django-casdoor-auth

A Django app that lets users sign in to your Django site with Casdoor (OAuth 2.0 authorization code flow), built on casdoor-python-sdk.

• The state parameter is random, stored in the session and checked on the callback (no login CSRF).
• The access token's signature, expiry and audience are verified with your application's certificate, and only users of the configured organization are accepted.
• Each Django user is linked to a Casdoor user by its immutable Casdoor ID, so renaming a user in Casdoor keeps the same Django account, and nobody can take over an existing Django account (e.g. a local admin superuser) by signing up in Casdoor with the same name.
• Users created through Casdoor get an unusable password: they can only sign in through Casdoor.

Requires Python 3.10+ and Django 4.2+.

Install

pip install django-casdoor-auth

Configure

Add casdoor_auth to INSTALLED_APPS in settings.py (it needs django.contrib.auth and django.contrib.sessions):

INSTALLED_APPS = [
    "django.contrib.admin",
    "django.contrib.auth",
    "django.contrib.contenttypes",
    "django.contrib.sessions",
    "django.contrib.messages",
    "django.contrib.staticfiles",
    "casdoor_auth",
]

Then add your Casdoor application:

CASDOOR_CONFIG = {
    "endpoint": "https://door.casdoor.com",
    "client_id": "<client-id>",
    "client_secret": "<client-secret>",
    "certificate": """-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----""",
    "org_name": "casbin",
    "application_name": "app-example",
}

LOGIN_REDIRECT_URL = "/"

Other settings:

In the Casdoor application, add the callback URL (e.g. https://example.com/casdoor/callback/) to Redirect URLs.

Run the migrations to create the table that links Django users to Casdoor users:

python manage.py migrate

Routes

from django.urls import include, path

urlpatterns = [
    # ...
    path("casdoor/", include("casdoor_auth.urls")),
]

<a href="{% url 'casdoor_sso' %}?next={{ request.path|urlencode }}">Sign in with Casdoor</a>

<form method="post" action="{% url 'casdoor_logout' %}">
  {% csrf_token %}
  <button type="submit">Sign out</button>
</form>

After signing in, request.user is the Django user and request.session["user"] holds the claims of the Casdoor access token (name, display name, email, roles, permissions, ...).

Upgrading from 1.x

• Run python manage.py migrate.
• Users that 1.x created are linked to their Casdoor user the next time they sign in. A Django user with a real password is not taken over by a Casdoor user of the same name unless CASDOOR_LINK_EXISTING_USERS = True.
• The logout view only accepts POST.
• The helper views in casdoor_auth.user are removed; call casdoor-python-sdk directly instead.

Development

pip install -e . black ruff
python -m django test --settings=tests.settings --pythonpath=.
black casdoor_auth tests && ruff check casdoor_auth tests

License

Apache 2.0