Client {{ client.name }} would like to access this information of you ...
``` **error.html** ```html{{ description }}
``` ## Standard Claims This subset of OpenID Connect defines a set of standard Claims. They are returned in the UserInfo Response. The package comes with a setting called `OIDC_USERINFO`, basically it refers to a class that MUST have a class-method named `get_by_user`, this will be called with a Django `User` instance and returns an object with all the claims of the user as attributes. List of all the attributes grouped by scopes: | profile | email | phone | address | | ------------------ | -------------- | --------------------- | ---------------------- | | name | email | phone_number | address_formatted | | given_name | email_verified | phone_number_verified | address_street_address | | family_name | | | address_locality | | middle_name | | | address_region | | nickname | | | address_postal_code | | preferred_username | | | address_country | | profile | | | | | picture | | | | | website | | | | | gender | | | | | birthdate | | | | | zoneinfo | | | | | locale | | | | | updated_at | | | | Example using a django model: ```python from django.conf import settings from django.db import models class UserInfo(models.Model): GENDER_CHOICES = [ ('F', 'Female'), ('M', 'Male'), ] user = models.OneToOneField(settings.AUTH_USER_MODEL, primary_key=True) given_name = models.CharField(max_length=255, blank=True, null=True) family_name = models.CharField(max_length=255, blank=True, null=True) gender = models.CharField(max_length=100, choices=GENDER_CHOICES, null=True) birthdate = models.DateField(null=True) updated_at = models.DateTimeField(auto_now=True, null=True) email_verified = models.NullBooleanField(default=False) phone_number = models.CharField(max_length=255, blank=True, null=True) phone_number_verified = models.NullBooleanField(default=False) address_locality = models.CharField(max_length=255, blank=True, null=True) address_country = models.CharField(max_length=255, blank=True, null=True) @classmethod def get_by_user(cls, user): return cls.objects.get(user=user) ``` ## Server Endpoints **/authorize endpoint** Example of an OpenID Authentication Request using the ``Authorization Code`` flow. ```curl GET /openid/authorize?client_id=123&redirect_uri=http%3A%2F%2Fexample.com%2F&response_type=code&scope=openid%20profile%20email&state=abcdefgh HTTP/1.1 Host: localhost:8000 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded ``` After the user accepts and authorizes the client application, the server redirects to: ```curl http://example.com/?code=5fb3b172913448acadce6b011af1e75e&state=abcdefgh ``` The ``code`` param will be use it to obtain access token. **/token endpoint** ```curl POST /openid/token/ HTTP/1.1 Host: localhost:8000 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded client_id=123&client_secret=456&redirect_uri=http%253A%252F%252Fexample.com%252F&grant_type=authorization_code&code=5fb3b172913448acadce6b011af1e75e&state=abcdefgh ``` **/userinfo endpoint** ```curl POST /openid/userinfo/ HTTP/1.1 Host: localhost:8000 Authorization: Bearer 2b5e4400bfcf47aa9f6abb1d7432fc60 ``` ## Running Tests Use [tox](https://pypi.python.org/pypi/tox) for running tests in each of the environments, also to run coverage among: ```bash $ tox ``` If you have a Django project properly configured with the package. Then just run tests as normal. ```bash $ python manage.py test --settings oidc_provider.tests.app.settings oidc_provider ``` Also tests run on every commit to the project, we use [travis](https://travis-ci.org/juanifioren/django-oidc-provider/) for this. ## Relying Parties This provider was tested (and fully works) with these OIDC Clients: - [Drupal OpenID Connect](https://www.drupal.org/project/openid_connect) - [Passport OpenID Connect](https://github.com/jaredhanson/passport-openidconnect) (for NodeJS) - [OIDCAndroidLib](https://github.com/kalemontes/OIDCAndroidLib) (for Android) - [Amazon IAM OpenID Connect Identity Provider](https://console.aws.amazon.com/iam/home) (for AWS) - [Amazon Cognito](https://console.aws.amazon.com/cognito/home) (for AWS Identity pools) ## Settings ##### SITE_URL REQUIRED. The OP server url. `str`. For example `http://localhost:8000`. ##### LOGIN_URL REQUIRED. Used to log the user in. [Read more in Django docs](https://docs.djangoproject.com/en/1.7/ref/settings/#login-url). `str`. Default is `/accounts/login/`. ##### OIDC_AFTER_USERLOGIN_HOOK OPTIONAL. A string with the location of your function. Provide a way to plug into the process after the user has logged in, typically to perform some business logic. Default is: ```python def default_hook_func(request, user, client): return None ``` Return `None` if you want to continue with the flow. The typical situation will be checking some state of the user or maybe redirect him somewhere. With request you have access to all OIDC parameters. Remember that if you redirect the user to another place then you need to take him back to the authorize endpoint (use `request.get_full_path()` as the value for a "next" parameter). ##### OIDC_CODE_EXPIRE OPTIONAL. `int`. Expressed in seconds. Default is `60*10`. ##### OIDC_EXTRA_SCOPE_CLAIMS OPTIONAL. A string with the location of your class. Default is `oidc_provider.lib.claims.AbstractScopeClaims`. Used to add extra scopes specific for your app. This class MUST inherit ``AbstractScopeClaims``. OpenID Connect Clients will use scope values to specify what access privileges are being requested for Access Tokens. [Here](http://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims) you have the standard scopes defined by the protocol. Check out an example of how to implement it: ```python from oidc_provider.lib.claims import AbstractScopeClaims class MyAppScopeClaims(AbstractScopeClaims): def setup(self): # Here you can load models that will be used # in more than one scope for example. # print self.user # print self.scopes try: self.some_model = SomeModel.objects.get(user=self.user) except SomeModel.DoesNotExist: # Create an empty model object. self.some_model = SomeModel() def scope_books(self, user): # Here you can search books for this user. dic = { 'books_readed': books_readed_count, } return dic ``` See how we create our own scopes using the convention: ``def scope_