Providing user details to the Resource server

[Usouf]

So I have been looking around in the documentation to find out how to provide user details from the authentication server to the resource server but to no avail (only username is provided.)

I have created the auth server and the resource server and I'm able to get the API data from the resource server to my client using the access token provided by the auth server. But I need to be able to filter the data according to details of the user which is why I have to provide the user details to the resource server.

How can I accomplish that using this library? or what should I override to get what I need?

[Usouf]

I achieved this by modifying get_token_response in IntrospectTokenView in the Auth-Server

def get_token_response(token_value=None):
        try:
            token = get_access_token_model().objects.select_related(
                "user", "application"
                ).get(token=token_value)
        except ObjectDoesNotExist:
            return HttpResponse(
                content=json.dumps({"active": False}),
                status=401,
                content_type="application/json"
            )
        else:
            if token.is_valid():
                data = {
                    "active": True,
                    "scope": token.scope,
                    "exp": int(calendar.timegm(token.expires.timetuple())),
                }
                if token.application:
                    data["client_id"] = token.application.client_id
                if token.user:
                    data["username"] = token.user.get_username()
# TODO: DANGER ZONE
# Pass extra parameters
# ------------------------------------------------------------------------------
                    data["email"] = token.user.email
                    data["phone_number"] = token.user.phone_number
                    data["is_company"] = token.user.is_company
                    customer = token.user.customer
                    data["designation"] = customer.designation
                    company = customer.company
                    data["company"] = company.company_name
# ------------------------------------------------------------------------------
                return HttpResponse(content=json.dumps(data), status=200, content_type="application/json")
            else:
                return HttpResponse(content=json.dumps({
                    "active": False,
                }), status=200, content_type="application/json")

and _get_token_from_authentication_server in OAuth2Validator in the Resource-Server

def _get_token_from_authentication_server(
            self, token, introspection_url, introspection_token, introspection_credentials
    ):
        headers = None
        if introspection_token:
            headers = {"Authorization": "Bearer {}".format(introspection_token)}
        elif introspection_credentials:
            client_id = introspection_credentials[0].encode("utf-8")
            client_secret = introspection_credentials[1].encode("utf-8")
            basic_auth = base64.b64encode(client_id + b":" + client_secret)
            headers = {"Authorization": "Basic {}".format(basic_auth.decode("utf-8"))}

        try:
            response = requests.post(
                introspection_url,
                data={"token": token}, headers=headers
            )
        except requests.exceptions.RequestException:
            log.exception("Introspection: Failed POST to %r in token lookup", introspection_url)
            return None

        # Log an exception when response from auth server is not successful
        if response.status_code != http.client.OK:
            log.exception("Introspection: Failed to get a valid response "
                          "from authentication server. Status code: {}, "
                          "Reason: {}.".format(response.status_code,
                                               response.reason))
            return None

        try:
            content = response.json()
        except ValueError:
            log.exception("Introspection: Failed to parse response as json")
            return None

        if "active" in content and content["active"] is True:
            if "username" in content:
                user, _created = UserModel.objects.get_or_create(
                    **{UserModel.USERNAME_FIELD: content["username"]}
                )
# TODO: DANGER ZONE
# Adding extra data to user profile and create company
# ------------------------------------------------------------------------------
                user.email = content["email"]
                user.phone_number = content["phone_number"]
                user.is_company = content["is_company"]

                customer, _created_customer = CustomerModel.objects.get_or_create(
                    user = user
                )
                customer.designation = content["designation"]

                company, _created_company = CompanyModel.objects.get_or_create(
                    company_name = content["company"]
                )
                customer.company = company

                customer.save()
                user.save()
# ------------------------------------------------------------------------------
            else:
                user = None

            max_caching_time = datetime.now() + timedelta(
                seconds=oauth2_settings.RESOURCE_SERVER_TOKEN_CACHING_SECONDS
            )

            if "exp" in content:
                expires = datetime.utcfromtimestamp(content["exp"])
                if expires > max_caching_time:
                    expires = max_caching_time
            else:
                expires = max_caching_time

            scope = content.get("scope", "")
            expires = make_aware(expires)

            access_token, _created = AccessToken.objects.update_or_create(
                token=token,
                defaults={
                    "user": user,
                    "application": None,
                    "scope": scope,
                    "expires": expires,
                })

            return access_token

.
Now I'm wondering how can I extend the classes and add the extra codes instead of directly modifying the source code? Appreciate any help.

[HoodyH]

You have to override the OAuth2Validator class in the settings.py file:

OAUTH2_PROVIDER = {
    'OAUTH2_VALIDATOR_CLASS': 'MyApplication.myfile.MyOAuth2Validator ',
}

in the file: myfile

class MyOAuth2Validator(OAuth2Validator):
    def _get_token_from_authentication_server(
        self, token, introspection_url, introspection_token, introspection_credentials
    ):
        pass
        # your custom code here

But is better to create a user/profile endpoint to get that data

[n2ygk]

How to do this as of Release 1.5.0 is documented here.

I've just submitted a minor documentation PR #956 but otherwise this seems to work mostly fine. Here's my code snippet:

from oauth2_provider.oauth2_validators import OAuth2Validator


class CustomOAuth2Validator(OAuth2Validator):

    def get_additional_claims(self, request):
        """
        Return additional ID Token Claims based on the OIDC scope claims.
        Args:
            request:

        Returns:
            dict of additional claims
        """
        claims = {
            "sub": request.user.username
        }
        if 'profile' in request.scopes:
            claims["given_name"] = request.user.first_name
            claims["family_name"] = request.user.last_name
            claims["name"] = ' '.join([request.user.first_name, request.user.last_name])
        if 'email' in request.scopes:
            claims["email"] = request.user.email
        if 'https://api.columbia.edu/scope/group' in request.scopes:
            claims['https://api.columbia.edu/claim/group'] = ' '.join([g.name for g in request.user.groups.all()])
        return claims

    def get_userinfo_claims(self, request):
        """
        Return additional Userinfo claims
        Args:
            request:

        Returns: userinfo dict
        """
        claims = super().get_userinfo_claims(request)
        # This version of request seems to only have the 'openid' scope. That's probably a bug.
        # additional_claims = self.get_additional_claims(request)
        # for now kludge it to provide all the stuff while we investigate if this is a bug.
        kludged_request = request
        kludged_request.scopes += ['profile', 'email', 'https://api.columbia.edu/scope/group']
        additional_claims = self.get_additional_claims(kludged_request)
        return {**claims, **additional_claims}

I have a to-do item to see why the scopes list is missing....

[dopry]

@n2ygk did you ever figure out why the scopes list is missing? I'm not even getting my full list of scopes in get_additional_claims.

[n2ygk]

Umm scopes are not the same as claims....