Skip to content

Commit 5ea3c87

Browse files
simon-spier0simon-spier0
authored
Added: Implementation of POST login and logout (snok#345)
* Added: Implementation of POST login and logout * Fixed: Line length based on rule E501 * Improve formatting of django template integration docs. Co-authored-by: simon-spier0 <>
1 parent 378f141 commit 5ea3c87

File tree

4 files changed

+101
-15
lines changed

4 files changed

+101
-15
lines changed

‎README.rst

Lines changed: 30 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -98,13 +98,36 @@ This will add these paths to Django:
9898
* ``/oauth2/callback`` where ADFS redirects back to after login. So make sure you set the redirect URI on ADFS to this.
9999
* ``/oauth2/logout`` which logs out the user from both Django and ADFS.
100100
101-
You can use them like this in your django templates:
102-
103-
.. code-block:: html
104-
105-
<a href="{% url 'django_auth_adfs:logout' %}">Logout</a>
106-
<a href="{% url 'django_auth_adfs:login' %}">Login</a>
107-
<a href="{% url 'django_auth_adfs:login-no-sso' %}">Login (no SSO)</a>
101+
Below is sample Django template code to use these paths depending if
102+
you'd like to use GET or POST requests. Logging out was deprecated in
103+
`Django 4.1 <https://docs.djangoproject.com/en/5.1/releases/4.1/#features-deprecated-in-4-1>`_.
104+
105+
- Using GET requests:
106+
107+
.. code-block:: html
108+
109+
<a href="{% url 'django_auth_adfs:logout' %}">Logout</a>
110+
<a href="{% url 'django_auth_adfs:login' %}">Login</a>
111+
<a href="{% url 'django_auth_adfs:login-no-sso' %}">Login (no SSO)</a>
112+
113+
- Using POST requests:
114+
115+
.. code-block:: html+django
116+
117+
<form method="post" action="{% url 'django_auth_adfs:logout' %}">
118+
{% csrf_token %}
119+
<button type="submit">Logout</button>
120+
</form>
121+
<form method="post" action="{% url 'django_auth_adfs:login' %}">
122+
{% csrf_token %}
123+
<input type="hidden" name="next" value="{{ next }}">
124+
<button type="submit">Login</button>
125+
</form>
126+
<form method="post" action="{% url 'django_auth_adfs:login-no-sso' %}">
127+
{% csrf_token %}
128+
<input type="hidden" name="next" value="{{ next }}">
129+
<button type="submit">Login (no SSO)</button>
130+
</form>
108131
109132
Contributing
110133
------------

‎django_auth_adfs/config.py

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -337,7 +337,10 @@ def build_authorization_endpoint(self, request, disable_sso=None, force_mfa=Fals
337337
338338
"""
339339
self.load_config()
340-
redirect_to = request.GET.get(REDIRECT_FIELD_NAME, None)
340+
if request.method == 'POST':
341+
redirect_to = request.POST.get(REDIRECT_FIELD_NAME, None)
342+
else:
343+
redirect_to = request.GET.get(REDIRECT_FIELD_NAME, None)
341344
if not redirect_to:
342345
redirect_to = django_settings.LOGIN_REDIRECT_URL
343346
redirect_to = base64.urlsafe_b64encode(redirect_to.encode()).decode()

‎django_auth_adfs/views.py

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,15 @@ def get(self, request):
8484
"""
8585
return redirect(provider_config.build_authorization_endpoint(request))
8686

87+
def post(self, request):
88+
"""
89+
Initiates the OAuth2 flow and redirect the user agent to ADFS
90+
91+
Args:
92+
request (django.http.request.HttpRequest): A Django Request object
93+
"""
94+
return redirect(provider_config.build_authorization_endpoint(request))
95+
8796

8897
class OAuth2LoginNoSSOView(View):
8998
def get(self, request):
@@ -95,6 +104,15 @@ def get(self, request):
95104
"""
96105
return redirect(provider_config.build_authorization_endpoint(request, disable_sso=True))
97106

107+
def post(self, request):
108+
"""
109+
Initiates the OAuth2 flow and redirect the user agent to ADFS
110+
111+
Args:
112+
request (django.http.request.HttpRequest): A Django Request object
113+
"""
114+
return redirect(provider_config.build_authorization_endpoint(request, disable_sso=True))
115+
98116

99117
class OAuth2LoginForceMFA(View):
100118
def get(self, request):
@@ -106,6 +124,15 @@ def get(self, request):
106124
"""
107125
return redirect(provider_config.build_authorization_endpoint(request, force_mfa=True))
108126

127+
def post(self, request):
128+
"""
129+
Initiates the OAuth2 flow and redirect the user agent to ADFS
130+
131+
Args:
132+
request (django.http.request.HttpRequest): A Django Request object
133+
"""
134+
return redirect(provider_config.build_authorization_endpoint(request, force_mfa=True))
135+
109136

110137
class OAuth2LogoutView(View):
111138
def get(self, request):
@@ -117,3 +144,13 @@ def get(self, request):
117144
"""
118145
logout(request)
119146
return redirect(provider_config.build_end_session_endpoint())
147+
148+
def post(self, request):
149+
"""
150+
Logs out the user from both Django and ADFS
151+
152+
Args:
153+
request (django.http.request.HttpRequest): A Django Request object
154+
"""
155+
logout(request)
156+
return redirect(provider_config.build_end_session_endpoint())

‎docs/install.rst

Lines changed: 30 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -102,10 +102,33 @@ This will add these paths to Django:
102102
* ``/oauth2/callback`` where ADFS redirects back to after login. So make sure you set the redirect URI on ADFS to this.
103103
* ``/oauth2/logout`` which logs out the user from both Django and ADFS.
104104
105-
You can use them like this in your django templates:
106-
107-
.. code-block:: html
108-
109-
<a href="{% url 'django_auth_adfs:logout' %}">Logout</a>
110-
<a href="{% url 'django_auth_adfs:login' %}">Login</a>
111-
<a href="{% url 'django_auth_adfs:login-no-sso' %}">Login (no SSO)</a>
105+
Below is sample Django template code to use these paths depending if
106+
you'd like to use GET or POST requests. Logging out was deprecated in
107+
`Django 4.1 <https://docs.djangoproject.com/en/5.1/releases/4.1/#features-deprecated-in-4-1>`_.
108+
109+
- Using GET requests:
110+
111+
.. code-block:: html
112+
113+
<a href="{% url 'django_auth_adfs:logout' %}">Logout</a>
114+
<a href="{% url 'django_auth_adfs:login' %}">Login</a>
115+
<a href="{% url 'django_auth_adfs:login-no-sso' %}">Login (no SSO)</a>
116+
117+
- Using POST requests:
118+
119+
.. code-block:: html+django
120+
121+
<form method="post" action="{% url 'django_auth_adfs:logout' %}">
122+
{% csrf_token %}
123+
<button type="submit">Logout</button>
124+
</form>
125+
<form method="post" action="{% url 'django_auth_adfs:login' %}">
126+
{% csrf_token %}
127+
<input type="hidden" name="next" value="{{ next }}">
128+
<button type="submit">Login</button>
129+
</form>
130+
<form method="post" action="{% url 'django_auth_adfs:login-no-sso' %}">
131+
{% csrf_token %}
132+
<input type="hidden" name="next" value="{{ next }}">
133+
<button type="submit">Login (no SSO)</button>
134+
</form>

0 commit comments

Comments
 (0)