Configurable AccessToken and RefreshToken models

[dirkmoors]

For my project, I need to be able to have a different AccessToken and RefreshToken model. Since django-oauth-toolkit already supports configurable Application model classes, I decided to do the same for AccessToken and RefreshToken.

I've created a pull request for this feature: #252

Cheers,
Dirk

[kvogel]

I will need this too! Also a way of generating a custom bearer token signature.

Thanks,
Kurt

[dirkmoors]

@kvogel I think you can achieve the custom bearer token this way:

from oauth2_provider.oauth2_backends import OAuthLibCore
from oauth2_provider.settings import oauth2_settings
...

def generate_token_for_request(request, refresh_token=False):
    expiry_datetime = datetime.utcnow() + timedelta(seconds=token_expires_in(request))
    permissions = []
    return generate_custom_token(
        request.user, permissions, expiry_datetime=expiry_datetime, refresh_token=refresh_token)

class CustomProviderBackend(OAuthLibCore):
    def __init__(self, *args, **kwargs):
        super(CustomProviderBackend, self).__init__(server=oauth2.Server(
            oauth2_settings.OAUTH2_VALIDATOR_CLASS(), token_generator=generate_token_for_request,
            refresh_token_generator=generate_token_for_request))

And then in settings.py:

OAUTH2_PROVIDER = {
    ...
    # this is the core Custom Provider backend
    'OAUTH2_BACKEND_CLASS': 'custom_backend.CustomProviderBackend',
    ....
}

[kvogel]

I don't see 'OAUTH2_BACKEND_CLASS' setting in latest release in pip: django-oauth-toolkit==0.8.1. But yes this is something along the lines I'd like to have. Also...

I'd like to have a custom model as well because I want to "crypto-split" a users credentials for backend RSA enc/dec of their keys. Basically during a session a user may want to decrypt an object and I don't want the server to hold any sensitive info so I'd like to take a user's password xor it with a random number and have one "half" on the server and one in the browser.

I could store it somewhere else but it would be convenient if I could tack it on to the AccessToken/RefreshToken.

Thanks for the heads up,
Kurt

[dirkmoors]

You are correct, I am using the 'master branch', because it IS implemented there. I was also missing that functionality when I was using v0.8.1, but when looking through the code on github, I found out that it was present there.

[n2ygk]

Closing due to age and no recent activity. Feel free to reopen/submit a PR if you are still interested.