Single Sign-On: Validators depend on Application model

[bryanveloso]

I've been attempting to get the awesome stuff in #54 to work and I ran into the following:

Traceback:
File "/Users/Bryan/.virtualenvs/hello-base/lib/python2.7/site-packages/django/core/handlers/base.py" in get_response
  115.                         response = callback(request, *callback_args, **callback_kwargs)
File "/Users/Bryan/.virtualenvs/hello-base/lib/python2.7/site-packages/django/views/generic/base.py" in view
  68.             return self.dispatch(request, *args, **kwargs)
File "/Users/Bryan/.virtualenvs/hello-base/lib/python2.7/site-packages/django/views/generic/base.py" in dispatch
  86.         return handler(request, *args, **kwargs)
File "/Users/Bryan/Code/Revyver/hello-base/base/components/accounts/views.py" in get
  68.         user = authenticate(request=request)
File "/Users/Bryan/.virtualenvs/hello-base/lib/python2.7/site-packages/django/contrib/auth/__init__.py" in authenticate
  58.     for backend in get_backends():
File "/Users/Bryan/.virtualenvs/hello-base/lib/python2.7/site-packages/django/contrib/auth/__init__.py" in get_backends
  33.         backends.append(load_backend(backend_path))
File "/Users/Bryan/.virtualenvs/hello-base/lib/python2.7/site-packages/django/contrib/auth/__init__.py" in load_backend
  17.         mod = import_module(module)
File "/Users/Bryan/.virtualenvs/hello-base/lib/python2.7/site-packages/django/utils/importlib.py" in import_module
  35.     __import__(name)
File "/Users/Bryan/.virtualenvs/hello-base/lib/python2.7/site-packages/oauth2_provider/backends.py" in <module>
  2. from .oauth2_backends import get_oauthlib_core
File "/Users/Bryan/.virtualenvs/hello-base/lib/python2.7/site-packages/oauth2_provider/oauth2_backends.py" in <module>
  5. from .oauth2_validators import OAuth2Validator
File "/Users/Bryan/.virtualenvs/hello-base/lib/python2.7/site-packages/oauth2_provider/oauth2_validators.py" in <module>
  14. Application = get_application_model()
File "/Users/Bryan/.virtualenvs/hello-base/lib/python2.7/site-packages/oauth2_provider/models.py" in get_application_model
  239.         raise ImproperlyConfigured(e.format(oauth2_settings.APPLICATION_MODEL))

Exception Type: ImproperlyConfigured at /accounts/authenticated/
Exception Value: APPLICATION_MODEL refers to model oauth2_provider.Application that has not been installed

It seems that the validators depend on APPLICATION_MODEL existing, but I'm trying to SSO from a separate client, so I shouldn't have to have another instance of Application on my client.

/cc @masci

[masci]

Not sure what is your setup, but are you trying to validate a token coming from another server? Could you give me some details about the infrastructure you're working on? Thanks!

[bryanveloso]

@masci — Yes. I'll try to explain it as best I can. :)

Site A has the toolkit installed. Site B is registered as a client application on site A. Site B uses site A to authenticate users, but in order to use the validation features provided by this toolkit, Site B has to have an Application model as well. I guess the easiest way to think about it is if Site A were Twitter and Site B were a site providing SSO using Twitter, Site B shouldn't have to have an Application model to validate the token coming in from Site A.

Hopefully that helps.

[masci]

Thanks @bryanveloso now is clear!

I'm afraid the authentication backend we recently implemented in DOT is only useful when the server operates both as resource server and authentication server, because the only way B can validate a token issued by A is to ask A itself and one would not make an http request to A for every authenticated operation in B.

An alternative is the OpenID strategy, using the token issued by A as a federated identity for a user in B: when the authorization flow comes to the end (the implicit grant would work well), you grab the access token, access an /userinfo endpoint in A to check user details and manually login the user inside B, then proceed with standard ModelAuthentication.

Do you have any particular requirement in B that does not fit with the solution above?

[bryanveloso]

Your alternate solution is what I ended up doing. Since I'm operating both A and B, I authenticate B against the details in A. Thanks for the explanation!

😁

[sthzg]

@bryanveloso It's quite an old ticket, I know, but I am curious how this approach went for you. Did you keep using it to provide SSO with DOT? Would you recommend going the same route or would you do it differently now?