Django OpenID Connect (OIDC) authentication provider
====================================================

This module makes it easy to integrate OpenID Connect as an authentication source in a Django project.

Behind the scenes, it uses Roland Hedberg's great pyoidc library.

Modified by JHUAPL BOSS to support Python3

Modified by Thomas Frössman with fixes and additional modifications.

Quickstart
----------

Install djangooidc::

    # Latest (pre) release
    pip install django-oidc-tf


    # Latest code - unstable!
    pip install git+https://github.com/thomasf/django-oidc.git


Then to use it in a Django project, add this to your urls.py::

    url(r'openid/', include('djangooidc.urls')),


Then add the following items to your settings.py:

* add `'djangooidc.backends.OpenIdConnectBackend'` to AUTHENTICATION_BACKENDS **after** the default
  `'django.contrib.auth.backends.ModelBackend'`
* set LOGIN_URL = 'openid'
* add the specific OIDC parameters (change the absolute URLs to yours)::

    # Information used when registering the client, this may be the same for all OPs
    # Ignored if auto registration is not used.
    OIDC_DYNAMIC_CLIENT_REGISTRATION_DATA = {
        "application_type": "web",
        "contacts": ["ops@example.com"],
        "redirect_uris": ["http://localhost:8000/openid/callback/login/", ],
        "post_logout_redirect_uris": ["http://localhost:8000/openid/callback/logout/", ]
    }

    # Default is using the 'code' workflow, which requires direct connectivity from your website to the OP.
    OIDC_DEFAULT_BEHAVIOUR = {
        "response_type": "code",
        "scope": ["openid", "profile", "email", "address", "phone"],
    }

The configuration above is enough to use OIDC providers (OP) that support discovery and self client registration.
In addition, you may want to use a specific OpenID Connect provider that is not auto-discoverable. This is done
by adding items to the OIDC_PROVIDERS dictionary. See full documentation for parameter names.

For example, an Azure AD OP would be::

    OIDC_PROVIDERS = {
        "Azure Active Directory": {
            "srv_discovery_url": "https://sts.windows.net/aaaaaaaa-aaaa-1111-aaaa-xxxxxxxxxxxxx/",
            "behaviour": OIDC_DEFAULT_BEHAVIOUR,
            "client_registration": {
                "client_id": "your_client_id",
                "client_secret": "your_client_secret",
                "redirect_uris": ["http://localhost:8000/openid/callback/login/"],
                "post_logout_redirect_uris": ["http://localhost:8000/openid/callback/logout/"],
            }
        }
    }


You may now test the authentication by going to (on the development server) http://localhost:8000/openid/login or to any
of your views that requires authentication.


Features
--------

* Ready to use Django authentication backend
* No models stored in database - just some configuration in settings.py to keep it simple
* Fully integrated with Django's internal accounts and permission system
* Support for all OIDC workflows: Authorization Code flow, Implicit flow, Hybrid flow. Don't worry if you don't know
  what these are - the package comes with great defaults.
* Includes logout at the provider level
