oauth2 flow about drf-yasg HOT 20 CLOSED

Hi. I've worked through this problem and have came up with a basic SWAGGER_SETTINGS for anyone having issues to reference.

This example works on a local server that is doing both authenticating and authorizing. It works on Django 2.0.

https://github.com/Vigrond/django_oauth2_example

from drf-yasg.

I'm going to close this issue. Please do report back with any further findings, and meanwhile I'm going to look into making the redirect url configurable (and also allowing arbitrary configuration variables), maybe even make the templates extensible.

from drf-yasg.

Hello @andruten

Sadly I have no idea about OAuth, so I don't think I can help you very much.

Have you tried watching the Network tab in the browser to see what goes wrong?

Could it be that the missing piece of your puzzle is the redirect URI? (https://github.com/swagger-api/swagger-ui/blob/master/docs/usage/configuration.md#network) - if it's this, there is currently no way to set it, but you could temporarily edit the swagger-ui-init.js static file of this app in order to add it and see if it helps anything:

var swaggerConfig = {
    oauth2RedirectUrl: '*correct url here*',
    url: specURL,
    dom_id: '#swagger-ui',
    displayOperationId: true,
    .
    .
    .

If that does not help, I really have no idea. You could try searching just for "swagger-ui oauth2" problems, since the issue is probably only loosely related to this library.

from drf-yasg.

Thank you so much @axnsan12. I'll take a look and i'll let you know!

from drf-yasg.

Have you had any success with this?

from drf-yasg.

Nope, it didn't work.

Finally, i changed the SWAGGER_SETTINGS to this:

SWAGGER_SETTINGS = {
    "USE_SESSION_AUTH": False,
    "SECURITY_DEFINITIONS": {
        "api_key": {
            "type": "apiKey",
            "name": "access_token",
            "in": "header"
        },
        "google_oauth": {
            "type": "oauth2",
            "authorizationUrl": "http://127.0.0.1:8000/auth/login/google-oauth2",
            "tokenUrl": "http://localhost:8000/auth/token",
            "flow": "accessCode",
        }
    }
}

And the current flow is
GET /auth/login/google-oauth2?response_type=code&client_id={client_id}&redirect_uri=http%3A%2F%2Flocalhost%3A3200%2Foauth2-redirect.html&state={state}
GET /auth/login/google-oauth2/?response_type=code&client_id={client_id}&redirect_uri=http%3A%2F%2Flocalhost%3A3200%2Foauth2-redirect.html&state={state}
GET /auth/complete/google-oauth2/?state={state}&code={code}

There is a parameter called redirect_uri with http://localhost:3200/oauth2-redirect.html value but that template it's not exposed in my project.

And i'm stucked there. Do you have any clues?

Thank you :).

from drf-yasg.

Yes, that looks like what I said above. It's not currently exposed, so I'd have to ask you to try and modify it in the library files (in your site-packages😱), just to see if it works/has the desired effect.

If that is the case, we can work out a way to make it configurable from client code.

from drf-yasg.

Ok, i'll do it and i'll tell you 💪 .

Thank you!

from drf-yasg.

This might also be relevant: https://github.com/swagger-api/swagger-ui/blob/master/docs/usage/oauth2.md

🤔

from drf-yasg.

Hmmmm, interesting. Where is that class creation?

from drf-yasg.

My guess would be that you'd add it here:

from drf-yasg.

ok, i'll have a try!

from drf-yasg.

The problem is http://localhost:3200/oauth2-redirect.html or http://localhost:8000/oauth2-redirect.html aren't exposed either. What can i expose that url? directly in my urls.py file and creating a view?

from drf-yasg.

Anyway, it didn't worked as expected. I can see the redirections but /oauth2-redirect.html is not beign reached in the flow.

from drf-yasg.

Well, I don't know. So you have your OAuth otherwise working? I would think this is part of the normal usage.

My guess would be that you have to create an endpoint on your server which gets called by Google when someone successfully authenticates. Google's oauth documentation would probably help.

from drf-yasg.

Yes, i think i'll do that. Thank you for your help :).

from drf-yasg.

Thank you @Vigrond!

from drf-yasg.

Hello @Vigrond, that looks great! Would you mind if I included your sample into the documentation? See #90.

from drf-yasg.

@axnsan12 looks good! thanks for the ref!

from drf-yasg.

@axnsan12 you may want to include a note to ensure their application's redirect_url is specified to swagger's static url. (/static/drf-yasg/swagger-ui-dist/oauth2-redirect.html) or they'll get a mismatched redirect error

from drf-yasg.