amsterdam-django-oidc

This package contains an authentication backend for Django. It is currently based on the authentication backend provided by Mozilla through the mozilla-django-oidc package. The Mozilla package however does not validate the iss, aud and exp claims of the access token and always calls the userinfo endpoint on the identity provider. Unfortunately that is not adequate for the use case within the landscape of applications of the city of Amsterdam. Hence, the reason for this solution.

Instead of calling the userinfo endpoint, it will validate the aforementioned claims.

Install

The package can be installed using your favorite package manager for python. For example using uv:

uv add amsterdam-django-oidc

Or using pip:

pip install amsterdam-django-oidc

Usage

Add the backend to the setting AUTHENTICATION_BACKENDS:

# settings.py
AUTHENTICATION_BACKENDS = [
    # ...
    "amsterdam_django_oidc.OIDCAuthenticationBackend",
]

There are also a few settings required in addition to those of the Mozilla package:

Development

In order to facilitate further development of this package a containerized setup is provided.

Building the container images

docker compose build

Running development tools

It's recommended to start a container and use the shell inside the container:

docker compose run --rm amsterdam-django-oidc bash

Once you see the shell it's possible to run commands like:

uv run ruff check
uv run mypy .
uv run pytest