e344bb6cd8
The JWT includes the user email and username, along with details pulled from the original access token (e.g. scope, expiration). ECOM-4221
67 lines
2.5 KiB
Python
67 lines
2.5 KiB
Python
"""
|
|
Classes that override default django-oauth-toolkit behavior
|
|
"""
|
|
from __future__ import unicode_literals
|
|
|
|
from django.contrib.auth import authenticate, get_user_model
|
|
from oauth2_provider.oauth2_validators import OAuth2Validator
|
|
|
|
|
|
class EdxOAuth2Validator(OAuth2Validator):
|
|
"""
|
|
Validator class that implements edX-specific custom behavior:
|
|
|
|
* It allows users to log in with their email or username.
|
|
* It does not require users to be active before logging in.
|
|
"""
|
|
|
|
def validate_user(self, username, password, client, request, *args, **kwargs):
|
|
"""
|
|
Authenticate users, but allow inactive users (with u.is_active == False)
|
|
to authenticate.
|
|
"""
|
|
user = self._authenticate(username=username, password=password)
|
|
if user is not None:
|
|
request.user = user
|
|
return True
|
|
return False
|
|
|
|
def _authenticate(self, username, password):
|
|
"""
|
|
Authenticate the user, allowing the user to identify themself either by
|
|
username or email
|
|
"""
|
|
|
|
authenticated_user = authenticate(username=username, password=password)
|
|
if authenticated_user is None:
|
|
UserModel = get_user_model() # pylint: disable=invalid-name
|
|
try:
|
|
email_user = UserModel.objects.get(email=username)
|
|
except UserModel.DoesNotExist:
|
|
authenticated_user = None
|
|
else:
|
|
authenticated_user = authenticate(username=email_user.username, password=password)
|
|
return authenticated_user
|
|
|
|
def save_bearer_token(self, token, request, *args, **kwargs):
|
|
"""
|
|
Ensure that access tokens issued via client credentials grant are associated with the owner of the
|
|
``Application``.
|
|
"""
|
|
grant_type = request.grant_type
|
|
user = request.user
|
|
|
|
if grant_type == 'client_credentials':
|
|
# Temporarily remove the grant type to avoid triggering the super method's code that removes request.user.
|
|
request.grant_type = None
|
|
|
|
# Ensure the tokens get associated with the correct user since DOT does not normally
|
|
# associate access tokens issued with the client_credentials grant to users.
|
|
request.user = request.client.user
|
|
|
|
super(EdxOAuth2Validator, self).save_bearer_token(token, request, *args, **kwargs)
|
|
|
|
# Restore the original request attributes
|
|
request.grant_type = grant_type
|
|
request.user = user
|