Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

OpenApiAuthenticationExtension with oauth2 #985

Closed
Marta-Junk opened this issue May 9, 2023 · 1 comment
Closed

OpenApiAuthenticationExtension with oauth2 #985

Marta-Junk opened this issue May 9, 2023 · 1 comment

Comments

@Marta-Junk
Copy link

Hello
I have read an issue concerning oauth2 customization problems and your suggestion to patch Swagger UI.
I have tried a different approach. My goal would be to use the token received during authentication as a Bearer token. Given that as far as I know it's not possible to change the Authorization from "Basic" to "Bearer" by simple configuration, I tried to come up with a new Scheme that would mimic oauth2 scheme and additionally change the Authorization header. As you suggested here: #264 I created a scheme.py file and defined a new scheme class there ( I played with both OpenApiAuthenticationExtension and DjangoOAuthToolkitScheme as a parent class). As a target class I specified oauth2_provider.contrib.rest_framework.OAuth2Authentication (I did not define my custom authentication class) and in get_security_definition I planned to return both flows and 'bearer' scheme. Unfortunately I have encountered some issues.
Do you have any suggestions for creating a custom oauth2 scheme or a working example? In particular, should I create a custom authentication class or should OAuth2Authentication do? Should I configure my permissions, as right now I see that my app checks permissions when I hit the swagger 'basic view' (the one with list of endpoints where no authentication is required).

@tfranzel
Copy link
Owner

Unfortunately I have encountered some issues.

well that is not enough information.

Should I configure my permissions, as right now I see that my app checks permissions when I hit the swagger 'basic view' (the one with list of endpoints where no authentication is required).

That has nothing to do with OAuth2. by default we do not protect the swagger page itself.

#264 is dealing with knox, which you don't mention. It might be unrelated.

Given that as far as I know it's not possible to change the Authorization from "Basic" to "Bearer" by simple configuration

This is an DRF issue that is unrelated to us. The fact that OAuth/Swagger will require Bearer (as per RFC) and DRF by default only uses Basic is stupid but not our fault. This can only be fixed my making DRF accept the keyword Bearer, which is unrelated to both the oauth lib and spectacular.

Sry, but your question is all over the place, badly formatted, and too vague to be properly answered. If you want further assistance please rewrite your question with more specifics and clarity.

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants