user from a provider.
JWTAuthenticationMiddleware into your middleware after SessionMiddleware. You can optionally remove the AuthenticationMiddleware if you are not using other ways to log in.MIDDLEWARE = [
...
'django.contrib.sessions.middleware.SessionMiddleware',
...
'django.contrib.auth.middleware.AuthenticationMiddleware',
'django_jwt.middleware.JWTAuthenticationMiddleware',
...
]
AuthenticationMiddleware, you will need to add this settings:SILENCED_SYSTEM_CHECKS = ['admin.E408']
LOGOUT_REDIRECT_URL in order to redirect after logout.oidc_login and oidc_logout. To make it default you can set LOGIN_URL = 'oidc_login'.request.user.request.user_claims.request.userinfo.request.get_access_token().You can add this to your APIviews class by adding JWTTokenAuthentication to authentification_classes attribute.
In this example, the view requires that all requests must have ID Token JWT Bearer Authentication.
from rest_framework import permissions, views
from django_jwt import JWTTokenAuthentication
class ExampleAPIView(view.APIView):
authentication_classes = [JWTTokenAuthentication]
permission_classes = [permissions.IsAuthenticated]
If all your application can work with JWT Bearer Authentication you can add the JWTTokenAuthentication class to DEFAULT_AUTHENTICATION_CLASSES setting on settings.py of your app.
REST_FRAMEWORK = {
'DEFAULT_AUTHENTICATION_CLASSES': [
'django_jwt.rest_framework.JWTTokenAuthentication',
]
}
All settings from the django-jwt-oidc library will be set inside a JWT_OIDC dictionary on settings.py.
JWT_OIDC = {
...
}
Set this to client.
JWT_OIDC = {
...
'TYPE': 'client',
...
}
Set this to the discovery endpoint of the provider.
JWT_OIDC = {
...
'DISCOVERY_ENDPOINT': 'https://domain/.well-known/openid-configuration',
...
}
Set this to the client ID of your application in the provider.
JWT_OIDC = {
...
'CLIENT_ID': 'some_string',
...
}
Set this to the response type of your application in the provider. This determines the flow of your authentication.
JWT_OIDC = {
...
'RESPONSE_TYPE': 'code', # Recommended to use Authorization Code flow
...
}
Set this to the client secret of your application in the provider. This setting is required if want to Hybrid flow or Authorization Code flow (Setting code inside the RESPONSE_TYPE)
JWT_OIDC = {
...
'CLIENT_SECRET': 'some_string',
...
}
Set this to set the scope of the authentication flow.
JWT_OIDC = {
...
'SCOPE': 'openid', # Default
...
}
Set this if you want to use some other claim as identifier for your user model. Default: 'sub'
JWT_OIDC = {
...
'IDENTIFICATION_CLAIM': 'sub', # default
...
}
Set this to change the claims names to be translated to your User model fields. {'claim_name': 'model_field_name'}
JWT_OIDC = {
...
'ID_TOKEN_RENAME_ATTRIBUTES': {}, # Default
...
}
Set this to True if you want to create users that they not exist.
JWT_OIDC = {
...
'CREATE_USER': False, # Default
...
}
Set this to set defaults values to users that log in with the OIDC.
JWT_OIDC = {
...
'USER_DEFAULT_ATTRIBUTES': {}, # Default
...
}
Set this to activate the PKCE_EXTENSION. It is recommended.
JWT_OIDC = {
...
'PKCE_EXTENSION': False, # Default
...
}
Set this for the PKCE_EXTENSION method. Only 'S256' supported.
JWT_OIDC = {
...
'CODE_CHALLENGE_METHOD': 'S256', # Default
...
}
Setting display for the authentication flow. Options: page, popup, touch and wap.
JWT_OIDC = {
...
'CLIENT_DISPLAY': '', # Default
...
}
Setting prompt for the authentication flow. Options: login, consent, select_account and none.
JWT_OIDC = {
...
'CLIENT_PROMPT': '', # Default
...
}
Setting max_age for the authentication flow. How many seconds the user has logged in the provider.
JWT_OIDC = {
...
'CLIENT_PROMPT': '', # Default
...
}
Other settings for the authentication flow.
This is an extra app of the django_jwt app that deploys a OpenID Connect provider with implicit flow (Not recommended), Hybrid flow, Authorization Code flow and Authorization Code flow with PKCE.
The JWTs are signed by RSA or ECC keys that are being regenerated to improve security.
Django JWT Server does not provide for a login view.
django_jwt.server to your installed apps.python manage.py migrate.LOGIN_URL setting on settings.py.All settings from the django-jwt-oidc library will be set inside a JWT_OIDC dictionary on settings.py.
JWT_OIDC = {
...
}
Set this to provider.
JWT_OIDC = {
...
'TYPE': 'provider',
...
}
Set this to your discovery endpoint of the provider.
JWT_OIDC = {
...
'DISCOVERY_ENDPOINT': 'https://my-domain/.well-known/openid-configuration',
...
}
Set this to the algorithm used to sign tokens. ECC is recommended.
JWT_OIDC = {
...
'SIGNATURE_ALG': 'ES512', # Default
...
}
Expiration time (in seconds) of the RSA or ECC keys. They will be stopped to be used for signing after this time. They will be deleted after not needed again for validation.
JWT_OIDC = {
...
'JWK_EXPIRATION_TIME': 3600, # Default
...
}
Expiration time (in seconds) of the ID tokens.
JWT_OIDC = {
...
'JWT_ID_TOKEN_EXPIRATION_TIME': 2700, # Default
...
}
Expiration time (in seconds) of the access tokens. Recommended to be low.
JWT_OIDC = {
...
'JWT_ACCESS_TOKEN_EXPIRATION_TIME': 600, # Default
...
}
Expiration time (in seconds) of the refresh tokens. Must be higher than access tokens.
JWT_OIDC = {
...
'JWT_ACCESS_TOKEN_EXPIRATION_TIME': 3600, # Default
...
}
Set this in order to only be able to refresh tokens x times.
JWT_OIDC = {
...
'MAX_REFRESH': 10, # Default
...
}
User model serializer.
JWT_OIDC = {
...
'USERINFO_SERIALIZER': 'django_jwt.server.serializers.UserSerializer', # Default
...
}
Exclude fields of the User model in the 'django_jwt.server.serializers.UserSerializer'.
JWT_OIDC = {
...
'USERINFO_SERIALIZER_EXCLUDE': ['password'], # Default
...
}
This is an extra functionality of the django_jwt app that makes a OpenId server with oauth 2.0 with implicit flow with an input to "log in" as whatever sub value you want.
Not maintained to changes of the 1.0 version.
CORS_ALLOWED_ORIGINS.JWT_OIDC['TYPE'] setting to 'fake'.JWT_OIDC['CLIENT_ID'] setting to the same client id your frontend is targeting.DEFAULT_DOMAIN setting on your Django settings. Example:DEFAULT_DOMAIN = 'https://localhost:8000'
urls.py.FAQs
Django library that implements the authentification for OpenId SSO with JWT from oauth2.
We found that django-jwt-oidc demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.