Recently I had the experience of utilizing the django-oauth-access library from the team at Eldarion. The documentation is a work in progress, so
I thought I would share some tips getting it to work.
The first step after following the installation instructions is creating the OAUTH_ACCESS_SETTINGS entry in settings.py:
OAUTH_ACCESS_SETTINGS = {
'twitter':{
'keys': {
'KEY': '<Consumer Key>',
'SECRET': '<Consumer Secret>'
},
'endpoints': {
'access_token': 'https://api.twitter.com/oauth/access_token',
'request_token':'https://api.twitter.com/oauth/request_token',
'authorize': 'https://api.twitter.com/oauth/authenticate',
'provider_scope':'',
'callback': 'account.oauth_callbacks.twitter_callback'
}
},
'facebook': {
'keys': {
'KEY': '<App ID>',
'SECRET': '<App Secret>',
},
'endpoints': {
'access_token': 'https://graph.facebook.com/oauth/access_token',
'authorize': 'https://graph.facebook.com/oauth/authorize',
'provider_scope': '',
'callback': 'account.oauth_callbacks.facebook_callback',
}
},
}
So what's included in this setting? You can see that each oauth provider we want to connect with has a stanza and each stanza has two sections.
First we have the key and secret provided by both twitter and facebook for connecting with their api. Usually this is application
specific and will be different for each app you create. The second part are the endpoints for communication between your app
and the oauth provider. The endpoint section also includes the important callback, which is the code that your application provides
for local authentication and account creation. Let's head over to the callback section.
from oauth_access.callback import AuthenticationCallback
class BasicCallback(AuthenticationCallback):
def handle_no_user(self, request, access, token, user_data):
return self.create_user(request, access, token, user_data)
def create_user(self, request, access, token, user_data):
identifier = self.identifier_from_data(user_data)
user = User(username=str(identifier))
user.set_unusable_password()
user.save()
self.login_user(request, user)
return user
def redirect_url(self, request):
return request.user.get_profile().get_absolute_url()
class TwitterCallback(BasicCallback):
def identifier_from_data(self, data):
return "twitter-%s" % data['id']
def fetch_user_data(self, request, access, token):
url = 'https://twitter.com/account/verify_credentials.json'
return access.make_api_call("json", url, token)
twitter_callback = TwitterCallback()
As you can see, it's not that complicated. I've created a base class that all my
provider specific classes inherit from. In the base class, you can handle
application specific logic like creating the user and redirecting urls. Django oauth access
provides all the authentication details and uses your callbacks when no
user exists and when it needs to redirect after authentication.
Finally, I'd like to thank the guys over at Eldarion for creating and releasing this package.
It's made it a lot easier to integrate django projects with oauth providers.
