You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airavata.apache.org by ma...@apache.org on 2021/03/24 21:43:43 UTC
[airavata-django-portal] branch develop updated: Automatically set
OAUTHLIB_INSECURE_TRANSPORT for local dev
This is an automated email from the ASF dual-hosted git repository.
machristie pushed a commit to branch develop
in repository https://gitbox.apache.org/repos/asf/airavata-django-portal.git
The following commit(s) were added to refs/heads/develop by this push:
new f28c747 Automatically set OAUTHLIB_INSECURE_TRANSPORT for local dev
f28c747 is described below
commit f28c747712eb8e2772b29b607574278b20cc6299
Author: Marcus Christie <ma...@apache.org>
AuthorDate: Wed Mar 24 17:43:24 2021 -0400
Automatically set OAUTHLIB_INSECURE_TRANSPORT for local dev
---
Dockerfile | 1 -
README.md | 8 --------
django_airavata/apps/auth/backends.py | 7 +++++++
3 files changed, 7 insertions(+), 9 deletions(-)
diff --git a/Dockerfile b/Dockerfile
index 684d6de..8e4fd4e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -58,7 +58,6 @@ RUN yarn run build
FROM python:3.8 as server-stage
ENV PYTHONUNBUFFERED 1
-ENV OAUTHLIB_INSECURE_TRANSPORT 1
EXPOSE 8000
diff --git a/README.md b/README.md
index d8d058a..7667dd5 100644
--- a/README.md
+++ b/README.md
@@ -79,14 +79,6 @@ information on how to install yarn.
python manage.py runserver
```
- - Note: if you want to use OpenID Connect authentication from the Django
- Portal when running it locally, you'll need to first set the following
- environment to allow OAuth over insecure HTTP:
-
- ```
- export OAUTHLIB_INSECURE_TRANSPORT=1
- ```
-
7. Point your browser to http://localhost:8000.
## Docker instructions
diff --git a/django_airavata/apps/auth/backends.py b/django_airavata/apps/auth/backends.py
index 3cdc406..b21afc8 100644
--- a/django_airavata/apps/auth/backends.py
+++ b/django_airavata/apps/auth/backends.py
@@ -1,5 +1,6 @@
"""Django Airavata Auth Backends: KeycloakBackend."""
import logging
+import os
import time
import requests
@@ -130,6 +131,12 @@ class KeycloakBackend(object):
verify = verify_ssl
if verify_ssl and hasattr(settings, 'KEYCLOAK_CA_CERTFILE'):
verify = settings.KEYCLOAK_CA_CERTFILE
+ if not request.is_secure() and settings.DEBUG and not os.environ.get('OAUTHLIB_INSECURE_TRANSPORT'):
+ # For local development (DEBUG=True), allow insecure OAuth redirect flow
+ # if OAUTHLIB_INSECURE_TRANSPORT isn't already set
+ os.environ['OAUTHLIB_INSECURE_TRANSPORT'] = "1"
+ logger.info("Adding env var OAUTHLIB_INSECURE_TRANSPORT=1 to allow "
+ "OAuth redirect flow even though request is not secure")
token = oauth2_session.fetch_token(
token_url, client_secret=client_secret,
authorization_response=authorization_code_url, verify=verify)