# `django-auth-tkt`, a Django SSO authentication provider

## Introduction

This tiny module adds [mod_auth_tkt](http://www.openfusion.com.au/labs/mod_auth_tkt/) login support to a [Django](https://djangoproject.com/) site. Whenever a user logs in to Django, an additional SSO ticket is created that can be used to also access other authenticated URLs outside of Django.

As a convenience, the names of all groups to which the logged in user belongs to are added to the `token` list of the SSO ticket. This can be used for `TKTAuthToken` access control.

It does not add any authentication backend, you can use either the included `ModelBackend` or any other that works with Django's `AuthenticationMiddleware`.

The lifetime of tickets can be configured in the Django `settings.py`. When the user logs out of Django, the ticket is also invalidated.

## Usage

Add `git+https://github.com/dnknth/django-auth-tkt.git` to `requirements.txt`.

In `settings.py`:

 * Optionally (but recommended), add `django_auth_tkt.SsoMiddleware` to the `MIDDLEWARE` list. It logs out the current user from Django when teh SSO ticket expires and relies on `django.contrib.auth.middleware.AuthenticationMiddleware`, so it should be placed below it.
 * Also optionally, define the lifetime of tickets, e.g. `SSO_TICKET_LIFETIME = timedelta(days=1)`. The default value is one hour.
 * The default cookie name of the ticket is `auth_tkt`, it can be changed with the `SSO_TICKET_NAME` setting.
 * The default hash algorithm is [MD5](). It can be adjusted with `SSO_HASH_ALGORITHM`, 
   allowed values are `'md5'`, `'sha256'` and `'sha512'`. 
 
Decorate the authentication views in the `urlpatterns` of the main `urls.py`, for example:

    from django.contrib import admin
    from django.contrib.auth import views as auth_views
    from django.urls import include, path
    import django_auth_tkt as sso

    urlpatterns = [
        path('accounts/login/', sso.auth(auth_views.LoginView.as_view(
            redirect_authenticated_user=True))),
        path('accounts/logout/', sso.unauth(auth_views.LogoutView.as_view())),
        path('accounts/', include('django.contrib.auth.urls')),
    
        path('admin/login/', sso.auth(admin.site.login)),
        path('admin/logout/', sso.unauth(admin.site.logout)),
        path('admin/', admin.site.urls),
    ]

For Apache configuration examples, see [mod_auth_tkt(3)](http://manpages.ubuntu.com/manpages/focal/en/man3/mod_auth_tkt.3.html#examples).

## Caveats

* The underlying [auth_tkt](https://github.com/yola/auth_tkt) module only supports insecure [MD5 hashing](https://security.stackexchange.com/a/19908). 
