Settings

This document describes the Django settings that can be used to customize the configuration of mozilla-django-oidc.

OIDC_OP_AUTHORIZATION_ENDPOINT

Default:

No default

URL of your OpenID Connect provider authorization endpoint.

OIDC_OP_TOKEN_ENDPOINT

Default:

No default

URL of your OpenID Connect provider token endpoint

OIDC_OP_USER_ENDPOINT

Default:

No default

URL of your OpenID Connect provider userinfo endpoint

OIDC_RP_CLIENT_ID

Default:

No default

OpenID Connect client ID provided by your OP

OIDC_RP_CLIENT_SECRET

Default:

No default

OpenID Connect client secret provided by your OP

OIDC_VERIFY_JWT

Default:

True

Controls whether the OpenID Connect client verifies the signature of the JWT tokens

OIDC_VERIFY_KID

Default:

True

Controls whether the OpenID Connect client verifies the KID field of the JWT tokens

OIDC_USE_NONCE

Default:

True

Controls whether the OpenID Connect client uses nonce verification

OIDC_VERIFY_SSL

Default:

True

Controls whether the OpenID Connect client verifies the SSL certificate of the OP responses

OIDC_TIMEOUT

Default:

None

Defines a timeout for all requests to the OpenID Connect provider (fetch JWS, retrieve JWT tokens, Userinfo Endpoint). The default is set to None which means the library will wait indefinitely. The time can be defined as seconds (integer). More information about possible configuration values, see Python requests: https://requests.readthedocs.io/en/master/user/quickstart/#timeouts

OIDC_PROXY

Default:

None

Defines a proxy for all requests to the OpenID Connect provider (fetch JWS, retrieve JWT tokens, Userinfo Endpoint). The default is set to None which means the library will not use a proxy and connect directly. For configuring a proxy check the Python requests documentation: https://requests.readthedocs.io/en/master/user/advanced/#proxies

OIDC_EXEMPT_URLS

Default:

[]

This is a list of absolute url paths, regular expressions for url paths, or Django view names. This plus the mozilla-django-oidc urls are exempted from the session renewal by the SessionRefresh middleware.

OIDC_CREATE_USER

Default:

True

Enables or disables automatic user creation during authentication

OIDC_STATE_SIZE

Default:

32

Sets the length of the random string used for OpenID Connect state verification

OIDC_NONCE_SIZE

Default:

32

Sets the length of the random string used for OpenID Connect nonce verification

OIDC_MAX_STATES

Default:

50

Sets the maximum number of State / Nonce combinations stored in the session. Multiple combinations are used when the user does multiple concurrent login sessions.

OIDC_REDIRECT_FIELD_NAME

Default:

next

Sets the GET parameter that is being used to define the redirect URL after succesful authentication

OIDC_CALLBACK_CLASS

Default:

mozilla_django_oidc.views.OIDCAuthenticationCallbackView

Allows you to substitute a custom class-based view to be used as OpenID Connect callback URL.

Note

When using a custom callback view, it is generally a good idea to subclass the default OIDCAuthenticationCallbackView and override the methods you want to change.

OIDC_AUTHENTICATE_CLASS

Default:

mozilla_django_oidc.views.OIDCAuthenticationRequestView

Allows you to substitute a custom class-based view to be used as OpenID Connect authenticate URL.

Note

When using a custom authenticate view, it is generally a good idea to subclass the default OIDCAuthenticationRequestView and override the methods you want to change.

OIDC_RP_SCOPES

Default:

openid email

The OpenID Connect scopes to request during login.

Warning

When using custom scopes consider overriding the claim verification method since the default one only works for the default mozilla-django-oidc configuration.

OIDC_STORE_ACCESS_TOKEN

Default:

False

Controls whether the OpenID Connect client stores the OIDC access_token in the user session. The session key used to store the data is oidc_access_token.

By default we want to store as few credentials as possible so this feature defaults to False and it’s use is discouraged.

Warning

This feature stores authentication information in the session. If used in combination with Django’s cookie-based session backend, those tokens will be visible in the browser’s cookie store.

OIDC_STORE_ID_TOKEN

Default:

False

Controls whether the OpenID Connect client stores the OIDC id_token in the user session. The session key used to store the data is oidc_id_token.

OIDC_AUTH_REQUEST_EXTRA_PARAMS

Default:

{}

Additional parameters to include in the initial authorization request.

OIDC_RP_SIGN_ALGO

Default:

HS256

Sets the algorithm the IdP uses to sign ID tokens.

OIDC_RP_IDP_SIGN_KEY

Default:

None

Sets the key the IdP uses to sign ID tokens in the case of an RSA sign algorithm. Should be the signing key in PEM or DER format.

LOGIN_REDIRECT_URL

Default:

/accounts/profile

Path to redirect to on successful login. If you don’t specify this, the default Django value will be used.

See also

https://docs.djangoproject.com/en/stable/ref/settings/#login-redirect-url

LOGIN_REDIRECT_URL_FAILURE

Default:

/

Path to redirect to on an unsuccessful login attempt.

LOGOUT_REDIRECT_URL

Default:

None

After the logout view has logged the user out, it redirects to this url path.

See also

https://docs.djangoproject.com/en/stable/ref/settings/#logout-redirect-url

OIDC_OP_LOGOUT_URL_METHOD

Default:

'' (will use LOGOUT_REDIRECT_URL)

Function path that returns a URL to redirect the user to after auth.logout() is called.

Changed in version 0.7.0: The function must now take a request parameter.

OIDC_AUTHENTICATION_CALLBACK_URL

Default:

oidc_authentication_callback

URL pattern name for OIDCAuthenticationCallbackView. Will be passed to reverse. The pattern can also include namespace in order to resolve included urls.

See also

https://docs.djangoproject.com/en/stable/topics/http/urls/#url-namespaces

OIDC_ALLOW_UNSECURED_JWT

Default:

False

Controls whether the authentication backend is going to allow unsecured JWT tokens (tokens with header {"alg":"none"}). This needs to be set to True if OP is returning unsecured JWT tokens and RP wants to accept them.

See also

https://tools.ietf.org/html/rfc7519#section-6

OIDC_TOKEN_USE_BASIC_AUTH

Default:

False

Use HTTP Basic Authentication instead of sending the client secret in token request POST body.

ALLOW_LOGOUT_GET_METHOD

Default:

False

Allow using GET method to logout user