Django Azure AD 集成

Question

我目前正在使用 Azure AD 将 SSO 集成到 Django 项目中。我目前正在使用的包:https://github.com/leibowitz/django-azure-ad-auth 。我已按照文档设置 Azure AD 身份验证 。输入应用程序 URL 后，它会将我带到 Microsoft 登录页面，输入凭据后，它会重定向到应用程序。但在 Azure 身份验证后重定向到应用程序时，代码会在 session 中检查“nonce”和“state”变量，这些变量奇怪地返回为“None”，因此应用程序重定向到失败 URL。

@never_cache
def auth(request):
    backend = AzureActiveDirectoryBackend()
    redirect_uri = request.build_absolute_uri(reverse(complete))
    nonce = str(uuid.uuid4())
    request.session['nonce'] = nonce
    state = str(uuid.uuid4())
    request.session['state'] = state
    login_url = backend.login_url(
        redirect_uri=redirect_uri,
        nonce=nonce,
        state=state
    )
    return HttpResponseRedirect(login_url)


@never_cache
@csrf_exempt
def complete(request):
    backend = AzureActiveDirectoryBackend()
    method = 'GET' if backend.RESPONSE_MODE == 'fragment' else 'POST'
    original_state = request.session.get('state')
    state = getattr(request, method).get('state')
    if original_state == state:
        token = getattr(request, method).get('id_token')
        nonce = request.session.get('nonce')
        user = backend.authenticate(token=token, nonce=nonce)
        if user is not None:
            login(request, user)
            return HttpResponseRedirect(get_login_success_url(request))
    return HttpResponseRedirect('failure')

这是用于身份验证的代码。

Settings.py 示例如下:

AUTHENTICATION_BACKENDS = (
    'django.contrib.auth.backends.ModelBackend',
    'azure_ad_auth.backends.AzureActiveDirectoryBackend',
)

LOGIN_REDIRECT_URL = '/login_successful/'

AAD_TENANT_ID = 'd472b4f4-95c5-4eb3-8a9a-3615c837eada'
AAD_CLIENT_ID = '75e38b53-8174-4dc6-a8f6-bb7a913f1565'

SESSION_EXPIRE_AT_BROWSER_CLOSE = True
SESSION_SAVE_EVERY_REQUEST = True
SESSION_COOKIE_AGE = 86400 # sec
SESSION_COOKIE_DOMAIN = None
SESSION_COOKIE_NAME = 'DSESSIONID'
SESSION_COOKIE_SECURE = True

回溯

TypeError at /TypeError at /project/azure/complete/
must be str, not NoneType
Request Method: POST
Request URL:    http://testdomain.com/project/azure/complete/
Django Version: 2.2.4
Exception Type: TypeError
Exception Value:    
must be str, not NoneType
Exception Location: /home/project/azure_auth/views.py in complete, line 57
Python Executable:  /home/project/app/venv/bin/python3
Python Version: 3.6.8
Python Path:    
['/home/project/app/project',
 '/home/project/app/venv/bin',
 '/home/project/app/venv/lib64/python36.zip',
 '/home/project/app/venv/lib64/python3.6',
 '/home/project/app/venv/lib64/python3.6/lib-dynload',
 '/usr/lib64/python3.6',
 '/usr/lib/python3.6',
 '/home/project/app/venv/lib/python3.6/site-packages']
Server time:    Tue, 19 Nov 2019 05:21:10 +0000/azure/complete/
must be str, not NoneType
Request Method: POST
Request URL:    http://testdomain.com/project/azure/complete/
Django Version: 2.2.4
Exception Type: TypeError
Exception Value:    
must be str, not NoneType
Exception Location: /home/project/app/project/azure_auth/views.py in complete, line 57
Python Executable:  /home/project/app/venv/bin/python3
Python Version: 3.6.8
Python Path:    
['/home/project/app/project',
 '/home/project/app/venv/bin',
 '/home/project/app/venv/lib64/python36.zip',
 '/home/project/app/venv/lib64/python3.6',
 '/home/project/app/venv/lib64/python3.6/lib-dynload',
 '/usr/lib64/python3.6',
 '/usr/lib/python3.6',
 '/home/project/app/venv/lib/python3.6/site-packages']
Server time:    Tue, 19 Nov 2019 05:21:10 +0000


/home/project/app/project/azure_auth/views.py in complete
            f.write("nonce -->"+nonce+"\n") …
▼ Local vars
Variable    Value
backend 
<azure_auth.backends.AzureActiveDirectoryBackend object at 0x7f5c688dce80>
data    
['82aff4f9-2cc0-4521-aea7-ad3281d20774\n',
 'ba821364-86c9-4233-881f-bdc772f7c488\n']
f   
<_io.TextIOWrapper name='t1.txt' mode='w' encoding='UTF-8'>
method  
'POST'
n   
'82aff4f9-2cc0-4521-aea7-ad3281d20774'
nonce   
None
original_state  
None
request 
<WSGIRequest: POST '/project/azure/complete/'>
state   
'fd93da6a-9009-4363-9640-9364df7f64df'
token   
'eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6IkJCOENlRlZxeWFHckdOdWVoSklpTDRkZmp6dyIsImtpZCI6IkJCOENlRlZxeWFHckdOdWVoSklpTDRkZmp6dyJ9.eyJhdWQiOiI0MDMyODJjZi1kYjlmLTQ1OTYtOWM1My0wMmI1MTA2ZDA0MDIiLCJpc3MiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC9mYmM0OTNhOC0wZDI0LTQ0NTQtYTgxNS1mNGNhNThlOGMwOWQvIiwiaWF0IjoxNTc0MTQwNTY5LCJuYmYiOjE1NzQxNDA1NjksImV4cCI6MTU3NDE0NDQ2OSwiYWlvIjoiNDJWZ1lCQSt4TFhqNEdVTjRRWEJiU3ZOZmF4NXBHY2NPenFoNzFuNDlXMmxnYTYzMjIwQiIsImFtciI6WyJwd2QiXSwiZmFtaWx5X25hbWUiOiJFIEsgUyIsImdpdmVuX25hbWUiOiJTdXNyZWV0aGEiLCJpbl9jb3JwIjoidHJ1ZSIsImlwYWRkciI6IjE4Mi43NS4xNjcuMTg4IiwibmFtZSI6IkUgSyBTLFN1c3JlZXRoYSIsIm5vbmNlIjoiODgyNTg4ZjgtMGM3MC00Y2JlLTk4MTktY2JkNjUyZmI0MDQ5Iiwib2lkIjoiNTU0ZjYzZWEtOTg4Yi00MmMwLTk4NjUtMTIxMDNkZTdhZTBmIiwib25wcmVtX3NpZCI6IlMtMS01LTIxLTYwMzE5MzI1LTExNjA5ODI5NTEtMTYwMTc3MzkwNy02NTg1OTMiLCJzdWIiOiI2aERUa1hYYkN3Wm5rcHEwSU9wRTRVWk56RHZlRFhvVjM3RGV5U3dkaDZRIiwidGlkIjoiZmJjNDkzYTgtMGQyNC00NDU0LWE4MTUtZjRjYTU4ZThjMDlkIiwidW5pcXVlX25hbWUiOiJTRTA3NTA0OEBjZXJuZXIubmV0IiwidXBuIjoiU0UwNzUwNDhAY2VybmVyLm5ldCIsInV0aSI6IkZTQmhnVDg4UTAyUHNfU293ZDdtQUEiLCJ2ZXIiOiIxLjAifQ.Rvc6xcPRZ01iebYtEyAWeyDnQEUVtqV1L1mapr658jLog-_yIASyEm3kMrkt6dIWWEO3dJSe3k05xOJlbnHqcjaR5LKAwOZzGR_oBmyIyB8-IvuEankNVpwYtcz8mY7kFr6AqQmIsx7xLLgv4grp-bSy4eRqjk36VeLX_LwMBuM_U6V70w0gXN1vvFCj0tjsv-VtTAmNgvdxS0ltzdD3rzZ87DoXbPWmoozLtO9WBRsJvMuvn-frBtYUYkIhs3I-eVAO9ZG2IWEuLQx6k7RBmzX6HgFi9SVpyEhNru7fmwO-qj5uRj9FQa45lCZluUV25o_AV1NQ94d5lnFyeMh7uw'
user    
None

我在尝试将 session 变量写入文件(用于调试)时遇到上述错误。

Answer 1

我知道这个问题有点老了，但是 session 将无法被检索(以及原始状态和随机数)，并且如果浏览器没有发送 cookie，则比较将失败。

在 django 2.1+ 中默认不发送 cookie，因为默认设置添加 SameSite=Lax

The cookies used for django.contrib.sessions, django.contrib.messages, and Django’s CSRF protection now set the SameSite flag to Lax by default. Browsers that respect this flag won’t send these cookies on cross-origin requests. If you rely on the old behavior, set the SESSION_COOKIE_SAMESITE and/or CSRF_COOKIE_SAMESITE setting to None.

https://docs.djangoproject.com/en/3.0/releases/2.1/#samesite-cookies

理论上，这仍然应该发送 cookie ( from what I understand )，但由于某种原因 chrome 似乎不会发送。有一些我显然不明白的地方，所以如果有人知道更好的请评论。

无论如何，通过 SESSION_COOKIE_SAMESITE = None 更改设置应该可以。