django实战oauth2 provider/consumer和google oauth2详解

Oauth2 Django

Part I

• Install

pip install django-oauth-toolkit django-cors-middleware

• source/config/setting.py

INSTALLED_APPS += (    'django_extensions',    'debug_toolbar',    'oauth2_provider',    'corsheaders', ) MIDDLEWARE += (    'debug_toolbar.middleware.DebugToolbarMiddleware',    'corsheaders.middleware.CorsMiddleware', ) CORS_ORIGIN_ALLOW_ALL = True AUTHENTICATION_BACKENDS = (    'django.contrib.auth.backends.ModelBackend',    'oauth2_provider.backends.OAuth2Backend',)

• source/config/urls.py

url(r'^o/', include('oauth2_provider.urls', namespace='oauth2_provider')),

• Migrate

python source/manger.py migrate

Part II

• Register your application

http://localhost:8000/o/applications/ 

• Information

*Client id* and *Client Secret* are automatically generated;ID = kzsUOB12CcXKkSZfG90dLcons33daYYqafjBUdAwsecret = qN7MiCfG9cUpo2kAaj0lDkbpNBBgHKlIiO3GeeGS2dQkxwFUVS2NpWlPVCiVCpmnEjTLYtIPWBJwubWGB3SqF4fKypqsyVCCvX5DebaQW82shdyQIH96lWcPWFKYUtBj

Part III

注：当前的两个程序，A为provider（提供权限的一方）端口为8000，B为请求的一方，端口为8082。

1. 请求Bhttp://127.0.0.1:8082,设置url重定向
2. 重定向A的http://127.0.0.1:8000/o/authorize/?state=xx&client_id=xx&response_type=code
3. 浏览器请求，A判断是否登录，authorize是login_required的，所以会先判断是否登录，然后进入授权界面
4. 按照预先返回的要求，重定向到指定url
5. 在该url内获取到接收数据code和state，其中code是authorization_code。
6. 向A的8080请求获取Access Token，http://127.0.0.1:8000/o/token/?code=xx&redirect_uri=xx&grant_type=authorization_code&client_id=xx，注意要用post方法

// 返回{    "refresh_token": "k6hT71TZIsPIQYVJqxlzcoN6j6k306",    "access_token": "kltBlehmZbSJ9yCWpBv5f8St1oqLhu",    "expires_in": 36000,    "token_type": "Bearer",    "scope": "write read"}

1. 带着headers={‘acess_token’: ‘xxx’}访问A的url，则A访问数据库，返回给B所需要的信息。
2. 重写template的授权页面，在templates添加oauth2_provider目录，在其中添加authorize.html，重写界面，第一行固定为{% extends "base.html" %}。

Part IV

• Google Oauth2

pip install  oauth2client

• Before Starting
  注册一个帐号在google develop中，并enable相应的权限(scope)API，获取clientID。
• build a flow

from oauth2client.client import OAuth2WebServerFlowflow = OAuth2WebServerFlow(client_id='xxx',                           client_secret='X1nUWXLi9UxMk-rGj0oWohfb',                           # scope='https://www.googleapis.com/auth/plus.login',                           scope="https://www.googleapis.com/auth/userinfo.email",                           redirect_uri='http://localhost:8002/user/google_token/',                           authuser=-1,)

• First Step

auth_uri = flow.step1_get_authorize_url()return redirect(auth_uri)

• Second Step

response = requests.post("https://www.googleapis.com/oauth2/v4/token",                                 data={'code': code, 'redirect_uri': 'http://localhost:8002/user/google_token/',                                       'grant_type': 'authorization_code',                                       'client_id': '769145275139-ano9e5tp62s656jta058176o36pv3qpf.apps.googleusercontent.com',                                       'client_secret': 'X1nUWXLi9UxMk-rGj0oWohfb'}).json()        res = requests.get("https://www.googleapis.com/oauth2/v2/userinfo?access_token=" + response["access_token"]).json()

• Warning: refresh_token only exists in the first time…