Starlette OAuth2

A Startlette middleware for authentication through oauth2.

This middleware is intented to be used when the application relies on an external tenant (e.g. Microsoft AD) for authentication.

It assumes that a user that is not authenticated is not authorized to do anything.

Check example/ for a concrete implementation.

How to run the example against Microsoft AD

Note: the values in capital such as CLIENT_ID are to be replaced in example/.venv.

1. Generate a secret and write its value on SECRET_KEY

2. Go to Azure AD, create an app registration (app registrations), give it a name, and add http://localhost:5001/authorized as a Redirect URI.

   • replace the value on CLIENT_ID by the value on Application (client) ID
   • replace the value on TENANT_ID by the value on Directory (tenant) ID

3. In Certificates & secrets, create a new client secret.

   • replace the value on CLIENT_SECRET by the value of the key you just created under Client secrets

4. Install dependencies and run:

cd examples
python -m venv venv
venv/bin/pip install -r requirements.txt
python -m app

When you visit http://localhost:5001/public, you will see that you are not authenticated. When you visit http://localhost:5001, you will be redirected to your tenant, to authenticate. Once authenticated, you will be redirected back to http://localhost:5001, and your email will appear.

Public endpoints are optional. They are useful e.g. for healthchecks.