Django rest framework working with django oauth toolkit

Question

I'm creating an API using Django rest framework and I'm adding oauth2 authentication. I was able to set it up correctly and I can get the token to access my API end points. So far everything good.

My question now is how to be a bit more selective in what is protected and what is public. In my API there is a subset of end points that can be accessed by everybody so that they are anonymous users and they can't get the access token in the same way because username and password doesn't exists.

Here is the related content in my settings.py:

OAUTH2_PROVIDER = {
    # this is the list of available scopes
    'SCOPES': {
        'read': 'Read scope',
        'write': 'Write scope',
        'groups': 'Access to your groups'
    }
}

REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': (
        'oauth2_provider.ext.rest_framework.OAuth2Authentication',
    ),
    'DEFAULT_PERMISSION_CLASSES': (
        'rest_framework.permissions.IsAdminUser',
    ),
    'PAGE_SIZE': 10
}
INSTALLED_APPS = (
    ...
    'oauth2_provider',
    'rest_framework',
    ...
)

views.py:

# Everything fine for this end point
class PrivateViewSet(viewsets.ModelViewSet):
    serializer_class = custom_serializers.MySerializer
    http_method_names = ['get', 'post', 'head', 'options']
    permission_classes = (permissions.IsAuthenticated, custom_permissions.IsAdminOrOwner, TokenHasReadWriteScope)

# Getting the error
class PublicViewSet(viewsets.ModelViewSet):
    serializer_class = custom_serializers.MyPublicSerializer
    permission_classes = (permissions.AllowAny,)

So when I try to access to "PublicViewSet" end point I get the following error:

{"detail": "Authentication credentials were not provided."}

Is there a way to decide to which end points to apply the oauth2 authorization and keep others open publicly?

Muhammad Hassan · Accepted Answer · 2017-08-02 13:31:32Z

1

You are not been able to access the PublicViewSet endpoint because it is looking for the token in the setting you provided the DEFAULT_AUTHENTICATION_CLASSES. It follows the classes. To avoid this in the view you need to pass an empty authentication_classes.

class PublicViewSet(viewsets.ModelViewSet):
    serializer_class = custom_serializers.MyPublicSerializer
    authentication_classes = ()
    permission_classes = (permissions.AllowAny,)

edited Aug 2, 2017 at 13:31

Muhammad Hassan

14.5k7 gold badges37 silver badges55 bronze badges

answered Aug 22, 2015 at 17:45

Seenu S

3,5016 gold badges34 silver badges46 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

alexis Over a year ago

Thanks a lot for you reply. I also found a workaround to have more than one authentication class by default by adding it like this in the settings.py

'DEFAULT_AUTHENTICATION_CLASSES': (         'rest_framework.authentication.BasicAuthentication',         'oauth2_provider.ext.rest_framework.OAuth2Authentication',     ),

Then in combination with the permission_classes I could get it working.

Collectives™ on Stack Overflow

Django rest framework working with django oauth toolkit

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related