diff --git a/oauth2_provider/settings.py b/oauth2_provider/settings.py index eb8c8701a..9abdf2874 100644 --- a/oauth2_provider/settings.py +++ b/oauth2_provider/settings.py @@ -55,6 +55,10 @@ 'OAUTH2_VALIDATOR_CLASS', ) +# List of callback urls that don't need to be authenticated +URIS_WITHOUT_AUTH = ( +) + def perform_import(val, setting_name): """ @@ -90,11 +94,12 @@ class OAuth2ProviderSettings(object): and return the class, rather than the string literal. """ - def __init__(self, user_settings=None, defaults=None, import_strings=None, mandatory=None): + def __init__(self, user_settings=None, defaults=None, import_strings=None, mandatory=None, uris_without_auth=None): self.user_settings = user_settings or {} self.defaults = defaults or {} self.import_strings = import_strings or () self.mandatory = mandatory or () + self.uris_without_auth = uris_without_auth or () def __getattr__(self, attr): if attr not in self.defaults.keys(): @@ -126,4 +131,4 @@ def validate_setting(self, attr, val): raise AttributeError("OAuth2Provider setting: '%s' is mandatory" % attr) -oauth2_settings = OAuth2ProviderSettings(USER_SETTINGS, DEFAULTS, IMPORT_STRINGS, MANDATORY) +oauth2_settings = OAuth2ProviderSettings(USER_SETTINGS, DEFAULTS, IMPORT_STRINGS, MANDATORY, URIS_WITHOUT_AUTH) diff --git a/oauth2_provider/views/base.py b/oauth2_provider/views/base.py index e46e532c5..9a4f526fe 100644 --- a/oauth2_provider/views/base.py +++ b/oauth2_provider/views/base.py @@ -103,6 +103,15 @@ def form_valid(self, form): def get(self, request, *args, **kwargs): try: scopes, credentials = self.validate_authorization_request(request) + + # If the callback URI does not require authorization; immediately return a response + if 'redirect_uri' in request.GET and request.GET['redirect_uri'] in oauth2_settings.uris_without_auth: + uri, headers, body, status = self.create_authorization_response( + request=self.request, scopes=" ".join(scopes), + credentials=credentials, allow=True) + self.success_url = uri + return HttpResponseRedirect(self.success_url) + kwargs['scopes_descriptions'] = [oauth2_settings.SCOPES[scope] for scope in scopes] kwargs['scopes'] = scopes # at this point we know an Application instance with such client_id exists in the database