Azure AD B2C 的 mozilla-django-oidc 问题
[英]mozilla-django-oidc issue with Azure AD B2C
问题描述
I am trying to configure the "mozilla-django-oidc" package in Django.
我正在尝试在 Django 中配置“mozilla-django-oidc”包。 To authenticate I use Azure Active Directory B2C policy, so this is my federation server.为了进行身份验证，我使用 Azure Active Directory B2C 策略，因此这是我的联合服务器。
When I click in the login button I got this URL which looks wrong to me, I will split it, just for convenience:当我点击登录按钮时，我得到了这个在我看来是错误的 URL，为了方便起见，我将其拆分：
https://TENANTID.b2clogin.com/TENANTID.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1_TENANTID_signin?response_type=code&scope=openid+email&client_id=XXXXXXXXXXXXXXX&redirect_uri=http%3A%2F%2Flocalhost%3A8000%2Foidc%2Fcallback%2F&state=pt8aYXicnYRSQkkB8kwHSv4hQwt9Xzre&nonce=UfLfk6QovA2inpfo9W7zS2MZHLpO1tkJ https://TENANTID.b2clogin.com/TENANTID.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1_TENANTID_signin?response_type=code&scope=openid+email&client_id=XXXXXXXXXXXXXXX&redirect_uri=http%3A%2F%2Flocalhost%3A800000000 2Fcallback%2F&state=pt8aYXicnYRSQkkB8kwHSv4hQwt9Xzre&nonce=UfLfk6QovA2inpfo9W7zS2MZHLpO1tkJ
and the URL I need has this format: https://TENANTID.b2clogin.com/TENANTID.onmicrosoft.com/oauth2/v2.0/authorize?p=B2C_1_TENANTID_SIGNIN&client_id=XXXXXXXXXXXXX&nonce=defaultNonce&redirect_uri=http%3A%2F%2Flocalhost%3A8000%2Foidc%2Fcallback%2F&scope=openid&response_type=id_token&prompt=login并且我需要的 URL 具有以下格式： https://TENANTID.b2clogin.com/TENANTID.onmicrosoft.com/oauth2/v2.0/authorize?p=B2C_1_TENANTID_SIGNIN&client_id=XXXXXXXXXXXXX&nonce=defaultNonce&redirect_uri=http%3A%2F%2Flocalhost0%3A80 %2Foidc%2Fcallback%2F&scope=openid&response_type=id_token&prompt=login
In the home page I have this code:在主页中，我有以下代码：
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Home page</title>
</head>
<body>
<h3>
Welcome to home page
</h3>
{% if user.is_authenticated %}
<p>Current user: {{ user.email }}</p>
<form action="{% url 'oidc_logout' %}" method="post">
<input type="submit" value="logout">
</form>
{% else %}
<a href="{% url 'oidc_authentication_init' %}">Login</a>
{% endif %}
</body>
my code in the settings.py我在 settings.py 中的代码
OIDC_RP_SIGN_ALGO = "RS256"
OIDC_RP_CLIENT_ID = "xxxxxxxxxxxxxx" #fake client id just for this post
# OIDC_RP_CLIENT_SECRET = os.environ['OIDC_RP_CLIENT_SECRET']
OIDC_OP_AUTHORIZATION_ENDPOINT =
"https://TENANTID.b2clogin.com/TENANTID.onmicrosoft.com/oauth2/v2.0/authorize?
p=b2c_1_TENANTID_signin"
OIDC_OP_TOKEN_ENDPOINT = "https://TENANTID.b2clogin.com/TENANTID.onmicrosoft.com/oauth2/v2.0/token?
p=b2c_1_TENANTID_signin"
# OIDC_OP_USER_ENDPOINT = "<URL of the OIDC OP userinfo endpoint>"
LOGIN_REDIRECT_URL = "http://localhost:8000/oidc/callback/"
LOGOUT_REDIRECT_URL = "http://localhost:8000/welcome/
Note: I don't know what to put in this variable "OIDC_RP_CLIENT_SECRET" and also "OIDC_OP_USER_ENDPOINT"注意：我不知道在这个变量“OIDC_RP_CLIENT_SECRET”和“OIDC_OP_USER_ENDPOINT”中放什么
Any help please to get the right URL in this configuration?在此配置中获取正确的 URL 有什么帮助吗？ Thanks谢谢
2 个解决方案
解决方案1
1 已采纳 2020-03-31 18:42:01
I had to update the views.py file from the library in order to get the URL I needed.我必须更新库中的 views.py 文件才能获得我需要的 URL。 The documentation was very poor, but at least it is working.文档很差，但至少它是有效的。
解决方案2
0 2020-08-05 03:50:04
In order to get the URL you want, you need to remove the authorization parameter in your endpoints:为了获得您想要的 URL，您需要删除端点中的授权参数：
-
OIDC_OP_AUTHORIZATION_ENDPOINT -
OIDC_OP_TOKEN_ENDPOINT
This would yield new endpoints for you as follows.这将为您产生新的端点，如下所示。
OIDC_OP_AUTHORIZATION_ENDPOINT = "https://TENANTID.b2clogin.com/TENANTID.onmicrosoft.com/oauth2/v2.0/authorize"
OIDC_OP_TOKEN_ENDPOINT = "https://TENANTID.b2clogin.com/TENANTID.onmicrosoft.com/oauth2/v2.0/token"
Now you are missing a part of your URL so you can add the "policy" authorization parameter back in with the following bit of code:现在您缺少 URL 的一部分，因此您可以使用以下代码重新添加“policy”授权参数：
OIDC_AUTH_REQUEST_EXTRA_PARAMS = {'p': 'b2c_1_TENANTID_signin'}
OIDC_RP_SCOPES = ['openid']
Could you use OIDC_USE_NONCE = False instead of setting nonce to be defaultNonce ?您可以使用OIDC_USE_NONCE = False而不是将nonce设置为defaultNonce吗？
EDIT: I should have mentioned this doesn't resolve your issue around response_type and nonce .编辑：我应该提到这并不能解决您关于response_type和nonce 。
声明:本站的技术帖子网页，遵循CC BY-SA 4.0协议，如果您需要转载，请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.