Authentikate
What is Authentikate?
Authentikate is a library that provides a simple interface to validate tokens and retrieve corresponding user information inside a django application.
Note: This library is still somewhat tied to the Arkitekt Framework. We are working on making it more generic. If you have any ideas, please open an issue or a PR.
Alternatives
There are a few alternatives to this library, but none of them provide the same functionality. The most popular alternative is Simple JWT or Strawberry-django Auth . Both of these libraries provide a great way to authenticate users. So you should seriously consider using them instead of this library.
Why Authentikate?
Authentikate was designed to work with the Arkitekt Framework and therefore comes with a few additional features that are not available in other libraries.
Features:
- Designed to work with the more specific Oauth2 Self-Encoded Access Tokens
- Models Oauth2 Clients and Scopes
- Build in support for Guardian for object level permissions
- Build in support for Static Tokens (Token that are hard coded into the settings, e.g. for testing)
- Build in support for Strawberry
- Designed to work with Koherent for audit logging
- Imitation support with Imitation Tokens (Token that are hard coded into the settings, e.g. for testing)
Composed Usage
If you plan to use Authentikate with the Arkitekt Framework, you should consider the Kante library. It composes Authentikate with Koherent and provides a simple interface to authenticate and log all changes that are done by a specific app and user.
How do I use it?
Authentikate is a Django Libary, so you will have to add it to your INSTALLED_APPS in your settings.py file.
INSTALLED_APPS = [
...
'guardian', # This is required for object level permissions
'authentikate',
...
]
AUTHENTICATION_BACKENDS = [
"django.contrib.auth.backends.ModelBackend",
"guardian.backends.ObjectPermissionBackend", # This is required for object level permissions
]
You will also need some additional configuration in your `settings.py` file.
```python
AUTH_USER_MODEL = "authentikate.User"
AUTHENTIKATE = {
"ISSUERS": [
{
"kind": "jwks_uri",
"iss": "https://lok.my-org.com",
"jwks_uri": "https://lok.my-org.com/.well-known/jwks.json",
# Optional: refuse tokens lok has revoked before they expire. The
# list is fetched at most once a minute (configurable), not per request.
"revocation_uri": "https://lok.my-org.com/o/revoked/",
}
],
# This service's identifier, checked against the token's `aud`. Required —
# without it a token your issuer minted for any other service would be
# accepted here. Use "*" to accept any audience deliberately.
"AUDIENCE": "my-service",
}
ISSUERS and AUDIENCE are the required keys. Each entry is selected by its kind
(jwks_uri, jwks_dict, rsa, or rsa_file). For the full settings shape —
issuers, static tokens, provenance, headers, the public API and error model —
see docs/USAGE.md.
Upgrading? 4.0 renames the
active_orgclaim toorg(which now carries the organization id, not a slug) and makesAUDIENCEand the token'saudclaim required. 3.0 fixed two authentication bypasses and contains breaking changes of its own (most notably: token roles are no longer mirrored onto DjangoGroups). Seedocs/UPGRADING.md.
Standard Usage
Koherent is designed to work with Strawberry, so you will need to add its extension to your schema.
from authentikate.utils import authenticate_header_or_none
def my_view(request: HttpRequest) -> None:
auth = authenticate_header_or_none(request.headers)
if auth:
auth.user # This is the user that is authenticated
auth.app # This is the app that is authenticated
auth.scopes # These are the scopes that are authenticated
GraphQL Setup
Currently we require that you use the Kante GraphQL library, as it provides some
boilerplate code that is required to make this work.
import strawberry
from authentikate.strawberry import AuthentikateExtension, AuthExtension
schema = strawberry.Schema(query=Query, extensions=[AuthentikateExtension])
@strawberry.type
class Query:
@strawberry.field(extensions=[AuthExtension()])
def me(self, info: Info) -> User:
return info.context.request.user
@strawberry.field(extensions=[AuthExtension(scopes=["read:users"])])
def users(self, info: Info) -> List[User]:
return User.objects.all()
AuthExtension accepts scopes, roles, any_scope_of and any_role_of. Use
AuthSubscribeExtension on subscription fields.
Scoped Members
A member who was shared a few objects of an organization, and nothing else, gets a
token with an objects claim, keyed by the hub that hosts them:
{"org": "12", "roles": [], "objects": {"3": ["@mikro/arraydataset:42#derived"]}}
token.is_scoped tells the two kinds of member apart, and token.grants_for(hub)
lists the shared objects as ObjectGrant(structure, object_id, reach). Which rows an
object and its reach cover is the hosting service's business: authentikate only
decides whether such a token is served at all.
AUTHENTIKATE = {
...,
"HUB": "3", # this service's hub: the entry of `objects` it reads
"SCOPED_TOKENS": "auto", # auto | reject | self
}
auto(the default) rejects a scoped token (SCOPED_TOKEN_UNSUPPORTED) unless something in the process narrows reads to the shared objects and has said so withauthentikate.scoped.enforce_scoped(). Where it is accepted, it is read-only: mutations and subscriptions are refused (SCOPED_READ_ONLY) unless every root field opted in withAuthExtension(allow_scoped=True).rejectalways rejects it.selfaccepts it and leaves every rule to the service itself.
Outside GraphQL, require_full_member(token) and the @full_members_only view
decorator refuse a scoped member (FULL_MEMBERSHIP_REQUIRED).
The refusal is recorded as the operation's validation errors (on_validate). An
extension that assigns execution_context.pre_execution_errors itself, such as
strawberry's ValidationCache, must come before AuthentikateExtension in the
schema's extensions, or it overwrites the refusal.
Static Tokens
Static Tokens are tokens that are hard coded into the settings. They are useful for testing and development, but should not be used in production.
AUTHENTIKATE = {
"ISSUERS": [
{
"kind": "jwks_uri",
"iss": "https://lok.my-org.com",
"jwks_uri": "https://lok.my-org.com/.well-known/jwks.json",
}
],
# Static tokens bypass signature verification entirely. They are for tests
# and local development only: configuring them while DEBUG is False raises
# ImproperlyConfigured at startup.
"STATIC_TOKENS": {
"my_token": {
"sub": "my_user",
"iss": "https://lok.my-org.com",
"scope": "read:users",
"roles": ["reader"],
}
}
}
1 maintainer
Metadata
1 maintainer
Release files for authentikate 4.3.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| authentikate-4.3.0.tar.gz | 51.1 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| authentikate-4.3.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 115.1 kB
Release files / authentikate-4.3.0.tar.gz
| Download URL | authentikate-4.3.0.tar.gz |
|---|---|
| Size | 51.1 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
a19c5da084c1c8240693fd5bc7182626b030f1d21dd5b854efe50a85462c6d7b
|
|
BLAKE2b-256 checksum How to use checksums |
c539593704ceb3955d2c626f7bb2c8c7b8daee0165ccd9344292311ed01a6314
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
uv/0.13.1 {"installer":{"name":"uv","version":"0.13.1","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"24.04","id":"noble","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
Release files / authentikate-4.3.0-py3-none-any.whl
| Download URL | authentikate-4.3.0-py3-none-any.whl |
|---|---|
| Size | 64.0 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
620c8e97dc0c6adf60f0b3169109904644fcb16a6b5b437c3be6a997bf2c4f7a
|
|
BLAKE2b-256 checksum How to use checksums |
01c88cfcc7c1a83f7cb540e73f19640455ae7832100dabe6b3f579d8e17cd157
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
uv/0.13.1 {"installer":{"name":"uv","version":"0.13.1","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"24.04","id":"noble","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
