Django Rest Framework {"detail":"Authentication credentials were not provided."}

Question

I have tried to add authentication to my Rest API using OAuth Toolkit. I get to the login page and enter in my username and password then redirect to my api. I then get a message {"detail":"Authentication credentials were not provided."} I have tried looking into this and most people who have the problem seem to have missed something out of the Rest_Framework settings. I dont think I have though.

Heres my code:

Settings.py

LOGIN_REDIRECT_URL = '/api/users/'

REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': (
        'rest_framework.authentication.TokenAuthentication',
        'oauth2_provider.ext.rest_framework.OAuth2Authentication',
    ),
    'DEFAULT_PERMISSION_CLASSES': (
        'rest_framework.permissions.IsAdminUser',
    ),
    'DEFAULT_RENDERER_CLASSES': (
        'rest_framework.renderers.JSONRenderer',
    ),
    'DEFAULT_PARSER_CLASSES': (
        'rest_framework.parsers.JSONParser',
    ),
}

url.py

urlpatterns = patterns('', url(r'^admin/', include(admin.site.urls)),
                       url(r'^accounts/login/$', auth_views.login, {'template_name': 'login.html'}),

                       url(r'^api-auth/', include('rest_framework.urls', namespace='rest_framework')),
                       url(r'^api-token-auth/', 'rest_framework.authtoken.views.obtain_auth_token'),
                       url(r'^o/', include('oauth2_provider.urls', namespace='oauth2_provider')),

                       url(r'^api/users/$', api.UserList.as_view()),
                       url(r'^api/users/(?P<pk>[0-9+]+)/$', api.UserDetail.as_view()),
                       )

api.py

@receiver(post_save, sender=User)
def init_new_user(sender, instance, signal, created, **kwargs):
    if created:
        Token.objects.create(user=instance)


class APIEndpoint(ProtectedResourceView):
    def get(self, request, *args, **kwargs):
        return HttpResponse('Protected with OAuth2!')


class UserViewSet(viewsets.ModelViewSet):
    model = User
    serializer_class = UserSerializer

    def retrieve(self, request, pk=None):
        if pk == 'me':
            return Response(UserSerializer(request.user).data)
        return super(UserViewSet, self).retrieve(request, pk)


class UserList(generics.ListCreateAPIView):
    queryset = User.objects.all()
    serializer_class = UserSerializer


class UserDetail(generics.RetrieveUpdateDestroyAPIView):
    queryset = User.objects.all()
    serializer_class = UserSerializer

Answer 1

In my case token authentication was working fine on development server and not on Apache. The reason was exactly the missing WSGIPassAuthorization On

http://www.django-rest-framework.org/api-guide/authentication/#apache-mod_wsgi-specific-configuration

Answer 2

see your settings.py, if you have

'DEFAULT_PERMISSION_CLASSES': (
    'rest_framework.permissions.IsAuthenticated',
),

in REST_FRAMEWORK like this, it will Authenticate each time when you post.

REST_FRAMEWORK = {
'DEFAULT_PERMISSION_CLASSES': (
    'rest_framework.permissions.IsAuthenticated',
),
'DEFAULT_AUTHENTICATION_CLASSES': (
    'rest_framework.authentication.TokenAuthentication',
)}

so, delete it.