Configuring Providers¶
django-all-access configures and stores the set of OAuth providers in the database. To enable your users to authenticate with a particular provider, you will need to add the OAuth API URLs as well as your application’s consumer key and consumer secret. The process of registering your application with each provider will vary and you should refer to the provider’s API documentation for more information.
Note
While the consumer key/secret pairs are stored in the database
as opposed to putting them in the settings file, they are encrypted using the
AES specification.
Since this is a symmetric-key encryption the key/secret pairs can still be read
if the encryption key is compromised. In this case django-all-access uses a
key based on the standard SECRET_KEY
setting. You should take care to keep
this setting secret as its name would imply.
Common Providers¶
To get you started, there is an initial fixture of commonly used providers. This includes
the URLs needed for Facebook, Twitter, Google, Microsoft Live, Github and Bitbucket. Once you’ve
added allaccess
to your INSTALLED_APP
and created the tables with migrate
,
you can load this fixture via:
python manage.py loaddata common_providers.json
This does not include the consumer id/key or secret which will still need to be added to the records. The below examples will help you understand what these values mean and how they would be populated for additional providers you might want to use.
OAuth 1.0 Providers¶
OAuth 1.0 Protocol is defined by RFC 5849. It is sometimes referred to as 3-Legged OAuth due to the number of requests between the provider and consumer.
To enable an OAuth provider, you should add a Provider
record with the necessary
request_token_url
, authorization_url
and access_token_url
as defined
by the protocol. The provider’s API documentation should detail these for you. You
will also need to define a profile_url
which is the API endpoint for requesting
the currently authenticated user’s profile information. You will also need to
register for a key/secret pair from the provider.
This protocol is implemented by a number of providers. These providers include Twitter, Netflix, Yahoo, Linkedin, Flickr, Bitbucket, and Dropbox. Additional providers can be found on the OAuth.net Wiki.
Twitter Example¶
Twitter is a popular social website which provides a REST API with OAuth 1.0
authentication. If you wanted to enable Twitter authentication on your website
using django-all-access, you would create the following Provider
record:
name: twitter
request_token_url: https://api.twitter.com/oauth/request_token
authorization_url: https://api.twitter.com/oauth/authenticate
access_token_url: https://api.twitter.com/oauth/access_token
profile_url: https://api.twitter.com/1.1/account/verify_credentials.json
After adding your consumer key and secret to this record you should now be able
to authenticate with Twitter by visiting /accounts/login/twitter/
.
You can find more information on the Twitter API on their developer site.
OAuth 2.0 Providers¶
Unlike OAuth 1.0, OAuth 2.0 is only a working draft and not an official standard. In many ways it is much simpler than its predecessor. It is often referred to as 2-Legged OAuth because it removes the need for the request token step.
To enable an OAuth provider, you should add a Provider
record with the necessary
authorization_url
and access_token_url
as defined by the protocol.
The provider’s API documentation should detail these for you. You
will also need to define a profile_url
which is the API endpoint for requesting
the currently authenticated user’s profile information. You will also need to
register for a key/secret pair from the provider.
Providers which implement the OAuth 2.0 protocol include Facebook, Google, FourSquare, Meetup, Github, and Yammer.
Facebook Example¶
Facebook is a large social network which provides a REST API with OAuth 2.0
authentication. The below Provider
record will enable Facebook authentication:
name: facebook
authorization_url: https://www.facebook.com/v2.8/dialog/oauth
access_token_url: https://graph.facebook.com/v2.8/oauth/access_token
profile_url: https://graph.facebook.com/v2.8/me
As you can see, the request_token_url
is not included because it is not needed.
After adding your consumer key and secret to this record you should now be able
to authenticate with Facebook by visiting /accounts/login/facebook/
.
Facebook also has developer docs
for additional information on using their API.
Note
Facebook began using the version number in the URL as part of their 2.0 API. Since then very little has changed with regard to the OAuth flow but the version number is now required. The latest version of the API might not match the documentation here. For the most up to date info on the Facebook API you should consult their API docs.